Patch "staging: rtl8188eu: avoid a null dereference on pmlmepriv" has been added to the 4.9-stable tree

Patch "staging: rtl8188eu: avoid a null dereference on pmlmepriv" has been added to the 4.9-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    staging: rtl8188eu: avoid a null dereference on pmlmepriv

to the 4.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     staging-rtl8188eu-avoid-a-null-dereference-on-pmlmepriv.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From foo@baz Wed Dec  6 17:39:55 CET 2017
From: Colin Ian King <colin.king@canonical.com>
Date: Fri, 20 Oct 2017 20:40:24 +0200
Subject: staging: rtl8188eu: avoid a null dereference on pmlmepriv

From: Colin Ian King <colin.king@canonical.com>


[ Upstream commit 123c0aab0050cd0e07ce18e453389fbbb0a5a425 ]

There is a check on pmlmepriv before dereferencing it when
vfree'ing pmlmepriv->free_bss_buf however the previous call
to rtw_free_mlme_priv_ie_data deferences pmlmepriv causing
a null pointer deference if it is null.  Avoid this by also
calling rtw_free_mlme_priv_ie_data if the pointer is non-null.

Detected by CoverityScan, CID#1230262 ("Dereference before null check")
Fixes: 7b464c9fa5cc ("staging: r8188eu: Add files for new driver - part 4")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/staging/rtl8188eu/core/rtw_mlme.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/staging/rtl8188eu/core/rtw_mlme.c
+++ b/drivers/staging/rtl8188eu/core/rtw_mlme.c
@@ -107,10 +107,10 @@ void rtw_free_mlme_priv_ie_data(struct m
 
 void rtw_free_mlme_priv(struct mlme_priv *pmlmepriv)
 {
-	rtw_free_mlme_priv_ie_data(pmlmepriv);
-
-	if (pmlmepriv)
+	if (pmlmepriv) {
+		rtw_free_mlme_priv_ie_data(pmlmepriv);
 		vfree(pmlmepriv->free_bss_buf);
+	}
 }
 
 struct wlan_network *_rtw_alloc_network(struct mlme_priv *pmlmepriv)


Patches currently in stable-queue which might be from colin.king@canonical.com are

queue-4.9/staging-rtl8188eu-avoid-a-null-dereference-on-pmlmepriv.patch
queue-4.9/net-sctp-fix-array-overrun-read-on-sctp_timer_tbl.patch