[PATCH] wifi: ath10k: Fix potential CE configuration leaks on PCI probe failure

[PATCH] wifi: ath10k: Fix potential CE configuration leaks on PCI probe failure

[Guangshuo Li]

PCI claim, wakeup or IRQ initialization failures bypass
ath10k_pci_release_resource(), leaking the three configuration arrays
allocated by ath10k_pci_setup_resource().

Free the arrays with the CE pipes on the common unwind path. Keep
the later hardware cleanup separate so the arrays are freed once.

This issue was found by our static analysis tool under development.

Fixes: 1cfd3426ef98 ("ath10k: Fix NULL pointer dereference in AHB device probe")
Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
---
Validation: x86-64 Clang W=1 changed-object builds passed with
allmodconfig and allyesconfig. No hardware/kernel runtime test or full
linked-kernel build.
OpenAI Codex assisted with source review, patch implementation and
commit-message drafting. The submitter has reviewed the changes.

 drivers/net/wireless/ath/ath10k/pci.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index 335bc7c488e4..f3c4fe13f76b 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -3716,7 +3716,9 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
 	ath10k_pci_free_irq(ar);
 
 err_deinit_irq:
-	ath10k_pci_release_resource(ar);
+	ath10k_pci_rx_retry_sync(ar);
+	netif_napi_del(&ar->napi);
+	ath10k_pci_ce_deinit(ar);
 
 err_sleep:
 	ath10k_pci_sleep_sync(ar);
@@ -3724,6 +3726,9 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
 
 err_free_pipes:
 	ath10k_pci_free_pipes(ar);
+	kfree(ar_pci->attr);
+	kfree(ar_pci->pipe_config);
+	kfree(ar_pci->serv_to_pipe);
 
 err_core_destroy:
 	ath10k_core_destroy(ar);

base-commit: 05441d697f7f9a927264f4058cbbc6a03dfcac9d

Re: [PATCH] wifi: ath10k: Fix potential CE configuration leaks on PCI probe failure

[Loic Poulain]

Hi Guangshuo,

On Wed, Nov 4, 2026 at 3:34 AM Guangshuo Li <liguangshuo@mail.sdu.edu.cn> wrote:
>
> PCI claim, wakeup or IRQ initialization failures bypass
> ath10k_pci_release_resource(), leaking the three configuration arrays
> allocated by ath10k_pci_setup_resource().
>
> Free the arrays with the CE pipes on the common unwind path. Keep
> the later hardware cleanup separate so the arrays are freed once.
>
> This issue was found by our static analysis tool under development.
>
> Fixes: 1cfd3426ef98 ("ath10k: Fix NULL pointer dereference in AHB device probe")
> Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
> ---
> Validation: x86-64 Clang W=1 changed-object builds passed with
> allmodconfig and allyesconfig. No hardware/kernel runtime test or full
> linked-kernel build.
> OpenAI Codex assisted with source review, patch implementation and
> commit-message drafting. The submitter has reviewed the changes.
>
>  drivers/net/wireless/ath/ath10k/pci.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
> index 335bc7c488e4..f3c4fe13f76b 100644
> --- a/drivers/net/wireless/ath/ath10k/pci.c
> +++ b/drivers/net/wireless/ath/ath10k/pci.c
> @@ -3716,7 +3716,9 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
>         ath10k_pci_free_irq(ar);
>
>  err_deinit_irq:
> -       ath10k_pci_release_resource(ar);
> +       ath10k_pci_rx_retry_sync(ar);
> +       netif_napi_del(&ar->napi);
> +       ath10k_pci_ce_deinit(ar);
>
>  err_sleep:
>         ath10k_pci_sleep_sync(ar);
> @@ -3724,6 +3726,9 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
>
>  err_free_pipes:
>         ath10k_pci_free_pipes(ar);
> +       kfree(ar_pci->attr);
> +       kfree(ar_pci->pipe_config);
> +       kfree(ar_pci->serv_to_pipe);

I understand that ath10k_pci_release_resource() is not entirely
symmetrical to ath10k_pci_setup_resource() and tears down more than
what has been initialized at this point. However, would it actually be
problematic to use ath10k_pci_release_resource() in these error paths?
For example, is there any issue with calling ath10k_pci_ce_deinit()
when the CE layer has not been fully initialized yet? Using the
existing helper would avoid duplicating the cleanup logic and keep the
resource teardown centralized.

>
>  err_core_destroy:
>         ath10k_core_destroy(ar);
>
> base-commit: 05441d697f7f9a927264f4058cbbc6a03dfcac9d
>

Re: [PATCH] wifi: ath10k: Fix potential CE configuration leaks on PCI probe failure

[Jeff Johnson]

On 11/4/2026 11:07 PM, 李广硕 wrote:
> Hi Loic,
> 
> Thanks for the review.

Please follow linux kernel e-mail rules.
don't top post
don't send HTML e-mail.

Note your reply was not archived or sent to the mailing list because it was
HTML. I only received it since I was directly addressed.

You can see it is not captured in the thread:
https://lore.kernel.org/all/20261104-db9e3c75b3-wifi-ath10k-1@mail.sdu.edu.cn/

/jeff