Arend Van Spriel [off-list ref] wrote:

A use-after-free was found using KASAN. In brcmf_p2p_del_if() the virtual
interface is removed using call to brcmf_remove_interface(). After that
the virtual interface instance has been freed and should not be referenced.
Solve this by storing the nl80211 iftype in local variable, which is used
in a couple of places anyway.

Cc: stable@vger.kernel.org # 4.10.x, 4.9.x
Reported-by: Daniel J Blueman <redacted>
Reviewed-by: Hante Meuleman <redacted>
Reviewed-by: Pieter-Paul Giesberts <redacted>
Reviewed-by: Franky Lin <redacted>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>

Patch applied to wireless-drivers.git, thanks.

d77facb88448 brcmfmac: use local iftype avoiding use-after-free of virtual interface

-- 
https://patchwork.kernel.org/patch/9648553/

Documentation about submitting wireless patches and checking status
from patchwork:

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches