[PATCH] wifi: mac80211: check ieee80211_rx_data_set_link return in pubsta MLO path

[Michael Bommarito <michael.bommarito@gmail.com>]

__ieee80211_rx_handle_packet() resolves the link via
ieee80211_rx_data_set_link() on the pubsta->mlo path but ignores the
helper's return value.  Inside the helper,
  rx->link = rcu_dereference(rx->sdata->link[link_id]);
can leave rx->link NULL if link_id references a slot already cleared
by ieee80211_vif_set_links() during station-initiated ML
reconfiguration (see mlme.c's ieee80211_ml_reconfiguration(), which
invalidates sdata->link[] before the matching
ieee80211_sta_remove_link() loop walks the link-sta hash).  RX dispatch
still resolves a link_sta from the hash and then drops into
ieee80211_prepare_and_rx_handle(), which dereferences link->conf->addr.

Every other user site of ieee80211_rx_data_set_link() checks the return
and bails on failure; only this branch did not.  Mirror the safe
pattern.

Fixes: e66b7920aa5a ("wifi: mac80211: fix initialization of rx->link and rx->link_sta")
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Assisted-by: Claude:claude-opus-4-7
---

Notes for reviewers (not part of the commit):

Found by static audit of unchecked return values on
ieee80211_rx_data_set_link() call sites.  The non-pubsta
arm was already fixed upstream by commit 32d340ae6758 ("wifi:
mac80211: fix receiving MLO frames in the non-fast-path"); the
pubsta arm was missed, and this patch mirrors the same shape.

Runtime evidence:

 - Synthetic kernel-side A/B: on parent commit e66b7920aa5a..
   (pre-fix) forcing sdata->link[1] == NULL while sta->link[1]
   stays live causes ieee80211_rx_data_set_link() to return 0
   and ieee80211_prepare_and_rx_handle() to NULL-deref
   link->conf->addr; with the patch applied the guard drops
   the frame instead.

 - Source-level race window confirmed observationally: an
   instrumented pre-fix UML run with real hostapd + wpa_supplicant
   MLO and station-initiated SETUP_LINK_RECONFIG hits
   "sdata->link[1] == NULL while sta_valid_links still carries
   bit 1" on every reconfiguration attempt, inside
   ieee80211_setup_link_reconfig() between ieee80211_vif_set_links()
   and the per-link ieee80211_sta_remove_link() loop.

 - That same instrumented run does not itself crash, for two
   reasons independent of this bug: mac80211_hwsim feeds RX via
   ieee80211_rx_napi(hw, NULL, skb), so the pubsta arm at
   rx.c:5335 is unreachable from hwsim (frames take the
   already-fixed non-pubsta for_each_sta_info arm), and UML is
   single-CPU so RX softirq cannot interleave with the mlme
   reconfig sequence.  Real MLO-capable drivers (iwlwifi, mt76)
   do populate pubsta on their fast RX paths, and SMP hardware
   gives the race the micro-window it needs.

Benjamin Berg's 2026-02 RFC v2 "wifi: mac80211: refactor RX
link_id and station handling"
(20260223133818.9f5550ab445f.I...@changeid) touches the same
code and may supersede or subsume this patch; happy to fold /
rebase / drop.

 net/mac80211/rx.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 11d6c56c9d7e..e0ab4852c0c6 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -5332,7 +5332,9 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
 				if (!link_sta)
 					goto out;
 
-				ieee80211_rx_data_set_link(&rx, link_sta->link_id);
+				if (!ieee80211_rx_data_set_link(&rx,
+								link_sta->link_id))
+					goto out;
 			}
 
 			if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
-- 
2.53.0