From: Dhyan K Prajapati When switching an interface to monitor mode on drivers that set the IEEE80211_HW_WANT_MONITOR_VIF flag, ieee80211_link_info_change_notify() can pass BSS change notifications to the driver callback even though monitor interfaces have no associated BSS context (link->conf->bss is NULL) This triggers a NULL pointer dereference in drivers like iwldvm when they access BSS-specific fields without checking for NULL. Example crash on Intel Centrino Advanced-N 6205 (iwldvm): BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 5295.135825] fixed the issue by adding a NULL check for link->conf->bss before proceeding to driver notification Tested on Intel Centrino Advanced-N 6205 [Taylor Peak] (rev 34) Signed-off-by: Dhyan K Prajapati --- net/mac80211/main.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/mac80211/main.c b/net/mac80211/main.c index b05e313c7..190222c26 100644 --- a/net/mac80211/main.c +++ b/net/mac80211/main.c @@ -416,6 +416,8 @@ void ieee80211_link_info_change_notify(struct ieee80211_sub_if_data *sdata, case NL80211_IFTYPE_MONITOR: if (!ieee80211_hw_check(&local->hw, WANT_MONITOR_VIF)) return; + if (!link->conf->bss) + return; break; default: break; -- 2.43.0