summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--core/sme/src/common/sme_api.c132
1 files changed, 124 insertions, 8 deletions
diff --git a/core/sme/src/common/sme_api.c b/core/sme/src/common/sme_api.c
index 67b329e1930b..741ae26eb185 100644
--- a/core/sme/src/common/sme_api.c
+++ b/core/sme/src/common/sme_api.c
@@ -2294,14 +2294,22 @@ QDF_STATUS sme_set_ese_roam_scan_channel_list(tHalHandle hHal,
{
tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
QDF_STATUS status = QDF_STATUS_SUCCESS;
- tpCsrNeighborRoamControlInfo pNeighborRoamInfo
- = &pMac->roam.neighborRoamInfo[sessionId];
- tpCsrChannelInfo curchnl_list_info
- = &pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo;
+ tpCsrNeighborRoamControlInfo pNeighborRoamInfo = NULL;
+ tpCsrChannelInfo curchnl_list_info = NULL;
uint8_t oldChannelList[WNI_CFG_VALID_CHANNEL_LIST_LEN * 2] = { 0 };
uint8_t newChannelList[128] = { 0 };
uint8_t i = 0, j = 0;
+ if (sessionId >= CSR_ROAM_SESSION_MAX) {
+ QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,
+ FL("Invalid sme session id: %d"), sessionId);
+ return QDF_STATUS_E_INVAL;
+ }
+
+ pNeighborRoamInfo = &pMac->roam.neighborRoamInfo[sessionId];
+ curchnl_list_info =
+ &pNeighborRoamInfo->roamChannelInfo.currentChannelListInfo;
+
status = sme_acquire_global_lock(&pMac->sme);
if (!QDF_IS_STATUS_SUCCESS(status)) {
if (pMac->roam.configParam.isRoamOffloadScanEnabled)
@@ -8754,6 +8762,12 @@ QDF_STATUS sme_update_roam_rssi_diff(tHalHandle hHal, uint8_t sessionId,
tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
QDF_STATUS status = QDF_STATUS_SUCCESS;
+ if (sessionId >= CSR_ROAM_SESSION_MAX) {
+ QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,
+ FL("Invalid sme session id: %d"), sessionId);
+ return QDF_STATUS_E_INVAL;
+ }
+
status = sme_acquire_global_lock(&pMac->sme);
if (QDF_IS_STATUS_SUCCESS(status)) {
QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_DEBUG,
@@ -8767,6 +8781,7 @@ QDF_STATUS sme_update_roam_rssi_diff(tHalHandle hHal, uint8_t sessionId,
pMac->roam.configParam.RoamRssiDiff = RoamRssiDiff;
sme_release_global_lock(&pMac->sme);
}
+
if (pMac->roam.configParam.isRoamOffloadScanEnabled) {
csr_roam_offload_scan(pMac, sessionId,
ROAM_SCAN_OFFLOAD_UPDATE_CFG,
@@ -8829,6 +8844,12 @@ QDF_STATUS sme_update_wes_mode(tHalHandle hHal, bool isWESModeEnabled,
tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
QDF_STATUS status = QDF_STATUS_SUCCESS;
+ if (sessionId >= CSR_ROAM_SESSION_MAX) {
+ QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,
+ FL("Invalid sme session id: %d"), sessionId);
+ return QDF_STATUS_E_INVAL;
+ }
+
status = sme_acquire_global_lock(&pMac->sme);
if (QDF_IS_STATUS_SUCCESS(status)) {
QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_DEBUG,
@@ -8865,6 +8886,13 @@ QDF_STATUS sme_set_roam_scan_control(tHalHandle hHal, uint8_t sessionId,
MTRACE(qdf_trace(QDF_MODULE_ID_SME,
TRACE_CODE_SME_RX_HDD_SET_SCANCTRL, NO_SESSION, 0));
+
+ if (sessionId >= CSR_ROAM_SESSION_MAX) {
+ QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,
+ FL("Invalid sme session id: %d"), sessionId);
+ return QDF_STATUS_E_INVAL;
+ }
+
status = sme_acquire_global_lock(&pMac->sme);
if (QDF_IS_STATUS_SUCCESS(status)) {
QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_DEBUG,
@@ -9391,6 +9419,13 @@ QDF_STATUS sme_set_delay_before_vdev_stop(tHalHandle hal,
{
tpAniSirGlobal pMac = PMAC_STRUCT(hal);
QDF_STATUS status = QDF_STATUS_SUCCESS;
+
+ if (session_id >= CSR_ROAM_SESSION_MAX) {
+ QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,
+ FL("Invalid sme session id: %d"), session_id);
+ return QDF_STATUS_E_INVAL;
+ }
+
status = sme_acquire_global_lock(&pMac->sme);
if (QDF_IS_STATUS_SUCCESS(status)) {
QDF_TRACE(QDF_MODULE_ID_SME,
@@ -9442,6 +9477,12 @@ QDF_STATUS sme_set_neighbor_scan_refresh_period
tCsrNeighborRoamConfig *pNeighborRoamConfig = NULL;
tpCsrNeighborRoamControlInfo pNeighborRoamInfo = NULL;
+ if (sessionId >= CSR_ROAM_SESSION_MAX) {
+ QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,
+ FL("Invalid sme session id: %d"), sessionId);
+ return QDF_STATUS_E_INVAL;
+ }
+
status = sme_acquire_global_lock(&pMac->sme);
if (QDF_IS_STATUS_SUCCESS(status)) {
pNeighborRoamConfig =
@@ -9555,6 +9596,12 @@ QDF_STATUS sme_update_empty_scan_refresh_period(tHalHandle hHal, uint8_t session
tCsrNeighborRoamConfig *pNeighborRoamConfig = NULL;
tpCsrNeighborRoamControlInfo pNeighborRoamInfo = NULL;
+ if (sessionId >= CSR_ROAM_SESSION_MAX) {
+ QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,
+ FL("Invalid sme session id: %d"), sessionId);
+ return QDF_STATUS_E_INVAL;
+ }
+
status = sme_acquire_global_lock(&pMac->sme);
if (QDF_IS_STATUS_SUCCESS(status)) {
pNeighborRoamConfig =
@@ -9603,6 +9650,12 @@ QDF_STATUS sme_set_neighbor_scan_min_chan_time(tHalHandle hHal,
tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
QDF_STATUS status = QDF_STATUS_SUCCESS;
+ if (sessionId >= CSR_ROAM_SESSION_MAX) {
+ QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,
+ FL("Invalid sme session id: %d"), sessionId);
+ return QDF_STATUS_E_INVAL;
+ }
+
status = sme_acquire_global_lock(&pMac->sme);
if (QDF_IS_STATUS_SUCCESS(status)) {
QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_DEBUG,
@@ -9646,6 +9699,12 @@ QDF_STATUS sme_set_neighbor_scan_max_chan_time(tHalHandle hHal, uint8_t sessionI
tCsrNeighborRoamConfig *pNeighborRoamConfig = NULL;
tpCsrNeighborRoamControlInfo pNeighborRoamInfo = NULL;
+ if (sessionId >= CSR_ROAM_SESSION_MAX) {
+ QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,
+ FL("Invalid sme session id: %d"), sessionId);
+ return QDF_STATUS_E_INVAL;
+ }
+
status = sme_acquire_global_lock(&pMac->sme);
if (QDF_IS_STATUS_SUCCESS(status)) {
pNeighborRoamConfig =
@@ -9685,6 +9744,13 @@ QDF_STATUS sme_set_neighbor_scan_max_chan_time(tHalHandle hHal, uint8_t sessionI
uint16_t sme_get_neighbor_scan_min_chan_time(tHalHandle hHal, uint8_t sessionId)
{
tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
+
+ if (sessionId >= CSR_ROAM_SESSION_MAX) {
+ QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,
+ FL("Invalid sme session id: %d"), sessionId);
+ return 0;
+ }
+
return pMac->roam.neighborRoamInfo[sessionId].cfgParams.
minChannelScanTime;
}
@@ -9699,6 +9765,13 @@ uint16_t sme_get_neighbor_scan_min_chan_time(tHalHandle hHal, uint8_t sessionId)
uint32_t sme_get_neighbor_roam_state(tHalHandle hHal, uint8_t sessionId)
{
tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
+
+ if (sessionId >= CSR_ROAM_SESSION_MAX) {
+ QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,
+ FL("Invalid sme session id: %d"), sessionId);
+ return 0;
+ }
+
return pMac->roam.neighborRoamInfo[sessionId].neighborRoamState;
}
@@ -9805,6 +9878,13 @@ uint32_t sme_get_lim_mlm_session_state(tHalHandle hHal, uint8_t sessionId)
uint16_t sme_get_neighbor_scan_max_chan_time(tHalHandle hHal, uint8_t sessionId)
{
tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
+
+ if (sessionId >= CSR_ROAM_SESSION_MAX) {
+ QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,
+ FL("Invalid sme session id: %d"), sessionId);
+ return 0;
+ }
+
return pMac->roam.neighborRoamInfo[sessionId].cfgParams.
maxChannelScanTime;
}
@@ -9829,6 +9909,12 @@ QDF_STATUS sme_set_neighbor_scan_period(tHalHandle hHal, uint8_t sessionId,
tCsrNeighborRoamConfig *pNeighborRoamConfig = NULL;
tpCsrNeighborRoamControlInfo pNeighborRoamInfo = NULL;
+ if (sessionId >= CSR_ROAM_SESSION_MAX) {
+ QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,
+ FL("Invalid sme session id: %d"), sessionId);
+ return QDF_STATUS_E_INVAL;
+ }
+
status = sme_acquire_global_lock(&pMac->sme);
if (QDF_IS_STATUS_SUCCESS(status)) {
pNeighborRoamConfig =
@@ -9869,6 +9955,13 @@ QDF_STATUS sme_set_neighbor_scan_period(tHalHandle hHal, uint8_t sessionId,
uint16_t sme_get_neighbor_scan_period(tHalHandle hHal, uint8_t sessionId)
{
tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
+
+ if (sessionId >= CSR_ROAM_SESSION_MAX) {
+ QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,
+ FL("Invalid sme session id: %d"), sessionId);
+ return 0;
+ }
+
return pMac->roam.neighborRoamInfo[sessionId].cfgParams.
neighborScanPeriod;
}
@@ -9906,14 +9999,19 @@ QDF_STATUS sme_change_roam_scan_channel_list(tHalHandle hHal, uint8_t sessionId,
{
tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
QDF_STATUS status = QDF_STATUS_SUCCESS;
- tpCsrNeighborRoamControlInfo pNeighborRoamInfo =
- &pMac->roam.neighborRoamInfo[sessionId];
+ tpCsrNeighborRoamControlInfo pNeighborRoamInfo = NULL;
uint8_t oldChannelList[WNI_CFG_VALID_CHANNEL_LIST_LEN * 2] = { 0 };
uint8_t newChannelList[WNI_CFG_VALID_CHANNEL_LIST_LEN * 2] = { 0 };
uint8_t i = 0, j = 0;
tCsrChannelInfo *chan_info;
+ if (sessionId >= CSR_ROAM_SESSION_MAX) {
+ QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,
+ FL("Invalid sme session id: %d"), sessionId);
+ return QDF_STATUS_E_INVAL;
+ }
+ pNeighborRoamInfo = &pMac->roam.neighborRoamInfo[sessionId];
status = sme_acquire_global_lock(&pMac->sme);
if (!QDF_IS_STATUS_SUCCESS(status)) {
if (pMac->roam.configParam.isRoamOffloadScanEnabled)
@@ -9982,10 +10080,16 @@ QDF_STATUS sme_get_roam_scan_channel_list(tHalHandle hHal,
int i = 0;
uint8_t *pOutPtr = pChannelList;
tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
- tpCsrNeighborRoamControlInfo pNeighborRoamInfo =
- &pMac->roam.neighborRoamInfo[sessionId];
+ tpCsrNeighborRoamControlInfo pNeighborRoamInfo = NULL;
QDF_STATUS status = QDF_STATUS_SUCCESS;
+ if (sessionId >= CSR_ROAM_SESSION_MAX) {
+ QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,
+ FL("Invalid sme session id: %d"), sessionId);
+ return QDF_STATUS_E_INVAL;
+ }
+
+ pNeighborRoamInfo = &pMac->roam.neighborRoamInfo[sessionId];
status = sme_acquire_global_lock(&pMac->sme);
if (!QDF_IS_STATUS_SUCCESS(status))
return status;
@@ -13095,6 +13199,12 @@ QDF_STATUS sme_update_dfs_scan_mode(tHalHandle hHal, uint8_t sessionId,
tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
QDF_STATUS status = QDF_STATUS_SUCCESS;
+ if (sessionId >= CSR_ROAM_SESSION_MAX) {
+ QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,
+ FL("Invalid sme session id: %d"), sessionId);
+ return QDF_STATUS_E_INVAL;
+ }
+
status = sme_acquire_global_lock(&pMac->sme);
if (QDF_IS_STATUS_SUCCESS(status)) {
QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_DEBUG,
@@ -15673,6 +15783,12 @@ QDF_STATUS sme_update_roam_scan_hi_rssi_scan_params(tHalHandle hal_handle,
tpCsrNeighborRoamControlInfo nr_info = NULL;
uint32_t reason = 0;
+ if (session_id >= CSR_ROAM_SESSION_MAX) {
+ QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,
+ FL("Invalid sme session id: %d"), session_id);
+ return QDF_STATUS_E_INVAL;
+ }
+
status = sme_acquire_global_lock(&mac_ctx->sme);
if (QDF_IS_STATUS_SUCCESS(status)) {
nr_config = &mac_ctx->roam.configParam.neighborRoamConfig;
generated by cgit v1.2.3 (git 2.25.1) at 2026-08-04 03:57:04 +0000