|
@@ -499,18 +499,30 @@ static int ath6kl_wmi_tx_status_event_rx(u8 *datap, int len)
|
|
|
return 0;
|
|
|
}
|
|
|
|
|
|
-static int ath6kl_wmi_rx_probe_req_event_rx(u8 *datap, int len)
|
|
|
+static int ath6kl_wmi_rx_probe_req_event_rx(struct wmi *wmi, u8 *datap, int len)
|
|
|
{
|
|
|
struct wmi_p2p_rx_probe_req_event *ev;
|
|
|
+ u32 freq;
|
|
|
u16 dlen;
|
|
|
+ struct ath6kl *ar = wmi->parent_dev;
|
|
|
|
|
|
if (len < sizeof(*ev))
|
|
|
return -EINVAL;
|
|
|
|
|
|
ev = (struct wmi_p2p_rx_probe_req_event *) datap;
|
|
|
+ freq = le32_to_cpu(ev->freq);
|
|
|
dlen = le16_to_cpu(ev->len);
|
|
|
- ath6kl_dbg(ATH6KL_DBG_WMI, "rx_probe_req: len=%u\n",
|
|
|
- dlen);
|
|
|
+ if (datap + len < ev->data + dlen) {
|
|
|
+ ath6kl_err("invalid wmi_p2p_rx_probe_req_event: "
|
|
|
+ "len=%d dlen=%u\n", len, dlen);
|
|
|
+ return -EINVAL;
|
|
|
+ }
|
|
|
+ ath6kl_dbg(ATH6KL_DBG_WMI, "rx_probe_req: len=%u freq=%u "
|
|
|
+ "probe_req_report=%d\n",
|
|
|
+ dlen, freq, ar->probe_req_report);
|
|
|
+
|
|
|
+ if (ar->probe_req_report || ar->nw_type == AP_NETWORK)
|
|
|
+ cfg80211_rx_mgmt(ar->net_dev, freq, ev->data, dlen, GFP_ATOMIC);
|
|
|
|
|
|
return 0;
|
|
|
}
|
|
@@ -3045,7 +3057,7 @@ int ath6kl_wmi_control_rx(struct wmi *wmi, struct sk_buff *skb)
|
|
|
break;
|
|
|
case WMI_RX_PROBE_REQ_EVENTID:
|
|
|
ath6kl_dbg(ATH6KL_DBG_WMI, "WMI_RX_PROBE_REQ_EVENTID\n");
|
|
|
- ret = ath6kl_wmi_rx_probe_req_event_rx(datap, len);
|
|
|
+ ret = ath6kl_wmi_rx_probe_req_event_rx(wmi, datap, len);
|
|
|
break;
|
|
|
case WMI_P2P_CAPABILITIES_EVENTID:
|
|
|
ath6kl_dbg(ATH6KL_DBG_WMI, "WMI_P2P_CAPABILITIES_EVENTID\n");
|