From: Daniel Gabay ieee80211_get_channel() can return NULL if the frequency is not registered in the wiphy (e.g. due to regulatory domain restrictions). The returned channel pointer is passed directly to cfg80211_next_nan_dw_notif() which dereferences it unconditionally in both the tracepoint and the netlink message, causing a NULL pointer dereference. Add a NULL check before using the channel pointer. Fixes: 600941464991 ("wifi: iwlwifi: mld: Declare support for NAN capabilities") Signed-off-by: Daniel Gabay Reviewed-by: Ilan Peer Signed-off-by: Miri Korenblit --- drivers/net/wireless/intel/iwlwifi/mld/nan.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/intel/iwlwifi/mld/nan.c b/drivers/net/wireless/intel/iwlwifi/mld/nan.c index 264ea7a9a896..deb72e401e3c 100644 --- a/drivers/net/wireless/intel/iwlwifi/mld/nan.c +++ b/drivers/net/wireless/intel/iwlwifi/mld/nan.c @@ -305,6 +305,9 @@ void iwl_mld_handle_nan_dw_end_notif(struct iwl_mld *mld, return; } + if (WARN_ON_ONCE(!chan)) + return; + wdev = ieee80211_vif_to_wdev(mld->nan_device_vif); cfg80211_next_nan_dw_notif(wdev, chan, GFP_KERNEL); } -- 2.34.1