[PATCH 1/3] wifi: rsi: initialize background scan completion data

[Zhao Li]

Background scan completion can expose uninitialized timestamp and BSSID
fields to userspace, while cancellation is reported as a successful scan.

Both completion paths allocate cfg80211_scan_info on the stack but set
only aborted. mac80211 copies the other fields, and nl80211 can emit the
14 uninitialized bytes when the stack value interpreted as TSF is nonzero.

Zero-initialize the result and mark cancellation aborted.

LLM assistance was used to find the bug and review.

Fixes: 7fdcb8e12660 ("rsi: add support for hardware scan offload")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Zhao Li <enderaoelyther@xxxxxxxxx>
---
Validation: W=1 module builds with MODPOST passed with CONFIG_RSI_COEX
enabled and disabled. Not reproduced; RS9113/RS9116 hardware was
unavailable.
Sparse C=2 passed. Targeted Smatch introduced no new diagnostics.

 drivers/net/wireless/rsi/rsi_91x_mac80211.c | 5 +++--
 drivers/net/wireless/rsi/rsi_91x_mgmt.c     | 3 +--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/rsi/rsi_91x_mac80211.c b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
index 3faf2235728b..27bfdb6affaf 100644
--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
@@ -276,7 +276,9 @@ static void rsi_mac80211_cancel_hw_scan(struct ieee80211_hw *hw,
 {
 	struct rsi_hw *adapter = hw->priv;
 	struct rsi_common *common = adapter->priv;
-	struct cfg80211_scan_info info;
+	struct cfg80211_scan_info info = {
+		.aborted = true,
+	};
 
 	rsi_dbg(INFO_ZONE, "***** Hardware scan stop *****\n");
 	mutex_lock(&common->mutex);
@@ -284,7 +286,6 @@ static void rsi_mac80211_cancel_hw_scan(struct ieee80211_hw *hw,
 	if (common->bgscan_en) {
 		if (!rsi_send_bgscan_params(common, RSI_STOP_BGSCAN))
 			common->bgscan_en = false;
-		info.aborted = false;
 		ieee80211_scan_completed(adapter->hw, &info);
 		rsi_dbg(INFO_ZONE, "Back ground scan cancelled\n");
 	}
diff --git a/drivers/net/wireless/rsi/rsi_91x_mgmt.c b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
index d9dcbb255317..9ceb6cba3546 100644
--- a/drivers/net/wireless/rsi/rsi_91x_mgmt.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
@@ -2107,11 +2107,10 @@ static int rsi_handle_ta_confirm_type(struct rsi_common *common,
 	case BG_SCAN_PROBE_REQ:
 		rsi_dbg(INFO_ZONE, "BG scan complete event\n");
 		if (common->bgscan_en) {
-			struct cfg80211_scan_info info;
+			struct cfg80211_scan_info info = {};
 
 			if (!rsi_send_bgscan_params(common, RSI_STOP_BGSCAN))
 				common->bgscan_en = 0;
-			info.aborted = false;
 			ieee80211_scan_completed(adapter->hw, &info);
 		}
 		rsi_dbg(INFO_ZONE, "Background scan completed\n");
-- 
2.56.0