mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-10 10:39:26 +00:00
mwifiex: fix potential NULL dereference and use after free
[ Upstream commit 1dcd942921
]
There are two defects: (1) passing a NULL bss to
mwifiex_save_hidden_ssid_channels will result in NULL dereference,
(2) using bss after dropping the reference to it via cfg80211_put_bss.
To fix them, the patch moves the buggy code to the branch that bss is
not NULL and puts it before cfg80211_put_bss.
Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
4912b454e0
commit
1450ff7200
1 changed files with 10 additions and 8 deletions
|
@ -1906,15 +1906,17 @@ mwifiex_parse_single_response_buf(struct mwifiex_private *priv, u8 **bss_info,
|
|||
ETH_ALEN))
|
||||
mwifiex_update_curr_bss_params(priv,
|
||||
bss);
|
||||
cfg80211_put_bss(priv->wdev.wiphy, bss);
|
||||
}
|
||||
|
||||
if ((chan->flags & IEEE80211_CHAN_RADAR) ||
|
||||
(chan->flags & IEEE80211_CHAN_NO_IR)) {
|
||||
mwifiex_dbg(adapter, INFO,
|
||||
"radar or passive channel %d\n",
|
||||
channel);
|
||||
mwifiex_save_hidden_ssid_channels(priv, bss);
|
||||
if ((chan->flags & IEEE80211_CHAN_RADAR) ||
|
||||
(chan->flags & IEEE80211_CHAN_NO_IR)) {
|
||||
mwifiex_dbg(adapter, INFO,
|
||||
"radar or passive channel %d\n",
|
||||
channel);
|
||||
mwifiex_save_hidden_ssid_channels(priv,
|
||||
bss);
|
||||
}
|
||||
|
||||
cfg80211_put_bss(priv->wdev.wiphy, bss);
|
||||
}
|
||||
}
|
||||
} else {
|
||||
|
|
Loading…
Reference in a new issue