From a92cf1eb8d6d60a1d62e7930e62df992a77790f8 Mon Sep 17 00:00:00 2001
From: Abhishek Singh <absingh@codeaurora.org>
Date: Thu, 2 Nov 2017 17:04:11 +0530
Subject: [PATCH] qcacld-3.0: Fix memory leak in scan
 csr_scan_save_bss_description

csr_scan_save_bss_description allocate pCsrBssDescription which
is used to update the scan entry in scan module and after
update is done pCsrBssDescription is not freed.

Fix this by freeing pCsrBssDescription once entry is updated in
scan module.

Change-Id: I07f9bbea8fbf5b700203b03d8fd19a0871ea2881
CRs-Fixed: 2137082
---
 core/sme/src/csr/csr_api_roam.c   |  4 +--
 core/sme/src/csr/csr_api_scan.c   | 47 ++++++++++++++-----------------
 core/sme/src/csr/csr_inside_api.h |  2 +-
 3 files changed, 23 insertions(+), 30 deletions(-)

diff --git a/core/sme/src/csr/csr_api_roam.c b/core/sme/src/csr/csr_api_roam.c
index 0b55a895f158..53fab55d2839 100644
--- a/core/sme/src/csr/csr_api_roam.c
+++ b/core/sme/src/csr/csr_api_roam.c
@@ -6803,7 +6803,6 @@ static void csr_roam_process_start_bss_success(tpAniSirGlobal mac_ctx,
 	tSirBssDescription *bss_desc = NULL;
 	struct csr_roam_info roam_info;
 	tSirSmeStartBssRsp *start_bss_rsp = NULL;
-	struct tag_csrscan_result *scan_res = NULL;
 	eRoamCmdStatus roam_status;
 	eCsrRoamResult roam_result;
 	tDot11fBeaconIEs *ies_ptr = NULL;
@@ -6869,8 +6868,7 @@ static void csr_roam_process_start_bss_success(tpAniSirGlobal mac_ctx,
 		}
 	}
 	if (!CSR_IS_INFRA_AP(profile) && !CSR_IS_NDI(profile)) {
-		scan_res =
-			csr_scan_append_bss_description(mac_ctx,
+		csr_scan_append_bss_description(mac_ctx,
 					bss_desc, ies_ptr, false,
 					session_id);
 	}
diff --git a/core/sme/src/csr/csr_api_scan.c b/core/sme/src/csr/csr_api_scan.c
index acb1420186f3..e9d6668c936e 100644
--- a/core/sme/src/csr/csr_api_scan.c
+++ b/core/sme/src/csr/csr_api_scan.c
@@ -1344,6 +1344,7 @@ static void csr_scan_add_result(tpAniSirGlobal mac_ctx,
 	if (!buf) {
 		sme_err("Failed to allocate wbuf for mgmt rx len (%u)",
 			buf_len);
+		csr_free_scan_result_entry(mac_ctx, pResult);
 		return;
 	}
 	qdf_nbuf_put_tail(buf, buf_len);
@@ -1368,6 +1369,7 @@ static void csr_scan_add_result(tpAniSirGlobal mac_ctx,
 		GET_IE_LEN_IN_BSS(bss_desc->length));
 	tgt_scan_bcn_probe_rx_callback(mac_ctx->psoc, NULL, buf, &rx_param,
 		frm_type);
+	csr_free_scan_result_entry(mac_ctx, pResult);
 }
 
 /*
@@ -1659,7 +1661,7 @@ static bool csr_process_bss_desc_for_bkid_list(tpAniSirGlobal pMac,
 
 #endif
 
-static struct tag_csrscan_result *csr_scan_save_bss_description(tpAniSirGlobal
+static bool csr_scan_save_bss_description(tpAniSirGlobal
 							pMac,
 						     tSirBssDescription *
 						     pBSSDescription,
@@ -1678,41 +1680,34 @@ static struct tag_csrscan_result *csr_scan_save_bss_description(tpAniSirGlobal
 	cbAllocated = sizeof(struct tag_csrscan_result) + cbBSSDesc;
 
 	pCsrBssDescription = qdf_mem_malloc(cbAllocated);
-	if (NULL != pCsrBssDescription) {
-		pCsrBssDescription->AgingCount =
-			(int32_t) pMac->roam.configParam.agingCount;
-		sme_debug(
-			"Set Aging Count = %d for BSS " MAC_ADDRESS_STR " ",
-			pCsrBssDescription->AgingCount,
-			MAC_ADDR_ARRAY(pCsrBssDescription->Result.BssDescriptor.
-				       bssId));
-		qdf_mem_copy(&pCsrBssDescription->Result.BssDescriptor,
-			     pBSSDescription, cbBSSDesc);
-#if defined(QDF_ENSBALED)
-		if (NULL != pCsrBssDescription->Result.pvIes) {
-			QDF_ASSERT(pCsrBssDescription->Result.pvIes == NULL);
-			return NULL;
-		}
-#endif
-		csr_scan_add_result(pMac, pCsrBssDescription, pIes, sessionId);
+	if (!pCsrBssDescription) {
+		sme_err(" Failed to allocate memory for pCsrBssDescription");
+		return false;
 	}
 
-	return pCsrBssDescription;
+	pCsrBssDescription->AgingCount =
+		(int32_t) pMac->roam.configParam.agingCount;
+	sme_debug(
+		"Set Aging Count = %d for BSS " MAC_ADDRESS_STR " ",
+		pCsrBssDescription->AgingCount,
+		MAC_ADDR_ARRAY(pCsrBssDescription->Result.BssDescriptor.
+			       bssId));
+	qdf_mem_copy(&pCsrBssDescription->Result.BssDescriptor,
+		     pBSSDescription, cbBSSDesc);
+	csr_scan_add_result(pMac, pCsrBssDescription, pIes, sessionId);
+
+	return true;
 }
 
 /* Append a Bss Description... */
-struct tag_csrscan_result *csr_scan_append_bss_description(tpAniSirGlobal pMac,
+bool csr_scan_append_bss_description(tpAniSirGlobal pMac,
 						tSirBssDescription *
 						pSirBssDescription,
 						tDot11fBeaconIEs *pIes,
 						bool fForced, uint8_t sessionId)
 {
-	struct tag_csrscan_result *pCsrBssDescription = NULL;
-
-	pCsrBssDescription = csr_scan_save_bss_description(pMac,
+	return csr_scan_save_bss_description(pMac,
 					pSirBssDescription, pIes, sessionId);
-
-	return pCsrBssDescription;
 }
 
 static void csr_purge_channel_power(tpAniSirGlobal pMac, tDblLinkList
@@ -4772,7 +4767,7 @@ QDF_STATUS csr_scan_create_entry_in_scan_cache(tpAniSirGlobal pMac,
 	qdf_mem_copy(pNewBssDescriptor->bssId, bssid.bytes,
 			sizeof(tSirMacAddr));
 	pNewBssDescriptor->channelId = channel;
-	if (NULL == csr_scan_append_bss_description(pMac, pNewBssDescriptor,
+	if (!csr_scan_append_bss_description(pMac, pNewBssDescriptor,
 						pNewIes, true, sessionId)) {
 		sme_err("csr_scan_append_bss_description failed");
 		status = QDF_STATUS_E_FAILURE;
diff --git a/core/sme/src/csr/csr_inside_api.h b/core/sme/src/csr/csr_inside_api.h
index 596056141c13..b9d1af325310 100644
--- a/core/sme/src/csr/csr_inside_api.h
+++ b/core/sme/src/csr/csr_inside_api.h
@@ -281,7 +281,7 @@ QDF_STATUS csr_scan_handle_failed_lostlink2(tpAniSirGlobal pMac,
 					    uint32_t sessionId);
 QDF_STATUS csr_scan_handle_failed_lostlink3(tpAniSirGlobal pMac,
 					    uint32_t sessionId);
-struct tag_csrscan_result *csr_scan_append_bss_description(tpAniSirGlobal pMac,
+bool csr_scan_append_bss_description(tpAniSirGlobal pMac,
 						tSirBssDescription *
 						pSirBssDescription,
 						tDot11fBeaconIEs *pIes,