wifi: mac80211: init cnt before accessing elem in ieee80211_copy_mbssid_beacon

With the new __counted_by annocation in cfg80211_mbssid_elems,
the "cnt" struct member must be set before accessing the "elem"
array. Failing to do so will trigger a runtime warning when enabling
CONFIG_UBSAN_BOUNDS and CONFIG_FORTIFY_SOURCE.

Fixes: c14679d7005a ("wifi: cfg80211: Annotate struct cfg80211_mbssid_elems with __counted_by")
Signed-off-by: Haoyu Li <lihaoyu499@gmail.com>
Link: https://patch.msgid.link/20241123172500.311853-1-lihaoyu499@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 61a824ec33da356a9d2c4c99a5507b340bbf909e..1dd61c9bb8f1ba717bfe655add7ccdfe335e765a 100644 (file)
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1088,13 +1088,13 @@ ieee80211_copy_mbssid_beacon(u8 *pos, struct cfg80211_mbssid_elems *dst,
 {
        int i, offset = 0;
 
+       dst->cnt = src->cnt;
        for (i = 0; i < src->cnt; i++) {
                memcpy(pos + offset, src->elem[i].data, src->elem[i].len);
                dst->elem[i].len = src->elem[i].len;
                dst->elem[i].data = pos + offset;
                offset += dst->elem[i].len;
        }
-       dst->cnt = src->cnt;
 
        return offset;
 }