shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-07 19:30:30 +09:00
Code Issues Packages Projects Releases Wiki Activity

mwifiex: fix potential NULL dereference and use after free

Browse Source 
[ Upstream commit 1dcd942921 ]

There are two defects: (1) passing a NULL bss to
mwifiex_save_hidden_ssid_channels will result in NULL dereference,
(2) using bss after dropping the reference to it via cfg80211_put_bss.
To fix them, the patch moves the buggy code to the branch that bss is
not NULL and puts it before cfg80211_put_bss.

Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Pan Bian
2018-11-29 18:25:19 +08:00
committed by Greg Kroah-Hartman
parent 5de3963e57
commit f49bf9bb7b
1 changed files with 10 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
drivers/net/wireless/marvell/mwifiex/scan.c
View File

@@ -1890,15 +1890,17 @@ mwifiex_parse_single_response_buf(struct mwifiex_private *priv, u8 **bss_info,
ETH_ALEN))
mwifiex_update_curr_bss_params(priv,
bss);
cfg80211_put_bss(priv->wdev.wiphy, bss);
}
if ((chan->flags & IEEE80211_CHAN_RADAR) ||
(chan->flags & IEEE80211_CHAN_NO_IR)) {
mwifiex_dbg(adapter, INFO,
"radar or passive channel %d\n",
channel);
mwifiex_save_hidden_ssid_channels(priv, bss);
if ((chan->flags & IEEE80211_CHAN_RADAR) ||
(chan->flags & IEEE80211_CHAN_NO_IR)) {
mwifiex_dbg(adapter, INFO,
"radar or passive channel %d\n",
channel);
mwifiex_save_hidden_ssid_channels(priv,
bss);
}
cfg80211_put_bss(priv->wdev.wiphy, bss);
}
}
} else {