qcacld-3.0: Make data length as zero whenever we free the data

qcacld-2.0 to qcacld-3.0 propagation

In limSendSmeJoinReassocRsp API, assoc req, assoc rsp, ricData, tspecIes
are sent to SME layer if corresponding pointer in psessionEntry is
not NULL. There is bug here where the pointer is NULL but the length is
non zero. Because of this data is copied at incorrect offset and data
at SME layer is not at right offset leading to corrupted IE in
next re-assoc request.

Fix this by making length as zero whenever we free the data.

Change-Id: I4ba4ff49e56bc2f2758d869eae8ff9370b0c0489
CRs-Fixed: 932712

core/mac/src/pe/lim/lim_process_assoc_rsp_frame.c

@@ -381,6 +381,7 @@ static void lim_update_ric_data(tpAniSirGlobal mac_ctx,
 	if (session_entry->ricData != NULL) {
 		cdf_mem_free(session_entry->ricData);
 		session_entry->ricData = NULL;
+		session_entry->RICDataLen = 0;
 	}
 	if (assoc_rsp->ricPresent) {
 		session_entry->RICDataLen =
@@ -429,6 +430,7 @@ static void lim_update_ese_tspec(tpAniSirGlobal mac_ctx,
 	if (session_entry->tspecIes != NULL) {
 		cdf_mem_free(session_entry->tspecIes);
 		session_entry->tspecIes = NULL;
+		session_entry->tspecLen = 0;
 	}
 	if (assoc_rsp->tspecPresent) {
 		lim_log(mac_ctx, LOG1, FL("Tspec EID present in assoc rsp"));
@@ -745,6 +747,7 @@ lim_process_assoc_rsp_frame(tpAniSirGlobal mac_ctx,
 			 "and setting NULL"));
 		cdf_mem_free(session_entry->assocRsp);
 		session_entry->assocRsp = NULL;
+		session_entry->assocRspLen = 0;
 	}
 
 	session_entry->assocRsp = cdf_mem_malloc(frame_len);

core/mac/src/pe/lim/lim_process_beacon_frame.c

@@ -150,6 +150,7 @@ lim_process_beacon_frame(tpAniSirGlobal mac_ctx, uint8_t *rx_pkt_info,
 		if (session->beacon != NULL) {
 			cdf_mem_free(session->beacon);
 			session->beacon = NULL;
+			session->bcnLen = 0;
 		}
 		session->bcnLen = WMA_GET_RX_PAYLOAD_LEN(rx_pkt_info);
 		session->beacon = cdf_mem_malloc(session->bcnLen);

core/mac/src/pe/lim/lim_process_probe_rsp_frame.c

@@ -161,6 +161,7 @@ lim_process_probe_rsp_frame(tpAniSirGlobal mac_ctx, uint8_t *rx_Packet_info,
 		if (session_entry->beacon != NULL) {
 			cdf_mem_free(session_entry->beacon);
 			session_entry->beacon = NULL;
+			session_entry->bcnLen = 0;
 		}
 		session_entry->bcnLen =
 			WMA_GET_RX_PAYLOAD_LEN(rx_Packet_info);

core/mac/src/pe/lim/lim_send_management_frames.c

@@ -2358,6 +2358,7 @@ lim_send_reassoc_req_with_ft_ies_mgmt_frame(tpAniSirGlobal mac_ctx,
 	if (NULL != pe_session->assocReq) {
 		cdf_mem_free(pe_session->assocReq);
 		pe_session->assocReq = NULL;
+		pe_session->assocReqLen = 0;
 	}
 	if (ft_ies_length) {
 		pe_session->assocReq = cdf_mem_malloc(ft_ies_length);

core/mac/src/pe/lim/lim_send_sme_rsp_messages.c

@@ -271,48 +271,53 @@ static void lim_handle_join_rsp_status(tpAniSirGlobal mac_ctx,
 				sme_join_rsp->beaconLength);
 			cdf_mem_free(session_entry->beacon);
 			session_entry->beacon = NULL;
+			session_entry->bcnLen = 0;
 #ifdef WLAN_FEATURE_VOWIFI_11R_DEBUG
 			lim_log(mac_ctx, LOG1, FL("Beacon=%d"),
-				session_entry->bcnLen);
+				sme_join_rsp->beaconLength);
 #endif
 		}
 		if (session_entry->assocReq != NULL) {
 			sme_join_rsp->assocReqLength =
 				session_entry->assocReqLen;
 			cdf_mem_copy(sme_join_rsp->frames +
-				session_entry->bcnLen, session_entry->assocReq,
+				sme_join_rsp->beaconLength,
+				session_entry->assocReq,
 				sme_join_rsp->assocReqLength);
 			cdf_mem_free(session_entry->assocReq);
 			session_entry->assocReq = NULL;
+			session_entry->assocReqLen = 0;
 #ifdef WLAN_FEATURE_VOWIFI_11R_DEBUG
 			lim_log(mac_ctx,
 				LOG1, FL("AssocReq=%d"),
-				session_entry->assocReqLen);
+				sme_join_rsp->assocReqLength);
 #endif
 		}
 		if (session_entry->assocRsp != NULL) {
 			sme_join_rsp->assocRspLength =
 				session_entry->assocRspLen;
 			cdf_mem_copy(sme_join_rsp->frames +
-				session_entry->bcnLen +
-				session_entry->assocReqLen,
+				sme_join_rsp->beaconLength +
+				sme_join_rsp->assocReqLength,
 				session_entry->assocRsp,
 				sme_join_rsp->assocRspLength);
 			cdf_mem_free(session_entry->assocRsp);
 			session_entry->assocRsp = NULL;
+			session_entry->assocRspLen = 0;
 		}
 #ifdef WLAN_FEATURE_VOWIFI_11R
 		if (session_entry->ricData != NULL) {
 			sme_join_rsp->parsedRicRspLen =
 				session_entry->RICDataLen;
 			cdf_mem_copy(sme_join_rsp->frames +
-				session_entry->bcnLen +
-				session_entry->assocReqLen +
-				session_entry->assocRspLen,
+				sme_join_rsp->beaconLength +
+				sme_join_rsp->assocReqLength +
+				sme_join_rsp->assocRspLength,
 				session_entry->ricData,
 				sme_join_rsp->parsedRicRspLen);
 			cdf_mem_free(session_entry->ricData);
 			session_entry->ricData = NULL;
+			session_entry->RICDataLen = 0;
 			lim_log(mac_ctx, LOG1, FL("RicLength=%d"),
 				sme_join_rsp->parsedRicRspLen);
 		}
@@ -322,22 +327,23 @@ static void lim_handle_join_rsp_status(tpAniSirGlobal mac_ctx,
 			sme_join_rsp->tspecIeLen =
 				session_entry->tspecLen;
 			cdf_mem_copy(sme_join_rsp->frames +
-				session_entry->bcnLen +
-				session_entry->assocReqLen +
-				session_entry->assocRspLen +
-				session_entry->RICDataLen,
+				sme_join_rsp->beaconLength +
+				sme_join_rsp->assocReqLength +
+				sme_join_rsp->assocRspLength +
+				sme_join_rsp->parsedRicRspLen,
 				session_entry->tspecIes,
 				sme_join_rsp->tspecIeLen);
 			cdf_mem_free(session_entry->tspecIes);
 			session_entry->tspecIes = NULL;
+			session_entry->tspecLen = 0;
 			lim_log(mac_ctx, LOG1, FL("ESE-TspecLen=%d"),
-				session_entry->tspecLen);
+				sme_join_rsp->tspecIeLen);
 		}
 #endif
 		sme_join_rsp->aid = session_entry->limAID;
 #ifdef WLAN_FEATURE_VOWIFI_11R_DEBUG
 		lim_log(mac_ctx, LOG1, FL("AssocRsp=%d"),
-			session_entry->assocRspLen);
+			sme_join_rsp->assocRspLength);
 #endif
 		sme_join_rsp->vht_channel_width =
 			session_entry->ch_width;
@@ -367,25 +373,30 @@ static void lim_handle_join_rsp_status(tpAniSirGlobal mac_ctx,
 		if (session_entry->beacon != NULL) {
 			cdf_mem_free(session_entry->beacon);
 			session_entry->beacon = NULL;
+			session_entry->bcnLen = 0;
 		}
 		if (session_entry->assocReq != NULL) {
 			cdf_mem_free(session_entry->assocReq);
 			session_entry->assocReq = NULL;
+			session_entry->assocReqLen = 0;
 		}
 		if (session_entry->assocRsp != NULL) {
 			cdf_mem_free(session_entry->assocRsp);
 			session_entry->assocRsp = NULL;
+			session_entry->assocRspLen = 0;
 		}
 #ifdef WLAN_FEATURE_VOWIFI_11R
 		if (session_entry->ricData != NULL) {
 			cdf_mem_free(session_entry->ricData);
 			session_entry->ricData = NULL;
+			session_entry->RICDataLen = 0;
 		}
 #endif
 #ifdef FEATURE_WLAN_ESE
 		if (session_entry->tspecIes != NULL) {
 			cdf_mem_free(session_entry->tspecIes);
 			session_entry->tspecIes = NULL;
+			session_entry->tspecLen = 0;
 		}
 #endif
 	}

core/mac/src/pe/lim/lim_session.c

@@ -601,16 +601,19 @@ void pe_delete_session(tpAniSirGlobal mac_ctx, tpPESession session)
 	if (session->beacon != NULL) {
 		cdf_mem_free(session->beacon);
 		session->beacon = NULL;
+		session->bcnLen = 0;
 	}
 
 	if (session->assocReq != NULL) {
 		cdf_mem_free(session->assocReq);
 		session->assocReq = NULL;
+		session->assocReqLen = 0;
 	}
 
 	if (session->assocRsp != NULL) {
 		cdf_mem_free(session->assocRsp);
 		session->assocRsp = NULL;
+		session->assocRspLen = 0;
 	}
 
 	if (session->parsedAssocReq != NULL) {