diff options
| author | Ganapathi Bhat <gbhat@marvell.com> | 2016-06-16 18:52:21 +0530 |
|---|---|---|
| committer | Kalle Valo <kvalo@codeaurora.org> | 2016-06-29 18:53:59 +0300 |
| commit | 4699fc3f2dcbcce27d499343c7b85b172b17ee76 (patch) | |
| tree | 1d8ec23ca0e361f60d4b11075a5706e22ee16b91 /drivers/net/wireless/marvell/mwifiex/join.c | |
| parent | 08aba42fcc7eea5e24558b3c59d1b9e86c3b9e75 (diff) | |
| download | kernel_replicant_linux-4699fc3f2dcbcce27d499343c7b85b172b17ee76.tar.gz kernel_replicant_linux-4699fc3f2dcbcce27d499343c7b85b172b17ee76.tar.bz2 kernel_replicant_linux-4699fc3f2dcbcce27d499343c7b85b172b17ee76.zip | |
mwifiex: Fix an issue spotted by KASAN
When an association command is sent to firmware but the process is
killed before the command response arrives, driver will try to
access bss_desc which is already freed. This issue is fixed by
checking return value of bss_start.
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Diffstat (limited to 'drivers/net/wireless/marvell/mwifiex/join.c')
| -rw-r--r-- | drivers/net/wireless/marvell/mwifiex/join.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/drivers/net/wireless/marvell/mwifiex/join.c b/drivers/net/wireless/marvell/mwifiex/join.c index a4b773d102b3..1c7b00630b90 100644 --- a/drivers/net/wireless/marvell/mwifiex/join.c +++ b/drivers/net/wireless/marvell/mwifiex/join.c @@ -647,6 +647,12 @@ int mwifiex_ret_802_11_associate(struct mwifiex_private *priv, const u8 *ie_ptr; struct ieee80211_ht_operation *assoc_resp_ht_oper; + if (!priv->attempted_bss_desc) { + mwifiex_dbg(priv->adapter, ERROR, + "ASSOC_RESP: failed, association terminated by host\n"); + goto done; + } + assoc_rsp = (struct ieee_types_assoc_rsp *) &resp->params; cap_info = le16_to_cpu(assoc_rsp->cap_info_bitmap); @@ -1270,6 +1276,12 @@ int mwifiex_ret_802_11_ad_hoc(struct mwifiex_private *priv, u16 cmd = le16_to_cpu(resp->command); u8 result; + if (!priv->attempted_bss_desc) { + mwifiex_dbg(priv->adapter, ERROR, + "ADHOC_RESP: failed, association terminated by host\n"); + goto done; + } + if (cmd == HostCmd_CMD_802_11_AD_HOC_START) result = start_result->result; else |