mt7996_rx_get_wcid() returns NULL when the reported WLAN index does not map to a station entry on a valid band. Commit a3ea1c309bf3 ("wifi: mt76: mt7996: Fix mt7996_reverse_frag0_hdr_trans for MLO") made mt7996_reverse_frag0_hdr_trans() load msta_link->sta while declaring its locals, ahead of the !msta check that used to reject a NULL WCID. A header-translated first fragment without a station WCID now dereferences a NULL pointer in the receive path. Check the link before loading its station pointer. Found by code review and not reproduced; compile-tested only. AI assistance was used. Fixes: a3ea1c309bf3 ("wifi: mt76: mt7996: Fix mt7996_reverse_frag0_hdr_trans for MLO") Cc: stable@vger.kernel.org Signed-off-by: Zhao Li --- drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c index f36da545045b..186216f21d28 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c @@ -191,12 +191,12 @@ static int mt7996_reverse_frag0_hdr_trans(struct sk_buff *skb, u16 hdr_gap) struct mt76_rx_status *status = (struct mt76_rx_status *)skb->cb; struct ethhdr *eth_hdr = (struct ethhdr *)(skb->data + hdr_gap); struct mt7996_sta_link *msta_link = (void *)status->wcid; - struct mt7996_sta *msta = msta_link->sta; struct ieee80211_bss_conf *link_conf; __le32 *rxd = (__le32 *)skb->data; struct ieee80211_sta *sta; struct ieee80211_vif *vif; struct ieee80211_hdr hdr; + struct mt7996_sta *msta; u16 frame_control; if (le32_get_bits(rxd[3], MT_RXD3_NORMAL_ADDR_TYPE) != @@ -206,6 +206,10 @@ static int mt7996_reverse_frag0_hdr_trans(struct sk_buff *skb, u16 hdr_gap) if (!(le32_to_cpu(rxd[1]) & MT_RXD1_NORMAL_GROUP_4)) return -EINVAL; + if (!msta_link) + return -EINVAL; + + msta = msta_link->sta; if (!msta || !msta->vif) return -EINVAL; base-commit: 5dbf2415ca9821a611d09308e3b29d2c37e7cd77 -- 2.56.1