From d4caa41ce4e3c053c2aec1cd01554ef46ec654c0 Mon Sep 17 00:00:00 2001 From: Sandeep Puligilla Date: Wed, 15 Nov 2017 16:51:51 -0800 Subject: qcacld-3.0: Fix memory leak in measurement request processing Memory leak is detected while processing the measurement report request while another request is under processing. Pass an address of the pointer to the rrm beacon request API to get the allocated memory address. Change-Id: I83c44a6a7a4a8e1ce56e48b008e7d784cca1dc6d CRs-Fixed: 2144031 --- core/mac/src/pe/rrm/rrm_api.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/core/mac/src/pe/rrm/rrm_api.c b/core/mac/src/pe/rrm/rrm_api.c index 26c208178517..c1f12286d3c8 100644 --- a/core/mac/src/pe/rrm/rrm_api.c +++ b/core/mac/src/pe/rrm/rrm_api.c @@ -963,7 +963,7 @@ static void rrm_process_beacon_request_failure(tpAniSirGlobal pMac, * @peer: Macaddress of the peer requesting the radio measurement * @session_entry: session entry * @curr_req: Pointer to RRM request - * @report: Pointer to radio measurement report + * @radiomes_report: Pointer to radio measurement report * @rrm_req: Array of Measurement request IEs * @num_report: No.of reports * @index: Index for Measurement request @@ -976,27 +976,29 @@ static void rrm_process_beacon_request_failure(tpAniSirGlobal pMac, static tSirRetStatus rrm_process_beacon_req(tpAniSirGlobal mac_ctx, tSirMacAddr peer, tpPESession session_entry, tpRRMReq curr_req, - tpSirMacRadioMeasureReport report, + tpSirMacRadioMeasureReport *radiomes_report, tDot11fRadioMeasurementRequest *rrm_req, uint8_t *num_report, int index) { tRrmRetStatus rrm_status = eRRM_SUCCESS; + tpSirMacRadioMeasureReport report; if (curr_req) { - if (report == NULL) { + if (*radiomes_report == NULL) { /* * Allocate memory to send reports for * any subsequent requests. */ - report = qdf_mem_malloc(sizeof(*report) * + *radiomes_report = qdf_mem_malloc(sizeof(*report) * (rrm_req->num_MeasurementRequest - index)); - if (NULL == report) { + if (NULL == *radiomes_report) { pe_err("Unable to allocate memory during RRM Req processing"); return eSIR_MEM_ALLOC_FAILED; } pe_debug("rrm beacon type refused of %d report in beacon table", *num_report); } + report = *radiomes_report; report[*num_report].refused = 1; report[*num_report].type = SIR_MAC_RRM_BEACON_TYPE; report[*num_report].token = @@ -1007,7 +1009,7 @@ tSirRetStatus rrm_process_beacon_req(tpAniSirGlobal mac_ctx, tSirMacAddr peer, curr_req = qdf_mem_malloc(sizeof(*curr_req)); if (NULL == curr_req) { pe_err("Unable to allocate memory during RRM Req processing"); - qdf_mem_free(report); + qdf_mem_free(*radiomes_report); return eSIR_MEM_ALLOC_FAILED; } pe_debug("Processing Beacon Report request"); @@ -1131,7 +1133,7 @@ rrm_process_radio_measurement_request(tpAniSirGlobal mac_ctx, case SIR_MAC_RRM_BEACON_TYPE: /* Process beacon request. */ status = rrm_process_beacon_req(mac_ctx, peer, - session_entry, curr_req, report, rrm_req, + session_entry, curr_req, &report, rrm_req, &num_report, i); if (eSIR_SUCCESS != status) return status; -- cgit v1.2.3