Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b3d679e1 authored by Abhinav Kumar's avatar Abhinav Kumar Committed by nshrivas
Browse files

qcacld-3.0: Fix possible memory leak 

Free Dynamic allocated memory in following scenarios:
1. In __lim_ext_scan_forward_bcn_probe_rsp()
Free dynamic allocated memory for result in failure case

2. In sme_oem_data_req()
Free dynamic allocated memory for oem_data_req in failure case.

3. In sme_notify_ht2040_mode()
Free dynamic allocated memory for pHtOpMode in default case.

4. In sme_send_rate_update_ind()
Free dynamic allocated memory for rate_upd if mutex acquire
fails.

5. In sme_txpower_limit()
Free dynamic allocated memory tx_power_limit rate_upd if mutex
acquire fails.

Change-Id: I5deccb5ac10f69ad00ea860f43c821ee7e90c71e
CRs-Fixed: 2465786
parent d586d86a

core/mac/src/pe/lim/lim_process_message_queue.c

+1 −0
Original line number Diff line number Diff line
@@ -625,6 +625,7 @@ __lim_ext_scan_forward_bcn_probe_rsp(tpAniSirGlobal pmac, uint8_t *rx_pkt_info, 


	if (NULL == bssdescr) {

		pe_err("qdf_mem_malloc(length=%d) failed", frame_len);

		qdf_mem_free(result);

		return;

	}

core/sme/src/common/sme_api.c

+38 −37
Original line number Diff line number Diff line
@@ -4764,6 +4764,7 @@ QDF_STATUS sme_oem_data_req(tHalHandle hal, struct oem_data_req *hdd_oem_req) 
	oem_data_req->data = qdf_mem_malloc(oem_data_req->data_len);

	if (!oem_data_req->data) {

		sme_err("mem alloc failed");

		qdf_mem_free(oem_data_req);

		return QDF_STATUS_E_NOMEM;

	}
@@ -9218,6 +9219,7 @@ QDF_STATUS sme_notify_ht2040_mode(tHalHandle hHal, uint16_t staId, 
	default:

		QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,

			  "%s: Invalid OP mode", __func__);

		qdf_mem_free(pHtOpMode);

		return QDF_STATUS_E_FAILURE;

	}
@@ -9641,28 +9643,27 @@ QDF_STATUS sme_send_rate_update_ind(tHalHandle hHal, 
			TX_RATE_HT20 | TX_RATE_SGI;



	status = sme_acquire_global_lock(&pMac->sme);

	if (QDF_STATUS_SUCCESS == status) {

	if (QDF_IS_STATUS_ERROR(status)) {

		qdf_mem_free(rate_upd);

		return status;

	}



	msg.type = WMA_RATE_UPDATE_IND;

	msg.bodyptr = rate_upd;

	MTRACE(qdf_trace(QDF_MODULE_ID_SME, TRACE_CODE_SME_TX_WMA_MSG,

			 NO_SESSION, msg.type));

		if (!QDF_IS_STATUS_SUCCESS

			    (scheduler_post_message(QDF_MODULE_ID_SME,

						    QDF_MODULE_ID_WMA,

						    QDF_MODULE_ID_WMA,

						    &msg))) {



	status = scheduler_post_message(QDF_MODULE_ID_SME, QDF_MODULE_ID_WMA,

					QDF_MODULE_ID_WMA, &msg);

	if (QDF_IS_STATUS_ERROR(status)) {

		QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,

				  "%s: Not able to post WMA_SET_RMC_RATE_IND to WMA!",

			  "%s: Not able to post WMA_RATE_UPDATE_IND to WMA!",

			  __func__);



			sme_release_global_lock(&pMac->sme);

		qdf_mem_free(rate_upd);

			return QDF_STATUS_E_FAILURE;

		status = QDF_STATUS_E_FAILURE;

	}



	sme_release_global_lock(&pMac->sme);

		return QDF_STATUS_SUCCESS;

	}



	return status;

}
@@ -10380,8 +10381,7 @@ QDF_STATUS sme_set_thermal_level(tHalHandle hal, uint8_t level) 
 */

QDF_STATUS sme_txpower_limit(tHalHandle hHal, tSirTxPowerLimit *psmetx)

{

	QDF_STATUS status = QDF_STATUS_SUCCESS;

	QDF_STATUS qdf_status = QDF_STATUS_SUCCESS;

	QDF_STATUS status;

	struct scheduler_msg message = {0};

	tpAniSirGlobal pMac = PMAC_STRUCT(hHal);

	tSirTxPowerLimit *tx_power_limit;
@@ -10397,24 +10397,25 @@ QDF_STATUS sme_txpower_limit(tHalHandle hHal, tSirTxPowerLimit *psmetx) 
	*tx_power_limit = *psmetx;



	status = sme_acquire_global_lock(&pMac->sme);

	if (QDF_IS_STATUS_SUCCESS(status)) {

	if (QDF_IS_STATUS_ERROR(status)) {

		qdf_mem_free(tx_power_limit);

		return status;

	}



	message.type = WMA_TX_POWER_LIMIT;

		message.reserved = 0;

	message.bodyptr = tx_power_limit;



		qdf_status = scheduler_post_message(QDF_MODULE_ID_SME,

						    QDF_MODULE_ID_WMA,

						    QDF_MODULE_ID_WMA,

						    &message);

		if (!QDF_IS_STATUS_SUCCESS(qdf_status)) {

	status = scheduler_post_message(QDF_MODULE_ID_SME, QDF_MODULE_ID_WMA,

					QDF_MODULE_ID_WMA, &message);

	if (QDF_IS_STATUS_ERROR(status)) {

		QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_ERROR,

			  "%s: not able to post WMA_TX_POWER_LIMIT",

			  __func__);

		status = QDF_STATUS_E_FAILURE;

		qdf_mem_free(tx_power_limit);

	}



	sme_release_global_lock(&pMac->sme);

	}



	return status;

}