[PATCH v2] hostapd: ucode: initialize conf before iface_start early jump

[John Macias]

uc_hostapd_iface_start() jumps to the out: label when it is called
without an info argument, which skips the assignment of conf. The code
after out: dereferences conf (conf->channel), so iface.start() without
arguments reads an uninitialized pointer.

hostapd.uc calls iface.start() that way for apsta_state with up=true and
no frequency. On a Netgear RAX120 v1 (ipq807x, ath11k) running an AP-only
radio, apsta_state {"up": false} followed by {"up": true} reliably
crashed hostapd with SIGSEGV in uc_hostapd_iface_start(); the ubus call
then timed out and procd restarted wpad.

Move the assignment of conf before the jump. With this change the same
stop/start sequence was repeated three times: the AP came back each time
and hostapd kept running.

Assisted-by: LLM
Signed-off-by: John Macias <dencity7 at gmail.com>
---
v2: resend; v1 was garbled by my mail client (context lines lost their
leading space). No code changes.

 package/network/services/hostapd/src/src/ap/ucode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package/network/services/hostapd/src/src/ap/ucode.c b/package/network/services/hostapd/src/src/ap/ucode.c
index 526f8f4a..8afbe7ee 100644
--- a/package/network/services/hostapd/src/src/ap/ucode.c
+++ b/package/network/services/hostapd/src/src/ap/ucode.c
@@ -768,6 +768,7 @@ uc_hostapd_iface_start(uc_vm_t *vm, size_t nargs)
 	if (!iface)
 		return NULL;
 
+	conf = iface->conf;
 	if (!info)
 		goto out;
 
@@ -783,7 +784,6 @@ uc_hostapd_iface_start(uc_vm_t *vm, size_t nargs)
 		}								\
 	} while(0)
 
-	conf = iface->conf;
 	UPDATE_VAL(op_class, "op_class");
 	UPDATE_VAL(hw_mode, "hw_mode");
 	UPDATE_VAL(channel, "channel");
-- 
2.47.3