A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 08:36:12 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix memory leak in OEM data request

Browse source 
Fix memory leak in OEM data request, by freeing data buffer as message
passed down the layers is consumed in lower layers.

Change-Id: I8e8dc0c96de3055fada2c19139bc9e0c03b9e73e
CRs-Fixed: 964290
This commit is contained in:
Naveen Rawat 2016-01-19 17:26:00 -08:00 • committed by Akash Patel
commit 504adcee54
3 changed files with 9 additions and 36 deletions
Download patch file Download diff file Expand all files Collapse all files

3
core/mac/src/pe/lim/lim_process_sme_req_messages.c
View file

@ -1466,7 +1466,8 @@ static void __lim_process_sme_oem_data_req(tpAniSirGlobal pMac, uint32_t *pMsgBu
pMlmOemDataReq->data_len = pOemDataReq->data_len;
cdf_mem_copy(pMlmOemDataReq->data, pOemDataReq->data,
pOemDataReq->data_len);
/* buffer from SME copied, free it now */
cdf_mem_free(pOemDataReq->data);
/* Issue LIM_MLM_OEM_DATA_REQ to MLM */
lim_post_mlm_message(pMac, LIM_MLM_OEM_DATA_REQ,
(uint32_t *) pMlmOemDataReq);

1
core/sme/inc/oem_data_internal.h
View file

@ -51,7 +51,6 @@ typedef struct tagOemDataStruct {
/* context of the original caller */
void *pContext;
uint32_t oemDataReqID; /* original request ID */
tOemDataReqConfig oemDataReqConfig; /* current oem data request */
uint8_t sessionId; /* Session on which oem data req is active */
/* callback for sending data response to oem application */
sme_send_oem_data_rsp_msg oem_data_rsp_callback;

41
core/sme/src/oem_data/oem_data_api.c
View file

@ -140,7 +140,7 @@ CDF_STATUS oem_data_oem_data_req(tHalHandle hHal,
CDF_STATUS status = CDF_STATUS_SUCCESS;
tpAniSirGlobal pMac = PMAC_STRUCT(hHal);
tSmeCmd *pOemDataCmd = NULL;
tOemDataReq *cmd_req, *mac_req;
tOemDataReq *cmd_req;
do {
if (!CSR_IS_SESSION_VALID(pMac, sessionId)) {
@ -148,29 +148,8 @@ CDF_STATUS oem_data_oem_data_req(tHalHandle hHal,
break;
}
pMac->oemData.oemDataReqConfig.sessionId = sessionId;
pMac->oemData.oemDataReqID = *(pOemDataReqID);
pMac->oemData.oemDataReqConfig.data_len =
oemDataReqConfig->data_len;
if (pMac->oemData.oemDataReqConfig.data) {
cdf_mem_free(pMac->oemData.oemDataReqConfig.data);
pMac->oemData.oemDataReqConfig.data = NULL;
}
pMac->oemData.oemDataReqConfig.data =
cdf_mem_malloc(pMac->oemData.oemDataReqConfig.data_len);
if (!pMac->oemData.oemDataReqConfig.data) {
sms_log(pMac, LOGE, FL("memory alloc failed"));
status = CDF_STATUS_E_NOMEM;
break;
}
cdf_mem_copy((void *)(pMac->oemData.oemDataReqConfig.data),
(void *)(oemDataReqConfig->data),
oemDataReqConfig->data_len);
pMac->oemData.oemDataReqActive = false;
pOemDataCmd = sme_get_command_buffer(pMac);
@ -183,10 +162,9 @@ CDF_STATUS oem_data_oem_data_req(tHalHandle hHal,
cmd_req = &(pOemDataCmd->u.oemDataCmd.oemDataReq);
mac_req = &(pMac->oemData.oemDataReqConfig);
/* set the oem data request */
cmd_req->sessionId = mac_req->sessionId;
cmd_req->data_len = mac_req->data_len;
cmd_req->sessionId = sessionId;
cmd_req->data_len = oemDataReqConfig->data_len;
cmd_req->data = cdf_mem_malloc(cmd_req->data_len);
if (!cmd_req->data) {
@ -196,7 +174,7 @@ CDF_STATUS oem_data_oem_data_req(tHalHandle hHal,
}
cdf_mem_copy((void *)(cmd_req->data),
(void *)(mac_req->data),
(void *)(oemDataReqConfig->data),
cmd_req->data_len);
} else {
status = CDF_STATUS_E_FAILURE;
@ -247,20 +225,15 @@ CDF_STATUS oem_data_send_mb_oem_data_req(tpAniSirGlobal pMac,
sms_log(pMac, LOGP, FL("cdf_mem_malloc failed"));
return CDF_STATUS_E_NOMEM;
}
pMsg->data = cdf_mem_malloc(pOemDataReq->data_len);
if (!pMsg->data) {
sms_log(pMac, LOGP, FL("cdf_mem_malloc failed"));
cdf_mem_free(pMsg);
return CDF_STATUS_E_NOMEM;
}
msgLen = (uint16_t) (sizeof(*pMsg) + pOemDataReq->data_len);
pMsg->messageType = eWNI_SME_OEM_DATA_REQ;
pMsg->messageLen = msgLen;
cdf_copy_macaddr(&pMsg->selfMacAddr, &pSession->selfMacAddr);
pMsg->data_len = pOemDataReq->data_len;
cdf_mem_copy(pMsg->data, pOemDataReq->data,
pOemDataReq->data_len);
pMsg->data = pOemDataReq->data;
/* Incoming buffer ptr saved, set to null to avoid free by caller */
pOemDataReq->data = NULL;
sms_log(pMac, LOGW, "OEM_DATA: sending message to pe%s", __func__);
status = cds_send_mb_message_to_mac(pMsg);