[PATCH] NAN: Fix maybe-uninitialized warnings in peer schedule handling

[Qingling Wu]

From 7917a95f7e7855d710111c6657f5ce3bb22bf759 Mon Sep 17 00:00:00 2001

NXP Public
From: Qingling Wu <qingling.wu at nxp.com>
Date: Tue, 20 Oct 2026 00:52:31 -0700
Subject: [PATCH] NAN: Fix maybe-uninitialized warnings in peer schedule
 handling

wpas_nan_set_peer_schedule_cb() declares `ret` without an initializer.
If wpas_nan_set_peer_sched_chan() fails while building the local map
list, the function jumps to `out` before any of the three assignments
to `ret` (wpa_drv_sta_add(), wpa_drv_nan_config_peer_schedule(),
wpa_drv_sta_remove()) are reached, so the final `return ret;` can
return an uninitialized value. Initialize `ret` to 0 at declaration.

nan_peer_set_sched() declares `map` inside a dl_list_for_each loop
body without an initializer. When the committed schedule has no map
entries (sched->n_maps == 0), the inner `for` loop body never
executes and `map` is never assigned, even though the subsequent
`if (i == sched->n_maps) continue;` check prevents it from actually
being dereferenced. GCC's flow analysis cannot prove this invariant
across the loop/break/continue structure and flags the memcpy use of
`map` as possibly uninitialized. Initialize `map` to NULL at
declaration to keep -Werror=maybe-uninitialized builds working.

Reproduced with arm-zephyr-eabi-gcc 14.3.0 -Og -Werror=maybe-uninitialized
(Zephyr toolchain), no special build options required beyond -Werror,
so this is not specific to the Zephyr build.

Signed-off-by: Qingling Wu <qingling.wu at nxp.com>
---
 src/nan/nan.c                   | 2 +-
 wpa_supplicant/nan_supplicant.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/nan/nan.c b/src/nan/nan.c
index 293e99ff0..b61843a82 100644
--- a/src/nan/nan.c
+++ b/src/nan/nan.c
@@ -3026,7 +3026,7 @@ static void nan_peer_set_sched(struct nan_data *nan, struct nan_peer *peer,
         * schedule and store the copy of the time bitmap.
         */
        dl_list_for_each(cur, &sched_entries, struct nan_avail_entry, list) {
-               struct nan_map *map;
+               struct nan_map *map = NULL;
                unsigned int i;

                for (i = 0; i < sched->n_maps; i++) {
diff --git a/wpa_supplicant/nan_supplicant.c b/wpa_supplicant/nan_supplicant.c
index 63b7101dc..453779238 100644
--- a/wpa_supplicant/nan_supplicant.c
+++ b/wpa_supplicant/nan_supplicant.c
@@ -252,7 +252,7 @@ static int wpas_nan_set_peer_schedule_cb(void *ctx, const u8 *nmi_addr,
 {
        struct wpa_supplicant *wpa_s = ctx;
        struct nan_peer_schedule_config peer_sched;
-       int i, j, ret;
+       int i, j, ret = 0;

        wpa_printf(MSG_DEBUG, "NAN: Set peer schedule - nmi_addr=" MACSTR
                   " new_sta=%d cdw=%u seq_id=%u max_chan_switch_time=%u",
--
2.34.1