wifi: mt76: mt7925: fix stale pointer comparisons in change_vif_links

In the error path of mt7925_change_vif_links(), the free: label iterates
over link_ids to clean up, but compares against `mconf` and `mlink`
which hold stale values from the last loop iteration rather than the
current link_id being freed.

Use array-indexed access (mconfs[link_id] / mlinks[link_id]) to compare
against the correct per-link pointers.

Fixes: 69acd6d910b0 ("wifi: mt76: mt7925: add mt7925_change_vif_links")
Tested-by: Marcin FM <marcin@lgic.pl>
Tested-by: Cristian-Florin Radoi <radoi.chris@gmail.com>
Tested-by: George Salukvadze <giosal90@gmail.com>
Tested-by: Evgeny Kapusta <3193631@gmail.com>
Tested-by: Samu Toljamo <samu.toljamo@gmail.com>
Tested-by: Ariel Rosenfeld <ariel.rosenfeld.750@gmail.com>
Tested-by: Chapuis Dario <chapuisdario4@gmail.com>
Tested-by: Thibaut François <tibo@humeurlibre.fr>
Tested-by: 张旭涵 <Loong.0x00@gmail.com>
Reviewed-by: Sean Wang <sean.wang@mediatek.com>
Signed-off-by: Javier Tia <floss@jetm.me>
Link: https://patch.msgid.link/20260425195011.790265-2-sean.wang@kernel.org
Signed-off-by: Felix Fietkau <nbd@nbd.name>

diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c b/drivers/net/wireless/mediatek/mt76/mt7925/main.c
index dcd2f07318fc5aa8a3aa6d0cff627c8553517440..819fd104aa606d8d4011923c157799f25fac7491 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c
@@ -2185,9 +2185,9 @@ free:
                rcu_assign_pointer(mvif->link_conf[link_id], NULL);
                rcu_assign_pointer(mvif->sta.link[link_id], NULL);
 
-               if (mconf != &mvif->bss_conf)
+               if (mconfs[link_id] != &mvif->bss_conf)
                        devm_kfree(dev->mt76.dev, mconfs[link_id]);
-               if (mlink != &mvif->sta.deflink)
+               if (mlinks[link_id] != &mvif->sta.deflink)
                        devm_kfree(dev->mt76.dev, mlinks[link_id]);
        }