From 72a1c609afd1a5b8c0a85ceca9c0997fef286f79 Mon Sep 17 00:00:00 2001 From: Ankit Gupta Date: Mon, 10 Oct 2016 10:15:59 -0700 Subject: [PATCH] qcacld-3.0: Fix double free memory in sme_power_save.c In sme_ps_enter_wowl_req_params() and sme_ps_exit_wowl_req_params(), if call to sme_post_ps_msg_to_wma() fails, both caller and callee frees the message buffer causing double free of memory. Do not free the memory again in caller function if sme_post_ps_msg_to_wma returns error. Change-Id: I92bab9477a07016c44f099e4286178c9d5487a4c CRs-Fixed: 1076087 --- core/sme/src/common/sme_power_save.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/core/sme/src/common/sme_power_save.c b/core/sme/src/common/sme_power_save.c index 59d4cc962fd9..48b298c653d6 100644 --- a/core/sme/src/common/sme_power_save.c +++ b/core/sme/src/common/sme_power_save.c @@ -394,8 +394,9 @@ static QDF_STATUS sme_ps_enter_wowl_req_params(tpAniSirGlobal mac_ctx, QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_INFO, FL("Msg WMA_WOWL_ENTER_REQ Successfully sent to WMA")); return QDF_STATUS_SUCCESS; - } else - goto end; + } else { + return QDF_STATUS_E_FAILURE; + } end: if (hal_wowl_params != NULL) @@ -429,10 +430,9 @@ static QDF_STATUS sme_ps_exit_wowl_req_params(tpAniSirGlobal mac_ctx, QDF_TRACE(QDF_MODULE_ID_SME, QDF_TRACE_LEVEL_INFO, FL("Msg WMA_WOWL_EXIT_REQ Successfully sent to WMA")); return QDF_STATUS_SUCCESS; + } else { + return QDF_STATUS_E_FAILURE; } - if (hal_wowl_msg != NULL) - qdf_mem_free(hal_wowl_msg); - return QDF_STATUS_E_FAILURE; } /**