Fix for the crash in TDLS multipeer scenario
Check whether the station index assigned by the firmware to the
peer is valid before registering to TL as well as before issuing
DEL_STA for the same peer.
CRs-Fixed: 471969
Change-Id: I71df38f46c44e27bb5e4f615ac07ed4463c51201
diff --git a/CORE/HDD/inc/wlan_hdd_assoc.h b/CORE/HDD/inc/wlan_hdd_assoc.h
index c1d1b6d..9136810 100644
--- a/CORE/HDD/inc/wlan_hdd_assoc.h
+++ b/CORE/HDD/inc/wlan_hdd_assoc.h
@@ -45,6 +45,8 @@
#define HDD_MAX_NUM_IBSS_STA ( 9 )
#ifdef FEATURE_WLAN_TDLS
#define HDD_MAX_NUM_TDLS_STA ( HDD_MAX_NUM_IBSS_STA - 1 ) // up to 3 as 1 is assigned to AP
+#define TDLS_STA_INDEX_VALID(staId) \
+ (((staId) >= 4) && ((staId) < 0xFF))
#endif
#define TKIP_COUNTER_MEASURE_STARTED 1
#define TKIP_COUNTER_MEASURE_STOPED 0
diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c
index 8dbcdd4..3f6a25b 100644
--- a/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -7223,6 +7223,14 @@
return -EINVAL;
}
+ if (!TDLS_STA_INDEX_VALID(pTdlsPeer->staId))
+ {
+ hddLog(VOS_TRACE_LEVEL_ERROR, "%s: Invalid Staion Index %u "
+ MAC_ADDRESS_STR " failed",
+ __func__, pTdlsPeer->staId, MAC_ADDR_ARRAY(peer));
+ return -EINVAL;
+ }
+
if (eTDLS_LINK_CONNECTING == pTdlsPeer->link_status)
{
wlan_hdd_tdls_set_peer_link_status(pTdlsPeer, eTDLS_LINK_CONNECTED);
@@ -7253,7 +7261,7 @@
{
hddTdlsPeer_t *curr_peer = wlan_hdd_tdls_find_peer(pAdapter, peer);
- if(NULL != curr_peer)
+ if((NULL != curr_peer) && TDLS_STA_INDEX_VALID(curr_peer->staId))
{
long status;