| .. | .. |
|---|
| 600 | 600 | rtw_clear_bit(RTW_RECV_ACK_OR_TIMEOUT, &preorder_ctrl->rec_abba_rsp_ack); |
|---|
| 601 | 601 | |
|---|
| 602 | 602 | } |
|---|
| 603 | | - ATOMIC_SET(&psta->keytrack, 0); |
|---|
| 603 | + |
|---|
| 604 | 604 | |
|---|
| 605 | 605 | /* init for DM */ |
|---|
| 606 | 606 | psta->cmn.rssi_stat.rssi = (-1); |
|---|
| .. | .. |
|---|
| 641 | 641 | { |
|---|
| 642 | 642 | int i; |
|---|
| 643 | 643 | _irqL irqL0; |
|---|
| 644 | | - _queue *pfree_sta_queue, *pdefrag_q = NULL; |
|---|
| 644 | + _queue *pfree_sta_queue; |
|---|
| 645 | 645 | struct recv_reorder_ctrl *preorder_ctrl; |
|---|
| 646 | 646 | struct sta_xmit_priv *pstaxmitpriv; |
|---|
| 647 | 647 | struct xmit_priv *pxmitpriv = &padapter->xmitpriv; |
|---|
| .. | .. |
|---|
| 651 | 651 | struct mlme_ext_info *pmlmeinfo = &(pmlmeext->mlmext_info); |
|---|
| 652 | 652 | int pending_qcnt[4]; |
|---|
| 653 | 653 | u8 is_pre_link_sta = _FALSE; |
|---|
| 654 | | - _list *phead, *plist; |
|---|
| 655 | | - _queue *pfree_recv_queue = &padapter->recvpriv.free_recv_queue; |
|---|
| 656 | | - union recv_frame *prframe; |
|---|
| 657 | | - |
|---|
| 658 | 654 | |
|---|
| 659 | 655 | if (psta == NULL) |
|---|
| 660 | 656 | goto exit; |
|---|
| .. | .. |
|---|
| 772 | 768 | /* for A-MPDU Rx reordering buffer control, cancel reordering_ctrl_timer */ |
|---|
| 773 | 769 | for (i = 0; i < 16 ; i++) { |
|---|
| 774 | 770 | _irqL irqL; |
|---|
| 771 | + _list *phead, *plist; |
|---|
| 772 | + union recv_frame *prframe; |
|---|
| 775 | 773 | _queue *ppending_recvframe_queue; |
|---|
| 774 | + _queue *pfree_recv_queue = &padapter->recvpriv.free_recv_queue; |
|---|
| 776 | 775 | |
|---|
| 777 | 776 | preorder_ctrl = &psta->recvreorder_ctrl[i]; |
|---|
| 778 | 777 | rtw_clear_bit(RTW_RECV_ACK_OR_TIMEOUT, &preorder_ctrl->rec_abba_rsp_ack); |
|---|
| .. | .. |
|---|
| 800 | 799 | _exit_critical_bh(&ppending_recvframe_queue->lock, &irqL); |
|---|
| 801 | 800 | |
|---|
| 802 | 801 | } |
|---|
| 803 | | - |
|---|
| 804 | | - |
|---|
| 805 | | - /* CVE-2020-24586, clear defrag queue */ |
|---|
| 806 | | - pdefrag_q = &psta->sta_recvpriv.defrag_q; |
|---|
| 807 | | - enter_critical_bh(&pdefrag_q->lock); |
|---|
| 808 | | - phead = get_list_head(pdefrag_q); |
|---|
| 809 | | - plist = get_next(phead); |
|---|
| 810 | | - while (!rtw_is_list_empty(phead)) { |
|---|
| 811 | | - prframe = LIST_CONTAINOR(plist, union recv_frame, u); |
|---|
| 812 | | - plist = get_next(plist); |
|---|
| 813 | | - rtw_list_delete(&(prframe->u.hdr.list)); |
|---|
| 814 | | - rtw_free_recvframe(prframe, pfree_recv_queue); |
|---|
| 815 | | - } |
|---|
| 816 | | - exit_critical_bh(&pdefrag_q->lock); |
|---|
| 817 | 802 | |
|---|
| 818 | 803 | if (!((psta->state & WIFI_AP_STATE) || MacAddr_isBcst(psta->cmn.mac_addr)) && is_pre_link_sta == _FALSE) |
|---|
| 819 | 804 | rtw_hal_set_odm_var(padapter, HAL_ODM_STA_INFO, psta, _FALSE); |
|---|