From 4c5948f09c3384c893768ef3652815c3d1eb4214 Mon Sep 17 00:00:00 2001
From: Tushnim Bhattacharyya <tushnimb@codeaurora.org>
Date: Tue, 15 Dec 2020 14:57:00 -0800
Subject: [PATCH] qcacld-3.0: Release resource after TDLS cmd processing

It doesn't free resources in failed cases like getting vdev or tdls
vdev object when handling tdls commands. This causes reference
count of psoc leak or memory leak. Following are the functions,

tdls_set_responder
tdls_notify_sta_connect
tdls_notify_sta_disconnect
tdls_set_operation_mode
tdls_reset_all_peers

Change-Id: I8b5d5fa8a137a1b07f0fa6e4667047db95d7b99e
CRs-Fixed: 2839099
---
 .../tdls/core/src/wlan_tdls_cmds_process.c    | 17 +++++++++----
 components/tdls/core/src/wlan_tdls_main.c     | 24 ++++++++++++++++---
 2 files changed, 34 insertions(+), 7 deletions(-)

diff --git a/components/tdls/core/src/wlan_tdls_cmds_process.c b/components/tdls/core/src/wlan_tdls_cmds_process.c
index cccf32e66ce8..265b58c1b105 100644
--- a/components/tdls/core/src/wlan_tdls_cmds_process.c
+++ b/components/tdls/core/src/wlan_tdls_cmds_process.c
@@ -2104,22 +2104,31 @@ int tdls_process_set_responder(struct tdls_set_responder_req *set_req)
  */
 int tdls_set_responder(struct tdls_set_responder_req *set_req)
 {
-	QDF_STATUS status;
+	int status;
 
-	if (!set_req || !set_req->vdev) {
+	if (!set_req) {
+		tdls_err("Invalid input params");
+		return  -EINVAL;
+	}
+
+	if (!set_req->vdev) {
 		tdls_err("Invalid input params %pK", set_req);
-		return -EINVAL;
+		status = -EINVAL;
+		goto free_req;
 	}
 
 	status = wlan_objmgr_vdev_try_get_ref(set_req->vdev, WLAN_TDLS_NB_ID);
 	if (QDF_STATUS_SUCCESS != status) {
 		tdls_err("vdev object is deleted");
-		return -EINVAL;
+		status = -EINVAL;
+		goto error;
 	}
 
 	status = tdls_process_set_responder(set_req);
 
+error:
 	wlan_objmgr_vdev_release_ref(set_req->vdev, WLAN_TDLS_NB_ID);
+free_req:
 	qdf_mem_free(set_req);
 	return status;
 }
diff --git a/components/tdls/core/src/wlan_tdls_main.c b/components/tdls/core/src/wlan_tdls_main.c
index 57e5fe5da468..a08bba0e9a39 100644
--- a/components/tdls/core/src/wlan_tdls_main.c
+++ b/components/tdls/core/src/wlan_tdls_main.c
@@ -554,6 +554,7 @@ static QDF_STATUS tdls_reset_all_peers(
 
 	if (!delete_all_peers_ind || !delete_all_peers_ind->vdev) {
 		tdls_err("invalid param");
+		qdf_mem_free(delete_all_peers_ind);
 		return QDF_STATUS_E_INVAL;
 	}
 
@@ -1243,11 +1244,17 @@ QDF_STATUS tdls_notify_sta_connect(struct tdls_sta_notify_params *notify)
 {
 	QDF_STATUS status;
 
-	if (!notify || !notify->vdev) {
+	if (!notify) {
 		tdls_err("invalid param");
 		return QDF_STATUS_E_INVAL;
 	}
 
+	if (!notify->vdev) {
+		tdls_err("invalid param");
+		qdf_mem_free(notify);
+		return QDF_STATUS_E_INVAL;
+	}
+
 	status = tdls_process_sta_connect(notify);
 
 	wlan_objmgr_vdev_release_ref(notify->vdev, WLAN_TDLS_NB_ID);
@@ -1333,11 +1340,17 @@ QDF_STATUS tdls_notify_sta_disconnect(struct tdls_sta_notify_params *notify)
 {
 	QDF_STATUS status;
 
-	if (!notify || !notify->vdev) {
+	if (!notify) {
 		tdls_err("invalid param");
 		return QDF_STATUS_E_INVAL;
 	}
 
+	if (!notify->vdev) {
+		tdls_err("invalid param");
+		qdf_mem_free(notify);
+		return QDF_STATUS_E_INVAL;
+	}
+
 	status = tdls_process_sta_disconnect(notify);
 
 	wlan_objmgr_vdev_release_ref(notify->vdev, WLAN_TDLS_NB_ID);
@@ -1620,9 +1633,14 @@ QDF_STATUS tdls_set_operation_mode(struct tdls_set_mode_params *tdls_set_mode)
 	struct tdls_vdev_priv_obj *tdls_vdev;
 	QDF_STATUS status;
 
-	if (!tdls_set_mode || !tdls_set_mode->vdev)
+	if (!tdls_set_mode)
 		return QDF_STATUS_E_INVAL;
 
+	if (!tdls_set_mode->vdev) {
+		qdf_mem_free(tdls_set_mode);
+		return QDF_STATUS_E_INVAL;
+	}
+
 	status = tdls_get_vdev_objects(tdls_set_mode->vdev,
 				       &tdls_vdev, &tdls_soc);