Browse Source

qcacmn: Decrement peer ref count on rx hw stats req failure

Peer ref count incremented in dp_request_rx_hw_stats
is not decremented back in case of error scenarios
resulting in possible ref leak and failure in peer
deletion.

Fix is to invoke dp_peer_unref_delete for error
scenarios in dp_request_rx_hw_stats error.

Change-Id: I81ecf60a97ff5c804445fd713ed779c478df8521
CRs-Fixed: 2706596
Yeshwanth Sriram Guntuka 5 years ago
parent
commit
b72685beaa
1 changed files with 2 additions and 0 deletions
  1. 2 0
      dp/wifi3.0/dp_main.c

+ 2 - 0
dp/wifi3.0/dp_main.c

@@ -10260,6 +10260,7 @@ dp_request_rx_hw_stats(struct cdp_soc_t *soc_hdl, uint8_t vdev_id)
 
 
 	if (!rx_hw_stats) {
 	if (!rx_hw_stats) {
 		dp_err("malloc failed for hw stats structure");
 		dp_err("malloc failed for hw stats structure");
+		dp_peer_unref_delete(peer);
 		return QDF_STATUS_E_NOMEM;
 		return QDF_STATUS_E_NOMEM;
 	}
 	}
 
 
@@ -10271,6 +10272,7 @@ dp_request_rx_hw_stats(struct cdp_soc_t *soc_hdl, uint8_t vdev_id)
 		dp_err("no tid stats sent successfully");
 		dp_err("no tid stats sent successfully");
 		qdf_mem_free(rx_hw_stats);
 		qdf_mem_free(rx_hw_stats);
 		qdf_spin_unlock_bh(&soc->rx_hw_stats_lock);
 		qdf_spin_unlock_bh(&soc->rx_hw_stats_lock);
+		dp_peer_unref_delete(peer);
 		return QDF_STATUS_E_INVAL;
 		return QDF_STATUS_E_INVAL;
 	}
 	}
 	qdf_atomic_set(&rx_hw_stats->pending_tid_stats_cnt,
 	qdf_atomic_set(&rx_hw_stats->pending_tid_stats_cnt,