__nl80211_lock_held_wdev() can return an ERR_PTR on failure. If this happens, 'wdev' holds an error pointer that bypasses the non-NULL check at 'out_err' and gets passed into wdev_put(), resulting in a dereference. Clear 'wdev' to NULL before jumping to 'out_err' to prevent this. Fixes: 599b8a3c549b ("wifi: cfg80211: support unlocked station get/dump") Signed-off-by: Ethan Tidmore --- net/wireless/nl80211.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index d790e204aee3..739283404531 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -9031,6 +9031,7 @@ static int nl80211_dump_station(struct sk_buff *skb, wdev); if (IS_ERR(wdev)) { err = PTR_ERR(wdev); + wdev = NULL; goto out_err; } -- Thanks, ET https://github.com/sponsors/ethantidmore