mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-27 21:03:32 +00:00
Code Issues Releases Wiki Activity

wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes

Browse source 
commit 4f2bdb3c5e upstream.

When moving a station out of a VLAN and deleting the VLAN afterwards, the
fast_rx entry still holds a pointer to the VLAN's netdev, which can cause
use-after-free bugs. Fix this by immediately calling ieee80211_check_fast_rx
after the VLAN change.

Cc: stable@vger.kernel.org
Reported-by: ranygh@riseup.net
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Link: https://msgid.link/20240316074336.40442-1-nbd@nbd.name
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Felix Fietkau 2024-03-16 08:43:36 +01:00 committed by Greg Kroah-Hartman
parent 34ca809e05
commit e8678551c0
1 changed files with 2 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
net/mac80211/cfg.c
View file

@ -2164,15 +2164,14 @@ static int ieee80211_change_station(struct wiphy *wiphy,
} }
if (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && if (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
sta->sdata->u.vlan.sta) { sta->sdata->u.vlan.sta)
ieee80211_clear_fast_rx(sta);
RCU_INIT_POINTER(sta->sdata->u.vlan.sta, NULL); RCU_INIT_POINTER(sta->sdata->u.vlan.sta, NULL);
}
if (test_sta_flag(sta, WLAN_STA_AUTHORIZED)) if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
ieee80211_vif_dec_num_mcast(sta->sdata); ieee80211_vif_dec_num_mcast(sta->sdata);
sta->sdata = vlansdata; sta->sdata = vlansdata;
ieee80211_check_fast_rx(sta);
ieee80211_check_fast_xmit(sta); ieee80211_check_fast_xmit(sta);
if (test_sta_flag(sta, WLAN_STA_AUTHORIZED)) { if (test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {