qcacld-3.0: Drop probe resp if MLD address doesn't match

Driver uses ML-probe response received during connection to
generate partner link probe response generation to add to scan
entry and the same scan entry is used during partner VDEV connect.

If the wireless environment has two different AP MLDs (AP-0, AP1)
with same SSID and each individual link BSSID also are same, then
during connection if STA sends ML-probe request to AP-0 but the
ML-probe response is received from AP-1, then the probe response
generated for partner VDEV will correspond to AP-1 whereas assoc
VDEV will use AP-0 for connection.

As MLD address for both APs are different, during peer create each
VDEV (assoc and partner) will have different MLD address which is
undesirable.

Validate the ML-probe response received for matching MLD address
if VDEV is ML VDEV.

Change-Id: I91c2ffa4927346c2f34a4eb4708ed8aa071ff795
CRs-Fixed: 3645669

core/mac/src/pe/lim/lim_process_probe_rsp_frame.c

@@ -233,6 +233,47 @@ void lim_update_mlo_mgr_prb_info(struct mac_context *mac_ctx,
 }
 #endif
 
+#ifdef WLAN_FEATURE_11BE_MLO
+static bool
+lim_validate_probe_rsp_mld_addr(struct pe_session *session,
+				tpSirProbeRespBeacon probe_rsp)
+{
+	QDF_STATUS status;
+	struct wlan_mlo_ie *mlo_ie;
+	struct qdf_mac_addr curr_bss_mld;
+	struct qdf_mac_addr *probe_rsp_mld;
+
+	/* If ML-IE is not present or if the VDEV is not MLO return success */
+	if (!probe_rsp->mlo_ie.mlo_ie_present ||
+	    !wlan_vdev_mlme_is_mlo_vdev(session->vdev))
+		return true;
+
+	status = wlan_vdev_get_bss_peer_mld_mac(session->vdev, &curr_bss_mld);
+	if (QDF_IS_STATUS_ERROR(status)) {
+		pe_err("Failed to fetch MLD address for ML VDEV");
+		return false;
+	}
+
+	mlo_ie = &probe_rsp->mlo_ie.mlo_ie;
+	probe_rsp_mld =	(struct qdf_mac_addr *)mlo_ie->mld_mac_addr;
+	if (qdf_is_macaddr_zero(probe_rsp_mld) ||
+	    !qdf_is_macaddr_equal(probe_rsp_mld, &curr_bss_mld)) {
+		pe_err("prb rsp MLD " QDF_MAC_ADDR_FMT ", bss peer MLD " QDF_MAC_ADDR_FMT,
+		       QDF_MAC_ADDR_REF(probe_rsp_mld->bytes),
+		       QDF_MAC_ADDR_REF(curr_bss_mld.bytes));
+		return false;
+	}
+
+	return true;
+}
+#else
+static inline bool
+lim_validate_probe_rsp_mld_addr(struct pe_session *session,
+				tpSirProbeRespBeacon probe_rsp)
+{
+	return true;
+}
+#endif
 /**
  * lim_process_probe_rsp_frame() - processes received Probe Response frame
  * @mac_ctx: Pointer to Global MAC structure
@@ -285,8 +326,7 @@ lim_process_probe_rsp_frame(struct mac_context *mac_ctx, uint8_t *rx_Packet_info
 				rx_Packet_info) !=
 		QDF_STATUS_SUCCESS) {
 		pe_err("Parse error ProbeResponse, length=%d", frame_len);
-		qdf_mem_free(probe_rsp);
-		return;
+		goto mem_free;
 	}
 
 	frame_len = WMA_GET_RX_PAYLOAD_LEN(rx_Packet_info);
@@ -297,9 +337,12 @@ lim_process_probe_rsp_frame(struct mac_context *mac_ctx, uint8_t *rx_Packet_info
 		body, frame_len, probe_rsp) == QDF_STATUS_E_FAILURE) ||
 		!probe_rsp->ssidPresent) {
 		pe_err("Parse error ProbeResponse, length=%d", frame_len);
-		qdf_mem_free(probe_rsp);
-		return;
+		goto mem_free;
 	}
+
+	if (!lim_validate_probe_rsp_mld_addr(session_entry, probe_rsp))
+		goto mem_free;
+
 	qdf_trace_hex_dump(QDF_MODULE_ID_PE, QDF_TRACE_LEVEL_DEBUG, body,
 			   frame_len);
 
@@ -366,8 +409,7 @@ lim_process_probe_rsp_frame(struct mac_context *mac_ctx, uint8_t *rx_Packet_info
 		sir_copy_mac_addr(current_bssid, session_entry->bssId);
 		if (qdf_mem_cmp(current_bssid, header->bssId,
 				sizeof(tSirMacAddr))) {
-			qdf_mem_free(probe_rsp);
-			return;
+			goto mem_free;
 		}
 		if (!LIM_IS_CONNECTION_ACTIVE(session_entry)) {
 			pe_warn("Recved Probe Resp from AP,AP-alive");
@@ -383,14 +425,14 @@ lim_process_probe_rsp_frame(struct mac_context *mac_ctx, uint8_t *rx_Packet_info
 							session_entry);
 		}
 
-		if (!cu_flag) {
-			qdf_mem_free(probe_rsp);
-			return;
-		}
+		if (!cu_flag)
+			goto mem_free;
 
 		lim_process_updated_ies_in_probe_rsp(mac_ctx, session_entry,
 						     probe_rsp);
 	}
+
+mem_free:
 	qdf_mem_free(probe_rsp);
 
 	/* Ignore Probe Response frame in all other states */

core/mac/src/sys/legacy/src/utils/src/parser_api.c

@@ -11323,6 +11323,11 @@ sir_convert_mlo_probe_rsp_frame2_struct(uint8_t *ml_ie,
 	util_get_mlie_common_info_len(ml_ie, ml_ie_total_len,
 				      &mlo_ie_ptr->mlo_ie.common_info_length);
 
+	sta_prof = ml_ie + sizeof(struct wlan_ie_multilink) +
+		   mlo_ie_ptr->mlo_ie.common_info_length;
+	lim_store_mlo_ie_raw_info(ml_ie, sta_prof,
+				  ml_ie_total_len, &mlo_ie_ptr->mlo_ie);
+
 	util_get_bvmlie_mldmacaddr(ml_ie, ml_ie_total_len, &mld_mac_addr);
 	qdf_mem_copy(mlo_ie_ptr->mlo_ie.mld_mac_addr, mld_mac_addr.bytes,
 		     QDF_MAC_ADDR_SIZE);
@@ -11339,10 +11344,6 @@ sir_convert_mlo_probe_rsp_frame2_struct(uint8_t *ml_ie,
 						bss_param_change_cnt_found;
 	mlo_ie_ptr->mlo_ie.bss_param_change_count = bss_param_change_cnt;
 	mlo_ie_ptr->mlo_ie_present = true;
-	sta_prof = ml_ie + sizeof(struct wlan_ie_multilink) +
-		   mlo_ie_ptr->mlo_ie.common_info_length;
-	lim_store_mlo_ie_raw_info(ml_ie, sta_prof,
-				  ml_ie_total_len, &mlo_ie_ptr->mlo_ie);
 
 	return QDF_STATUS_SUCCESS;
 }