ath10k: fix locking for WEP keys

peer->keys needs to be protected by data_lock
since it is also accessed from the WMI path.

Both install() and clear() routines for peer
keys modify the key contents, so use the data_lock
to avoid races.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

2 files changed, 6 insertions, 0 deletions

diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h
index c5107854a8f6..90775a5358b8 100644
--- a/drivers/net/wireless/ath/ath10k/core.h
+++ b/drivers/net/wireless/ath/ath10k/core.h
@@ -219,6 +219,8 @@ struct ath10k_peer {
         int vdev_id;
         u8 addr[ETH_ALEN];
         DECLARE_BITMAP(peer_ids, ATH10K_MAX_NUM_PEER_IDS);
+
+        /* protected by ar->data_lock */
         struct ieee80211_key_conf *keys[WMI_MAX_KEY_INDEX + 1];
 };
 
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index c6c09c1d421e..d5aaaa0b9e15 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -136,7 +136,9 @@ static int ath10k_install_peer_wep_keys(struct ath10k_vif *arvif,
                 if (ret)
                         return ret;
 
+                spin_lock_bh(&ar->data_lock);
                 peer->keys[i] = arvif->wep_keys[i];
+                spin_unlock_bh(&ar->data_lock);
         }
 
         return 0;
@@ -173,7 +175,9 @@ static int ath10k_clear_peer_keys(struct ath10k_vif *arvif,
                         ath10k_warn(ar, "failed to remove peer wep key %d: %d\n",
                                     i, ret);
 
+                spin_lock_bh(&ar->data_lock);
                 peer->keys[i] = NULL;
+                spin_unlock_bh(&ar->data_lock);
         }
 
         return first_errno;