Browse Source

qcacld-3.0: Release resource after TDLS cmd processing

It doesn't free resources in failed cases like getting vdev or tdls
vdev object when handling tdls commands. This causes reference
count of psoc leak or memory leak. Following are the functions,

tdls_set_responder
tdls_notify_sta_connect
tdls_notify_sta_disconnect
tdls_set_operation_mode
tdls_reset_all_peers

Change-Id: I8b5d5fa8a137a1b07f0fa6e4667047db95d7b99e
CRs-Fixed: 2839099
Tushnim Bhattacharyya 4 years ago
parent
commit
2cac8a113b

+ 13 - 4
components/tdls/core/src/wlan_tdls_cmds_process.c

@@ -2104,22 +2104,31 @@ int tdls_process_set_responder(struct tdls_set_responder_req *set_req)
  */
 int tdls_set_responder(struct tdls_set_responder_req *set_req)
 {
-	QDF_STATUS status;
+	int status;
 
-	if (!set_req || !set_req->vdev) {
+	if (!set_req) {
+		tdls_err("Invalid input params");
+		return  -EINVAL;
+	}
+
+	if (!set_req->vdev) {
 		tdls_err("Invalid input params %pK", set_req);
-		return -EINVAL;
+		status = -EINVAL;
+		goto free_req;
 	}
 
 	status = wlan_objmgr_vdev_try_get_ref(set_req->vdev, WLAN_TDLS_NB_ID);
 	if (QDF_STATUS_SUCCESS != status) {
 		tdls_err("vdev object is deleted");
-		return -EINVAL;
+		status = -EINVAL;
+		goto error;
 	}
 
 	status = tdls_process_set_responder(set_req);
 
+error:
 	wlan_objmgr_vdev_release_ref(set_req->vdev, WLAN_TDLS_NB_ID);
+free_req:
 	qdf_mem_free(set_req);
 	return status;
 }

+ 21 - 3
components/tdls/core/src/wlan_tdls_main.c

@@ -554,6 +554,7 @@ static QDF_STATUS tdls_reset_all_peers(
 
 	if (!delete_all_peers_ind || !delete_all_peers_ind->vdev) {
 		tdls_err("invalid param");
+		qdf_mem_free(delete_all_peers_ind);
 		return QDF_STATUS_E_INVAL;
 	}
 
@@ -1243,11 +1244,17 @@ QDF_STATUS tdls_notify_sta_connect(struct tdls_sta_notify_params *notify)
 {
 	QDF_STATUS status;
 
-	if (!notify || !notify->vdev) {
+	if (!notify) {
 		tdls_err("invalid param");
 		return QDF_STATUS_E_INVAL;
 	}
 
+	if (!notify->vdev) {
+		tdls_err("invalid param");
+		qdf_mem_free(notify);
+		return QDF_STATUS_E_INVAL;
+	}
+
 	status = tdls_process_sta_connect(notify);
 
 	wlan_objmgr_vdev_release_ref(notify->vdev, WLAN_TDLS_NB_ID);
@@ -1333,11 +1340,17 @@ QDF_STATUS tdls_notify_sta_disconnect(struct tdls_sta_notify_params *notify)
 {
 	QDF_STATUS status;
 
-	if (!notify || !notify->vdev) {
+	if (!notify) {
 		tdls_err("invalid param");
 		return QDF_STATUS_E_INVAL;
 	}
 
+	if (!notify->vdev) {
+		tdls_err("invalid param");
+		qdf_mem_free(notify);
+		return QDF_STATUS_E_INVAL;
+	}
+
 	status = tdls_process_sta_disconnect(notify);
 
 	wlan_objmgr_vdev_release_ref(notify->vdev, WLAN_TDLS_NB_ID);
@@ -1620,9 +1633,14 @@ QDF_STATUS tdls_set_operation_mode(struct tdls_set_mode_params *tdls_set_mode)
 	struct tdls_vdev_priv_obj *tdls_vdev;
 	QDF_STATUS status;
 
-	if (!tdls_set_mode || !tdls_set_mode->vdev)
+	if (!tdls_set_mode)
 		return QDF_STATUS_E_INVAL;
 
+	if (!tdls_set_mode->vdev) {
+		qdf_mem_free(tdls_set_mode);
+		return QDF_STATUS_E_INVAL;
+	}
+
 	status = tdls_get_vdev_objects(tdls_set_mode->vdev,
 				       &tdls_vdev, &tdls_soc);