WifiHAL: Free the stats received so far if requestResponse() fails
WLAN driver may return failure (e.g. TIMEOUT) for llstats_get even after sending few stats to wifihal. This is possible in the below cases, 1. Driver gets radio stats from firmware and sent those stats to the wifihal and got a TIMEOUT while waiting for iface stats 2. Driver gets radio stats and iface stats from firmware and sent those stats to the wifihal and got a TIMEOUT while waiting for peer stats Wifihal treats this as complete request failure from driver and doesn't return the received stats to framework. The memory allocated for these stats is not getting freed. Free the same when requestResponse() returns error. Remove the memset() of mResultsParams in initGetContext() as it's causing a memleak of the stats collected in the above cases when next llstats_get request comes from framework. This memset() just resets mResultsParams but doesn't reset the cached results size parameter mRadioStatsSize. When next radios stats come to wifihal, realloc() with this parameter creates a fresh buffer (mResultsParams.radio_stats) of size (mRadioStatsSize+new_stats_size) but memset happens only from address (mResultsParams.radio_stats+mRadioStatsSize). So mResultsParams.radio_stats contains garbage values from mResultsParams.radio_stats to mResultsParams.radio_stats+mRadioStatsSize byte. Native or wifihal accesses these garbage values and tx_time_per_levels is one of them. Accessing tx_time_per_levels leads to illegal memory access as it contains garbage values. Change-Id: Ic99541c16d2fd0328c504da10fef2acdbf228b12
Loading
Please sign in to comment