[PATCH] wifi: ath11k: Fix potential SRNG configuration leak on init failure

[Guangshuo Li]

If either DMA pointer-buffer allocation fails after the SRNG
configuration is copied, HAL initialization returns without freeing
the copy. Its callers skip HAL deinitialization on this error.

Free the configuration on both allocation failure paths and clear
its pointer before returning.

This issue was found by our static analysis tool under development.

Fixes: f7eb4b04ce6f ("ath11k: hal: create hw_srng_config dynamically")
Signed-off-by: Guangshuo Li <liguangshuo@xxxxxxxxxxxxxxx>
---
Validation: x86-64 Clang W=1 changed-object builds passed with
allmodconfig and allyesconfig. No hardware/kernel runtime test or full
linked-kernel build.
OpenAI Codex assisted with source review, patch implementation and
commit-message drafting. The submitter has reviewed the changes.

 drivers/net/wireless/ath/ath11k/hal.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ath/ath11k/hal.c b/drivers/net/wireless/ath/ath11k/hal.c
index 98bd9e3f0aae..8a4e5042d89a 100644
--- a/drivers/net/wireless/ath/ath11k/hal.c
+++ b/drivers/net/wireless/ath/ath11k/hal.c
@@ -1351,7 +1351,7 @@ int ath11k_hal_srng_init(struct ath11k_base *ab)
 
 	ret = ath11k_hal_alloc_cont_rdp(ab);
 	if (ret)
-		goto err_hal;
+		goto err_free_config;
 
 	ret = ath11k_hal_alloc_cont_wrp(ab);
 	if (ret)
@@ -1363,7 +1363,9 @@ int ath11k_hal_srng_init(struct ath11k_base *ab)
 
 err_free_cont_rdp:
 	ath11k_hal_free_cont_rdp(ab);
-
+err_free_config:
+	kfree(hal->srng_config);
+	hal->srng_config = NULL;
 err_hal:
 	return ret;
 }

base-commit: 05441d697f7f9a927264f4058cbbc6a03dfcac9d