From fdb73435f6ac3b2caed9a6ec45e815c531d1a645 Mon Sep 17 00:00:00 2001 From: Jeff Johnson Date: Tue, 11 Oct 2016 08:07:27 -0700 Subject: [PATCH] qcacld-3.0: Fix potential reference of uninitialized roam profile Currently in hdd_send_re_assoc_event() there are several guard tests which protect the function from executing unless all of the prerequisite information is present. If any of the tests fail then the code performs centralized cleanup. One of the cleanups performed is to free the roam profile. Unfortunately at the time most of the guard tests are performed the roam profile has not been retrieved from SME, and has not been initialized in any other way. This would ultimately result in csr_roam_free_connect_profile() reading "garbage" values for pBssDesc and pAddIEAssoc. Address this issue by relocating the existing qdf_mem_zero() of the roam profile so that the roam profile is initialized before any of the guard tests are performed. Change-Id: I2a2ba92ffb5b73c3ba4f54482d8f2b37f6e2dad6 CRs-Fixed: 1076422 --- core/hdd/src/wlan_hdd_assoc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/core/hdd/src/wlan_hdd_assoc.c b/core/hdd/src/wlan_hdd_assoc.c index 09aab866e173..d8f35f4ecd79 100644 --- a/core/hdd/src/wlan_hdd_assoc.c +++ b/core/hdd/src/wlan_hdd_assoc.c @@ -1900,6 +1900,8 @@ static void hdd_send_re_assoc_event(struct net_device *dev, tCsrRoamConnectedProfile roam_profile; tHalHandle hal_handle = WLAN_HDD_GET_HAL_CTX(pAdapter); + qdf_mem_zero(&roam_profile, sizeof(roam_profile)); + if (!rspRsnIe) { hdd_err("Unable to allocate RSN IE"); goto done; @@ -1951,7 +1953,6 @@ static void hdd_send_re_assoc_event(struct net_device *dev, chan = ieee80211_get_channel(pAdapter->wdev.wiphy, (int)pCsrRoamInfo->pBssDesc->channelId); - qdf_mem_zero(&roam_profile, sizeof(tCsrRoamConnectedProfile)); sme_roam_get_connect_profile(hal_handle, pAdapter->sessionId, &roam_profile); bss = cfg80211_get_bss(pAdapter->wdev.wiphy, chan,