cfg80211: free_priv for BSS info

When cfg80211 users have their own allocated data in the per-BSS
private data, they will need to free this when the BSS struct is
destroyed. Add a free_priv method and fix one place where the BSS
was kfree'd rather than released properly.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 3cccd13..0668b2bf 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -376,7 +376,7 @@
 	mutex_destroy(&drv->mtx);
 	mutex_destroy(&drv->devlist_mtx);
 	list_for_each_entry_safe(scan, tmp, &drv->bss_list, list)
-		kfree(scan);
+		cfg80211_put_bss(&scan->pub);
 	kfree(drv);
 }
 
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 009d128..ec148f6 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -56,6 +56,8 @@
 	struct cfg80211_internal_bss *bss;
 
 	bss = container_of(ref, struct cfg80211_internal_bss, ref);
+	if (bss->pub.free_priv)
+		bss->pub.free_priv(&bss->pub);
 	kfree(bss);
 }