diff --git a/core/mac/src/pe/lim/lim_process_sme_req_messages.c b/core/mac/src/pe/lim/lim_process_sme_req_messages.c index 356c73c8985e..c8aa31c1d053 100644 --- a/core/mac/src/pe/lim/lim_process_sme_req_messages.c +++ b/core/mac/src/pe/lim/lim_process_sme_req_messages.c @@ -3607,6 +3607,7 @@ static void __lim_process_roam_scan_offload_req(struct mac_context *mac_ctx, local_ie_buf = qdf_mem_malloc(MAX_DEFAULT_SCAN_IE_LEN); if (!local_ie_buf) { + qdf_mem_zero(req_buffer, sizeof(*req_buffer)); qdf_mem_free(req_buffer); return; } @@ -3634,6 +3635,7 @@ static void __lim_process_roam_scan_offload_req(struct mac_context *mac_ctx, status = wma_post_ctrl_msg(mac_ctx, &wma_msg); if (QDF_STATUS_SUCCESS != status) { pe_err("Posting WMA_ROAM_SCAN_OFFLOAD_REQ failed"); + qdf_mem_zero(req_buffer, sizeof(*req_buffer)); qdf_mem_free(req_buffer); } } diff --git a/core/mac/src/pe/lim/lim_security_utils.c b/core/mac/src/pe/lim/lim_security_utils.c index 1e9f0fb80c2e..4da4c923a60d 100644 --- a/core/mac/src/pe/lim/lim_security_utils.c +++ b/core/mac/src/pe/lim/lim_security_utils.c @@ -844,6 +844,8 @@ void lim_send_set_bss_key_req(struct mac_context *mac, /* Respond to SME with LIM_MLM_SETKEYS_CNF */ mlmSetKeysCnf.resultCode = eSIR_SME_HAL_SEND_MESSAGE_FAIL; + qdf_mem_zero(pSetBssKeyParams, sizeof(tSetBssKeyParams)); + qdf_mem_free(pSetBssKeyParams); } else return; /* Continue after WMA_SET_BSSKEY_RSP... */ diff --git a/core/sme/src/common/sme_api.c b/core/sme/src/common/sme_api.c index d7515344f116..4b328cc03aeb 100644 --- a/core/sme/src/common/sme_api.c +++ b/core/sme/src/common/sme_api.c @@ -6440,6 +6440,7 @@ QDF_STATUS sme_stop_roaming(mac_handle_t mac_handle, uint8_t session_id, if (QDF_STATUS_SUCCESS != status) { sme_err("WMA_ROAM_SCAN_OFFLOAD_REQ failed, session_id: %d", session_id); + qdf_mem_zero(req, sizeof(*req)); qdf_mem_free(req); return QDF_STATUS_E_FAULT; } diff --git a/core/sme/src/csr/csr_api_roam.c b/core/sme/src/csr/csr_api_roam.c index 1c50d400b1ca..3654ae826afa 100644 --- a/core/sme/src/csr/csr_api_roam.c +++ b/core/sme/src/csr/csr_api_roam.c @@ -16210,8 +16210,10 @@ QDF_STATUS csr_send_mb_set_context_req_msg(struct mac_context *mac, status = scheduler_post_message(QDF_MODULE_ID_SME, QDF_MODULE_ID_PE, QDF_MODULE_ID_PE, &msg); - if (QDF_IS_STATUS_ERROR(status)) + if (QDF_IS_STATUS_ERROR(status)) { + qdf_mem_zero(pMsg, msgLen); qdf_mem_free(pMsg); + } } while (0); return status; } diff --git a/core/wma/src/wma_mgmt.c b/core/wma/src/wma_mgmt.c index a345b3000a07..e2e13ce5e52f 100644 --- a/core/wma/src/wma_mgmt.c +++ b/core/wma/src/wma_mgmt.c @@ -2149,6 +2149,7 @@ static QDF_STATUS wma_setup_install_key_cmd(tp_wma_handle wma_handle, iface->is_waiting_for_key = false; end: + qdf_mem_zero(¶ms, sizeof(struct set_key_params)); return status; } #endif @@ -2380,6 +2381,8 @@ void wma_set_bsskey(tp_wma_handle wma_handle, tpSetBssKeyParams key_info) /* TODO: Should we wait till we get HTT_T2H_MSG_TYPE_SEC_IND? */ key_info->status = QDF_STATUS_SUCCESS; + qdf_mem_zero(&key_params, sizeof(struct wma_set_key_params)); + out: wma_send_msg_high_priority(wma_handle, WMA_SET_BSSKEY_RSP, (void *)key_info, 0); @@ -2603,6 +2606,7 @@ void wma_set_stakey(tp_wma_handle wma_handle, tpSetStaKeyParams key_info) /* TODO: Should we wait till we get HTT_T2H_MSG_TYPE_SEC_IND? */ key_info->status = QDF_STATUS_SUCCESS; out: + qdf_mem_zero(&key_params, sizeof(struct wma_set_key_params)); if (key_info->sendRsp) wma_send_msg_high_priority(wma_handle, WMA_SET_STAKEY_RSP, (void *)key_info, 0); diff --git a/core/wma/src/wma_scan_roam.c b/core/wma/src/wma_scan_roam.c index 1be44596efff..7361953a0c8d 100644 --- a/core/wma/src/wma_scan_roam.c +++ b/core/wma/src/wma_scan_roam.c @@ -398,6 +398,7 @@ QDF_STATUS wma_roam_scan_offload_mode(tp_wma_handle wma_handle, status = wmi_unified_roam_scan_offload_mode_cmd(wma_handle->wmi_handle, scan_cmd_fp, params); + qdf_mem_zero(params, sizeof(*params)); qdf_mem_free(params); if (QDF_IS_STATUS_ERROR(status)) return status; @@ -1532,6 +1533,7 @@ QDF_STATUS wma_process_roaming_config(tp_wma_handle wma_handle, if (!mac) { WMA_LOGE("%s: mac is NULL", __func__); + qdf_mem_zero(roam_req, sizeof(*roam_req)); qdf_mem_free(roam_req); return QDF_STATUS_E_FAILURE; } @@ -1540,6 +1542,7 @@ QDF_STATUS wma_process_roaming_config(tp_wma_handle wma_handle, /* roam scan offload is not enabled in firmware. * Cannot initialize it in the middle of connection. */ + qdf_mem_zero(roam_req, sizeof(*roam_req)); qdf_mem_free(roam_req); return QDF_STATUS_E_PERM; } @@ -1925,6 +1928,7 @@ QDF_STATUS wma_process_roaming_config(tp_wma_handle wma_handle, default: break; } + qdf_mem_zero(roam_req, sizeof(*roam_req)); qdf_mem_free(roam_req); return qdf_status; }