observed memory leak in wpa_supplicant

[Naveen Singh]

Hi All
We have been running some stress test of sending a deauth with reason
code 6 and 7 from an AP to an associated client and monitoring the
memory usage of wpa_supplicant. In our setup wpa_supplicant talks to
connman over dbus. Running this stress test reveals memory leak in wpa
supplicant (memory usage of wpa supplicant keeps on growing).

For connection after getting disconnected connman does "AddNetwork"
DBUS call to the previously connected SSID. This ends up causing
memory to be allocated for struct wpa_ssid (os_zalloc called). At this
time there is already a structure allocated for same SSID as a result
of previous connection. Every connection ends up creating a memory
which is never freed.

This surely causes memory usage of wpa_supplicant to go up. Should not
we be allocating memory only if that profile (for that SSID does not
exist?)

I am talking about this function:
struct wpa_ssid * wpa_config_add_network(struct wpa_config *config)
{
int id;
struct wpa_ssid *ssid, *last = NULL;

id = -1;
ssid = config->ssid;
while (ssid) {
        wpa_printf(MSG_ERROR, "wpa_config_add_network existing ssid is
%p", ssid);
if (ssid->id > id)
id = ssid->id;
last = ssid;
ssid = ssid->next;
}
id++;

ssid = os_zalloc(sizeof(*ssid));
if (ssid == NULL)
return NULL;
ssid->id = id;
if (last)
last->next = ssid;
else
config->ssid = ssid;
        wpa_printf(MSG_ERROR, "wpa_config_add_network added %p size
%d", ssid, sizeof(*ssid));

wpa_config_update_prio_list(config);

return ssid;
}
Regards