RDKBACCL-1702: [TDK][AUTO][BPI][DML]Setting Device.WiFi.AccessPoint.<i>.WPS.X_CISCO_COM_CancelSession causes OneWiFi crash

[ap934]

Reason for change: Setting WPS cancel on non-wps vaps causing onewifi crash, added defensive guard in respective event handlers
Test Procedure: WPS functionality should work, WPS cancel should work for accesspoint 1 and 2, rest non-wps vaps are returned with error
Risks: Low
Priority: P2

[Copilot]

Pull request overview

Prevents OneWiFi crashes when TR-181 clients attempt to cancel WPS sessions on VAPs where WPS is not applicable/enabled by adding defensive guards in the relevant DML paths and the controller event handler.

Changes:

• Add a defensive check in the platform DML callback to reject X_CISCO_COM_CancelSession when WPS is disabled for the VAP.
• Add a similar defensive check in the TR-181 multi-link DML handler for X_CISCO_COM_CancelSession.
• Ignore WPS-cancel events in the controller if the target VAP is not a private VAP.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
source/platform/common/data_model/wifi_dml_cb.c	Reject WPS cancel requests when WPS is disabled for the VAP.
source/dml/tr_181/ml/cosa_wifi_dml.c	Reject WPS cancel requests when WPS is disabled (but still needs payload sizing fix for ctrl-queue).
source/core/wifi_ctrl_queue_handlers.c	Ignore WPS-cancel events for non-private VAP indices before calling HAL.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

source/platform/common/data_model/wifi_dml_cb.c:4833

• instance_number is a uint8_t here, but it’s sent to the ctrl queue with len = sizeof(instance_number) (1 byte). process_wps_cancel_event() consumes the payload as an INT (*(INT*)data), so this is still an out-of-bounds read/UB and can crash even with the new WPS-enable guard. Send a 32-bit/int vap index into the queue (consistent with the push-button path above and with cosa_wifi_dml.c).

        instance_number -= 1;
        wifi_util_dbg_print(WIFI_DMCLI, "%s:%d: WPS cancel for vap %d\n", __func__, __LINE__,
            instance_number);
        push_event_to_ctrl_queue(&instance_number, sizeof(instance_number), wifi_event_type_command,
            wifi_event_type_command_wps_cancel, NULL);

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

source/platform/common/data_model/wifi_dml_cb.c:4827

• X_CISCO_COM_CancelSession is a command-style boolean (getter always returns false). The setter currently triggers a cancel even when output_value is false, and will also return an error for non-WPS VAPs even for a no-op write of false. Gate the behavior so only true triggers a cancel; treat false as a successful no-op.

        if (p_dm_vap_info->u.bss_info.wps.enable == false) {
            wifi_util_error_print(WIFI_DMCLI,
                "%s:%d: WPS not enabled for %s, cancel session not supported\n",
                __func__, __LINE__, p_dm_vap_info->vap_name);
            return false;

source/dml/tr_181/ml/cosa_wifi_dml.c:12412

• X_CISCO_COM_CancelSession should only perform a cancel when the written value is TRUE (command-style param; reads are always false). As written, a FALSE write still enqueues a cancel. Also, the queue handler now ignores non-private VAP indices; rejecting non-private VAPs here keeps behavior consistent and returns the requested error instead of a silent ignore.

        if (vapInfo->u.bss_info.wps.enable == false) {
            wifi_util_error_print(WIFI_DMCLI,"%s:%d: WPS not enabled for %s, cancel session not supported\n",__func__, __LINE__, vapInfo->vap_name);
            return FALSE;
        }
        INT vap_index = (INT)(instance_number - 1);

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

source/dml/tr_181/ml/cosa_wifi_dml.c:12414

• WPS_SetParamBoolValue() now guards on vapInfo->u.bss_info.wps.enable, but it still allows X_CISCO_COM_CancelSession on non-private VAPs when WPS happens to be enabled (the ctrl handler will ignore it due to isVapPrivate()), so the setter can report success while doing nothing. Add a private-VAP applicability check here (consistent with webconfig_send_wps_change_event() and process_wps_cancel_event()).

        if (vapInfo->u.bss_info.wps.enable == false) {
            wifi_util_error_print(WIFI_DMCLI,"%s:%d: WPS not enabled for %s, cancel session not supported\n",__func__, __LINE__, vapInfo->vap_name);
            return FALSE;
        }
        INT vap_index = (INT)(instance_number - 1);