qcacld-3.0: Sanitize the sme_get_link_speed() API

Currently sme_get_link_speed() requires that the caller pass an
allocated buffer as the lsReq param. This violates the general
concensus that SME should make no assumptions about the buffers passed
to it by HDD.

Update the implementation such that SME allocates the buffer that will
be passed in the message, and update HDD to use the stack.

Note that this is a prerequisite for moving the linkspeed request
processing to the new HDD Request Management infrastructure.

Change-Id: I09257855c6c260bb4a6ca91eb79bb24813cc5efa
CRs-Fixed: 2000023

core/hdd/src/wlan_hdd_wext.c

@@ -2055,28 +2055,22 @@ QDF_STATUS wlan_hdd_get_linkspeed_for_peermac(hdd_adapter_t *pAdapter,
 	QDF_STATUS status;
 	unsigned long rc;
 	static struct linkspeedContext context;
-	tSirLinkSpeedInfo *linkspeed_req;
+	tSirLinkSpeedInfo linkspeed_req;
 
 	if (NULL == pAdapter) {
 		hdd_err("pAdapter is NULL");
 		return QDF_STATUS_E_FAULT;
 	}
-	linkspeed_req = qdf_mem_malloc(sizeof(*linkspeed_req));
-	if (NULL == linkspeed_req) {
-		hdd_err("Request Buffer Alloc Fail");
-		return QDF_STATUS_E_NOMEM;
-	}
 	init_completion(&context.completion);
 	context.pAdapter = pAdapter;
 	context.magic = LINK_CONTEXT_MAGIC;
 
-	qdf_copy_macaddr(&linkspeed_req->peer_macaddr, &macAddress);
+	qdf_copy_macaddr(&linkspeed_req.peer_macaddr, &macAddress);
 	status = sme_get_link_speed(WLAN_HDD_GET_HAL_CTX(pAdapter),
-				    linkspeed_req,
+				    &linkspeed_req,
 				    &context, hdd_get_link_speed_cb);
 	if (QDF_STATUS_SUCCESS != status) {
 		hdd_err("Unable to retrieve statistics for link speed");
-		qdf_mem_free(linkspeed_req);
 	} else {
 		rc = wait_for_completion_timeout
 			(&context.completion,

core/sme/src/common/sme_api.c

@@ -10648,35 +10648,45 @@ QDF_STATUS sme_get_link_speed(tHalHandle hHal, tSirLinkSpeedInfo *lsReq,
 {
 
 	QDF_STATUS status = QDF_STATUS_SUCCESS;
-	QDF_STATUS qdf_status = QDF_STATUS_SUCCESS;
-	tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
+	tpAniSirGlobal pMac;
+	tSirLinkSpeedInfo *req;
 	struct scheduler_msg message;
 
+	if (!hHal || !pCallbackfn || !lsReq) {
+		QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,
+			  FL("Invalid parameter"));
+		return QDF_STATUS_E_FAILURE;
+	}
+
+	pMac = PMAC_STRUCT(hHal);
+	req = qdf_mem_malloc(sizeof(*req));
+	if (!req) {
+		sms_log(pMac, LOGP, FL("Failed to allocate memory"));
+		return QDF_STATUS_E_NOMEM;
+	}
+	*req = *lsReq;
+
 	status = sme_acquire_global_lock(&pMac->sme);
-	if (QDF_STATUS_SUCCESS == status) {
-		if ((NULL == pCallbackfn) &&
-		    (NULL == pMac->sme.pLinkSpeedIndCb)) {
-			QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,
-				  "%s: Indication Call back did not registered",
-				  __func__);
-			sme_release_global_lock(&pMac->sme);
-			return QDF_STATUS_E_FAILURE;
-		} else if (NULL != pCallbackfn) {
-			pMac->sme.pLinkSpeedCbContext = plsContext;
-			pMac->sme.pLinkSpeedIndCb = pCallbackfn;
-		}
-		/* serialize the req through MC thread */
-		message.bodyptr = lsReq;
-		message.type = WMA_GET_LINK_SPEED;
-		qdf_status = scheduler_post_msg(QDF_MODULE_ID_WMA,
-						 &message);
-		if (!QDF_IS_STATUS_SUCCESS(qdf_status)) {
-			QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,
-				  "%s: Post Link Speed msg fail", __func__);
-			status = QDF_STATUS_E_FAILURE;
-		}
-		sme_release_global_lock(&pMac->sme);
+	if (QDF_STATUS_SUCCESS != status) {
+		sms_log(pMac, LOGP, FL("Failed to acquire global lock"));
+		qdf_mem_free(req);
+		return QDF_STATUS_E_FAILURE;
 	}
+
+	pMac->sme.pLinkSpeedCbContext = plsContext;
+	pMac->sme.pLinkSpeedIndCb = pCallbackfn;
+
+	/* serialize the req through MC thread */
+	message.bodyptr = req;
+	message.type = WMA_GET_LINK_SPEED;
+	status = scheduler_post_msg(QDF_MODULE_ID_WMA, &message);
+	sme_release_global_lock(&pMac->sme);
+	if (!QDF_IS_STATUS_SUCCESS(status)) {
+		QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,
+			  "%s: Post Link Speed msg fail", __func__);
+		qdf_mem_free(req);
+	}
+
 	return status;
 }