[PATCH] wifi: wcn36xx: drop the SMSM state references on probe error

[PATCH] wifi: wcn36xx: drop the SMSM state references on probe error

[Wentao Liang]

wcn36xx_platform_get_resources() acquires two SMSM state handles with
qcom_smem_state_get(). Each successful call returns a reference that the
caller has to release with qcom_smem_state_put(), which is only done by
wcn36xx_remove() for a device that probed successfully.

Several error paths in between return without dropping the references
already taken: failing to get the "tx-rings-empty" handle leaks the
"tx-enable" one, and failing to look up the qcom,mmio phandle or to map
one of the mmio regions leaks both of them. A probe that fails after the
first successful acquisition therefore leaks the SMSM state references
for good.

Make these paths unwind through the existing label chain and put the
handles there.

Fixes: f303a9311065 ("wcn36xx: Transition driver to SMD client")
Cc: stable@vger.kernel.org
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/net/wireless/ath/wcn36xx/main.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
index ad8a4bd910d2..0c4f5b5b8dda 100644
--- a/drivers/net/wireless/ath/wcn36xx/main.c
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -1502,13 +1502,15 @@ static int wcn36xx_platform_get_resources(struct wcn36xx *wcn,
 			"tx-rings-empty", &wcn->tx_rings_empty_state_bit);
 	if (IS_ERR(wcn->tx_rings_empty_state)) {
 		wcn36xx_err("failed to get tx-rings-empty state\n");
-		return PTR_ERR(wcn->tx_rings_empty_state);
+		ret = PTR_ERR(wcn->tx_rings_empty_state);
+		goto put_tx_enable_state;
 	}
 
 	mmio_node = of_parse_phandle(pdev->dev.parent->of_node, "qcom,mmio", 0);
 	if (!mmio_node) {
 		wcn36xx_err("failed to acquire qcom,mmio reference\n");
-		return -EINVAL;
+		ret = -EINVAL;
+		goto put_tx_rings_empty_state;
 	}
 
 	wcn->is_pronto = !!of_device_is_compatible(mmio_node, "qcom,pronto");
@@ -1552,6 +1554,10 @@ static int wcn36xx_platform_get_resources(struct wcn36xx *wcn,
 	iounmap(wcn->ccu_base);
 put_mmio_node:
 	of_node_put(mmio_node);
+put_tx_rings_empty_state:
+	qcom_smem_state_put(wcn->tx_rings_empty_state);
+put_tx_enable_state:
+	qcom_smem_state_put(wcn->tx_enable_state);
 	return ret;
 }
 
-- 
2.34.1

Re: [PATCH] wifi: wcn36xx: drop the SMSM state references on probe error

[Krzysztof Kozlowski]

On Tue, 03 Nov 2026 10:29:02 +0000, Wentao Liang wrote:
> wcn36xx_platform_get_resources() acquires two SMSM state handles with
> qcom_smem_state_get(). Each successful call returns a reference that the
> caller has to release with qcom_smem_state_put(), which is only done by
> wcn36xx_remove() for a device that probed successfully.
> 
> Several error paths in between return without dropping the references
> already taken: failing to get the "tx-rings-empty" handle leaks the
> "tx-enable" one, and failing to look up the qcom,mmio phandle or to map
> one of the mmio regions leaks both of them. A probe that fails after the
> first successful acquisition therefore leaks the SMSM state references
> for good.
> 
> Make these paths unwind through the existing label chain and put the
> handles there.
> 
> Fixes: f303a9311065 ("wcn36xx: Transition driver to SMD client")
> Cc: stable@vger.kernel.org
> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/net/wireless/ath/wcn36xx/main.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
> 



Multiple things here:
1. Your team ignored completely previous feedback. Multiple times.

2. You use multiple identities with this email address, thus I doubt that we
   speak with an actual person.

3. Your bot does not even bother running checkpatch, right?

4. Nothing of this was reproduced nor tested.

5. Finally, the same feedback:
You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.

This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down.  Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.

Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem (so a patchset grouping multiple patches with a short cover
letter), how to document the issue discovery method and what was
or was not tested.

Best regards,
Krzysztof

Re: [PATCH] wifi: wcn36xx: drop the SMSM state references on probe error

[Krzysztof Kozlowski]

On Tue, 03 Nov 2026 10:29:02 +0000, Wentao Liang wrote:
> wcn36xx_platform_get_resources() acquires two SMSM state handles with
> qcom_smem_state_get(). Each successful call returns a reference that the
> caller has to release with qcom_smem_state_put(), which is only done by
> wcn36xx_remove() for a device that probed successfully.
> 
> Several error paths in between return without dropping the references
> already taken: failing to get the "tx-rings-empty" handle leaks the
> "tx-enable" one, and failing to look up the qcom,mmio phandle or to map
> one of the mmio regions leaks both of them. A probe that fails after the
> first successful acquisition therefore leaks the SMSM state references
> for good.
> 
> Make these paths unwind through the existing label chain and put the
> handles there.
> 
> Fixes: f303a9311065 ("wcn36xx: Transition driver to SMD client")
> Cc: stable@vger.kernel.org
> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/net/wireless/ath/wcn36xx/main.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
> 

Multiple things here:
1. Your team ignored completely previous feedback. Multiple times.

2. You use multiple identities with this email address, thus I doubt that we
   speak with an actual person.

3. Your bot does not even bother running checkpatch, right?

4. Nothing of this was reproduced nor tested.

5. Finally, the same feedback:
You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.

This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down.  Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.

Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem (so a patchset grouping multiple patches with a short cover
letter), how to document the issue discovery method and what was
or was not tested.

Best regards,
Krzysztof