qcacld-3.0: Free LIM Deauth/Disassoc requests during lim cleanup

If Deauth/Disassoc timer is currently running when lim_cleanup
happens due to SSR, the memory allocated for Disassoc/Deauth Req in
mac context is not freed leading to memory leak.

Free Deauth/Disassoc Requests stored in mac context in lim_cleanup.
Also check for existing Deauth/Disassoc Request pointers stored in
mac context and free it before assigning it to point to the
current request.

Change-Id: Id7e221bd9d5061ecaa9b73a4fe1dc0f465f68aa9
CRs-Fixed: 2191131

2 files changed, 27 insertions, 0 deletions

diff --git a/core/mac/src/pe/lim/lim_api.c b/core/mac/src/pe/lim/lim_api.c
index d35112216445..0cb47a7fd379 100644
--- a/core/mac/src/pe/lim/lim_api.c
+++ b/core/mac/src/pe/lim/lim_api.c
@@ -633,6 +633,17 @@ void lim_cleanup(tpAniSirGlobal pMac)
 		qdf_mem_free(pMac->lim.gpLimMlmScanReq);
 		pMac->lim.gpLimMlmScanReq = NULL;
 	}
+
+	if (pMac->lim.limDisassocDeauthCnfReq.pMlmDisassocReq) {
+		qdf_mem_free(pMac->lim.limDisassocDeauthCnfReq.pMlmDisassocReq);
+		pMac->lim.limDisassocDeauthCnfReq.pMlmDisassocReq = NULL;
+	}
+
+	if (pMac->lim.limDisassocDeauthCnfReq.pMlmDeauthReq) {
+		qdf_mem_free(pMac->lim.limDisassocDeauthCnfReq.pMlmDeauthReq);
+		pMac->lim.limDisassocDeauthCnfReq.pMlmDeauthReq = NULL;
+	}
+
 	/* Now, finally reset the deferred message queue pointers */
 	lim_reset_deferred_msg_q(pMac);
 
diff --git a/core/mac/src/pe/lim/lim_process_mlm_req_messages.c b/core/mac/src/pe/lim/lim_process_mlm_req_messages.c
index 04ae3ed637e7..4fb9f60679c2 100644
--- a/core/mac/src/pe/lim/lim_process_mlm_req_messages.c
+++ b/core/mac/src/pe/lim/lim_process_mlm_req_messages.c
@@ -1316,6 +1316,7 @@ lim_process_mlm_disassoc_req_ntf(tpAniSirGlobal mac_ctx,
 				qdf_mem_malloc(sizeof(tSirSmeDisassocRsp));
 			if (NULL == sme_disassoc_rsp) {
 				pe_err("memory allocation failed for disassoc rsp");
+				qdf_mem_free(mlm_disassocreq);
 				return;
 			}
 
@@ -1337,6 +1338,7 @@ lim_process_mlm_disassoc_req_ntf(tpAniSirGlobal mac_ctx,
 
 			lim_send_sme_disassoc_deauth_ntf(mac_ctx,
 					QDF_STATUS_SUCCESS, msg);
+			qdf_mem_free(mlm_disassocreq);
 			return;
 
 		}
@@ -1400,6 +1402,11 @@ lim_process_mlm_disassoc_req_ntf(tpAniSirGlobal mac_ctx,
 	/* Send Disassociate frame to peer entity */
 	if (send_disassoc_frame && (mlm_disassocreq->reasonCode !=
 		eSIR_MAC_DISASSOC_DUE_TO_FTHANDOFF_REASON)) {
+		if (mac_ctx->lim.limDisassocDeauthCnfReq.pMlmDisassocReq) {
+			pe_err("pMlmDisassocReq is not NULL, freeing");
+			qdf_mem_free(mac_ctx->lim.limDisassocDeauthCnfReq.
+				     pMlmDisassocReq);
+		}
 		mac_ctx->lim.limDisassocDeauthCnfReq.pMlmDisassocReq =
 			mlm_disassocreq;
 		/*
@@ -1660,6 +1667,7 @@ lim_process_mlm_deauth_req_ntf(tpAniSirGlobal mac_ctx,
 				    qdf_mem_malloc(sizeof(tSirSmeDeauthRsp));
 				if (NULL == sme_deauth_rsp) {
 					pe_err("memory allocation failed for deauth rsp");
+					qdf_mem_free(mlm_deauth_req);
 					return;
 				}
 
@@ -1686,6 +1694,7 @@ lim_process_mlm_deauth_req_ntf(tpAniSirGlobal mac_ctx,
 
 				lim_send_sme_disassoc_deauth_ntf(mac_ctx,
 						QDF_STATUS_SUCCESS, msg_buf);
+				qdf_mem_free(mlm_deauth_req);
 				return;
 			}
 
@@ -1796,7 +1805,14 @@ lim_process_mlm_deauth_req_ntf(tpAniSirGlobal mac_ctx,
 	sta_ds->mlmStaContext.disassocReason = (tSirMacReasonCodes)
 					       mlm_deauth_req->reasonCode;
 	sta_ds->mlmStaContext.cleanupTrigger = mlm_deauth_req->deauthTrigger;
+
+	if (mac_ctx->lim.limDisassocDeauthCnfReq.pMlmDeauthReq) {
+		pe_err("pMlmDeauthReq is not NULL, freeing");
+		qdf_mem_free(mac_ctx->lim.limDisassocDeauthCnfReq.
+			     pMlmDeauthReq);
+	}
 	mac_ctx->lim.limDisassocDeauthCnfReq.pMlmDeauthReq = mlm_deauth_req;
+
 	/*
 	 * Set state to mlm State to eLIM_MLM_WT_DEL_STA_RSP_STATE
 	 * This is to address the issue of race condition between