mwifiex: Fix NULL pointer dereference in skb_dequeue()
authorAmitkumar Karwar <akarwar@marvell.com>
Wed, 28 Sep 2016 12:48:23 +0000 (18:18 +0530)
committerKalle Valo <kvalo@codeaurora.org>
Wed, 9 Nov 2016 01:33:25 +0000 (03:33 +0200)
commitc44c040300d7afd79294710313a4989683e2afb1
tree111821dc779464eae2887e515d496fc4992c8592
parent5190f2e405919cd30ba2f12c58129fb2d71cd6b6
mwifiex: Fix NULL pointer dereference in skb_dequeue()

At couple of places in cleanup path, we are just going through the
skb queue and freeing them without unlinking. This leads to a crash
when other thread tries to do skb_dequeue() and use already freed node.

The problem is freed by unlinking skb before freeing it.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
drivers/net/wireless/marvell/mwifiex/cfg80211.c
drivers/net/wireless/marvell/mwifiex/wmm.c