diff options
| author | Kees Cook <kees@kernel.org> | 2025-07-21 11:31:29 -0700 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2025-07-22 10:38:39 +0200 |
| commit | 2ed9a9fc9976262109d04f1a3c75c46de8ce4f22 (patch) | |
| tree | aea0d5b72ccbed8d40d8a64f9aa1a90c3ccdf6f1 /net/wireless | |
| parent | wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() (diff) | |
| download | linux-2ed9a9fc9976262109d04f1a3c75c46de8ce4f22.tar.gz linux-2ed9a9fc9976262109d04f1a3c75c46de8ce4f22.zip | |
wifi: nl80211: Set num_sub_specs before looping through sub_specs
The processing of the struct cfg80211_sar_specs::sub_specs flexible
array requires its counter, num_sub_specs, to be assigned before the
loop in nl80211_set_sar_specs(). Leave the final assignment after the
loop in place in case fewer ended up in the array.
Fixes: aa4ec06c455d ("wifi: cfg80211: use __counted_by where appropriate")
Signed-off-by: Kees Cook <kees@kernel.org>
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Link: https://patch.msgid.link/20250721183125.work.183-kees@kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/wireless')
| -rw-r--r-- | net/wireless/nl80211.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index b4bf44768dc8..89519aa52893 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -17559,6 +17559,7 @@ static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info) if (!sar_spec) return -ENOMEM; + sar_spec->num_sub_specs = specs; sar_spec->type = type; specs = 0; nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) { |