[PATCH] wifi: nl80211: clear wdev before erroring out of station dump

[PATCH] wifi: nl80211: clear wdev before erroring out of station dump

[Noah Weinberger]

Hello,

In nl80211_dump_station(), the new -EAGAIN retry path calls
__nl80211_lock_held_wdev(), which drops the reference we hold and then
re-looks up the wdev under the wiphy mutex. If the wdev is being
removed, that lookup returns ERR_PTR(-ENODEV).

The IS_ERR branch jumps to out_err with 'wdev' still set to the error
pointer, and out_err then does:

    else if (wdev)
            wdev_put(wdev);

i.e. wdev_put() is called on ERR_PTR(-ENODEV), dereferencing an
unmapped kernel address (~0xd). The station dump requires no
capabilities, so any local user can reach the trigger while a
concurrent interface removal (admin action or unplug) closes the race.
The result is a kernel oops in the dumping task, or a full panic with
panic_on_oops.

The sibling handlers nl80211_get_station() and nl80211_tx_mgmt() never
put the error pointer; the dump path is the only one that does. Clear
wdev before jumping to the error label.

Affected version/commit: mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07), net/wireless/nl80211.c:9023-9035 (EAGAIN path), nl80211.c:296-306 (__nl80211_lock_held_wdev), nl80211.c:9133-9137 (out_err).
Introduced in the v7.4 merge window (unlocked station-dump rework).

This was found during an assisted (AI-supported) static source review of
mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07); every code path cited below was re-verified by the
reporter against that tree. The patch below has NOT been compiled and has
NOT been runtime tested, and no reproducer was produced - the triggering
conditions are described above instead. Please treat this as a report for
verification rather than a battle-tested fix.

Fixes: [fill in before sending - on a full clone run:
  git log -S '__nl80211_lock_held_wdev' --oneline -- net/wireless/nl80211.c]
Reported-by: [your name and email]
---
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index d790e20..7392834 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -9031,6 +9031,7 @@ static int nl80211_dump_station(struct sk_buff *skb,
 								wdev);
 				if (IS_ERR(wdev)) {
 					err = PTR_ERR(wdev);
+					wdev = NULL;
 					goto out_err;
 				}

Re: [PATCH] wifi: nl80211: clear wdev before erroring out of station dump

[Greg KH]

On Sun, Nov 08, 2026 at 09:57:39PM +0000, Noah Weinberger wrote:
> Hello,
> 
> In nl80211_dump_station(), the new -EAGAIN retry path calls
> __nl80211_lock_held_wdev(), which drops the reference we hold and then
> re-looks up the wdev under the wiphy mutex. If the wdev is being
> removed, that lookup returns ERR_PTR(-ENODEV).
> 
> The IS_ERR branch jumps to out_err with 'wdev' still set to the error
> pointer, and out_err then does:
> 
>     else if (wdev)
>             wdev_put(wdev);
> 
> i.e. wdev_put() is called on ERR_PTR(-ENODEV), dereferencing an
> unmapped kernel address (~0xd). The station dump requires no
> capabilities, so any local user can reach the trigger while a
> concurrent interface removal (admin action or unplug) closes the race.
> The result is a kernel oops in the dumping task, or a full panic with
> panic_on_oops.
> 
> The sibling handlers nl80211_get_station() and nl80211_tx_mgmt() never
> put the error pointer; the dump path is the only one that does. Clear
> wdev before jumping to the error label.
> 
> Affected version/commit: mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07), net/wireless/nl80211.c:9023-9035 (EAGAIN path), nl80211.c:296-306 (__nl80211_lock_held_wdev), nl80211.c:9133-9137 (out_err).
> Introduced in the v7.4 merge window (unlocked station-dump rework).
> 
> This was found during an assisted (AI-supported) static source review of
> mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07); every code path cited below was re-verified by the
> reporter against that tree. The patch below has NOT been compiled and has
> NOT been runtime tested, and no reproducer was produced - the triggering
> conditions are described above instead. Please treat this as a report for
> verification rather than a battle-tested fix.
> 
> Fixes: [fill in before sending - on a full clone run:
>   git log -S '__nl80211_lock_held_wdev' --oneline -- net/wireless/nl80211.c]
> Reported-by: [your name and email]

I think you forgot to read the patch your LLM spit out :(