From a82fd5caa6bc9cc77a1fc6be4b2e3c7a997f131e Mon Sep 17 00:00:00 2001 From: Naveen Rawat Date: Tue, 13 Sep 2016 11:18:34 -0700 Subject: [PATCH] qcacld-3.0: Fix double free of memory Remove freeing of msg from helper function lim_delete_sta_util, since caller of that will free the msg buffer at the end of function. Change-Id: I2e0ee43dda9d5e30e86c4033eba934e4d7938887 CRs-Fixed: 1066025 --- core/mac/src/pe/lim/lim_link_monitoring_algo.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/core/mac/src/pe/lim/lim_link_monitoring_algo.c b/core/mac/src/pe/lim/lim_link_monitoring_algo.c index 3e578b8aa65f..94b416000f09 100644 --- a/core/mac/src/pe/lim/lim_link_monitoring_algo.c +++ b/core/mac/src/pe/lim/lim_link_monitoring_algo.c @@ -76,7 +76,6 @@ static void lim_delete_sta_util(tpAniSirGlobal mac_ctx, tpDeleteStaContext msg, msg->staId, msg->reasonCode); if (LIM_IS_IBSS_ROLE(session_entry)) { - qdf_mem_free(msg); return; } @@ -87,7 +86,6 @@ static void lim_delete_sta_util(tpAniSirGlobal mac_ctx, tpDeleteStaContext msg, lim_log(mac_ctx, LOGE, FL("Invalid STA limSystemRole=%d"), GET_LIM_SYSTEM_ROLE(session_entry)); - qdf_mem_free(msg); return; } stads->del_sta_ctx_rssi = msg->rssi; @@ -98,7 +96,6 @@ static void lim_delete_sta_util(tpAniSirGlobal mac_ctx, tpDeleteStaContext msg, if (stads->staIndex != msg->staId) { lim_log(mac_ctx, LOGE, FL("staid mismatch: %d vs %d "), stads->staIndex, msg->staId); - qdf_mem_free(msg); return; } @@ -122,7 +119,6 @@ static void lim_delete_sta_util(tpAniSirGlobal mac_ctx, tpDeleteStaContext msg, lim_log(mac_ctx, LOGE, FL("Inv Del STA staId:%d, assocId:%d"), msg->staId, msg->assocId); - qdf_mem_free(msg); return; } else { lim_send_disassoc_mgmt_frame(mac_ctx, @@ -169,7 +165,6 @@ static void lim_delete_sta_util(tpAniSirGlobal mac_ctx, tpDeleteStaContext msg, "in some transit state, Addr = " MAC_ADDRESS_STR), MAC_ADDR_ARRAY(msg->bssId)); - qdf_mem_free(msg); return; } @@ -268,6 +263,7 @@ void lim_delete_sta_context(tpAniSirGlobal mac_ctx, tpSirMsgQ lim_msg) break; } qdf_mem_free(msg); + lim_msg->bodyptr = NULL; return; }