The return value of nla_nest_start can be NULL. Add validation to "radio" to fix potential invalid memory access. Change-Id: Iea6b0008e72548e8e4e26cd5eb87a9c5c2dad2c6 CRs-Fixed: 3242444
@@ -14283,6 +14283,10 @@ __wlan_hdd_cfg80211_get_radio_combination_matrix(struct wiphy *wiphy,
if (!comb[comb_idx].band_mask[radio_idx])
break;
radio = nla_nest_start(reply_skb, radio_idx);
+ if (!radio) {
+ ret = -ENOMEM;
+ goto err;
+ }
if (comb[comb_idx].band_mask[radio_idx] ==
BIT(REG_BAND_5G)) {
qca_band = QCA_SETBAND_5G;