From 8f4aa18225c5f640a811cd744d90ea667911af0f Mon Sep 17 00:00:00 2001
From: Abhishek Singh <absingh@codeaurora.org>
Date: Wed, 6 Mar 2019 10:29:24 +0530
Subject: [PATCH] qcacld-3.0: Fix vdev ref leak in P2P-GO during SSR

If P2P-GO is active and SSR happens the vdev ref coount taken
by sap_ctx is not released and this lead to ref count leak.

To fix this release vdev ref count for sap_ctx in
hdd_reset_all_adapters().

Change-Id: Id35247a917f3e0c3e163ea00a7a850cdf28ddd80
CRs-Fixed: 2410121
---
 core/hdd/src/wlan_hdd_main.c |  6 ++++++
 core/sap/inc/sap_api.h       |  8 ++++++++
 core/sap/src/sap_module.c    | 15 +++++++++++++--
 3 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/core/hdd/src/wlan_hdd_main.c b/core/hdd/src/wlan_hdd_main.c
index cb67e59bffb5..0b4bbaeb714e 100644
--- a/core/hdd/src/wlan_hdd_main.c
+++ b/core/hdd/src/wlan_hdd_main.c
@@ -5805,6 +5805,12 @@ QDF_STATUS hdd_reset_all_adapters(struct hdd_context *hdd_ctx)
 				WLAN_HDD_GET_SAP_CTX_PTR(adapter));
 		}
 
+		/* Release vdev ref count to avoid vdev object leak */
+		if (adapter->device_mode == QDF_P2P_GO_MODE ||
+		    adapter->device_mode == QDF_SAP_MODE)
+			wlansap_release_vdev_ref(
+				WLAN_HDD_GET_SAP_CTX_PTR(adapter));
+
 		/* Delete connection peers if any to avoid peer object leaks */
 		if (adapter->device_mode == QDF_STA_MODE ||
 		    adapter->device_mode == QDF_P2P_CLIENT_MODE) {
diff --git a/core/sap/inc/sap_api.h b/core/sap/inc/sap_api.h
index 1695559c7d43..dcdb60883444 100644
--- a/core/sap/inc/sap_api.h
+++ b/core/sap/inc/sap_api.h
@@ -1303,6 +1303,14 @@ uint32_t wlansap_get_chan_width(struct sap_context *sap_ctx);
  */
 QDF_STATUS wlansap_set_invalid_session(struct sap_context *sap_ctx);
 
+/*
+ * wlansap_set_invalid_session() - Release vdev ref taken by sap context
+ * @sap_ctx: pointer to the SAP context
+ *
+ * Return: QDF_STATUS
+ */
+QDF_STATUS wlansap_release_vdev_ref(struct sap_context *sap_ctx);
+
 /**
  * sap_get_cac_dur_dfs_region() - get cac duration and dfs region.
  * @sap_ctxt: sap context
diff --git a/core/sap/src/sap_module.c b/core/sap/src/sap_module.c
index 8c7035d8428c..faadb489fab8 100644
--- a/core/sap/src/sap_module.c
+++ b/core/sap/src/sap_module.c
@@ -2441,13 +2441,24 @@ QDF_STATUS wlansap_set_invalid_session(struct sap_context *sap_ctx)
 		return QDF_STATUS_E_FAILURE;
 	}
 
-	sap_release_vdev_ref(sap_ctx);
-
 	sap_ctx->sessionId = CSR_SESSION_ID_INVALID;
 
 	return QDF_STATUS_SUCCESS;
 }
 
+QDF_STATUS wlansap_release_vdev_ref(struct sap_context *sap_ctx)
+{
+	if (!sap_ctx) {
+		QDF_TRACE(QDF_MODULE_ID_SAP, QDF_TRACE_LEVEL_ERROR,
+			  FL("Invalid SAP pointer"));
+		return QDF_STATUS_E_FAILURE;
+	}
+
+	sap_release_vdev_ref(sap_ctx);
+
+	return QDF_STATUS_SUCCESS;
+}
+
 void wlansap_cleanup_cac_timer(struct sap_context *sap_ctx)
 {
 	struct mac_context *mac;