From 078310190d3dd2fca1abc1bc1d2f6ce20d17e722 Mon Sep 17 00:00:00 2001
From: yeshwanth sriram guntuka <ysriramg@codeaurora.org>
Date: Fri, 30 Jun 2017 12:26:57 +0530
Subject: [PATCH] qcacld-3.0: Fix memory leak in lim_send_assoc_req_mgmt_frame

Assoc request buffer is not freed in
lim_send_assoc_req_mgmt_frame in failure cases

Fix is to free memory in the failure cases.

Change-Id: I12c350131baff31e2c761d3480abccdf6d78fe0a
CRs-Fixed: 2063965
---
 core/mac/src/pe/lim/lim_send_management_frames.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/core/mac/src/pe/lim/lim_send_management_frames.c b/core/mac/src/pe/lim/lim_send_management_frames.c
index 44f0d72c048e..bdffb96e1324 100644
--- a/core/mac/src/pe/lim/lim_send_management_frames.c
+++ b/core/mac/src/pe/lim/lim_send_management_frames.c
@@ -1636,6 +1636,7 @@ lim_send_assoc_req_mgmt_frame(tpAniSirGlobal mac_ctx,
 
 	if (NULL == pe_session) {
 		pe_err("pe_session is NULL");
+		qdf_mem_free(mlm_assoc_req);
 		return;
 	}
 
@@ -1644,6 +1645,7 @@ lim_send_assoc_req_mgmt_frame(tpAniSirGlobal mac_ctx,
 	/* check this early to avoid unncessary operation */
 	if (NULL == pe_session->pLimJoinReq) {
 		pe_err("pe_session->pLimJoinReq is NULL");
+		qdf_mem_free(mlm_assoc_req);
 		return;
 	}
 	add_ie_len = pe_session->pLimJoinReq->addIEAssoc.length;
@@ -1652,6 +1654,7 @@ lim_send_assoc_req_mgmt_frame(tpAniSirGlobal mac_ctx,
 	frm = qdf_mem_malloc(sizeof(tDot11fAssocRequest));
 	if (NULL == frm) {
 		pe_err("Unable to allocate memory");
+		qdf_mem_free(mlm_assoc_req);
 		return;
 	}
 	qdf_mem_set((uint8_t *) frm, sizeof(tDot11fAssocRequest), 0);
@@ -1947,8 +1950,7 @@ lim_send_assoc_req_mgmt_frame(tpAniSirGlobal mac_ctx,
 		lim_post_sme_message(mac_ctx, LIM_MLM_ASSOC_CNF,
 			(uint32_t *) &assoc_cnf);
 
-		qdf_mem_free(frm);
-		return;
+		goto end;
 	}
 	/* Paranoia: */
 	qdf_mem_set(frame, bytes, 0);
@@ -1963,8 +1965,7 @@ lim_send_assoc_req_mgmt_frame(tpAniSirGlobal mac_ctx,
 	if (DOT11F_FAILED(status)) {
 		pe_err("Assoc request pack failure (0x%08x)", status);
 		cds_packet_free((void *)packet);
-		qdf_mem_free(frm);
-		return;
+		goto end;
 	} else if (DOT11F_WARNED(status)) {
 		pe_warn("Assoc request pack warning (0x%08x)", status);
 	}
@@ -2024,9 +2025,8 @@ lim_send_assoc_req_mgmt_frame(tpAniSirGlobal mac_ctx,
 		pe_err("Failed to send Association Request (%X)!",
 			qdf_status);
 		/* Pkt will be freed up by the callback */
-		qdf_mem_free(frm);
-		return;
 	}
+end:
 	/* Free up buffer allocated for mlm_assoc_req */
 	qdf_mem_free(mlm_assoc_req);
 	mlm_assoc_req = NULL;