lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: Avoid info leak in IOCTL CCXBEACONREQ

Browse Source 
While processing IOCTL - CCXBEACONREQ, when number of
beacon request IEs is zero, respective handler drv_cmd_ccx_beacon_req()
is trying to log measurement token from un-initialized struct variable
ese beacon request, which results in kernel info disclosure.

To fix this, initialize stack variable ese beacon request and return
error in disconnected state when number of beacon request IEs is zero.

Change-Id: I4b0a8c673f9ca92e8699a157b24a100bb0cffa83
CRs-Fixed: 2225338
This commit is contained in:
Rajeev Kumar Sirasanagandla 2018-04-19 18:02:45 +05:30 committed by nshrivas
parent 0e03a98d21
commit 8413a48db3
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
core/hdd/src/wlan_hdd_ioctl.c
View File

@ -5474,7 +5474,7 @@ static int drv_cmd_ccx_beacon_req(struct hdd_adapter *adapter,
{
int ret;
uint8_t *value = command;
tCsrEseBeaconReq eseBcnReq;
tCsrEseBeaconReq eseBcnReq = {0};
QDF_STATUS status = QDF_STATUS_SUCCESS;
if (QDF_STA_MODE != adapter->device_mode) {
@ -5492,6 +5492,10 @@ static int drv_cmd_ccx_beacon_req(struct hdd_adapter *adapter,
if (!hdd_conn_is_connected(WLAN_HDD_GET_STATION_CTX_PTR(adapter))) {
hdd_debug("Not associated");
if (!eseBcnReq.numBcnReqIe)
return -EINVAL;
hdd_indicate_ese_bcn_report_no_results(adapter,
eseBcnReq.bcnReq[0].measurementToken,
0x02, /* BIT(1) set for measurement done */