Commit 424c545d authored by Subhani Shaik's avatar Subhani Shaik
Browse files

WifiHAL: Free the stats received so far if requestResponse() fails

WLAN driver may return failure (e.g. TIMEOUT) for llstats_get even
after sending few stats to wifihal. This is possible in the below
cases,
1. Driver gets radio stats from firmware and sent those stats to
   the wifihal and got a TIMEOUT while waiting for iface stats
2. Driver gets radio stats and iface stats from firmware and sent
   those stats to the wifihal and got a TIMEOUT while waiting for
   peer stats

Wifihal treats this as complete request failure from driver and
doesn't return the received stats to framework. The memory
allocated for these stats is not getting freed. Free the same
when requestResponse() returns error.

Remove the memset() of mResultsParams in initGetContext() as it's
causing a memleak of the stats collected in the above cases when
next llstats_get request comes from framework.
This memset() just resets mResultsParams but doesn't reset the
cached results size parameter mRadioStatsSize.
When next radios stats come to wifihal, realloc() with this
parameter creates a fresh buffer (mResultsParams.radio_stats) of
size (mRadioStatsSize+new_stats_size) but memset happens only from
address (mResultsParams.radio_stats+mRadioStatsSize).
So mResultsParams.radio_stats contains garbage values from
mResultsParams.radio_stats to
mResultsParams.radio_stats+mRadioStatsSize byte.
Native or wifihal accesses these garbage values and
tx_time_per_levels is one of them.
Accessing tx_time_per_levels leads to illegal memory access as it
contains garbage values.

Change-Id: Ic99541c16d2fd0328c504da10fef2acdbf228b12
parent bb197790
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment