qcacld: UMAC: Fix memory leak in limProcessAssocReqFrame

Memory allocated for Assoc request frame (pAssocReq) and
pAssocReq->assocReqFrame in limProcessAssocReqFrame() is
not freed up properly. This results in memory leak.

This change set fixes the memory leak by freeing the memory
appropriately.

Change-Id: I9fd96382de9c84e6cd1c5af86eddb0dfa6006099
CRs-Fixed: 786075

1 files changed, 21 insertions, 8 deletions

diff --git a/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c b/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
index 913c8e955470..1825e7adf287 100644
--- a/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
+++ b/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
@@ -248,6 +248,7 @@ limProcessAssocReqFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,
     tANI_U32 retryInterval;
 #endif
     tANI_U16 assocId = 0;
+    bool assoc_req_copied = false;
 
     limGetPhyMode(pMac, &phyMode, psessionEntry);
 
@@ -1109,6 +1110,7 @@ sendIndToSme:
         }
 
         psessionEntry->parsedAssocReq[pStaDs->assocId] = pAssocReq;
+        assoc_req_copied = true;
     }
 
 
@@ -1398,6 +1400,7 @@ if (limPopulateMatchingRateSet(pMac,
 
     // BTAMP: Storing the parsed assoc request in the psessionEntry array
     psessionEntry->parsedAssocReq[pStaDs->assocId] = pAssocReq;
+    assoc_req_copied = true;
 
     /* BTAMP: If STA context already exist (ie. updateContext = 1)
      * for this STA, then we should delete the old one, and add
@@ -1484,22 +1487,32 @@ if (limPopulateMatchingRateSet(pMac,
     return;
 
 error:
-    if (pAssocReq != NULL)
-    {
-        if ( pAssocReq->assocReqFrame )
-        {
+    if (pAssocReq != NULL) {
+        if (pAssocReq->assocReqFrame) {
             vos_mem_free(pAssocReq->assocReqFrame);
             pAssocReq->assocReqFrame = NULL;
+            pAssocReq->assocReqFrameLength = 0;
         }
-
         vos_mem_free(pAssocReq);
+        if (assoc_req_copied) /* to avoid double free */
+            psessionEntry->parsedAssocReq[pStaDs->assocId] = NULL;
     }
 
-    /* If it is not duplicate Assoc request then only make to Null */
+    /* If it is not duplicate Assoc request then only free the memory */
     if ((pStaDs != NULL) &&
           (pStaDs->mlmStaContext.mlmState != eLIM_MLM_WT_ADD_STA_RSP_STATE)) {
-            if (psessionEntry->parsedAssocReq != NULL)
-                psessionEntry->parsedAssocReq[pStaDs->assocId] = NULL;
+            if (psessionEntry->parsedAssocReq != NULL) {
+                pTempAssocReq = psessionEntry->parsedAssocReq[pStaDs->assocId];
+                if (pTempAssocReq != NULL) {
+                    if (pTempAssocReq->assocReqFrame) {
+                        vos_mem_free(pTempAssocReq->assocReqFrame);
+                        pTempAssocReq->assocReqFrame = NULL;
+                        pTempAssocReq->assocReqFrameLength = 0;
+                    }
+                    vos_mem_free(pTempAssocReq);
+                    psessionEntry->parsedAssocReq[pStaDs->assocId] = NULL;
+                }
+            }
     }
 
     return;