diff options
| author | Ganapathi Bhat <gbhat@marvell.com> | 2016-06-16 16:22:21 +0300 |
|---|---|---|
| committer | Kalle Valo <kvalo@codeaurora.org> | 2016-06-29 18:53:59 +0300 |
| commit | 4699fc3f2dcbcce27d499343c7b85b172b17ee76 (patch) | |
| tree | 1d8ec23ca0e361f60d4b11075a5706e22ee16b91 /drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | |
| parent | 08aba42fcc7eea5e24558b3c59d1b9e86c3b9e75 (diff) | |
| download | linux-4699fc3f2dcbcce27d499343c7b85b172b17ee76.tar.xz | |
mwifiex: Fix an issue spotted by KASAN
When an association command is sent to firmware but the process is
killed before the command response arrives, driver will try to
access bss_desc which is already freed. This issue is fixed by
checking return value of bss_start.
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Diffstat (limited to 'drivers/net/wireless/marvell/mwifiex/sta_ioctl.c')
| -rw-r--r-- | drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c index 8e0862657122..2ba5397272e2 100644 --- a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c +++ b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c @@ -426,6 +426,10 @@ done: if (bss_desc) kfree(bss_desc->beacon_buf); kfree(bss_desc); + + if (ret < 0) + priv->attempted_bss_desc = NULL; + return ret; } |