wl12xx: lock the RCU when accessing sta via ieee80211_find_sta()

We were calling ieee80211_find_sta() and the sta returned by it
without locking the RCU, which is required by mac80211.

Fix this and reorganize slightly the area of the code where the sta is
used.

Reported-by: Jonathan DE CESCO <jonathanc@ti.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>

diff --git a/drivers/net/wireless/wl12xx/main.c b/drivers/net/wireless/wl12xx/main.c
index 588e10e..2192e4c 100644 (file)
--- a/drivers/net/wireless/wl12xx/main.c
+++ b/drivers/net/wireless/wl12xx/main.c
@@ -2219,7 +2219,7 @@ static void wl1271_bss_info_changed_sta(struct wl1271 *wl,
        bool do_join = false, set_assoc = false;
        bool is_ibss = (wl->bss_type == BSS_TYPE_IBSS);
        int ret;
-       struct ieee80211_sta *sta = ieee80211_find_sta(vif, bss_conf->bssid);
+       struct ieee80211_sta *sta;
 
        if (is_ibss) {
                ret = wl1271_bss_beacon_info_changed(wl, vif, bss_conf,
@@ -2378,36 +2378,42 @@ static void wl1271_bss_info_changed_sta(struct wl1271 *wl,
        if (ret < 0)
                goto out;
 
-       /*
-        * Takes care of: New association with HT enable,
-        *                HT information change in beacon.
-        */
-       if (sta &&
-           (changed & BSS_CHANGED_HT) &&
-           (bss_conf->channel_type != NL80211_CHAN_NO_HT)) {
-               ret = wl1271_acx_set_ht_capabilities(wl, &sta->ht_cap, true);
-               if (ret < 0) {
-                       wl1271_warning("Set ht cap true failed %d", ret);
-                       goto out;
-               }
+       rcu_read_lock();
+       sta = ieee80211_find_sta(vif, bss_conf->bssid);
+       if (sta)  {
+               /* handle new association with HT and HT information change */
+               if ((changed & BSS_CHANGED_HT) &&
+                   (bss_conf->channel_type != NL80211_CHAN_NO_HT)) {
+                       ret = wl1271_acx_set_ht_capabilities(wl, &sta->ht_cap,
+                                                            true);
+                       if (ret < 0) {
+                               wl1271_warning("Set ht cap true failed %d",
+                                              ret);
+                               rcu_read_unlock();
+                               goto out;
+                       }
                        ret = wl1271_acx_set_ht_information(wl,
-                               bss_conf->ht_operation_mode);
-               if (ret < 0) {
-                       wl1271_warning("Set ht information failed %d", ret);
-                       goto out;
+                                               bss_conf->ht_operation_mode);
+                       if (ret < 0) {
+                               wl1271_warning("Set ht information failed %d",
+                                              ret);
+                               rcu_read_unlock();
+                               goto out;
+                       }
                }
-       }
-       /*
-        * Takes care of: New association without HT,
-        *                Disassociation.
-        */
-       else if (sta && (changed & BSS_CHANGED_ASSOC)) {
-               ret = wl1271_acx_set_ht_capabilities(wl, &sta->ht_cap, false);
-               if (ret < 0) {
-                       wl1271_warning("Set ht cap false failed %d", ret);
-                       goto out;
+               /* handle new association without HT and disassociation */
+               else if (changed & BSS_CHANGED_ASSOC) {
+                       ret = wl1271_acx_set_ht_capabilities(wl, &sta->ht_cap,
+                                                            false);
+                       if (ret < 0) {
+                               wl1271_warning("Set ht cap false failed %d",
+                                              ret);
+                               rcu_read_unlock();
+                               goto out;
+                       }
                }
        }
+       rcu_read_unlock();
 
        if (changed & BSS_CHANGED_ARP_FILTER) {
                __be32 addr = bss_conf->arp_addr_list[0];