wifi: nl80211: Set num_sub_specs before looping through sub_specs

The processing of the struct cfg80211_sar_specs::sub_specs flexible
array requires its counter, num_sub_specs, to be assigned before the
loop in nl80211_set_sar_specs(). Leave the final assignment after the
loop in place in case fewer ended up in the array.

Fixes: aa4ec06c455d ("wifi: cfg80211: use __counted_by where appropriate")
Signed-off-by: Kees Cook <kees@kernel.org>
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Link: https://patch.msgid.link/20250721183125.work.183-kees@kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index b4bf44768dc809f16d468bb51565840fae16774a..89519aa52893e6c7738d4e24352b0a77bc4e89c8 100644 (file)
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -17559,6 +17559,7 @@ static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info)
        if (!sar_spec)
                return -ENOMEM;
 
+       sar_spec->num_sub_specs = specs;
        sar_spec->type = type;
        specs = 0;
        nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) {