A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-12 15:49:17 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix memory leak in scan csr_scan_save_bss_description

Browse source 
csr_scan_save_bss_description allocate pCsrBssDescription which
is used to update the scan entry in scan module and after
update is done pCsrBssDescription is not freed.

Fix this by freeing pCsrBssDescription once entry is updated in
scan module.

Change-Id: I07f9bbea8fbf5b700203b03d8fd19a0871ea2881
CRs-Fixed: 2137082
This commit is contained in:
Abhishek Singh 2017-11-02 17:04:11 +05:30 • committed by snandini
commit a92cf1eb8d
3 changed files with 23 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

4
core/sme/src/csr/csr_api_roam.c
View file

@ -6803,7 +6803,6 @@ static void csr_roam_process_start_bss_success(tpAniSirGlobal mac_ctx,
tSirBssDescription *bss_desc = NULL;
struct csr_roam_info roam_info;
tSirSmeStartBssRsp *start_bss_rsp = NULL;
struct tag_csrscan_result *scan_res = NULL;
eRoamCmdStatus roam_status;
eCsrRoamResult roam_result;
tDot11fBeaconIEs *ies_ptr = NULL;
@ -6869,8 +6868,7 @@ static void csr_roam_process_start_bss_success(tpAniSirGlobal mac_ctx,
}
}
if (!CSR_IS_INFRA_AP(profile) && !CSR_IS_NDI(profile)) {
scan_res =
csr_scan_append_bss_description(mac_ctx,
csr_scan_append_bss_description(mac_ctx,
bss_desc, ies_ptr, false,
session_id);
}

47
core/sme/src/csr/csr_api_scan.c
View file

@ -1344,6 +1344,7 @@ static void csr_scan_add_result(tpAniSirGlobal mac_ctx,
if (!buf) {
sme_err("Failed to allocate wbuf for mgmt rx len (%u)",
buf_len);
csr_free_scan_result_entry(mac_ctx, pResult);
return;
}
qdf_nbuf_put_tail(buf, buf_len);
@ -1368,6 +1369,7 @@ static void csr_scan_add_result(tpAniSirGlobal mac_ctx,
GET_IE_LEN_IN_BSS(bss_desc->length));
tgt_scan_bcn_probe_rx_callback(mac_ctx->psoc, NULL, buf, &rx_param,
frm_type);
csr_free_scan_result_entry(mac_ctx, pResult);
}
/*
@ -1659,7 +1661,7 @@ static bool csr_process_bss_desc_for_bkid_list(tpAniSirGlobal pMac,
#endif
static struct tag_csrscan_result *csr_scan_save_bss_description(tpAniSirGlobal
static bool csr_scan_save_bss_description(tpAniSirGlobal
pMac,
tSirBssDescription *
pBSSDescription,
@ -1678,41 +1680,34 @@ static struct tag_csrscan_result *csr_scan_save_bss_description(tpAniSirGlobal
cbAllocated = sizeof(struct tag_csrscan_result) + cbBSSDesc;
pCsrBssDescription = qdf_mem_malloc(cbAllocated);
if (NULL != pCsrBssDescription) {
pCsrBssDescription->AgingCount =
(int32_t) pMac->roam.configParam.agingCount;
sme_debug(
"Set Aging Count = %d for BSS " MAC_ADDRESS_STR " ",
pCsrBssDescription->AgingCount,
MAC_ADDR_ARRAY(pCsrBssDescription->Result.BssDescriptor.
bssId));
qdf_mem_copy(&pCsrBssDescription->Result.BssDescriptor,
pBSSDescription, cbBSSDesc);
#if defined(QDF_ENSBALED)
if (NULL != pCsrBssDescription->Result.pvIes) {
QDF_ASSERT(pCsrBssDescription->Result.pvIes == NULL);
return NULL;
}
#endif
csr_scan_add_result(pMac, pCsrBssDescription, pIes, sessionId);
if (!pCsrBssDescription) {
sme_err(" Failed to allocate memory for pCsrBssDescription");
return false;
}
return pCsrBssDescription;
pCsrBssDescription->AgingCount =
(int32_t) pMac->roam.configParam.agingCount;
sme_debug(
"Set Aging Count = %d for BSS " MAC_ADDRESS_STR " ",
pCsrBssDescription->AgingCount,
MAC_ADDR_ARRAY(pCsrBssDescription->Result.BssDescriptor.
bssId));
qdf_mem_copy(&pCsrBssDescription->Result.BssDescriptor,
pBSSDescription, cbBSSDesc);
csr_scan_add_result(pMac, pCsrBssDescription, pIes, sessionId);
return true;
}
/* Append a Bss Description... */
struct tag_csrscan_result *csr_scan_append_bss_description(tpAniSirGlobal pMac,
bool csr_scan_append_bss_description(tpAniSirGlobal pMac,
tSirBssDescription *
pSirBssDescription,
tDot11fBeaconIEs *pIes,
bool fForced, uint8_t sessionId)
{
struct tag_csrscan_result *pCsrBssDescription = NULL;
pCsrBssDescription = csr_scan_save_bss_description(pMac,
return csr_scan_save_bss_description(pMac,
pSirBssDescription, pIes, sessionId);
return pCsrBssDescription;
}
static void csr_purge_channel_power(tpAniSirGlobal pMac, tDblLinkList
@ -4772,7 +4767,7 @@ QDF_STATUS csr_scan_create_entry_in_scan_cache(tpAniSirGlobal pMac,
qdf_mem_copy(pNewBssDescriptor->bssId, bssid.bytes,
sizeof(tSirMacAddr));
pNewBssDescriptor->channelId = channel;
if (NULL == csr_scan_append_bss_description(pMac, pNewBssDescriptor,
if (!csr_scan_append_bss_description(pMac, pNewBssDescriptor,
pNewIes, true, sessionId)) {
sme_err("csr_scan_append_bss_description failed");
status = QDF_STATUS_E_FAILURE;

2
core/sme/src/csr/csr_inside_api.h
View file

@ -281,7 +281,7 @@ QDF_STATUS csr_scan_handle_failed_lostlink2(tpAniSirGlobal pMac,
uint32_t sessionId);
QDF_STATUS csr_scan_handle_failed_lostlink3(tpAniSirGlobal pMac,
uint32_t sessionId);
struct tag_csrscan_result *csr_scan_append_bss_description(tpAniSirGlobal pMac,
bool csr_scan_append_bss_description(tpAniSirGlobal pMac,
tSirBssDescription *
pSirBssDescription,
tDot11fBeaconIEs *pIes,