From ccaaef1f8b83fb54756de0d575a43df8d1818be0 Mon Sep 17 00:00:00 2001 From: liting Date: Thu, 2 Jul 2026 15:10:19 +0800 Subject: [PATCH] vwifi: zero-initialize station_info in connect paths Both vwifi_virtio_mgmt_rx_connect_request() and vwifi_connect_routine() allocated struct station_info with kmalloc(), leaving the ->filled bitmap and other members uninitialized. cfg80211 inspects ->filled to decide which fields are valid, so passing garbage there causes it to read uninitialized members, leading to a kernel panic. Use kzalloc() in both call sites to ensure all fields start zeroed. The explicitly assigned assoc_req_ies/assoc_req_ies_len are unaffected, as they are read unconditionally rather than gated by ->filled. --- vwifi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/vwifi.c b/vwifi.c index 287e558..e8ab3f2 100644 --- a/vwifi.c +++ b/vwifi.c @@ -1126,7 +1126,7 @@ static void vwifi_connect_routine(struct work_struct *w) return; /* AP connection part */ - sinfo = kmalloc(sizeof(struct station_info), GFP_KERNEL); + sinfo = kzalloc(sizeof(struct station_info), GFP_KERNEL); if (!sinfo) return; @@ -2843,7 +2843,7 @@ static void vwifi_virtio_mgmt_rx_connect_request( if (ether_addr_equal(sta_ent->mac, src)) return; - sinfo = kmalloc(sizeof(struct station_info), GFP_KERNEL); + sinfo = kzalloc(sizeof(struct station_info), GFP_KERNEL); if (!sinfo) return;