Association request initiated by the host contains
the RSN capabilities which contains both the flags
of PMF, i.e PMF required and PMF capable. The DUT
may connect to a non PMF AP or only a PMF capable AP,
if the DUT is PMK capable and not PMF required,
but connection to a non PMF AP isnt allowed
if the DUT is configured as PMF required.
In the Association request, the DUT advertises its
RSN capabilities, and accrding to them, the connection
(PMF/non PMF) happens. But these capabilities arent
sent to the firmware, so while roaming, the DUT may
connect to a non-PMF AP, as in the re-assoc request
the DUT would still advertise PMF-REQUIRED as false,
which would be violation of protocol.
Fix is to send these RSN capabilities to the
firmware as part of roam scan offload params,
to have firmware save the configuration, and
send the RE-assoc request with PMF required as
true, if the DUT supports PMF required.
Change-Id: Iff58f7ba3b2fee7a834bd625225bbb3d62f33557
CRs-Fixed: 2234977
While SSR happen, hdd_reset_all_adapters will not clear
mac_ctx->sap.sapCtxList[sapctx->sessionId].pSapContext, and later the
sapctx will assign new sessionId after SSR restart SAP and update to
mac_ctx->sap.sapCtxList. So sapctx/old sessionId still can be
referenced by like wlan_sap_is_pre_cac_active and call pre cac cleanup
on unexpected port.
When SAP restart and set global sapCtxList in sap_set_session_param(),
find matched sapctx and clear it before assigning updated value.
Change-Id: Id02733cb22267ac0c1899d8caf9ac47c65e24a88
CRs-Fixed: 2232398
Vdev ref count is incremented in wma_state_info_dump
and not decremented before return. This results in
vdev not deleted physically as part of wlan0 hdd_stop.
On hdd_open, a new vdev is created for wlan0 with same
mac addr as the previous wlan0 vdev. In scan, API to
get vdev by mac addr will return NULL since the first
wlan0 vdev is not physically deleted and not removed from
vdev list.
Fix is to decrement vdev ref count in wma_state_info_dump.
Change-Id: I67c90a721643f5bb7c6e212846f6d398055a6672
CRs-Fixed: 2233997
In find_ie_defn function, if the current IE is an Ext IE with EID=255,
the third byte of the IE is accessed to get the extn_eid. However, if
the actual buffer length is less than 3, then an OOB read would occur
while trying to access extn_eid.
Add check to access pbuf + 2 for extn_eid only if nbuf is greater than 2.
Change-Id: Id9708176affe35a85eb21a07901ae8ed62b78b9e
CRs-Fixed: 2237141
Add Null pointer check for packet buffer before dereference
it in lim_send_addba_response_frame() API.
Change-Id: I46c637b7534fe200ec586b07e34d9a4baee5ac7e
CRs-Fixed: 2232740
'wma' pointer is initialized using the return value of
cds_get_context;This function can return NULL value.
Check for NULL pointer before dereferencing the 'wma'.
Change-Id: I529a34fba91f19bdd6c62d14e97cfabb476cdf7f
CRs-Fixed: 2239647
Currently in pe_handle_mgmt_frame, all management frames are posted
into the PE message queue. The beacon and probe response frames are
filtered before posting into the PE message queue, however the PE
message queue can still be flooded with probe request frames.
Post probe request frames via SCAN queue with the appropriate
callback function.
Change-Id: Ie29ad9602d3389af467b8f893624b86265a44421
CRs-Fixed: 2238190
Remove duplicate structs wmi_dual_mac_config and sir_dual_mac_config
and use policy_mgr_dual_mac_config.
Change-Id: I6da6539f519ec46ee274ba3f3ae042e5fd9c25d2
CRs-Fixed: 2190993
Use correct size to mem zero tCsrRoamConnectedProfile
In csr_roam_save_ndi_connected_info() function.
Change-Id: I54d2bef0bd9202971dff47f9b25d43ff40258630
CRs-Fixed: 2232891
The IOCTL handler mapping code for QCSAP_SET_FW_PROFILE_HIST_INTVL
mistakenly falls through to the next switch case. Add a break to prevent
executing two IOCTL callbacks for QCSAP_SET_FW_PROFILE_HIST_INTVL.
Change-Id: I6b0a17b87c22d1d2be3697456608e8ebe704afed
CRs-Fixed: 2232911
Currently wlan_hdd_cfg80211_register_frames falls through to error
handling at the end of the success path. Return success instead.
Change-Id: I28eda918d3d5858cc42ef3958abe918b9ed788e9
CRs-Fixed: 2240003
