A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 07:03:09 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix double free of memory

Browse source 
Remove freeing of msg from helper function lim_delete_sta_util, since
caller of that will free the msg buffer at the end of function.

Change-Id: I2e0ee43dda9d5e30e86c4033eba934e4d7938887
CRs-Fixed: 1066025
This commit is contained in:
Naveen Rawat 2016-09-13 11:18:34 -07:00 • committed by qcabuildsw
commit a82fd5caa6
1 changed files with 1 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

6
core/mac/src/pe/lim/lim_link_monitoring_algo.c
View file

@ -76,7 +76,6 @@ static void lim_delete_sta_util(tpAniSirGlobal mac_ctx, tpDeleteStaContext msg,
msg->staId, msg->reasonCode);
if (LIM_IS_IBSS_ROLE(session_entry)) {
qdf_mem_free(msg);
return;
}
@ -87,7 +86,6 @@ static void lim_delete_sta_util(tpAniSirGlobal mac_ctx, tpDeleteStaContext msg,
lim_log(mac_ctx, LOGE,
FL("Invalid STA limSystemRole=%d"),
GET_LIM_SYSTEM_ROLE(session_entry));
qdf_mem_free(msg);
return;
}
stads->del_sta_ctx_rssi = msg->rssi;
@ -98,7 +96,6 @@ static void lim_delete_sta_util(tpAniSirGlobal mac_ctx, tpDeleteStaContext msg,
if (stads->staIndex != msg->staId) {
lim_log(mac_ctx, LOGE, FL("staid mismatch: %d vs %d "),
stads->staIndex, msg->staId);
qdf_mem_free(msg);
return;
}
@ -122,7 +119,6 @@ static void lim_delete_sta_util(tpAniSirGlobal mac_ctx, tpDeleteStaContext msg,
lim_log(mac_ctx, LOGE,
FL("Inv Del STA staId:%d, assocId:%d"),
msg->staId, msg->assocId);
qdf_mem_free(msg);
return;
} else {
lim_send_disassoc_mgmt_frame(mac_ctx,
@ -169,7 +165,6 @@ static void lim_delete_sta_util(tpAniSirGlobal mac_ctx, tpDeleteStaContext msg,
"in some transit state, Addr = "
MAC_ADDRESS_STR),
MAC_ADDR_ARRAY(msg->bssId));
qdf_mem_free(msg);
return;
}
@ -268,6 +263,7 @@ void lim_delete_sta_context(tpAniSirGlobal mac_ctx, tpSirMsgQ lim_msg)
break;
}
qdf_mem_free(msg);
lim_msg->bodyptr = NULL;
return;
}