From a8637bb1b6e111594615f4247b99e94906b47030 Mon Sep 17 00:00:00 2001 From: wadesong Date: Tue, 23 Jan 2018 15:11:19 +0800 Subject: [PATCH] qcacld-3.0: Add more check points for SAP callback When auth failure occures, hostapd will issue BSS stop command, resulting in BSS peer deleted. After that, auth frame may still get received, and SAP callback may still access BSS peer object for remote peer creation, which results in an assertion. Add more check points to make sure SAP callback is handling the peer object addition correctly based on different status of SAP state machine. Change-Id: Icdb7ae2db018f16cb60878bda8bab1e791667cba CRs-Fixed: 2179494 --- core/hdd/src/wlan_hdd_hostapd.c | 6 ++++++ core/sap/src/sap_fsm.c | 6 ++++++ core/sme/src/csr/csr_api_roam.c | 5 +++-- core/sme/src/csr/csr_cmd_process.c | 5 +++-- 4 files changed, 18 insertions(+), 4 deletions(-) diff --git a/core/hdd/src/wlan_hdd_hostapd.c b/core/hdd/src/wlan_hdd_hostapd.c index 8ee9c8976e81..28130cbee04a 100644 --- a/core/hdd/src/wlan_hdd_hostapd.c +++ b/core/hdd/src/wlan_hdd_hostapd.c @@ -2083,6 +2083,12 @@ QDF_STATUS hdd_hostapd_sap_event_cb(tpSap_Event pSapEvent, case eSAP_STA_ASSOC_EVENT: case eSAP_STA_REASSOC_EVENT: event = &pSapEvent->sapevt.sapStationAssocReassocCompleteEvent; + if (eSAP_STATUS_FAILURE == event->status) { + hdd_notice("assoc failure: " MAC_ADDRESS_STR, + MAC_ADDR_ARRAY(wrqu.addr.sa_data)); + break; + } + wrqu.addr.sa_family = ARPHRD_ETHER; memcpy(wrqu.addr.sa_data, &event->staMac, QDF_MAC_ADDR_SIZE); diff --git a/core/sap/src/sap_fsm.c b/core/sap/src/sap_fsm.c index 517430ba9a54..9d8f7ec14544 100644 --- a/core/sap/src/sap_fsm.c +++ b/core/sap/src/sap_fsm.c @@ -2417,6 +2417,12 @@ QDF_STATUS sap_signal_hdd_event(struct sap_context *sap_ctx, FL("Invalid CSR Roam Info")); return QDF_STATUS_E_INVAL; } + if (eSAP_DISCONNECTING == sap_ctx->sapsMachine) { + QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_ERROR, + "SAP is disconnecting, not able to handle any incoming (re)assoc req"); + return QDF_STATUS_E_ABORTED; + } + reassoc_complete = &sap_ap_event.sapevt.sapStationAssocReassocCompleteEvent; diff --git a/core/sme/src/csr/csr_api_roam.c b/core/sme/src/csr/csr_api_roam.c index 25db519e0790..4cc3c3a0d037 100644 --- a/core/sme/src/csr/csr_api_roam.c +++ b/core/sme/src/csr/csr_api_roam.c @@ -6155,7 +6155,8 @@ QDF_STATUS csr_roam_process_command(tpAniSirGlobal pMac, tSmeCmd *pCommand) switch (pCommand->u.roamCmd.roamReason) { case eCsrForcedDisassoc: - if (eCSR_ROAMING_STATE_IDLE == pMac->roam.curState[sessionId]) { + if (eCSR_ROAMING_STATE_IDLE == + sme_get_current_roam_state(pMac, sessionId)) { sme_err("Ignore eCsrForcedDisassoc cmd on roam state %d", eCSR_ROAMING_STATE_IDLE); return QDF_STATUS_E_FAILURE; @@ -11935,7 +11936,7 @@ csr_roam_chk_lnk_wm_status_change_ntf(tpAniSirGlobal mac_ctx, if (!QDF_IS_STATUS_SUCCESS(status)) break; if (eCSR_ROAMING_STATE_JOINED == - mac_ctx->roam.curState[sessionId] + sme_get_current_roam_state(mac_ctx, sessionId) && ((eCSR_ROAM_SUBSTATE_JOINED_REALTIME_TRAFFIC == mac_ctx->roam.curSubState[sessionId]) || (eCSR_ROAM_SUBSTATE_NONE == diff --git a/core/sme/src/csr/csr_cmd_process.c b/core/sme/src/csr/csr_cmd_process.c index 41fc5be5a502..ab4f1c9dda22 100644 --- a/core/sme/src/csr/csr_cmd_process.c +++ b/core/sme/src/csr/csr_cmd_process.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2011-2017 The Linux Foundation. All rights reserved. + * Copyright (c) 2011-2018 The Linux Foundation. All rights reserved. * * Previously licensed under the ISC license by Qualcomm Atheros, Inc. * @@ -49,8 +49,9 @@ QDF_STATUS csr_msg_processor(tpAniSirGlobal mac_ctx, void *msg_buf) QDF_STATUS status = QDF_STATUS_SUCCESS; tSirSmeRsp *sme_rsp = (tSirSmeRsp *) msg_buf; uint8_t session_id = sme_rsp->sessionId; - enum csr_roam_state cur_state = mac_ctx->roam.curState[session_id]; + enum csr_roam_state cur_state; + cur_state = sme_get_current_roam_state(mac_ctx, session_id); sme_debug("msg %d[0x%04X] recvd in curstate %s & substate %s id(%d)", sme_rsp->messageType, sme_rsp->messageType, mac_trace_getcsr_roam_state(cur_state),