From 87ba364a2ccb3bc3f337623cb03df8a6aae773c3 Mon Sep 17 00:00:00 2001 From: Ashish Kumar Dhanotiya Date: Fri, 13 Aug 2021 19:17:00 +0530 Subject: [PATCH] qcacld-3.0: Do not free radio stats memory from wma Currently driver frees the radio stats memory from wma in error cases, there is a possibility that if hdd gets time out for the stats request, it tries to free the radio stats memory and at the same time if wma receives invalid stats from fw in that case wma also tries to free the radio stats memory which may lead to double free. To aoid above issue, do not free the radio stats memory from wma, in error cases hdd will free this memory after it gets time out. Change-Id: I6f6073a1a8e0be1b87efce288b7567e8fc8d69b0 CRs-Fixed: 3013842 --- core/wma/src/wma_utils.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/core/wma/src/wma_utils.c b/core/wma/src/wma_utils.c index 2c824a2bbd49..11fa4b46823a 100644 --- a/core/wma/src/wma_utils.c +++ b/core/wma/src/wma_utils.c @@ -2191,7 +2191,6 @@ static int wma_unified_link_radio_stats_event_handler(void *handle, * events may be spoofed. Drop all of them and report error. */ wma_err("Invalid following WMI_RADIO_LINK_STATS_EVENTID. Discarding this set"); - wma_unified_radio_tx_mem_free(handle); return -EINVAL; } @@ -2242,10 +2241,8 @@ static int wma_unified_link_radio_stats_event_handler(void *handle, channels_in_this_event = qdf_mem_malloc( radio_stats->num_channels * chan_stats_size); - if (!channels_in_this_event) { - wma_unified_radio_tx_mem_free(handle); + if (!channels_in_this_event) return -ENOMEM; - } chn_results = (struct wifi_channel_stats *)&channels_in_this_event[0]; @@ -2283,7 +2280,7 @@ static int wma_unified_link_radio_stats_event_handler(void *handle, channels_in_this_event, rs_results); if (status) { - wma_unified_radio_tx_mem_free(handle); + wma_err("Failed to copy channel stats"); return status; } }