Skip to contentSkip to conversation

wifi: cfg80211: Move cfg80211_scan_req_add_chan() n_channels increment earlier

PATCH In review Kees Cook 2 participants 2 messages Dec 30, 2024 802.11 (including cfg80211/NL80211)

lore
Share & tools
lore

Kees Cook

author
#0 lore raw

PATCH 1/1 wifi: cfg80211: Move cfg80211_scan_req_add_chan() n_channels increment earlier

Since adding __counted_by(n_channels) to struct cfg80211_scan_request, anything adding to the channels array must increment n_channels first. Move n_channels increment earlier.

Reported-by John Rowley <[email protected]>
Closes https://lore.kernel.org/stable/1815535c709ba9d9.156c6a5c9cdf6e59.b249b6b6a5ee4634@localhost.localdomain/ open here
Fixes aa4ec06c455d ("wifi: cfg80211: use __counted_by where appropriate")
Signed-off-by Kees Cook <[email protected]>

---
Cc: Johannes Berg <[email protected]>
Cc: Dmitry Antipov <[email protected]>
Cc: Nathan Chancellor <[email protected]>
Cc: [email protected]

---
 net/wireless/scan.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)
net/wireless/scan.c +1 -2
index 1c6fd45aa809..ccdbeb604639 100644
@@ -763,12 +763,11 @@ static  void cfg80211_scan_req_add_chan(struct cfg80211_scan_request *request,
 		}
 	}
 
+	request->n_channels++;
 	request->channels[n_channels] = chan;
 	if (add_to_6ghz)
 		request->scan_6ghz_params[request->n_6ghz_params].channel_idx =
 			n_channels;
-
-	request->n_channels++;
 }
 
 static bool cfg80211_find_ssid_match(struct cfg80211_colocated_ap *ap,
Signature · 1 line
2.34.1
Reviewed-by on v1 1/1
#1 lore raw
Quoted 8 lines · Kees Cook

Since adding __counted_by(n_channels) to struct cfg80211_scan_request, anything adding to the channels array must increment n_channels first. Move n_channels increment earlier.

Reported-by John Rowley <[email protected]>
Closes https://lore.kernel.org/stable/1815535c709ba9d9.156c6a5c9cdf6e59.b249b6b6a5ee4634@localhost.localdomain/ open here
Fixes aa4ec06c455d ("wifi: cfg80211: use __counted_by where appropriate")
Signed-off-by Kees Cook <[email protected]>
Reviewed-by Gustavo A. R. Silva <[email protected]>

-Gustavo

Quoted 27 lines

---
Cc: Johannes Berg <[email protected]>
Cc: Dmitry Antipov <[email protected]>
Cc: Nathan Chancellor <[email protected]>
Cc: [email protected]

---
  net/wireless/scan.c | 3 +--
  1 file changed, 1 insertion(+), 2 deletions(-)
net/wireless/scan.c +1 -2
index 1c6fd45aa809..ccdbeb604639 100644
@@ -763,12 +763,11 @@ static  void cfg80211_scan_req_add_chan(struct cfg80211_scan_request *request,
  		}
  	}
 
+	request->n_channels++;
  	request->channels[n_channels] = chan;
  	if (add_to_6ghz)
  		request->scan_6ghz_params[request->n_6ghz_params].channel_idx =
  			n_channels;
-
-	request->n_channels++;
  }
 
  static bool cfg80211_find_ssid_match(struct cfg80211_colocated_ap *ap,