From 779d27414831836afddbeb0e6cc39b9f20dfe19b Mon Sep 17 00:00:00 2001 From: Wu Gao Date: Tue, 25 Dec 2018 17:44:05 +0800 Subject: [PATCH] qcacmn: Remove structure wmi_tdls_params Using both structure wmi_tdls_params and tdls_info if TDLS component sets FW states, which will cause memory corruption potentially. Use enum wmi_tdls_state as type of tdls state. Change-Id: Ia1e78a5c6d8aee9ab5166c0704dd7827f42c2457 CRs-Fixed: 2372452 --- wmi/inc/wmi_unified_param.h | 37 ------------------------------ wmi/inc/wmi_unified_priv.h | 3 ++- wmi/inc/wmi_unified_sta_api.h | 7 +++--- wmi/src/wmi_unified_sta_api.c | 7 +++--- wmi/src/wmi_unified_sta_tlv.c | 43 +++++++++++++++++++---------------- 5 files changed, 34 insertions(+), 63 deletions(-) diff --git a/wmi/inc/wmi_unified_param.h b/wmi/inc/wmi_unified_param.h index ff139fe5637f..8654da595f6e 100644 --- a/wmi/inc/wmi_unified_param.h +++ b/wmi/inc/wmi_unified_param.h @@ -2637,43 +2637,6 @@ struct fw_dump_req_param { struct fw_dump_seg_req_param segment[WMI_MAX_NUM_FW_SEGMENTS]; }; -/** - * struct wmi_tdls_params - TDLS parameters - * @vdev_id: vdev id - * @tdls_state: TDLS state - * @notification_interval_ms: notification inerval - * @tx_discovery_threshold: tx discovery threshold - * @tx_teardown_threshold: tx teardown threashold - * @rssi_teardown_threshold: RSSI teardown threshold - * @rssi_delta: RSSI delta - * @tdls_options: TDLS options - * @peer_traffic_ind_window: raffic indication window - * @peer_traffic_response_timeout: traffic response timeout - * @puapsd_mask: uapsd mask - * @puapsd_inactivity_time: uapsd inactivity time - * @puapsd_rx_frame_threshold: uapsd rx frame threshold - * @teardown_notification_ms: tdls teardown notification interval - * @tdls_peer_kickout_threshold: tdls packet threshold for - * peer kickout operation - */ -struct wmi_tdls_params { - uint32_t vdev_id; - uint32_t tdls_state; - uint32_t notification_interval_ms; - uint32_t tx_discovery_threshold; - uint32_t tx_teardown_threshold; - int32_t rssi_teardown_threshold; - int32_t rssi_delta; - uint32_t tdls_options; - uint32_t peer_traffic_ind_window; - uint32_t peer_traffic_response_timeout; - uint32_t puapsd_mask; - uint32_t puapsd_inactivity_time; - uint32_t puapsd_rx_frame_threshold; - uint32_t teardown_notification_ms; - uint32_t tdls_peer_kickout_threshold; -}; - /** * struct dhcp_offload_info_params - dhcp offload parameters * @vdev_id: request data length diff --git a/wmi/inc/wmi_unified_priv.h b/wmi/inc/wmi_unified_priv.h index 3a1f58fea763..c4f05c2f82e0 100644 --- a/wmi/inc/wmi_unified_priv.h +++ b/wmi/inc/wmi_unified_priv.h @@ -935,7 +935,8 @@ QDF_STATUS (*send_set_tdls_offchan_mode_cmd)(wmi_unified_t wmi_handle, struct tdls_channel_switch_params *chan_switch_params); QDF_STATUS (*send_update_fw_tdls_state_cmd)(wmi_unified_t wmi_handle, - void *tdls_param, uint8_t tdls_state); + struct tdls_info *tdls_param, + enum wmi_tdls_state tdls_state); QDF_STATUS (*send_update_tdls_peer_state_cmd)(wmi_unified_t wmi_handle, struct tdls_peer_state_params *peerStateParams, diff --git a/wmi/inc/wmi_unified_sta_api.h b/wmi/inc/wmi_unified_sta_api.h index 8dae9b09b965..78755e3ee1f4 100644 --- a/wmi/inc/wmi_unified_sta_api.h +++ b/wmi/inc/wmi_unified_sta_api.h @@ -185,13 +185,14 @@ QDF_STATUS wmi_unified_set_tdls_offchan_mode_cmd(void *wmi_hdl, /** * wmi_unified_update_fw_tdls_state_cmd() - send enable/disable tdls for a vdev * @wmi_handle: wmi handle - * @pwmaTdlsparams: TDLS params + * @tdls_param: TDLS params + * @tdls_state: TDLS state * * Return: QDF_STATUS_SUCCESS on success and QDF_STATUS_E_FAILURE for failure */ QDF_STATUS wmi_unified_update_fw_tdls_state_cmd(void *wmi_hdl, - void *tdls_param, - uint8_t tdls_state); + struct tdls_info *tdls_param, + enum wmi_tdls_state tdls_state); /** * wmi_unified_update_tdls_peer_state_cmd() - update TDLS peer state diff --git a/wmi/src/wmi_unified_sta_api.c b/wmi/src/wmi_unified_sta_api.c index 91d1558a9919..85484119d4c8 100644 --- a/wmi/src/wmi_unified_sta_api.c +++ b/wmi/src/wmi_unified_sta_api.c @@ -161,13 +161,14 @@ QDF_STATUS wmi_unified_set_tdls_offchan_mode_cmd(void *wmi_hdl, } QDF_STATUS wmi_unified_update_fw_tdls_state_cmd(void *wmi_hdl, - void *tdls_param, uint8_t tdls_state) + struct tdls_info *tdls_param, + enum wmi_tdls_state tdls_state) { wmi_unified_t wmi_handle = (wmi_unified_t) wmi_hdl; if (wmi_handle->ops->send_update_fw_tdls_state_cmd) - return wmi_handle->ops->send_update_fw_tdls_state_cmd(wmi_handle, - tdls_param, tdls_state); + return wmi_handle->ops->send_update_fw_tdls_state_cmd( + wmi_handle, tdls_param, tdls_state); return QDF_STATUS_E_FAILURE; } diff --git a/wmi/src/wmi_unified_sta_tlv.c b/wmi/src/wmi_unified_sta_tlv.c index 327fc80bc16d..69e5f6974214 100644 --- a/wmi/src/wmi_unified_sta_tlv.c +++ b/wmi/src/wmi_unified_sta_tlv.c @@ -22,6 +22,9 @@ #include "wmi_unified_priv.h" #include "wmi_unified_sta_param.h" #include "wmi_unified_sta_api.h" +#ifdef CONVERGED_TDLS_ENABLE +#include +#endif /** * send_set_sta_sa_query_param_cmd_tlv() - set sta sa query parameters @@ -635,13 +638,14 @@ static QDF_STATUS send_set_tdls_offchan_mode_cmd_tlv(wmi_unified_t wmi_handle, * * Return: 0 for success or error code */ -static QDF_STATUS send_update_fw_tdls_state_cmd_tlv(wmi_unified_t wmi_handle, - void *tdls_param, uint8_t tdls_state) +static QDF_STATUS +send_update_fw_tdls_state_cmd_tlv(wmi_unified_t wmi_handle, + struct tdls_info *tdls_param, + enum wmi_tdls_state tdls_state) { wmi_tdls_set_state_cmd_fixed_param *cmd; wmi_buf_t wmi_buf; - struct wmi_tdls_params *wmi_tdls = (struct wmi_tdls_params *) tdls_param; uint16_t len = sizeof(wmi_tdls_set_state_cmd_fixed_param); wmi_buf = wmi_buf_alloc(wmi_handle, len); @@ -653,25 +657,26 @@ static QDF_STATUS send_update_fw_tdls_state_cmd_tlv(wmi_unified_t wmi_handle, WMITLV_TAG_STRUC_wmi_tdls_set_state_cmd_fixed_param, WMITLV_GET_STRUCT_TLVLEN (wmi_tdls_set_state_cmd_fixed_param)); - cmd->vdev_id = wmi_tdls->vdev_id; - cmd->state = tdls_state; - cmd->notification_interval_ms = wmi_tdls->notification_interval_ms; - cmd->tx_discovery_threshold = wmi_tdls->tx_discovery_threshold; - cmd->tx_teardown_threshold = wmi_tdls->tx_teardown_threshold; - cmd->rssi_teardown_threshold = wmi_tdls->rssi_teardown_threshold; - cmd->rssi_delta = wmi_tdls->rssi_delta; - cmd->tdls_options = wmi_tdls->tdls_options; - cmd->tdls_peer_traffic_ind_window = wmi_tdls->peer_traffic_ind_window; + cmd->vdev_id = tdls_param->vdev_id; + cmd->state = (A_UINT32)tdls_state; + cmd->notification_interval_ms = tdls_param->notification_interval_ms; + cmd->tx_discovery_threshold = tdls_param->tx_discovery_threshold; + cmd->tx_teardown_threshold = tdls_param->tx_teardown_threshold; + cmd->rssi_teardown_threshold = tdls_param->rssi_teardown_threshold; + cmd->rssi_delta = tdls_param->rssi_delta; + cmd->tdls_options = tdls_param->tdls_options; + cmd->tdls_peer_traffic_ind_window = tdls_param->peer_traffic_ind_window; cmd->tdls_peer_traffic_response_timeout_ms = - wmi_tdls->peer_traffic_response_timeout; - cmd->tdls_puapsd_mask = wmi_tdls->puapsd_mask; - cmd->tdls_puapsd_inactivity_time_ms = wmi_tdls->puapsd_inactivity_time; + tdls_param->peer_traffic_response_timeout; + cmd->tdls_puapsd_mask = tdls_param->puapsd_mask; + cmd->tdls_puapsd_inactivity_time_ms = + tdls_param->puapsd_inactivity_time; cmd->tdls_puapsd_rx_frame_threshold = - wmi_tdls->puapsd_rx_frame_threshold; + tdls_param->puapsd_rx_frame_threshold; cmd->teardown_notification_ms = - wmi_tdls->teardown_notification_ms; + tdls_param->teardown_notification_ms; cmd->tdls_peer_kickout_threshold = - wmi_tdls->tdls_peer_kickout_threshold; + tdls_param->tdls_peer_kickout_threshold; WMI_LOGD("%s: tdls_state: %d, state: %d, " "notification_interval_ms: %d, " @@ -709,7 +714,7 @@ static QDF_STATUS send_update_fw_tdls_state_cmd_tlv(wmi_unified_t wmi_handle, wmi_buf_free(wmi_buf); return QDF_STATUS_E_FAILURE; } - WMI_LOGD("%s: vdev_id %d", __func__, wmi_tdls->vdev_id); + WMI_LOGD("%s: vdev_id %d", __func__, tdls_param->vdev_id); return QDF_STATUS_SUCCESS; }