data path KW fixes

data path KW fixes.

Change-Id: I4b9ded51d06f08493fc723580b6862eaa0bfdb58
CRs-Fixed: 625039

4 files changed, 34 insertions, 19 deletions

diff --git a/CORE/CLD_TXRX/HTT/htt_rx.c b/CORE/CLD_TXRX/HTT/htt_rx.c
index 3bbd9301c676..f284b8c68a22 100644
--- a/CORE/CLD_TXRX/HTT/htt_rx.c
+++ b/CORE/CLD_TXRX/HTT/htt_rx.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2014 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -1237,6 +1237,9 @@ htt_rx_restitch_mpdu_from_msdus(
 
     prev_buf = mpdu_buf;
     dest = adf_nbuf_put_tail(prev_buf, wifi_hdr_len);
+    if (!dest) {
+        goto mpdu_stitch_fail;
+    }
     adf_os_mem_copy(dest, hdr_desc, wifi_hdr_len);
     hdr_desc += wifi_hdr_len;
 
diff --git a/CORE/CLD_TXRX/TLSHIM/tl_shim.c b/CORE/CLD_TXRX/TLSHIM/tl_shim.c
index d023e49ffacf..e147ca75d02b 100644
--- a/CORE/CLD_TXRX/TLSHIM/tl_shim.c
+++ b/CORE/CLD_TXRX/TLSHIM/tl_shim.c
@@ -1670,6 +1670,11 @@ void *tl_shim_get_vdev_by_addr(void *vos_context, uint8_t *mac_addr)
 	}
 
 	pdev = vos_get_context(VOS_MODULE_ID_TXRX, vos_context);
+	if (!pdev) {
+		TLSHIM_LOGE("PDEV [%pM] not found", mac_addr);
+		return NULL;
+	}
+
 	peer = ol_txrx_find_peer_by_addr(pdev, mac_addr, &peer_id);
 
 	if (!peer) {
@@ -1694,6 +1699,10 @@ void *tl_shim_get_vdev_by_sta_id(void *vos_context, uint8_t sta_id)
 	}
 
 	pdev = vos_get_context(VOS_MODULE_ID_TXRX, vos_context);
+	if (!pdev) {
+                TLSHIM_LOGE("PDEV not found for sta_id [%d]", sta_id);
+		return NULL;
+	}
 
 	peer = ol_txrx_peer_find_by_local_id(pdev, sta_id);
 
diff --git a/CORE/CLD_TXRX/TXRX/ol_tx.c b/CORE/CLD_TXRX/TXRX/ol_tx.c
index 2dc7dc6a4fe4..633287f74e40 100644
--- a/CORE/CLD_TXRX/TXRX/ol_tx.c
+++ b/CORE/CLD_TXRX/TXRX/ol_tx.c
@@ -145,23 +145,25 @@ ol_tx_vdev_ll_pause_queue_send_base(struct ol_txrx_vdev_t *vdev)
         max_to_accept--;
         vdev->ll_pause.txq.depth--;
         tx_msdu = vdev->ll_pause.txq.head;
-        vdev->ll_pause.txq.head = adf_nbuf_next(tx_msdu);
-        if (NULL == vdev->ll_pause.txq.head) {
-            vdev->ll_pause.txq.tail = NULL;
-        }
-        adf_nbuf_set_next(tx_msdu, NULL);
-        tx_msdu = ol_tx_ll(vdev, tx_msdu);
-        /*
-         * It is unexpected that ol_tx_ll would reject the frame,
-         * since we checked that there's room for it, though there's
-         * an infinitesimal possibility that between the time we checked
-         * the room available and now, a concurrent batch of tx frames
-         * used up all the room.
-         * For simplicity, just drop the frame.
-         */
         if (tx_msdu) {
-            adf_nbuf_unmap(vdev->pdev->osdev, tx_msdu, ADF_OS_DMA_TO_DEVICE);
-            adf_nbuf_tx_free(tx_msdu, 1 /* error */);
+            vdev->ll_pause.txq.head = adf_nbuf_next(tx_msdu);
+            if (NULL == vdev->ll_pause.txq.head) {
+                vdev->ll_pause.txq.tail = NULL;
+            }
+            adf_nbuf_set_next(tx_msdu, NULL);
+            tx_msdu = ol_tx_ll(vdev, tx_msdu);
+            /*
+             * It is unexpected that ol_tx_ll would reject the frame,
+             * since we checked that there's room for it, though there's
+             * an infinitesimal possibility that between the time we checked
+             * the room available and now, a concurrent batch of tx frames
+             * used up all the room.
+             * For simplicity, just drop the frame.
+             */
+            if (tx_msdu) {
+                adf_nbuf_unmap(vdev->pdev->osdev, tx_msdu, ADF_OS_DMA_TO_DEVICE);
+                adf_nbuf_tx_free(tx_msdu, 1 /* error */);
+            }
         }
     }
     if (vdev->ll_pause.txq.depth) {
diff --git a/CORE/CLD_TXRX/TXRX/ol_txrx.c b/CORE/CLD_TXRX/TXRX/ol_txrx.c
index d0b3b2f63a69..23f9cb21e76a 100644
--- a/CORE/CLD_TXRX/TXRX/ol_txrx.c
+++ b/CORE/CLD_TXRX/TXRX/ol_txrx.c
@@ -211,7 +211,8 @@ OL_TXRX_LOCAL_PEER_ID_FREE(
     struct ol_txrx_peer_t *peer)
 {
     int i = peer->local_id;
-    if (i == OL_TXRX_INVALID_LOCAL_PEER_ID) {
+    if ((i == OL_TXRX_INVALID_LOCAL_PEER_ID) ||
+        (i >= OL_TXRX_NUM_LOCAL_PEER_IDS)) {
         return;
     }
     /* put this ID on the head of the freelist */
@@ -1288,7 +1289,7 @@ ol_txrx_peer_uapsdmask_get(struct ol_txrx_pdev_t *txrx_pdev, u_int16_t peer_id)
 
     struct ol_txrx_peer_t *peer;
     peer = ol_txrx_peer_find_by_id(txrx_pdev, peer_id);
-    if (!peer) {
+    if (peer) {
         return peer->uapsd_mask;
     }