diff options
| author | Felix Fietkau <nbd@nbd.name> | 2024-03-16 08:43:36 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-04-03 15:11:48 +0200 |
| commit | 2884a50f52313a7a911de3afcad065ddbb3d78fc (patch) | |
| tree | 8760be4641d99a41a995189c1d10c21e501e3d55 | |
| parent | 744cad9ef73d23b729ac0f2a14171b88c5b4f5ad (diff) | |
| download | linux-stable-2884a50f52313a7a911de3afcad065ddbb3d78fc.tar.gz linux-stable-2884a50f52313a7a911de3afcad065ddbb3d78fc.tar.bz2 linux-stable-2884a50f52313a7a911de3afcad065ddbb3d78fc.zip | |
wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes
commit 4f2bdb3c5e3189297e156b3ff84b140423d64685 upstream.
When moving a station out of a VLAN and deleting the VLAN afterwards, the
fast_rx entry still holds a pointer to the VLAN's netdev, which can cause
use-after-free bugs. Fix this by immediately calling ieee80211_check_fast_rx
after the VLAN change.
Cc: stable@vger.kernel.org
Reported-by: ranygh@riseup.net
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Link: https://msgid.link/20240316074336.40442-1-nbd@nbd.name
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | net/mac80211/cfg.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c index 594cd45b9d2d..ebaf930bb4c9 100644 --- a/net/mac80211/cfg.c +++ b/net/mac80211/cfg.c @@ -2164,15 +2164,14 @@ static int ieee80211_change_station(struct wiphy *wiphy, } if (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && - sta->sdata->u.vlan.sta) { - ieee80211_clear_fast_rx(sta); + sta->sdata->u.vlan.sta) RCU_INIT_POINTER(sta->sdata->u.vlan.sta, NULL); - } if (test_sta_flag(sta, WLAN_STA_AUTHORIZED)) ieee80211_vif_dec_num_mcast(sta->sdata); sta->sdata = vlansdata; + ieee80211_check_fast_rx(sta); ieee80211_check_fast_xmit(sta); if (test_sta_flag(sta, WLAN_STA_AUTHORIZED)) { |