samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: Fix a memory leak in HTC tx bundle packet allocation

Browse Source 
When HTC_PACKETs are allocated for bundle tx, netbuf and bundle
queue will also be allocated and stored in the context of
HTC_PACKET, but these two structures are not freed when the
bundle HTC_PACKETs are removed from pBundleFreeList and freed.

Retrieve the netbuf and bundle queue pointers from HTC_PACKET
context and free them when HTC_PACKET is freed.

Change-Id: I61d9eb18027b12f8b9491c696e4e16d793edf0d2
CRs-Fixed: 2127098
This commit is contained in:
wadesong
2017-10-14 09:11:34 +08:00
committed by snandini
parent 3c11bdd460
commit fbf643a4fc
1 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
htc/htc.c
View File

@@ -144,6 +144,8 @@ static void htc_cleanup(HTC_TARGET *target)
HTC_PACKET *pPacket; HTC_PACKET *pPacket;
int i; int i;
HTC_ENDPOINT *endpoint; HTC_ENDPOINT *endpoint;
HTC_PACKET_QUEUE *pkt_queue;
qdf_nbuf_t netbuf;
if (target->hif_dev != NULL) { if (target->hif_dev != NULL) {
hif_detach_htc(target->hif_dev); hif_detach_htc(target->hif_dev);
@@ -158,13 +160,22 @@ static void htc_cleanup(HTC_TARGET *target)
qdf_mem_free(pPacket); qdf_mem_free(pPacket);
} }
LOCK_HTC_TX(target);
pPacket = target->pBundleFreeList; pPacket = target->pBundleFreeList;
target->pBundleFreeList = NULL;
UNLOCK_HTC_TX(target);
while (pPacket) { while (pPacket) {
HTC_PACKET *pPacketTmp = (HTC_PACKET *) pPacket->ListLink.pNext; HTC_PACKET *pPacketTmp = (HTC_PACKET *) pPacket->ListLink.pNext;
netbuf = GET_HTC_PACKET_NET_BUF_CONTEXT(pPacket);
if (netbuf)
qdf_nbuf_free(netbuf);
pkt_queue = pPacket->pContext;
if (pkt_queue)
qdf_mem_free(pkt_queue);
qdf_mem_free(pPacket); qdf_mem_free(pPacket);
pPacket = pPacketTmp; pPacket = pPacketTmp;
} }
#ifdef TODO_FIXME #ifdef TODO_FIXME
while (true) { while (true) {
pPacket = htc_alloc_control_tx_packet(target); pPacket = htc_alloc_control_tx_packet(target);
@@ -609,7 +620,9 @@ QDF_STATUS htc_wait_target(HTC_HANDLE HTCHandle)
temp_bundle_packet = rx_bundle_packet; temp_bundle_packet = rx_bundle_packet;
} }
LOCK_HTC_TX(target);
target->pBundleFreeList = temp_bundle_packet; target->pBundleFreeList = temp_bundle_packet;
UNLOCK_HTC_TX(target);
} }
/* done processing */ /* done processing */