From: Bing Zhao <bzhao@marvell.com>
Date: Fri, 12 Apr 2013 17:34:17 +0000 (-0700)
Subject: mwifiex: fix use-after-free in beacon_ie processing
X-Git-Tag: omap-for-v3.10/dt-fixes-for-merge-window~65^2~43^2^2~18
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d837a2ae40fd37bcbb5a42126e3d89c68c90fccc;p=pandora-kernel.git

mwifiex: fix use-after-free in beacon_ie processing

beacon_ie buffer is allocated in mwifiex_fill_new_bss_desc()
and the buffer pointer is saved in bss_desc->beacon_buf.
beacon_ie is freed before the function returns. However,
bss_desc->beacon_buf is still being accessed afterwards.

Fix it by freeing beacon_ie (bss_desc->beacon_buf) in
caller's scope.

Reviewed-by: Doug Anderson <dianders@chromium.org>
Reviewed-by: Paul Stewart <pstew@chromium.org>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
---

Reading git-diff-tree failed