Re: [PATCH] wifi: ath11k: Fix potential SRNG configuration leak on init failure

[Baochen Qiang]

On 11/4/2026 10:33 AM, Guangshuo Li wrote:
> If either DMA pointer-buffer allocation fails after the SRNG
> configuration is copied, HAL initialization returns without freeing
> the copy. Its callers skip HAL deinitialization on this error.
> 
> Free the configuration on both allocation failure paths and clear
> its pointer before returning.
> 
> This issue was found by our static analysis tool under development.
> 
> Fixes: f7eb4b04ce6f ("ath11k: hal: create hw_srng_config dynamically")
> Signed-off-by: Guangshuo Li <liguangshuo@xxxxxxxxxxxxxxx>
> ---
> Validation: x86-64 Clang W=1 changed-object builds passed with
> allmodconfig and allyesconfig. No hardware/kernel runtime test or full
> linked-kernel build.
> OpenAI Codex assisted with source review, patch implementation and
> commit-message drafting. The submitter has reviewed the changes.
> 
>  drivers/net/wireless/ath/ath11k/hal.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/wireless/ath/ath11k/hal.c b/drivers/net/wireless/ath/ath11k/hal.c
> index 98bd9e3f0aae..8a4e5042d89a 100644
> --- a/drivers/net/wireless/ath/ath11k/hal.c
> +++ b/drivers/net/wireless/ath/ath11k/hal.c
> @@ -1351,7 +1351,7 @@ int ath11k_hal_srng_init(struct ath11k_base *ab)
>  
>  	ret = ath11k_hal_alloc_cont_rdp(ab);
>  	if (ret)
> -		goto err_hal;
> +		goto err_free_config;
>  
>  	ret = ath11k_hal_alloc_cont_wrp(ab);
>  	if (ret)
> @@ -1363,7 +1363,9 @@ int ath11k_hal_srng_init(struct ath11k_base *ab)
>  
>  err_free_cont_rdp:
>  	ath11k_hal_free_cont_rdp(ab);
> -
> +err_free_config:
> +	kfree(hal->srng_config);
> +	hal->srng_config = NULL;
>  err_hal:
>  	return ret;
>  }
> 
> base-commit: 05441d697f7f9a927264f4058cbbc6a03dfcac9d
> 

Reviewed-by: Baochen Qiang <baochen.qiang@xxxxxxxxxxxxxxxx>