diff options
| author | Naveen Rawat <naveenrawat@codeaurora.org> | 2017-04-03 20:18:30 -0700 |
|---|---|---|
| committer | Sandeep Puligilla <spuligil@codeaurora.org> | 2017-04-04 13:20:23 -0700 |
| commit | cf9bffcfa16040aa1b19a36c2531aaee8b4e2dcc (patch) | |
| tree | 4f1cef2b12c37ce0962b8b88d516fc0b3b45d406 | |
| parent | 3b4d3a3ffd165c7b7a8d1c9b09bfa2aeea673409 (diff) | |
qcacld-3.0: Avoid double free of req in wma_hold_req_timer
Do not free request pointer in wma_hold_req_timer, if not found
in the list, because firmware response would have consumed and
freed it.
Change-Id: Ibf561243c606b40e45c8b1cd7c0d2559e0ea85aa
CRs-Fixed: 2027853
| -rw-r--r-- | core/wma/src/wma_dev_if.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/core/wma/src/wma_dev_if.c b/core/wma/src/wma_dev_if.c index 559bc6bfe9b5..bb97d3f11484 100644 --- a/core/wma/src/wma_dev_if.c +++ b/core/wma/src/wma_dev_if.c @@ -2475,7 +2475,7 @@ void wma_hold_req_timer(void *data) wma = cds_get_context(QDF_MODULE_ID_WMA); if (NULL == wma) { WMA_LOGE(FL("Failed to get wma")); - goto free_tgt_req; + return; } WMA_LOGA(FL("request %d is timed out for vdev_id - %d"), @@ -2485,7 +2485,11 @@ void wma_hold_req_timer(void *data) if (!msg) { WMA_LOGE(FL("Failed to lookup request message - %d"), tgt_req->msg_type); - goto free_tgt_req; + /* + * if find request failed, then firmware rsp should have + * consumed the buffer. Do not free. + */ + return; } if (tgt_req->msg_type == WMA_ADD_STA_REQ) { @@ -2537,9 +2541,6 @@ void wma_hold_req_timer(void *data) tgt_req->msg_type, tgt_req->type); QDF_BUG(0); } -free_tgt_req: - qdf_mc_timer_destroy(&tgt_req->event_timeout); - qdf_mem_free(tgt_req); } /** |