[PATCH 3/3] wifi: iwlwifi: mld: unpublish links before freeing on add failure

[Zhao Li <enderaoelyther@gmail.com>]

During firmware restart, iwl_mld_add_link() can reuse a link that is
already published in mld_vif->link[]. If link initialization fails, the
common error path frees the link without clearing that pointer.

A later firmware-add failure does clear the pointer, but then immediately
frees the link while an RCU reader may still hold it.

Clear mld_vif->link[] in the common error path and defer freeing dynamic
links until after an RCU grace period, matching normal link removal.

iwl_mld_link_from_mac80211() reads that same slot under the wiphy mutex, so
a NULL link means the slot is already NULL; the common clear cannot discard
another link.

Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-6-astra
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
---
 drivers/net/wireless/intel/iwlwifi/mld/link.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mld/link.c b/drivers/net/wireless/intel/iwlwifi/mld/link.c
index 96e06940b34c..55b84801923d 100644
--- a/drivers/net/wireless/intel/iwlwifi/mld/link.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/link.c
@@ -541,15 +541,15 @@ int iwl_mld_add_link(struct iwl_mld *mld,
 	ret = iwl_mld_add_link_to_fw(mld, bss_conf);
 	if (ret) {
 		RCU_INIT_POINTER(mld->fw_id_to_bss_conf[link->fw_id], NULL);
-		RCU_INIT_POINTER(mld_vif->link[bss_conf->link_id], NULL);
 		goto free;
 	}
 
 	return ret;
 
 free:
+	RCU_INIT_POINTER(mld_vif->link[bss_conf->link_id], NULL);
 	if (!is_deflink)
-		kfree(link);
+		kfree_rcu(link, rcu_head);
 	return ret;
 }
 
-- 
2.55.0