From 7a03c02b36f7e2d0a297afdfdce677403a955a81 Mon Sep 17 00:00:00 2001 From: Jianmin Zhu Date: Fri, 26 Oct 2018 14:48:35 +0800 Subject: [PATCH] qcacld-3.0: Fix mem and timer leak when WMA_DELETE_BSS_REQ timeout In wma_vdev_resp_timer(), while handling WMA_DELETE_BSS_REQ if wma_crash_on_fw_timeout() is true, SSR is triggered, but timer event_timeout isn't destroyed, wma_target_req, and user_data isn't freed, result in timer and mem leak. Change-Id: Ic47af43de671d195c6addd0360b96305af15d9bf CRs-Fixed: 2337211 --- core/wma/src/wma_dev_if.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/core/wma/src/wma_dev_if.c b/core/wma/src/wma_dev_if.c index dc27356f427d..18d7363cb8b8 100644 --- a/core/wma/src/wma_dev_if.c +++ b/core/wma/src/wma_dev_if.c @@ -3603,18 +3603,23 @@ void wma_vdev_resp_timer(void *data) if (wma_crash_on_fw_timeout(wma->fw_timeout_crash) == true) { wma_trigger_recovery_assert_on_fw_timeout( WMA_DELETE_BSS_REQ); - return; + wma_cleanup_target_req_param(tgt_req); + goto free_tgt_req; } status = wma_remove_bss_peer(wma, pdev, tgt_req, tgt_req->vdev_id, params); - if (status != 0) + if (status != 0) { + wma_cleanup_target_req_param(tgt_req); goto free_tgt_req; + } if (wmi_service_enabled( wma->wmi_handle, - wmi_service_sync_delete_cmds)) + wmi_service_sync_delete_cmds)) { + wma_cleanup_target_req_param(tgt_req); goto free_tgt_req; + } if (wma_send_vdev_down_to_fw(wma, tgt_req->vdev_id) != QDF_STATUS_SUCCESS) {