1 files changed, 6 insertions, 1 deletions

diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index d313c9befa23..ff1016607f0b 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -1723,7 +1723,12 @@ cfg80211_update_notlisted_nontrans(struct wiphy *wiphy,
                 return;
         new_ie_len -= trans_ssid[1];
         mbssid = cfg80211_find_ie(WLAN_EID_MULTIPLE_BSSID, ie, ielen);
-        if (!mbssid)
+        /*
+         * It's not valid to have the MBSSID element before SSID
+         * ignore if that happens - the code below assumes it is
+         * after (while copying things inbetween).
+         */
+        if (!mbssid || mbssid < trans_ssid)
                 return;
         new_ie_len -= mbssid[1];
         rcu_read_lock();