[PATCH] wifi: ath12k: Fix potential SRNG configuration leak on init failure

[PATCH] wifi: ath12k: Fix potential SRNG configuration leak on init failure

[Guangshuo Li]

If either DMA pointer-buffer allocation fails after the SRNG
configuration is copied, HAL initialization returns without freeing
the copy. Its callers skip HAL deinitialization on this error.

Free the configuration on both allocation failure paths and clear
its pointer before returning.

This issue was found by our static analysis tool under development.

Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
---
Validation: x86-64 Clang W=1 changed-object builds passed with
allmodconfig and allyesconfig. No hardware/kernel runtime test or full
linked-kernel build.
OpenAI Codex assisted with source review, patch implementation and
commit-message drafting. The submitter has reviewed the changes.

 drivers/net/wireless/ath/ath12k/hal.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ath/ath12k/hal.c b/drivers/net/wireless/ath/ath12k/hal.c
index c0c3d2f047ef..8dafbe44df38 100644
--- a/drivers/net/wireless/ath/ath12k/hal.c
+++ b/drivers/net/wireless/ath/ath12k/hal.c
@@ -744,7 +744,7 @@ int ath12k_hal_srng_init(struct ath12k_base *ab)
 
 	ret = ath12k_hal_alloc_cont_rdp(hal);
 	if (ret)
-		goto err_hal;
+		goto err_free_config;
 
 	ret = ath12k_hal_alloc_cont_wrp(hal);
 	if (ret)
@@ -756,7 +756,9 @@ int ath12k_hal_srng_init(struct ath12k_base *ab)
 
 err_free_cont_rdp:
 	ath12k_hal_free_cont_rdp(hal);
-
+err_free_config:
+	kfree(hal->srng_config);
+	hal->srng_config = NULL;
 err_hal:
 	return ret;
 }

base-commit: 05441d697f7f9a927264f4058cbbc6a03dfcac9d

Re: [PATCH] wifi: ath12k: Fix potential SRNG configuration leak on init failure

[Rameshkumar Sundaram]

On 11/4/2026 8:03 AM, Guangshuo Li wrote:
> If either DMA pointer-buffer allocation fails after the SRNG
> configuration is copied, HAL initialization returns without freeing
> the copy. Its callers skip HAL deinitialization on this error.
> 
> Free the configuration on both allocation failure paths and clear
> its pointer before returning.
> 
> This issue was found by our static analysis tool under development.
> 
> Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
> Signed-off-by: Guangshuo Li <liguangshuo@mail.sdu.edu.cn>
> ---
> Validation: x86-64 Clang W=1 changed-object builds passed with
> allmodconfig and allyesconfig. No hardware/kernel runtime test or full
> linked-kernel build.
> OpenAI Codex assisted with source review, patch implementation and
> commit-message drafting. The submitter has reviewed the changes.
> 
>   drivers/net/wireless/ath/ath12k/hal.c | 6 ++++--
>   1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/wireless/ath/ath12k/hal.c b/drivers/net/wireless/ath/ath12k/hal.c
> index c0c3d2f047ef..8dafbe44df38 100644
> --- a/drivers/net/wireless/ath/ath12k/hal.c
> +++ b/drivers/net/wireless/ath/ath12k/hal.c
> @@ -744,7 +744,7 @@ int ath12k_hal_srng_init(struct ath12k_base *ab)
>   
>   	ret = ath12k_hal_alloc_cont_rdp(hal);
>   	if (ret)
> -		goto err_hal;
> +		goto err_free_config;
>   
>   	ret = ath12k_hal_alloc_cont_wrp(hal);
>   	if (ret)
> @@ -756,7 +756,9 @@ int ath12k_hal_srng_init(struct ath12k_base *ab)
>   
>   err_free_cont_rdp:
>   	ath12k_hal_free_cont_rdp(hal);
> -
> +err_free_config:
> +	kfree(hal->srng_config);
> +	hal->srng_config = NULL;
>   err_hal:
>   	return ret;
>   }
> 
> base-commit: 05441d697f7f9a927264f4058cbbc6a03dfcac9d
> 


Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>