Re: [PATCH RFC] wifi: mac80211: prevent destroying non-TDLS stations in TDLS operations

Preserve the TDLS-peer validation in both touched paths. The verified bug is
that NL80211_TDLS_DISABLE_LINK accepts the associated AP's address and 
blindly
destroys its non-TDLS station entry; later AP probing cannot find that 
station
and triggers the reported !sta warning. The delayed setup cleanup has 
the same
destructive risk because setup currently records any existing station 
address,
not necessarily a TDLS peer.

Correct the delayed-work hunk so it does not ignore the return value of
__sta_info_destroy(), which is declared __must_check and causes an
-Wunused-result compiler warning. The smallest correction is to retain the
new sta_info_get() plus sta->sta.tdls validation, but call the existing
sta_info_destroy_addr(sdata, sdata->u.mgd.tdls_peer) wrapper after that 
check.
Alternatively, explicitly consume and handle the internal helper's result.

Keep the early missing/non-TDLS rejection in NL80211_TDLS_DISABLE_LINK, the
queue flushing and recalculation order for valid TDLS peers, and the 
existing
commit message and tags. Do not add unrelated cleanup or broaden the change.

On 8/2/2026 11:52 PM, syzbot wrote:
> When userspace sends a NL80211_CMD_TDLS_OPER command with the
> NL80211_TDLS_DISABLE_LINK operation, the request is handled by
> ieee80211_tdls_oper(). The code for this operation directly calls
> sta_info_destroy_addr() to destroy the station entry associated with the
> provided MAC address. Unlike the NL80211_TDLS_ENABLE_LINK case, which
> correctly verifies that the target station exists and is actually a TDLS
> peer, the disable link path blindly destroys whatever station matches the
> MAC address.
>
> If the provided MAC address is the AP's MAC address, this causes the AP's
> station entry to be destroyed while the interface is still associated.
> Later, when the driver attempts to send a probe request to the AP, it looks
> up the AP's station entry, which returns NULL, triggering a warning in
> ieee80211_mgd_probe_ap_send():
>
> WARNING: net/mac80211/mlme.c:4898 at
> ieee80211_mgd_probe_ap_send+0x497/0x560 net/mac80211/mlme.c:4898
> RIP: 0010:ieee80211_mgd_probe_ap_send+0x497/0x560 net/mac80211/mlme.c:4898
> Call Trace:
>   <TASK>
>   cfg80211_wiphy_work+0x29e/0x420 net/wireless/core.c:538
>   process_one_work kernel/workqueue.c:3322 [inline]
>   process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
>   worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
>   kthread+0x388/0x470 kernel/kthread.c:436
>   ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
>   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>   </TASK>
>
> A similar issue exists in ieee80211_tdls_peer_del_work() which is queued by
> ieee80211_tdls_mgmt_setup(). If a TDLS setup request is sent with the AP's
> MAC address, the AP's station entry will be destroyed when the setup
> timeout expires.
>
> Fix this by explicitly verifying that the station exists and is a TDLS peer
> (sta->sta.tdls == true) before destroying it in both ieee80211_tdls_oper()
> and ieee80211_tdls_peer_del_work().
>
> Fixes: dfe018bf9953 ("mac80211: handle TDLS high-level commands and frames")
> Assisted-by: Gemini:gemini-3.5-flash Gemini:gemini-3.1-pro-preview syzbot
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=a59b5291776979816910
> Link: https://syzkaller.appspot.com/ai_job?id=52e47481-fb24-46ec-8402-1f14cf87081f
> To: "Johannes Berg" <[email protected]>
> To: <[email protected]>
> To: "Arik Nemtsov" <[email protected]>
> Cc: <[email protected]>
>
> ---
> diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c
> index ffd575a8d..24297552f 100644
> --- a/net/mac80211/tdls.c
> +++ b/net/mac80211/tdls.c
> @@ -33,8 +33,12 @@ void ieee80211_tdls_peer_del_work(struct wiphy *wiphy, struct wiphy_work *wk)
>   	lockdep_assert_wiphy(local->hw.wiphy);
>   
>   	if (!is_zero_ether_addr(sdata->u.mgd.tdls_peer)) {
> +		struct sta_info *sta;
> +
>   		tdls_dbg(sdata, "TDLS del peer %pM\n", sdata->u.mgd.tdls_peer);
> -		sta_info_destroy_addr(sdata, sdata->u.mgd.tdls_peer);
> +		sta = sta_info_get(sdata, sdata->u.mgd.tdls_peer);
> +		if (sta && sta->sta.tdls)
> +			__sta_info_destroy(sta);
>   		eth_zero_addr(sdata->u.mgd.tdls_peer);
>   	}
>   }
> @@ -1462,6 +1466,10 @@ int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
>   			     !ether_addr_equal(sdata->u.mgd.tdls_peer, peer));
>   		break;
>   	case NL80211_TDLS_DISABLE_LINK:
> +		sta = sta_info_get(sdata, peer);
> +		if (!sta || !sta->sta.tdls)
> +			return -ENOLINK;
> +
>   		/*
>   		 * The teardown message in ieee80211_tdls_mgmt_teardown() was
>   		 * created while the queues were stopped, so it might still be
> @@ -1476,7 +1484,7 @@ int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
>   		/* flush a potentially queued teardown packet */
>   		ieee80211_flush_queues(local, sdata, false);
>   
> -		ret = sta_info_destroy_addr(sdata, peer);
> +		ret = __sta_info_destroy(sta);
>   
>   		iee80211_tdls_recalc_ht_protection(sdata, NULL);
>   
>
>
> base-commit: f5098b6bae761e346ebcd9da7f95622c04733cff