From: Daniel Gabay Date: Tue, 12 May 2026 19:34:35 +0000 (+0300) Subject: wifi: iwlwifi: mld: validate aux sta before flush in stop_nan X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=ee61fa6d6c194e9393e1cb89fcb507ecaf60f1d9;p=thirdparty%2Flinux.git wifi: iwlwifi: mld: validate aux sta before flush in stop_nan iwl_mld_stop_nan() calls iwl_mld_flush_link_sta_txqs() without checking that aux_sta.sta_id is valid. The DW end handler correctly guards this with a WARN_ON check. Add the same defensive check to stop_nan for consistency and to avoid sending a flush command with an invalid sta_id. Signed-off-by: Daniel Gabay Reviewed-by: Ilan Peer Link: https://patch.msgid.link/20260512222731.76b3db062a5e.I0567cfeb915c38c517eb6e1829d78c9fa8653c1f@changeid Signed-off-by: Miri Korenblit --- diff --git a/drivers/net/wireless/intel/iwlwifi/mld/nan.c b/drivers/net/wireless/intel/iwlwifi/mld/nan.c index deb72e401e3c..913f0acf172a 100644 --- a/drivers/net/wireless/intel/iwlwifi/mld/nan.c +++ b/drivers/net/wireless/intel/iwlwifi/mld/nan.c @@ -203,7 +203,8 @@ int iwl_mld_stop_nan(struct ieee80211_hw *hw, /* assume that higher layer guarantees that no additional frames are * added before calling this callback */ - iwl_mld_flush_link_sta_txqs(mld, mld_vif->aux_sta.sta_id); + if (!WARN_ON(mld_vif->aux_sta.sta_id == IWL_INVALID_STA)) + iwl_mld_flush_link_sta_txqs(mld, mld_vif->aux_sta.sta_id); iwl_mld_remove_aux_sta(mld, vif); /* cancel based on object type being NAN, as the NAN objects do