From 2afb6f5c96bd3c58871d3b1532a035995f422487 Mon Sep 17 00:00:00 2001 From: Dustin Brown Date: Fri, 2 Dec 2016 14:47:48 -0800 Subject: [PATCH] qcacld-3.0: Fix memory leaks when WMI send fails Calls to wmi_unified_cmd_send() do not cleanup the passed buffer on failure. Ensure all calls to wmi_unified_cmd_send() handle the failure case and free the passed buffer. Change-Id: I222bfbafc7e1f2eb0e11a54775a5d01a7a339521 CRs-Fixed: 1100325 --- core/wma/src/wma_features.c | 8 ++++++++ core/wma/src/wma_scan_roam.c | 2 +- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/core/wma/src/wma_features.c b/core/wma/src/wma_features.c index 17f1eb31186d..b8af3dbc7f96 100644 --- a/core/wma/src/wma_features.c +++ b/core/wma/src/wma_features.c @@ -5558,6 +5558,8 @@ QDF_STATUS wma_process_get_peer_info_req ret = wmi_unified_cmd_send(wma->wmi_handle, buf, len, WMI_PEER_INFO_REQ_CMDID); + if (ret != QDF_STATUS_SUCCESS) + wmi_buf_free(buf); WMA_LOGE("IBSS get peer info cmd sent len: %d, vdev %d" " command id: %d, status: %d", len, @@ -5649,6 +5651,8 @@ QDF_STATUS wma_process_rmc_enable_ind(tp_wma_handle wma) ret = wmi_unified_cmd_send(wma->wmi_handle, buf, len, WMI_RMC_SET_MODE_CMDID); + if (ret != QDF_STATUS_SUCCESS) + wmi_buf_free(buf); WMA_LOGE("Enable RMC cmd sent len: %d, vdev %d" " command id: %d," " status: %d", len, vdev_id, WMI_RMC_SET_MODE_CMDID, ret); @@ -5699,6 +5703,8 @@ QDF_STATUS wma_process_rmc_disable_ind(tp_wma_handle wma) ret = wmi_unified_cmd_send(wma->wmi_handle, buf, len, WMI_RMC_SET_MODE_CMDID); + if (ret != QDF_STATUS_SUCCESS) + wmi_buf_free(buf); WMA_LOGE("Disable RMC cmd sent len: %d, vdev %d" " command id: %d," " status: %d", len, vdev_id, WMI_RMC_SET_MODE_CMDID, ret); @@ -5762,6 +5768,8 @@ QDF_STATUS wma_process_rmc_action_period_ind(tp_wma_handle wma) ret = wmi_unified_cmd_send(wma->wmi_handle, buf, len, WMI_RMC_SET_ACTION_PERIOD_CMDID); + if (ret != QDF_STATUS_SUCCESS) + wmi_buf_free(buf); WMA_LOGE("RMC action period %d cmd sent len: %d, vdev %d" " command id: %d, status: %d", periodicity_msec, diff --git a/core/wma/src/wma_scan_roam.c b/core/wma/src/wma_scan_roam.c index 7c1f7f0dfb8e..f92d48768da1 100644 --- a/core/wma/src/wma_scan_roam.c +++ b/core/wma/src/wma_scan_roam.c @@ -2812,7 +2812,7 @@ static QDF_STATUS wma_switch_channel(tp_wma_handle wma, if (ret < 0) { WMA_LOGP("%s: Failed to send vdev start command", __func__); - qdf_nbuf_free(buf); + wmi_buf_free(buf); return QDF_STATUS_E_FAILURE; }