commit be97df0a997507a38d55fa5b3912eafd1cbdc759
author Rajeev Kumar <rajekuma@qca.qualcomm.com> Thu Oct 24 18:30:39 2013 -0700
committer Kiet Lam <c_kietl@qca.qualcomm.com> Thu Oct 31 12:02:02 2013 -0700
tree 6ef1d1f0a78cf451519a8d05448e9c4f6f4df51a
parent 41c7c5f849b8cc45ba6331ac968f6c14f335b732

wlan: fix invalid handling of user data in HDD

Fixing direct access of user space pointer inside HDD ioctl

Change-Id: I0bd221849f70f6e653d83db2abcad5f517a41e48
CRs-Fixed: 561026

CORE/HDD/src/wlan_hdd_scan.c

diff --git a/CORE/HDD/src/wlan_hdd_scan.c b/CORE/HDD/src/wlan_hdd_scan.c
index 6cbc426..42245d2 100644
--- a/CORE/HDD/src/wlan_hdd_scan.c
+++ b/CORE/HDD/src/wlan_hdd_scan.c
@@ -949,8 +949,7 @@
         int i, j, ssid_start;
         hdd_scan_pending_option_e scanPendingOption = WEXT_SCAN_PENDING_GIVEUP;
 
-        /* save the original buffer */
-        str_ptr = wrqu->data.pointer;
+        str_ptr = extra;
 
         i = WEXT_CSCAN_HEADER_SIZE;