wifi: nl80211: hold wdev mutex for tid config

We need wdev_chandef() in this code, which now requires
the wdev mutex due to the per-link nature. Hold it here
to make sure we can access the link.

Reported-by: syzbot+b4e9aa0f32ffd9902442@syzkaller.appspotmail.com
Fixes: 7b0a0e3c3a88 ("wifi: cfg80211: do some rework towards MLO link APIs")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index efdf0148a8fab96e87795ca5956ad6da68f202d5..1b24befb90079a59d95d0978f7709e638491b2ae 100644 (file)
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -15433,6 +15433,8 @@ static int nl80211_set_tid_config(struct sk_buff *skb,
        if (info->attrs[NL80211_ATTR_MAC])
                tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
 
+       wdev_lock(dev->ieee80211_ptr);
+
        nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
                            rem_conf) {
                ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX,
@@ -15454,6 +15456,7 @@ static int nl80211_set_tid_config(struct sk_buff *skb,
 
 bad_tid_conf:
        kfree(tid_config);
+       wdev_unlock(dev->ieee80211_ptr);
        return ret;
 }