Re: [PATCH] wifi: ath10k: Fix potential CE configuration leaks on PCI probe failure

[Loic Poulain]

Hi Guangshuo,

On Wed, Nov 4, 2026 at 3:34 AM Guangshuo Li <liguangshuo@xxxxxxxxxxxxxxx> wrote:
>
> PCI claim, wakeup or IRQ initialization failures bypass
> ath10k_pci_release_resource(), leaking the three configuration arrays
> allocated by ath10k_pci_setup_resource().
>
> Free the arrays with the CE pipes on the common unwind path. Keep
> the later hardware cleanup separate so the arrays are freed once.
>
> This issue was found by our static analysis tool under development.
>
> Fixes: 1cfd3426ef98 ("ath10k: Fix NULL pointer dereference in AHB device probe")
> Signed-off-by: Guangshuo Li <liguangshuo@xxxxxxxxxxxxxxx>
> ---
> Validation: x86-64 Clang W=1 changed-object builds passed with
> allmodconfig and allyesconfig. No hardware/kernel runtime test or full
> linked-kernel build.
> OpenAI Codex assisted with source review, patch implementation and
> commit-message drafting. The submitter has reviewed the changes.
>
>  drivers/net/wireless/ath/ath10k/pci.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
> index 335bc7c488e4..f3c4fe13f76b 100644
> --- a/drivers/net/wireless/ath/ath10k/pci.c
> +++ b/drivers/net/wireless/ath/ath10k/pci.c
> @@ -3716,7 +3716,9 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
>         ath10k_pci_free_irq(ar);
>
>  err_deinit_irq:
> -       ath10k_pci_release_resource(ar);
> +       ath10k_pci_rx_retry_sync(ar);
> +       netif_napi_del(&ar->napi);
> +       ath10k_pci_ce_deinit(ar);
>
>  err_sleep:
>         ath10k_pci_sleep_sync(ar);
> @@ -3724,6 +3726,9 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
>
>  err_free_pipes:
>         ath10k_pci_free_pipes(ar);
> +       kfree(ar_pci->attr);
> +       kfree(ar_pci->pipe_config);
> +       kfree(ar_pci->serv_to_pipe);

I understand that ath10k_pci_release_resource() is not entirely
symmetrical to ath10k_pci_setup_resource() and tears down more than
what has been initialized at this point. However, would it actually be
problematic to use ath10k_pci_release_resource() in these error paths?
For example, is there any issue with calling ath10k_pci_ce_deinit()
when the CE layer has not been fully initialized yet? Using the
existing helper would avoid duplicating the cleanup logic and keep the
resource teardown centralized.

>
>  err_core_destroy:
>         ath10k_core_destroy(ar);
>
> base-commit: 05441d697f7f9a927264f4058cbbc6a03dfcac9d
>