mwifiex: fix use-after-free in beacon_ie processing

beacon_ie buffer is allocated in mwifiex_fill_new_bss_desc()
and the buffer pointer is saved in bss_desc->beacon_buf.
beacon_ie is freed before the function returns. However,
bss_desc->beacon_buf is still being accessed afterwards.

Fix it by freeing beacon_ie (bss_desc->beacon_buf) in
caller's scope.

Reviewed-by: Doug Anderson <dianders@chromium.org>
Reviewed-by: Paul Stewart <pstew@chromium.org>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 8 insertions, 0 deletions

diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index e7f6deaf715e..37b24e830844 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -1533,10 +1533,18 @@ static int mwifiex_update_curr_bss_params(struct mwifiex_private *priv,
         /* Make a copy of current BSSID descriptor */
         memcpy(&priv->curr_bss_params.bss_descriptor, bss_desc,
                sizeof(priv->curr_bss_params.bss_descriptor));
+
+        /* The contents of beacon_ie will be copied to its own buffer
+         * in mwifiex_save_curr_bcn()
+         */
         mwifiex_save_curr_bcn(priv);
         spin_unlock_irqrestore(&priv->curr_bcn_buf_lock, flags);
 
 done:
+        /* beacon_ie buffer was allocated in function
+         * mwifiex_fill_new_bss_desc(). Free it now.
+         */
+        kfree(bss_desc->beacon_buf);
         kfree(bss_desc);
         return 0;
 }