Double 'put' of bss in mac80211/mlme.c?

[Ben Greear <greearb@candelatech.com>]

Looks like an easy way to leak ies would be to mess up the
ref counting on bss objects.

While looking at such code, I found this in mac80211/mlme.c

The destroy_assoc_data does a put_bss, and then it is put again
directly.  Is this on purpose, or would this effectively cause
a double-free?

		if (!ieee80211_assoc_success(sdata, *bss, mgmt, len)) {
			/* oops -- internal error -- send timeout for now */
			ieee80211_destroy_assoc_data(sdata, false);
			cfg80211_put_bss(sdata->local->hw.wiphy, *bss);
			return RX_MGMT_CFG80211_ASSOC_TIMEOUT;
		}

Thanks,
Ben

-- 
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc  http://www.candelatech.com