qcacld-3.0: Potential double free in lim_send_sme_wm_status_change_ntf()
lim_sys_process_mmh_msg_api() is a wrapper for sys_process_mmh_msg(),
and sys_process_mmh_msg() itself free the msg->bodyptr. So if
lim_sys_process_mmh_msg_api() returns an error, wm_status_change_ntf
would be freed by both sys_process_mmh_msg() and
lim_send_sme_wm_status_change_ntf()
Change-Id: Ib66d0263625fc2606b4fb4d16f007f3d155977ba
CRs-Fixed: 2411688
diff --git a/core/mac/src/pe/lim/lim_process_probe_req_frame.c b/core/mac/src/pe/lim/lim_process_probe_req_frame.c
index 4bedb40..810c08d 100644
--- a/core/mac/src/pe/lim/lim_process_probe_req_frame.c
+++ b/core/mac/src/pe/lim/lim_process_probe_req_frame.c
@@ -562,7 +562,6 @@
qdf_mem_copy(pSirSmeProbeReqInd->WPSPBCProbeReq.probeReqIE, pProbeReqIE,
ProbeReqIELen);
- if (lim_sys_process_mmh_msg_api(mac, &msgQ) != QDF_STATUS_SUCCESS)
- pe_err("couldnt send the probe req to hdd");
+ lim_sys_process_mmh_msg_api(mac, &msgQ);
} /*** end lim_send_sme_probe_req_ind() ***/
diff --git a/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c b/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c
index 1902c67..6ae2450 100644
--- a/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c
+++ b/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c
@@ -1179,10 +1179,7 @@
}
MTRACE(mac_trace(mac_ctx, TRACE_CODE_TX_SME_MSG, session_id, msg.type));
- if (QDF_STATUS_SUCCESS != lim_sys_process_mmh_msg_api(mac_ctx, &msg)) {
- qdf_mem_free(wm_status_change_ntf);
- pe_err("lim_sys_process_mmh_msg_api failed");
- }
+ lim_sys_process_mmh_msg_api(mac_ctx, &msg);
} /*** end lim_send_sme_wm_status_change_ntf() ***/
diff --git a/core/mac/src/pe/lim/lim_utils.h b/core/mac/src/pe/lim/lim_utils.h
index fcc1b01..ac8398c 100644
--- a/core/mac/src/pe/lim/lim_utils.h
+++ b/core/mac/src/pe/lim/lim_utils.h
@@ -269,12 +269,10 @@
/* Deferred Message Queue Reset */
void lim_reset_deferred_msg_q(struct mac_context *mac);
-static inline QDF_STATUS lim_sys_process_mmh_msg_api(struct mac_context *mac,
- struct scheduler_msg *msg)
+static inline void lim_sys_process_mmh_msg_api(struct mac_context *mac,
+ struct scheduler_msg *msg)
{
sys_process_mmh_msg(mac, msg);
-
- return QDF_STATUS_SUCCESS;
}
void lim_handle_update_olbc_cache(struct mac_context *mac);