[PATCH] wifi: cfg80211: direct error paths to appropriate exit point in nl80211_dump_station()

[PATCH] wifi: cfg80211: direct error paths to appropriate exit point in nl80211_dump_station()

[Sergio Perez Gonzalez]

There are two safety checks which, on error, will go to
cfg80211_sinfo_release_content(), at a point where `sinfo` has not been
initialized to zero or populated with allocated pointers. Bypass
cfg80211_sinfo_release_content() from those two goto's, but also
explicitly clear `sinfo` on declaration to prevent any such issues
in the future.

Link: https://scan7.scan.coverity.com/#/project-view/53936/11354?selectedIssue=1644656
Fixes: 49e47223ecc4 ("wifi: cfg80211: allocate memory for link_station info structure")

Signed-off-by: Sergio Perez Gonzalez <sperezglz@gmail.com>
---
 net/wireless/nl80211.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 4e6c0a4e2a82..c516fa5f5e97 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -7446,7 +7446,7 @@ static void cfg80211_sta_set_mld_sinfo(struct station_info *sinfo)
 static int nl80211_dump_station(struct sk_buff *skb,
 				struct netlink_callback *cb)
 {
-	struct station_info sinfo;
+	struct station_info sinfo = {};
 	struct cfg80211_registered_device *rdev;
 	struct wireless_dev *wdev;
 	u8 mac_addr[ETH_ALEN];
@@ -7477,7 +7477,7 @@ static int nl80211_dump_station(struct sk_buff *skb,
 				kzalloc(sizeof(*sinfo.links[0]), GFP_KERNEL);
 			if (!sinfo.links[i]) {
 				err = -ENOMEM;
-				goto out_err;
+				goto out_sinfo_release;
 			}
 		}
 
@@ -7486,7 +7486,7 @@ static int nl80211_dump_station(struct sk_buff *skb,
 		if (err == -ENOENT)
 			break;
 		if (err)
-			goto out_err;
+			goto out_sinfo_release;
 
 		if (sinfo.valid_links)
 			cfg80211_sta_set_mld_sinfo(&sinfo);
@@ -7504,8 +7504,9 @@ static int nl80211_dump_station(struct sk_buff *skb,
  out:
 	cb->args[2] = sta_idx;
 	err = skb->len;
- out_err:
+ out_sinfo_release:
 	cfg80211_sinfo_release_content(&sinfo);
+ out_err:
 	wiphy_unlock(&rdev->wiphy);
 
 	return err;
-- 
2.43.0