[PATCH] wifi: ath10k: Fix potential CE configuration leaks on PCI probe failure

[Guangshuo Li]

PCI claim, wakeup or IRQ initialization failures bypass
ath10k_pci_release_resource(), leaking the three configuration arrays
allocated by ath10k_pci_setup_resource().

Free the arrays with the CE pipes on the common unwind path. Keep
the later hardware cleanup separate so the arrays are freed once.

This issue was found by our static analysis tool under development.

Fixes: 1cfd3426ef98 ("ath10k: Fix NULL pointer dereference in AHB device probe")
Signed-off-by: Guangshuo Li <liguangshuo@xxxxxxxxxxxxxxx>
---
Validation: x86-64 Clang W=1 changed-object builds passed with
allmodconfig and allyesconfig. No hardware/kernel runtime test or full
linked-kernel build.
OpenAI Codex assisted with source review, patch implementation and
commit-message drafting. The submitter has reviewed the changes.

 drivers/net/wireless/ath/ath10k/pci.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index 335bc7c488e4..f3c4fe13f76b 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -3716,7 +3716,9 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
 	ath10k_pci_free_irq(ar);
 
 err_deinit_irq:
-	ath10k_pci_release_resource(ar);
+	ath10k_pci_rx_retry_sync(ar);
+	netif_napi_del(&ar->napi);
+	ath10k_pci_ce_deinit(ar);
 
 err_sleep:
 	ath10k_pci_sleep_sync(ar);
@@ -3724,6 +3726,9 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
 
 err_free_pipes:
 	ath10k_pci_free_pipes(ar);
+	kfree(ar_pci->attr);
+	kfree(ar_pci->pipe_config);
+	kfree(ar_pci->serv_to_pipe);
 
 err_core_destroy:
 	ath10k_core_destroy(ar);

base-commit: 05441d697f7f9a927264f4058cbbc6a03dfcac9d