From 1b60ed34f712e9f606d80951f1586f4274ebadf1 Mon Sep 17 00:00:00 2001 From: Zhiling Zou Date: Mon, 3 Aug 2026 12:07:40 +0800 Subject: [PATCH] wifi: mac80211: serialize debugfs netdev rename with recreate ieee80211_debugfs_rename_netdev() renames sdata->vif.debugfs_dir without sharing synchronization with ieee80211_debugfs_recreate_netdev(). When MLO link updates switch an interface to or from MLO, the recreate path can remove and rebuild that dentry while a concurrent netdev rename still uses the stale pointer. Serialize the rename helper with the same wiphy mutex that protects the recreate path so the dentry cannot be removed while debugfs_change_name() is operating on it. Reported-by: Vega Signed-off-by: Zhiling Zou Link: https://patch.msgid.link/76eecaf74ca2d4e4aedf46c3ee7505917433468b.1785729184.git.zhilinz@nebusec.ai Signed-off-by: Johannes Berg --- net/mac80211/debugfs_netdev.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c index f3c6a41e4911..10f8d77852a1 100644 --- a/net/mac80211/debugfs_netdev.c +++ b/net/mac80211/debugfs_netdev.c @@ -1024,7 +1024,13 @@ void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata) void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata) { - debugfs_change_name(sdata->vif.debugfs_dir, "netdev:%s", sdata->name); + struct dentry *dir; + + wiphy_lock(sdata->local->hw.wiphy); + dir = sdata->vif.debugfs_dir; + if (dir) + debugfs_change_name(dir, "netdev:%s", sdata->name); + wiphy_unlock(sdata->local->hw.wiphy); } void ieee80211_debugfs_recreate_netdev(struct ieee80211_sub_if_data *sdata,