samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: Free the old bcn if new one is rcvd in sync frame ind

Browse Source 
Firmware may send two consecutive roam sync frame indications when
it supports MLO roaming. The first event carries link beacon and
second event carries assoc beacon. This is to let host driver have
both the link scan results if host has to take care of link
connect(e.g. OWE MLO roaming, EAP MLO roaming,.. ).
If host driver doesn't have support/doesn't need link beacon,
it would be overwritten by assoc beacon(e.g. wpa2 MLO roaming,
SAE MLO roaming, ..).
This results in a memleak as the previous cached beacon is
not freed(vdev->rso_cfg->roam_sync_frame_ind->bcn_probe_rsp).

Free the existing beacon if new one is received. Also, remove the
current free's from extract_roam_sync_frame_event_tlv() which
doesn't need any such freeing as the copy always happens to a
freshly allocated buffer.

Change-Id: If3b4d6e4b8e1e2af5306171ad7eda28e744da64e
CRs-Fixed: 3322094
This commit is contained in:
Srinivas Dasari
2022-10-27 12:10:02 +05:30
committed by Madan Koyyalamudi
parent 9d2fec51e7
commit 4cfbb4b30c
2 changed files with 6 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
components/wmi/src/wmi_unified_roam_tlv.c
View File

@@ -2707,9 +2707,6 @@ extract_roam_sync_frame_event_tlv(wmi_unified_t wmi_handle, void *event,
roam_sync_frame_ind->is_beacon =
synch_frame_event->is_beacon;
if (roam_sync_frame_ind->bcn_probe_rsp)
qdf_mem_free(roam_sync_frame_ind->bcn_probe_rsp);
roam_sync_frame_ind->bcn_probe_rsp =
qdf_mem_malloc(roam_sync_frame_ind->bcn_probe_rsp_len);
if (!roam_sync_frame_ind->bcn_probe_rsp) {
@@ -2725,8 +2722,6 @@ extract_roam_sync_frame_event_tlv(wmi_unified_t wmi_handle, void *event,
roam_sync_frame_ind->reassoc_req_len =
synch_frame_event->reassoc_req_len;
if (roam_sync_frame_ind->reassoc_req)
qdf_mem_free(roam_sync_frame_ind->reassoc_req);
roam_sync_frame_ind->reassoc_req =
qdf_mem_malloc(roam_sync_frame_ind->reassoc_req_len);
if (!roam_sync_frame_ind->reassoc_req) {
@@ -2742,9 +2737,6 @@ extract_roam_sync_frame_event_tlv(wmi_unified_t wmi_handle, void *event,
roam_sync_frame_ind->reassoc_rsp_len =
synch_frame_event->reassoc_rsp_len;
if (roam_sync_frame_ind->reassoc_rsp)
qdf_mem_free(roam_sync_frame_ind->reassoc_rsp);
roam_sync_frame_ind->reassoc_rsp =
qdf_mem_malloc(roam_sync_frame_ind->reassoc_rsp_len);
if (!roam_sync_frame_ind->reassoc_rsp) {