[openwrt/openwrt] mac80211: fix a crash triggered by sta disconnect with per-sta VLANs

[LEDE Commits]

nbd pushed a commit to openwrt/openwrt.git, branch main:
https://git.openwrt.org/dea42f67ab06a8f2c1e6338f9829d31a28642317

commit dea42f67ab06a8f2c1e6338f9829d31a28642317
Author: Felix Fietkau <nbd at nbd.name>
AuthorDate: Sat Mar 16 08:50:05 2024 +0100

    mac80211: fix a crash triggered by sta disconnect with per-sta VLANs
    
    Reported-by: ranygh at riseup.net
    Signed-off-by: Felix Fietkau <nbd at nbd.name>
---
 ...11-check-clear-fast-rx-for-non-4addr-sta-.patch | 35 ++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/package/kernel/mac80211/patches/subsys/332-wifi-mac80211-check-clear-fast-rx-for-non-4addr-sta-.patch b/package/kernel/mac80211/patches/subsys/332-wifi-mac80211-check-clear-fast-rx-for-non-4addr-sta-.patch
new file mode 100644
index 0000000000..02b4345f21
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/332-wifi-mac80211-check-clear-fast-rx-for-non-4addr-sta-.patch
@@ -0,0 +1,35 @@
+From: Felix Fietkau <nbd at nbd.name>
+Date: Sat, 16 Mar 2024 08:37:21 +0100
+Subject: [PATCH] wifi: mac80211: check/clear fast rx for non-4addr sta VLAN
+ changes
+
+When moving a station out of a VLAN and deleting the VLAN afterwards, the
+fast_rx entry still holds a pointer to the VLAN's netdev, which can cause
+use-after-free bugs. Fix this by immediately calling ieee80211_check_fast_rx
+after the VLAN change.
+
+Cc: stable at vger.kernel.org
+Reported-by: ranygh at riseup.net
+Signed-off-by: Felix Fietkau <nbd at nbd.name>
+---
+
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -2184,15 +2184,14 @@ static int ieee80211_change_station(stru
+ 		}
+ 
+ 		if (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
+-		    sta->sdata->u.vlan.sta) {
+-			ieee80211_clear_fast_rx(sta);
++		    sta->sdata->u.vlan.sta)
+ 			RCU_INIT_POINTER(sta->sdata->u.vlan.sta, NULL);
+-		}
+ 
+ 		if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
+ 			ieee80211_vif_dec_num_mcast(sta->sdata);
+ 
+ 		sta->sdata = vlansdata;
++		ieee80211_check_fast_rx(sta);
+ 		ieee80211_check_fast_xmit(sta);
+ 
+ 		if (test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {