If is_bwnss_oui return true in util_scan_parse_vendor_ie,
and it will run into below logical:
scan_params->ie_list.bwnss_map = (((uint8_t *)ie) + 8)
But in fact if ie->ie_len < 6, it will casue read out
of boundary issue. So add the length chekcing before
reading it
Change-Id: I0cdf723154eb808f8062efd897f9d67d54d4573b
CRs-Fixed: 2838849
During esp ie parse from beacon/probe response, the data pointer
is getting read from esp ie and it's not validate while updating
to esp params which may cause out of bound read issue.
Validate data pointer before updating to esp params.
Change-Id: I1167b82248613cc65fcd7c70cdcfe57595de6b21
CRs-Fixed: 2842234
For lithium based chip, the rssi_comb value fetched from monitor
buffer TLV is in unit dBm already, if plus noise_floor value in
qdf_nbuf_update_radiotap() again, then the rssi showed in wireshark
will be incorrect.
Convert rssi_comb to unit dB and not impact legacy chip in
qdf_nbuf_update_radiotap().
Change-Id: I889a15f39ebc639386405fb0aae1909c0cce75e0
CRs-Fixed: 2844896
During nbuf free if entry is not found in debug tracker list
it is treated as double free or unallocated buffer free
which is not correct because there is possibility of nbuf
entry not being present in debug tracker list due to memory
allocation failures for tracker nodes in system low memory state.
Maintaian counter for nbuf debug tracker node memory
allocation failures, during nbuf free if entry is not found
in debug tracker list and tracker memory allocation failures
are present then don't raise issue for nbuf free.
Change-Id: I770cfc23bad35af7e7dbec34852a31cc68300ca5
CRs-Fixed: 2844059
Use safe API - wlan_objmgr_iterate_obj_list to enumerate
vdev. It will check vdev in "create" state by
wlan_objmgr_vdev_try_get_ref.
Change-Id: I650801c07846e22f1863925ed4316c0a24bd9cae
CRs-Fixed: 2849177
During ie parse from beacon/probe response, the variable
tbtt_count and tbtt_length in util_scan_parse_rnr_ie() getting
read from ie and the value is not checked before using it which
may cause out of bound read issue
Validate tbtt_count and tbtt_length before using it
Change-Id: I51cfb2356fb16feda8a70c4b76c7f76c90b1393b
CRs-Fixed: 2836205
Currently the rx rings history is allocated dynamically
on load time. The memory requirement for saving these
history are more than a page (order 5 to 6 allocations).
Such big memory allocation can fail due to various
reasons, one of them being memory fragmentation.
Fix this by pre-allocating the rx ring history memory.
Also allocate the rx reinject history memory when the
HW accelerated path is used.
Change-Id: Id957cd5df91a2ca7f182dea691a0557b4e386f55
CRs-Fixed: 2844388
FW memory allocation depends upon important resource config sent from
host during wmi init. Hence, log these important resource config parameters
sent during wmi init.
Change-Id: I5e187b905716a5a2c1767bc4b081f54034994653
CRs-Fixed: 2839119
Channel number can be invalid when finding out the enumeration for the
channel. Rate limit the messages for the same.
Change-Id: Ie6cf178482647547d58d4d9555763332d6598846
CRs-Fixed: 2843978
In moselle, once wow enabled there is a possibility that wow wake
interrupt can be fired from FW during runtime suspend in-progress
in host, this will introduce a race between runtime suspend and
resume, so adding a synchronization between runtime suspend and
wow triggered runtime resume.
Change-Id: I38d6a24e4421697cc2d0090ba8d19884885596cb
CRs-Fixed: 2845672
In arch 32 platform, the size of rnr_chan_info is 8 bytes, and it only
allocates 4 bytes for each of them. Which cause memory access out of
bounds.
Change-Id: I4f1798c5354c6a76e32bdfed13ade9667465b789
CRs-Fixed: 2827289
Currently, Host driver assumes WMI_MIN_HEAD_ROOM is part of WMI
messages and Validations are done accordingly. But this
WMI_MIN_HEAD_ROOM is not considered in the firmware. Because of
this host may drop valid events.
To avoid this, Don't consider WMI_MIN_HEAD_ROOM while validating WMI
msg length.
Change-Id: I5f1fe12cfae570e636defb8a4a46ec154f988195
CRs-Fixed: 2844982
Add previously freed nbuf and buffer start address info in rx descriptor.
This helps in debugging use after free access of rx buffers.
Change-Id: I1c883bf049ce75dd0413b85946fe2982648d8004
CRs-Fixed: 2827151
Currently, 6g channels are sorted based on the weightage of each
channel. Frequencies are sorted but the flags associated to each
channel are not updated properly. So, channels carry invalid
flags to firmware and firmware may miss to scan few 6g channels
based on these flags and may scan few 6g channels unnecessarily.
Copy flags also while sorting frequencies to maintain the flags
of each channel as it is.
Also, change the type of phymode to enum scan_phy_mode
from uint32_t.
Change-Id: I0a2330faab1b738f2d7eff3d39ccbfffd51dfde0
CRs-Fixed: 2840029
A temporary variable "temp" is declared to use it while sorting
the channels based on the weightage/rnr info. This is declared
as a pointer to hold the reference of struct rnr_chan_weight but
memcpy is done to this without allocating memory.
Declare this as a variable instead of pointer to use it as an
intermediate variable for sorting.
Change-Id: If619f5fa462d5400f0a77e57317ac3c8debb34a5
CRs-Fixed: 2842819
During qdf assert generic failure information printed at last is misleading
failure reason, to avoid this don't print generic failure information.
Change-Id: I55359b2e41a3ee50de4e45e73183f2480c28a1eb
CRs-Fixed: 2789137
Currently DMA mask for the device is set during hif_enable_bus.
If the datapath memory prealloc feature is enabled, there are
a few dma memory allocation which is done before the DMA mask
is set for the device. This leads to the aforementioned dma
memory pre-allocation to be attempted at the default DMA mask.
Due to this the entire device capability of dma address might
not be used.
Add hif api to set dma mask before hif is initialized. This
is needed to set dma mask in case of datapath memory pre allocation.
Change-Id: I6fd25d9cb6ab3aaacd6f959abe4e060e23f37095
CRs-Fixed: 2845020
scenario:
FISA new FST entry is initialed, host will start one timer to
send HTT MSG DP_HTT_FST_CACHE_INVALIDATE_FULL to FW in 5 ms,
WOW suspending happened in the same time, PCIe bus get suspended.
5 ms later, HTT msg sending will try to prevent PCIe L1 to update
CE SRNG HP register, hit assert as PCIe bus suspended already.
suspend and cancel the FSE cache flushing timer when dp_bus_suspend,
resume it when dp_bus_resume.
CRs-Fixed: 2843214
Change-Id: Ie2bc115a0de068335d6c46749f52d205cc21f5a3
rx_ring_history is an array of pointers, address of pointer is
always a non-NULL value, this always passed the NULL check,
which leads to NULL pointer dereference, fixing the same.
Change-Id: I401203a6f2a5930869cf4002ac0e714d3fdba62f
CRs-Fixed: 2844038
Some AP disables AMSDU in BA256 mode, this has draw back
with KPI in HE mode, so leave a config field to use 64 BA
forcibly to make high KPI with these types of AP
Change-Id: Ia69ffe118fd5bbda78cfb98126a483fcf305294e
CRs-Fixed: 2828304
Currently, 6g PSC/non-PSC channels in the scan request are
scanned or optimized to scan only if RNR IE is found based on
the inis scan_mode_6ghz and scan_mode_6ghz_duty_cycle.
As scan_mode_6ghz_duty_cycle is set to 4 by default, first 3
scans are optimized to scan only if RNR IE is found and 4th scan
would be full scan. If there is any standalone AP in 6g channel
that doesn't advertize RNR IE in colocated APs beacons/probe
responses, that's not scanned till the 4th scan.
Reverse the order for scan_mode_6ghz_duty_cycle such that the
first scan of every four scans is a full scan and rest of the
three scans are optimized. So, the standalone 6g APs can be found
in first scan itself based on the ini scan_mode_6ghz.
Change-Id: Ice1614a94f1fd166e283355616ace241a5df2bcb
CRs-Fixed: 2829550
When the number of HTT packets in the endpoint TxQueue is more
than MaxTxQueueDepth, we hit the overflow condition. If the
overflow condition is hit, in htc_try_send(), we skip sending the
excess packets. This is true only if EpSendFull() is registered,
else we will try sending the excess packets.
As part of this logic, we are calling restore_tx_packet(); the
intention of calling resotre_tx_packet() is to just perform
skb_pull_head(), but restore_tx_packet() will also unmap the
HTT packet. Later, when we try to send the excess packets, these
would be already unmapped and when the HW/FW try to access this
unmapped location, it would lead to SMMU fault.
Change-Id: Ie60a302d6a2736f7aa12944b7016d2bdb9ffb10d
CRs-Fixed: 2836444
Currently, Stats request commands are sent over qmi right from the
target suspend request is sent to FW. This is leading to a crash in
FW since it is trying to access PCI when it is in suspend state.
To address this, send stats request over QMI only after the ack is
received for the target suspend command.
Change-Id: Id7a79d52740916f66476bf911e571c0ff466c7d3
CRs-Fixed: 2838737
cld80211_oem_rsp_alloc_skb api is used to alloc skb for reply msg.
A static buffer pointer is returned from this reentrant func
which can be called by kworker and scheduler thread at same
time resulting single buffer access by both threads. After
kworker thread freeing this skb, scheduler is further updating
data in this skb resulting in page fault error. Use local
skb pointer to avoid such race conditions
CRs-Fixed: 2822390
Change-Id: I5f807d06c4890b027c86de9187f17fb83b19db5e
In dual station case, wlan0 is connected to AP, wlan1
connects to the same ap and will get failed because two
interfaces can not connect to same band (same ap).
At present wlan1 will do unlink bss of ap after connect fail.
This may corrupt the bss tree in kernel because the bss is
still pointed by wlan0’s wdev -> current_bss.
Fix by avoid the unlink bss if the bss is still connected
in any interfaces.
Change-Id: I27c76eca2d4f130addabbdc2600f6959d24c8511
CRs-Fixed: 2837496
Currently, Rx diag event work is not being flushed during idle shutdown.
This may result in use after free access if the scheduled diag event work
gets the chance to execute after driver modules are closed.
To address this, flush diag events work during idle shutdown.
Change-Id: I348e80d2c86a5e070f0fb67d66b758529fede76c
CRs-Fixed: 2838020
Currently QMI message length is not being validated before
handling QMI event. This is resulting in illegal memory access
when QMI message length is invalid.
To address this, discard QMI events with invalid length.
Change-Id: Ia9f04bcb4fa3b365cbbf2be8885a8d30f78f8f10
CRs-Fixed: 2839277
The bcast twt functionality may need to be enabled separately
for requestor and responder roles. Enable such configuration
by looking up WMI service bit support from target:
wmi_service_twt_bcast_req_support
wmi_service_twt_bcast_resp_support
Change-Id: Ibc91173c23cf69f0d248af27d61c77bee3e8f48a
CRs-Fixed: 2828720
Add feature capability indication for Adaptive 11r for the
drivers to advertize support for this.
Change-Id: I28da5c3d7d4d841de980c841b1d4c39be12ed295
CRs-Fixed: 2817358
As part of monitor mode init, add check for null monitor vdev before
accessing vdev_id in case prevous cleanup of monitor vdev still ongoing.
Change-Id: I0165684c8aa2abea73fa8c0d1692dac789fb20f6
CRs-Fixed: 2835758
Vdev object manager reference should be taken before enqueuing
serialization command and it should be released after dequeuing the
command from serialization queue. Currently this reference release is
done before moving the command to active queue from pending queue.
This may lead to vdev object deletion before the command is moved to
active queue and result in use after free access for vdev object.
To resolve this, release vdev object reference after moving the
serialization command to active queue.
Change-Id: Ibef0814a245abb36f526997d848cf15ef6a49a44
CRs-Fixed: 2832676
Introduce proper logging APIs for diag module and also rate limit error
logs when skb allocation fails in low memory conditions to avoid excessive
logging side effects
Change-Id: Ia41ff7cfd526180825df61a43f1f59163947f257
CRs-Fixed: 2836681
Currently, reg_set_2g_channel_params_for_freq only considers
enabled channels when filling in the channel params. This
could cause issue when starting vdev in a passive channel.
Update the logic to consider CHANNEL_STATE_DFS as well.
Change-Id: I7a49aaa9a51e09729d7b912a6e3fd62fa240d714
CRs-fixed: 2835565
Add drop statistics for duplicate EAPOL frames received
in the REO exception ring as OOR frames. This will help
understand if EAPOL frames are getting dropped which could
cause connection issues.
Change-Id: Ib9d5a3c04ce6638c65166f02261af5c526cc47eb
CRs-Fixed: 2814633
Currently, host decrements beacon switch count and sends
channel switch frame every time until count becomes 0 this
may introduce sync issue between fw and host.
To avoid sync issue csa switch count is offloaded to fw. fw
will send CSA_SWITCH_COUNT_STATUS_EVENTID once beacon count
becomes 0 and host will send vdev restart once it recives
CSA_SWITCH_COUNT_STATUS_EVENTID.
Change-Id: I60238e8e83b56ca4c6490f9516d673d14ef9c323
CRs-Fixed: 2831356
QMI bypass mode uses 2mb of of mem region for
fw uses. Current implementation does not free this
memory region when qmi bypass mode in enabled.
Free mem leak in qmi bypass mode.
Change-Id: Ie11aa9f20f93183e0b999cd6578aea4b231f8d8b
RTPM wow resume gets triggered from ongoing WMI cmds related to SAP
getting started on the 5 GHz DFS channel. Even though PCIe link resume
is successful, there is a link up vote from UMAC and scn link suspended
state is not getting clear. Thus, clear the scn->link_suspended state
at the end of hif_pci_bus_resume_noirq() because before HIF PCIe bus resume
noirq phase is complete, PCIe link is already resumed.
Change-Id: If05593c95d2d63d271fed4abcf84b43e96cc070e
CRs-Fixed: 2833831
check csa_beacon_template service and set
WLAN_SOC_CEXT_CSA_OFFLOAD/25th bit of
soc_fw_ext_caps in psoc if service is
supported by fw.
Change-Id: I8dca74c805cc8696f261e0f791818bca579c80c8
CRs-Fixed: 2826451
Add support to view station's peer RSSI value in auth and assoc request
packet by extracting rssi from probe request and passing it down to
FW in the auth request and assoc request mgmt frames.
Change-Id: I92f714ed815ab8c77f6a6b7df3363dc96f1119bc
CRs-Fixed: 2832982
