nl80211: NULL pointer check for msg in i802_flush()

Pointer 'msg' from nl80211_bss_msg() might be NULL and might be
dereferenced by nla_put_u8(), so need to check for memory allocation
failure explicitly here.

Fixes: b1e463374e ("AP MLD: Link-specific flushing of stations")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>

diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
index 2856d458415567558de5f7ea5669fdc44b855f5b..3f9789df3745f84df8decfadb341068a390f89b1 100644 (file)
--- a/src/drivers/driver_nl80211.c
+++ b/src/drivers/driver_nl80211.c
@@ -7882,6 +7882,8 @@ static int i802_flush(void *priv, int link_id)
         * XXX: FIX! this needs to flush all VLANs too
         */
        msg = nl80211_bss_msg(bss, 0, NL80211_CMD_DEL_STATION);
+       if (!msg)
+               goto fail;
        if (link_id >= 0 && (bss->valid_links & BIT(link_id)) &&
            nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
                goto fail;