Browse Source

qcacmn: Ignore fragmented packet before peer TID setup

peer->rx_tid[tid].array is initiailized when peer TID is setup.
It seems like we are processing the fragmented Rx packet before peer
TID is setup. Drop the fragmented packet in this case.

Change-Id: Ic076e59a9074efff9fed9f9154aa973c41f67341
CRs-Fixed: 2388684
Manjunathappa Prakash 6 years ago
parent
commit
a5a3a1e49d
2 changed files with 10 additions and 7 deletions
  1. 0 5
      dp/wifi3.0/dp_peer.c
  2. 10 2
      dp/wifi3.0/dp_rx_defrag.c

+ 0 - 5
dp/wifi3.0/dp_peer.c

@@ -2027,11 +2027,6 @@ void dp_peer_rx_init(struct dp_pdev *pdev, struct dp_peer *peer)
 
 		rx_tid->defrag_waitlist_elem.tqe_next = NULL;
 		rx_tid->defrag_waitlist_elem.tqe_prev = NULL;
-
-#ifdef notyet /* TODO: See if this is required for exception handling */
-		/* invalid sequence number */
-		peer->tids_last_seq[tid] = 0xffff;
-#endif
 	}
 
 	peer->active_ba_session_cnt = 0;

+ 10 - 2
dp/wifi3.0/dp_rx_defrag.c

@@ -1393,8 +1393,6 @@ static QDF_STATUS dp_rx_defrag_store_fragment(struct dp_soc *soc,
 	pdev = peer->vdev->pdev;
 	rx_tid = &peer->rx_tid[tid];
 
-	rx_reorder_array_elem = peer->rx_tid[tid].array;
-
 	mpdu_sequence_control_valid =
 		hal_rx_get_mpdu_sequence_control_valid(rx_desc->rx_buf_start);
 
@@ -1433,6 +1431,16 @@ static QDF_STATUS dp_rx_defrag_store_fragment(struct dp_soc *soc,
 	 */
 	fragno = dp_rx_frag_get_mpdu_frag_number(rx_desc->rx_buf_start);
 
+	rx_reorder_array_elem = peer->rx_tid[tid].array;
+	if (!rx_reorder_array_elem) {
+		QDF_TRACE(QDF_MODULE_ID_TXRX, QDF_TRACE_LEVEL_ERROR,
+			  "Rcvd Fragmented pkt before peer_tid is setup");
+		qdf_nbuf_free(frag);
+		dp_rx_add_to_free_desc_list(head, tail, rx_desc);
+		*rx_bfs = 1;
+		goto end;
+	}
+
 	/*
 	 * !more_frag: no more fragments to be delivered
 	 * !frag_no: packet is not fragmented