Pending frames can be retried after their station is no longer available. Require a station for both MLO-specific branches and retain the existing non-station transmission path for valid vif traffic. Detected by static analysis and reviewed with AI-assisted source auditing. Fixes: 7ef0c7ad735b ("wifi: mt76: mt7996: Implement MLD address translation for EAPOL") Fixes: 85cd5534a3f2 ("wifi: mt76: mt7996: use correct link_id when filling TXD and TXP") Assisted-by: LLM Signed-off-by: Slavin Liu --- drivers/net/wireless/mediatek/mt76/mt7996/mac.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c index 1cba381a78b8..e24dd530486c 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/mac.c @@ -1057,7 +1057,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, if (!wcid) wcid = &dev->mt76.global_wcid; - if ((is_8023 || ieee80211_is_data_qos(hdr->frame_control)) && sta->mlo && + if (sta && (is_8023 || ieee80211_is_data_qos(hdr->frame_control)) && sta->mlo && likely(tx_info->skb->protocol != cpu_to_be16(ETH_P_PAE))) { u8 tid = tx_info->skb->priority & IEEE80211_QOS_CTL_TID_MASK; @@ -1097,7 +1097,7 @@ int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, * compatible with 802.11 EAPOL frame, we do the translation by * software */ - if (tx_info->skb->protocol == cpu_to_be16(ETH_P_PAE) && sta->mlo) { + if (sta && tx_info->skb->protocol == cpu_to_be16(ETH_P_PAE) && sta->mlo) { struct ieee80211_hdr *hdr = (void *)tx_info->skb->data; struct ieee80211_bss_conf *link_conf; struct ieee80211_link_sta *link_sta;