wifi: nl80211: hold wdev mutex for channel switch APIs

Since we deal with links in an MLD here, hold the wdev mutex now. Signed-off-by: Johannes Berg <[email protected]>
josf · Jul 15, 2022 · 4e2f3d6 · 4e2f3d6
1 parent 858fd18
commit 4e2f3d6
Showing 1 changed file with 16 additions and 5 deletions.
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
@@ -3348,8 +3348,13 @@ static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 	int link_id = nl80211_link_id_or_invalid(info->attrs);
 	struct net_device *netdev = info->user_ptr[1];
+	int ret;
+
+	wdev_lock(netdev->ieee80211_ptr);
+	ret = __nl80211_set_channel(rdev, netdev, info, link_id);
+	wdev_unlock(netdev->ieee80211_ptr);
 
-	return __nl80211_set_channel(rdev, netdev, info, link_id);
+	return ret;
 }
 
 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
@@ -3461,10 +3466,16 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 	}
 
 	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
-		result = __nl80211_set_channel(
-			rdev,
-			nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
-			info, -1);
+		if (wdev) {
+			wdev_lock(wdev);
+			result = __nl80211_set_channel(
+				rdev,
+				nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
+				info, -1);
+			wdev_unlock(wdev);
+		} else {
+			result = __nl80211_set_channel(rdev, netdev, info, -1);
+		}
 		if (result)
 			goto out;
 	}