CVE-2026-74489: wifi: mac80211: fix tid_tx use-after-free on BA session stop

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: fix tidtx use-after-free on BA session stop

ieee80211stoptxbacb() hands tidtx to kfreercu() through ieee80211removetidtx(), and then reads tidtx->ndp after dropping sta->lock:

ieee80211removetidtx(sta, tid); / kfreercu(tidtx, rcuhead) / ... spinunlockbh(&sta->lock);

if (starttxq) ieee80211aggstarttxq(sta, tid, false);

if (senddelba) ieee80211senddelba(..., tidtx->ndp);

That read is not covered by an RCU read-side critical section, and it runs in preemptible process context: both callers hold the wiphy mutex, reaching it either from the ieee80211basessionwork() wiphy work or from ieee80211stateardownBAsessions() during station teardown. Softirqs can run in that window too, both from the localbhenable() that ends ieee80211aggstarttxq() and from any interrupt exit, so the RCU callback can free tidtx before the read.

Driving the function from a test module with the grace period forced into that window, KASAN reports the read, and the free arrives on the ordinary RCU softirq path:

BUG: KASAN: slab-use-after-free in ieee80211stoptxbacb+0x3cd/0x400 Read of size 1 at addr ffff888002b9f52e by task kworker/0:1/10 [...] Freed by task 57: kasanslabfree+0x47/0x70 rcufreesheafprepare+0x70/0x250 rcufreesheafnobarn+0x18/0x40 rcucore+0x426/0x1310 handlesoftirqs+0x144/0x590 irqexitrcu+0xea/0x150 irqexitrcu+0x9/0x20 sysvecapictimerinterrupt+0x6b/0x80 asmsysvecapictimerinterrupt+0x1a/0x20

senddelba is only set when txstop is set, which happens for AGGSTOPLOCALREQUEST alone, so this is reached on local teardown - session idle timeout, PTK rekey, suspend, HW reconfig - and not from a peer's DELBA.

Read ndp into a local before the session is freed, while sta->lock is still held. tidtx->ndp has a single writer, in ieee80211txbasessionhandlestart(), which cannot run concurrently here: both paths are serialised by the wiphy mutex, and the session is already marked HTAGGSTATESTOPPING at this point. tidtx->ndp is also the only tidtx dereference left after ieee80211removetidtx() in this function.

[move/change the comment a bit to be more general not just on ndp, initialize ndp directly]