qcacld-3.0: Fix for memory leaks in multiple functions

1)  Fix for memory leaks lim management frame registration queue by
    unconditionally removing all nodes from queue and releasing the
    node pointer. This need to be done for FTM mode also.

2) Free u_mac_post_ctrl_msgu_mac_post_ctrl_msg in the error cases.

3) In wma_tx_packet(), free tx_frame memory in error cases.

Change-Id: Idbae6b2666d38d0f130d0115e5a05387c0b63c31
CRs-fixed: 2027588

core/mac/src/pe/lim/lim_api.c

@@ -620,18 +620,16 @@ void lim_cleanup(tpAniSirGlobal pMac)
 
 	pe_deregister_mgmt_rx_frm_callback(pMac);
 
-	if (QDF_GLOBAL_FTM_MODE != cds_get_conparam()) {
-		qdf_mutex_acquire(&pMac->lim.lim_frame_register_lock);
-		while (qdf_list_remove_front(
+	qdf_mutex_acquire(&pMac->lim.lim_frame_register_lock);
+	while (qdf_list_remove_front(
 			&pMac->lim.gLimMgmtFrameRegistratinQueue,
 			(qdf_list_node_t **) &pLimMgmtRegistration) ==
 			QDF_STATUS_SUCCESS) {
-			qdf_mem_free(pLimMgmtRegistration);
-		}
-		qdf_mutex_release(&pMac->lim.lim_frame_register_lock);
-		qdf_list_destroy(&pMac->lim.gLimMgmtFrameRegistratinQueue);
-		qdf_mutex_destroy(&pMac->lim.lim_frame_register_lock);
+		qdf_mem_free(pLimMgmtRegistration);
 	}
+	qdf_mutex_release(&pMac->lim.lim_frame_register_lock);
+	qdf_list_destroy(&pMac->lim.gLimMgmtFrameRegistratinQueue);
+	qdf_mutex_destroy(&pMac->lim.lim_frame_register_lock);
 
 	lim_cleanup_mlm(pMac);
 

core/mac/src/pe/lim/lim_ft_preauth.c

@@ -151,10 +151,7 @@ int lim_process_ft_pre_auth_req(tpAniSirGlobal mac_ctx,
 		/* Post the FT Pre Auth Response to SME */
 		lim_post_ft_pre_auth_rsp(mac_ctx, eSIR_FAILURE, NULL, 0,
 					 session);
-		/*
-		 * return FALSE, since the Pre-Auth Req will be freed in
-		 * limPostFTPreAuthRsp on failure
-		 */
+		buf_consumed = true;
 		return buf_consumed;
 	}
 

core/mac/src/pe/lim/lim_process_sme_req_messages.c

@@ -4157,6 +4157,7 @@ static void __lim_process_roam_scan_offload_req(tpAniSirGlobal mac_ctx,
 	if (!local_ie_buf) {
 		lim_log(mac_ctx, LOGE,
 			FL("Mem Alloc failed for local_ie_buf"));
+		qdf_mem_free(req_buffer);
 		return;
 	}
 

core/mac/src/pe/lim/lim_send_sme_rsp_messages.c

@@ -1983,6 +1983,8 @@ void lim_send_sme_pe_ese_tsm_rsp(tpAniSirGlobal pMac,
 		PELOGE(lim_log
 		       (pMac, LOGE, FL("Session not found for the Sta id(%d)"),
 		       pPeStats->staId);)
+		qdf_mem_free(pPeStats->tsmStatsReq);
+		qdf_mem_free(pPeStats);
 		return;
 	}
 

core/wma/src/wma_data.c

@@ -2440,6 +2440,7 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen,
 
 	if (NULL == wma_handle) {
 		WMA_LOGE("wma_handle is NULL");
+		cds_packet_free((void *)tx_frame);
 		return QDF_STATUS_E_FAILURE;
 	}
 	iface = &wma_handle->interfaces[vdev_id];
@@ -2448,6 +2449,7 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen,
 
 	if (!txrx_vdev) {
 		WMA_LOGE("TxRx Vdev Handle is NULL");
+		cds_packet_free((void *)tx_frame);
 		return QDF_STATUS_E_FAILURE;
 	}
 
@@ -2460,12 +2462,14 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen,
 
 	if (frmType >= TXRX_FRM_MAX) {
 		WMA_LOGE("Invalid Frame Type Fail to send Frame");
+		cds_packet_free((void *)tx_frame);
 		return QDF_STATUS_E_FAILURE;
 	}
 
 	pMac = cds_get_context(QDF_MODULE_ID_PE);
 	if (!pMac) {
 		WMA_LOGE("pMac Handle is NULL");
+		cds_packet_free((void *)tx_frame);
 		return QDF_STATUS_E_FAILURE;
 	}
 	/*
@@ -2475,6 +2479,7 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen,
 	if (!((frmType == TXRX_FRM_802_11_MGMT) ||
 	      (frmType == TXRX_FRM_802_11_DATA))) {
 		WMA_LOGE("No Support to send other frames except 802.11 Mgmt/Data");
+		cds_packet_free((void *)tx_frame);
 		return QDF_STATUS_E_FAILURE;
 	}
 #ifdef WLAN_FEATURE_11W
@@ -2592,6 +2597,7 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen,
 
 		if (pdev == NULL) {
 			WMA_LOGE("%s: pdev pointer is not available", __func__);
+			cds_packet_free((void *)tx_frame);
 			return QDF_STATUS_E_FAULT;
 		}
 
@@ -2615,6 +2621,7 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen,
 				} else {
 					WMA_LOGE("%s: Already one Data pending for Ack, reject Tx of data frame",
 						__func__);
+					cds_packet_free((void *)tx_frame);
 					return QDF_STATUS_E_FAILURE;
 				}
 			}
@@ -2624,6 +2631,7 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen,
 			 * so Ack Complete Cb is must
 			 */
 			WMA_LOGE("No Ack Complete Cb. Don't Allow");
+			cds_packet_free((void *)tx_frame);
 			return QDF_STATUS_E_FAILURE;
 		}
 
@@ -2684,6 +2692,7 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen,
 				txrx_vdev);
 	if (ctrl_pdev == NULL) {
 		WMA_LOGE("ol_pdev_handle is NULL\n");
+		cds_packet_free((void *)tx_frame);
 		return QDF_STATUS_E_FAILURE;
 	}
 	is_high_latency = cdp_cfg_is_high_latency(soc, ctrl_pdev);