From d660b47e8abb2efc4ecfc328dc144760f27df8ac Mon Sep 17 00:00:00 2001 From: Dundi Raviteja Date: Mon, 13 Aug 2018 15:32:42 +0530 Subject: qcacld-2.0: Possible kernel info leak in sme_updateP2pIe() Currently in sme_updateP2pIe() function probe response information element buffer is dumping before copying the data into it, this may leads to kernel info leak. To address this issue, copy data to information element buffer before dumping it. Change-Id: I65e9f83b1a245c8891ad914480fbacd744fdb0a0 CRs-Fixed: 2291491 --- CORE/SME/src/sme_common/sme_Api.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CORE/SME/src/sme_common/sme_Api.c b/CORE/SME/src/sme_common/sme_Api.c index 935ca60138e5..2f9cd31e2185 100644 --- a/CORE/SME/src/sme_common/sme_Api.c +++ b/CORE/SME/src/sme_common/sme_Api.c @@ -8187,11 +8187,11 @@ eHalStatus sme_updateP2pIe(tHalHandle hHal, void *p2pIe, tANI_U32 p2pIeLength) { pMac->p2pContext.probeRspIeLength = p2pIeLength; + vos_mem_copy((tANI_U8 *)pMac->p2pContext.probeRspIe, p2pIe, + p2pIeLength); sirDumpBuf( pMac, SIR_LIM_MODULE_ID, LOG2, pMac->p2pContext.probeRspIe, pMac->p2pContext.probeRspIeLength ); - vos_mem_copy((tANI_U8 *)pMac->p2pContext.probeRspIe, p2pIe, - p2pIeLength); } //release the lock for the sme object -- cgit v1.2.3