From ae8afdf04250a4e852a3b5c361f1c388ca02fedc Mon Sep 17 00:00:00 2001 From: bings Date: Thu, 9 Jan 2020 18:36:31 +0800 Subject: [PATCH] qcacmn: Fix memory leak and NULL access in scm_add_rnr_channel_db In scm_add_rnr_channel_db, if pointer channel is NULL, it should return. Allocate rnr_node buffer whenever it is used, otherwise memory leak happens if the BSS channel is not 6Ghz. Change-Id: Iecba2453c2e9cdf9301826e0e11f740190616110 CRs-Fixed: 2601014 --- umac/scan/core/src/wlan_scan_cache_db.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/umac/scan/core/src/wlan_scan_cache_db.c b/umac/scan/core/src/wlan_scan_cache_db.c index c123e726573d..f316b0ac3a8a 100644 --- a/umac/scan/core/src/wlan_scan_cache_db.c +++ b/umac/scan/core/src/wlan_scan_cache_db.c @@ -87,7 +87,7 @@ static void scm_add_rnr_channel_db(struct scan_cache_entry *entry) scm_debug("scan entry channel freq %d", chan_freq); if (is_6g_bss) { channel = scm_get_chan_meta(chan_freq); - if (channel) { + if (!channel) { scm_debug("Failed to get chan Meta freq %d", chan_freq); return; } @@ -107,9 +107,6 @@ static void scm_add_rnr_channel_db(struct scan_cache_entry *entry) /* Skip if entry is not valid */ if (!rnr_bss->channel_number) continue; - rnr_node = qdf_mem_malloc(sizeof(struct scan_rnr_node)); - if (!rnr_node) - return; chan_freq = wlan_reg_chan_opclass_to_freq(rnr_bss->channel_number, rnr_bss->operating_class, false); @@ -119,13 +116,16 @@ static void scm_add_rnr_channel_db(struct scan_cache_entry *entry) channel = scm_get_chan_meta(chan_freq); if (!channel) { scm_debug("Failed to get chan Meta freq %d", chan_freq); - qdf_mem_free(rnr_node); return; } channel->bss_beacon_probe_count++; /* Don't add RNR entry if list is full */ if (qdf_list_size(&channel->rnr_list) >= WLAN_MAX_RNR_COUNT) continue; + + rnr_node = qdf_mem_malloc(sizeof(struct scan_rnr_node)); + if (!rnr_node) + return; rnr_node->entry.timestamp = entry->scan_entry_time; if (!qdf_is_macaddr_zero(&rnr_bss->bssid)) qdf_mem_copy(&rnr_node->entry.bssid,