Commit 2ed9a9fc authored by Kees Cook's avatar Kees Cook Committed by Johannes Berg
Browse files

wifi: nl80211: Set num_sub_specs before looping through sub_specs 



The processing of the struct cfg80211_sar_specs::sub_specs flexible
array requires its counter, num_sub_specs, to be assigned before the
loop in nl80211_set_sar_specs(). Leave the final assignment after the
loop in place in case fewer ended up in the array.

Fixes: aa4ec06c ("wifi: cfg80211: use __counted_by where appropriate")
Signed-off-by: default avatarKees Cook <kees@kernel.org>
Reviewed-by: default avatarGustavo A. R. Silva <gustavoars@kernel.org>
Link: https://patch.msgid.link/20250721183125.work.183-kees@kernel.org


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent a37192c4

net/wireless/nl80211.c

+1 −0
Original line number Diff line number Diff line
@@ -17559,6 +17559,7 @@ static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info) 
	if (!sar_spec)

		return -ENOMEM;









	sar_spec->num_sub_specs = specs;









	sar_spec->type = type;









	specs = 0;









	nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) {