qcacld-2.0: Fix wild pointer issue for AC tx queue optimization

The WDA_SET_AC_TXQ_OPTIMIZE msg buffer freed without alloc, this
will cause wild pointer. In this change, do not use pointer to pass
the AC tx queue optimization parameter, and remove the invalid buffer
free.

Change-Id: I232a854b24f21d7fd2fdebb9351f21f64d39bc8d
CRs-Fixed: 2425153

5 files changed, 15 insertions, 15 deletions

diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c
index 668c77ec3079..547ea5dca7f6 100644
--- a/CORE/HDD/src/wlan_hdd_main.c
+++ b/CORE/HDD/src/wlan_hdd_main.c
@@ -17665,7 +17665,7 @@ int hdd_wlan_startup(struct device *dev, v_VOID_t *hif_sc)
 
    if ((pHddCtx->cfg_ini->enable_ac_txq_optimize >> 4) & 0x01)
       sme_set_ac_txq_optimize(pHddCtx->hHal,
-                              &pHddCtx->cfg_ini->enable_ac_txq_optimize);
+                              pHddCtx->cfg_ini->enable_ac_txq_optimize);
 
    if (pHddCtx->cfg_ini->enable_go_cts2self_for_sta)
        sme_set_cts2self_for_p2p_go(pHddCtx->hHal);
diff --git a/CORE/SERVICES/COMMON/wma_api.h b/CORE/SERVICES/COMMON/wma_api.h
index cec7bd647b2d..1a07321f60c0 100644
--- a/CORE/SERVICES/COMMON/wma_api.h
+++ b/CORE/SERVICES/COMMON/wma_api.h
@@ -189,5 +189,5 @@ VOS_STATUS wma_set_tx_power_scale_decr_db(uint8_t vdev_id, int value);
 void wma_tx_failure_cb(void *ctx, uint32_t num_msdu,
 		       uint8_t tid, uint32_t status);
 
-VOS_STATUS wma_set_ac_txq_optimize(void *wda_handle, uint8_t *value);
+VOS_STATUS wma_set_ac_txq_optimize(void *wda_handle, uint8_t value);
 #endif
diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c
index 2e3d1450ca7c..e5392ffe1df8 100644
--- a/CORE/SERVICES/WMA/wma.c
+++ b/CORE/SERVICES/WMA/wma.c
@@ -35726,8 +35726,7 @@ VOS_STATUS wma_mc_process_msg(v_VOID_t *vos_context, vos_msg_t *msg)
 			vos_mem_free(msg->bodyptr);
 			break;
 		case WDA_SET_AC_TXQ_OPTIMIZE:
-			wma_set_ac_txq_optimize(wma_handle, msg->bodyptr);
-			vos_mem_free(msg->bodyptr);
+			wma_set_ac_txq_optimize(wma_handle, msg->bodyval);
 			break;
 		case WDA_MNT_FILTER_TYPE_CMD:
 			wma_mnt_filter_type_cmd(wma_handle,
@@ -40162,7 +40161,7 @@ VOS_STATUS wma_set_cts2self_for_p2p_go(void *wda_handle,
  * Return: VOS_STATUS.
  */
 static int32_t
-wmi_unified_ac_txq_optimize_send(wmi_unified_t wmi, uint8_t *ac_txq_optimize)
+wmi_unified_ac_txq_optimize_send(wmi_unified_t wmi, uint8_t ac_txq_optimize)
 {
 	wmi_pdev_set_ac_tx_queue_optimized_cmd_fixed_param *cmd;
 	wmi_buf_t buf;
@@ -40182,11 +40181,12 @@ wmi_unified_ac_txq_optimize_send(wmi_unified_t wmi, uint8_t *ac_txq_optimize)
 		       wmi_pdev_set_ac_tx_queue_optimized_cmd_fixed_param));
 
 	cmd->pdev_id = 0;
-	if ((*ac_txq_optimize & 0x0f) < NUM_AC)
-		cmd->ac = *ac_txq_optimize & 0x0f;
-	else
+	if ((ac_txq_optimize & 0x0f) < NUM_AC)
+		cmd->ac = ac_txq_optimize & 0x0f;
+	else {
+		WMA_LOGE("%s: error conf val 0x%x", __func__, ac_txq_optimize);
 		return -EINVAL;
-
+	}
 	cmd->ac_tx_queue_optimize_enable = 1;
 
 	if (wmi_unified_cmd_send(wmi, buf, len,
@@ -40207,18 +40207,18 @@ wmi_unified_ac_txq_optimize_send(wmi_unified_t wmi, uint8_t *ac_txq_optimize)
  *
  * Return: VOS_STATUS.
  */
-VOS_STATUS wma_set_ac_txq_optimize(void *wda_handle, uint8_t *value)
+VOS_STATUS wma_set_ac_txq_optimize(void *wda_handle, uint8_t value)
 {
 	int32_t ret;
 	tp_wma_handle wma = (tp_wma_handle)wda_handle;
 
 	ret = wmi_unified_ac_txq_optimize_send(wma->wmi_handle, value);
 	if (ret) {
-		WMA_LOGE("Fail to Set AC queue, input 0x%02x", *value);
+		WMA_LOGE("Fail to Set AC queue, input 0x%02x", value);
 		return VOS_STATUS_E_FAILURE;
 	}
 
-	WMA_LOGI("Successfully Set AC queue, input 0x%02x", *value);
+	WMA_LOGI("Successfully Set AC queue, input 0x%02x", value);
 	return VOS_STATUS_SUCCESS;
 }
 
diff --git a/CORE/SME/inc/sme_Api.h b/CORE/SME/inc/sme_Api.h
index d3ec3c65df4b..f5f7b855d5b5 100644
--- a/CORE/SME/inc/sme_Api.h
+++ b/CORE/SME/inc/sme_Api.h
@@ -4867,7 +4867,7 @@ eHalStatus sme_clear_random_mac(tHalHandle hal, uint32_t session_id,
 eHalStatus sme_set_chip_pwr_save_fail_cb(tHalHandle hal, void (*cb)( void *,
 				struct chip_pwr_save_fail_detected_params *));
 
-eHalStatus sme_set_ac_txq_optimize(tHalHandle hal_handle, uint8_t *value);
+eHalStatus sme_set_ac_txq_optimize(tHalHandle hal_handle, uint8_t value);
 
 VOS_STATUS sme_mnt_filter_type_cmd(struct sme_mnt_filter_type_req *input);
 
diff --git a/CORE/SME/src/sme_common/sme_Api.c b/CORE/SME/src/sme_common/sme_Api.c
index 4075c49acc2a..4f5f76a41553 100644
--- a/CORE/SME/src/sme_common/sme_Api.c
+++ b/CORE/SME/src/sme_common/sme_Api.c
@@ -14742,12 +14742,12 @@ eHalStatus sme_set_cts2self_for_p2p_go(tHalHandle hal_handle)
  * @value                          reference to the value
  * Return: hal_status
  */
-eHalStatus sme_set_ac_txq_optimize(tHalHandle hal_handle, uint8_t *value)
+eHalStatus sme_set_ac_txq_optimize(tHalHandle hal_handle, uint8_t value)
 {
 	eHalStatus status = eHAL_STATUS_SUCCESS;
 	vos_msg_t vos_msg;
 
-	vos_msg.bodyptr = value;
+	vos_msg.bodyval = value;
 	vos_msg.type = WDA_SET_AC_TXQ_OPTIMIZE;
 	if (!VOS_IS_STATUS_SUCCESS(vos_mq_post_message(VOS_MODULE_ID_WDA,
 						       &vos_msg))) {