Re: [PATCH] wifi: nl80211: clear wdev before erroring out of station dump

[netdev-bot+sashiko@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential
issue(s) to consider.

Critical: 0 · High: 0 · Medium: 1 · Low: 1

If you believe none of the issues are legitimate, please reply to each
issue of Medium severity or higher and explain why the AI is wrong.
If any of them are legitimate and you plan to respin, please let patchwork
know by including "pw-bot: cr" as a separate line at the end of your reply
(one such reply per series is enough).

- [Medium] The commit message is still a draft report, not a submittable
  patch.
- [Low] The commit fixes a real ERR_PTR dereference in
  nl80211_dump_station() (net/wireless/nl80211.c), but it has no usable…

--

wifi: nl80211: clear wdev before erroring out of station dump

This patch sets wdev to NULL in the -EAGAIN retry path of
nl80211_dump_station() when __nl80211_lock_held_wdev() returns an error
pointer. Without it, out_err calls wdev_put() on ERR_PTR(-ENODEV) when the
interface is removed while the dump is running.

> Fixes: [fill in before sending - on a full clone run:
>   git log -S '__nl80211_lock_held_wdev' --oneline -- net/wireless/nl80211.c]

[Severity: Low]
This Fixes: tag is still the template placeholder. Could it be filled in?

According to git blame on nl80211_dump_station() in net/wireless/nl80211.c,
the whole -EAGAIN retry block came from commit 599b8a3c549b. That block is
the __nl80211_lock_held_wdev() call, the IS_ERR() check and the
goto out_err. So the tag would presumably be:

Fixes: 599b8a3c549b ("wifi: cfg80211: support unlocked station get/dump")

The one-line code change itself looks right to me.
nl80211_lock_and_recheck() already calls wiphy_unlock() and put_device()
before it returns ERR_PTR(-ENODEV). With wdev = NULL and locked = false,
out_err then has nothing left to do.

> Reported-by: [your name and email]

[Severity: Medium]
This Reported-by: is also an unfilled placeholder. The trailers also have
no Signed-off-by: line.

Documentation/process/submitting-patches.rst requires a sign-off. Can the
patch be applied as it stands?

The log also has text that reads like a cover letter rather than a commit
message:

> Hello,

[ ... ]

> This was found during an assisted (AI-supported) static source review of
> mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07); every code path cited below was re-verified by the
> reporter against that tree. The patch below has NOT been compiled and has
> NOT been runtime tested, and no reproducer was produced - the triggering
> conditions are described above instead. Please treat this as a report for
> verification rather than a battle-tested fix.

Could this text be dropped, or moved below the --- line?

> Affected version/commit: mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07), net/wireless/nl80211.c:9023-9035 (EAGAIN path), nl80211.c:296-306 (__nl80211_lock_held_wdev), nl80211.c:9133-9137 (out_err).

These file:line references only match a single rc snapshot, so they will
go stale. Could they be replaced with function names, or dropped?

The message says the change has not been compiled or runtime tested. Could
the respin be build tested, and add the sign-off at the same time?

-- 
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/ltwfLZuSH-PEFdqMECEU8rHwZCjSL5--7RG-qrW8a-Fwezdgpb1QYiDm-8aCRNIgwY-laqSmHJWAqV4uI092NLEudhWEABdd3B5iGsV4jJ8%3D%40proton.me