Re: [PATCH] wifi: mac80211: use frame link_id when adjusting link_sta on reorder release

[Willy Tarreau]

Hello,

On Sun, Nov 08, 2026 at 09:35:44PM +0000, Noah Weinberger wrote:
> Hello,
> 
> In ieee80211_rx_handlers(), when frames are released from the BA reorder
> buffer on timeout, rx->link_sta is re-fetched using the *previous*
> rx->link_id instead of the frame's own status->link_id. For a legacy
> (non-MLO) client on an MLO access point,
> ieee80211_release_reorder_timeout() passes link_id = -1 and
> ieee80211_rx_data_set_sta() never updates rx->link_id, so the adjust
> block evaluates rcu_dereference(rx->sta->link[-1]).
(...)

Note, in the future please do not Cc security@ once public lists are
already in Cc, as there is no need for private coordination anymore.

thanks,
Willy