qcacld-3.0: Release PMF timer's memory before deleting the session

Recent fix I082c771bbee6d083b15515dd2e40ed9a27e0a9a1 has been added
to release PEER's uncleaned timer memory but this fix is not good
enough to cover SSR (sub system restart) scenario in which driver
never calls stop bss API.

To resolve the SSR case, call lim_del_pmf_sa_query_timer() API before
deleting the PE session.

CRs-Fixed: 2127688
Change-Id: I50d6eda88fcd666b546fffb6a0bc1b7e500a8cae

core/mac/src/pe/lim/lim_api.c

@@ -866,6 +866,8 @@ tSirRetStatus pe_close(tpAniSirGlobal pMac)
 	qdf_spinlock_destroy(&pMac->sys.bbt_mgmt_lock);
 	for (i = 0; i < pMac->lim.maxBssId; i++) {
 		if (pMac->lim.gpSession[i].valid == true) {
+			lim_del_pmf_sa_query_timer(pMac,
+						   &pMac->lim.gpSession[i]);
 			pe_delete_session(pMac, &pMac->lim.gpSession[i]);
 		}
 	}

core/mac/src/pe/lim/lim_send_sme_rsp_messages.c

@@ -2277,52 +2277,6 @@ err:
 	qdf_mem_free(csa_params);
 }
 
-#ifdef WLAN_FEATURE_11W
-/**
- * lim_del_pmf_sa_query_timer() - This function deletes SA query timer
- * @mac_ctx: pointer to mac context
- * @pe_session: pointer to PE session
- *
- * This API is to delete the PMF SA query timer created for each associated STA
- *
- * Return: none
- */
-static void
-lim_del_pmf_sa_query_timer(tpAniSirGlobal mac_ctx, tpPESession pe_session)
-{
-	uint32_t associated_sta;
-	tpDphHashNode sta_ds = NULL;
-
-	for (associated_sta = 1;
-	     associated_sta < mac_ctx->lim.gLimAssocStaLimit;
-	     associated_sta++) {
-		sta_ds = dph_get_hash_entry(mac_ctx, associated_sta,
-					    &pe_session->dph.dphHashTable);
-		if (NULL == sta_ds)
-			continue;
-
-		pe_err("Deleting pmfSaQueryTimer for staid: %d",
-			sta_ds->staIndex);
-		tx_timer_deactivate(&sta_ds->pmfSaQueryTimer);
-		tx_timer_delete(&sta_ds->pmfSaQueryTimer);
-	}
-}
-#else
-/**
- * lim_del_pmf_sa_query_timer() - This function deletes SA query timer
- * @mac_ctx: pointer to mac context
- * @pe_session: pointer to PE session
- *
- * This API is to delete the PMF SA query timer created for each associated STA
- *
- * Return: none
- */
-static void
-lim_del_pmf_sa_query_timer(tpAniSirGlobal mac_ctx, tpPESession pe_session)
-{
-}
-#endif
-
 /*--------------------------------------------------------------------------
    \brief pe_delete_session() - Handle the Delete BSS Response from HAL.
 
@@ -2346,18 +2300,6 @@ void lim_handle_delete_bss_rsp(tpAniSirGlobal pMac, struct scheduler_msg *MsgQ)
 		return;
 	}
 
-	/*
-	 * If for some reasons PEERs who are associated to SAP DUT can't get
-	 * clean-up then here is the chance to release any left out memory.
-	 *
-	 * One of the memory, driver assign to PEER is PMF SA query timer.
-	 * Release it before calling del bss response handling API.
-	 *
-	 */
-	if (LIM_IS_AP_ROLE(psessionEntry) &&
-	    (psessionEntry->statypeForBss == STA_ENTRY_SELF))
-		lim_del_pmf_sa_query_timer(pMac, psessionEntry);
-
 	/*
 	 * During DEL BSS handling, the PE Session will be deleted, but it is
 	 * better to clear this flag if the session is hanging around due

core/mac/src/pe/lim/lim_utils.c

@@ -6608,6 +6608,28 @@ tSirRetStatus lim_strip_ie(tpAniSirGlobal mac_ctx,
 	return eSIR_SUCCESS;
 }
 
+#ifdef WLAN_FEATURE_11W
+void lim_del_pmf_sa_query_timer(tpAniSirGlobal mac_ctx, tpPESession pe_session)
+{
+	uint32_t associated_sta;
+	tpDphHashNode sta_ds = NULL;
+
+	for (associated_sta = 1;
+			associated_sta < mac_ctx->lim.gLimAssocStaLimit;
+			associated_sta++) {
+		sta_ds = dph_get_hash_entry(mac_ctx, associated_sta,
+				&pe_session->dph.dphHashTable);
+		if (NULL == sta_ds)
+			continue;
+
+		pe_err("Deleting pmfSaQueryTimer for staid: %d",
+			sta_ds->staIndex);
+		tx_timer_deactivate(&sta_ds->pmfSaQueryTimer);
+		tx_timer_delete(&sta_ds->pmfSaQueryTimer);
+	}
+}
+#endif
+
 tSirRetStatus lim_strip_supp_op_class_update_struct(tpAniSirGlobal mac_ctx,
 		uint8_t *addn_ie, uint16_t *addn_ielen,
 		tDot11fIESuppOperatingClasses *dst)

core/mac/src/pe/lim/lim_utils.h

@@ -671,6 +671,33 @@ tSirRetStatus lim_strip_extcap_update_struct(tpAniSirGlobal mac_ctx,
 void lim_merge_extcap_struct(tDot11fIEExtCap *dst, tDot11fIEExtCap *src,
 		bool add);
 
+#ifdef WLAN_FEATURE_11W
+/**
+ * lim_del_pmf_sa_query_timer() - This function deletes SA query timer
+ * @mac_ctx: pointer to mac context
+ * @pe_session: pointer to PE session
+ *
+ * This API is to delete the PMF SA query timer created for each associated STA
+ *
+ * Return: none
+ */
+void lim_del_pmf_sa_query_timer(tpAniSirGlobal mac_ctx, tpPESession pe_session);
+#else
+/**
+ * lim_del_pmf_sa_query_timer() - This function deletes SA query timer
+ * @mac_ctx: pointer to mac context
+ * @pe_session: pointer to PE session
+ *
+ * This API is to delete the PMF SA query timer created for each associated STA
+ *
+ * Return: none
+ */
+static inline void
+lim_del_pmf_sa_query_timer(tpAniSirGlobal mac_ctx, tpPESession pe_session)
+{
+}
+#endif
+
 /**
  * lim_strip_op_class_update_struct - strip sup op class IE and populate
  *				  the dot11f structure