In ath11k_dp_srng_setup(), the memory allocated for ring->vaddr_unaligned is not freed in the error paths that follow. Fix that by calling ath11k_dp_srng_cleanup() in those error paths. Compile tested only. Issue found using a prototype static analysis tool built on the LLVM compiler infrastructure. Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-sonnet-4-6 Reviewed-by: Baochen Qiang Signed-off-by: Abdun Nihaal --- v1->v2: - Moved the information about compile testing, and how the issue was detected to the commit message, as suggested by Baochen Qiang. - Add the release function in the switch default case as well, as pointed out by Jeff Johnson. Also add Assisted-by tag. v1 link: https://patchwork.kernel.org/project/linux-wireless/patch/20260727105532.118164-1-nihaal@cse.iitm.ac.in/ drivers/net/wireless/ath/ath11k/dp.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/wireless/ath/ath11k/dp.c b/drivers/net/wireless/ath/ath11k/dp.c index f389b97acbdd..be65d73b904b 100644 --- a/drivers/net/wireless/ath/ath11k/dp.c +++ b/drivers/net/wireless/ath/ath11k/dp.c @@ -313,6 +313,7 @@ int ath11k_dp_srng_setup(struct ath11k_base *ab, struct dp_srng *ring, case HAL_RXDMA_DIR_BUF: break; default: + ath11k_dp_srng_cleanup(ab, ring); ath11k_warn(ab, "Not a valid ring type in dp :%d\n", type); return -EINVAL; } @@ -324,6 +325,7 @@ int ath11k_dp_srng_setup(struct ath11k_base *ab, struct dp_srng *ring, ret = ath11k_hal_srng_setup(ab, type, ring_num, mac_id, ¶ms); if (ret < 0) { + ath11k_dp_srng_cleanup(ab, ring); ath11k_warn(ab, "failed to setup srng: %d ring_id %d\n", ret, ring_num); return ret; -- 2.43.0