Commit 79845c66 authored Oct 21, 2013 by Johannes Berg

cfg80211: fix scheduled scan pointer access



Since rdev->sched_scan_req is dereferenced outside the
lock protecting it, this might be done at the wrong
time, causing crashes. Move the dereference to where
it should be - inside the RTNL locked section.

Cc: stable@vger.kernel.org [3.8+]
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

parent 095d81ce

net/wireless/scan.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -254,10 +254,10 @@ void __cfg80211_sched_scan_results(struct work_struct *wk)
		rdev = container_of(wk, struct cfg80211_registered_device,
		sched_scan_results_wk);

		request = rdev->sched_scan_req;

		rtnl_lock();

		request = rdev->sched_scan_req;

		/* we don't have sched_scan_req anymore if the scan is stopping */
		if (request) {
		if (request->flags & NL80211_SCAN_FLAG_FLUSH) {