Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 49ccee87 authored by Krupali Dhanvijay's avatar Krupali Dhanvijay
Browse files

qcacld-3.0: Revert double free change 

The mainline change of change-id Idc70e8437f89cb1cf4f6d35f924085409994714a
fixes a double free issue introduced as part of
wma->target_if migration of WMI_ROAM_PMKID_REQUEST_EVENTID event handling.
But this is not applicable for legacy branches as the same migration
changes are not done.

So Reverting the double free
change in wma_roam_pmkid_request_event_handler.

Change-Id: I88d31a295398eb2ab700857260285450a8f245bd
CRs-Fixed: 3130848
parent dfc2e22b

core/wma/src/wma_scan_roam.c

+13 −11
Original line number Diff line number Diff line
@@ -5007,44 +5007,44 @@ int wma_roam_pmkid_request_event_handler(void *handle, uint8_t *event, 


	if (!event) {

		wma_err("received null event from target");

		return QDF_STATUS_E_INVAL;

		return -EINVAL;

	}



	param_buf = (WMI_ROAM_PMKID_REQUEST_EVENTID_param_tlvs *)event;

	if (!param_buf) {

		wma_err("received null buf from target");

		return QDF_STATUS_E_INVAL;

		return -EINVAL;

	}



	roam_pmkid_req_ev = param_buf->fixed_param;

	if (!roam_pmkid_req_ev) {

		wma_err("received null event data from target");

		return QDF_STATUS_E_INVAL;

		return -EINVAL;

	}



	if (roam_pmkid_req_ev->vdev_id >= wma->max_bssid) {

		wma_err("received invalid vdev_id %d", roam_pmkid_req_ev->vdev_id);

		return QDF_STATUS_E_INVAL;

		return -EINVAL;

	}



	num_entries = param_buf->num_pmkid_request;

	if (num_entries > MAX_RSSI_AVOID_BSSID_LIST) {

		wma_err("num bssid entries:%d exceeds maximum value",

			num_entries);

		return QDF_STATUS_E_INVAL;

		return -EINVAL;

	}



	src_list = param_buf->pmkid_request;

	if (len < (sizeof(*roam_pmkid_req_ev) +

		(num_entries * sizeof(*src_list)))) {

		wma_err("Invalid length: %d", len);

		return QDF_STATUS_E_INVAL;

		return -EINVAL;

	}



	dst_list = qdf_mem_malloc(sizeof(struct roam_pmkid_req_event) +

				 (sizeof(struct qdf_mac_addr) * num_entries));

	if (!dst_list)

		return QDF_STATUS_E_NOMEM;

		return -ENOMEM;



	for (i = 0; i < num_entries; i++) {

		roam_bsslist = &dst_list->ap_bssid[i];
@@ -5055,7 +5055,7 @@ int wma_roam_pmkid_request_event_handler(void *handle, uint8_t *event, 
		    qdf_is_macaddr_group(roam_bsslist)) {

			wma_err("Invalid bssid");

			qdf_mem_free(dst_list);

			return QDF_STATUS_E_INVAL;

			return -EINVAL;

		}

		wma_debug("Received pmkid fallback for bssid: "QDF_MAC_ADDR_FMT" vdev_id:%d",

			  QDF_MAC_ADDR_REF(roam_bsslist->bytes),
@@ -5066,10 +5066,12 @@ int wma_roam_pmkid_request_event_handler(void *handle, uint8_t *event, 


	status = wma->csr_roam_pmkid_req_cb(roam_pmkid_req_ev->vdev_id,

					    dst_list);

	if (QDF_IS_STATUS_ERROR(status))

	if (QDF_IS_STATUS_ERROR(status)) {

		wma_err("Pmkid request failed");

		qdf_mem_free(dst_list);

		return -EINVAL;

	}



	if (dst_list)

	qdf_mem_free(dst_list);

	return 0;

}