When a scattered frame is received, msdu length caclulation
is incorrect, this leads to while loop can't break. At last
skb, null pointer dereference happned. Change is aimed to
correct the length caclulation.
Change-Id: Ifb316f004ea5829b1130ce4c0fc9253134e26713
CRs-Fixed: 3025973
Add support for extracting Thermal Stats Events
from thermal event TLV for FW event
WMI_THERM_THROT_STATS_EVENTID.
Also, added support for FW Cmd to request for
Thermal Stats: WMI_REQUEST_THERMAL_STATS_CMDID
Change-Id: I2bc80d082bda45e2255371bcb0c31d35d9806525
CRs-Fixed: 3016845
6GHz do not have any dfs channels so do not update dfs related
parameters for 6GHz frequencies
Change-Id: I791622ce4b401bca65f132665eb2a1ebd7c9e931
CRs-Fixed: 3020653
Dump flow pool stats even for low verbosity level as
part of periodic stats display.
Change-Id: Iea59d20b0a81cfd0bfdac65ad54a11fa33f30f2f
CRs-Fixed: 3031168
Firmware sends some ppdu stats required for packet capture
mode in new ppdu stats tlv HTT_PPDU_STATS_FOR_SMU_TLV.
Add code to parse it if feature is enabled via ini and
send the ppdu stats using wdi event to packet capture
component.
Change-Id: I5567007a91093dd342f37458760b3a61c040b779
CRs-Fixed: 3004476
Currently, rx packet capture events processing happens even
when feature is disabled by ini. This incurs per packet overhead
in rx path.
The fix is to move all the processing from rx path to packet capture mode
component. Send only wdi event from rx path, when feature is enabled by
ini.
Change-Id: I647256b85117cd3373950c78a5a0ae7d6710e4e2
CRs-Fixed: 2969123
Currently error BAR frames are routed to host, but host
doesn't have complete information to check whether these
frames are valid and really action need to be taken or not.
If host updates H.W without validating SSN it is causing
window movement and REO HW aging timeout happening for
next set of RX packets and delay is induced.
To avoid RX packets delay skipping BAR update to H.W
Change-Id: I92c1614993b6985218a453fe528fbd274fab254f
CRs-Fixed: 2995461
There is a requirement to get sequence number and tid for tx
data packets in packet capture mode. These fields are not
received as part of WBM tx completion, but are obtained from
FW in ppdu stats. As WBM tx completion and FW ppdu stats are
two different events, the ppdu_stats of previously sent ppdu
are filled in the radiotap header of current tx ppdu in packet
capture mode.
Enhance code to add required fields such as ppdu_id of tx current
ppdu and ppdu_id, tid, start_seq, ba_bitmap of previously sent ppdu
as extension2 to radiotap header. These fields will be added in
radiotap header only when add_rtap_ext2 is set.
Change-Id: I448a9c03a770b61ab802d855bc5f1a6587bd01b3
CRs-Fixed: 3004472
In case of split profile, while parsing the other segment
of the non transmitted profile present in the subsequent
MBSSID tag, it is possible that the beacon is corrupted where
the non tx profile length has gone out of bound.
In case of above scenario, the MBSSIE parsing code does not
free up the memory allocated for split_prof_start before
returning, which could possibly result into a memmory leak.
Handling the split_profile_continue bit before non tx profile
length check can avoid this situation.
Change-Id: Iaa491fd2803d88759e74ca5a668dddb9f8a42708
CRs-Fixed: 3023554
While parsing MBSS IE split profiles, bssid copy flag
is not reset in between sub element parsing resulting
in skipping the bssid copy for next non tx profile.
Reset skip_bssid_copy flag for each sub element parsing
so that correct bssid is copied for next non tx profile
CRs-Fixed: 3019298
Change-Id: I429190b21a3ddafdc75a73e8b063f6b6f629492a
Even though force wake request timed out there is possibility of
wake request got stuck and handled later at qmi level this leads
to leaving device in wake state for long time unnecessarily.
To avoid this send force wake release when wake request times out.
Change-Id: Ic0e1b3d3fe9d4b0e0f0d4b9be5804ef4f1d3e724
CRs-Fixed: 3019575
Since target already converts RSSI from SNR to dBm for QCA6490 and
WCN7850, so don't convert them again in host side.
Change-Id: Ie35f3821a802f2e65b61f4891f2ca9c632fa1477
CRs-Fixed: 3024119
util_scan_copy_beacon_data copies beacon and updates ie
pointers for the cache entry. However, two of the ie pointers
listed below are not updated:
1) hecap_6g - pointer to he 6ghz cap ie.
2) srp - pointer to spatial reuse parameter sub extended ie.
These non updated pointers will cause use after free issues
if the parent scan entry is freed.
Update ie pointers for hecap_6g and srp.
Change-Id: I6d0a6129941e3dc1267404a4191ab368c013a102
CRs-Fixed: 2862607
Enhance QCA_NL80211_VENDOR_SUBCMD_THERMAL_CMD to fetch thermal stats
for different temperature levels from the driver to userspace. The
stats will be stored in the driver/firmware for predefined temperature
levels and will be reported to userspace when
QCA_NL80211_VENDOR_SUBCMD_THERMAL_CMD is sent with command type
QCA_WLAN_VENDOR_ATTR_THERMAL_CMD_TYPE_GET_THERMAL_STATS.
The thermal stats can be cleared from userspace by sending
QCA_NL80211_VENDOR_SUBCMD_THERMAL_CMD command with type
QCA_WLAN_VENDOR_ATTR_THERMAL_CMD_TYPE_CLEAR_THERMAL_STATS.
Change-Id: I937bc89865df484a068c887d906df5a9502f1925
CRs-Fixed: 3016851
In the WMI_MGMT_RX_EVENTID event handling, add a length
check to validate if the buffer length sent by the firmware
is less than or equal to the actual buffer length.
Change-Id: I7db9af48bc525543b972dcaf40aee0a05d8f5023
CRs-Fixed: 3001331
In the WMI_PDEV_FIPS_EVENTID event handling, add a length
check to validate if the buffer length sent by the firmware
in fixed params is less than or equal to the actual buffer
length before processing the data.
Change-Id: I7a952d3e3a2f66060451263b72118a52aa89dd06
CRs-Fixed: 3009887
API "fw_diag_data_event_handler" is the handler of an event
WMI_DIAG_DATA_CONTAINER_EVENTID comes from FW. Arguments of
this handler function come from FW.
If num_data may be less than size of(struct wlan_diag_data),
possible OOB while extracting event data.
Fix is to add a sanity check for num_data to avoid the OOB
read.
Change-Id: Ia2eb62dbaa154936bdb4ea34065657d441f12810
CRs-Fixed: 3001178
API "target_if_wifi_pos_oem_rsp_ev_handler" is the handler for
the event with WMI_OEM_RESPONSE_EVENTID. Host receives
"rsp->dma_len" from fw. The integer overflow occurs if
"oem_rsp->dma_len" is big enough while calculating the total
length of the Oem Data response buffer.
Fix is to add a sanity check for rsp->dma_len to avoid integer
overflow.
Change-Id: Idfbd358f62534eae0147f03505ced5728877a269
CRs-Fixed: 3001191
During beacon or probe response, if channel is dfs && frame type
is MGMT_SUBTYPE_BEACON, it would call "util_scan_add_hidden_ssid"
to deal with the packet. If the ie id matches with SSID then OOB
read may occur in ie_len as it is validated with upper bound of
ie_ssid.
Validate the ie length first. If it is more than 0 then copy
memory to SSID which are equivalent to ie length.
Change-Id: Ib5e2ab7f6f3337d4c3e5c240e3133d8f276be50a
CRs-Fixed: 3007473
Add QCA new status vendor attribute
QCA_WLAN_VENDOR_TWT_STATUS_POWER_SAVE_EXIT_TERMINATE
to indicate the TWT session termination due to power save
exit request from userspace.
Change-Id: I515e4e8384b92b2556d72c4015252f075577f13c
CRs-Fixed: 3013360
Add new TWT teardown status code to indicate host teared
down the TWT session due to PS disable.
Change-Id: I49c2d7bb1abc4ceb4f79b833cbafcb44e8b936fe
CRs-Fixed: 3013358
In qdf_mem_multi_page_link, pages->cacheable_pages is array with elem num
pages->num_pages, but pages->cacheable_pages[pages->num_pages] is read,
out of bounds error will report if KASAN enabled.
When ini dp_tx_ext_desc is 6144 and DP_TX_DESC_POOL_SIZE is 6144,
Size in bytes of TX TSO Num Seg Desc is 16, page size is 4096, so TX TSO
Num Seq Desc need 24 pages (6144*16/4096), each address need 8 bytes,
so TSO Num Seq Desc need kmalloc 192 bytes to save address of 24 pages.
BUG: KASAN: slab-out-of-bounds in qdf_mem_multi_page_link+0x190/0x1f4
Read of size 8 at addr ffffff816b4d60c0 by task kworker/u16:0/8
CPU: 7 PID: 8 Comm: kworker/u16:0 Tainted: G S W O
Workqueue: cnss_driver_event cnss_driver_event_work
Call trace:
dump_backtrace+0x0/0x204
show_stack+0x18/0x24
dump_stack+0xcc/0x11c
print_address_description+0x88/0x578
__kasan_report+0x1ac/0x20c
kasan_report+0x14/0x20
__asan_load8+0x98/0x9c
qdf_mem_multi_page_link+0x190/0x1f4 [wlan]
dp_tx_tso_num_seg_pool_init+0x84/0x170 [wlan]
dp_soc_tx_desc_sw_pools_init+0xb4/0x128 [wlan]
dp_soc_init+0xf78/0x18c8 [wlan]
dp_soc_init_wifi3+0x14/0x20 [wlan]
cds_open+0x7e8/0x15fc [wlan]
hdd_wlan_start_modules+0x7d8/0xf10 [wlan]
hdd_wlan_startup+0x17c/0xbd4 [wlan]
wlan_hdd_pld_probe+0x234/0x370 [wlan]
pld_pcie_probe+0x6c/0x88 [wlan]
cnss_pci_call_driver_probe+0xd8/0x358
cnss_bus_call_driver_probe+0x38/0x6c
cnss_driver_event_work+0xf14/0x1188
process_one_work+0x53c/0x8b8
worker_thread+0x4f8/0x928
kthread+0x1e8/0x200
ret_from_fork+0x10/0x18
Allocated by task 8:
__kasan_kmalloc+0x100/0x1c0
kasan_kmalloc+0x10/0x1c
__kmalloc+0x130/0x448
kzalloc+0x14/0x20 [wlan]
__qdf_mem_malloc+0xcc/0x120 [wlan]
qdf_mem_multi_pages_alloc+0xc0/0x580 [wlan]
dp_prealloc_init+0x1b0/0x48c [wlan]
wlan_hdd_pld_probe+0x200/0x370 [wlan]
pld_pcie_probe+0x6c/0x88 [wlan]
cnss_pci_call_driver_probe+0xd8/0x358
cnss_bus_call_driver_probe+0x38/0x6c
cnss_driver_event_work+0xf14/0x1188
process_one_work+0x53c/0x8b8
worker_thread+0x4f8/0x928
kthread+0x1e8/0x200
ret_from_fork+0x10/0x18
The bad address belongs to the object
which belongs to the cache kmalloc-192 of size 192
The bad address is located 0 bytes to the right of
f816b4d60c0).
Change-Id: I6569c22bc8f900296f49a4426f085912a33aa452
CRs-Fixed: 3014390
Add CDP interface API support for pkt_log_exit,
to cleanup pkt_log_init on failure.
Change-Id: Ib50efaed5997d341d3e76c2e1dbe42856df40191
CRs-Fixed: 3012201
Currently in function wmi_extract_dbr_buf_release_entry,
num_buf_release_entry & num_meta_data_entry are copied
to direct_buf_rx_rsp structure without any validation which
may cause out of bound issue if num_buf_release_entry or
num_meta_data_entries provided in fixed param becomes greater
than actual number of entries.
Fix is to validate num_entries and num_meta_data before populating
param->num_buf_release_entry and param->num_meta_data_entry.
Change-Id: I18050fd4f90f8815d7eceb5f715fdbaa09130d3a
CRs-Fixed: 3000875
Define the new TWT attributes for configuring the broadcast TWT
parameters in enum qca_wlan_vendor_attr_twt_setup.
Change-Id: Ia7b0e1565cef3bfe5d213b783390c7231a1a8446
CRs-Fixed: 2924690
Currently, we are Flushing fragments for peer as part of rx defrag
clean up. There is the possibility that frag flush is called while
we are accessing frags in rx defrag store fragment path in parallel.
Which will cause access after the free issue.
Adding lock in rx defrag store fragment path to avoid any
parallel flush while accessing the frags.
Change-Id: Ic27caab58429d776449f4b774eb7163ffa6215ac
CRs-Fixed: 2995156
Currently, reg curr channel list contains dfs channels
but sap and p2p go can't enable on dfs channels if
dfs_master_mode ini is disabled. So, usable channel list
may contain some invalid channels in case of p2p go and sap.
Fix is to check dfs_master_mode ini and include/exculde sap and
p2p go channels based on dfs_master_mode.
Change-Id: If82d2feda78315ab53c5c7ed75f743c14186da98
CRs-Fixed: 2961435
Currently, host sends bw value to upper layer in response
of GET_USABLE_CHAN command. but upper layer requires bw
value in form of nl80211_chan_width enum and considering
bw value as invalid and resulting into 0 bw.
Fix is to populate bw value from ch_params.ch_width instead
of populating from curr channel list and then convert to
nl80211_chan_width from phy_ch_width in hdd.
Change-Id: I1937ac2b3282224861a200a5d956a6e92109328e
CRs-Fixed: 2957055
Fetch usable channels for NAN interface mode from
policy manager or reg current channel list based on
filter mask and Update res msg channel list.
Change-Id: Ifa4ad4c7c8479f4a0ecc7dbe101f6507ff1525dc
CRs-Fixed: 2949340
Currently sleep based wait is used for checking EP request/release
vote is taken effect or not. But once worker thread goes to sleep
it is taking in order of milli seconds to schedule back worker thread
this scheduling delay is causing srng HP/TP writes to be updated in
delayed manner.
To avoid this first try checking EP vote is taken affect by busy wait
then go for sleep based method.
Change-Id: I72e81941a23752a41c9b5307e82c2e971aee1ec8
CRs-Fixed: 2999541
Currently timeout for checking pld_is_pci_ep_awake in
hif_prevent_link_low_power_states might be higher than
the defined timeout depends on how long qdf_sleep takes
to get scheduled again, so avoid this uncertain timeout
adding reference to the system time.
Change-Id: I67a28d46c996ccc56680cf8e20c09a70729a33c5
CRs-Fixed: 2994746
In MISSION mode, MSI address and data are still
configured for monitor status rings even though MCC
uses only polling mode for this ring.
Fix is to skip MSI configuration for monitor sts
ring in MISSION mode for MCC.
Change-Id: If295a5afc6731bbec1ad7182590e0015f3a911ba
CRs-Fixed:
After reg work is complete there is possiblity EP vote reset
request still not processed by F.W. So wait till EP vote reset
is done after reg work completion.
Change-Id: I1f4e318ac96ba3a15c613c5faf5095d4be7c8e99
CRs-Fixed: 2994233
Add api to set intermediate EP vote access state.
Make sure reg work handler is complete before setting
intermediate vote access.
Change-Id: Ib229d9af8b1e58505a9ae5fbf39aa912ca21a3c3
CRs-Fixed: 2994040
Currently there is no synchronization for flush log completion
between fw and userspace. When host driver receives command to
flush logs, it sends the command to fw and releases the control
of the userspace thread, it does not wait for the flush log
completion event from the fw and because of which user space
does not know when the host and fw completes the log flush.
To address above issue add a logic to wait for fw event of
flush log completion before host returns control to userspace.
Change-Id: I04fa0aead146d2b7b8627e4101c6dcd99d3947e9
CRs-Fixed: 2983387
Currently for UK ETSI1 is mapped due
to which reg list may skip some valid
channel list for UK in case of MCC and DSRC.
Fix is to map MCC to ETSI13_WORLD and
DSRC to ETSI10_WORLD.
Change-Id: Ibcc09e2c45506ee5d4d1cbbaf5763d6056a8ff71
CRs-Fixed: 2953624
When vdev deleted and interface down, there are pending pkts in nbuf
queue of dp rx thread in cornel cases, when flush cmd comes, even vdev
is not found by vdev id, rx stack callback isn't set to NULL, pkts are
still delivered to kernel stack, but rx queue is invalid now, assert
will happen when GRO flush happens.
Fix by setting rx stack callback as NULL when vdev isn't found by vdev
id.
Change-Id: Iad3b71dbc86563a4f8b5369474b2a901cdf8b325
CRs-Fixed: 2995694
Mark vdev as delete in process after flush out the packets in rx thread
queue currently.
If rx packet received after flush and before mark vdev as delete in
process, the packet is enqueued into rx thread queue and not flushed after
vdev deleted physically and net interface down. After that, if flush
pkts after interface down, assert will happen.
Fix:
Mark vdev as delete in process before flush out the packets in the rx
thread queues.
If the vdev is marked as delete in progress, then the
packets received on that particular vdev should not be
enqueued to dp rx thread any more.
Change-Id: If651a9e97b8501efc26400079194570ba6407f13
CRs-Fixed: 2996534
skb_set_len and skb_pull operations are done in both
dp_rx_deliver_to_pkt_capture_no_peer and
dp_rx_deliver_to_stack_no_peer. Due to this, in the
issue scenario, EAPOL frame gets dropped in roaming
scenario since qdf_nbuf_is_ipv4_eapol_pkt returns
false.
Fix is to do a skb_push_head operation in
dp_rx_deliver_to_pkt_capture_no_peer API before
exiting.
Change-Id: I071a5248f9f8577c8a21547f67ec53d707dee0be
CRs-Fixed: 2982188
In WMI INIT, check whether firmware supports the ack event or
not. If it supports then enable driver support and send it to
firmware during WMI INIT.
Change-Id: Icfdee6bc06e6a393de880b87fdab70665ea7c8b4
CRs-Fixed: 2987898
