When bringing up the wireless interface via virtual monitor mode, iwlagn_bss_info_changed() can be called with a NULL bss_conf pointer during ieee80211_add_virtual_monitor() -> ieee80211_do_open() sequence. This causes a NULL pointer dereference when the function attempts to access bss_conf fields at offset +0x10. Crash signature: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:iwlagn_bss_info_changed+0x19d/0x640 [iwldvm] Call Trace: drv_link_info_changed+0x2b5/0x2c0 [mac80211] ieee80211_link_info_change_notify+0x13d/0x160 [mac80211] ieee80211_recalc_txpower+0x5c/0x60 [mac80211] ieee80211_assign_link_chanctx+0x182/0x410 [mac80211] ieee80211_add_virtual_monitor+0x17c/0x2b0 [mac80211] ieee80211_do_open+0x6d8/0x740 [mac80211] Add an early NULL check for bss_conf before accessing its members. Hardware: Dell Latitude E6430 WiFi: Intel Centrino Advanced-N 6205 [8086:0085] Kernel: 6.18.7-061807-generic Signed-off-by: Dhyan K Prajapati --- drivers/net/wireless/intel/iwlwifi/dvm/rxon.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/rxon.c b/drivers/net/wireless/intel/iwlwifi/dvm/rxon.c index e08e44cae..2d480b1d1 100644 --- a/drivers/net/wireless/intel/iwlwifi/dvm/rxon.c +++ b/drivers/net/wireless/intel/iwlwifi/dvm/rxon.c @@ -1392,6 +1392,11 @@ void iwlagn_bss_info_changed(struct ieee80211_hw *hw, mutex_lock(&priv->mutex); + + if (!bss_conf) { + mutex_unlock(&priv->mutex); + return; + } if (changes & BSS_CHANGED_IDLE && vif->cfg.idle) { /* * If we go idle, then clearly no "passive-no-rx" -- 2.43.0