qcacld-3.0: Handle event eWNI_SME_UPPER_LAYER_ASSOC_CNF

It doesn't handle event eWNI_SME_UPPER_LAYER_ASSOC_CNF if state isn't
eCSR_ROAMING_STATE_JOINED, which cause memory leak. So handle this
event and free the memory.

Change-Id: Ibfbf9ac5e2d74a2c81839976b4cc1fb7deae7e60
CRs-Fixed: 2414369

core/sme/src/csr/csr_api_roam.c

@@ -9663,6 +9663,15 @@ void csr_roaming_state_msg_processor(struct mac_context *mac, void *pMsgBuf)
 		csr_roam_check_for_link_status_change(mac, pSmeRsp);
 		break;
 
+	case eWNI_SME_UPPER_LAYER_ASSOC_CNF:
+	{
+		tSirSmeAssocIndToUpperLayerCnf *upper_layer_assoc_cnf =
+			(tSirSmeAssocIndToUpperLayerCnf *)pMsgBuf;
+		if (upper_layer_assoc_cnf->ies) {
+			qdf_mem_free(upper_layer_assoc_cnf->ies);
+			sme_debug("free ies");
+		}
+	}
 	default:
 		sme_debug("Unexpected message type: %d[0x%X] received in substate %s",
 			pSmeRsp->messageType, pSmeRsp->messageType,

core/sme/src/csr/csr_cmd_process.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2018 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2019 The Linux Foundation. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -69,6 +69,17 @@ QDF_STATUS csr_msg_processor(struct mac_context *mac_ctx, void *msg_buf)
 			break;
 		}
 
+		if (sme_rsp->messageType ==
+		    eWNI_SME_UPPER_LAYER_ASSOC_CNF) {
+			tSirSmeAssocIndToUpperLayerCnf *upper_layer_assoc_cnf =
+				(tSirSmeAssocIndToUpperLayerCnf *)msg_buf;
+			if (upper_layer_assoc_cnf->ies) {
+				qdf_mem_free(upper_layer_assoc_cnf->ies);
+				sme_debug("free ies");
+			}
+			break;
+		}
+
 		/*
 		 * For all other messages, we ignore it
 		 * To work-around an issue where checking for set/remove