commit deb2253b5134924ed64baf7d2b1d2f6cfc12d0f2
author Sreelakshmi Konamki <c_skonam@qti.qualcomm.com> Thu Apr 14 14:59:13 2016 +0530
committer Satyanarayana Dash <sadash@codeaurora.org> Thu Apr 28 17:15:42 2016 +0530
tree e733925cfc10be1470d943d07aa3ad118d3d838e
parent 5d09520ae9f07d2ba89e67c8463629ba427412bd

wlan: Fix memory leak and NULL pointer dereference issues

Few functions doesn't free the allocated memory during failure cases
and dereference the pointer before NULL check.

This includes fix to free the allocated memory during failure cases,
add NULL check before deferencing the pointer and
memory layering violation in SME.

Change-Id: Ia4717c29788612a9b0c6e0286e6d70cefcc81df7
CRs-Fixed: 996173

CORE/HDD/src/wlan_hdd_cfg80211.c

diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c
index b41784a..c5a3a04 100644
--- a/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -6400,12 +6400,12 @@
         if (control == QCA_WLAN_RSSI_MONITORING_START) {
                 if (!tb[PARAM_MIN_RSSI]) {
                         hddLog(LOGE, FL("attr min rssi failed"));
-                        return -EINVAL;
+                        goto fail;
                 }
 
                 if (!tb[PARAM_MAX_RSSI]) {
                         hddLog(LOGE, FL("attr max rssi failed"));
-                        return -EINVAL;
+                        goto fail;
                 }
 
                 pReq->minRssi = nla_get_s8(tb[PARAM_MIN_RSSI]);
@@ -6415,7 +6415,7 @@
                 if (!(pReq->minRssi < pReq->maxRssi)) {
                         hddLog(LOGW, FL("min_rssi: %d must be less than max_rssi: %d"),
                                         pReq->minRssi, pReq->maxRssi);
-                        return -EINVAL;
+                        goto fail;
                 }
                 hddLog(LOG1, FL("Min_rssi: %d Max_rssi: %d"),
                        pReq->minRssi, pReq->maxRssi);
@@ -6428,16 +6428,19 @@
         }
         else {
                 hddLog(LOGE, FL("Invalid control cmd: %d"), control);
-                return -EINVAL;
+                goto fail;
         }
 
         if (!HAL_STATUS_SUCCESS(status)) {
                 hddLog(LOGE,
                         FL("sme_set_rssi_monitoring failed(err=%d)"), status);
-                return -EINVAL;
+                goto fail;
         }
 
         return 0;
+fail:
+        vos_mem_free(pReq);
+        return -EINVAL;
 }
 
 /*
@@ -6751,7 +6754,7 @@
     if (request_id == 0)
     {
         hddLog(LOGE, FL("request_id cannot be zero"));
-        return -EINVAL;
+        goto fail;
     }
 
     if (!tb[PARAM_PERIOD])