From 48d4b5c4c6dcdb196bacfbf067a61b0324910237 Mon Sep 17 00:00:00 2001
From: Abhishek Ambure <aambure@codeaurora.org>
Date: Mon, 13 Jul 2020 20:43:50 +0530
Subject: [PATCH] qcacld-3.0: Don't free assoc rsp fail timer on rsp status
 TRY_AGAIN_LATER

For WPA3 SAE, host runs pmf comeback timer to retry assoc request. Host
retires assoc request once if assoc response has response status as
TRY_AGAIN_LATER after 1 seconds.
Problem scenario:
Host sends assoc request to which AP respond with assoc response status
TRY_AGAIN_LATER, deactivates assoc response failure timer and retransmit
assoc request after 1 second. After 1 second host retransmit assoc req
and marks this is "retried" assoc request. If to the retried assoc
request host gets assoc response with reason status TRY_AGAIN_LATER,
host deactivates assoc failure timer and drops the assoc response.
Thus association does not complete and even association timer doesn't
trigger.
Fix:
deactivate assoc failure timer after checking the assoc response status
is not TRY_AGAIN_LATER and deactivate pmf comeback timer on assoc failure
timer gets trigger.

Change-Id: I7fc89063efec3c4a5b0521e9ff8301d6ea64683e
CRs-Fixed: 2730194
---
 core/mac/src/pe/include/lim_api.h                  | 14 ++++++++++++++
 core/mac/src/pe/lim/lim_api.c                      |  6 +-----
 core/mac/src/pe/lim/lim_process_assoc_rsp_frame.c  | 13 ++++++-------
 core/mac/src/pe/lim/lim_process_mlm_req_messages.c |  1 +
 4 files changed, 22 insertions(+), 12 deletions(-)

diff --git a/core/mac/src/pe/include/lim_api.h b/core/mac/src/pe/include/lim_api.h
index 4c1cafd55c04..d05344eaaccd 100644
--- a/core/mac/src/pe/include/lim_api.h
+++ b/core/mac/src/pe/include/lim_api.h
@@ -113,6 +113,20 @@ QDF_STATUS lim_start(struct mac_context *mac);
 QDF_STATUS pe_start(struct mac_context *mac);
 void pe_stop(struct mac_context *mac);
 
+#ifdef WLAN_FEATURE_11W
+/**
+ * lim_stop_pmfcomeback_timer() - stop pmf comeback timer
+ * @session: Pointer to PE session
+ *
+ * Return: None
+ */
+void lim_stop_pmfcomeback_timer(struct pe_session *session);
+#else
+static inline void lim_stop_pmfcomeback_timer(struct pe_session *session)
+{
+}
+#endif
+
 /**
  * pe_register_mgmt_rx_frm_callback() - registers callback for receiving
  *                                      mgmt rx frames
diff --git a/core/mac/src/pe/lim/lim_api.c b/core/mac/src/pe/lim/lim_api.c
index 5b4d7cd9649f..26195a839f11 100644
--- a/core/mac/src/pe/lim/lim_api.c
+++ b/core/mac/src/pe/lim/lim_api.c
@@ -593,7 +593,7 @@ static inline void lim_nan_register_callbacks(struct mac_context *mac_ctx)
 #endif
 
 #ifdef WLAN_FEATURE_11W
-static void lim_stop_pmfcomeback_timer(struct pe_session *session)
+void lim_stop_pmfcomeback_timer(struct pe_session *session)
 {
 	if (session->opmode != QDF_STA_MODE)
 		return;
@@ -601,10 +601,6 @@ static void lim_stop_pmfcomeback_timer(struct pe_session *session)
 	qdf_mc_timer_stop(&session->pmf_retry_timer);
 	session->pmf_retry_timer_info.retried = false;
 }
-#else
-static void lim_stop_pmfcomeback_timer(struct pe_session *session)
-{
-}
 #endif
 
 /*
diff --git a/core/mac/src/pe/lim/lim_process_assoc_rsp_frame.c b/core/mac/src/pe/lim/lim_process_assoc_rsp_frame.c
index baaa47069782..29fea494dda2 100644
--- a/core/mac/src/pe/lim/lim_process_assoc_rsp_frame.c
+++ b/core/mac/src/pe/lim/lim_process_assoc_rsp_frame.c
@@ -836,13 +836,6 @@ lim_process_assoc_rsp_frame(struct mac_context *mac_ctx, uint8_t *rx_pkt_info,
 		return;
 	}
 	lim_copy_u16((uint8_t *) &mac_capab, caps);
-
-	/* Stop Association failure timer */
-	if (subtype == LIM_ASSOC)
-		lim_deactivate_and_change_timer(mac_ctx, eLIM_ASSOC_FAIL_TIMER);
-	else
-		lim_stop_reassoc_retry_timer(mac_ctx);
-
 	lim_handle_assoc_reject_status(mac_ctx, session_entry, assoc_rsp,
 				       hdr->sa);
 
@@ -873,6 +866,12 @@ lim_process_assoc_rsp_frame(struct mac_context *mac_ctx, uint8_t *rx_pkt_info,
 		return;
 	}
 
+	/* Stop Association failure timer */
+	if (subtype == LIM_ASSOC)
+		lim_deactivate_and_change_timer(mac_ctx, eLIM_ASSOC_FAIL_TIMER);
+	else
+		lim_stop_reassoc_retry_timer(mac_ctx);
+
 	if (assoc_rsp->status_code != eSIR_MAC_SUCCESS_STATUS) {
 		/*
 		 *Re/Association response was received
diff --git a/core/mac/src/pe/lim/lim_process_mlm_req_messages.c b/core/mac/src/pe/lim/lim_process_mlm_req_messages.c
index 0c995ed57cb2..b77b27932434 100644
--- a/core/mac/src/pe/lim/lim_process_mlm_req_messages.c
+++ b/core/mac/src/pe/lim/lim_process_mlm_req_messages.c
@@ -1957,6 +1957,7 @@ void lim_process_assoc_failure_timeout(struct mac_context *mac_ctx,
 			session->peSessionId, session->limMlmState));
 		/* Change timer for future activations */
 		lim_deactivate_and_change_timer(mac_ctx, eLIM_ASSOC_FAIL_TIMER);
+		lim_stop_pmfcomeback_timer(session);
 		/*
 		 * Free up buffer allocated for JoinReq held by
 		 * MLM state machine