mac80211: lock sdata in ieee80211_csa_connection_drop_work()

We call ieee80211_ibss_disconnect(), which requires sdata to be
locked, so lock the sdata during ieee80211_csa_connection_drop_work().

Cc: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

1 files changed, 4 insertions, 0 deletions

diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index e97fa7fac96e..a6ca56dfe0d7 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -753,12 +753,16 @@ static void ieee80211_csa_connection_drop_work(struct work_struct *work)
                 container_of(work, struct ieee80211_sub_if_data,
                              u.ibss.csa_connection_drop_work);
 
+        sdata_lock(sdata);
+
         ieee80211_ibss_disconnect(sdata);
         synchronize_rcu();
         skb_queue_purge(&sdata->skb_queue);
 
         /* trigger a scan to find another IBSS network to join */
         ieee80211_queue_work(&sdata->local->hw, &sdata->work);
+
+        sdata_unlock(sdata);
 }
 
 static void ieee80211_ibss_csa_mark_radar(struct ieee80211_sub_if_data *sdata)