qcacld-3.0: Potential double free in lim_send_sme_wm_status_change_ntf()
lim_sys_process_mmh_msg_api() is a wrapper for sys_process_mmh_msg(),
and sys_process_mmh_msg() itself free the msg->bodyptr. So if
lim_sys_process_mmh_msg_api() returns an error, wm_status_change_ntf
would be freed by both sys_process_mmh_msg() and
lim_send_sme_wm_status_change_ntf()
Change-Id: Ib66d0263625fc2606b4fb4d16f007f3d155977ba
CRs-Fixed: 2411688
diff --git a/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c b/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c
index 1902c67..6ae2450 100644
--- a/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c
+++ b/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c
@@ -1179,10 +1179,7 @@
}
MTRACE(mac_trace(mac_ctx, TRACE_CODE_TX_SME_MSG, session_id, msg.type));
- if (QDF_STATUS_SUCCESS != lim_sys_process_mmh_msg_api(mac_ctx, &msg)) {
- qdf_mem_free(wm_status_change_ntf);
- pe_err("lim_sys_process_mmh_msg_api failed");
- }
+ lim_sys_process_mmh_msg_api(mac_ctx, &msg);
} /*** end lim_send_sme_wm_status_change_ntf() ***/