openwrt/package/network/services/hostapd/patches/022-hostapd-fix-use-of-uninitialized-stack-variables.patch

From: Felix Fietkau <nbd@nbd.name>
Date: Thu, 8 Jul 2021 16:33:03 +0200
Subject: [PATCH] hostapd: fix use of uninitialized stack variables

When a CSA is performed on an 80 MHz channel, hostapd_change_config_freq
unconditionally calls hostapd_set_oper_centr_freq_seg0/1_idx with seg0/1
filled by ieee80211_freq_to_chan.
However, if ieee80211_freq_to_chan fails (because the freq is 0 or invalid),
seg0/1 remains uninitialized and filled with stack garbage, causing errors
such as "hostapd: 80 MHz: center segment 1 configured"

Signed-off-by: Felix Fietkau <nbd@nbd.name>
---

--- a/src/ap/hostapd.c
+++ b/src/ap/hostapd.c
@@ -3453,7 +3453,7 @@ static int hostapd_change_config_freq(st
 				      struct hostapd_freq_params *old_params)
 {
 	int channel;
-	u8 seg0, seg1;
+	u8 seg0 = 0, seg1 = 0;
 	struct hostapd_hw_modes *mode;
 
 	if (!params->channel) {
hostapd: fix uninitialized stack variable on CSA Signed-off-by: Felix Fietkau <nbd@nbd.name> 2021-07-12 11:31:04 +00:00			`From: Felix Fietkau <nbd@nbd.name>`
			`Date: Thu, 8 Jul 2021 16:33:03 +0200`
			`Subject: [PATCH] hostapd: fix use of uninitialized stack variables`

			`When a CSA is performed on an 80 MHz channel, hostapd_change_config_freq`
			`unconditionally calls hostapd_set_oper_centr_freq_seg0/1_idx with seg0/1`
			`filled by ieee80211_freq_to_chan.`
			`However, if ieee80211_freq_to_chan fails (because the freq is 0 or invalid),`
			`seg0/1 remains uninitialized and filled with stack garbage, causing errors`
			`such as "hostapd: 80 MHz: center segment 1 configured"`

			`Signed-off-by: Felix Fietkau <nbd@nbd.name>`
			`---`

			`--- a/src/ap/hostapd.c`
			`+++ b/src/ap/hostapd.c`
hostapd: update to 2022-07-29 b704dc72e tests: sigma_dut and updated ConfResult value for Configurator failures 89de431f2 DPP: Add config response status value to DPP-CONF-SENT 10104915a tests: sigma_dut and DPP PB session overlap 80d5e264c Enhance QCA vendor roam event to indicate MLO links after reassociation 662249306 Update copyright notices for the QCA vendor definitions 8adcdd659 tests: Temporary workaround for dpp_chirp_ap_5g ddcd15c2d tests: Fix fuzzing/sae build 7fa67861a tests: Fix p2p_channel_avoid3 ee3567d65 tests: Add more time for scan/connection 1d08b238c nl80211: Allow more time for the initial scan with 6 GHz ac9e6a2ab tests: Allow 6 GHz opclasses in MBO checks faf9c04cb Remove a host of unnecessary OPENSSL_IS_BORINGSSL ifdefs b9cd5a82f Always process pending QCA_NL80211_VENDOR_SUBCMD_KEY_MGMT_ROAM_AUTH data ef4cd8e33 QoS: Use common classifier_mask for ipv4/ipv6 93be02592 Add fixed FDD mode to qca_btc_chain_mode QCA vendor attribute e7cbfa1c1 tests: sigma_dut and DPP Enrollee unsupported curves 5565fbee2 DPP: Check Enrollee supported curves when building Config Response ceae05cec tests: sigma_dut and DPP MUDURL setting for hostapd 4cfb484e9 DPP: Allow dpp_controller_start without arguments in CLIs c97000933 Fix ifdef condition for imsi_privacy_cert 2a9a61d6c tests: SAE with extended key AKM e35f6ed1d tests: More detailed report on SAE PMKSA caching error case f70db167a SAE: Derive a variable length PMK with the new AKM suites 91010e6f6 SAE: Indicate AKM suite selector in commit for new AKM suites e81ec0962 SAE: Use H2E unconditionally with the new AKM suites f8eed2e8b SAE: Store PMK length and AKM in SAE data 9dc4e9d13 SAE: EAPOL-Key and key/MIC length information for the new AKM suites a32ef3cfb SAE: Driver capability flags for the new SAE AKM suites 91df8c9c6 SAE: Internal WPA_KEY_MGMT_* defines for extended key AKMs 5c8a714b1 SAE: Use wpa_key_mgmt_sae() helper 5456b0f26 Define new RSN AKM suite selector values def33101c DPP: Clear push button announcement state on wpa_supplicant FLUSH 35587fa8f tests: DPP Controller/Relay with need to discover Controller d22dfe918 DPP: Event message for indicating when Relay would need a Controller ca7892e98 tests: DPP Relay and adding/removing connection to a Controller bfe3cfc38 DPP: Allow Relay connections to Controllers to be added and removed 808834b18 Add a comparison function for hostapd_ip_addr f7763880b DPP: Advertise Configurator connectivity on Relay automatically ff7cc1d49 tests: DPP Relay and dynamic Controller addition ca682f80a DPP: Dynamic Controller initiated connection on Relay d2388bcca DPP: Strict validation of PKEX peer bootstrapping key during auth a7b8cef8b DPP3: Fix push button boostrapping key passing through PKEX 69d7c8e6b DPP: Add peer=id entry for PKEX-over-TCP case b607d2723 tests: sigma_dut and DPP PB Configurator in wpa_supplicant 1ff9251a8 DPP3: Push button Configurator in wpa_supplicant b94e46bc7 tests: PB Configurator in wpa_supplicant ca4e82cbf tests: sigma_dut DPP/PKEX initiator as Configurator over TCP and Wi-Fi e9137950f DPP: Recognize own PKEX Exchange Request if it ends up being received 692956446 DPP: Note PKEX code/identifier deletion in debug log dfa9183b1 tests: DPP reconfig after Controller-initiated operation through Relay ae4a3a6f6 DPP: Add DPP-CONF-REQ-RX event for Controller 17216b524 tests: sigma_dut DPP/PKEX initiator as Configurator (TCP) through Relay fb2937b85 DPP: Allow Controller to initiate PKEX through Relay 15af83cf1 DPP: Delete PKEX code and identifier on success completion of PKEX d86ed5b72 tests: Allow DPP_PKEX_REMOVE success in dpp_pkex_hostapd_errors 0a4f391b1 tests: sigma_dut and DPP Connector Privacy 479e412a6 DPP3: Default value for dpp_connector_privacy 7d12871ba test: DPP Private Peer Introduction protocol 148de3e0d DPP3: Private Peer Introduction protocol 786ea402b HPKE base mode with single-shot API f0273bc81 OpenSSL: Remove a forgotten debug print f2bb0839f test: DPP 3rd party config information 68209ddbe DPP: Allow 3rd party information to be added into config object 0e2217c95 DPP: Allow 3rd party information to be added into config request obj 3d82fbe05 Add QCA vendor subcommand and attributes for SCS rule configuration 16b62ddfa QCA vendor attribute for DBAM configuration 004b1ff47 tests: DPP Controller initiating through Relay 451ede2c3 DPP: Allow AP/Relay to be configured to listed for new TCP connections 248654d36 tests: sigma_dut DPP PB test cases 697b7d7ec tests: DPP push button 7bbe85987 DPP3: Allow external configuration to be specified on AP for PB 8db786a43 DPP3: Testing functionality for push button announcements 37bccfcab DPP3: Push button bootstrap mechanism a0054fe7c Add AP and STA specific P802.11az security capabilities (vendor command) 159e63613 QCA vendor command for CoAP offload processing 3b7bb17f6 Add QCA vendor attribute for TIM beacon statistics 09a281e52 Add QCA vendor interface for PASN offload to userspace 809fb96fa Add a vendor attribute to configure concurrency policy for AP interface a5754f531 Rename QCA_NL80211_VENDOR_SUBCMD_CONCURRENT_MULTI_STA_POLICY 085a3fc76 EHT: Add 320 channel width support bafe35df0 Move CHANWIDTH_* definitions from ieee80211_defs.h to defs.h 92f549901 tests: Remove the 80+80 vs. 160 part from wpa2_ocv_ap_vht160_mismatch c580c2aec tests: Make OCV negative test error cases more robust 3c2ba98ad Add QCA vendor event to indicate driver recovery after internal failures 6b461f68c Set current_ssid before changing state to ASSOCIATING 8dd826741 QCA vendor attribute to configure direct data path for audio traffic 504be2f9d QCA vendor command support to get WLAN radio combinations d5905dbc8 OCV: Check the Frequency Segment 1 Channel Number only on 80+80 MHz Signed-off-by: David Bauer <mail@david-bauer.net> 2022-08-19 00:17:22 +00:00			`@@ -3453,7 +3453,7 @@ static int hostapd_change_config_freq(st`
hostapd: fix uninitialized stack variable on CSA Signed-off-by: Felix Fietkau <nbd@nbd.name> 2021-07-12 11:31:04 +00:00			`struct hostapd_freq_params *old_params)`
			`{`
			`int channel;`
			`- u8 seg0, seg1;`
			`+ u8 seg0 = 0, seg1 = 0;`
			`struct hostapd_hw_modes *mode;`

			`if (!params->channel) {`