瀏覽代碼

qcacld-3.0: Fix Mem leak in wma_tx_packet

Free packet memory in error cases in wma_tx_packet.

Change-Id: I4409b69fecdf28ae6e94af390e5de61208577383
CRs-Fixed: 2658624
Utkarsh Bhatnagar 5 年之前
父節點
當前提交
00b9851ebb
共有 1 個文件被更改,包括 11 次插入2 次删除
  1. 11 2
      core/wma/src/wma_data.c

+ 11 - 2
core/wma/src/wma_data.c

@@ -2415,6 +2415,7 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen,
 
 	if (!soc) {
 		WMA_LOGE("%s:SOC context is NULL", __func__);
+		cds_packet_free((void *)tx_frame);
 		return QDF_STATUS_E_FAILURE;
 	}
 
@@ -2470,8 +2471,11 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen,
 							pdev_id, wh->i_addr1,
 							&mic_len, &hdr_len);
 
-					if (QDF_IS_STATUS_ERROR(qdf_status))
-						return qdf_status;
+					if (QDF_IS_STATUS_ERROR(qdf_status)) {
+						cds_packet_free(
+							(void *)tx_frame);
+						goto error;
+					}
 				}
 
 				newFrmLen = frmLen + hdr_len + mic_len;
@@ -2536,6 +2540,7 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen,
 			if (!igtk) {
 				wma_alert("IGTK not present");
 				cds_packet_free((void *)tx_frame);
+				cds_packet_free((void *)pPacket);
 				goto error;
 			}
 			if (!cds_attach_mmie(igtk,
@@ -2546,6 +2551,7 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen,
 				wma_alert("Failed to attach MMIE");
 				/* Free the original packet memory */
 				cds_packet_free((void *)tx_frame);
+				cds_packet_free((void *)pPacket);
 				goto error;
 			}
 			cds_packet_free((void *)tx_frame);
@@ -2715,6 +2721,7 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen,
 		if (!QDF_IS_STATUS_SUCCESS(qdf_status)) {
 			WMA_LOGP("%s: Event Reset failed tx comp event %x",
 				 __func__, qdf_status);
+			cds_packet_free((void *)tx_frame);
 			goto error;
 		}
 	}
@@ -2777,11 +2784,13 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen,
 	psoc = wma_handle->psoc;
 	if (!psoc) {
 		WMA_LOGE("%s: psoc ctx is NULL", __func__);
+		cds_packet_free((void *)tx_frame);
 		goto error;
 	}
 
 	if (!wma_handle->pdev) {
 		WMA_LOGE("%s: pdev ctx is NULL", __func__);
+		cds_packet_free((void *)tx_frame);
 		goto error;
 	}