From 6d25c97f3fa9de14474938f772eac4c12843e9ca Mon Sep 17 00:00:00 2001 From: gaurank kathpalia Date: Thu, 7 Mar 2019 20:25:28 +0530 Subject: [PATCH] qcacld-3.0: Clear Key information from driver memory after disconnect Currently the key information i.e the key, and the number of keys are not getting cleared on wifi link disconnection from wifi driver memory, which can lead to information disclosure. Clear the key information i.e the number of keys and keys from wifi driver memory to avoid any potential information disclore after wifi is turned off. Change-Id: I45306e0d648c500f63f723b4e3ccb6098c055158 CRs-Fixed: 2415413 --- core/mac/src/pe/lim/lim_process_sme_req_messages.c | 2 ++ core/mac/src/pe/lim/lim_security_utils.c | 2 ++ core/sme/src/common/sme_api.c | 1 + core/sme/src/csr/csr_api_roam.c | 4 +++- core/wma/src/wma_mgmt.c | 4 ++++ core/wma/src/wma_scan_roam.c | 4 ++++ 6 files changed, 16 insertions(+), 1 deletion(-) diff --git a/core/mac/src/pe/lim/lim_process_sme_req_messages.c b/core/mac/src/pe/lim/lim_process_sme_req_messages.c index 356c73c8985e..c8aa31c1d053 100644 --- a/core/mac/src/pe/lim/lim_process_sme_req_messages.c +++ b/core/mac/src/pe/lim/lim_process_sme_req_messages.c @@ -3607,6 +3607,7 @@ static void __lim_process_roam_scan_offload_req(struct mac_context *mac_ctx, local_ie_buf = qdf_mem_malloc(MAX_DEFAULT_SCAN_IE_LEN); if (!local_ie_buf) { + qdf_mem_zero(req_buffer, sizeof(*req_buffer)); qdf_mem_free(req_buffer); return; } @@ -3634,6 +3635,7 @@ static void __lim_process_roam_scan_offload_req(struct mac_context *mac_ctx, status = wma_post_ctrl_msg(mac_ctx, &wma_msg); if (QDF_STATUS_SUCCESS != status) { pe_err("Posting WMA_ROAM_SCAN_OFFLOAD_REQ failed"); + qdf_mem_zero(req_buffer, sizeof(*req_buffer)); qdf_mem_free(req_buffer); } } diff --git a/core/mac/src/pe/lim/lim_security_utils.c b/core/mac/src/pe/lim/lim_security_utils.c index 1e9f0fb80c2e..4da4c923a60d 100644 --- a/core/mac/src/pe/lim/lim_security_utils.c +++ b/core/mac/src/pe/lim/lim_security_utils.c @@ -844,6 +844,8 @@ void lim_send_set_bss_key_req(struct mac_context *mac, /* Respond to SME with LIM_MLM_SETKEYS_CNF */ mlmSetKeysCnf.resultCode = eSIR_SME_HAL_SEND_MESSAGE_FAIL; + qdf_mem_zero(pSetBssKeyParams, sizeof(tSetBssKeyParams)); + qdf_mem_free(pSetBssKeyParams); } else return; /* Continue after WMA_SET_BSSKEY_RSP... */ diff --git a/core/sme/src/common/sme_api.c b/core/sme/src/common/sme_api.c index d7515344f116..4b328cc03aeb 100644 --- a/core/sme/src/common/sme_api.c +++ b/core/sme/src/common/sme_api.c @@ -6440,6 +6440,7 @@ QDF_STATUS sme_stop_roaming(mac_handle_t mac_handle, uint8_t session_id, if (QDF_STATUS_SUCCESS != status) { sme_err("WMA_ROAM_SCAN_OFFLOAD_REQ failed, session_id: %d", session_id); + qdf_mem_zero(req, sizeof(*req)); qdf_mem_free(req); return QDF_STATUS_E_FAULT; } diff --git a/core/sme/src/csr/csr_api_roam.c b/core/sme/src/csr/csr_api_roam.c index 1c50d400b1ca..3654ae826afa 100644 --- a/core/sme/src/csr/csr_api_roam.c +++ b/core/sme/src/csr/csr_api_roam.c @@ -16210,8 +16210,10 @@ QDF_STATUS csr_send_mb_set_context_req_msg(struct mac_context *mac, status = scheduler_post_message(QDF_MODULE_ID_SME, QDF_MODULE_ID_PE, QDF_MODULE_ID_PE, &msg); - if (QDF_IS_STATUS_ERROR(status)) + if (QDF_IS_STATUS_ERROR(status)) { + qdf_mem_zero(pMsg, msgLen); qdf_mem_free(pMsg); + } } while (0); return status; } diff --git a/core/wma/src/wma_mgmt.c b/core/wma/src/wma_mgmt.c index a345b3000a07..e2e13ce5e52f 100644 --- a/core/wma/src/wma_mgmt.c +++ b/core/wma/src/wma_mgmt.c @@ -2149,6 +2149,7 @@ static QDF_STATUS wma_setup_install_key_cmd(tp_wma_handle wma_handle, iface->is_waiting_for_key = false; end: + qdf_mem_zero(¶ms, sizeof(struct set_key_params)); return status; } #endif @@ -2380,6 +2381,8 @@ void wma_set_bsskey(tp_wma_handle wma_handle, tpSetBssKeyParams key_info) /* TODO: Should we wait till we get HTT_T2H_MSG_TYPE_SEC_IND? */ key_info->status = QDF_STATUS_SUCCESS; + qdf_mem_zero(&key_params, sizeof(struct wma_set_key_params)); + out: wma_send_msg_high_priority(wma_handle, WMA_SET_BSSKEY_RSP, (void *)key_info, 0); @@ -2603,6 +2606,7 @@ void wma_set_stakey(tp_wma_handle wma_handle, tpSetStaKeyParams key_info) /* TODO: Should we wait till we get HTT_T2H_MSG_TYPE_SEC_IND? */ key_info->status = QDF_STATUS_SUCCESS; out: + qdf_mem_zero(&key_params, sizeof(struct wma_set_key_params)); if (key_info->sendRsp) wma_send_msg_high_priority(wma_handle, WMA_SET_STAKEY_RSP, (void *)key_info, 0); diff --git a/core/wma/src/wma_scan_roam.c b/core/wma/src/wma_scan_roam.c index 1be44596efff..7361953a0c8d 100644 --- a/core/wma/src/wma_scan_roam.c +++ b/core/wma/src/wma_scan_roam.c @@ -398,6 +398,7 @@ QDF_STATUS wma_roam_scan_offload_mode(tp_wma_handle wma_handle, status = wmi_unified_roam_scan_offload_mode_cmd(wma_handle->wmi_handle, scan_cmd_fp, params); + qdf_mem_zero(params, sizeof(*params)); qdf_mem_free(params); if (QDF_IS_STATUS_ERROR(status)) return status; @@ -1532,6 +1533,7 @@ QDF_STATUS wma_process_roaming_config(tp_wma_handle wma_handle, if (!mac) { WMA_LOGE("%s: mac is NULL", __func__); + qdf_mem_zero(roam_req, sizeof(*roam_req)); qdf_mem_free(roam_req); return QDF_STATUS_E_FAILURE; } @@ -1540,6 +1542,7 @@ QDF_STATUS wma_process_roaming_config(tp_wma_handle wma_handle, /* roam scan offload is not enabled in firmware. * Cannot initialize it in the middle of connection. */ + qdf_mem_zero(roam_req, sizeof(*roam_req)); qdf_mem_free(roam_req); return QDF_STATUS_E_PERM; } @@ -1925,6 +1928,7 @@ QDF_STATUS wma_process_roaming_config(tp_wma_handle wma_handle, default: break; } + qdf_mem_zero(roam_req, sizeof(*roam_req)); qdf_mem_free(roam_req); return qdf_status; }