From d5aae7fcf4c134eb96fed7412210fe6a045d6045 Mon Sep 17 00:00:00 2001
From: Yeshwanth Sriram Guntuka <ysriramg@codeaurora.org>
Date: Mon, 27 Nov 2017 14:33:51 +0530
Subject: [PATCH] qcacld-3.0: Add check to validate vdev id

Set ARP stats command is sent to firmware after
SAP is stopped. As a result, invalid vdev id is
sent in the set ARP stats param resulting in
firmware crash.

Fix is to add check to validate vdev id before
sending set ARP stats command to firmware.

Change-Id: Ia7ab56b9d5aa6a0fd53d84ef1264feea395dd44c
CRs-Fixed: 2149289
---
 core/hdd/src/wlan_hdd_cfg80211.c | 5 +++++
 core/wma/inc/wma_internal.h      | 9 +++++++++
 core/wma/src/wma_dev_if.c        | 2 +-
 core/wma/src/wma_main.c          | 4 ++++
 4 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/core/hdd/src/wlan_hdd_cfg80211.c b/core/hdd/src/wlan_hdd_cfg80211.c
index e9a2e65cefb5..70e54f98d6f8 100644
--- a/core/hdd/src/wlan_hdd_cfg80211.c
+++ b/core/hdd/src/wlan_hdd_cfg80211.c
@@ -11581,6 +11581,11 @@ static int __wlan_hdd_cfg80211_set_nud_stats(struct wiphy *wiphy,
 		return err;
 	}
 
+	if (adapter->session_id == HDD_SESSION_ID_INVALID) {
+		hdd_err("Invalid session id");
+		return -EINVAL;
+	}
+
 	if (tb[STATS_SET_START]) {
 		if (!tb[STATS_GW_IPV4]) {
 			QDF_TRACE(QDF_MODULE_ID_HDD, QDF_TRACE_LEVEL_ERROR,
diff --git a/core/wma/inc/wma_internal.h b/core/wma/inc/wma_internal.h
index da8285071dc2..7bf868220a4b 100644
--- a/core/wma/inc/wma_internal.h
+++ b/core/wma/inc/wma_internal.h
@@ -1369,4 +1369,13 @@ struct wma_beacon_interval_reset_req {
  */
 int wma_fill_beacon_interval_reset_req(tp_wma_handle wma, uint8_t vdev_id,
 				uint16_t beacon_interval, uint32_t timeout);
+/*
+ * wma_is_vdev_valid() - check the vdev status
+ * @vdev_id: vdev identifier
+ *
+ * This function verifies the vdev validity
+ *
+ * Return: 'true' on valid vdev else 'false'
+ */
+bool wma_is_vdev_valid(uint32_t vdev_id);
 #endif
diff --git a/core/wma/src/wma_dev_if.c b/core/wma/src/wma_dev_if.c
index 236e66769231..cd3e40d1895f 100644
--- a/core/wma/src/wma_dev_if.c
+++ b/core/wma/src/wma_dev_if.c
@@ -1145,7 +1145,7 @@ int wma_vdev_start_resp_handler(void *handle, uint8_t *cmd_param_info,
 	return 0;
 }
 
-static bool wma_is_vdev_valid(uint32_t vdev_id)
+bool wma_is_vdev_valid(uint32_t vdev_id)
 {
 	tp_wma_handle wma_handle = cds_get_context(QDF_MODULE_ID_WMA);
 
diff --git a/core/wma/src/wma_main.c b/core/wma/src/wma_main.c
index bdf3c292867e..7e9efab294e8 100644
--- a/core/wma/src/wma_main.c
+++ b/core/wma/src/wma_main.c
@@ -6955,6 +6955,10 @@ static void wma_set_arp_req_stats(WMA_HANDLE handle,
 			 __func__);
 		return;
 	}
+	if (!wma_is_vdev_valid(req_buf->vdev_id)) {
+		WMA_LOGE("vdev id not active or not valid");
+		return;
+	}
 
 	arp_stats = (struct set_arp_stats *)req_buf;
 	status = wmi_unified_set_arp_stats_req(wma_handle->wmi_handle,