A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-15 01:01:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix memory leak issue in csr_roam_issue_ft_preauth_req()

Browse source 
Make sure to free BSS descriptor buffer in case of failure to
send message. In failure case only message body buffer is freed.

Change-Id: I1919ed25d98808fad47f455820b760d96d18f4b2
CRs-Fixed: 2332101
This commit is contained in:
Arif Hussain 2018-10-15 13:32:00 -07:00 • committed by nshrivas
commit ca0fbb7d93
1 changed files with 26 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

43
core/sme/src/csr/csr_roam_preauth.c
View file

@ -513,7 +513,10 @@ QDF_STATUS csr_roam_issue_ft_preauth_req(tpAniSirGlobal mac_ctx,
tpSirBssDescription bss_desc)
{
tpSirFTPreAuthReq preauth_req;
uint16_t auth_req_len = 0;
uint16_t auth_req_len;
tpSirBssDescription buf;
uint32_t dot11mode, buf_len;
QDF_STATUS status;
struct csr_roam_session *csr_session = CSR_GET_SESSION(mac_ctx,
session_id);
@ -523,28 +526,29 @@ QDF_STATUS csr_roam_issue_ft_preauth_req(tpAniSirGlobal mac_ctx,
return QDF_STATUS_E_FAILURE;
}
dot11mode = csr_get_dot11_mode(mac_ctx, session_id, bss_desc);
if (!dot11mode) {
sme_err("dot11mode is zero");
return QDF_STATUS_E_FAILURE;
}
auth_req_len = sizeof(tSirFTPreAuthReq);
preauth_req = qdf_mem_malloc(auth_req_len);
if (!preauth_req)
return QDF_STATUS_E_NOMEM;
buf_len = sizeof(bss_desc->length) + bss_desc->length;
buf = qdf_mem_malloc(buf_len);
if (!buf) {
qdf_mem_free(preauth_req);
return QDF_STATUS_E_NOMEM;
}
/* Save the SME Session ID. We need it while processing preauth resp */
csr_session->ftSmeContext.smeSessionId = session_id;
preauth_req->pbssDescription = qdf_mem_malloc(sizeof(bss_desc->length)
+ bss_desc->length);
if (!preauth_req->pbssDescription)
return QDF_STATUS_E_NOMEM;
preauth_req->messageType = eWNI_SME_FT_PRE_AUTH_REQ;
preauth_req->preAuthchannelNum = bss_desc->channelId;
preauth_req->dot11mode = csr_get_dot11_mode(mac_ctx, session_id,
bss_desc);
if (!preauth_req->dot11mode) {
sme_err("preauth_req->dot11mode is zero");
qdf_mem_free(preauth_req);
return QDF_STATUS_E_FAILURE;
}
preauth_req->dot11mode = dot11mode;
qdf_mem_copy((void *)&preauth_req->currbssId,
(void *)csr_session->connectedProfile.bssid.bytes,
@ -565,10 +569,15 @@ QDF_STATUS csr_roam_issue_ft_preauth_req(tpAniSirGlobal mac_ctx,
} else {
preauth_req->ft_ies_length = 0;
}
qdf_mem_copy(preauth_req->pbssDescription, bss_desc,
sizeof(bss_desc->length) + bss_desc->length);
qdf_mem_copy(buf, bss_desc, buf_len);
preauth_req->pbssDescription = buf;
preauth_req->length = auth_req_len;
return umac_send_mb_message_to_mac(preauth_req);
status = umac_send_mb_message_to_mac(preauth_req);
if (QDF_IS_STATUS_ERROR(status))
qdf_mem_free(buf);
return status;
}
void csr_roam_ft_pre_auth_rsp_processor(tpAniSirGlobal mac_ctx,