[bug report] wifi: mt76: mt7996: use correct link_id when filling TXD and TXP

[Dan Carpenter]

I suspect these are false positives...  Hopefully it doesn't take too
long to review.

Hello Shayne Chen,

Commit 85cd5534a3f2 ("wifi: mt76: mt7996: use correct link_id when
filling TXD and TXP") from Nov 6, 2025 (linux-next), leads to the
following Smatch static checker warning:

drivers/net/wireless/mediatek/mt76/mt7996/mac.c:1064 mt7996_tx_prepare_skb() error: we previously assumed 'sta' could be null (see line 1049)
drivers/net/wireless/mediatek/mt76/mt7996/mac.c:1104 mt7996_tx_prepare_skb() error: we previously assumed 'vif' could be null (see line 1048)

drivers/net/wireless/mediatek/mt76/mt7996/mac.c
    1038 int mt7996_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,
    1039                           enum mt76_txq_id qid, struct mt76_wcid *wcid,
    1040                           struct ieee80211_sta *sta,
    1041                           struct mt76_tx_info *tx_info)
    1042 {
    1043         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx_info->skb->data;
    1044         struct mt7996_dev *dev = container_of(mdev, struct mt7996_dev, mt76);
    1045         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb);
    1046         struct ieee80211_key_conf *key = info->control.hw_key;
    1047         struct ieee80211_vif *vif = info->control.vif;
    1048         struct mt7996_vif *mvif = vif ? (struct mt7996_vif *)vif->drv_priv : NULL;
    1049         struct mt7996_sta *msta = sta ? (struct mt7996_sta *)sta->drv_priv : NULL;

This code assumes that sta and vif can be NULL.

    1050         struct mt76_vif_link *mlink = NULL;
    1051         struct mt76_txwi_cache *t;
    1052         int id, i, pid, nbuf = tx_info->nbuf - 1;
    1053         bool is_8023 = info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP;
    1054         __le32 *ptr = (__le32 *)txwi_ptr;
    1055         u8 *txwi = (u8 *)txwi_ptr;
    1056         u8 link_id;
    1057 
    1058         if (unlikely(tx_info->skb->len <= ETH_HLEN))
    1059                 return -EINVAL;
    1060 
    1061         if (!wcid)
    1062                 wcid = &dev->mt76.global_wcid;
    1063 
--> 1064         if ((is_8023 || ieee80211_is_data_qos(hdr->frame_control)) && sta->mlo &&
                                                                               ^^^^^^^^
This dereferences it without checking.  Possibly the
"(is_8023 || ieee80211_is_data_qos(hdr->frame_control))" condition
means that sta is non-NULL.

    1065             likely(tx_info->skb->protocol != cpu_to_be16(ETH_P_PAE))) {
    1066                 u8 tid = tx_info->skb->priority & IEEE80211_QOS_CTL_TID_MASK;
    1067 
    1068                 link_id = (tid % 2) ? msta->seclink_id : msta->deflink_id;
                                               ^^^^^^^^^^^^^^^^^^^^^^^^^
This also is unchecked.

    1069         } else {
    1070                 link_id = u32_get_bits(info->control.flags,
    1071                                        IEEE80211_TX_CTRL_MLO_LINK);
    1072         }
    1073 
    1074         if (link_id != wcid->link_id && link_id != IEEE80211_LINK_UNSPECIFIED) {
    1075                 if (msta) {
    1076                         struct mt7996_sta_link *msta_link =
    1077                                 rcu_dereference(msta->link[link_id]);
    1078 
    1079                         if (msta_link)
    1080                                 wcid = &msta_link->wcid;
    1081                 } else if (mvif) {
    1082                         mlink = rcu_dereference(mvif->mt76.link[link_id]);
    1083                         if (mlink && mlink->wcid)
    1084                                 wcid = mlink->wcid;
    1085                 }
    1086         }
    1087 
    1088         t = (struct mt76_txwi_cache *)(txwi + mdev->drv->txwi_size);
    1089         t->skb = tx_info->skb;
    1090
    1091         id = mt76_token_consume(mdev, &t);
    1092         if (id < 0)
    1093                 return id;
    1094
    1095         /* Since the rules of HW MLD address translation are not fully
    1096          * compatible with 802.11 EAPOL frame, we do the translation by
    1097          * software
    1098          */
    1099         if (tx_info->skb->protocol == cpu_to_be16(ETH_P_PAE) && sta->mlo) {
                                                                         ^^^^^^^^
    1100                 struct ieee80211_hdr *hdr = (void *)tx_info->skb->data;
    1101                 struct ieee80211_bss_conf *link_conf;
    1102                 struct ieee80211_link_sta *link_sta;
    1103
--> 1104                 link_conf = rcu_dereference(vif->link_conf[wcid->link_id]);
                                                     ^^^^^

    1105                 if (!link_conf)
    1106                         return -EINVAL;
    1107
    1108                 link_sta = rcu_dereference(sta->link[wcid->link_id]);
    1109                 if (!link_sta)
    1110                         return -EINVAL;
    1111

regards,
dan carpenter