A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-15 01:01:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix memory leak in lim_send_assoc_req_mgmt_frame

Browse source 
Assoc request buffer is not freed in
lim_send_assoc_req_mgmt_frame in failure cases

Fix is to free memory in the failure cases.

Change-Id: I12c350131baff31e2c761d3480abccdf6d78fe0a
CRs-Fixed: 2063965
This commit is contained in:
yeshwanth sriram guntuka 2017-06-30 12:26:57 +05:30 • committed by snandini
commit 078310190d
1 changed files with 6 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

12
core/mac/src/pe/lim/lim_send_management_frames.c
View file

@ -1636,6 +1636,7 @@ lim_send_assoc_req_mgmt_frame(tpAniSirGlobal mac_ctx,
if (NULL == pe_session) {
pe_err("pe_session is NULL");
qdf_mem_free(mlm_assoc_req);
return;
}
@ -1644,6 +1645,7 @@ lim_send_assoc_req_mgmt_frame(tpAniSirGlobal mac_ctx,
/* check this early to avoid unncessary operation */
if (NULL == pe_session->pLimJoinReq) {
pe_err("pe_session->pLimJoinReq is NULL");
qdf_mem_free(mlm_assoc_req);
return;
}
add_ie_len = pe_session->pLimJoinReq->addIEAssoc.length;
@ -1652,6 +1654,7 @@ lim_send_assoc_req_mgmt_frame(tpAniSirGlobal mac_ctx,
frm = qdf_mem_malloc(sizeof(tDot11fAssocRequest));
if (NULL == frm) {
pe_err("Unable to allocate memory");
qdf_mem_free(mlm_assoc_req);
return;
}
qdf_mem_set((uint8_t *) frm, sizeof(tDot11fAssocRequest), 0);
@ -1947,8 +1950,7 @@ lim_send_assoc_req_mgmt_frame(tpAniSirGlobal mac_ctx,
lim_post_sme_message(mac_ctx, LIM_MLM_ASSOC_CNF,
(uint32_t *) &assoc_cnf);
qdf_mem_free(frm);
return;
goto end;
}
/* Paranoia: */
qdf_mem_set(frame, bytes, 0);
@ -1963,8 +1965,7 @@ lim_send_assoc_req_mgmt_frame(tpAniSirGlobal mac_ctx,
if (DOT11F_FAILED(status)) {
pe_err("Assoc request pack failure (0x%08x)", status);
cds_packet_free((void *)packet);
qdf_mem_free(frm);
return;
goto end;
} else if (DOT11F_WARNED(status)) {
pe_warn("Assoc request pack warning (0x%08x)", status);
}
@ -2024,9 +2025,8 @@ lim_send_assoc_req_mgmt_frame(tpAniSirGlobal mac_ctx,
pe_err("Failed to send Association Request (%X)!",
qdf_status);
/* Pkt will be freed up by the callback */
qdf_mem_free(frm);
return;
}
end:
/* Free up buffer allocated for mlm_assoc_req */
qdf_mem_free(mlm_assoc_req);
mlm_assoc_req = NULL;