Merge "wlan: Decrement pending mgmt packet count properly."
diff --git a/CORE/HDD/inc/wlan_hdd_main.h b/CORE/HDD/inc/wlan_hdd_main.h
index 069aea9..c61cb08 100644
--- a/CORE/HDD/inc/wlan_hdd_main.h
+++ b/CORE/HDD/inc/wlan_hdd_main.h
@@ -209,7 +209,7 @@
 #define HDD_PNO_SCAN_TIMERS_SET_ONE      1
 /* value should not be greater than PNO_MAX_SCAN_TIMERS */
 #define HDD_PNO_SCAN_TIMERS_SET_MULTIPLE 6
-#define WLAN_WAIT_TIME_PNO  500
+#define WLAN_WAIT_TIME_PNO  2000
 #endif
 
 #define MAX_USER_COMMAND_SIZE 4096
diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c
index f139439..df7cc45 100644
--- a/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -13592,7 +13592,8 @@
     vos_mem_zero(pnoRequest.p24GProbeTemplate, SIR_PNO_MAX_PB_REQ_SIZE);
     vos_mem_zero(pnoRequest.p5GProbeTemplate, SIR_PNO_MAX_PB_REQ_SIZE);
 
-    if ((0 < request->ie_len) && (NULL != request->ie))
+    if ((0 < request->ie_len) && (request->ie_len <= SIR_PNO_MAX_PB_REQ_SIZE) &&
+        (NULL != request->ie))
     {
         pnoRequest.us24GProbeTemplateLen = request->ie_len;
         memcpy(pnoRequest.p24GProbeTemplate, request->ie,
@@ -13667,7 +13668,6 @@
         VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                   FL("Timed out waiting for PNO to be Enabled"));
         ret = 0;
-        goto error;
     }
 
     ret = pAdapter->pno_req_status;
diff --git a/CORE/SME/src/pmc/pmcApi.c b/CORE/SME/src/pmc/pmcApi.c
index b933999..4c493ce 100644
--- a/CORE/SME/src/pmc/pmcApi.c
+++ b/CORE/SME/src/pmc/pmcApi.c
@@ -2945,6 +2945,8 @@
     tCsrRoamSession *pSession = CSR_GET_SESSION( pMac, sessionId );
     tANI_U8 ucDot11Mode;
     tSmeCmd *pCommand;
+    tANI_U8 *tmp = NULL;
+    tANI_U16 len = 0;
 
     if (NULL == pSession)
     {
@@ -2974,6 +2976,29 @@
         ucDot11Mode = (tANI_U8) csrTranslateToWNICfgDot11Mode(pMac,
                                        csrFindBestPhyMode( pMac, pMac->roam.configParam.phyMode ));
 
+        if (pRequestBuf->us24GProbeTemplateLen ||
+                 pRequestBuf->us5GProbeTemplateLen)
+        {
+            tmp = vos_mem_malloc(SIR_PNO_MAX_PB_REQ_SIZE);
+            if (tmp == NULL)
+            {
+                VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_ERROR,
+                    FL("failed to allocate memory"));
+            }
+            /* Continue even mem alloc fails as driver can still go ahead
+             * without supplicant IE's in probe req.
+             */
+        }
+
+        if (NULL != tmp)
+        {
+            len = pRequestBuf->us24GProbeTemplateLen;
+            if (0 != len && len <= SIR_PNO_MAX_PB_REQ_SIZE)
+            {
+                vos_mem_copy(tmp, pRequestBuf->p24GProbeTemplate, len);
+            }
+        }
+
         /*Prepare a probe request for 2.4GHz band and one for 5GHz band*/
         if (eSIR_SUCCESS == pmcPrepareProbeReqTemplate(pMac, SIR_PNO_24G_DEFAULT_CH,
                                   ucDot11Mode, pSession->selfMacAddr,
@@ -2981,25 +3006,33 @@
                                   &pRequestBuf->us24GProbeTemplateLen))
         {
             /* Append IE passed by supplicant(if any) to probe request */
-            if ((0 < pRequest->us24GProbeTemplateLen) &&
-                ((pRequestBuf->us24GProbeTemplateLen +
-                pRequest->us24GProbeTemplateLen) < SIR_PNO_MAX_PB_REQ_SIZE ))
+            if ((0 < len) &&((pRequestBuf->us24GProbeTemplateLen + len)
+                              < SIR_PNO_MAX_PB_REQ_SIZE ))
             {
                 vos_mem_copy((tANI_U8 *)&pRequestBuf->p24GProbeTemplate +
                               pRequestBuf->us24GProbeTemplateLen,
-                              pRequest->p24GProbeTemplate,
-                              pRequest->us24GProbeTemplateLen);
-                pRequestBuf->us24GProbeTemplateLen +=
-                                             pRequest->us24GProbeTemplateLen;
+                              tmp,
+                              len);
+                pRequestBuf->us24GProbeTemplateLen += len;
                 VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
-                       "%s: pRequest->us24GProbeTemplateLen = %d", __func__,
-                        pRequest->us24GProbeTemplateLen);
+                     "%s: us24GProbeTemplateLen = %d", __func__,
+                      pRequestBuf->us24GProbeTemplateLen);
             }
             else
             {
                 VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
                    "%s: Extra ie discarded on 2.4G, IE length = %d Max IE length is %d",
-                   __func__, pRequest->us24GProbeTemplateLen, SIR_PNO_MAX_PB_REQ_SIZE);
+                   __func__, pRequestBuf->us24GProbeTemplateLen, SIR_PNO_MAX_PB_REQ_SIZE);
+            }
+        }
+
+        len = 0;
+        if (NULL != tmp)
+        {
+            len = pRequestBuf->us5GProbeTemplateLen;
+            if (0 != len && len <= SIR_PNO_MAX_PB_REQ_SIZE)
+            {
+                vos_mem_copy(tmp, pRequestBuf->p5GProbeTemplate, len);
             }
         }
 
@@ -3009,26 +3042,27 @@
                                    &pRequestBuf->us5GProbeTemplateLen))
         {
             /* Append IE passed by supplicant(if any) to probe request */
-            if ((0 < pRequest->us5GProbeTemplateLen ) &&
-                ((pRequestBuf->us5GProbeTemplateLen +
-                pRequest->us5GProbeTemplateLen) < SIR_PNO_MAX_PB_REQ_SIZE ))
+            if ((0 < len) &&((pRequestBuf->us5GProbeTemplateLen + len)
+                              < SIR_PNO_MAX_PB_REQ_SIZE))
             {
                 vos_mem_copy((tANI_U8 *)&pRequestBuf->p5GProbeTemplate +
                           pRequestBuf->us5GProbeTemplateLen,
-                          pRequest->p5GProbeTemplate,
-                          pRequest->us5GProbeTemplateLen);
-                pRequestBuf->us5GProbeTemplateLen += pRequest->us5GProbeTemplateLen;
+                          tmp,
+                          len);
+                pRequestBuf->us5GProbeTemplateLen += len;
                 VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
-                    "%s: pRequestBuf->us5GProbeTemplateLen = %d", __func__,
-                     pRequest->us5GProbeTemplateLen);
+                    "%s: us5GProbeTemplateLen = %d", __func__,
+                     pRequestBuf->us5GProbeTemplateLen);
             }
             else
             {
                 VOS_TRACE(VOS_MODULE_ID_SME, VOS_TRACE_LEVEL_INFO,
                        "%s: Extra IE discarded on 5G, IE length = %d Max IE length is %d",
-                        __func__, pRequest->us5GProbeTemplateLen, SIR_PNO_MAX_PB_REQ_SIZE);
+                        __func__, pRequestBuf->us5GProbeTemplateLen, SIR_PNO_MAX_PB_REQ_SIZE);
             }
         }
+        if (NULL != tmp)
+            vos_mem_free(tmp);
     }
     pCommand->command = eSmeCommandPnoReq;
     pCommand->sessionId = (tANI_U8)sessionId;
diff --git a/CORE/SME/src/sme_common/sme_Api.c b/CORE/SME/src/sme_common/sme_Api.c
index a00e3fa..f28cc48 100644
--- a/CORE/SME/src/sme_common/sme_Api.c
+++ b/CORE/SME/src/sme_common/sme_Api.c
@@ -1028,6 +1028,9 @@
                                 smsLog(pMac, LOGE,
                                   FL("failed to post SME PNO SCAN %d"), status);
                             }
+                            //We need to re-run the command
+                            fContinue = eANI_BOOLEAN_TRUE;
+
                             if (csrLLRemoveEntry(&pMac->sme.smeCmdActiveList,
                                               &pCommand->Link, LL_ACCESS_LOCK))
                             {
diff --git a/CORE/WDA/src/wlan_qct_wda.c b/CORE/WDA/src/wlan_qct_wda.c
index 2ae99bd..6da3677 100644
--- a/CORE/WDA/src/wlan_qct_wda.c
+++ b/CORE/WDA/src/wlan_qct_wda.c
@@ -14928,6 +14928,15 @@
                                            VOS_STATUS_E_FAILURE);
       }
 
+      if (pPNOScanReqParams->enable == 1)
+      {
+          if (pPNOScanReqParams->aNetworks)
+              vos_mem_free(pPNOScanReqParams->aNetworks);
+          if (pPNOScanReqParams->p24GProbeTemplate)
+              vos_mem_free(pPNOScanReqParams->p24GProbeTemplate);
+          if (pPNOScanReqParams->p5GProbeTemplate)
+              vos_mem_free(pPNOScanReqParams->p5GProbeTemplate);
+      }
       vos_mem_free(pWdaParams->wdaWdiApiMsgParam);
       vos_mem_free(pWdaParams->wdaMsgParam);
       vos_mem_free(pWdaParams);