[PATCH wireless 1/1] wifi: mac80211: serialize debugfs netdev rename with recreate

ieee80211_debugfs_rename_netdev() renames sdata->vif.debugfs_dir
without sharing synchronization with ieee80211_debugfs_recreate_netdev().
When MLO link updates switch an interface to or from MLO, the recreate
path can remove and rebuild that dentry while a concurrent netdev rename
still uses the stale pointer.

Serialize the rename helper with the same wiphy mutex that protects the
recreate path so the dentry cannot be removed while debugfs_change_name()
is operating on it.

Fixes: c942398f95efb ("wifi: mac80211: handle debugfs when switching to/from MLO")
Cc: [email protected]
Reported-by: Vega <[email protected]>
Signed-off-by: Zhiling Zou <[email protected]>
---
 net/mac80211/debugfs_netdev.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index f3c6a41e49119..10f8d77852a1a 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -1024,7 +1024,13 @@ void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)
 
 void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata)
 {
-	debugfs_change_name(sdata->vif.debugfs_dir, "netdev:%s", sdata->name);
+	struct dentry *dir;
+
+	wiphy_lock(sdata->local->hw.wiphy);
+	dir = sdata->vif.debugfs_dir;
+	if (dir)
+		debugfs_change_name(dir, "netdev:%s", sdata->name);
+	wiphy_unlock(sdata->local->hw.wiphy);
 }
 
 void ieee80211_debugfs_recreate_netdev(struct ieee80211_sub_if_data *sdata,
-- 
2.43.0