Re: [PATCH] wifi: nl80211: clear wdev before erroring out of station dump

[Greg KH <gregkh@linuxfoundation.org>]

On Sun, Nov 08, 2026 at 09:57:39PM +0000, Noah Weinberger wrote:
> Hello,
> 
> In nl80211_dump_station(), the new -EAGAIN retry path calls
> __nl80211_lock_held_wdev(), which drops the reference we hold and then
> re-looks up the wdev under the wiphy mutex. If the wdev is being
> removed, that lookup returns ERR_PTR(-ENODEV).
> 
> The IS_ERR branch jumps to out_err with 'wdev' still set to the error
> pointer, and out_err then does:
> 
>     else if (wdev)
>             wdev_put(wdev);
> 
> i.e. wdev_put() is called on ERR_PTR(-ENODEV), dereferencing an
> unmapped kernel address (~0xd). The station dump requires no
> capabilities, so any local user can reach the trigger while a
> concurrent interface removal (admin action or unplug) closes the race.
> The result is a kernel oops in the dumping task, or a full panic with
> panic_on_oops.
> 
> The sibling handlers nl80211_get_station() and nl80211_tx_mgmt() never
> put the error pointer; the dump path is the only one that does. Clear
> wdev before jumping to the error label.
> 
> Affected version/commit: mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07), net/wireless/nl80211.c:9023-9035 (EAGAIN path), nl80211.c:296-306 (__nl80211_lock_held_wdev), nl80211.c:9133-9137 (out_err).
> Introduced in the v7.4 merge window (unlocked station-dump rework).
> 
> This was found during an assisted (AI-supported) static source review of
> mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07); every code path cited below was re-verified by the
> reporter against that tree. The patch below has NOT been compiled and has
> NOT been runtime tested, and no reproducer was produced - the triggering
> conditions are described above instead. Please treat this as a report for
> verification rather than a battle-tested fix.
> 
> Fixes: [fill in before sending - on a full clone run:
>   git log -S '__nl80211_lock_held_wdev' --oneline -- net/wireless/nl80211.c]
> Reported-by: [your name and email]

I think you forgot to read the patch your LLM spit out :(