[PATCH wireless] wifi: mac80211: check for a NULL link in the MLD station RX loop

[Joas Antonio dos Santos via B4 Relay]

From: Joas Antonio dos Santos <joasantonio108@xxxxxxxxx>

Since commit 6d531b9af16e ("wifi: mac80211: rework RX packet handling"),
__ieee80211_rx_handle_packet() looks up the link of each MLD station
that matches addr2 and passes it straight to ieee80211_rx_valid_freq(),
which dereferences link->sdata and link->conf whenever status->freq is
set.  The non-MLD loop and the interface loop below it check the link,
this one does not.

The link can be NULL there.  ieee80211_vif_update_links() clears
sdata->link[link_id] for a removed link first, and only later, after
ieee80211_tear_down_links() (including its synchronize_rcu()) and
drv_change_vif_links(), calls ieee80211_sta_remove_link(), which takes
the link station out of the hash.  RX runs under RCU only, so a data
frame from that link's address arriving in this window finds the link
station but a NULL link, and the kernel oopses in softirq context.  A
link is removed this way for example when an associated AP announces
removal of one of its links (ieee80211_ml_reconf_work()), and the
frames only need a matching transmitter address, before any crypto.

Before the rework, ieee80211_rx_data_set_link() returned false for a
NULL link and the frame was skipped.  Skip it again.

Fixes: 6d531b9af16e ("wifi: mac80211: rework RX packet handling")
Signed-off-by: Joas Antonio dos Santos <joasantonio108@xxxxxxxxx>
---
wifi: mac80211: check for a NULL link in the MLD station RX loop
---
 net/mac80211/rx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index ecee9348c70d..038bca60a7c7 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -5469,7 +5469,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
 			sdata =	sta->sdata;
 			link = rcu_dereference(sdata->link[link_sta->link_id]);
 
-			if (!ieee80211_rx_valid_freq(status->freq, link))
+			if (!link || !ieee80211_rx_valid_freq(status->freq, link))
 				continue;
 
 			if (rx_data_pending) {

---
base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
change-id: 20261102-mac80211-rx-null-link-6f2e0b50f6bb

Best regards,
-- 
Joas Antonio dos Santos <joasantonio108@xxxxxxxxx>