samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: Add more check points for SAP callback

Browse Source 
When auth failure occures, hostapd will issue BSS stop
command, resulting in BSS peer deleted. After that, auth
frame may still get received, and SAP callback may still
access BSS peer object for remote peer creation, which
results in an assertion.

Add more check points to make sure SAP callback is
handling the peer object addition correctly based on
different status of SAP state machine.

Change-Id: Icdb7ae2db018f16cb60878bda8bab1e791667cba
CRs-Fixed: 2179494
This commit is contained in:
wadesong
2018-01-23 15:11:19 +08:00
committed by snandini
parent 34cc2d542c
commit a8637bb1b6
4 changed files with 18 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
core/hdd/src/wlan_hdd_hostapd.c
View File

@@ -2083,6 +2083,12 @@ QDF_STATUS hdd_hostapd_sap_event_cb(tpSap_Event pSapEvent,
case eSAP_STA_ASSOC_EVENT:
case eSAP_STA_REASSOC_EVENT:
event = &pSapEvent->sapevt.sapStationAssocReassocCompleteEvent;
if (eSAP_STATUS_FAILURE == event->status) {
hdd_notice("assoc failure: " MAC_ADDRESS_STR,
MAC_ADDR_ARRAY(wrqu.addr.sa_data));
break;
}
wrqu.addr.sa_family = ARPHRD_ETHER;
memcpy(wrqu.addr.sa_data,
&event->staMac, QDF_MAC_ADDR_SIZE);

6
core/sap/src/sap_fsm.c
View File

@@ -2417,6 +2417,12 @@ QDF_STATUS sap_signal_hdd_event(struct sap_context *sap_ctx,
FL("Invalid CSR Roam Info"));
return QDF_STATUS_E_INVAL;
}
if (eSAP_DISCONNECTING == sap_ctx->sapsMachine) {
QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_ERROR,
"SAP is disconnecting, not able to handle any incoming (re)assoc req");
return QDF_STATUS_E_ABORTED;
}
reassoc_complete =
&sap_ap_event.sapevt.sapStationAssocReassocCompleteEvent;

5
core/sme/src/csr/csr_api_roam.c
View File

@@ -6155,7 +6155,8 @@ QDF_STATUS csr_roam_process_command(tpAniSirGlobal pMac, tSmeCmd *pCommand)
switch (pCommand->u.roamCmd.roamReason) {
case eCsrForcedDisassoc:
if (eCSR_ROAMING_STATE_IDLE == pMac->roam.curState[sessionId]) {
if (eCSR_ROAMING_STATE_IDLE ==
sme_get_current_roam_state(pMac, sessionId)) {
sme_err("Ignore eCsrForcedDisassoc cmd on roam state %d",
eCSR_ROAMING_STATE_IDLE);
return QDF_STATUS_E_FAILURE;
@@ -11935,7 +11936,7 @@ csr_roam_chk_lnk_wm_status_change_ntf(tpAniSirGlobal mac_ctx,
if (!QDF_IS_STATUS_SUCCESS(status))
break;
if (eCSR_ROAMING_STATE_JOINED ==
mac_ctx->roam.curState[sessionId]
sme_get_current_roam_state(mac_ctx, sessionId)
&& ((eCSR_ROAM_SUBSTATE_JOINED_REALTIME_TRAFFIC
== mac_ctx->roam.curSubState[sessionId])
|| (eCSR_ROAM_SUBSTATE_NONE ==

5
core/sme/src/csr/csr_cmd_process.c
View File

@@ -1,5 +1,5 @@
/*
* Copyright (c) 2011-2017 The Linux Foundation. All rights reserved.
* Copyright (c) 2011-2018 The Linux Foundation. All rights reserved.
*
* Previously licensed under the ISC license by Qualcomm Atheros, Inc.
*
@@ -49,8 +49,9 @@ QDF_STATUS csr_msg_processor(tpAniSirGlobal mac_ctx, void *msg_buf)
QDF_STATUS status = QDF_STATUS_SUCCESS;
tSirSmeRsp *sme_rsp = (tSirSmeRsp *) msg_buf;
uint8_t session_id = sme_rsp->sessionId;
enum csr_roam_state cur_state = mac_ctx->roam.curState[session_id];
enum csr_roam_state cur_state;
cur_state = sme_get_current_roam_state(mac_ctx, session_id);
sme_debug("msg %d[0x%04X] recvd in curstate %s & substate %s id(%d)",
sme_rsp->messageType, sme_rsp->messageType,
mac_trace_getcsr_roam_state(cur_state),