Skip to content
23 changes: 21 additions & 2 deletions source/apps/sm/wifi_sm.c
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ typedef struct {
static int sm_stats_to_monitor_set(wifi_app_t *app, bool enable);
static void sm_events_subscribe(wifi_app_t *app);

client_assoc_stats_t client_assoc_stats[MAX_NUM_RADIOS];
client_assoc_stats_t *client_assoc_stats = NULL; //allocate during app init

int sm_survey_type_conversion(wifi_neighborScanMode_t *halw_scan_type, survey_type_t *app_stat_type, unsigned int conv_type)
{
Expand Down Expand Up @@ -878,6 +878,7 @@ static void sm_events_subscribe(wifi_app_t *app)
int sm_init(wifi_app_t *app, unsigned int create_flag)
{
int rc = RETURN_OK;
int radios_count = getNumberRadios();
if (app_init(app, create_flag) != 0) {
return RETURN_ERR;
}
Expand All @@ -888,8 +889,22 @@ int sm_init(wifi_app_t *app, unsigned int create_flag)
app->data.u.sm_data.sm_stats_config_map = hash_map_create();
app->data.u.sm_data.report_tasks_map = hash_map_create();

memset(client_assoc_stats, 0, sizeof(client_assoc_stats));
client_assoc_stats = calloc(radios_count, sizeof(client_assoc_stats_t));
if (client_assoc_stats == NULL) {
wifi_util_error_print(WIFI_SM, "%s:%d: calloc failed for client_assoc_stats\n", __func__, __LINE__);
hash_map_destroy(app->data.u.sm_data.report_tasks_map);
app->data.u.sm_data.report_tasks_map = NULL;
free_sm_stats_config_map(app);
return RETURN_ERR;
Comment on lines +892 to +898
Copy link

Copilot AI Feb 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

On the calloc failure path, sm_stats_config_map and report_tasks_map have already been created, but the function returns immediately without destroying them. Add cleanup for those allocations (and any other init steps in this function) before returning to avoid leaks when SM init fails early.

Copilot uses AI. Check for mistakes.
}
rc = sm_report_init(app);
if (rc != RETURN_OK) {
free(client_assoc_stats);
client_assoc_stats = NULL;
hash_map_destroy(app->data.u.sm_data.report_tasks_map);
app->data.u.sm_data.report_tasks_map = NULL;
free_sm_stats_config_map(app);
}
Comment on lines 900 to +907
Copy link

Copilot AI Feb 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If sm_report_init(app) fails, this code frees client_assoc_stats but leaves sm_stats_config_map / report_tasks_map allocated and returns the error. Please add a consolidated failure cleanup path (e.g., goto cleanup) that also destroys these maps (and any other partially-initialized resources) before returning.

Copilot uses AI. Check for mistakes.

Comment on lines +892 to 908
Copy link

Copilot AI Feb 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If sm_report_init(app) fails, sm_init() returns an error but client_assoc_stats (allocated here) is not freed, and the newly-created maps also remain allocated. Add cleanup on the failure path (free client_assoc_stats, destroy sm_stats_config_map / report_tasks_map, etc.), or refactor sm_init() to a single goto-based cleanup block.

Copilot uses AI. Check for mistakes.
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@copilot open a new pull request to apply changes based on this feedback

wifi_util_info_print(WIFI_SM, "%s:%d: Init SM app %s\n", __func__, __LINE__,
rc ? "failure" : "success");
Expand Down Expand Up @@ -923,6 +938,10 @@ int sm_deinit(wifi_app_t *app)
{
sm_stats_to_monitor_set(app, false);
free_sm_stats_config_map(app);
if (client_assoc_stats != NULL) {
free(client_assoc_stats);
client_assoc_stats = NULL;
}
sm_report_deinit(app);
return RETURN_OK;
}
Loading