mac80211: make mgmt_tx accept a NULL channel

cfg80211 passes a NULL channel to mgmt_tx if the frame has
to be sent on the one currently in use by the device.
Make the implementation of mgmt_tx correctly handle this
case. Fail if offchan is required.

Signed-off-by: Antonio Quartulli <antonio@open-mesh.com>
[fix RCU locking]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

1 files changed, 14 insertions, 3 deletions

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index cd6f35f6e714..64cf294c2b96 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2841,6 +2841,12 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
                 return -EOPNOTSUPP;
         }
 
+        /* configurations requiring offchan cannot work if no channel has been
+         * specified
+         */
+        if (need_offchan && !chan)
+                return -EINVAL;
+
         mutex_lock(&local->mtx);
 
         /* Check if the operating channel is the requested channel */
@@ -2850,10 +2856,15 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
                 rcu_read_lock();
                 chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
 
-                if (chanctx_conf)
-                        need_offchan = chan != chanctx_conf->def.chan;
-                else
+                if (chanctx_conf) {
+                        need_offchan = chan && (chan != chanctx_conf->def.chan);
+                } else if (!chan) {
+                        ret = -EINVAL;
+                        rcu_read_unlock();
+                        goto out_unlock;
+                } else {
                         need_offchan = true;
+                }
                 rcu_read_unlock();
         }