4 files changed, 12 insertions, 1 deletions

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 27fa53bfed0d..875e63d3d9c5 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1053,6 +1053,7 @@ static int ieee80211_change_beacon(struct wiphy *wiphy, struct net_device *dev,
         int err;
 
         sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        sdata_assert_lock(sdata);
 
         /* don't allow changing the beacon while CSA is in place - offset
          * of channel switch counter may change
@@ -1080,6 +1081,8 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
         struct probe_resp *old_probe_resp;
         struct cfg80211_chan_def chandef;
 
+        sdata_assert_lock(sdata);
+
         old_beacon = sdata_dereference(sdata->u.ap.beacon, sdata);
         if (!old_beacon)
                 return -ENOENT;
@@ -3002,6 +3005,8 @@ static void ieee80211_csa_finalize(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_local *local = sdata->local;
         int err, changed = 0;
 
+        sdata_assert_lock(sdata);
+
         mutex_lock(&local->mtx);
         sdata->radar_required = sdata->csa_radar_required;
         err = ieee80211_vif_change_channel(sdata, &changed);
@@ -3083,7 +3088,7 @@ int ieee80211_channel_switch(struct wiphy *wiphy, struct net_device *dev,
         struct ieee80211_if_mesh __maybe_unused *ifmsh;
         int err, num_chanctx, changed = 0;
 
-        lockdep_assert_held(&sdata->wdev.mtx);
+        sdata_assert_lock(sdata);
 
         if (!list_empty(&local->roc_list) || local->scanning)
                 return -EBUSY;
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index f01d4683d473..b2da79f019d4 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -795,6 +795,8 @@ ieee80211_ibss_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         int err;
         u32 sta_flags;
 
+        sdata_assert_lock(sdata);
+
         sta_flags = IEEE80211_STA_DISABLE_VHT;
         switch (ifibss->chandef.width) {
         case NL80211_CHAN_WIDTH_5:
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 3dfd20a453ab..8880bc8fce0d 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -822,7 +822,9 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
         cancel_work_sync(&local->dynamic_ps_enable_work);
 
         cancel_work_sync(&sdata->recalc_smps);
+        sdata_lock(sdata);
         sdata->vif.csa_active = false;
+        sdata_unlock(sdata);
         cancel_work_sync(&sdata->csa_finalize_work);
 
         cancel_delayed_work_sync(&sdata->dfs_cac_timer_work);
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index bd55115c8922..f70e9cd10552 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -864,6 +864,8 @@ ieee80211_mesh_process_chnswitch(struct ieee80211_sub_if_data *sdata,
         int err;
         u32 sta_flags;
 
+        sdata_assert_lock(sdata);
+
         sta_flags = IEEE80211_STA_DISABLE_VHT;
         switch (sdata->vif.bss_conf.chandef.width) {
         case NL80211_CHAN_WIDTH_20_NOHT: