From 339b01d8aebe8da59898d19966f061998686e876 Mon Sep 17 00:00:00 2001
From: Kai Chen <kaichen@codeaurora.org>
Date: Sun, 22 Jul 2018 11:34:13 -0700
Subject: [PATCH] qcacmn: Check the MPDU start tag before read ppdu id

Check the MPDU start tag before read ppdu id in MPDU
start TLV in the head of packet TLV.

Change-Id: I0b9a367e148d55a6c667adc8ad16e7c0fdf0a741
---
 dp/wifi3.0/dp_rx_mon_dest.c |  8 ++++++++
 hal/wifi3.0/hal_api_mon.h   | 19 +++++++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/dp/wifi3.0/dp_rx_mon_dest.c b/dp/wifi3.0/dp_rx_mon_dest.c
index dcb8ae193f38..6348b0214d6d 100644
--- a/dp/wifi3.0/dp_rx_mon_dest.c
+++ b/dp/wifi3.0/dp_rx_mon_dest.c
@@ -222,6 +222,14 @@ dp_rx_mon_mpdu_pop(struct dp_soc *soc, uint32_t mac_id,
 				 num_msdus);
 
 			if (is_first_msdu) {
+				if (!HAL_RX_HW_DESC_MPDU_VALID(
+					rx_desc_tlv)) {
+					drop_mpdu = true;
+					qdf_nbuf_free(msdu);
+					msdu = NULL;
+					goto next_msdu;
+				}
+
 				msdu_ppdu_id = HAL_RX_HW_DESC_GET_PPDUID_GET(
 						rx_desc_tlv);
 				is_first_msdu = false;
diff --git a/hal/wifi3.0/hal_api_mon.h b/hal/wifi3.0/hal_api_mon.h
index 8dfd185fa041..3d4194e3f59a 100644
--- a/hal/wifi3.0/hal_api_mon.h
+++ b/hal/wifi3.0/hal_api_mon.h
@@ -212,6 +212,25 @@ HAL_RX_DESC_GET_80211_HDR(void *hw_desc_addr) {
 	return rx_pkt_hdr;
 }
 
+/*
+ * HAL_RX_HW_DESC_MPDU_VALID() - check MPDU start TLV tag in MPDU
+ *			start TLV of Hardware TLV descriptor
+ * @hw_desc_addr: Hardware desciptor address
+ *
+ * Return: bool: if TLV tag match
+ */
+static inline
+bool HAL_RX_HW_DESC_MPDU_VALID(void *hw_desc_addr)
+{
+	struct rx_pkt_tlvs *rx_desc = (struct rx_pkt_tlvs *)hw_desc_addr;
+	uint32_t tlv_tag;
+
+	tlv_tag = HAL_RX_GET_USER_TLV32_TYPE(
+		&rx_desc->mpdu_start_tlv);
+
+	return tlv_tag == WIFIRX_MPDU_START_E ? true : false;
+}
+
 static inline
 uint32_t HAL_RX_HW_DESC_GET_PPDUID_GET(void *hw_desc_addr)
 {