From 00b9851ebbc2bbf3402ded814ee1d551481f68da Mon Sep 17 00:00:00 2001 From: Utkarsh Bhatnagar Date: Wed, 8 Apr 2020 21:53:20 +0530 Subject: [PATCH] qcacld-3.0: Fix Mem leak in wma_tx_packet Free packet memory in error cases in wma_tx_packet. Change-Id: I4409b69fecdf28ae6e94af390e5de61208577383 CRs-Fixed: 2658624 --- core/wma/src/wma_data.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/core/wma/src/wma_data.c b/core/wma/src/wma_data.c index a0e3c0357f3e..ec40bdab02da 100644 --- a/core/wma/src/wma_data.c +++ b/core/wma/src/wma_data.c @@ -2415,6 +2415,7 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen, if (!soc) { WMA_LOGE("%s:SOC context is NULL", __func__); + cds_packet_free((void *)tx_frame); return QDF_STATUS_E_FAILURE; } @@ -2470,8 +2471,11 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen, pdev_id, wh->i_addr1, &mic_len, &hdr_len); - if (QDF_IS_STATUS_ERROR(qdf_status)) - return qdf_status; + if (QDF_IS_STATUS_ERROR(qdf_status)) { + cds_packet_free( + (void *)tx_frame); + goto error; + } } newFrmLen = frmLen + hdr_len + mic_len; @@ -2536,6 +2540,7 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen, if (!igtk) { wma_alert("IGTK not present"); cds_packet_free((void *)tx_frame); + cds_packet_free((void *)pPacket); goto error; } if (!cds_attach_mmie(igtk, @@ -2546,6 +2551,7 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen, wma_alert("Failed to attach MMIE"); /* Free the original packet memory */ cds_packet_free((void *)tx_frame); + cds_packet_free((void *)pPacket); goto error; } cds_packet_free((void *)tx_frame); @@ -2715,6 +2721,7 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen, if (!QDF_IS_STATUS_SUCCESS(qdf_status)) { WMA_LOGP("%s: Event Reset failed tx comp event %x", __func__, qdf_status); + cds_packet_free((void *)tx_frame); goto error; } } @@ -2777,11 +2784,13 @@ QDF_STATUS wma_tx_packet(void *wma_context, void *tx_frame, uint16_t frmLen, psoc = wma_handle->psoc; if (!psoc) { WMA_LOGE("%s: psoc ctx is NULL", __func__); + cds_packet_free((void *)tx_frame); goto error; } if (!wma_handle->pdev) { WMA_LOGE("%s: pdev ctx is NULL", __func__); + cds_packet_free((void *)tx_frame); goto error; }