From ec620b28dec36630d96960c62628d28078ac07f6 Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Fri, 12 Apr 2024 16:39:01 +0800 Subject: [PATCH] wifi: mac80211: fix race condition on enabling fast-xmit stable inclusion from stable-v5.10.211 commit 5ffab99e070b9f8ae0cf60c3c3602b84eee818dd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2MI CVE: CVE-2024-26779 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5ffab99e070b9f8ae0cf60c3c3602b84eee818dd -------------------------------- [ Upstream commit bcbc84af1183c8cf3d1ca9b78540c2185cd85e7f ] fast-xmit must only be enabled after the sta has been uploaded to the driver, otherwise it could end up passing the not-yet-uploaded sta via drv_tx calls to the driver, leading to potential crashes because of uninitialized drv_priv data. Add a missing sta->uploaded check and re-check fast xmit after inserting a sta. Signed-off-by: Felix Fietkau Link: https://msgid.link/20240104181059.84032-1-nbd@nbd.name Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin Signed-off-by: Ziyang Xuan (cherry picked from commit 57c75fe6c2ac905745d59dab56e75da176d0e972) --- net/mac80211/sta_info.c | 2 ++ net/mac80211/tx.c | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c index 2e84360990f0..44bd03c6b847 100644 --- a/net/mac80211/sta_info.c +++ b/net/mac80211/sta_info.c @@ -700,6 +700,8 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU) if (ieee80211_vif_is_mesh(&sdata->vif)) mesh_accept_plinks_update(sdata); + ieee80211_check_fast_xmit(sta); + return 0; out_remove: sta_info_hash_del(local, sta); diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c index bbbcc678c655..ef8bb5dfd110 100644 --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -2958,7 +2958,7 @@ void ieee80211_check_fast_xmit(struct sta_info *sta) sdata->vif.type == NL80211_IFTYPE_STATION) goto out; - if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED)) + if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED) || !sta->uploaded) goto out; if (test_sta_flag(sta, WLAN_STA_PS_STA) || -- Gitee