[PATCH ath-next 3/4] wifi: ath12k: protect new_alpha2 access with base_lock

[Baochen Qiang]

ab->new_alpha2 is written under ab->base_lock by the 11d new country
code event handler ath12k_reg_11d_new_cc_event() and by the SMBIOS
BDF parser, and read under the same lock by ath12k_update_11d().

ath12k_mac_hw_register() however read ab->new_alpha2 without holding
base_lock, racing with those writers. Take base_lock and copy the
value into a local wmi_set_current_country_arg, mirroring what
ath12k_update_11d() already does, and use the local copy afterwards.

Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3

Signed-off-by: Baochen Qiang <baochen.qiang at oss.qualcomm.com>
---
 drivers/net/wireless/ath/ath12k/mac.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ath/ath12k/mac.c b/drivers/net/wireless/ath/ath12k/mac.c
index 82cbb5b9cd11..56f9c1945cf0 100644
--- a/drivers/net/wireless/ath/ath12k/mac.c
+++ b/drivers/net/wireless/ath/ath12k/mac.c
@@ -15052,11 +15052,17 @@ static int ath12k_mac_hw_register(struct ath12k_hw *ah)
 			goto err_unregister_hw;
 		}
 
-		if (this_ab->hw_params->current_cc_support && this_ab->new_alpha2[0]) {
+		if (this_ab->hw_params->current_cc_support) {
 			struct wmi_set_current_country_arg current_cc = {};
 
+			spin_lock_bh(&this_ab->base_lock);
 			memcpy(&current_cc.alpha2, this_ab->new_alpha2, 2);
-			memcpy(&ar->alpha2, this_ab->new_alpha2, 2);
+			spin_unlock_bh(&this_ab->base_lock);
+
+			if (!current_cc.alpha2[0])
+				goto fw_stats_init;
+
+			memcpy(&ar->alpha2, current_cc.alpha2, 2);
 
 			reinit_completion(&ar->regd_update_completed);
 
@@ -15067,6 +15073,7 @@ static int ath12k_mac_hw_register(struct ath12k_hw *ah)
 					    ret);
 		}
 
+fw_stats_init:
 		ath12k_fw_stats_init(ar);
 		ath12k_debugfs_register(ar);
 	}

-- 
2.25.1