[PATCH ath-next 0/2] wifi: ath12k: fix NULL deref when MLO link activation fails

[Wei Zhang <wei.zhang@oss.qualcomm.com>]

ath12k_mac_op_change_sta_links() adds a link to ahsta->links_map
before verifying that the link's vdev is ready, allowing broken links
to be processed by subsequent operations and causing NULL dereferences.

Patch 1 fixes three error path inconsistencies in ath12k_mac_vdev_create()
that leave arvif state or vdev resources inconsistent: a direct return on
wmi_vdev_create failure bypasses err: which clears arvif->ar; and both
failure paths in err_peer_del skip the DP peer cleanup and vdev rollback.

Patch 2 uses arvif->is_created (made reliable by patch 1) to guard
against links with no vdev before allocating a link station, preventing
broken links from entering links_map.

Wei Zhang (2):
  wifi: ath12k: fix inconsistent arvif state in vdev_create error paths
  wifi: ath12k: fix NULL deref in change_sta_links for unready link

 drivers/net/wireless/ath/ath12k/mac.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

base-commit: 7b25796f571fc09a7aa6fe7efb23edccd326917d
-- 
2.34.1