diff --git a/core/hdd/src/wlan_hdd_hostapd.c b/core/hdd/src/wlan_hdd_hostapd.c index e1981ccac2fc..fbd1b2a00df1 100644 --- a/core/hdd/src/wlan_hdd_hostapd.c +++ b/core/hdd/src/wlan_hdd_hostapd.c @@ -2234,32 +2234,28 @@ QDF_STATUS hdd_hostapd_sap_event_cb(tpSap_Event pSapEvent, HDD_SAP_WAKE_LOCK_DURATION); { struct station_info *sta_info; - uint16_t iesLen = event->iesLen; + uint32_t ies_len = event->ies_len; sta_info = qdf_mem_malloc(sizeof(*sta_info)); if (!sta_info) { hdd_err("Failed to allocate station info"); return QDF_STATUS_E_FAILURE; } - if (iesLen <= MAX_ASSOC_IND_IE_LEN) { - sta_info->assoc_req_ies = - (const u8 *)&event->ies[0]; - sta_info->assoc_req_ies_len = iesLen; + + sta_info->assoc_req_ies = event->ies; + sta_info->assoc_req_ies_len = ies_len; #if (LINUX_VERSION_CODE < KERNEL_VERSION(4, 0, 0)) && !defined(WITH_BACKPORTS) - /* - * After Kernel 4.0, it's no longer need to set - * STATION_INFO_ASSOC_REQ_IES flag, as it - * changed to use assoc_req_ies_len length to - * check the existence of request IE. - */ - sta_info->filled |= STATION_INFO_ASSOC_REQ_IES; + /* + * After Kernel 4.0, it's no longer need to set + * STATION_INFO_ASSOC_REQ_IES flag, as it + * changed to use assoc_req_ies_len length to + * check the existence of request IE. + */ + sta_info->filled |= STATION_INFO_ASSOC_REQ_IES; #endif - cfg80211_new_sta(dev, - (const u8 *)&event->staMac.bytes[0], - sta_info, GFP_KERNEL); - } else { - hdd_err("Assoc Ie length is too long"); - } + cfg80211_new_sta(dev, + (const u8 *)&event->staMac.bytes[0], + sta_info, GFP_KERNEL); qdf_mem_free(sta_info); } /* Lets abort scan to ensure smooth authentication for client */ diff --git a/core/sap/inc/sap_api.h b/core/sap/inc/sap_api.h index 880b7e25ecd3..8915a3463c0a 100644 --- a/core/sap/inc/sap_api.h +++ b/core/sap/inc/sap_api.h @@ -50,6 +50,8 @@ extern "C" { #define MAX_ACL_MAC_ADDRESS 32 #define AUTO_CHANNEL_SELECT 0 #define MAX_ASSOC_IND_IE_LEN 255 +#define MAX_ASSOC_REQ_IE_LEN 2000 +#define ASSOC_REQ_IE_OFFSET 4 /* defines for WPS config states */ #define SAP_WPS_DISABLED 0 @@ -260,8 +262,8 @@ typedef struct sap_StationAssocReassocCompleteEvent_s { eStationType staType; uint8_t staId; uint8_t status; - uint8_t ies[MAX_ASSOC_IND_IE_LEN]; - uint16_t iesLen; + uint8_t *ies; + uint32_t ies_len; uint32_t statusCode; bool wmmEnabled; uint8_t timingMeasCap; diff --git a/core/sap/src/sap_fsm.c b/core/sap/src/sap_fsm.c index 8469ce7fd37a..0886d9d0b5e0 100644 --- a/core/sap/src/sap_fsm.c +++ b/core/sap/src/sap_fsm.c @@ -1499,27 +1499,19 @@ QDF_STATUS sap_signal_hdd_event(struct sap_context *sap_ctx, &csr_roaminfo->peerMac); reassoc_complete->staId = csr_roaminfo->staId; reassoc_complete->statusCode = csr_roaminfo->statusCode; - reassoc_complete->iesLen = csr_roaminfo->rsnIELen; - qdf_mem_copy(reassoc_complete->ies, csr_roaminfo->prsnIE, - csr_roaminfo->rsnIELen); -#ifdef FEATURE_WLAN_WAPI - if (csr_roaminfo->wapiIELen) { - uint8_t len = reassoc_complete->iesLen; - - reassoc_complete->iesLen += csr_roaminfo->wapiIELen; - qdf_mem_copy(&reassoc_complete->ies[len], - csr_roaminfo->pwapiIE, - csr_roaminfo->wapiIELen); + if (csr_roaminfo->assocReqLength < ASSOC_REQ_IE_OFFSET) { + QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_ERROR, + FL("Invalid assoc request length:%d"), + csr_roaminfo->assocReqLength); + return QDF_STATUS_E_INVAL; } -#endif - if (csr_roaminfo->addIELen) { - uint8_t len = reassoc_complete->iesLen; + reassoc_complete->ies_len = (csr_roaminfo->assocReqLength - + ASSOC_REQ_IE_OFFSET); + reassoc_complete->ies = (csr_roaminfo->assocReqPtr + + ASSOC_REQ_IE_OFFSET); - reassoc_complete->iesLen += csr_roaminfo->addIELen; - qdf_mem_copy(&reassoc_complete->ies[len], - csr_roaminfo->paddIE, - csr_roaminfo->addIELen); + if (csr_roaminfo->addIELen) { if (wlan_get_vendor_ie_ptr_from_oui( SIR_MAC_P2P_OUI, SIR_MAC_P2P_OUI_SIZE, csr_roaminfo->paddIE, csr_roaminfo->addIELen)) { diff --git a/core/sme/inc/csr_api.h b/core/sme/inc/csr_api.h index c7bf043c7226..7d64c802bb60 100644 --- a/core/sme/inc/csr_api.h +++ b/core/sme/inc/csr_api.h @@ -1210,6 +1210,8 @@ typedef struct sSirSmeAssocIndToUpperLayerCnf { /* Extended capabilities of STA */ uint8_t ecsa_capable; + uint32_t ies_len; + uint8_t *ies; tDot11fIEHTCaps ht_caps; tDot11fIEVHTCaps vht_caps; tSirMacCapabilityInfo capability_info; diff --git a/core/sme/src/csr/csr_api_roam.c b/core/sme/src/csr/csr_api_roam.c index d608006e6933..fb4ce2f4cd72 100644 --- a/core/sme/src/csr/csr_api_roam.c +++ b/core/sme/src/csr/csr_api_roam.c @@ -9622,6 +9622,7 @@ void csr_roam_joined_state_msg_processor(struct mac_context *mac, void *pMsgBuf) qdf_mem_copy(&roam_info->chan_info, &pUpperLayerAssocCnf->chan_info, sizeof(struct oem_channel_info)); + roam_info->ampdu = pUpperLayerAssocCnf->ampdu; roam_info->sgi_enable = pUpperLayerAssocCnf->sgi_enable; roam_info->tx_stbc = pUpperLayerAssocCnf->tx_stbc; @@ -9642,6 +9643,13 @@ void csr_roam_joined_state_msg_processor(struct mac_context *mac, void *pMsgBuf) pUpperLayerAssocCnf->capability_info; if (CSR_IS_INFRA_AP(roam_info->u.pConnectedProfile)) { + if (pUpperLayerAssocCnf->ies_len > 0) { + roam_info->assocReqLength = + pUpperLayerAssocCnf->ies_len; + roam_info->assocReqPtr = + pUpperLayerAssocCnf->ies; + } + mac->roam.roamSession[sessionId].connectState = eCSR_ASSOC_STATE_TYPE_INFRA_CONNECTED; roam_info->fReassocReq = @@ -9650,6 +9658,8 @@ void csr_roam_joined_state_msg_processor(struct mac_context *mac, void *pMsgBuf) roam_info, 0, eCSR_ROAM_INFRA_IND, eCSR_ROAM_RESULT_INFRA_ASSOCIATION_CNF); + if (pUpperLayerAssocCnf->ies) + qdf_mem_free(pUpperLayerAssocCnf->ies); } } break; @@ -15634,6 +15644,21 @@ QDF_STATUS csr_send_assoc_ind_to_upper_layer_cnf_msg(struct mac_context *mac, if (pAssocInd->VHTCaps.present) pMsg->vht_caps = pAssocInd->VHTCaps; pMsg->capability_info = pAssocInd->capability_info; + if (pAssocInd->assocReqPtr) { + if (pAssocInd->assocReqLength < MAX_ASSOC_REQ_IE_LEN) { + pMsg->ies = qdf_mem_malloc( + pAssocInd->assocReqLength); + if (pMsg->ies == NULL) { + qdf_mem_free(pMsg); + return QDF_STATUS_E_NOMEM; + } + pMsg->ies_len = pAssocInd->assocReqLength; + qdf_mem_copy(pMsg->ies , pAssocInd->assocReqPtr, + pMsg->ies_len); + } else { + sme_err("Assoc Ie length is too long"); + } + } msgQ.type = eWNI_SME_UPPER_LAYER_ASSOC_CNF; msgQ.bodyptr = pMsg;