wifi: mac80211: fix general-protection-fault in ieee80211_subif_start_xmit()

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: fix general-protection-fault in ieee80211_subif_start_xmit()

When device is running and the interface status is changed, the gpf issue

is triggered. The problem triggering process is as follows:

Thread A: Thread B

ieee80211_runtime_change_iftype() process_one_work()

... ...

ieee80211_do_stop() ...

... ...

sdata->bss = NULL ...

... ieee80211_subif_start_xmit()

ieee80211_multicast_to_unicast

//!sdata->bss->multicast_to_unicast

cause gpf issue

When the interface status is changed, the sending queue continues to send

packets. After the bss is set to NULL, the bss is accessed. As a result,

this causes a general-protection-fault issue.

The following is the stack information:

general protection fault, probably for non-canonical address

0xdffffc000000002f: 0000 [#1] PREEMPT SMP KASAN

KASAN: null-ptr-deref in range [0x0000000000000178-0x000000000000017f]

Workqueue: mld mld_ifc_work

RIP: 0010:ieee80211_subif_start_xmit+0x25b/0x1310

Call Trace:

<TASK>

dev_hard_start_xmit+0x1be/0x990

__dev_queue_xmit+0x2c9a/0x3b60

ip6_finish_output2+0xf92/0x1520

ip6_finish_output+0x6af/0x11e0

ip6_output+0x1ed/0x540

mld_sendpack+0xa09/0xe70

mld_ifc_work+0x71c/0xdb0

process_one_work+0x9bf/0x1710

worker_thread+0x665/0x1080

kthread+0x2e4/0x3a0

ret_from_fork+0x1f/0x30

</TASK>