From bfd0549f67c4edeeeaf118a99b1a1c78fabf2cf8 Mon Sep 17 00:00:00 2001
From: Krunal Soni <ksoni@codeaurora.org>
Date: Tue, 3 Oct 2017 15:48:37 -0700
Subject: [PATCH] qcacld-3.0: Initialize roam id to invalid value

Current driver has roam id uninitialized in anticipation that roam id
will be filled by SME APIs to correct value but in error conditions
that value may not be filled at all. In those kind of cases
initializing to invalid value will help to avoid any security breach.

CRs-Fixed: 2119198
Change-Id: I96e55cb91ef76df63dd6ba267130e1092fdcf899
---
 core/hdd/src/wlan_hdd_cfg80211.c | 8 ++++----
 core/hdd/src/wlan_hdd_ioctl.c    | 2 +-
 core/hdd/src/wlan_hdd_wext.c     | 4 ++--
 core/sap/src/sap_module.c        | 2 +-
 core/sme/inc/sme_api.h           | 1 +
 5 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/core/hdd/src/wlan_hdd_cfg80211.c b/core/hdd/src/wlan_hdd_cfg80211.c
index 48308ad6f97b..bea4e2f0c483 100644
--- a/core/hdd/src/wlan_hdd_cfg80211.c
+++ b/core/hdd/src/wlan_hdd_cfg80211.c
@@ -13234,7 +13234,7 @@ void wlan_hdd_cfg80211_set_key_wapi(struct hdd_adapter *adapter, uint8_t key_ind
 	tCsrRoamSetKey setKey;
 	bool isConnected = true;
 	int status = 0;
-	uint32_t roamId = 0xFF;
+	uint32_t roamId = INVALID_ROAM_ID;
 	uint8_t *pKeyPtr = NULL;
 
 	hdd_debug("Device_mode %s(%d)",
@@ -13906,7 +13906,7 @@ static int __wlan_hdd_cfg80211_add_key(struct wiphy *wiphy,
 	struct hdd_adapter *adapter = WLAN_HDD_GET_PRIV_PTR(ndev);
 	tCsrRoamSetKey setKey;
 	int status;
-	uint32_t roamId = 0xFF;
+	uint32_t roamId = INVALID_ROAM_ID;
 	struct hdd_hostapd_state *pHostapdState;
 	QDF_STATUS qdf_ret_status;
 	struct hdd_context *hdd_ctx;
@@ -14453,7 +14453,7 @@ static int __wlan_hdd_cfg80211_set_default_key(struct wiphy *wiphy,
 			 */
 
 			tCsrRoamSetKey setKey;
-			uint32_t roamId = 0xFF;
+			uint32_t roamId = INVALID_ROAM_ID;
 			tCsrKeys *Keys = &pWextState->roamProfile.Keys;
 
 			hdd_debug("Default tx key index %d", key_index);
@@ -15350,7 +15350,7 @@ static int wlan_hdd_cfg80211_connect_start(struct hdd_adapter *adapter,
 	struct hdd_wext_state *pWextState;
 	struct hdd_context *hdd_ctx;
 	struct hdd_station_ctx *hdd_sta_ctx;
-	uint32_t roamId;
+	uint32_t roamId = INVALID_ROAM_ID;
 	tCsrRoamProfile *pRoamProfile;
 	eCsrAuthType RSNAuthType;
 	tSmeConfigParams *sme_config;
diff --git a/core/hdd/src/wlan_hdd_ioctl.c b/core/hdd/src/wlan_hdd_ioctl.c
index 46b24e643110..9fc093a3d737 100644
--- a/core/hdd/src/wlan_hdd_ioctl.c
+++ b/core/hdd/src/wlan_hdd_ioctl.c
@@ -4358,7 +4358,7 @@ static int drv_cmd_fast_reassoc(struct hdd_adapter *adapter,
 	uint8_t *value = command;
 	uint8_t channel = 0;
 	tSirMacAddr targetApBssid;
-	uint32_t roamId = 0;
+	uint32_t roamId = INVALID_ROAM_ID;
 	tCsrRoamModifyProfileFields modProfileFields;
 	tCsrHandoffRequest handoffInfo;
 	struct hdd_station_ctx *pHddStaCtx;
diff --git a/core/hdd/src/wlan_hdd_wext.c b/core/hdd/src/wlan_hdd_wext.c
index a40eeeedf0f1..c010c9f0c91c 100644
--- a/core/hdd/src/wlan_hdd_wext.c
+++ b/core/hdd/src/wlan_hdd_wext.c
@@ -7037,7 +7037,7 @@ static int __iw_set_encodeext(struct net_device *dev,
 	int key_index;
 	struct iw_point *encoding = &wrqu->encoding;
 	tCsrRoamSetKey setKey;
-	uint32_t roamId = 0xFF;
+	uint32_t roamId = INVALID_ROAM_ID;
 
 	ENTER_DEV(dev);
 
@@ -10771,7 +10771,7 @@ static int __iw_setnone_getnone(struct net_device *dev,
 
 		tHalHandle hHal = WLAN_HDD_GET_HAL_CTX(adapter);
 		tSirMacAddr bssid;
-		uint32_t roamId = 0;
+		uint32_t roamId = INVALID_ROAM_ID;
 		uint8_t operating_ch =
 			adapter->sessionCtx.station.conn_info.operationChannel;
 		tCsrRoamModifyProfileFields modProfileFields;
diff --git a/core/sap/src/sap_module.c b/core/sap/src/sap_module.c
index 0080e4f7c201..610899f308eb 100644
--- a/core/sap/src/sap_module.c
+++ b/core/sap/src/sap_module.c
@@ -1431,7 +1431,7 @@ QDF_STATUS wlansap_set_key_sta(struct sap_context *sap_ctx,
 	QDF_STATUS qdf_status = QDF_STATUS_SUCCESS;
 	void *hHal = NULL;
 	QDF_STATUS qdf_ret_status = QDF_STATUS_E_FAILURE;
-	uint32_t roamId = 0xFF;
+	uint32_t roamId = INVALID_ROAM_ID;
 
 	if (NULL == sap_ctx) {
 		QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_ERROR,
diff --git a/core/sme/inc/sme_api.h b/core/sme/inc/sme_api.h
index 98fa678f2ecf..325cc9916711 100644
--- a/core/sme/inc/sme_api.h
+++ b/core/sme/inc/sme_api.h
@@ -81,6 +81,7 @@
 #define SME_SESSION_ID_ANY        50
 
 #define SME_INVALID_COUNTRY_CODE "XX"
+#define INVALID_ROAM_ID 0
 
 #define SME_SET_CHANNEL_REG_POWER(reg_info_1, val) do {	\
 	reg_info_1 &= 0xff00ffff;	      \