There is a very rare race condition between
ol_txrx_peer_find_by_local_id_inc_ref(running in OL RX
thread context) and ol_txrx_peer_detach(running in MC
thread context) where MC thread 1st got chance and cleared
the peer->valid flag before OL RX thread can increment the
ref count and this led to OL RX thread got a peer without
any ref count which was freed later while OL RX thread was
still using it.
Change:
1 Set peer to NULL if peer valid check fails in
ol_txrx_peer_find_by_local_id_inc_ref
2 release peer ref cnt for error case in ol_rx_data_cb
Change-Id: Id21350933386464e5814babcb078d9719572af86
CRs-Fixed: 2176704
When radar is found, the current channel is put in NOL list and the state
is set as CHANNEL_STATE_DISABLE.
Currently if channel state is not CHANNEL_STATE_DFS, it will not do channel
change. This is not correct.
Do channel change when radar is found in dfs channel
Change-Id: Iabc8ef5ee92e9d2dc83a95d8fce36a2271ca056c
CRs-Fixed: 2155835
When radar is found, the current channel is put in NOL list and the state
is set as CHANNEL_STATE_DISABLE.
So change the channel state check from wlan_reg_is_dfs_ch to
wlan_reg_is_passive_or_disable_ch
Change-Id: If0595682100746cb12ddb8a1c3ca0106ccd1af21
CRs-Fixed: 2178842
Memory for chan_info is allocated in hdd_wlan_startup() and
freed in hdd_wlan_exit(). When device boots up, memory gets
allocated for chan_info but if interface timer expires, all
the modules are closed and memory is checked for any leaks.
As memory for chan_info is freed in hdd_wlan_exit() so memory
for chan_info is still present and hence assert in
qdf_mem_check_for_leaks().
Allocate memory for chan_info in hdd_features_init() and free
it in hdd_features_deinit().
Change-Id: Ia8944da16a776d4de4fdfbb10b605ebd2b60f0b6
CRs-Fixed: 2178435
In wma_sar_event_handler, compiler with -Werror=frame-larger-than=
throws frame size larger than 1024 bytes build error.
Fix is to use heap memory for struct sar_limit_event.
Change-Id: Idd122b24a7e00b10404864e045eaa9df01852fd8
CRs-Fixed: 2177791
If gDisableDFSChSwitch is configured as 1, channel should not be
switched even radar is found.
Set usenol as 0 when gDisableDFSChSwitch is configured as 1.
Change-Id: I05c4afea3eb9af9c541b2324a2d50ea59c05f7d7
CRs-Fixed: 2178652
Old ch_width is set as invalid after radar detection, and can't be
used anymore. Update sap_ctx->ch_params after channel is selected.
Change-Id: I9e068785312d7072eeaeaa4b1aae4bd82d62d36f
CRs-Fixed: 2178586
HE PPET is an optional field within HE Capability IE, however
current frame parser code was treating it as optiona IE and
inserting EID, length for it causing in-correct PPET values.
Fix frame parser code by treating PPET as just another data
field instead of IE.
Change-Id: I1903d99daf5eb00e47f42485886532551e061982
CRs-Fixed: 2172820
For the AP+AP SCC LTE-Coex case, when channel avoidance event
is reported, the channel switch request for SAP will be blocked
by policy manager if the target channel is different with the
operating channel of the existing SAP due to the SCC policy.
Need to update the logic to give higher priority to the channel
avoidance request.
Another change is to move the dfs_radar_found ref counter from
hdd_ctx to hdd_adapter so that the channel switch request of
the 2nd SAP will not be blocked when the 1st one is still in
progress since it might take some time to get VDEV restart
response from FW.
Change-Id: I8594b35b70276f7ed3884697caf69a99ee91b952
CRs-Fixed: 2171958
Currently in SAP cases, logging is huge and hence failure
logs are getting overwritten very fast within 2mins itself.
Fix it to delete the some irrelevant log prints.
Change-Id: I90a77ba9348b84eb7e5c3518391f7c98a04bb39f
CRs-Fixed: 2169101
In function hdd_hostapd_sap_event_cb the variable staId is not
initialized and used as an index element.
Initialize the variable staId
Change-Id: Ifef98b8c8cfa2ea63c31a5fc54986a4d016ee70a
CRs-Fixed: 2162255
In the function sap_clear_session_param, sapctx->sessionId can have
value more than max value allowed for the array
mac_ctx->sap.sapCtxList.
Add sanity check for the variable sapctx->sessionId
Change-Id: I846a8a1435de63d0a2e34f23bc407e0a8fa53eb2
CRs-Fixed: 2162255
In function hdd_update_dp_vdev_flags, hdd_ctx is not being
validated before dereference.
Add NULL check for hdd_ctx.
Change-Id: Id907e273ec3d135c0e140d3b8b9aa6346af2d9a3
CRs-Fixed: 2162252
Currently variable "tid" is from message, which is used directly
as array size which causes buffer over-write.
To address this issue add check for the array size.
Change-Id: I9b9d028ddb9566938f93ff8155284876c1ef9c03
CRs-Fixed: 2146949
Currently variable "tx_desc_id" is from message and it
is used without check.This may cause buffer over-write.
To address this issue add check for valid "tx_desc_id"
Change-Id: Ifcdbf60ce1e0f81be77308185ab51b59746c21af
CRs-Fixed: 2146878
Currently variable "tid" is from message, which is used
directly as array size which causes buffer over-write.
To address this issue add check for the array size.
Change-Id: I9fae424d19ce5e886d385071863cbfca9633dd84
CRs-Fixed: 2148184
During resume process FW may assert hence to avoid kernel panic
and let subsystem restart to gracefully recover the system avoid
kernel panic if FW is down during HDD resume failure.
Change-Id: I8c53b7251e35dd40b9700f15c0c4897ef80209f8
CRs-Fixed: 2178302
Target register is safe to access only after FW ack the wlan
enable request, which is done in hif_enable. Hence set FW ready
state after that.
Change-Id: Ieeb7dd3e1a2400c7b2568869ac27cf7f745c20d5
CRs-Fixed: 2167736
During initializing ibss security settings there is a possibility
of integer underflow while extracting wpa ie because of ie length
check miss.
Add wpa ie length boundary check before extracting wpa ie.
Change-Id: I37d8ee5ea1e1ba12277128a1407783f5647251b6
CRs-Fixed: 2151241
With bitmask used currently to save current obss detections
for different mode is overwritten by next detection bitmask,
which will failed to reconfigure continue absent detection.
Fix the same by saving detection mode only for the detected
mode and keeping other detection mode unchanged.
Change-Id: Ib9e0ba809589e33b3c8abb29939aea8d8ed0de5a
CRs-Fixed: 2177414
Check for the minimum allowed data that can be written into
the buffer param_buf->num_wow_packet_buffer in the functions
wma_wake_event_packet and wma_wake_event_piggybacked.
Change-Id: I8b83bc973fd6f0d7ad9e421a387ce3f03d6b6939
CRs-Fixed: 2161027
In change "qcacld-3.0: Validate Scan Default IEs" in the qcacld-3.0
project (Change-Id: Ifd8739c96a9990f01ff159eb59a7e904f7b8c592) the
utility API hdd_is_ie_valid() was introduced. One review comments was
that this should be a converged API.
Subsequently change "qcacmn: Introduce wlan_is_ie_valid()" in the
qcacmn project (Change-Id: I8d2a520ea70645ab54b450de83452c0035653485)
created the converged API wlan_is_ie_valid(), so now remove
hdd_is_ie_valid() and instead use wlan_is_ie_valid().
Change-Id: I60fcba09e9c962b7891315cea0e273db88a3d49d
CRs-Fixed: 2170493
hdd_ctx in hdd_connect_result is missed when changing
Iaa1934594d5ffcf3b90dd2ad41bba4eb62f71119.
Change-Id: Ic07976f45e5b51a998b0f4cdd99f98c92a799475
CRs-Fixed: 2177707
Configure IEEE80211_CHAN_DFS for DFS channel, otherwise channel changes
does not happen.
Change-Id: I0cfbff43d0fff79ae17f1e96b764d4c213ae2ea1
CRs-Fixed: 2155839
Currently remote OUI is not getting updated when get station info
is done in STA case.
Add support to send AP MAC address to upper layer, upper layer can
use this MAC to derive OUI information of the AP.
Change-Id: I2091f47c2f0d605969c047663e266992e631484b
CRs-Fixed: 2174523
Add an ini parameter for GCMP support. Send an indication
to FW with the ini value.
Change-Id: Ib24747ddb35593373ecc83d6c7f89866571c2421
CRs-Fixed: 2175104
