Browse Source

qcacld-3.0: Fix invalid malloc in lim_cm_fill_link_session

When roaming from legacy AP to MLO AP, during the pe session
creation for the link vdev, the bss descriptor is allocated in
lim_cm_fill_link_session(), but its already allocated as part of
lim_join_req allocation and is not freed.

Don't allocate memory for bss_desc pointer again in
lim_cm_fill_link_session() api.

Change-Id: I1d4e0683df04e8bbf307e595cb5ac5e36ca24586
CRs-Fixed: 3363077
Pragaspathi Thilagaraj 2 years ago
parent
commit
c2f626b33c
1 changed files with 0 additions and 9 deletions
  1. 0 9
      core/mac/src/pe/lim/lim_api.c

+ 0 - 9
core/mac/src/pe/lim/lim_api.c

@@ -3481,18 +3481,10 @@ lim_cm_fill_link_session(struct mac_context *mac_ctx,
 	pe_join_req = pe_session->lim_join_req;
 	bss_desc = &pe_session->lim_join_req->bssDescription;
 
-	bss_desc = qdf_mem_malloc(sizeof(struct bss_description) + ie_len);
-	if (!bss_desc) {
-		QDF_ASSERT(bss_desc);
-		status = -QDF_STATUS_E_NOMEM;
-		goto end;
-	}
-
 	status = lim_roam_fill_bss_descr(mac_ctx, sync_ind, bss_desc,
 					 pe_session);
 	if (!QDF_IS_STATUS_SUCCESS(status)) {
 		pe_err("LFR3:Failed to fill Bss Descr");
-		qdf_mem_free(bss_desc);
 		goto end;
 	}
 
@@ -3500,7 +3492,6 @@ lim_cm_fill_link_session(struct mac_context *mac_ctx,
 	if (QDF_IS_STATUS_ERROR(status)) {
 		pe_err("Failed to fill pe session vdev id %d",
 		       pe_session->vdev_id);
-		qdf_mem_free(bss_desc);
 		goto end;
 	}