Skip to content

Commit a066917

Browse files
panjaneyjmberg-intel
authored andcommitted
wifi: mac80211: Fix uninitialized variable with __free() in ieee80211_ml_epcs()
The cleanup attribute runs kfree() when the variable goes out of scope. There is a possibility that the link_elems variable is uninitialized if the loop ends before an assignment is made to this variable. This leads to uninitialized variable bug. Fix this by assigning link_elems to NULL. Signed-off-by: Pagadala Yesu Anjaneyulu <[email protected]> Reviewed-by: Ilan Peer <[email protected]> Signed-off-by: Miri Korenblit <[email protected]> Link: https://patch.msgid.link/20250609213231.eeacd3738a7b.I0f876fa1359daeec47ab3aef098255a9c23efd70@changeid Signed-off-by: Johannes Berg <[email protected]>
1 parent 5300e5e commit a066917

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

net/mac80211/mlme.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10705,8 +10705,8 @@ static void ieee80211_ml_epcs(struct ieee80211_sub_if_data *sdata,
1070510705
*/
1070610706
for_each_mle_subelement(sub, (const u8 *)elems->ml_epcs,
1070710707
elems->ml_epcs_len) {
10708+
struct ieee802_11_elems *link_elems __free(kfree) = NULL;
1070810709
struct ieee80211_link_data *link;
10709-
struct ieee802_11_elems *link_elems __free(kfree);
1071010710
u8 *pos = (void *)sub->data;
1071110711
u16 control;
1071210712
ssize_t len;

0 commit comments

Comments
 (0)