Commit 4f2bdb3c authored by Felix Fietkau's avatar Felix Fietkau Committed by Johannes Berg
Browse files

wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes 



When moving a station out of a VLAN and deleting the VLAN afterwards, the
fast_rx entry still holds a pointer to the VLAN's netdev, which can cause
use-after-free bugs. Fix this by immediately calling ieee80211_check_fast_rx
after the VLAN change.

Cc: stable@vger.kernel.org
Reported-by: default avatar <ranygh@riseup.net>
Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
Link: https://msgid.link/20240316074336.40442-1-nbd@nbd.name


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 27f8f108

net/mac80211/cfg.c

+2 −3
Original line number Diff line number Diff line
@@ -2199,15 +2199,14 @@ static int ieee80211_change_station(struct wiphy *wiphy, 
		}



		if (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&

		    sta->sdata->u.vlan.sta) {

			ieee80211_clear_fast_rx(sta);

		    sta->sdata->u.vlan.sta)

			RCU_INIT_POINTER(sta->sdata->u.vlan.sta, NULL);

		}



		if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))

			ieee80211_vif_dec_num_mcast(sta->sdata);



		sta->sdata = vlansdata;

		ieee80211_check_fast_rx(sta);

		ieee80211_check_fast_xmit(sta);



		if (test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {