[PATCH wireless] wifi: mac80211: check for a NULL link in the MLD data RX station loop

[orkunsari via B4 Relay]

From: orkunsari <sariorkunemin@xxxxxxxxx>

Since commit 6d531b9af16e ("wifi: mac80211: rework RX packet
handling"), the loop over MLD link stations in
__ieee80211_rx_handle_packet() passes the result of
rcu_dereference(sdata->link[link_sta->link_id]) straight to
ieee80211_rx_valid_freq(), which dereferences link->sdata.

ieee80211_vif_update_links() clears sdata->link[] for a removed link
before ieee80211_sta_remove_link() and sta_info_flush() take the
corresponding link stations out of the hash table, so a frame received
from that link's address in between finds a link station whose link
pointer is NULL.  The management frame path already checks for this.

Skip link stations without a link, as the management path does.

This was found by AI-assisted code review (Claude Code).  The fix has
been build-tested with W=1 only; no reproducer was run.

Fixes: 6d531b9af16e ("wifi: mac80211: rework RX packet handling")
Signed-off-by: orkunsari <sariorkunemin@xxxxxxxxx>
---
Regression in v7.4-rc1 only; released kernels are not affected.
---
 net/mac80211/rx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index ecee9348c7..038bca60a7 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -5469,7 +5469,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
 			sdata =	sta->sdata;
 			link = rcu_dereference(sdata->link[link_sta->link_id]);
 
-			if (!ieee80211_rx_valid_freq(status->freq, link))
+			if (!link || !ieee80211_rx_valid_freq(status->freq, link))
 				continue;
 
 			if (rx_data_pending) {

---
base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
change-id: 20261104-mac80211-mld-null-link-82fc4b8bfdf1

Best regards,
--  
orkunsari <sariorkunemin@xxxxxxxxx>