nl80211_lock_and_recheck() can return an ERR_PTR on failure. If this happens, 'wdev' holds an error pointer that bypasses the non-NULL check at 'out' and gets passed into wdev_put(), resulting in a dereference. Clear 'wdev' to NULL before jumping to 'out' to prevent this. Fixes: 8e3d9039d280 ("wifi: nl80211: avoid rtnl for commands that don't want it") Signed-off-by: Ethan Tidmore --- net/wireless/nl80211.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index d790e204aee3..7a5f7000fbaa 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -20192,6 +20192,7 @@ static int nl80211_pre_doit(const struct genl_split_ops *ops, wdev = nl80211_lock_and_recheck(rdev, netns, wdev_id); if (IS_ERR(wdev)) { err = PTR_ERR(wdev); + wdev = NULL; goto out; } } -- Thanks, ET https://github.com/sponsors/ethantidmore