wifi: iwlwifi: mld: validate aux sta before flush in stop_nan

iwl_mld_stop_nan() calls iwl_mld_flush_link_sta_txqs() without checking
that aux_sta.sta_id is valid. The DW end handler correctly guards this
with a WARN_ON check. Add the same defensive check to stop_nan for
consistency and to avoid sending a flush command with an invalid sta_id.

Signed-off-by: Daniel Gabay <daniel.gabay@intel.com>
Reviewed-by: Ilan Peer <ilan.peer@intel.com>
Link: https://patch.msgid.link/20260512222731.76b3db062a5e.I0567cfeb915c38c517eb6e1829d78c9fa8653c1f@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>

diff --git a/drivers/net/wireless/intel/iwlwifi/mld/nan.c b/drivers/net/wireless/intel/iwlwifi/mld/nan.c
index deb72e401e3c014a0b5a488078ca59fbda4f6fd8..913f0acf172adbbb48f288996f57190edd58b754 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/mld/nan.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/nan.c
@@ -203,7 +203,8 @@ int iwl_mld_stop_nan(struct ieee80211_hw *hw,
        /* assume that higher layer guarantees that no additional frames are
         * added before calling this callback
         */
-       iwl_mld_flush_link_sta_txqs(mld, mld_vif->aux_sta.sta_id);
+       if (!WARN_ON(mld_vif->aux_sta.sta_id == IWL_INVALID_STA))
+               iwl_mld_flush_link_sta_txqs(mld, mld_vif->aux_sta.sta_id);
        iwl_mld_remove_aux_sta(mld, vif);
 
        /* cancel based on object type being NAN, as the NAN objects do