linux-kernel - [PATCH] wifi: cfg80211: direct error paths to appropriate exit point in nl80211_dump

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20250715164539.14383-1-sperezglz@gmail.com>
Date: Tue, 15 Jul 2025 10:45:35 -0600
From: Sergio Perez Gonzalez <sperezglz@...il.com>
To: johannes@...solutions.net
Cc: Sergio Perez Gonzalez <sperezglz@...il.com>,
	linux-wireless@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH] wifi: cfg80211: direct error paths to appropriate exit point in nl80211_dump_station()

There are two safety checks which, on error, will go to
cfg80211_sinfo_release_content(), at a point where `sinfo` has not been
initialized to zero or populated with allocated pointers. Bypass
cfg80211_sinfo_release_content() from those two goto's, but also
explicitly clear `sinfo` on declaration to prevent any such issues
in the future.

Link: https://scan7.scan.coverity.com/#/project-view/53936/11354?selectedIssue=1644656
Fixes: 49e47223ecc4 ("wifi: cfg80211: allocate memory for link_station info structure")

Signed-off-by: Sergio Perez Gonzalez <sperezglz@...il.com>
---
 net/wireless/nl80211.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 4e6c0a4e2a82..c516fa5f5e97 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -7446,7 +7446,7 @@ static void cfg80211_sta_set_mld_sinfo(struct station_info *sinfo)
 static int nl80211_dump_station(struct sk_buff *skb,
 				struct netlink_callback *cb)
 {
-	struct station_info sinfo;
+	struct station_info sinfo = {};
 	struct cfg80211_registered_device *rdev;
 	struct wireless_dev *wdev;
 	u8 mac_addr[ETH_ALEN];
@@ -7477,7 +7477,7 @@ static int nl80211_dump_station(struct sk_buff *skb,
 				kzalloc(sizeof(*sinfo.links[0]), GFP_KERNEL);
 			if (!sinfo.links[i]) {
 				err = -ENOMEM;
-				goto out_err;
+				goto out_sinfo_release;
 			}
 		}
 
@@ -7486,7 +7486,7 @@ static int nl80211_dump_station(struct sk_buff *skb,
 		if (err == -ENOENT)
 			break;
 		if (err)
-			goto out_err;
+			goto out_sinfo_release;
 
 		if (sinfo.valid_links)
 			cfg80211_sta_set_mld_sinfo(&sinfo);
@@ -7504,8 +7504,9 @@ static int nl80211_dump_station(struct sk_buff *skb,
  out:
 	cb->args[2] = sta_idx;
 	err = skb->len;
- out_err:
+ out_sinfo_release:
 	cfg80211_sinfo_release_content(&sinfo);
+ out_err:
 	wiphy_unlock(&rdev->wiphy);
 
 	return err;
-- 
2.43.0