Commit 1dcd9429 authored by Pan Bian's avatar Pan Bian Committed by Kalle Valo

mwifiex: fix potential NULL dereference and use after free

There are two defects: (1) passing a NULL bss to
mwifiex_save_hidden_ssid_channels will result in NULL dereference,
(2) using bss after dropping the reference to it via cfg80211_put_bss.
To fix them, the patch moves the buggy code to the branch that bss is
not NULL and puts it before cfg80211_put_bss.
Signed-off-by: default avatarPan Bian <bianpan2016@163.com>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
parent 074b145a
...@@ -1882,15 +1882,17 @@ mwifiex_parse_single_response_buf(struct mwifiex_private *priv, u8 **bss_info, ...@@ -1882,15 +1882,17 @@ mwifiex_parse_single_response_buf(struct mwifiex_private *priv, u8 **bss_info,
ETH_ALEN)) ETH_ALEN))
mwifiex_update_curr_bss_params(priv, mwifiex_update_curr_bss_params(priv,
bss); bss);
cfg80211_put_bss(priv->wdev.wiphy, bss);
}
if ((chan->flags & IEEE80211_CHAN_RADAR) || if ((chan->flags & IEEE80211_CHAN_RADAR) ||
(chan->flags & IEEE80211_CHAN_NO_IR)) { (chan->flags & IEEE80211_CHAN_NO_IR)) {
mwifiex_dbg(adapter, INFO, mwifiex_dbg(adapter, INFO,
"radar or passive channel %d\n", "radar or passive channel %d\n",
channel); channel);
mwifiex_save_hidden_ssid_channels(priv, bss); mwifiex_save_hidden_ssid_channels(priv,
bss);
}
cfg80211_put_bss(priv->wdev.wiphy, bss);
} }
} }
} else { } else {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment