qcacld-2.0: Pass correct data length in oem data response msg

Add data length information in oem data response messages. Currently
maximum response size is passed to upper layers.

Change-Id: Id74d44e03755af9a5402e5409ee5f6b5e7abbb7c
CRs-Fixed: 1001118

7 files changed, 107 insertions, 41 deletions

diff --git a/CORE/MAC/inc/sirApi.h b/CORE/MAC/inc/sirApi.h
index 8771929511db..80255ca660cb 100644
--- a/CORE/MAC/inc/sirApi.h
+++ b/CORE/MAC/inc/sirApi.h
@@ -990,7 +990,8 @@ typedef struct sSirOemDataRsp
     tANI_U16             messageType;
     tANI_U16             length;
     bool                 target_rsp;
-    tANI_U8              oemDataRsp[OEM_DATA_RSP_SIZE];
+    uint32_t             rsp_len;
+    uint8_t              *oem_data_rsp;
 } tSirOemDataRsp, *tpSirOemDataRsp;
 
 #endif //FEATURE_OEM_DATA_SUPPORT
diff --git a/CORE/MAC/src/pe/include/limGlobal.h b/CORE/MAC/src/pe/include/limGlobal.h
index db2340229a05..a7b4ca803c38 100644
--- a/CORE/MAC/src/pe/include/limGlobal.h
+++ b/CORE/MAC/src/pe/include/limGlobal.h
@@ -331,7 +331,8 @@ typedef struct sLimMlmOemDataReq
 typedef struct sLimMlmOemDataRsp
 {
    bool                   target_rsp;
-   tANI_U8                oemDataRsp[OEM_DATA_RSP_SIZE];
+   uint32_t               rsp_len;
+   uint8_t                *oem_data_rsp;
 } tLimMlmOemDataRsp, *tpLimMlmOemDataRsp;
 #endif
 
diff --git a/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c b/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c
index 9bbade21116c..9970b0e0cf34 100644
--- a/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c
+++ b/CORE/MAC/src/pe/lim/limSendSmeRspMessages.c
@@ -1404,16 +1404,30 @@ void limSendSmeOemDataRsp(tpAniSirGlobal pMac, tANI_U32* pMsgBuf, tSirResultCode
     //get the pointer to the mlm message
     pMlmOemDataRsp = (tLimMlmOemDataRsp*)(pMsgBuf);
 
-    msgLength = sizeof(tSirOemDataRsp);
+    msgLength = sizeof(*pSirSmeOemDataRsp);
 
     //now allocate memory for the char buffer
     pSirSmeOemDataRsp = vos_mem_malloc(msgLength);
     if (NULL == pSirSmeOemDataRsp)
     {
-        limLog(pMac, LOGP, FL("call to AllocateMemory failed for pSirSmeOemDataRsp"));
+        limLog(pMac, LOGP, FL("malloc failed for pSirSmeOemDataRsp"));
+        vos_mem_free(pMlmOemDataRsp->oem_data_rsp);
+        vos_mem_free(pMlmOemDataRsp);
         return;
     }
 
+    if (pMlmOemDataRsp->rsp_len) {
+        pSirSmeOemDataRsp->oem_data_rsp =
+                vos_mem_malloc(pMlmOemDataRsp->rsp_len);
+        if (!pSirSmeOemDataRsp->oem_data_rsp) {
+            limLog(pMac, LOGE, FL("malloc failed for oem_data_rsp"));
+            vos_mem_free(pSirSmeOemDataRsp);
+            vos_mem_free(pMlmOemDataRsp->oem_data_rsp);
+            vos_mem_free(pMlmOemDataRsp);
+            return;
+        }
+    }
+
 #if defined (ANI_LITTLE_BYTE_ENDIAN)
     sirStoreU16N((tANI_U8*)&pSirSmeOemDataRsp->length, msgLength);
     sirStoreU16N((tANI_U8*)&pSirSmeOemDataRsp->messageType, eWNI_SME_OEM_DATA_RSP);
@@ -1422,10 +1436,16 @@ void limSendSmeOemDataRsp(tpAniSirGlobal pMac, tANI_U32* pMsgBuf, tSirResultCode
     pSirSmeOemDataRsp->messageType = eWNI_SME_OEM_DATA_RSP;
 #endif
     pSirSmeOemDataRsp->target_rsp = pMlmOemDataRsp->target_rsp;
-    vos_mem_copy(pSirSmeOemDataRsp->oemDataRsp, pMlmOemDataRsp->oemDataRsp, OEM_DATA_RSP_SIZE);
+    pSirSmeOemDataRsp->rsp_len = pMlmOemDataRsp->rsp_len;
+    vos_mem_copy(pSirSmeOemDataRsp->oem_data_rsp,
+                 pMlmOemDataRsp->oem_data_rsp,
+                 pSirSmeOemDataRsp->rsp_len);
 
     //Now free the memory from MLM Rsp Message
+    vos_mem_free(pMlmOemDataRsp->oem_data_rsp);
+    pMlmOemDataRsp->oem_data_rsp = NULL;
     vos_mem_free(pMlmOemDataRsp);
+    pMlmOemDataRsp = NULL;
 
     mmhMsg.type = eWNI_SME_OEM_DATA_RSP;
     mmhMsg.bodyptr = pSirSmeOemDataRsp;
diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c
index 3f6ff1edefa1..bc749850c62f 100644
--- a/CORE/SERVICES/WMA/wma.c
+++ b/CORE/SERVICES/WMA/wma.c
@@ -5414,13 +5414,15 @@ static int wma_oem_capability_event_callback(void *handle,
 		return -EINVAL;
 	}
 
-	/* wma puts 4 bytes prefix for msg subtype, so length
+	/*
+	 * wma puts 4 bytes prefix for msg subtype, so length
 	 * of data received from target should be 4 bytes less
 	 * then max allowed
 	 */
-	if (datalen > (OEM_DATA_RSP_SIZE - 4)) {
+	if (datalen > (OEM_DATA_RSP_SIZE - OEM_MESSAGE_SUBTYPE_LEN)) {
 		WMA_LOGE("%s: Received data len (%d) exceeds max value (%d)",
-		         __func__, datalen, (OEM_DATA_RSP_SIZE - 4));
+		         __func__, datalen,
+			(OEM_DATA_RSP_SIZE - OEM_MESSAGE_SUBTYPE_LEN));
 		return -EINVAL;
 	}
 
@@ -5430,14 +5432,23 @@ static int wma_oem_capability_event_callback(void *handle,
 		return -ENOMEM;
 	}
 
-	vos_mem_zero(pStartOemDataRsp, sizeof(tStartOemDataRsp));
+	pStartOemDataRsp->rsp_len = datalen + OEM_MESSAGE_SUBTYPE_LEN;
+	pStartOemDataRsp->oem_data_rsp = vos_mem_malloc(datalen);
+	if (!pStartOemDataRsp->rsp_len) {
+		WMA_LOGE(FL("malloc failed for data"));
+		vos_mem_free(pStartOemDataRsp);
+		return -ENOMEM;
+	}
+
 	pStartOemDataRsp->target_rsp = true;
-	msg_subtype = (u_int32_t *)(&pStartOemDataRsp->oemDataRsp[0]);
+	msg_subtype = (uint32_t *) pStartOemDataRsp->oem_data_rsp;
 	*msg_subtype = WMI_OEM_CAPABILITY_RSP;
-	vos_mem_copy(&pStartOemDataRsp->oemDataRsp[4], data, datalen);
+	/* copy data after msg sub type */
+	vos_mem_copy(pStartOemDataRsp->oem_data_rsp + OEM_MESSAGE_SUBTYPE_LEN,
+		     data, datalen);
 
-	WMA_LOGI("%s: Sending WDA_START_OEM_DATA_RSP, data len (%d)",
-	         __func__, datalen);
+	WMA_LOGI(FL("Sending WDA_START_OEM_DATA_RSP, data len (%d)"),
+		 pStartOemDataRsp->rsp_len);
 
 	wma_send_msg(wma, WDA_START_OEM_DATA_RSP, (void *)pStartOemDataRsp, 0);
 	return 0;
@@ -5467,13 +5478,15 @@ static int wma_oem_measurement_report_event_callback(void *handle,
 		return -EINVAL;
 	}
 
-	/* wma puts 4 bytes prefix for msg subtype, so length
+	/*
+	 * wma puts 4 bytes prefix for msg subtype, so length
 	 * of data received from target should be 4 bytes less
 	 * then max allowed
 	 */
-	if (datalen > (OEM_DATA_RSP_SIZE - 4)) {
+	if (datalen > (OEM_DATA_RSP_SIZE - OEM_MESSAGE_SUBTYPE_LEN)) {
 		WMA_LOGE("%s: Received data len (%d) exceeds max value (%d)",
-		         __func__, datalen, (OEM_DATA_RSP_SIZE - 4));
+		         __func__, datalen,
+			(OEM_DATA_RSP_SIZE - OEM_MESSAGE_SUBTYPE_LEN));
 		return -EINVAL;
 	}
 
@@ -5483,14 +5496,23 @@ static int wma_oem_measurement_report_event_callback(void *handle,
 		return -ENOMEM;
 	}
 
-	vos_mem_zero(pStartOemDataRsp, sizeof(tStartOemDataRsp));
+	pStartOemDataRsp->rsp_len = datalen + OEM_MESSAGE_SUBTYPE_LEN;
+	pStartOemDataRsp->oem_data_rsp = vos_mem_malloc(datalen);
+	if (!pStartOemDataRsp->rsp_len) {
+		WMA_LOGE(FL("malloc failed for data"));
+		vos_mem_free(pStartOemDataRsp);
+		return -ENOMEM;
+	}
+
 	pStartOemDataRsp->target_rsp = true;
-	msg_subtype = (u_int32_t *)(&pStartOemDataRsp->oemDataRsp[0]);
+	msg_subtype = (uint32_t *) pStartOemDataRsp->oem_data_rsp;
 	*msg_subtype = WMI_OEM_MEASUREMENT_RSP;
-	vos_mem_copy(&pStartOemDataRsp->oemDataRsp[4], data, datalen);
+	/* copy data after msg sub type */
+	vos_mem_copy(pStartOemDataRsp->oem_data_rsp + OEM_MESSAGE_SUBTYPE_LEN,
+		     data, pStartOemDataRsp->rsp_len);
 
-	WMA_LOGI("%s: Sending WDA_START_OEM_DATA_RSP, data len (%d)",
-	         __func__, datalen);
+	WMA_LOGI(FL("Sending WDA_START_OEM_DATA_RSP, data len (%d)"),
+		 datalen);
 
 	wma_send_msg(wma, WDA_START_OEM_DATA_RSP, (void *)pStartOemDataRsp, 0);
 	return 0;
@@ -5520,13 +5542,15 @@ static int wma_oem_error_report_event_callback(void *handle,
 		return -EINVAL;
 	}
 
-	/* wma puts 4 bytes prefix for msg subtype, so length
+	/*
+	 * wma puts 4 bytes prefix for msg subtype, so length
 	 * of data received from target should be 4 bytes less
 	 * then max allowed
 	 */
-	if (datalen > (OEM_DATA_RSP_SIZE - 4)) {
+	if (datalen > (OEM_DATA_RSP_SIZE - OEM_MESSAGE_SUBTYPE_LEN)) {
 		WMA_LOGE("%s: Received data len (%d) exceeds max value (%d)",
-		         __func__, datalen, (OEM_DATA_RSP_SIZE - 4));
+		         __func__, datalen,
+			(OEM_DATA_RSP_SIZE - OEM_MESSAGE_SUBTYPE_LEN));
 		return -EINVAL;
 	}
 
@@ -5536,14 +5560,23 @@ static int wma_oem_error_report_event_callback(void *handle,
 		return -ENOMEM;
 	}
 
-	vos_mem_zero(pStartOemDataRsp, sizeof(tStartOemDataRsp));
+	pStartOemDataRsp->rsp_len = datalen + OEM_MESSAGE_SUBTYPE_LEN;
+	pStartOemDataRsp->oem_data_rsp = vos_mem_malloc(datalen);
+	if (!pStartOemDataRsp->rsp_len) {
+		WMA_LOGE(FL("malloc failed for data"));
+		vos_mem_free(pStartOemDataRsp);
+		return -ENOMEM;
+	}
+
 	pStartOemDataRsp->target_rsp = true;
-	msg_subtype = (u_int32_t *)(&pStartOemDataRsp->oemDataRsp[0]);
+	msg_subtype = (uint32_t *) pStartOemDataRsp->oem_data_rsp;
 	*msg_subtype = WMI_OEM_ERROR_REPORT_RSP;
-	vos_mem_copy(&pStartOemDataRsp->oemDataRsp[4], data, datalen);
+	/* copy data after msg sub type */
+	vos_mem_copy(pStartOemDataRsp->oem_data_rsp + OEM_MESSAGE_SUBTYPE_LEN,
+		     data, pStartOemDataRsp->rsp_len);
 
-	WMA_LOGI("%s: Sending WDA_START_OEM_DATA_RSP, data len (%d)",
-	         __func__, datalen);
+	WMA_LOGI(FL("Sending WDA_START_OEM_DATA_RSP, data len (%d)"),
+		 datalen);
 
 	wma_send_msg(wma, WDA_START_OEM_DATA_RSP, (void *)pStartOemDataRsp, 0);
 	return 0;
@@ -5565,7 +5598,7 @@ static int wma_oem_data_response_handler(void *handle,
 	WMI_OEM_RESPONSE_EVENTID_param_tlvs *param_buf;
 	uint8_t *data;
 	uint32_t datalen;
-	tStartOemDataRsp *oem_data_rsp;
+	tStartOemDataRsp *oem_rsp;
 
 	param_buf = (WMI_OEM_RESPONSE_EVENTID_param_tlvs *) datap;
 	if (!param_buf) {
@@ -5587,19 +5620,26 @@ static int wma_oem_data_response_handler(void *handle,
 		return -EINVAL;
 	}
 
-	oem_data_rsp = vos_mem_malloc(sizeof(*oem_data_rsp));
-	if (!oem_data_rsp) {
-		WMA_LOGE(FL("Failed to alloc oem_data_rsp"));
+	oem_rsp = vos_mem_malloc(sizeof(*oem_rsp));
+	if (!oem_rsp) {
+		WMA_LOGE(FL("Failed to alloc oem_rsp"));
+		return -ENOMEM;
+	}
+
+	oem_rsp->rsp_len = datalen;
+	oem_rsp->oem_data_rsp = vos_mem_malloc(datalen);
+	if (!oem_rsp->rsp_len) {
+		WMA_LOGE(FL("malloc failed for data"));
+		vos_mem_free(oem_rsp);
 		return -ENOMEM;
 	}
 
-	vos_mem_zero(oem_data_rsp, sizeof(tStartOemDataRsp));
-	oem_data_rsp->target_rsp = true;
-	vos_mem_copy(&oem_data_rsp->oemDataRsp[0], data, datalen);
+	oem_rsp->target_rsp = true;
+	vos_mem_copy(oem_rsp->oem_data_rsp, data, datalen);
 
 	WMA_LOGI(FL("Sending WMA_START_OEM_DATA_RSP, data len %d"), datalen);
 
-	wma_send_msg(wma, WDA_START_OEM_DATA_RSP, (void *)oem_data_rsp, 0);
+	wma_send_msg(wma, WDA_START_OEM_DATA_RSP, (void *)oem_rsp, 0);
 	return 0;
 }
 
diff --git a/CORE/SME/inc/oemDataApi.h b/CORE/SME/inc/oemDataApi.h
index d0cd6a9bdd6d..57c2cc41ad38 100644
--- a/CORE/SME/inc/oemDataApi.h
+++ b/CORE/SME/inc/oemDataApi.h
@@ -52,6 +52,7 @@
 
 /* message subtype for internal purpose */
 #define OEM_MESSAGE_SUBTYPE_INTERNAL   0xdeadbeef
+#define OEM_MESSAGE_SUBTYPE_LEN 4
 
 /*************************************************************************************************************
   OEM DATA REQ/RSP - DATA STRUCTURES
@@ -70,7 +71,8 @@ typedef struct tagOemDataReq
 *************************************************************************************************************/
 typedef struct tagOemDataRsp
 {
-    tANI_U8   oemDataRsp[OEM_DATA_RSP_SIZE];
+    uint32_t  rsp_len;
+    uint8_t   *oem_data_rsp;
 } tOemDataRsp;
 
 /*************************************************************************************************************/
diff --git a/CORE/SME/src/oemData/oemDataApi.c b/CORE/SME/src/oemData/oemDataApi.c
index ed3b327f3845..1f757e867d34 100644
--- a/CORE/SME/src/oemData/oemDataApi.c
+++ b/CORE/SME/src/oemData/oemDataApi.c
@@ -338,11 +338,12 @@ eHalStatus sme_HandleOemDataRsp(tHalHandle hHal, tANI_U8* pMsg)
         /* Send to upper layer only if rsp is from target */
         if (pOemDataRsp->target_rsp) {
             smsLog(pMac, LOG1, FL("received target oem data resp"));
-            send_oem_data_rsp_msg(sizeof(tOemDataRsp),
-                                  &pOemDataRsp->oemDataRsp[0]);
+            send_oem_data_rsp_msg(pOemDataRsp->rsp_len,
+                                  pOemDataRsp->oem_data_rsp);
         } else {
             smsLog(pMac, LOG1, FL("received internal oem data resp"));
         }
+        vos_mem_free(pOemDataRsp->oem_data_rsp);
     } while(0);
 
     return status;
diff --git a/CORE/WDA/inc/legacy/halMsgApi.h b/CORE/WDA/inc/legacy/halMsgApi.h
index 84b8412aabdf..b48b35a5bdaf 100644
--- a/CORE/WDA/inc/legacy/halMsgApi.h
+++ b/CORE/WDA/inc/legacy/halMsgApi.h
@@ -758,7 +758,8 @@ typedef struct
 typedef struct
 {
     bool                target_rsp;
-    tANI_U8             oemDataRsp[OEM_DATA_RSP_SIZE];
+    uint32_t            rsp_len;
+    uint8_t             *oem_data_rsp;
 } tStartOemDataRsp, *tpStartOemDataRsp;
 #endif