]> git.baikalelectronics.ru Git - kernel.git/commit
mwifiex: fix use-after-free in beacon_ie processing
authorBing Zhao <bzhao@marvell.com>
Fri, 12 Apr 2013 17:34:17 +0000 (10:34 -0700)
committerJohn W. Linville <linville@tuxdriver.com>
Mon, 22 Apr 2013 19:38:35 +0000 (15:38 -0400)
commit24ac096020cf5c1d99c3732847c2594d266877a3
treed952e47adcbfbb9c7797b5593149df161de3f4e6
parent52cfbbebb7174e29e57843484a931dfe9f195d37
mwifiex: fix use-after-free in beacon_ie processing

beacon_ie buffer is allocated in mwifiex_fill_new_bss_desc()
and the buffer pointer is saved in bss_desc->beacon_buf.
beacon_ie is freed before the function returns. However,
bss_desc->beacon_buf is still being accessed afterwards.

Fix it by freeing beacon_ie (bss_desc->beacon_buf) in
caller's scope.

Reviewed-by: Doug Anderson <dianders@chromium.org>
Reviewed-by: Paul Stewart <pstew@chromium.org>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/mwifiex/scan.c
drivers/net/wireless/mwifiex/sta_ioctl.c