From 9323e8559bfe7f2cfe2f1a649361d777ce4f05d0 Mon Sep 17 00:00:00 2001 From: Will Huang Date: Fri, 2 Feb 2018 17:55:15 +0800 Subject: [PATCH] qcacld-3.0: Add msg.flush_callback for wma_send_msg_by_priority If wma_send_msg with msg_type WMA_SET_LINK_STATE_RSP, tpLinkStateParams params has a member callbackArg which is malloc from heap. If this message is flushed when driver unload, because no msg.flush_callback is supplied, the flush just free msg->bodyptr and callbackArg got leak. Fix it by supply a flush_callback as wma_discard_fw_event, and minor change to avoid NULL pointer access. Change-Id: Ie979a1e83cbd7c87e5bbb08382ae2af3230a13db CRs-Fixed: 2181458 --- core/wma/src/wma_main.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/core/wma/src/wma_main.c b/core/wma/src/wma_main.c index d7f946b4efeb..f2d07caf9384 100644 --- a/core/wma/src/wma_main.c +++ b/core/wma/src/wma_main.c @@ -1775,6 +1775,9 @@ QDF_STATUS wma_process_hal_pwr_dbg_cmd(WMA_HANDLE handle, static void wma_discard_fw_event(struct scheduler_msg *msg) { + if (!msg->bodyptr) + return; + switch (msg->type) { case WMA_PROCESS_FW_EVENT: qdf_nbuf_free(((wma_process_fw_event_params *)msg->bodyptr) @@ -1784,8 +1787,8 @@ static void wma_discard_fw_event(struct scheduler_msg *msg) qdf_mem_free(((tpLinkStateParams) msg->bodyptr)->callbackArg); break; } - if (msg->bodyptr) - qdf_mem_free(msg->bodyptr); + + qdf_mem_free(msg->bodyptr); msg->bodyptr = NULL; msg->bodyval = 0; msg->type = 0; @@ -3402,6 +3405,7 @@ void wma_send_msg_by_priority(tp_wma_handle wma_handle, uint16_t msg_type, msg.type = msg_type; msg.bodyval = body_val; msg.bodyptr = body_ptr; + msg.flush_callback = wma_discard_fw_event; status = scheduler_post_msg_by_priority(QDF_MODULE_ID_PE, &msg, is_high_priority);