Browse Source

qcacld-3.0: Possible memleak at csr_roam_info->ft_pending_assoc_ind

Memory is allocated for ft_pending_assoc_ind in
csr_roam_chk_lnk_assoc_ind() for SAP/GO mode when AKM is
FT_RSN_PSK. This gets saved in ft_pending_assoc_ind_list
when ASSOC_IND is sent to HDD and the same would be used
later by ft_update/ft_cleanup APIs in success scenarios.

But if it fails to add the node for ft_pending_assoc_ind
in the list due to some reason (e.g. csr_roam_call_callback()
returns a failure), the buffer is not freed at all and results
in a memleak.

Free the buffer if csr_roam_call_callback() returns a failure.

Change-Id: Id8998f4905ac58fdc2ab101c9b1ea0870c31f44c
CRs-Fixed: 3339084
Vijay Patil 2 years ago
parent
commit
6ba5b28b6c
1 changed files with 3 additions and 0 deletions
  1. 3 0
      core/sme/src/csr/csr_api_roam.c

+ 3 - 0
core/sme/src/csr/csr_api_roam.c

@@ -4028,6 +4028,9 @@ csr_roam_chk_lnk_assoc_ind(struct mac_context *mac_ctx, tSirSmeRsp *msg_ptr)
 			if (roam_info->owe_pending_assoc_ind) {
 				qdf_mem_free(roam_info->owe_pending_assoc_ind);
 				roam_info->owe_pending_assoc_ind = NULL;
+			} else if (roam_info->ft_pending_assoc_ind) {
+				qdf_mem_free(roam_info->ft_pending_assoc_ind);
+				roam_info->ft_pending_assoc_ind = NULL;
 			}
 			roam_info->status_code = eSIR_SME_ASSOC_REFUSED;
 		} else if (pAssocInd->rsnIE.length && WLAN_ELEMID_RSN ==