[PATCH] wifi: nl80211: clear wdev before erroring out of station dump

[Noah Weinberger]

Hello,

In nl80211_dump_station(), the new -EAGAIN retry path calls
__nl80211_lock_held_wdev(), which drops the reference we hold and then
re-looks up the wdev under the wiphy mutex. If the wdev is being
removed, that lookup returns ERR_PTR(-ENODEV).

The IS_ERR branch jumps to out_err with 'wdev' still set to the error
pointer, and out_err then does:

    else if (wdev)
            wdev_put(wdev);

i.e. wdev_put() is called on ERR_PTR(-ENODEV), dereferencing an
unmapped kernel address (~0xd). The station dump requires no
capabilities, so any local user can reach the trigger while a
concurrent interface removal (admin action or unplug) closes the race.
The result is a kernel oops in the dumping task, or a full panic with
panic_on_oops.

The sibling handlers nl80211_get_station() and nl80211_tx_mgmt() never
put the error pointer; the dump path is the only one that does. Clear
wdev before jumping to the error label.

Affected version/commit: mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07), net/wireless/nl80211.c:9023-9035 (EAGAIN path), nl80211.c:296-306 (__nl80211_lock_held_wdev), nl80211.c:9133-9137 (out_err).
Introduced in the v7.4 merge window (unlocked station-dump rework).

This was found during an assisted (AI-supported) static source review of
mainline fa4ad798f6f681031775266044ba1b0cf3c670bd (v7.4-rc1, 2026-11-07); every code path cited below was re-verified by the
reporter against that tree. The patch below has NOT been compiled and has
NOT been runtime tested, and no reproducer was produced - the triggering
conditions are described above instead. Please treat this as a report for
verification rather than a battle-tested fix.

Fixes: [fill in before sending - on a full clone run:
  git log -S '__nl80211_lock_held_wdev' --oneline -- net/wireless/nl80211.c]
Reported-by: [your name and email]
---
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index d790e20..7392834 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -9031,6 +9031,7 @@ static int nl80211_dump_station(struct sk_buff *skb,
 								wdev);
 				if (IS_ERR(wdev)) {
 					err = PTR_ERR(wdev);
+					wdev = NULL;
 					goto out_err;
 				}