git: d29f920d9400 - stable/15 - LinuxKPI: 802.11: add != NULL check in ieee80211_tx_status_ext()

The branch stable/15 has been updated by bz:

URL: https://cgit.FreeBSD.org/src/commit/?id=d29f920d94002e67232f1ebcb4e5470a076ac4f0

commit d29f920d94002e67232f1ebcb4e5470a076ac4f0
Author:     Kim Shrier <fbsdbugs@westryn.net>
AuthorDate: 2026-08-31 16:28:51 +0000
Commit:     Bjoern A. Zeeb <bz@FreeBSD.org>
CommitDate: 2026-09-10 09:46:53 +0000

    LinuxKPI: 802.11: add != NULL check in ieee80211_tx_status_ext()
    
    There seems to be another possible race with net80211 state machine
    changing the bss from under us (another lvif_bss_synched case).
    Just do the != NULL check to avoid a NULL pointer deref in
    ieee80211_ratectl_rate().
    
    (bz extended the original comment and wrote the commit message).
    
    Sponosred by:   The FreeBSD Foundation (commit)
    PR:             297184
    
    (cherry picked from commit 0211e64ce1e5ba208f4b96453ce6740a49689b91)
---
 sys/compat/linuxkpi/common/src/linux_80211.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c b/sys/compat/linuxkpi/common/src/linux_80211.c
index d8b5b631efd8..52897e16df9c 100644
--- a/sys/compat/linuxkpi/common/src/linux_80211.c
+++ b/sys/compat/linuxkpi/common/src/linux_80211.c
@@ -9122,7 +9122,15 @@ linuxkpi_ieee80211_tx_status_ext(struct ieee80211_hw *hw,
 
 		IMPROVE("only update rate if needed but that requires us to get a proper rate from mo_sta_statistics");
 		ieee80211_ratectl_tx_complete(ni, &txs);
-		ieee80211_ratectl_rate(ni->ni_vap->iv_bss, NULL, 0);
+		/*
+		 * A tx completion can land here after the vap has been torn
+		 * down (iv_bss cleared on the way to INIT) while frames were
+		 * still in flight; there is no bss node left to rate-adjust.
+		 * This is another case of !lvif->lvif_bss_synched but checking
+		 * that seems too cumbersome.
+		 */
+		if (ni->ni_vap->iv_bss != NULL)
+			ieee80211_ratectl_rate(ni->ni_vap->iv_bss, NULL, 0);
 
 #ifdef LINUXKPI_DEBUG_80211
 		if (linuxkpi_debug_80211 & D80211_TRACE_TX) {