From: Daniel Gabay iwl_mld_stop_nan() calls iwl_mld_flush_link_sta_txqs() without checking that aux_sta.sta_id is valid. The DW end handler correctly guards this with a WARN_ON check. Add the same defensive check to stop_nan for consistency and to avoid sending a flush command with an invalid sta_id. Fixes: 600941464991 ("wifi: iwlwifi: mld: Declare support for NAN capabilities") Signed-off-by: Daniel Gabay Reviewed-by: Ilan Peer Signed-off-by: Miri Korenblit --- drivers/net/wireless/intel/iwlwifi/mld/nan.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/intel/iwlwifi/mld/nan.c b/drivers/net/wireless/intel/iwlwifi/mld/nan.c index deb72e401e3c..913f0acf172a 100644 --- a/drivers/net/wireless/intel/iwlwifi/mld/nan.c +++ b/drivers/net/wireless/intel/iwlwifi/mld/nan.c @@ -203,7 +203,8 @@ int iwl_mld_stop_nan(struct ieee80211_hw *hw, /* assume that higher layer guarantees that no additional frames are * added before calling this callback */ - iwl_mld_flush_link_sta_txqs(mld, mld_vif->aux_sta.sta_id); + if (!WARN_ON(mld_vif->aux_sta.sta_id == IWL_INVALID_STA)) + iwl_mld_flush_link_sta_txqs(mld, mld_vif->aux_sta.sta_id); iwl_mld_remove_aux_sta(mld, vif); /* cancel based on object type being NAN, as the NAN objects do -- 2.34.1