Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 87ba364a authored by Ashish Kumar Dhanotiya's avatar Ashish Kumar Dhanotiya Committed by Madan Koyyalamudi
Browse files

qcacld-3.0: Do not free radio stats memory from wma 

Currently driver frees the radio stats memory from wma
in error cases, there is a possibility that if hdd gets
time out for the stats request, it tries to free the radio
stats memory and at the same time if wma receives invalid
stats from fw in that case wma also tries to free the radio
stats memory which may lead to double free.

To aoid above issue, do not free the radio stats memory from
wma, in error cases hdd will free this memory after it gets
time out.

Change-Id: I6f6073a1a8e0be1b87efce288b7567e8fc8d69b0
CRs-Fixed: 3013842
parent 1e937d5c

core/wma/src/wma_utils.c

+2 −5
Original line number Diff line number Diff line
@@ -2191,7 +2191,6 @@ static int wma_unified_link_radio_stats_event_handler(void *handle, 
		 * events may be spoofed. Drop all of them and report error.

		 */

		wma_err("Invalid following WMI_RADIO_LINK_STATS_EVENTID. Discarding this set");

		wma_unified_radio_tx_mem_free(handle);

		return -EINVAL;

	}
@@ -2242,10 +2241,8 @@ static int wma_unified_link_radio_stats_event_handler(void *handle, 
		channels_in_this_event = qdf_mem_malloc(

					radio_stats->num_channels *

					chan_stats_size);

		if (!channels_in_this_event) {

			wma_unified_radio_tx_mem_free(handle);

		if (!channels_in_this_event)

			return -ENOMEM;

		}



		chn_results =

			(struct wifi_channel_stats *)&channels_in_this_event[0];
@@ -2283,7 +2280,7 @@ static int wma_unified_link_radio_stats_event_handler(void *handle, 
					     channels_in_this_event,

					     rs_results);

		if (status) {

			wma_unified_radio_tx_mem_free(handle);

			wma_err("Failed to copy channel stats");

			return status;

		}

	}