[openwrt/openwrt] mt76: mt7996: fix crash when using mesh

[LEDE Commits]

hauke pushed a commit to openwrt/openwrt.git, branch openwrt-25.12:
https://git.openwrt.org/7c732c8a4793a18b1c0b1ddd5519e6e3952782a3

commit 7c732c8a4793a18b1c0b1ddd5519e6e3952782a3
Author: Hauke Mehrtens <hauke at hauke-m.de>
AuthorDate: Fri Jan 23 00:13:46 2026 +0100

    mt76: mt7996: fix crash when using mesh
    
    Backport a fix from upstream mt76 to fix a crash in 802.11s mesh mode.
    
    Fixes: https://github.com/openwrt/openwrt/issues/20751
    Link: https://github.com/openwrt/openwrt/pull/21643
    Signed-off-by: Hauke Mehrtens <hauke at hauke-m.de>
    (cherry picked from commit 17d45f677b0eb1da3c8190a2778fcdfcd9ecd234)
---
 ...mt7996-fix-crash-in-mt7996_tx_prepare_skb.patch | 25 ++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/package/kernel/mt76/patches/0002-wifi-mt76-mt7996-fix-crash-in-mt7996_tx_prepare_skb.patch b/package/kernel/mt76/patches/0002-wifi-mt76-mt7996-fix-crash-in-mt7996_tx_prepare_skb.patch
new file mode 100644
index 0000000000..395fde3dd9
--- /dev/null
+++ b/package/kernel/mt76/patches/0002-wifi-mt76-mt7996-fix-crash-in-mt7996_tx_prepare_skb.patch
@@ -0,0 +1,25 @@
+From f473d66ab595d5f37aedc868bfe407da0a1245c8 Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd at nbd.name>
+Date: Wed, 12 Nov 2025 16:32:44 +0000
+Subject: wifi: mt76: mt7996: fix crash in mt7996_tx_prepare_skb
+
+Add missing NULL pointer check. In mesh mode, sta can be NULL even for
+qosdata frames.
+
+Signed-off-by: Felix Fietkau <nbd at nbd.name>
+Upstream: https://github.com/openwrt/mt76/commit/f473d66ab595d5f37aedc868bfe407da0a1245c8
+---
+ mt7996/mac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mt7996/mac.c
++++ b/mt7996/mac.c
+@@ -1061,7 +1061,7 @@ int mt7996_tx_prepare_skb(struct mt76_de
+ 	if (!wcid)
+ 		wcid = &dev->mt76.global_wcid;
+ 
+-	if ((is_8023 || ieee80211_is_data_qos(hdr->frame_control)) && sta->mlo &&
++	if ((is_8023 || ieee80211_is_data_qos(hdr->frame_control)) && sta && sta->mlo &&
+ 	    likely(tx_info->skb->protocol != cpu_to_be16(ETH_P_PAE))) {
+ 		u8 tid = tx_info->skb->priority & IEEE80211_QOS_CTL_TID_MASK;
+