Commit 206bbcf7 authored by Johannes Berg's avatar Johannes Berg
Browse files

wifi: nl80211: hold wdev mutex for tid config 



We need wdev_chandef() in this code, which now requires
the wdev mutex due to the per-link nature. Hold it here
to make sure we can access the link.

Reported-by: default avatar <syzbot+b4e9aa0f32ffd9902442@syzkaller.appspotmail.com>
Fixes: 7b0a0e3c ("wifi: cfg80211: do some rework towards MLO link APIs")
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 77e7b6ba

net/wireless/nl80211.c

+3 −0
Original line number Diff line number Diff line
@@ -15433,6 +15433,8 @@ static int nl80211_set_tid_config(struct sk_buff *skb, 
	if (info->attrs[NL80211_ATTR_MAC])

		tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]);









	wdev_lock(dev->ieee80211_ptr);

















	nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],









			    rem_conf) {









		ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX,








@@ -15454,6 +15456,7 @@ static int nl80211_set_tid_config(struct sk_buff *skb,















bad_tid_conf:









	kfree(tid_config);









	wdev_unlock(dev->ieee80211_ptr);









	return ret;









}