From: Daniel Gabay Date: Tue, 12 May 2026 19:34:34 +0000 (+0300) Subject: wifi: iwlwifi: mld: add NULL check for channel in DW end handler X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=dbaece4ef786119efe702f6d8e0f45565bb25c39;p=thirdparty%2Flinux.git wifi: iwlwifi: mld: add NULL check for channel in DW end handler ieee80211_get_channel() can return NULL if the frequency is not registered in the wiphy (e.g. due to regulatory domain restrictions). The returned channel pointer is passed directly to cfg80211_next_nan_dw_notif() which dereferences it unconditionally in both the tracepoint and the netlink message, causing a NULL pointer dereference. Add a NULL check before using the channel pointer. Signed-off-by: Daniel Gabay Reviewed-by: Ilan Peer Link: https://patch.msgid.link/20260512222731.a250203cd1c6.I1d807aab415da30a55dd89a974c3226adc547ebb@changeid Signed-off-by: Miri Korenblit --- diff --git a/drivers/net/wireless/intel/iwlwifi/mld/nan.c b/drivers/net/wireless/intel/iwlwifi/mld/nan.c index 264ea7a9a896..deb72e401e3c 100644 --- a/drivers/net/wireless/intel/iwlwifi/mld/nan.c +++ b/drivers/net/wireless/intel/iwlwifi/mld/nan.c @@ -305,6 +305,9 @@ void iwl_mld_handle_nan_dw_end_notif(struct iwl_mld *mld, return; } + if (WARN_ON_ONCE(!chan)) + return; + wdev = ieee80211_vif_to_wdev(mld->nan_device_vif); cfg80211_next_nan_dw_notif(wdev, chan, GFP_KERNEL); }