From: Johannes Berg If the wdev disappears during an unlocked dump that the driver returned -EAGAIN for (to get it locked), the code will attempt to dereference the ERR_PTR() on the way out. Since it's obviously not locked in that case (it wasn't even found), return instead of using the error label. Fixes: 599b8a3c549b ("wifi: cfg80211: support unlocked station get/dump") Reviewed-by: Miriam Rachel Korenblit Signed-off-by: Johannes Berg --- net/wireless/nl80211.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 2fc680382418..a49224a5f83b 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -9046,10 +9046,8 @@ static int nl80211_dump_station(struct sk_buff *skb, /* this fails if the wdev is being removed */ wdev = __nl80211_lock_held_wdev(rdev, netns, wdev); - if (IS_ERR(wdev)) { - err = PTR_ERR(wdev); - goto out_err; - } + if (IS_ERR(wdev)) + return PTR_ERR(wdev); /* try again locked now */ locked = true; -- 2.56.0