diff options
| author | Sandeep Puligilla <spuligil@codeaurora.org> | 2017-11-15 16:51:51 -0800 |
|---|---|---|
| committer | snandini <snandini@codeaurora.org> | 2017-11-16 20:46:40 -0800 |
| commit | d4caa41ce4e3c053c2aec1cd01554ef46ec654c0 (patch) | |
| tree | cc3e9febacdc43d5a268f471a3c832a3c7a8afa2 | |
| parent | 7e861c99699fa3f8009b7c8e69489e2d4d30585c (diff) | |
qcacld-3.0: Fix memory leak in measurement request processing
Memory leak is detected while processing the
measurement report request while another request
is under processing.
Pass an address of the pointer to the rrm beacon
request API to get the allocated memory address.
Change-Id: I83c44a6a7a4a8e1ce56e48b008e7d784cca1dc6d
CRs-Fixed: 2144031
| -rw-r--r-- | core/mac/src/pe/rrm/rrm_api.c | 16 |
1 files changed, 9 insertions, 7 deletions
diff --git a/core/mac/src/pe/rrm/rrm_api.c b/core/mac/src/pe/rrm/rrm_api.c index 26c208178517..c1f12286d3c8 100644 --- a/core/mac/src/pe/rrm/rrm_api.c +++ b/core/mac/src/pe/rrm/rrm_api.c @@ -963,7 +963,7 @@ static void rrm_process_beacon_request_failure(tpAniSirGlobal pMac, * @peer: Macaddress of the peer requesting the radio measurement * @session_entry: session entry * @curr_req: Pointer to RRM request - * @report: Pointer to radio measurement report + * @radiomes_report: Pointer to radio measurement report * @rrm_req: Array of Measurement request IEs * @num_report: No.of reports * @index: Index for Measurement request @@ -976,27 +976,29 @@ static void rrm_process_beacon_request_failure(tpAniSirGlobal pMac, static tSirRetStatus rrm_process_beacon_req(tpAniSirGlobal mac_ctx, tSirMacAddr peer, tpPESession session_entry, tpRRMReq curr_req, - tpSirMacRadioMeasureReport report, + tpSirMacRadioMeasureReport *radiomes_report, tDot11fRadioMeasurementRequest *rrm_req, uint8_t *num_report, int index) { tRrmRetStatus rrm_status = eRRM_SUCCESS; + tpSirMacRadioMeasureReport report; if (curr_req) { - if (report == NULL) { + if (*radiomes_report == NULL) { /* * Allocate memory to send reports for * any subsequent requests. */ - report = qdf_mem_malloc(sizeof(*report) * + *radiomes_report = qdf_mem_malloc(sizeof(*report) * (rrm_req->num_MeasurementRequest - index)); - if (NULL == report) { + if (NULL == *radiomes_report) { pe_err("Unable to allocate memory during RRM Req processing"); return eSIR_MEM_ALLOC_FAILED; } pe_debug("rrm beacon type refused of %d report in beacon table", *num_report); } + report = *radiomes_report; report[*num_report].refused = 1; report[*num_report].type = SIR_MAC_RRM_BEACON_TYPE; report[*num_report].token = @@ -1007,7 +1009,7 @@ tSirRetStatus rrm_process_beacon_req(tpAniSirGlobal mac_ctx, tSirMacAddr peer, curr_req = qdf_mem_malloc(sizeof(*curr_req)); if (NULL == curr_req) { pe_err("Unable to allocate memory during RRM Req processing"); - qdf_mem_free(report); + qdf_mem_free(*radiomes_report); return eSIR_MEM_ALLOC_FAILED; } pe_debug("Processing Beacon Report request"); @@ -1131,7 +1133,7 @@ rrm_process_radio_measurement_request(tpAniSirGlobal mac_ctx, case SIR_MAC_RRM_BEACON_TYPE: /* Process beacon request. */ status = rrm_process_beacon_req(mac_ctx, peer, - session_entry, curr_req, report, rrm_req, + session_entry, curr_req, &report, rrm_req, &num_report, i); if (eSIR_SUCCESS != status) return status; |