Commit b06eeb16 authored May 27, 2024 by Felix Fietkau Committed by Liu Jian May 27, 2024

wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes

stable inclusion
from stable-v5.10.215
commit e8b067c4058c0121ac8ca71559df8e2e08ff1a7e
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q8YT
CVE: CVE-2024-35789

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e8b067c4058c0121ac8ca71559df8e2e08ff1a7e



---------------------------

commit 4f2bdb3c5e3189297e156b3ff84b140423d64685 upstream.

When moving a station out of a VLAN and deleting the VLAN afterwards, the
fast_rx entry still holds a pointer to the VLAN's netdev, which can cause
use-after-free bugs. Fix this by immediately calling ieee80211_check_fast_rx
after the VLAN change.

Cc: stable@vger.kernel.org
Reported-by:  <ranygh@riseup.net>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Link: https://msgid.link/20240316074336.40442-1-nbd@nbd.name


Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Liu Jian <liujian56@huawei.com>

parent f300accf

net/mac80211/cfg.c

+2 −3

Original line number	Diff line number	Diff line
		@@ -1814,15 +1814,14 @@ static int ieee80211_change_station(struct wiphy *wiphy,
		}

		if (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
		sta->sdata->u.vlan.sta) {
		ieee80211_clear_fast_rx(sta);
		sta->sdata->u.vlan.sta)
		RCU_INIT_POINTER(sta->sdata->u.vlan.sta, NULL);
		}

		if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
		ieee80211_vif_dec_num_mcast(sta->sdata);

		sta->sdata = vlansdata;
		ieee80211_check_fast_rx(sta);
		ieee80211_check_fast_xmit(sta);

		if (test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {