A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 07:03:09 -04:00
Code Issues Projects Releases Packages Wiki Activity
No description
9,384 commits 10 branches 0 tags 2.1 GiB
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Zhu Jianmin 3c83a848cb qcacld-3.0: Fix use after free in roaming disassoc rsp handler 
During Rome LFR2 roaming, after pre-auth with new AP finished,
current AP is disassociated. In disassoc rsp handler:
csr_roam_roaming_state_disassoc_rsp_processor,
csr_roam_copy_profile is called after csr_dequeue_command.
In csr_dequeue_command, cmd from active list is removed, cmd from
pending cmd list is moved to active list and executed, if the cmd
is disassoc from wpa supplicant, pSession->pCurRoamProfile is
freed,  use after free happens in csr_roam_copy_profile

call stack when issue happens:

csr_roam_roaming_state_disassoc_rsp_processor
 ->csr_dequeue_command
    ->wlan_serialization_dequeue_cmd
       ->wlan_serialization_move_pending_to_active
          ->wlan_serialization_activate_cmd
             ->sme_ser_handle_active_cmd
                ->csr_roam_process_command
                   ->csr_roam_process_disassoc_deauth
                   -> csr_free_roam_profile
 ->csr_roam_copy_profile

Fixed by calling csr_dequeue_command after csr_roam_copy_profile

Change-Id: I903795e830c153b94a7dc0476a0e8ea5ecf6be2f
CRs-Fixed: 2205645
2018-03-16 05:26:20 -07:00
components qcacld-3.0: Rename PMO_ENTER and PMO_EXIT macros 2018-03-15 17:31:10 -07:00
core qcacld-3.0: Fix use after free in roaming disassoc rsp handler 2018-03-16 05:26:20 -07:00
uapi/linux
Android.mk
Kbuild qcacld-3.0: Add makefile flag for ObjMgr Debug Enhancements 2018-03-15 09:32:38 -07:00
Kconfig qcacld-3.0: Add makefile flag for ObjMgr Debug Enhancements 2018-03-15 09:32:38 -07:00
Makefile qcacld-3.0: Allow out-of-tree build with relative path in M 2018-02-09 11:33:09 -08:00
README.txt

README.txt 

This is CNSS WLAN Host Driver for products starting from iHelium