From 2b10eb61750582ee668cf6058bc1cf1c6ee49fcf Mon Sep 17 00:00:00 2001
From: Yeshwanth Sriram Guntuka <ysriramg@codeaurora.org>
Date: Fri, 9 Apr 2021 10:58:08 +0530
Subject: [PATCH] qcacmn: Drop msdu with len err in rx attn tlvs

Drop msdus received with len err set to 1 in
rx attention tlvs.

Change-Id: I8e754a6023874262406c050047ebf013e8b1d589
CRs-Fixed: 2941873
---
 dp/wifi3.0/dp_rx.c    |  7 +++++++
 dp/wifi3.0/dp_types.h |  2 ++
 hal/wifi3.0/hal_rx.h  | 22 ++++++++++++++++++++++
 3 files changed, 31 insertions(+)

diff --git a/dp/wifi3.0/dp_rx.c b/dp/wifi3.0/dp_rx.c
index 3caba3218773..b3cb408f1ef0 100644
--- a/dp/wifi3.0/dp_rx.c
+++ b/dp/wifi3.0/dp_rx.c
@@ -2710,6 +2710,13 @@ done:
 		vdev_id = QDF_NBUF_CB_RX_VDEV_ID(nbuf);
 		peer_id =  QDF_NBUF_CB_RX_PEER_ID(nbuf);
 
+		if (qdf_unlikely(hal_rx_attn_msdu_len_err_get(rx_tlv_hdr))) {
+			DP_STATS_INC(soc, rx.err.msdu_len_err, 1);
+			qdf_nbuf_free(nbuf);
+			nbuf = next;
+			continue;
+		}
+
 		if (dp_rx_is_list_ready(deliver_list_head, vdev, peer,
 					peer_id, vdev_id)) {
 			dp_rx_deliver_to_stack(soc, vdev, peer,
diff --git a/dp/wifi3.0/dp_types.h b/dp/wifi3.0/dp_types.h
index 767337c9f67f..596fe3c6de3e 100644
--- a/dp/wifi3.0/dp_types.h
+++ b/dp/wifi3.0/dp_types.h
@@ -1036,6 +1036,8 @@ struct dp_soc_stats {
 			uint32_t intrabss_eapol_drop;
 			/* Non Eapol pkt drop cnt due to peer not authorized */
 			uint32_t peer_unauth_rx_pkt_drop;
+			/* MSDU len err count */
+			uint32_t msdu_len_err;
 		} err;
 
 		/* packet count per core - per ring */
diff --git a/hal/wifi3.0/hal_rx.h b/hal/wifi3.0/hal_rx.h
index c319c0bd2fa2..1a5c32e8277d 100644
--- a/hal/wifi3.0/hal_rx.h
+++ b/hal/wifi3.0/hal_rx.h
@@ -4035,4 +4035,26 @@ uint32_t hal_rx_attn_offset_get(hal_soc_handle_t hal_soc_hdl)
 
 	return hal_soc->ops->hal_rx_attn_offset_get();
 }
+
+#define HAL_RX_ATTN_MSDU_LEN_ERR_GET(_rx_attn)		\
+	(_HAL_MS((*_OFFSET_TO_WORD_PTR(_rx_attn,	\
+		RX_ATTENTION_1_MSDU_LENGTH_ERR_OFFSET)),	\
+		RX_ATTENTION_1_MSDU_LENGTH_ERR_MASK,		\
+		RX_ATTENTION_1_MSDU_LENGTH_ERR_LSB))
+
+/**
+ * hal_rx_attn_msdu_len_err_get(): Get msdu_len_err value from
+ *  rx attention tlvs
+ * @buf: pointer to rx pkt tlvs hdr
+ *
+ * Return: msdu_len_err value
+ */
+static inline uint32_t
+hal_rx_attn_msdu_len_err_get(uint8_t *buf)
+{
+	struct rx_pkt_tlvs *pkt_tlvs = (struct rx_pkt_tlvs *)buf;
+	struct rx_attention *rx_attn = &pkt_tlvs->attn_tlv.rx_attn;
+
+	return HAL_RX_ATTN_MSDU_LEN_ERR_GET(rx_attn);
+}
 #endif /* _HAL_RX_H */