From 05330210d27994a5e2f64f01f621acb0623273aa Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Mon, 27 Jun 2022 12:43:37 +0200 Subject: [PATCH] wifi: nl80211: hold wdev mutex for tid config commit 206bbcf76121664e95a42e1c014c3fe168d07a3d upstream. We need wdev_chandef() in this code, which now requires the wdev mutex due to the per-link nature. Hold it here to make sure we can access the link. Reported-by: syzbot+b4e9aa0f32ffd9902442@syzkaller.appspotmail.com Fixes: 7b0a0e3c3a88 ("wifi: cfg80211: do some rework towards MLO link APIs") Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman --- net/wireless/nl80211.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index d0ba3e646ec6..4a0ea67e385f 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -15285,6 +15285,8 @@ static int nl80211_set_tid_config(struct sk_buff *skb, if (info->attrs[NL80211_ATTR_MAC]) tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]); + wdev_lock(dev->ieee80211_ptr); + nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG], rem_conf) { ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX, @@ -15306,6 +15308,7 @@ static int nl80211_set_tid_config(struct sk_buff *skb, bad_tid_conf: kfree(tid_config); + wdev_unlock(dev->ieee80211_ptr); return ret; }