Merge "qcacld-3.0: Drop probe resp if MLD address doesn't match" into wlan-cld3.driver.lnx.2.0.r112-rel

core/mac/src/pe/lim/lim_process_probe_rsp_frame.c

@@ -233,6 +233,47 @@ void lim_update_mlo_mgr_prb_info(struct mac_context *mac_ctx,
 }
 #endif
 
+#ifdef WLAN_FEATURE_11BE_MLO
+static bool
+lim_validate_probe_rsp_mld_addr(struct pe_session *session,
+				tpSirProbeRespBeacon probe_rsp)
+{
+	QDF_STATUS status;
+	struct wlan_mlo_ie *mlo_ie;
+	struct qdf_mac_addr curr_bss_mld;
+	struct qdf_mac_addr *probe_rsp_mld;
+
+	/* If ML-IE is not present or if the VDEV is not MLO return success */
+	if (!probe_rsp->mlo_ie.mlo_ie_present ||
+	    !wlan_vdev_mlme_is_mlo_vdev(session->vdev))
+		return true;
+
+	status = wlan_vdev_get_bss_peer_mld_mac(session->vdev, &curr_bss_mld);
+	if (QDF_IS_STATUS_ERROR(status)) {
+		pe_err("Failed to fetch MLD address for ML VDEV");
+		return false;
+	}
+
+	mlo_ie = &probe_rsp->mlo_ie.mlo_ie;
+	probe_rsp_mld =	(struct qdf_mac_addr *)mlo_ie->mld_mac_addr;
+	if (qdf_is_macaddr_zero(probe_rsp_mld) ||
+	    !qdf_is_macaddr_equal(probe_rsp_mld, &curr_bss_mld)) {
+		pe_err("prb rsp MLD " QDF_MAC_ADDR_FMT ", bss peer MLD " QDF_MAC_ADDR_FMT,
+		       QDF_MAC_ADDR_REF(probe_rsp_mld->bytes),
+		       QDF_MAC_ADDR_REF(curr_bss_mld.bytes));
+		return false;
+	}
+
+	return true;
+}
+#else
+static inline bool
+lim_validate_probe_rsp_mld_addr(struct pe_session *session,
+				tpSirProbeRespBeacon probe_rsp)
+{
+	return true;
+}
+#endif
 /**
  * lim_process_probe_rsp_frame() - processes received Probe Response frame
  * @mac_ctx: Pointer to Global MAC structure
@@ -285,8 +326,7 @@ lim_process_probe_rsp_frame(struct mac_context *mac_ctx, uint8_t *rx_Packet_info
 				rx_Packet_info) !=
 		QDF_STATUS_SUCCESS) {
 		pe_err("Parse error ProbeResponse, length=%d", frame_len);
-		qdf_mem_free(probe_rsp);
-		return;
+		goto mem_free;
 	}
 
 	frame_len = WMA_GET_RX_PAYLOAD_LEN(rx_Packet_info);
@@ -297,9 +337,12 @@ lim_process_probe_rsp_frame(struct mac_context *mac_ctx, uint8_t *rx_Packet_info
 		body, frame_len, probe_rsp) == QDF_STATUS_E_FAILURE) ||
 		!probe_rsp->ssidPresent) {
 		pe_err("Parse error ProbeResponse, length=%d", frame_len);
-		qdf_mem_free(probe_rsp);
-		return;
+		goto mem_free;
 	}
+
+	if (!lim_validate_probe_rsp_mld_addr(session_entry, probe_rsp))
+		goto mem_free;
+
 	qdf_trace_hex_dump(QDF_MODULE_ID_PE, QDF_TRACE_LEVEL_DEBUG, body,
 			   frame_len);
 
@@ -366,8 +409,7 @@ lim_process_probe_rsp_frame(struct mac_context *mac_ctx, uint8_t *rx_Packet_info
 		sir_copy_mac_addr(current_bssid, session_entry->bssId);
 		if (qdf_mem_cmp(current_bssid, header->bssId,
 				sizeof(tSirMacAddr))) {
-			qdf_mem_free(probe_rsp);
-			return;
+			goto mem_free;
 		}
 		if (!LIM_IS_CONNECTION_ACTIVE(session_entry)) {
 			pe_warn("Recved Probe Resp from AP,AP-alive");
@@ -383,14 +425,14 @@ lim_process_probe_rsp_frame(struct mac_context *mac_ctx, uint8_t *rx_Packet_info
 							session_entry);
 		}
 
-		if (!cu_flag) {
-			qdf_mem_free(probe_rsp);
-			return;
-		}
+		if (!cu_flag)
+			goto mem_free;
 
 		lim_process_updated_ies_in_probe_rsp(mac_ctx, session_entry,
 						     probe_rsp);
 	}
+
+mem_free:
 	qdf_mem_free(probe_rsp);
 
 	/* Ignore Probe Response frame in all other states */

core/mac/src/sys/legacy/src/utils/src/parser_api.c

@@ -11323,6 +11323,11 @@ sir_convert_mlo_probe_rsp_frame2_struct(uint8_t *ml_ie,
 	util_get_mlie_common_info_len(ml_ie, ml_ie_total_len,
 				      &mlo_ie_ptr->mlo_ie.common_info_length);
 
+	sta_prof = ml_ie + sizeof(struct wlan_ie_multilink) +
+		   mlo_ie_ptr->mlo_ie.common_info_length;
+	lim_store_mlo_ie_raw_info(ml_ie, sta_prof,
+				  ml_ie_total_len, &mlo_ie_ptr->mlo_ie);
+
 	util_get_bvmlie_mldmacaddr(ml_ie, ml_ie_total_len, &mld_mac_addr);
 	qdf_mem_copy(mlo_ie_ptr->mlo_ie.mld_mac_addr, mld_mac_addr.bytes,
 		     QDF_MAC_ADDR_SIZE);
@@ -11339,10 +11344,6 @@ sir_convert_mlo_probe_rsp_frame2_struct(uint8_t *ml_ie,
 						bss_param_change_cnt_found;
 	mlo_ie_ptr->mlo_ie.bss_param_change_count = bss_param_change_cnt;
 	mlo_ie_ptr->mlo_ie_present = true;
-	sta_prof = ml_ie + sizeof(struct wlan_ie_multilink) +
-		   mlo_ie_ptr->mlo_ie.common_info_length;
-	lim_store_mlo_ie_raw_info(ml_ie, sta_prof,
-				  ml_ie_total_len, &mlo_ie_ptr->mlo_ie);
 
 	return QDF_STATUS_SUCCESS;
 }