From: Sean Wang Date: Fri, 6 Mar 2026 23:22:27 +0000 (-0600) Subject: wifi: mt76: mt7925: validate mlink in sta_hdr_trans_tlv() X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=292651cafac012ebad3d9d68b38f69117da4685d;p=thirdparty%2Flinux.git wifi: mt76: mt7925: validate mlink in sta_hdr_trans_tlv() Replace the dead wcid NULL check in mt7925_mcu_sta_hdr_trans_tlv() with a WARN_ON_ONCE() guard on mlink before dereferencing mlink->wcid. wcid is always derived from mlink, so mlink is the only meaningful object to validate here. Signed-off-by: Sean Wang Link: https://patch.msgid.link/20260306232238.2039675-9-sean.wang@kernel.org Signed-off-by: Felix Fietkau --- diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c index 476aec8337a9f..ba471341e8d07 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c @@ -1082,11 +1082,11 @@ mt7925_mcu_sta_hdr_trans_tlv(struct sk_buff *skb, else hdr_trans->from_ds = true; - wcid = &mlink->wcid; - - if (!wcid) + if (WARN_ON_ONCE(!mlink)) return; + wcid = &mlink->wcid; + hdr_trans->dis_rx_hdr_tran = !test_bit(MT_WCID_FLAG_HDR_TRANS, &wcid->flags); if (test_bit(MT_WCID_FLAG_4ADDR, &wcid->flags)) { hdr_trans->to_ds = true;