mwifiex: fix potential NULL dereference and use after free
authorPan Bian <bianpan2016@163.com>
Thu, 29 Nov 2018 10:25:19 +0000 (18:25 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 5 Dec 2019 08:20:05 +0000 (09:20 +0100)
commit1450ff72007696a33b39cc82f1b419d128bbd233
tree2aca8a0573fac13f6bc3072ee388c80ed3188749
parent4912b454e029ff508754a63347e57746442021a3
mwifiex: fix potential NULL dereference and use after free

[ Upstream commit 1dcd9429212b98bea87fc6ec92fb50bf5953eb47 ]

There are two defects: (1) passing a NULL bss to
mwifiex_save_hidden_ssid_channels will result in NULL dereference,
(2) using bss after dropping the reference to it via cfg80211_put_bss.
To fix them, the patch moves the buggy code to the branch that bss is
not NULL and puts it before cfg80211_put_bss.

Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/wireless/marvell/mwifiex/scan.c