wifi: nxpwifi: protect sta_list against concurrent add and delete

nxpwifi_del_sta_entry() unlinks an entry from priv->sta_list without
holding priv->sta_list_spinlock.  The comment above it gives the
reason: the function is only reached from cfg80211_ops.del_station,
which runs under the wiphy mutex.

That mutex serialises this callback against other users of the same
lock, including wiphy_work items.  It covers neither of the two other
writers of the same list:

  nxpwifi_add_sta_entry()    from nxpwifi_uap_event_sta_assoc()
  nxpwifi_del_all_sta_list() from nxpwifi_uap_event_bss_idle()

Both run from nxpwifi_process_event() on the driver's main work queue,
a plain workqueue that never takes the wiphy lock, and both take
sta_list_spinlock around their update.  A station associating, or the
BSS going idle, can therefore modify priv->sta_list while a hostapd
del_station is walking it and unlinking an entry.

Take the lock here too.  As the traversal then runs under the write
lock, list_for_each_entry() replaces the _rcu variant, matching
nxpwifi_del_all_sta_list().

The same call path reaches nxpwifi_get_sta_entry() without
rcu_read_lock().  Entries are freed with kfree_rcu() and every other
caller holds it, so take it around the lookup as well.

Fixes: 73b01e57ed3e ("wifi: nxp: add nxpwifi driver for IW61x")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Tested-by: Jeff Chen <jeff.chen_1@nxp.com>
Reviewed-by: Jeff Chen <jeff.chen_1@nxp.com>
Signed-off-by: Jeff Chen <jeff.chen_1@nxp.com>

0 files changed, 0 insertions, 0 deletions