From 8413a48db3023e46039f2ebc7cd0a3cd4a928d2a Mon Sep 17 00:00:00 2001 From: Rajeev Kumar Sirasanagandla Date: Thu, 19 Apr 2018 18:02:45 +0530 Subject: [PATCH] qcacld-3.0: Avoid info leak in IOCTL CCXBEACONREQ While processing IOCTL - CCXBEACONREQ, when number of beacon request IEs is zero, respective handler drv_cmd_ccx_beacon_req() is trying to log measurement token from un-initialized struct variable ese beacon request, which results in kernel info disclosure. To fix this, initialize stack variable ese beacon request and return error in disconnected state when number of beacon request IEs is zero. Change-Id: I4b0a8c673f9ca92e8699a157b24a100bb0cffa83 CRs-Fixed: 2225338 --- core/hdd/src/wlan_hdd_ioctl.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/core/hdd/src/wlan_hdd_ioctl.c b/core/hdd/src/wlan_hdd_ioctl.c index a64b089f550f..a3dcb613b629 100644 --- a/core/hdd/src/wlan_hdd_ioctl.c +++ b/core/hdd/src/wlan_hdd_ioctl.c @@ -5474,7 +5474,7 @@ static int drv_cmd_ccx_beacon_req(struct hdd_adapter *adapter, { int ret; uint8_t *value = command; - tCsrEseBeaconReq eseBcnReq; + tCsrEseBeaconReq eseBcnReq = {0}; QDF_STATUS status = QDF_STATUS_SUCCESS; if (QDF_STA_MODE != adapter->device_mode) { @@ -5492,6 +5492,10 @@ static int drv_cmd_ccx_beacon_req(struct hdd_adapter *adapter, if (!hdd_conn_is_connected(WLAN_HDD_GET_STATION_CTX_PTR(adapter))) { hdd_debug("Not associated"); + + if (!eseBcnReq.numBcnReqIe) + return -EINVAL; + hdd_indicate_ese_bcn_report_no_results(adapter, eseBcnReq.bcnReq[0].measurementToken, 0x02, /* BIT(1) set for measurement done */