Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 85720b69 authored by Felix Fietkau's avatar Felix Fietkau Committed by Greg Kroah-Hartman
Browse files

wifi: mac80211: fix race condition on enabling fast-xmit 



[ Upstream commit bcbc84af1183c8cf3d1ca9b78540c2185cd85e7f ]

fast-xmit must only be enabled after the sta has been uploaded to the driver,
otherwise it could end up passing the not-yet-uploaded sta via drv_tx calls
to the driver, leading to potential crashes because of uninitialized drv_priv
data.
Add a missing sta->uploaded check and re-check fast xmit after inserting a sta.

Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
Link: https://msgid.link/20240104181059.84032-1-nbd@nbd.name


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent d3032de2

net/mac80211/sta_info.c

+2 −0
Original line number Diff line number Diff line
@@ -683,6 +683,8 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU) 
	if (ieee80211_vif_is_mesh(&sdata->vif))

		mesh_accept_plinks_update(sdata);



	ieee80211_check_fast_xmit(sta);



	return 0;

 out_remove:

	sta_info_hash_del(local, sta);

net/mac80211/tx.c

+1 −1
Original line number Diff line number Diff line
@@ -2919,7 +2919,7 @@ void ieee80211_check_fast_xmit(struct sta_info *sta) 
	    sdata->vif.type == NL80211_IFTYPE_STATION)

		goto out;



	if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED))

	if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED) || !sta->uploaded)

		goto out;



	if (test_sta_flag(sta, WLAN_STA_PS_STA) ||