qcacld-3.0: Fix memory leak allocated in csr_get_parsed_bss_description_ies

In some places memory allocated for the parsed IE’s
using csr_get_parsed_bss_description_ies are freed only if existing
IE description is NULL. Even though memory allocation not done based
on above condition, this may lead to memory leak.

To fix this make sure to check existing IE description while allocating
memory.

Change-Id: Ia065b9ebb4cbd00f48f3cdca8737190b3609e1c7
CRs-Fixed: 2002298

4 files changed, 38 insertions, 17 deletions

diff --git a/core/cds/src/cds_concurrency.c b/core/cds/src/cds_concurrency.c
index cd79c48c3280..6c75b584c349 100644
--- a/core/cds/src/cds_concurrency.c
+++ b/core/cds/src/cds_concurrency.c
@@ -6934,6 +6934,14 @@ static bool cds_sta_p2pgo_concur_handle(hdd_adapter_t *sta_adapter,
 					sta_adapter->sessionId);
 			if (true != ret) {
 				cds_err("sme_store_joinreq_param failed");
+				status = sme_scan_result_purge(
+						WLAN_HDD_GET_HAL_CTX(
+							sta_adapter),
+						scan_cache);
+				if (QDF_STATUS_SUCCESS != status) {
+					cds_err("sme_scan_result_purge failed");
+					/* Not returning */
+				}
 				/* Not returning */
 			}
 			cds_change_sta_conn_pending_status(true);
diff --git a/core/sme/src/common/sme_api.c b/core/sme/src/common/sme_api.c
index 5f99b8625fa7..f59eb879c513 100644
--- a/core/sme/src/common/sme_api.c
+++ b/core/sme/src/common/sme_api.c
@@ -17413,6 +17413,8 @@ free_scan_flter:
 		csr_free_scan_filter(mac_ctx, scan_filter);
 		qdf_mem_free(scan_filter);
 	}
+	if (result_handle)
+		csr_scan_result_purge(mac_ctx, result_handle);
 
 	return QDF_STATUS_SUCCESS;
 }
diff --git a/core/sme/src/csr/csr_api_roam.c b/core/sme/src/csr/csr_api_roam.c
index cd7e0e8057b0..40cf313b1e1b 100644
--- a/core/sme/src/csr/csr_api_roam.c
+++ b/core/sme/src/csr/csr_api_roam.c
@@ -5310,7 +5310,7 @@ static void csr_roam_join_handle_profile(tpAniSirGlobal mac_ctx,
 		} else {
 			cmd->u.roamCmd.roamProfile.uapsd_mask = 0;
 		}
-		if (ies_local && !result->pvIes)
+		if (ies_local && !scan_result->Result.pvIes)
 			qdf_mem_free(ies_local);
 		roam_info_ptr->pProfile = profile;
 		session->bRefAssocStartCnt++;
@@ -9395,6 +9395,8 @@ void csr_roam_roaming_state_disassoc_rsp_processor(tpAniSirGlobal pMac,
 			csr_free_scan_filter(pMac, pScanFilter);
 			qdf_mem_free(pScanFilter);
 			return;
+		} else {
+			csr_scan_result_purge(pMac, hBSSList);
 		}
 
 POST_ROAM_FAILURE:
diff --git a/core/sme/src/csr/csr_api_scan.c b/core/sme/src/csr/csr_api_scan.c
index b38c6487ad82..57f0645107ed 100644
--- a/core/sme/src/csr/csr_api_scan.c
+++ b/core/sme/src/csr/csr_api_scan.c
@@ -1728,10 +1728,14 @@ csr_parser_scan_result_for_5ghz_preference(tpAniSirGlobal pMac,
 
 			pIes = (tDot11fBeaconIEs *)(pBssDesc->Result.pvIes);
 			/* At this time, Result.pvIes may be NULL */
-			status = csr_get_parsed_bss_description_ies(pMac,
-					&pBssDesc->Result.BssDescriptor, &pIes);
-			if (!pIes && (!QDF_IS_STATUS_SUCCESS(status)))
-				continue;
+			if (NULL == pIes) {
+				status = csr_get_parsed_bss_description_ies(
+						pMac,
+						&pBssDesc->Result.BssDescriptor,
+						&pIes);
+				if (!pIes && (!QDF_IS_STATUS_SUCCESS(status)))
+					continue;
+			}
 
 			sms_log(pMac, LOG1, FL("SSID Matched"));
 			if (pFilter->bOSENAssociation) {
@@ -2936,12 +2940,14 @@ csr_remove_from_tmp_list(tpAniSirGlobal mac_ctx,
 
 		/* At this time, bss_dscp->Result.pvIes may be NULL */
 		local_ie = (tDot11fBeaconIEs *)(bss_dscp->Result.pvIes);
-		status = csr_get_parsed_bss_description_ies(mac_ctx,
+		if (local_ie == NULL) {
+			status = csr_get_parsed_bss_description_ies(mac_ctx,
 				&bss_dscp->Result.BssDescriptor, &local_ie);
-		if (!local_ie || !QDF_IS_STATUS_SUCCESS(status)) {
-			sms_log(mac_ctx, LOGE, FL("Cannot pared IEs"));
-			csr_free_scan_result_entry(mac_ctx, bss_dscp);
-			continue;
+			if (!local_ie || !QDF_IS_STATUS_SUCCESS(status)) {
+				sms_log(mac_ctx, LOGE, FL("Cannot pared IEs"));
+				csr_free_scan_result_entry(mac_ctx, bss_dscp);
+				continue;
+			}
 		}
 		dup_bss = csr_remove_dup_bss_description(mac_ctx,
 				&bss_dscp->Result.BssDescriptor,
@@ -7215,13 +7221,16 @@ QDF_STATUS csr_scan_save_preferred_network_found(tpAniSirGlobal pMac,
 			SIR_MAC_B_PR_SSID_OFFSET), uLen);
 	}
 	local_ie = (tDot11fBeaconIEs *) (pScanResult->Result.pvIes);
-	status = csr_get_parsed_bss_description_ies(pMac,
-			&pScanResult->Result.BssDescriptor, &local_ie);
-	if (!(local_ie || QDF_IS_STATUS_SUCCESS(status))) {
-		sms_log(pMac, LOGE, FL("Cannot parse IEs"));
-		csr_free_scan_result_entry(pMac, pScanResult);
-		qdf_mem_free(parsed_frm);
-		return QDF_STATUS_E_RESOURCES;
+	if (NULL == local_ie) {
+		status = csr_get_parsed_bss_description_ies(pMac,
+				&pScanResult->Result.BssDescriptor, &local_ie);
+
+		if (!(local_ie || QDF_IS_STATUS_SUCCESS(status))) {
+			sms_log(pMac, LOGE, FL("Cannot parse IEs"));
+			csr_free_scan_result_entry(pMac, pScanResult);
+			qdf_mem_free(parsed_frm);
+			return QDF_STATUS_E_RESOURCES;
+		}
 	}
 
 	fDupBss = csr_remove_dup_bss_description(pMac,