From ad935d3fefec7f775188d305a5bf63a64d30a065 Mon Sep 17 00:00:00 2001
From: Gokul Sivakumar <gokulkumar.sivakumar@infineon.com>
Date: Fri, 11 Nov 2022 19:40:04 +0530
Subject: [PATCH 45/49] validate the TWT parameters exponent and mantissa
 passed to wpa_cli

The exponent is a 5 bit param and the max value is 31 (0x1F). The mantissa
is a 16 bit param and its max value is 65535 (0xFFFF). Do this range check
before sending the TWT setup request to the driver.

Set the default value of flow ID as 255 instead of 0 to let the FW choose
it when explicitly not specified by the userpsace.


Signed-off-by: Gokul Sivakumar <gokulkumar.sivakumar@infineon.com>
---
 wpa_supplicant/ctrl_iface.c |  4 ++++
 wpa_supplicant/twt.c        | 30 +++++++++++++++++++++++++-----
 2 files changed, 29 insertions(+), 5 deletions(-)

diff --git a/wpa_supplicant/ctrl_iface.c b/wpa_supplicant/ctrl_iface.c
index 1d57e393b..d3dfc13aa 100644
--- a/wpa_supplicant/ctrl_iface.c
+++ b/wpa_supplicant/ctrl_iface.c
@@ -10005,7 +10005,11 @@ static int wpas_ctrl_iface_send_twt_setup(struct wpa_supplicant *wpa_s,
 	bool trigger = true;
 	bool implicit = true;
 	bool flow_type = true;
+#ifdef CONFIG_TWT_OFFLOAD_IFX
+	int flow_id = 0xFF;
+#else
 	int flow_id = 0;
+#endif /* CONFIG_TWT_OFFLOAD_IFX */
 	bool protection = false;
 	u8 twt_channel = 0;
 	u8 control = BIT(4); /* Control field (IEEE P802.11ax/D8.0 Figure
diff --git a/wpa_supplicant/twt.c b/wpa_supplicant/twt.c
index ff75b7ed3..fb0c3e3c6 100644
--- a/wpa_supplicant/twt.c
+++ b/wpa_supplicant/twt.c
@@ -52,8 +52,6 @@ int wpas_twt_offload_send_setup(struct wpa_supplicant *wpa_s, u8 dtok, int expon
 	u8 negotiation_type, twt_info_frame_disabled, min_twt_unit;
 
 	params.dtok = dtok;
-	params.exponent = (u8)exponent;
-	params.mantissa = (u16)mantissa;
 	params.min_twt = min_twt;
 	params.twt = twt;
 	params.twt_offset = twt_offset;
@@ -63,8 +61,30 @@ int wpas_twt_offload_send_setup(struct wpa_supplicant *wpa_s, u8 dtok, int expon
 	params.flow_type = flow_type ? 1 : 0;
 	params.protection = protection ? 1 : 0;
 	params.twt_channel = twt_channel;
-	params.flow_id = 0;
-	params.bcast_twt_id = 0;
+	params.flow_id = 0xFF;
+	params.bcast_twt_id = 0xFF;
+
+	/* exponent range - 0 to 31 */
+	if (exponent >= 0 && exponent <= 0x1F) {
+		params.exponent = (u8)exponent;
+	} else {
+		wpa_printf(MSG_ERROR,
+				"TWT offload: setup cmd exponent %d not supported",
+				exponent);
+		ret = -EOPNOTSUPP;
+		goto fail;
+	}
+
+	/* mantissa range - 1 to 65535 */
+	if (mantissa > 0 && mantissa <= 0xFFFF) {
+		params.mantissa = (u16)mantissa;
+	} else {
+		wpa_printf(MSG_ERROR,
+				"TWT offload: setup cmd mantissa %d not supported",
+				mantissa);
+		ret = -EOPNOTSUPP;
+		goto fail;
+	}
 
 	/* Setup Command Field - IEEE 802.11ax-2021 Table 9-297 */
 	switch(setup_cmd) {
@@ -192,7 +212,7 @@ fail:
 
 int wpas_twt_offload_init_default_session(struct wpa_supplicant *wpa_s)
 {
-	int exponent = 10, mantissa = 8192, setup_cmd = 2, flow_id = 0, ret = 0;
+	int exponent = 10, mantissa = 8192, setup_cmd = 2, flow_id = 0xFF, ret = 0;
 	unsigned long long twt = 0, twt_offset = 0;
 	bool requestor = true, trigger = true, implicit = true, flow_type = true,
 	     protection = false;
-- 
2.17.1

