Hi Dan, On Tue, 2022-07-26 at 17:10 +0300, Dan Carpenter wrote: > 5885 rcu_read_lock(); > 5886 err = ieee80211_lookup_ra_sta(sdata, skb, &sta); > > For sdata->vif.type == NL80211_IFTYPE_MESH_POINT then "sta" can be NULL. > Smatch doesn't know the value of sdata->vif.type at this point, and even > if it did, then it doesn't split the return states up with enough > granularity for that to make a difference. Right, but that wouldn't matter anyway? > 5887 if (err) { > 5888 rcu_read_unlock(); > 5889 return err; > 5890 } > 5891 > 5892 if (!IS_ERR(sta)) { Since this is all independent of the interface type. > 5893 u16 queue = __ieee80211_select_queue(sdata, sta, skb); > 5894 > 5895 skb_set_queue_mapping(skb, queue); > 5896 skb_get_hash(skb); > 5897 > 5898 /* > 5899 * for MLO STA, the SA should be the AP MLD address, but > 5900 * the link ID has been selected already > 5901 */ > --> 5902 if (sta->sta.mlo) > > Which Smatch complains about here. Makes sense, should be "if (sta && sta->sta.mlo)" then I suppose. I'm on vacation now, so if you want to send a patch as a reminder that'd be nice. I might clean this up later - it's not the first time the strange return behaviour semantics of ieee80211_lookup_ra_sta() have gotten confusing ... Thanks! johannes