A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-12 07:37:31 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix memory leak issue of ch_list in sap_get_channel_list

Browse source 
In the api sap_get_channel_list, list is allocated memory to store the
channel list to be sent for scan request. This api is called by
sap_goto_channel_sel which initializes scan_request.ChannelInfo.ChannelList
to channel_list, without any prior NULL check of channel_list.
Also in scan callback wlansap_scan_callback, if the state machine structure
is in disconnected state , the host returns without freeing the memory
allocated to the channel list in sap_ctx .

Fix is to free the memory allocated to the channel list
and make the sap_ctx->channellist, sap_ctx->num_of_channel
as NULL and zero respectively in both the instances.

Change-Id: Ia54287d6e77e206c717bd3c205ebe57510ea801c
CRs-Fixed: 2159489
This commit is contained in:
gaurank kathpalia 2017-12-19 20:57:55 +05:30 • committed by snandini
commit 16a721a680
2 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
core/sap/src/sap_api_link_cntl.c
View file

@ -110,6 +110,11 @@ QDF_STATUS wlansap_scan_callback(tHalHandle hal_handle,
if (sap_ctx->sapsMachine == eSAP_DISCONNECTED) {
QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_WARN,
"In %s BSS already stopped", __func__);
if (sap_ctx->channelList != NULL) {
qdf_mem_free(sap_ctx->channelList);
sap_ctx->channelList = NULL;
sap_ctx->num_of_channel = 0;
}
return QDF_STATUS_E_FAILURE;
}

5
core/sap/src/sap_fsm.c
View file

@ -1835,6 +1835,11 @@ QDF_STATUS sap_goto_channel_sel(struct sap_context *sap_context,
for (i = 0; i < num_of_channels; i++)
req->scan_req.chan_list.chan[i].freq =
wlan_chan_to_freq(channel_list[i]);
if (sap_context->channelList) {
qdf_mem_free(sap_context->channelList);
sap_context->channelList = NULL;
sap_context->num_of_channel = 0;
}
sap_context->channelList = channel_list;
sap_context->num_of_channel = num_of_channels;
/* Set requestType to Full scan */