From 4699fc3f2dcbcce27d499343c7b85b172b17ee76 Mon Sep 17 00:00:00 2001 From: Ganapathi Bhat Date: Thu, 16 Jun 2016 18:52:21 +0530 Subject: mwifiex: Fix an issue spotted by KASAN When an association command is sent to firmware but the process is killed before the command response arrives, driver will try to access bss_desc which is already freed. This issue is fixed by checking return value of bss_start. Signed-off-by: Amitkumar Karwar Signed-off-by: Kalle Valo --- drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'drivers/net/wireless/marvell/mwifiex/sta_ioctl.c') diff --git a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c index 8e0862657122..2ba5397272e2 100644 --- a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c +++ b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c @@ -426,6 +426,10 @@ done: if (bss_desc) kfree(bss_desc->beacon_buf); kfree(bss_desc); + + if (ret < 0) + priv->attempted_bss_desc = NULL; + return ret; } -- cgit