nl80211: use __cfg80211_rdev_from_attrs for testmode

To fix the testmode cross-namespace access problem,
use __cfg80211_rdev_from_attrs() to get the device
instead of open-coding similar functionality.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>

1 files changed, 10 insertions, 13 deletions

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 7e94d4d960bf..06623d064606 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -5230,21 +5230,18 @@ static int nl80211_testmode_dump(struct sk_buff *skb,
                                   nl80211_policy);
                 if (err)
                         return err;
-                if (nl80211_fam.attrbuf[NL80211_ATTR_WIPHY]) {
-                        phy_idx = nla_get_u32(
-                                nl80211_fam.attrbuf[NL80211_ATTR_WIPHY]);
-                } else {
-                        struct net_device *netdev;
 
-                        err = get_rdev_dev_by_ifindex(sock_net(skb->sk),
-                                                      nl80211_fam.attrbuf,
-                                                      &rdev, &netdev);
-                        if (err)
-                                return err;
-                        dev_put(netdev);
-                        phy_idx = rdev->wiphy_idx;
-                        cfg80211_unlock_rdev(rdev);
+                mutex_lock(&cfg80211_mutex);
+                rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
+                                                  nl80211_fam.attrbuf);
+                if (IS_ERR(rdev)) {
+                        mutex_unlock(&cfg80211_mutex);
+                        return PTR_ERR(rdev);
                 }
+                phy_idx = rdev->wiphy_idx;
+                rdev = NULL;
+                mutex_unlock(&cfg80211_mutex);
+
                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
                         cb->args[1] =
                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];