Wlan: Don't set token list head to NULL while searching ADD BA token
If back to back two or more ADD BA requests are sent, for different
TID or STA, the token list contains tokens for all the requests
sent.
Now when an ADD BA resp is received for any of the above ADD BA
request, the query to search and delete the token also sets the
head of the list to NULL and thus all other tokens are lost.
So only the first ADD BA resp is handled and all other responses
related to the lost tokens are dropped.
To fix this properly handle the search and delete token query
Change-Id: Icdb06e8890003ee50faaa0c766a89e2520c9184e
CRs-Fixed: 968312
diff --git a/CORE/MAC/src/pe/lim/limProcessActionFrame.c b/CORE/MAC/src/pe/lim/limProcessActionFrame.c
index 80c8616..3908f8b 100644
--- a/CORE/MAC/src/pe/lim/limProcessActionFrame.c
+++ b/CORE/MAC/src/pe/lim/limProcessActionFrame.c
@@ -1529,7 +1529,8 @@
if(eSIR_SUCCESS != limSearchAndDeleteDialogueToken(pMac, frmAddBARsp.DialogToken.token,
pSta->assocId, frmAddBARsp.AddBAParameterSet.tid))
{
- PELOGW(limLog(pMac, LOGE, FL("dialogueToken in received addBARsp did not match with outstanding requests"));)
+ limLog(pMac, LOGE,
+ FL("dialogueToken in received addBARsp did not match with outstanding requests"));
return;
}
diff --git a/CORE/MAC/src/pe/lim/limUtils.c b/CORE/MAC/src/pe/lim/limUtils.c
index c13a2c5..e27ebea 100644
--- a/CORE/MAC/src/pe/lim/limUtils.c
+++ b/CORE/MAC/src/pe/lim/limUtils.c
@@ -164,53 +164,52 @@
tpDialogueToken pCurrNode = pMac->lim.pDialogueTokenHead;
tpDialogueToken pPrevNode = pMac->lim.pDialogueTokenHead;
- //if the list is empty
+ /* if the list is empty */
if(NULL == pCurrNode)
return eSIR_FAILURE;
- // if the matching node is the first node.
- if(pCurrNode &&
+ /* If the matching node is the first node.*/
+ if ((token == pCurrNode->token) &&
(assocId == pCurrNode->assocId) &&
- (tid == pCurrNode->tid))
- {
- pMac->lim.pDialogueTokenHead = pCurrNode->next;
- //there was only one node in the list. So tail pointer also needs to be adjusted.
- if(NULL == pMac->lim.pDialogueTokenHead)
+ (tid == pCurrNode->tid)) {
+ pMac->lim.pDialogueTokenHead = pCurrNode->next;
+ /* There was only one node in the list.
+ * So tail pointer also needs to be adjusted.
+ */
+ if (NULL == pMac->lim.pDialogueTokenHead)
pMac->lim.pDialogueTokenTail = NULL;
vos_mem_free(pCurrNode);
- pMac->lim.pDialogueTokenHead = NULL;
return eSIR_SUCCESS;
}
- //first node did not match. so move to the next one.
+ /* first node did not match. so move to the next one. */
pCurrNode = pCurrNode->next;
- while(NULL != pCurrNode )
- {
- if(token == pCurrNode->token)
- {
- break;
- }
+ while (NULL != pCurrNode) {
+ if ((token == pCurrNode->token) &&
+ (assocId == pCurrNode->assocId) &&
+ (tid == pCurrNode->tid)) {
+ break;
+ }
pPrevNode = pCurrNode;
pCurrNode = pCurrNode->next;
}
- if(pCurrNode &&
- (assocId == pCurrNode->assocId) &&
- (tid == pCurrNode->tid))
- {
+ if (pCurrNode) {
pPrevNode->next = pCurrNode->next;
- //if the node being deleted is the last one then we also need to move the tail pointer to the prevNode.
+ /* if the node being deleted is the last one
+ * then we also need to move the tail pointer
+ * to the prevNode.
+ */
if(NULL == pCurrNode->next)
pMac->lim.pDialogueTokenTail = pPrevNode;
vos_mem_free(pCurrNode);
- pMac->lim.pDialogueTokenHead = NULL;
return eSIR_SUCCESS;
}
- PELOGW(limLog(pMac, LOGW, FL("LIM does not have matching dialogue token node"));)
+ limLog(pMac, LOGW,
+ FL("LIM does not have matching dialogue token node"));
return eSIR_FAILURE;
-
}