samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: Avoid double free of req in wma_hold_req_timer

Browse Source 
Do not free request pointer in wma_hold_req_timer, if not found
in the list, because firmware response would have consumed and
freed it.

Change-Id: Ibf561243c606b40e45c8b1cd7c0d2559e0ea85aa
CRs-Fixed: 2027853
This commit is contained in:
Naveen Rawat
2017-04-03 20:18:30 -07:00
committed by Sandeep Puligilla
parent 93c3a2e1a0
commit 0eb3dd0ebe
1 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
core/wma/src/wma_dev_if.c
View File

@@ -2360,7 +2360,7 @@ void wma_hold_req_timer(void *data)
wma = cds_get_context(QDF_MODULE_ID_WMA); wma = cds_get_context(QDF_MODULE_ID_WMA);
if (NULL == wma) { if (NULL == wma) {
WMA_LOGE(FL("Failed to get wma")); WMA_LOGE(FL("Failed to get wma"));
goto free_tgt_req; return;
} }
WMA_LOGA(FL("request %d is timed out for vdev_id - %d"), WMA_LOGA(FL("request %d is timed out for vdev_id - %d"),
@@ -2370,7 +2370,11 @@ void wma_hold_req_timer(void *data)
if (!msg) { if (!msg) {
WMA_LOGE(FL("Failed to lookup request message - %d"), WMA_LOGE(FL("Failed to lookup request message - %d"),
tgt_req->msg_type); tgt_req->msg_type);
goto free_tgt_req; /*
* if find request failed, then firmware rsp should have
* consumed the buffer. Do not free.
*/
return;
} }
if (tgt_req->msg_type == WMA_ADD_STA_REQ) { if (tgt_req->msg_type == WMA_ADD_STA_REQ) {
@@ -2422,9 +2426,6 @@ void wma_hold_req_timer(void *data)
tgt_req->msg_type, tgt_req->type); tgt_req->msg_type, tgt_req->type);
QDF_BUG(0); QDF_BUG(0);
} }
free_tgt_req:
qdf_mc_timer_destroy(&tgt_req->event_timeout);
qdf_mem_free(tgt_req);
} }
/** /**