From d5b44d34d95f0eff67341447ab8e17716ddb3eee Mon Sep 17 00:00:00 2001
From: Naveen Rawat <naveenrawat@codeaurora.org>
Date: Fri, 27 Jan 2017 16:54:57 -0800
Subject: qcacld-3.0: Fix memory leaks in csr_save_profile

Fix memory leaks in csr_save_profile by freeing all buffers within
saved cmd allocated within this function.

Change-Id: Ie06c91b145165df21992829883be11932871550d
CRs-Fixed: 1116619
---
 core/sme/src/csr/csr_api_roam.c | 24 +++++++++++++++++++++---
 core/sme/src/csr/csr_api_scan.c | 28 +++++++++++++++++++++++++---
 2 files changed, 46 insertions(+), 6 deletions(-)

diff --git a/core/sme/src/csr/csr_api_roam.c b/core/sme/src/csr/csr_api_roam.c
index 43e19050bc92..c4797023df90 100644
--- a/core/sme/src/csr/csr_api_roam.c
+++ b/core/sme/src/csr/csr_api_roam.c
@@ -428,15 +428,33 @@ QDF_STATUS csr_set_channels(tHalHandle hHal, tCsrConfigParam *pParam)
 QDF_STATUS csr_close(tpAniSirGlobal pMac)
 {
 	QDF_STATUS status = QDF_STATUS_SUCCESS;
+	tSmeCmd *saved_scan_cmd;
 
 	csr_roam_close(pMac);
 	csr_scan_close(pMac);
 	csr_ll_close(&pMac->roam.statsClientReqList);
 	csr_ll_close(&pMac->roam.peStatsReqList);
 	csr_ll_close(&pMac->roam.roamCmdPendingList);
-	if (pMac->sme.saved_scan_cmd) {
-		qdf_mem_free(pMac->sme.saved_scan_cmd);
-		pMac->sme.saved_scan_cmd = NULL;
+	saved_scan_cmd = (tSmeCmd *)pMac->sme.saved_scan_cmd;
+	if (saved_scan_cmd) {
+		csr_release_profile(pMac, saved_scan_cmd->u.scanCmd.
+				    pToRoamProfile);
+		if (saved_scan_cmd->u.scanCmd.pToRoamProfile) {
+			qdf_mem_free(saved_scan_cmd->u.scanCmd.pToRoamProfile);
+			saved_scan_cmd->u.scanCmd.pToRoamProfile = NULL;
+		}
+		if (saved_scan_cmd->u.scanCmd.u.scanRequest.SSIDs.SSIDList) {
+			qdf_mem_free(saved_scan_cmd->u.scanCmd.u.scanRequest.
+				     SSIDs.SSIDList);
+			saved_scan_cmd->u.scanCmd.u.scanRequest.SSIDs.
+				SSIDList = NULL;
+		}
+		if (saved_scan_cmd->u.roamCmd.pRoamBssEntry) {
+			qdf_mem_free(saved_scan_cmd->u.roamCmd.pRoamBssEntry);
+			saved_scan_cmd->u.roamCmd.pRoamBssEntry = NULL;
+		}
+		qdf_mem_free(saved_scan_cmd);
+		saved_scan_cmd = NULL;
 	}
 	/* DeInit Globals */
 	csr_roam_de_init_globals(pMac);
diff --git a/core/sme/src/csr/csr_api_scan.c b/core/sme/src/csr/csr_api_scan.c
index 78ecbf54ced4..bc3b6a4710c9 100644
--- a/core/sme/src/csr/csr_api_scan.c
+++ b/core/sme/src/csr/csr_api_scan.c
@@ -4051,6 +4051,7 @@ csr_handle_nxt_cmd(tpAniSirGlobal mac_ctx, tSmeCmd *pCommand,
 {
 	QDF_STATUS status, ret;
 	tSmeCmd *save_cmd = NULL;
+	tSmeCmd *saved_scan_cmd;
 
 	switch (*nxt_cmd) {
 	case eCsrNext11dScan1Success:
@@ -4115,9 +4116,30 @@ csr_handle_nxt_cmd(tpAniSirGlobal mac_ctx, tSmeCmd *pCommand,
 					SIR_UPDATE_REASON_HIDDEN_STA);
 		sms_log(mac_ctx, LOG1, FL("chan: %d session: %d status: %d"),
 					chan, pCommand->sessionId, ret);
-		if (mac_ctx->sme.saved_scan_cmd) {
-			qdf_mem_free(mac_ctx->sme.saved_scan_cmd);
-			mac_ctx->sme.saved_scan_cmd = NULL;
+		saved_scan_cmd = (tSmeCmd *)mac_ctx->sme.saved_scan_cmd;
+		if (saved_scan_cmd) {
+			csr_release_profile(mac_ctx, saved_scan_cmd->u.scanCmd.
+					    pToRoamProfile);
+			if (saved_scan_cmd->u.scanCmd.pToRoamProfile) {
+				qdf_mem_free(saved_scan_cmd->u.scanCmd.
+					     pToRoamProfile);
+				saved_scan_cmd->u.scanCmd.
+					pToRoamProfile = NULL;
+			}
+			if (saved_scan_cmd->u.scanCmd.u.scanRequest.SSIDs.
+			    SSIDList) {
+				qdf_mem_free(saved_scan_cmd->u.scanCmd.u.
+					     scanRequest.SSIDs.SSIDList);
+				saved_scan_cmd->u.scanCmd.u.scanRequest.SSIDs.
+					SSIDList = NULL;
+			}
+			if (saved_scan_cmd->u.roamCmd.pRoamBssEntry) {
+				qdf_mem_free(saved_scan_cmd->u.roamCmd.
+					     pRoamBssEntry);
+				saved_scan_cmd->u.roamCmd.pRoamBssEntry = NULL;
+			}
+			qdf_mem_free(saved_scan_cmd);
+			saved_scan_cmd = NULL;
 			sms_log(mac_ctx, LOGE,
 				FL("memory should have been free. Check!"));
 		}
-- 
cgit v1.2.3