diff options
| author | Naveen Rawat <naveenrawat@codeaurora.org> | 2016-09-13 11:18:34 -0700 |
|---|---|---|
| committer | qcabuildsw <qcabuildsw@localhost> | 2016-09-15 14:48:06 -0700 |
| commit | a82fd5caa6bc9cc77a1fc6be4b2e3c7a997f131e (patch) | |
| tree | 790162550d747fcc56016331536952ca5f3998b4 | |
| parent | c9fbe2950ea997cc083245e5575d6874022059a7 (diff) | |
qcacld-3.0: Fix double free of memory
Remove freeing of msg from helper function lim_delete_sta_util, since
caller of that will free the msg buffer at the end of function.
Change-Id: I2e0ee43dda9d5e30e86c4033eba934e4d7938887
CRs-Fixed: 1066025
| -rw-r--r-- | core/mac/src/pe/lim/lim_link_monitoring_algo.c | 6 |
1 files changed, 1 insertions, 5 deletions
diff --git a/core/mac/src/pe/lim/lim_link_monitoring_algo.c b/core/mac/src/pe/lim/lim_link_monitoring_algo.c index 3e578b8aa65f..94b416000f09 100644 --- a/core/mac/src/pe/lim/lim_link_monitoring_algo.c +++ b/core/mac/src/pe/lim/lim_link_monitoring_algo.c @@ -76,7 +76,6 @@ static void lim_delete_sta_util(tpAniSirGlobal mac_ctx, tpDeleteStaContext msg, msg->staId, msg->reasonCode); if (LIM_IS_IBSS_ROLE(session_entry)) { - qdf_mem_free(msg); return; } @@ -87,7 +86,6 @@ static void lim_delete_sta_util(tpAniSirGlobal mac_ctx, tpDeleteStaContext msg, lim_log(mac_ctx, LOGE, FL("Invalid STA limSystemRole=%d"), GET_LIM_SYSTEM_ROLE(session_entry)); - qdf_mem_free(msg); return; } stads->del_sta_ctx_rssi = msg->rssi; @@ -98,7 +96,6 @@ static void lim_delete_sta_util(tpAniSirGlobal mac_ctx, tpDeleteStaContext msg, if (stads->staIndex != msg->staId) { lim_log(mac_ctx, LOGE, FL("staid mismatch: %d vs %d "), stads->staIndex, msg->staId); - qdf_mem_free(msg); return; } @@ -122,7 +119,6 @@ static void lim_delete_sta_util(tpAniSirGlobal mac_ctx, tpDeleteStaContext msg, lim_log(mac_ctx, LOGE, FL("Inv Del STA staId:%d, assocId:%d"), msg->staId, msg->assocId); - qdf_mem_free(msg); return; } else { lim_send_disassoc_mgmt_frame(mac_ctx, @@ -169,7 +165,6 @@ static void lim_delete_sta_util(tpAniSirGlobal mac_ctx, tpDeleteStaContext msg, "in some transit state, Addr = " MAC_ADDRESS_STR), MAC_ADDR_ARRAY(msg->bssId)); - qdf_mem_free(msg); return; } @@ -268,6 +263,7 @@ void lim_delete_sta_context(tpAniSirGlobal mac_ctx, tpSirMsgQ lim_msg) break; } qdf_mem_free(msg); + lim_msg->bodyptr = NULL; return; } |