Skip to contentSkip to conversation

wifi: nl80211: Set num_sub_specs before looping through sub_specs

PATCH In review Kees Cook 2 participants 2 messages Jul 21, 2025 802.11 (including cfg80211/NL80211)

lore
Share & tools
lore

Kees Cook

author
#0 lore raw

PATCH 1/1 wifi: nl80211: Set num_sub_specs before looping through sub_specs

The processing of the struct cfg80211_sar_specs::sub_specs flexible array requires its counter, num_sub_specs, to be assigned before the loop in nl80211_set_sar_specs(). Leave the final assignment after the loop in place in case fewer ended up in the array.

Fixes aa4ec06c455d ("wifi: cfg80211: use __counted_by where appropriate")
Signed-off-by Kees Cook <[email protected]>

---
Cc: Johannes Berg <[email protected]>
Cc: Dmitry Antipov <[email protected]>
Cc: <[email protected]>

---
 net/wireless/nl80211.c | 1 +
 1 file changed, 1 insertion(+)
net/wireless/nl80211.c +1 -0
index 1c808b08b747..db8b089454ca 100644
@@ -17559,6 +17559,7 @@ static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info)
 	if (!sar_spec)
 		return -ENOMEM;
 
+	sar_spec->num_sub_specs = specs;
 	sar_spec->type = type;
 	specs = 0;
 	nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) {
Signature · 1 line
2.34.1
Reviewed-by on v1 1/1
#1 lore raw
Quoted 7 lines · Kees Cook

The processing of the struct cfg80211_sar_specs::sub_specs flexible array requires its counter, num_sub_specs, to be assigned before the loop in nl80211_set_sar_specs(). Leave the final assignment after the loop in place in case fewer ended up in the array.

Fixes aa4ec06c455d ("wifi: cfg80211: use __counted_by where appropriate")
Signed-off-by Kees Cook <[email protected]>
Reviewed-by Gustavo A. R. Silva <[email protected]>

Thanks!
-Gustavo

Quoted 20 lines

---
Cc: Johannes Berg <[email protected]>
Cc: Dmitry Antipov <[email protected]>
Cc: <[email protected]>

---
  net/wireless/nl80211.c | 1 +
  1 file changed, 1 insertion(+)
net/wireless/nl80211.c +1 -0
index 1c808b08b747..db8b089454ca 100644
@@ -17559,6 +17559,7 @@ static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info)
  	if (!sar_spec)
  		return -ENOMEM;
 
+	sar_spec->num_sub_specs = specs;
  	sar_spec->type = type;
  	specs = 0;
  	nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) {