regulatory: fix restore_regulatory_settings

My commit 8c46a9fea402f31eaaa962f453f12f26818e7b75
("regulatory: pass new regdomain to reset function")
broke the restore_regulatory_settings() function due
to a logic change. Consider this change:

-	reset_regdomains(true);
-	cfg80211_regdomain = cfg80211_world_regdom;
+	reset_regdomains(true, cfg80211_world_regdom);

This looks innocent enough, until you realise that the
called function (reset_regdomains) also resets the
cfg80211_world_regdom pointer, so that the old version
of the code would use the new object it pointed to and
the new version of the code uses the old object. This
lead to a double-free of this object.

Since reset_regdomains() sets it to &world_regdom, use
that directly.

Reported-by: Sujith Manoharan <sujith@msujith.org>
Tested-by: Sujith Manoharan <sujith@msujith.org>
Reported-by: Bob Copeland <me@bobcopeland.com>
Reported-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 2193f62bb8aef75d8795b6e9f2e4f583f85465a6..8c114e8a9135517e994d3ec64d650c9f8a83fcbf 100644 (file)
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1848,7 +1848,7 @@ static void restore_regulatory_settings(bool reset_user)
        mutex_lock(&cfg80211_mutex);
        mutex_lock(&reg_mutex);
 
-       reset_regdomains(true, cfg80211_world_regdom);
+       reset_regdomains(true, &world_regdom);
        restore_alpha2(alpha2, reset_user);
 
        /*