[PATCH] wifi: ath12k: Fix potential SRNG configuration leak on init failure

[Guangshuo Li]

If either DMA pointer-buffer allocation fails after the SRNG
configuration is copied, HAL initialization returns without freeing
the copy. Its callers skip HAL deinitialization on this error.

Free the configuration on both allocation failure paths and clear
its pointer before returning.

This issue was found by our static analysis tool under development.

Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")
Signed-off-by: Guangshuo Li <liguangshuo@xxxxxxxxxxxxxxx>
---
Validation: x86-64 Clang W=1 changed-object builds passed with
allmodconfig and allyesconfig. No hardware/kernel runtime test or full
linked-kernel build.
OpenAI Codex assisted with source review, patch implementation and
commit-message drafting. The submitter has reviewed the changes.

 drivers/net/wireless/ath/ath12k/hal.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ath/ath12k/hal.c b/drivers/net/wireless/ath/ath12k/hal.c
index c0c3d2f047ef..8dafbe44df38 100644
--- a/drivers/net/wireless/ath/ath12k/hal.c
+++ b/drivers/net/wireless/ath/ath12k/hal.c
@@ -744,7 +744,7 @@ int ath12k_hal_srng_init(struct ath12k_base *ab)
 
 	ret = ath12k_hal_alloc_cont_rdp(hal);
 	if (ret)
-		goto err_hal;
+		goto err_free_config;
 
 	ret = ath12k_hal_alloc_cont_wrp(hal);
 	if (ret)
@@ -756,7 +756,9 @@ int ath12k_hal_srng_init(struct ath12k_base *ab)
 
 err_free_cont_rdp:
 	ath12k_hal_free_cont_rdp(hal);
-
+err_free_config:
+	kfree(hal->srng_config);
+	hal->srng_config = NULL;
 err_hal:
 	return ret;
 }

base-commit: 05441d697f7f9a927264f4058cbbc6a03dfcac9d