From 617c89ade15899cdffa76fc8bd5e1f491137a519 Mon Sep 17 00:00:00 2001 From: Utkarsh Bhatnagar Date: Tue, 1 Sep 2020 15:36:36 +0530 Subject: [PATCH] qcacld-3.0: Limit the BA window buffer size In case where peer itself exhibits BA window size more than the allowed value, crash can happen. So, limit the BA window size to maximum allowed BA buffer size in case peer BA req buffer size is more than it. Change-Id: Ie695b9787b555616a5443077147d4bc3a3aefb78 CRs-Fixed: 2766363 --- .../mac/src/pe/lim/lim_process_action_frame.c | 27 ++++++++++++++++--- 1 file changed, 24 insertions(+), 3 deletions(-) diff --git a/core/mac/src/pe/lim/lim_process_action_frame.c b/core/mac/src/pe/lim/lim_process_action_frame.c index 7067e8b25988..c422324a389b 100644 --- a/core/mac/src/pe/lim/lim_process_action_frame.c +++ b/core/mac/src/pe/lim/lim_process_action_frame.c @@ -1437,6 +1437,9 @@ static void lim_process_addba_req(struct mac_context *mac_ctx, uint8_t *rx_pkt_i uint32_t frame_len, status; QDF_STATUS qdf_status; void *soc = cds_get_context(QDF_MODULE_ID_SOC); + tpDphHashNode sta_ds; + uint16_t aid, buff_size; + bool he_cap = false; mac_hdr = WMA_GET_RX_MAC_HEADER(rx_pkt_info); body_ptr = WMA_GET_RX_MPDU_DATA(rx_pkt_info); @@ -1460,10 +1463,28 @@ static void lim_process_addba_req(struct mac_context *mac_ctx, uint8_t *rx_pkt_i pe_warn("warning: unpack addba Req(0x%08x, %d bytes)", status, frame_len); } - pe_debug("token %d tid %d timeout %d buff_size %d ssn %d", + + sta_ds = dph_lookup_hash_entry(mac_ctx, mac_hdr->sa, &aid, + &session->dph.dphHashTable); + if (sta_ds && lim_is_session_he_capable(session)) + he_cap = lim_is_sta_he_capable(sta_ds); + + if (he_cap) + buff_size = MAX_BA_BUFF_SIZE; + else + buff_size = SIR_MAC_BA_DEFAULT_BUFF_SIZE; + + if (mac_ctx->usr_cfg_ba_buff_size) + buff_size = mac_ctx->usr_cfg_ba_buff_size; + + if (addba_req->addba_param_set.buff_size) + buff_size = QDF_MIN(buff_size, + addba_req->addba_param_set.buff_size); + + pe_debug("token %d tid %d timeout %d buff_size in frame %d buf_size calculated %d ssn %d", addba_req->DialogToken.token, addba_req->addba_param_set.tid, addba_req->ba_timeout.timeout, - addba_req->addba_param_set.buff_size, + addba_req->addba_param_set.buff_size, buff_size, addba_req->ba_start_seq_ctrl.ssn); qdf_status = cdp_addba_requestprocess( @@ -1472,7 +1493,7 @@ static void lim_process_addba_req(struct mac_context *mac_ctx, uint8_t *rx_pkt_i addba_req->DialogToken.token, addba_req->addba_param_set.tid, addba_req->ba_timeout.timeout, - addba_req->addba_param_set.buff_size, + buff_size, addba_req->ba_start_seq_ctrl.ssn); if (QDF_STATUS_SUCCESS == qdf_status) {