A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 00:00:00 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix potential reference of uninitialized roam profile

Browse source 
Currently in hdd_send_re_assoc_event() there are several guard tests
which protect the function from executing unless all of the
prerequisite information is present. If any of the tests fail then the
code performs centralized cleanup. One of the cleanups performed is to
free the roam profile.  Unfortunately at the time most of the guard
tests are performed the roam profile has not been retrieved from SME,
and has not been initialized in any other way.  This would ultimately
result in csr_roam_free_connect_profile() reading "garbage" values for
pBssDesc and pAddIEAssoc.  Address this issue by relocating the
existing qdf_mem_zero() of the roam profile so that the roam profile
is initialized before any of the guard tests are performed.

Change-Id: I2a2ba92ffb5b73c3ba4f54482d8f2b37f6e2dad6
CRs-Fixed: 1076422
This commit is contained in:
Jeff Johnson 2016-10-11 08:07:27 -07:00 • committed by qcabuildsw
commit fdb73435f6
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
core/hdd/src/wlan_hdd_assoc.c
View file

@ -1900,6 +1900,8 @@ static void hdd_send_re_assoc_event(struct net_device *dev,
tCsrRoamConnectedProfile roam_profile;
tHalHandle hal_handle = WLAN_HDD_GET_HAL_CTX(pAdapter);
qdf_mem_zero(&roam_profile, sizeof(roam_profile));
if (!rspRsnIe) {
hdd_err("Unable to allocate RSN IE");
goto done;
@ -1951,7 +1953,6 @@ static void hdd_send_re_assoc_event(struct net_device *dev,
chan = ieee80211_get_channel(pAdapter->wdev.wiphy,
(int)pCsrRoamInfo->pBssDesc->channelId);
qdf_mem_zero(&roam_profile, sizeof(tCsrRoamConnectedProfile));
sme_roam_get_connect_profile(hal_handle, pAdapter->sessionId,
&roam_profile);
bss = cfg80211_get_bss(pAdapter->wdev.wiphy, chan,