[BUGFIX] wifi: mac80211: Fix possible use after free in ieee80211_reconfig_roc

ieee80211_reconfig_roc function incorrectly uses list_for_each_entry
to iterate over the roc list without ensuring safe removal of
elements. Replace list_for_each_entry with list_for_each_entry_safe
to fix it.

type=bugfix
ticket=none
fixes=Ifc02a45a5ce23868dc7e428bad8d0e6996dd10f4

Signed-off-by: Daniel Gabay <daniel.gabay@intel.com>
Change-Id: I17bba3e85644518ecf7d8bc90fc71fb57326d2d5
Reviewed-on: https://gerritwcs.ir.intel.com/c/iwlwifi-stack-dev/+/109487
automatic-review: iil_jenkins iil_jenkins <EC.GER.UNIX.IIL.JENKINS@INTEL.COM>
Reviewed-by: Johannes Berg <johannes.berg@intel.com>
Reviewed-by: Miriam Rachel Korenblit <miriam.rachel.korenblit@intel.com>
tested: iil_jenkins iil_jenkins <EC.GER.UNIX.IIL.JENKINS@INTEL.COM>
x-iwlwifi-stack-dev: 02f49b3df194d6b0b7d24c77355f49e68eb49ec1
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index 82966e2..f6fce96 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -415,7 +415,7 @@
 
 void ieee80211_reconfig_roc(struct ieee80211_local *local)
 {
-	struct ieee80211_roc_work *roc;
+	struct ieee80211_roc_work *roc, *tmp;
 
 	/*
 	 * In the software implementation can just continue with the
@@ -429,7 +429,7 @@
 	wiphy_work_flush(local->hw.wiphy, &local->hw_roc_start);
 	wiphy_work_flush(local->hw.wiphy, &local->hw_roc_done);
 
-	list_for_each_entry(roc, &local->roc_list, list) {
+	list_for_each_entry_safe(roc, tmp, &local->roc_list, list) {
 		if (!roc->started)
 			break;
 
diff --git a/versions b/versions
index 29eeb5c..6169147 100644
--- a/versions
+++ b/versions
@@ -2,4 +2,4 @@
 BACKPORTED_KERNEL_VERSION="(see git)"
 BACKPORTED_KERNEL_NAME="iwlwifi"
 BACKPORTS_BUILD_TSTAMP=__DATE__ \" \" __TIME__
-BACKPORTS_GIT_TRACKED="iwlwifi-stack-public:master:12217:1c898c5e"
+BACKPORTS_GIT_TRACKED="iwlwifi-stack-public:master:12218:02f49b3d"