Bug#839629: kernel NULL pointer dereference at cfg80211_scan_done with kernel 4.8.0

[koos vriezen]

Package: broadcom-sta-source
Version:  6.30.223.271-3

Looking at the patch for kernel 4.8, I came up with the attached patch
(and I send this mail while running it :)


Thanks,
Koos Vriezen

--- modules/broadcom-sta/src/wl/sys/wl_cfg80211_hybrid.c.orig   2016-10-03 
10:53:55.588036464 +0200
+++ modules/broadcom-sta/src/wl/sys/wl_cfg80211_hybrid.c        2016-10-03 
10:54:11.911695944 +0200
@@ -2386,8 +2386,15 @@
        s32 err = 0;
 
        if (wl->scan_request) {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0)
+               struct cfg80211_scan_info info = {
+                       .aborted = true
+               };
                WL_DBG(("%s: Aborting scan\n", __FUNCTION__));
-               cfg80211_scan_done(wl->scan_request, true);     
+               cfg80211_scan_done(wl->scan_request, &info);
+#else
+               cfg80211_scan_done(wl->scan_request, true);
+#endif
                wl->scan_request = NULL;
        }
 
@@ -2488,7 +2495,14 @@
 
 scan_done_out:
        if (wl->scan_request) {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0)
+               struct cfg80211_scan_info info = {
+                       .aborted = false
+               };
+               cfg80211_scan_done(wl->scan_request, &info);
+#else
                cfg80211_scan_done(wl->scan_request, false);
+#endif
                wl->scan_request = NULL;
        }
        rtnl_unlock();
@@ -2913,7 +2927,14 @@
        s32 err = 0;
 
        if (wl->scan_request) {
-               cfg80211_scan_done(wl->scan_request, true);     
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0)
+               struct cfg80211_scan_info info = {
+                       .aborted = true
+               };
+               cfg80211_scan_done(wl->scan_request, &info);
+#else
+               cfg80211_scan_done(wl->scan_request, true);
+#endif
                wl->scan_request = NULL;
        }