wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes

jira LE-1907
cve CVE-2024-35789
Rebuild_History Non-Buildable kernel-5.14.0-427.31.1.el9_4
commit-author Felix Fietkau <nbd@nbd.name>
commit 4f2bdb3

When moving a station out of a VLAN and deleting the VLAN afterwards, the
fast_rx entry still holds a pointer to the VLAN's netdev, which can cause
use-after-free bugs. Fix this by immediately calling ieee80211_check_fast_rx
after the VLAN change.

	Cc: stable@vger.kernel.org
	Reported-by: ranygh@riseup.net
	Signed-off-by: Felix Fietkau <nbd@nbd.name>
Link: https://msgid.link/20240316074336.40442-1-nbd@nbd.name
	Signed-off-by: Johannes Berg <johannes.berg@intel.com>
(cherry picked from commit 4f2bdb3)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>

Author: PlaidCat

net/mac80211/cfg.c

@@ -2162,15 +2162,14 @@ static int ieee80211_change_station(struct wiphy *wiphy,
 		}
 
 		if (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
-		    sta->sdata->u.vlan.sta) {
-			ieee80211_clear_fast_rx(sta);
+		    sta->sdata->u.vlan.sta)
 			RCU_INIT_POINTER(sta->sdata->u.vlan.sta, NULL);
-		}
 
 		if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
 			ieee80211_vif_dec_num_mcast(sta->sdata);
 
 		sta->sdata = vlansdata;
+		ieee80211_check_fast_rx(sta);
 		ieee80211_check_fast_xmit(sta);
 
 		if (test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {