From: clowdyffs When kmalloc() for tx_status fails partway through the TX ring allocation loop in ath12k_dp_setup(), the previously allocated tx_status buffers from earlier iterations are not freed on the error path. Add a cleanup loop to the existing failure path that frees all allocated tx_status buffers. The cleanup loop mirrors the existing pattern in ath12k_dp_device_deinit() (the normal teardown path) rather than extracting a shared helper, to avoid adding call overhead to the common deinit path. Happy to refactor into a helper if preferred. Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Signed-off-by: clowdyffs --- drivers/net/wireless/ath/ath12k/dp.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireless/ath/ath12k/dp.c b/drivers/net/wireless/ath/ath12k/dp.c index 1c82d927d27b..8ea0d41f9829 100644 --- a/drivers/net/wireless/ath/ath12k/dp.c +++ b/drivers/net/wireless/ath/ath12k/dp.c @@ -1548,9 +1548,6 @@ static int ath12k_dp_setup(struct ath12k_base *ab) dp->tx_ring[i].tx_status = kmalloc(size, GFP_KERNEL); if (!dp->tx_ring[i].tx_status) { ret = -ENOMEM; - /* FIXME: The allocated tx status is not freed - * properly here - */ goto fail_cmn_reoq_cleanup; } } @@ -1570,6 +1567,10 @@ static int ath12k_dp_setup(struct ath12k_base *ab) ath12k_dp_rx_free(ab); fail_cmn_reoq_cleanup: + for (i = 0; i < ab->hw_params->max_tx_ring; i++) { + kfree(dp->tx_ring[i].tx_status); + dp->tx_ring[i].tx_status = NULL; + } ath12k_dp_reoq_lut_cleanup(ab); fail_cmn_srng_cleanup: -- 2.53.0