[PATCH] wifi: nl80211: clear wdev before erroring out of station dump

[PATCH] wifi: nl80211: clear wdev before erroring out of station dump

[Noah Weinberger]

Hello,

In nl80211_dump_station(), the new -EAGAIN retry path calls
__nl80211_lock_held_wdev(), which drops the reference we hold and then
re-looks up the wdev under the wiphy mutex. If the wdev is being
removed, that lookup returns ERR_PTR(-ENODEV).

The IS_ERR branch jumps to out_err with 'wdev' still set to the error
pointer, and out_err then does:

    else if (wdev)
            wdev_put(wdev);

i.e. wdev_put() is called on ERR_PTR(-ENODEV), dereferencing an
unmapped kernel address (~0xd). The station dump requires no
capabilities, so any local user can reach the trigger while a
concurrent interface removal (admin action or unplug) closes the race.
The result is a kernel oops in the dumping task, or a full panic with
panic_on_oops.

The sibling handlers nl80211_get_station() and nl80211_tx_mgmt() never
put the error pointer; the dump path is the only one that does. Clear
wdev before jumping to the error label.

Affected version/commit: mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07), net/wireless/nl80211.c:9023-9035 (EAGAIN path), nl80211.c:296-306 (__nl80211_lock_held_wdev), nl80211.c:9133-9137 (out_err).
Introduced in the v7.4 merge window (unlocked station-dump rework).

This was found during an assisted (AI-supported) static source review of
mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07); every code path cited below was re-verified by the
reporter against that tree. The patch below has NOT been compiled and has
NOT been runtime tested, and no reproducer was produced - the triggering
conditions are described above instead. Please treat this as a report for
verification rather than a battle-tested fix.

Fixes: [fill in before sending - on a full clone run:
  git log -S '__nl80211_lock_held_wdev' --oneline -- net/wireless/nl80211.c]
Reported-by: [your name and email]
---
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index d790e20..7392834 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -9031,6 +9031,7 @@ static int nl80211_dump_station(struct sk_buff *skb,
 								wdev);
 				if (IS_ERR(wdev)) {
 					err = PTR_ERR(wdev);
+					wdev = NULL;
 					goto out_err;
 				}

Re: [PATCH] wifi: nl80211: clear wdev before erroring out of station dump

[Greg KH]

On Sun, Nov 08, 2026 at 09:57:39PM +0000, Noah Weinberger wrote:
> Hello,
> 
> In nl80211_dump_station(), the new -EAGAIN retry path calls
> __nl80211_lock_held_wdev(), which drops the reference we hold and then
> re-looks up the wdev under the wiphy mutex. If the wdev is being
> removed, that lookup returns ERR_PTR(-ENODEV).
> 
> The IS_ERR branch jumps to out_err with 'wdev' still set to the error
> pointer, and out_err then does:
> 
>     else if (wdev)
>             wdev_put(wdev);
> 
> i.e. wdev_put() is called on ERR_PTR(-ENODEV), dereferencing an
> unmapped kernel address (~0xd). The station dump requires no
> capabilities, so any local user can reach the trigger while a
> concurrent interface removal (admin action or unplug) closes the race.
> The result is a kernel oops in the dumping task, or a full panic with
> panic_on_oops.
> 
> The sibling handlers nl80211_get_station() and nl80211_tx_mgmt() never
> put the error pointer; the dump path is the only one that does. Clear
> wdev before jumping to the error label.
> 
> Affected version/commit: mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07), net/wireless/nl80211.c:9023-9035 (EAGAIN path), nl80211.c:296-306 (__nl80211_lock_held_wdev), nl80211.c:9133-9137 (out_err).
> Introduced in the v7.4 merge window (unlocked station-dump rework).
> 
> This was found during an assisted (AI-supported) static source review of
> mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07); every code path cited below was re-verified by the
> reporter against that tree. The patch below has NOT been compiled and has
> NOT been runtime tested, and no reproducer was produced - the triggering
> conditions are described above instead. Please treat this as a report for
> verification rather than a battle-tested fix.
> 
> Fixes: [fill in before sending - on a full clone run:
>   git log -S '__nl80211_lock_held_wdev' --oneline -- net/wireless/nl80211.c]
> Reported-by: [your name and email]

I think you forgot to read the patch your LLM spit out :(

Re: [PATCH] wifi: nl80211: clear wdev before erroring out of station dump

[netdev-bot+sashiko]

Thank you for your contribution! Sashiko AI review found 2 potential
issue(s) to consider.

Critical: 0 · High: 0 · Medium: 1 · Low: 1

If you believe none of the issues are legitimate, please reply to each
issue of Medium severity or higher and explain why the AI is wrong.
If any of them are legitimate and you plan to respin, please let patchwork
know by including "pw-bot: cr" as a separate line at the end of your reply
(one such reply per series is enough).

- [Medium] The commit message is still a draft report, not a submittable
  patch.
- [Low] The commit fixes a real ERR_PTR dereference in
  nl80211_dump_station() (net/wireless/nl80211.c), but it has no usable…

--

wifi: nl80211: clear wdev before erroring out of station dump

This patch sets wdev to NULL in the -EAGAIN retry path of
nl80211_dump_station() when __nl80211_lock_held_wdev() returns an error
pointer. Without it, out_err calls wdev_put() on ERR_PTR(-ENODEV) when the
interface is removed while the dump is running.

> Fixes: [fill in before sending - on a full clone run:
>   git log -S '__nl80211_lock_held_wdev' --oneline -- net/wireless/nl80211.c]

[Severity: Low]
This Fixes: tag is still the template placeholder. Could it be filled in?

According to git blame on nl80211_dump_station() in net/wireless/nl80211.c,
the whole -EAGAIN retry block came from commit 599b8a3c549b. That block is
the __nl80211_lock_held_wdev() call, the IS_ERR() check and the
goto out_err. So the tag would presumably be:

Fixes: 599b8a3c549b ("wifi: cfg80211: support unlocked station get/dump")

The one-line code change itself looks right to me.
nl80211_lock_and_recheck() already calls wiphy_unlock() and put_device()
before it returns ERR_PTR(-ENODEV). With wdev = NULL and locked = false,
out_err then has nothing left to do.

> Reported-by: [your name and email]

[Severity: Medium]
This Reported-by: is also an unfilled placeholder. The trailers also have
no Signed-off-by: line.

Documentation/process/submitting-patches.rst requires a sign-off. Can the
patch be applied as it stands?

The log also has text that reads like a cover letter rather than a commit
message:

> Hello,

[ ... ]

> This was found during an assisted (AI-supported) static source review of
> mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07); every code path cited below was re-verified by the
> reporter against that tree. The patch below has NOT been compiled and has
> NOT been runtime tested, and no reproducer was produced - the triggering
> conditions are described above instead. Please treat this as a report for
> verification rather than a battle-tested fix.

Could this text be dropped, or moved below the --- line?

> Affected version/commit: mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07), net/wireless/nl80211.c:9023-9035 (EAGAIN path), nl80211.c:296-306 (__nl80211_lock_held_wdev), nl80211.c:9133-9137 (out_err).

These file:line references only match a single rc snapshot, so they will
go stale. Could they be replaced with function names, or dropped?

The message says the change has not been compiled or runtime tested. Could
the respin be build tested, and add the sign-off at the same time?

-- 
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/ltwfLZuSH-PEFdqMECEU8rHwZCjSL5--7RG-qrW8a-Fwezdgpb1QYiDm-8aCRNIgwY-laqSmHJWAqV4uI092NLEudhWEABdd3B5iGsV4jJ8%3D%40proton.me