mwifiex: fix potential NULL dereference and use after free
authorPan Bian <bianpan2016@163.com>
Thu, 29 Nov 2018 10:25:19 +0000 (18:25 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 5 Dec 2019 14:37:17 +0000 (15:37 +0100)
commit070fc4ce25c831193918880ab307549ff9285167
treeccaf83674256f8be63715e3406974b29285865e0
parentd98de9d9b8427db4be1b91949cc633aab5f7e76a
mwifiex: fix potential NULL dereference and use after free

[ Upstream commit 1dcd9429212b98bea87fc6ec92fb50bf5953eb47 ]

There are two defects: (1) passing a NULL bss to
mwifiex_save_hidden_ssid_channels will result in NULL dereference,
(2) using bss after dropping the reference to it via cfg80211_put_bss.
To fix them, the patch moves the buggy code to the branch that bss is
not NULL and puts it before cfg80211_put_bss.

Signed-off-by: Pan Bian <bianpan2016@163.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/wireless/marvell/mwifiex/scan.c