Merge branch 'android-msm-pixel-4.9-rvc-security' into android-msm-pixel-4.9-rvc-qpr3android-11.0.0_r0.97android-11.0.0_r0.96android-11.0.0_r0.92android-11.0.0_r0.91android-11.0.0_r0.112android-11.0.0_r0.111android-11.0.0_r0.102android-11.0.0_r0.101android-msm-crosshatch-4.9-android11-qpr3android-msm-bonito-4.9-android11-qpr3

Jul 2021.1

Bug: 185957890
Change-Id: Ibbe7fb94cf3db741b3085734efa0c896a9af4e99

3 files changed, 30 insertions, 19 deletions

diff --git a/core/mac/src/pe/lim/lim_process_assoc_req_frame.c b/core/mac/src/pe/lim/lim_process_assoc_req_frame.c
index 2c8edf20cf..b8eb33e625 100644
--- a/core/mac/src/pe/lim/lim_process_assoc_req_frame.c
+++ b/core/mac/src/pe/lim/lim_process_assoc_req_frame.c
@@ -2203,19 +2203,9 @@ static void fill_mlm_assoc_ind_vht(tpSirAssocReq assocreq,
 	}
 }
 
-/**
- * lim_send_mlm_assoc_ind() - Sends assoc indication to SME
- * @mac_ctx: Global Mac context
- * @sta_ds: Station DPH hash entry
- * @session_entry: PE session entry
- *
- * This function sends either LIM_MLM_ASSOC_IND
- * or LIM_MLM_REASSOC_IND to SME.
- *
- * Return: None
- */
-void lim_send_mlm_assoc_ind(tpAniSirGlobal mac_ctx,
-	tpDphHashNode sta_ds, tpPESession session_entry)
+QDF_STATUS lim_send_mlm_assoc_ind(tpAniSirGlobal mac_ctx,
+				  tpDphHashNode sta_ds,
+				  tpPESession session_entry)
 {
 	tpLimMlmAssocInd assoc_ind = NULL;
 	tpSirAssocReq assoc_req;
@@ -2252,7 +2242,7 @@ void lim_send_mlm_assoc_ind(tpAniSirGlobal mac_ctx,
 			lim_release_peer_idx(mac_ctx, sta_ds->assocId,
 				session_entry);
 			pe_err("AllocateMemory failed for assoc_ind");
-			return;
+			return QDF_STATUS_E_NOMEM;
 		}
 		qdf_mem_copy((uint8_t *) assoc_ind->peerMacAddr,
 			(uint8_t *) sta_ds->staAddr, sizeof(tSirMacAddr));
@@ -2305,7 +2295,7 @@ void lim_send_mlm_assoc_ind(tpAniSirGlobal mac_ctx,
 				pe_err("rsnIEdata index out of bounds: %d",
 					rsn_len);
 				qdf_mem_free(assoc_ind);
-				return;
+				return QDF_STATUS_E_INVAL;
 			}
 			assoc_ind->rsnIE.rsnIEdata[rsn_len] =
 				SIR_MAC_WPA_EID;
@@ -2457,5 +2447,5 @@ void lim_send_mlm_assoc_ind(tpAniSirGlobal mac_ctx,
 			 (uint32_t *) assoc_ind);
 		qdf_mem_free(assoc_ind);
 	}
-	return;
+	return QDF_STATUS_SUCCESS;
 }
diff --git a/core/mac/src/pe/lim/lim_process_mlm_rsp_messages.c b/core/mac/src/pe/lim/lim_process_mlm_rsp_messages.c
index 2f6e0e97c4..508c71a70c 100644
--- a/core/mac/src/pe/lim/lim_process_mlm_rsp_messages.c
+++ b/core/mac/src/pe/lim/lim_process_mlm_rsp_messages.c
@@ -2003,7 +2003,15 @@ void lim_process_ap_mlm_add_sta_rsp(tpAniSirGlobal pMac, tpSirMsgQ limMsgQ,
 	 * 2) PE receives eWNI_SME_ASSOC_CNF from SME
 	 * 3) BTAMP-AP sends Re/Association Response to BTAMP-STA
 	 */
-	lim_send_mlm_assoc_ind(pMac, pStaDs, psessionEntry);
+	if (lim_send_mlm_assoc_ind(pMac, pStaDs, psessionEntry) !=
+							QDF_STATUS_SUCCESS) {
+		lim_reject_association(pMac, pStaDs->staAddr,
+				       pStaDs->mlmStaContext.subType,
+				       true, pStaDs->mlmStaContext.authType,
+				       pStaDs->assocId, true,
+				       eSIR_MAC_UNSPEC_FAILURE_STATUS,
+				       psessionEntry);
+	}
 	/* fall though to reclaim the original Add STA Response message */
 end:
 	if (0 != limMsgQ->bodyptr) {
diff --git a/core/mac/src/pe/lim/lim_types.h b/core/mac/src/pe/lim/lim_types.h
index bf5204a12a..fcb3e910ef 100644
--- a/core/mac/src/pe/lim/lim_types.h
+++ b/core/mac/src/pe/lim/lim_types.h
@@ -466,8 +466,21 @@ tSirRetStatus lim_process_auth_frame_no_session(tpAniSirGlobal pMac, uint8_t *,
 						void *body);
 
 void lim_process_assoc_req_frame(tpAniSirGlobal, uint8_t *, uint8_t, tpPESession);
-void lim_send_mlm_assoc_ind(tpAniSirGlobal pMac, tpDphHashNode pStaDs,
-			    tpPESession psessionEntry);
+
+/**
+ * lim_send_mlm_assoc_ind() - Sends assoc indication to SME
+ * @mac_ctx: Global Mac context
+ * @sta_ds: Station DPH hash entry
+ * @session_entry: PE session entry
+ *
+ * This function sends either LIM_MLM_ASSOC_IND
+ * or LIM_MLM_REASSOC_IND to SME.
+ *
+ * Return: QDF_STATUS
+ */
+QDF_STATUS lim_send_mlm_assoc_ind(tpAniSirGlobal mac_ctx,
+				  tpDphHashNode sta_ds,
+				  tpPESession session_entry);
 
 void lim_process_assoc_rsp_frame(tpAniSirGlobal, uint8_t *, uint8_t, tpPESession);
 void lim_process_disassoc_frame(tpAniSirGlobal, uint8_t *, tpPESession);