On Mon, 2025-05-26 at 17:19 +0800, Wentao Liang wrote: > The function ieee80211_chsw_switch_vifs() calls the function > ieee80211_link_get_chanctx(), but does not check its return value. > The return value is a null pointer if the ieee80211_link_get_chanctx() > fails. This will lead to a null pointer dereference in the following > code "&old_ctx->conf". A proper implementation can be found in > ieee80211_link_use_reserved_assign(). > > Add a null pointer check and goto error handling path if the > function fails. How do you propose it can fail? johannes
