samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: Fix mem leak in wma_roam_update_vdev

Browse Source 
In the memory allocated for del_sta_params, set_link_params and
del_bss_params is not freed if the malloc for add_sta_params
fails. This causes memory leak in wma_roam_update_vdev.
Also in wma_extscan_operations_event_handler, oprn_ind is not
freed in case of failure.

Free the memory allocated for del_sta_params, set_link_params,
del_bss_params, oprn_ind during every return.

Change-Id: I727cc734943a2abcc2cfeca3285af13eb68cfe44
CRs-Fixed: 2464098
This commit is contained in:
Pragaspathi Thilagaraj
2019-06-03 13:47:58 +05:30
committed by nshrivas
parent 7ea060459e
commit beb769e8c5
1 changed files with 26 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
core/wma/src/wma_scan_roam.c
View File

@@ -2581,6 +2581,7 @@ static void wma_get_peer_uc_cipher(tp_wma_handle wma, uint8_t *peer_mac,
*uc_cipher = cipher; *uc_cipher = cipher;
} }
#endif #endif
/** /**
* wma_roam_update_vdev() - Update the STA and BSS * wma_roam_update_vdev() - Update the STA and BSS
* @wma: Global WMA Handle * @wma: Global WMA Handle
@@ -2592,8 +2593,9 @@ static void wma_get_peer_uc_cipher(tp_wma_handle wma, uint8_t *peer_mac,
* *
* Return: None * Return: None
*/ */
static void wma_roam_update_vdev(tp_wma_handle wma, static void
struct roam_offload_synch_ind *roam_synch_ind_ptr) wma_roam_update_vdev(tp_wma_handle wma,
struct roam_offload_synch_ind *roam_synch_ind_ptr)
{ {
tDeleteBssParams *del_bss_params; tDeleteBssParams *del_bss_params;
tDeleteStaParams *del_sta_params; tDeleteStaParams *del_sta_params;
@@ -2605,13 +2607,29 @@ static void wma_roam_update_vdev(tp_wma_handle wma,
vdev_id = roam_synch_ind_ptr->roamed_vdev_id; vdev_id = roam_synch_ind_ptr->roamed_vdev_id;
wma->interfaces[vdev_id].nss = roam_synch_ind_ptr->nss; wma->interfaces[vdev_id].nss = roam_synch_ind_ptr->nss;
del_bss_params = qdf_mem_malloc(sizeof(*del_bss_params)); del_bss_params = qdf_mem_malloc(sizeof(*del_bss_params));
del_sta_params = qdf_mem_malloc(sizeof(*del_sta_params)); if (!del_bss_params)
set_link_params = qdf_mem_malloc(sizeof(*set_link_params));
add_sta_params = qdf_mem_malloc(sizeof(*add_sta_params));
if (!del_bss_params || !del_sta_params ||
!set_link_params || !add_sta_params)
return; return;
del_sta_params = qdf_mem_malloc(sizeof(*del_sta_params));
if (!del_sta_params) {
qdf_mem_free(del_bss_params);
return;
}
set_link_params = qdf_mem_malloc(sizeof(*set_link_params));
if (!set_link_params) {
qdf_mem_free(del_bss_params);
qdf_mem_free(del_sta_params);
return;
}
add_sta_params = qdf_mem_malloc(sizeof(*add_sta_params));
if (!add_sta_params) {
qdf_mem_free(del_bss_params);
qdf_mem_free(del_sta_params);
qdf_mem_free(set_link_params);
return;
}
qdf_mem_zero(del_bss_params, sizeof(*del_bss_params)); qdf_mem_zero(del_bss_params, sizeof(*del_bss_params));
qdf_mem_zero(del_sta_params, sizeof(*del_sta_params)); qdf_mem_zero(del_sta_params, sizeof(*del_sta_params));
qdf_mem_zero(set_link_params, sizeof(*set_link_params)); qdf_mem_zero(set_link_params, sizeof(*set_link_params));
@@ -3916,6 +3934,7 @@ int wma_extscan_operations_event_handler(void *handle,
WMA_LOGE("FW mesg num_buk %d more than TLV hdr %d", WMA_LOGE("FW mesg num_buk %d more than TLV hdr %d",
oprn_event->num_buckets, oprn_event->num_buckets,
param_buf->num_bucket_id); param_buf->num_bucket_id);
qdf_mem_free(oprn_ind);
return -EINVAL; return -EINVAL;
} }