wifi: mac80211: fix race condition on enabling fast-xmit

stable inclusion
from stable-v4.19.308
commit 76fad1174a0cae6fc857b9f88b261a2e4f07d587
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2MI


CVE: CVE-2024-26779

--------------------------------

[ Upstream commit bcbc84af1183c8cf3d1ca9b78540c2185cd85e7f ]

fast-xmit must only be enabled after the sta has been uploaded to the driver,
otherwise it could end up passing the not-yet-uploaded sta via drv_tx calls
to the driver, leading to potential crashes because of uninitialized drv_priv
data.
Add a missing sta->uploaded check and re-check fast xmit after inserting a sta.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
Link: https://msgid.link/20240104181059.84032-1-nbd@nbd.name


Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>