From 82bcd76a118ae5d3d785cb455d2490ca81642d76 Mon Sep 17 00:00:00 2001
From: Abhishek Singh <absingh@codeaurora.org>
Date: Fri, 1 Mar 2019 10:59:29 +0530
Subject: [PATCH] qcacld-3.0: Fix mem leak for rrm channel list

In rrm scan response if IterMeasTimer fails to start the rrm channel list
is not freed. Similarly during rrm close if IterMeasTimer was running the
rrm channel list is not freed.

Free rrm channel list in rrm close and if IterMeasTimer fails to start.

Change-Id: I0ec18759dc81910755bda83d09f5106f8dd17937
CRs-Fixed: 2407417
---
 core/sme/src/rrm/sme_rrm.c | 39 ++++++++++++++++++++++++++++++++++----
 1 file changed, 35 insertions(+), 4 deletions(-)

diff --git a/core/sme/src/rrm/sme_rrm.c b/core/sme/src/rrm/sme_rrm.c
index cca594aac344..d5a8191c795b 100644
--- a/core/sme/src/rrm/sme_rrm.c
+++ b/core/sme/src/rrm/sme_rrm.c
@@ -396,6 +396,18 @@ static QDF_STATUS sme_ese_send_beacon_req_scan_results(
 	return status;
 }
 
+static inline
+void sme_reset_ese_bcn_req_in_progress(tpRrmSMEContext sme_rrm_ctx)
+{
+	if (sme_rrm_ctx)
+		sme_rrm_ctx->eseBcnReqInProgress = false;
+}
+
+#else
+
+static inline
+void sme_reset_ese_bcn_req_in_progress(tpRrmSMEContext sme_rrm_ctx)
+{}
 #endif /* FEATURE_WLAN_ESE */
 
 /**
@@ -639,6 +651,7 @@ static QDF_STATUS sme_rrm_scan_request_callback(mac_handle_t mac_handle,
 	struct mac_context *mac = MAC_CONTEXT(mac_handle);
 	tpRrmSMEContext pSmeRrmContext = &mac->rrm.rrmSmeContext;
 	uint32_t time_tick;
+	QDF_STATUS qdf_status;
 
 	/* if any more channels are pending, start a timer of a random value
 	 * within randomization interval.
@@ -661,7 +674,13 @@ static QDF_STATUS sme_rrm_scan_request_callback(mac_handle_t mac_handle,
 			time_tick % (pSmeRrmContext->randnIntvl - 10 + 1) + 10;
 
 		sme_debug("Set timer for interval %d ", interval);
-		qdf_mc_timer_start(&pSmeRrmContext->IterMeasTimer, interval);
+		qdf_status = qdf_mc_timer_start(&pSmeRrmContext->IterMeasTimer,
+						interval);
+		if (QDF_IS_STATUS_ERROR(qdf_status)) {
+			qdf_mem_free(pSmeRrmContext->channelList.ChannelList);
+			pSmeRrmContext->channelList.ChannelList = NULL;
+			sme_reset_ese_bcn_req_in_progress(pSmeRrmContext);
+		}
 
 	} else {
 		/* Done with the measurement. Clean up all context and send a
@@ -673,9 +692,8 @@ static QDF_STATUS sme_rrm_scan_request_callback(mac_handle_t mac_handle,
 					->currentIndex],
 					 true);
 		qdf_mem_free(pSmeRrmContext->channelList.ChannelList);
-#ifdef FEATURE_WLAN_ESE
-		pSmeRrmContext->eseBcnReqInProgress = false;
-#endif
+		pSmeRrmContext->channelList.ChannelList = NULL;
+		sme_reset_ese_bcn_req_in_progress(pSmeRrmContext);
 	}
 
 	return QDF_STATUS_SUCCESS;
@@ -943,6 +961,10 @@ QDF_STATUS sme_rrm_process_beacon_report_req_ind(struct mac_context *mac,
 	     && (pBeaconReq->channelList.numChannels == 0))) {
 		/* Add all the channel in the regulatory domain. */
 		len = mac->mlme_cfg->reg.valid_channel_list_num;
+		if (pSmeRrmContext->channelList.ChannelList) {
+			qdf_mem_free(pSmeRrmContext->channelList.ChannelList);
+			pSmeRrmContext->channelList.ChannelList = NULL;
+		}
 		pSmeRrmContext->channelList.ChannelList = qdf_mem_malloc(len);
 		if (!pSmeRrmContext->channelList.ChannelList)
 			return QDF_STATUS_E_NOMEM;
@@ -963,6 +985,10 @@ QDF_STATUS sme_rrm_process_beacon_report_req_ind(struct mac_context *mac,
 
 		len += pBeaconReq->channelList.numChannels;
 
+		if (pSmeRrmContext->channelList.ChannelList) {
+			qdf_mem_free(pSmeRrmContext->channelList.ChannelList);
+			pSmeRrmContext->channelList.ChannelList = NULL;
+		}
 		pSmeRrmContext->channelList.ChannelList = qdf_mem_malloc(len);
 		if (!pSmeRrmContext->channelList.ChannelList)
 			return QDF_STATUS_E_NOMEM;
@@ -1502,6 +1528,11 @@ QDF_STATUS rrm_close(struct mac_context *mac)
 		}
 	}
 
+	if (pSmeRrmContext->channelList.ChannelList) {
+		qdf_mem_free(pSmeRrmContext->channelList.ChannelList);
+		pSmeRrmContext->channelList.ChannelList = NULL;
+	}
+
 	qdf_status = qdf_mc_timer_destroy(&pSmeRrmContext->IterMeasTimer);
 	if (!QDF_IS_STATUS_SUCCESS(qdf_status)) {