| From 26056c83b099718ad14ff611b5b7d5cffef69240 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Sun, 25 Jan 2026 19:40:39 +0000 |
| Subject: wifi: iwlegacy: add missing mutex protection in |
| il4965_store_tx_power() |
| |
| From: Ziyi Guo <n7l8m4@u.northwestern.edu> |
| |
| [ Upstream commit e31fa691d0b1c07b6094a6cf0cce894192c462b3 ] |
| |
| il4965_store_tx_power() calls il_set_tx_power() without holding il->mutex. |
| However, il_set_tx_power() has lockdep_assert_held(&il->mutex) indicating |
| that callers must hold this lock. |
| |
| All other callers of il_set_tx_power() properly acquire the mutex: |
| - il_bg_scan_completed() acquires mutex at common.c:1683 |
| - il_mac_config() acquires mutex at common.c:5006 |
| - il3945_commit_rxon() and il4965_commit_rxon() are called via work |
| queues that hold the mutex (like il4965_bg_alive_start) |
| |
| Add mutex_lock()/mutex_unlock() around the il_set_tx_power() call in |
| the sysfs store function to fix the missing lock protection. |
| |
| Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu> |
| Acked-by: Stanislaw Gruszka <stf_xl@wp.pl> |
| Link: https://patch.msgid.link/20260125194039.1196488-1-n7l8m4@u.northwestern.edu |
| Signed-off-by: Johannes Berg <johannes.berg@intel.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/net/wireless/intel/iwlegacy/4965-mac.c | 2 ++ |
| 1 file changed, 2 insertions(+) |
| |
| diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c |
| index 6e5decf79a06b..7ef27f95c5265 100644 |
| --- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c |
| +++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c |
| @@ -4613,7 +4613,9 @@ il4965_store_tx_power(struct device *d, struct device_attribute *attr, |
| if (ret) |
| IL_INFO("%s is not in decimal form.\n", buf); |
| else { |
| + mutex_lock(&il->mutex); |
| ret = il_set_tx_power(il, val, false); |
| + mutex_unlock(&il->mutex); |
| if (ret) |
| IL_ERR("failed setting tx power (0x%08x).\n", ret); |
| else |
| -- |
| 2.51.0 |
| |
