[PATCH] wifi: mac80211: check ieee80211_rx_data_set_link return in pubsta MLO path

Michael Bommarito
2026-04-22T00:07:04Z

__ieee80211_rx_handle_packet() resolves the link via
ieee80211_rx_data_set_link() on the pubsta->mlo path but ignores the
helper's return value. Inside the helper,
rx->link = rcu_dereference(rx->sdata->link[link_id]);
can leave rx->link NULL if link_id references a slot already cleared
by ieee80211_vif_set_links() during station-initiated ML
reconfiguration (see mlme.c's ieee80211_ml_reconfiguration(), which
invalidates sdata->link[] before the matching
ieee80211_sta_remove_link() loop walks the link-sta hash). RX dispatch
still resolves a link_sta from the hash and then drops into
ieee80211_prepare_and_rx_handle(), which dereferences link->conf->addr.

Every other user site of ieee80211_rx_data_set_link() checks the return
and bails on failure; only this branch did not. Mirror the safe
pattern.

Fixes: e66b7920aa5a ("wifi: mac80211: fix initialization of rx->link and rx->link_sta")
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Assisted-by: Claude:claude-opus-4-7
---

Notes for reviewers (not part of the commit):

Found by static audit of unchecked return values on
ieee80211_rx_data_set_link() call sites. The non-pubsta
arm was already fixed upstream by commit 32d340ae6758 ("wifi:
mac80211: fix receiving MLO frames in the non-fast-path"); the
pubsta arm was missed, and this patch mirrors the same shape.

Runtime evidence:

- Synthetic kernel-side A/B: on parent commit e66b7920aa5a..
(pre-fix) forcing sdata->link[1] == NULL while sta->link[1]
stays live causes ieee80211_rx_data_set_link() to return 0
and ieee80211_prepare_and_rx_handle() to NULL-deref
link->conf->addr; with the patch applied the guard drops
the frame instead.

- Source-level race window confirmed observationally: an
instrumented pre-fix UML run with real hostapd + wpa_supplicant
MLO and station-initiated SETUP_LINK_RECONFIG hits
"sdata->link[1] == NULL while sta_valid_links still carries
bit 1" on every reconfiguration attempt, inside
ieee80211_setup_link_reconfig() between ieee80211_vif_set_links()
and the per-link ieee80211_sta_remove_link() loop.

- That same instrumented run does not itself crash, for two
reasons independent of this bug: mac80211_hwsim feeds RX via
ieee80211_rx_napi(hw, NULL, skb), so the pubsta arm at
rx.c:5335 is unreachable from hwsim (frames take the
already-fixed non-pubsta for_each_sta_info arm), and UML is
single-CPU so RX softirq cannot interleave with the mlme
reconfig sequence. Real MLO-capable drivers (iwlwifi, mt76)
do populate pubsta on their fast RX paths, and SMP hardware
gives the race the micro-window it needs.

Benjamin Berg's 2026-02 RFC v2 "wifi: mac80211: refactor RX
link_id and station handling"
(20260223133818.9f5550ab445f.I...@changeid) touches the same
code and may supersede or subsume this patch; happy to fold /
rebase / drop.

net/mac80211/rx.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 11d6c56c9d7e..e0ab4852c0c6 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -5332,7 +5332,9 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
if (!link_sta)
goto out;

- ieee80211_rx_data_set_link(&rx, link_sta->link_id);
+ if (!ieee80211_rx_data_set_link(&rx,
+ link_sta->link_id))
+ goto out;
}

if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
--
2.53.0