commit a24dff8844f883639b12b6ae19a09745ea96024a
author CNSS_WLAN Service <cnssbldsw@qualcomm.com> Tue Jun 26 09:18:24 2018 -0700
committer Gerrit - the friendly Code Review server <code-review@localhost> Tue Jun 26 09:18:24 2018 -0700
tree 4339b2706f32d7ea30abbfa339e8f096572dd36d
parent 56c29818bed3e5293a47237c373322a221d61c45
parent 5bd68a4fb7c8e9d005d1cc774ef0ebda0693260a

Merge "wlan: fix the beacon corruption in WDA beacon update msg" into wlan-driver.lnx.1.0

CORE/MAC/src/pe/sch/schApi.c

diff --git a/CORE/MAC/src/pe/sch/schApi.c b/CORE/MAC/src/pe/sch/schApi.c
index a19ff22..45d14f1 100644
--- a/CORE/MAC/src/pe/sch/schApi.c
+++ b/CORE/MAC/src/pe/sch/schApi.c
@@ -315,7 +315,15 @@
   schLog(pMac, LOGE,FL("TimIeOffset:[%d]"),beaconParams->TimIeOffset );
 #endif
 
-  beaconParams->beacon = beaconPayload;
+  if (size >= WDI_BEACON_TEMPLATE_SIZE ||
+      size >= SCH_MAX_BEACON_SIZE) {
+      schLog(pMac, LOGE,FL("beacon size (%d) exceed WDI limit %d or host limit %d"),
+             size, WDI_BEACON_TEMPLATE_SIZE, SCH_MAX_BEACON_SIZE);
+      VOS_ASSERT(0);
+      vos_mem_free(beaconParams);
+      return eSIR_FAILURE;
+  }
+  vos_mem_copy(beaconParams->beacon, beaconPayload, size);
   beaconParams->beaconLength = (tANI_U32) size;
   msgQ.bodyptr = beaconParams;
   msgQ.bodyval = 0;
@@ -571,7 +579,7 @@
         */
 
         sirCopyMacAddr( pprobeRespParams->bssId,  psessionEntry->bssId);
-        pprobeRespParams->pProbeRespTemplate   = pFrame2Hal;
+        vos_mem_copy(pprobeRespParams->probeRespTemplate, pFrame2Hal, nBytes);
         pprobeRespParams->probeRespTemplateLen = nBytes;
         vos_mem_copy(pprobeRespParams->ucProxyProbeReqValidIEBmap,IeBitmap,(sizeof(tANI_U32) * 8));
         msgQ.type     = WDA_UPDATE_PROBE_RSP_TEMPLATE_IND;

CORE/WDA/inc/legacy/halMsgApi.h

diff --git a/CORE/WDA/inc/legacy/halMsgApi.h b/CORE/WDA/inc/legacy/halMsgApi.h
index 83d0267..cd5503b 100644
--- a/CORE/WDA/inc/legacy/halMsgApi.h
+++ b/CORE/WDA/inc/legacy/halMsgApi.h
@@ -736,7 +736,7 @@
 
 typedef struct {
     tSirMacAddr bssId;
-    tANI_U8 *beacon;     // Beacon data.
+    tANI_U8 beacon[WDI_BEACON_TEMPLATE_SIZE];     // Beacon data.
     tANI_U32 beaconLength; //length of the template.
     tANI_U32 timIeOffset; //TIM IE offset from the beginning of the template.
     tANI_U16 p2pIeOffset; //P2P IE offset from the begining of the template
@@ -744,7 +744,7 @@
 
 typedef struct sSendProbeRespParams {
     tSirMacAddr bssId;
-    tANI_U8      *pProbeRespTemplate; 
+    tANI_U8      probeRespTemplate[SCH_MAX_PROBE_RESP_SIZE];
     tANI_U32     probeRespTemplateLen;
     tANI_U32     ucProxyProbeReqValidIEBmap[8];
 } tSendProbeRespParams, * tpSendProbeRespParams;

CORE/WDA/src/wlan_qct_wda.c

diff --git a/CORE/WDA/src/wlan_qct_wda.c b/CORE/WDA/src/wlan_qct_wda.c
index c1fb5b7..2a049c9 100644
--- a/CORE/WDA/src/wlan_qct_wda.c
+++ b/CORE/WDA/src/wlan_qct_wda.c
@@ -8768,7 +8768,7 @@
 
    vos_mem_copy(
            wdiSendProbeRspParam->wdiProbeRspTemplateInfo.pProbeRespTemplate,
-           pSendProbeRspParams->pProbeRespTemplate,
+           pSendProbeRspParams->probeRespTemplate,
            pSendProbeRspParams->probeRespTemplateLen);
    
    wdiSendProbeRspParam->wdiReqStatusCB = NULL ;