A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-15 01:01:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Fix multiple free of a single memory and memory leak in scan

Browse source 
MBSSID beacon support change 2371483 caused multiple free of
scan_list in failure cases. Also only memory for scan_list was
freed without freeing any scan entries in scan_list.
Fix multiple free of scan_list by multiple functions and free
each scan entry in scan_list before freeing scan_list memory itself.

Change-Id: I113391629f544b7accb9a4d1b7aaea11624e0d6e
CRs-Fixed: 2295311
This commit is contained in:
Om Prakash Tripathi 2018-08-14 15:41:34 +05:30 • committed by nshrivas
commit c341ca71a1
1 changed files with 10 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

20
umac/scan/dispatcher/src/wlan_scan_utils_api.c
View file

@ -980,7 +980,6 @@ util_scan_gen_scan_entry(struct wlan_objmgr_pdev *pdev,
scan_entry = qdf_mem_malloc_atomic(sizeof(*scan_entry));
if (!scan_entry) {
scm_err("failed to allocate memory for scan_entry");
qdf_mem_free(scan_list);
return QDF_STATUS_E_NOMEM;
}
scan_entry->raw_frame.ptr =
@ -988,7 +987,6 @@ util_scan_gen_scan_entry(struct wlan_objmgr_pdev *pdev,
if (!scan_entry->raw_frame.ptr) {
scm_err("failed to allocate memory for frame");
qdf_mem_free(scan_entry);
qdf_mem_free(scan_list);
return QDF_STATUS_E_NOMEM;
}
@ -1380,7 +1378,8 @@ static QDF_STATUS util_scan_parse_mbssid(struct wlan_objmgr_pdev *pdev,
struct mgmt_rx_event_params *rx_param,
qdf_list_t *scan_list)
{
return QDF_STATUS_SUCCESS;
return util_scan_gen_scan_entry(pdev, frame, frame_len,
frm_subtype, rx_param, scan_list);
}
#endif
@ -1409,13 +1408,14 @@ util_scan_parse_beacon_frame(struct wlan_objmgr_pdev *pdev,
*/
if (util_scan_find_ie(WLAN_ELEMID_MULTIPLE_BSSID,
(uint8_t *)&bcn->ie, ie_len))
util_scan_parse_mbssid(pdev, frame, frame_len,
frm_subtype, rx_param, scan_list);
status = util_scan_gen_scan_entry(pdev, frame, frame_len,
frm_subtype, rx_param, scan_list);
status = util_scan_parse_mbssid(pdev, frame, frame_len,
frm_subtype, rx_param,
scan_list);
else
status = util_scan_gen_scan_entry(pdev, frame, frame_len,
frm_subtype, rx_param,
scan_list);
if (QDF_IS_STATUS_ERROR(status)) {
qdf_mem_free(scan_list);
scm_err("Failed to create a scan entry");
}
@ -1441,7 +1441,7 @@ util_scan_unpack_beacon_frame(struct wlan_objmgr_pdev *pdev, uint8_t *frame,
frm_subtype, rx_param,
scan_list);
if (QDF_IS_STATUS_ERROR(status)) {
qdf_mem_free(scan_list);
ucfg_scan_purge_results(scan_list);
return NULL;
}