A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 15:11:48 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Limit the BA window buffer size

Browse source 
In case where peer itself exhibits BA window size more
than the allowed value, crash can happen. So, limit the
BA window size to maximum allowed BA buffer size in case
peer BA req buffer size is more than it.

Change-Id: Ie695b9787b555616a5443077147d4bc3a3aefb78
CRs-Fixed: 2766363
This commit is contained in:
Utkarsh Bhatnagar 2020-09-01 15:36:36 +05:30 • committed by snandini
commit 617c89ade1
1 changed files with 24 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

27
core/mac/src/pe/lim/lim_process_action_frame.c
View file

@ -1437,6 +1437,9 @@ static void lim_process_addba_req(struct mac_context *mac_ctx, uint8_t *rx_pkt_i
uint32_t frame_len, status;
QDF_STATUS qdf_status;
void *soc = cds_get_context(QDF_MODULE_ID_SOC);
tpDphHashNode sta_ds;
uint16_t aid, buff_size;
bool he_cap = false;
mac_hdr = WMA_GET_RX_MAC_HEADER(rx_pkt_info);
body_ptr = WMA_GET_RX_MPDU_DATA(rx_pkt_info);
@ -1460,10 +1463,28 @@ static void lim_process_addba_req(struct mac_context *mac_ctx, uint8_t *rx_pkt_i
pe_warn("warning: unpack addba Req(0x%08x, %d bytes)",
status, frame_len);
}
pe_debug("token %d tid %d timeout %d buff_size %d ssn %d",
sta_ds = dph_lookup_hash_entry(mac_ctx, mac_hdr->sa, &aid,
&session->dph.dphHashTable);
if (sta_ds && lim_is_session_he_capable(session))
he_cap = lim_is_sta_he_capable(sta_ds);
if (he_cap)
buff_size = MAX_BA_BUFF_SIZE;
else
buff_size = SIR_MAC_BA_DEFAULT_BUFF_SIZE;
if (mac_ctx->usr_cfg_ba_buff_size)
buff_size = mac_ctx->usr_cfg_ba_buff_size;
if (addba_req->addba_param_set.buff_size)
buff_size = QDF_MIN(buff_size,
addba_req->addba_param_set.buff_size);
pe_debug("token %d tid %d timeout %d buff_size in frame %d buf_size calculated %d ssn %d",
addba_req->DialogToken.token, addba_req->addba_param_set.tid,
addba_req->ba_timeout.timeout,
addba_req->addba_param_set.buff_size,
addba_req->addba_param_set.buff_size, buff_size,
addba_req->ba_start_seq_ctrl.ssn);
qdf_status = cdp_addba_requestprocess(
@ -1472,7 +1493,7 @@ static void lim_process_addba_req(struct mac_context *mac_ctx, uint8_t *rx_pkt_i
addba_req->DialogToken.token,
addba_req->addba_param_set.tid,
addba_req->ba_timeout.timeout,
addba_req->addba_param_set.buff_size,
buff_size,
addba_req->ba_start_seq_ctrl.ssn);
if (QDF_STATUS_SUCCESS == qdf_status) {