cfg80211/mac80211/ath6kl: acquire wdev lock outside ch_switch_notify

The channel switch notification should be sent under the
wdev/sdata-lock, preferably in the same moment as the channel change
happens, to avoid races by other callers (e.g. start/stop_ap).
This also adds the previously missing sdata_lock protection in
csa_finalize_work.

Reported-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

1 files changed, 3 insertions, 6 deletions

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 398756c226c3..95882a788b5b 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -10821,21 +10821,18 @@ void cfg80211_ch_switch_notify(struct net_device *dev,
         struct wiphy *wiphy = wdev->wiphy;
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 
-        trace_cfg80211_ch_switch_notify(dev, chandef);
+        ASSERT_WDEV_LOCK(wdev);
 
-        wdev_lock(wdev);
+        trace_cfg80211_ch_switch_notify(dev, chandef);
 
         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
                     wdev->iftype != NL80211_IFTYPE_ADHOC &&
                     wdev->iftype != NL80211_IFTYPE_MESH_POINT))
-                goto out;
+                return;
 
         wdev->channel = chandef->chan;
         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
-out:
-        wdev_unlock(wdev);
-        return;
 }
 EXPORT_SYMBOL(cfg80211_ch_switch_notify);