On Mon, 2025-05-26 at 17:19 +0800, Wentao Liang wrote:
The function ieee80211_chsw_switch_vifs() calls the function ieee80211_link_get_chanctx(), but does not check its return value. The return value is a null pointer if the ieee80211_link_get_chanctx() fails. This will lead to a null pointer dereference in the following code "&old_ctx->conf". A proper implementation can be found in ieee80211_link_use_reserved_assign().
Add a null pointer check and goto error handling path if the function fails.
How do you propose it can fail?
johannes