The memory allocated inside rtl92du_init_shared_data() is not freed in
any of the subsequent error paths in rtl92du_init_sw_vars().
Fix that by adding a call to rtl92du_deinit_shared_data() in the error
path.

Fixes: b5dc8873b6ff ("wifi: rtlwifi: Add rtl8192du/sw.c")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
---
Compile tested only. Issue found with static analysis.

 .../net/wireless/realtek/rtlwifi/rtl8192du/sw.c    | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192du/sw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192du/sw.c
index 7bafb051d5ec..c7eab3382b73 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192du/sw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192du/sw.c
@@ -118,7 +118,7 @@ static int rtl92du_init_sw_vars(struct ieee80211_hw *hw)
 
 	err = rtl92du_init_shared_data(hw);
 	if (err)
-		return err;
+		goto error;
 
 	rtlpriv->dm.dm_initialgain_enable = true;
 	rtlpriv->dm.dm_flag = 0;
@@ -145,8 +145,10 @@ static int rtl92du_init_sw_vars(struct ieee80211_hw *hw)
 
 	/* for firmware buf */
 	rtlpriv->rtlhal.pfirmware = kmalloc(0x8000, GFP_KERNEL);
-	if (!rtlpriv->rtlhal.pfirmware)
-		return -ENOMEM;
+	if (!rtlpriv->rtlhal.pfirmware) {
+		err = -ENOMEM;
+		goto error;
+	}
 
 	rtlpriv->max_fw_size = 0x8000;
 	pr_info("Driver for Realtek RTL8192DU WLAN interface\n");
@@ -160,10 +162,14 @@ static int rtl92du_init_sw_vars(struct ieee80211_hw *hw)
 		pr_err("Failed to request firmware!\n");
 		kfree(rtlpriv->rtlhal.pfirmware);
 		rtlpriv->rtlhal.pfirmware = NULL;
-		return err;
+		goto error;
 	}
 
 	return 0;
+
+error:
+	rtl92du_deinit_shared_data(hw);
+	return err;
 }
 
 static void rtl92du_deinit_sw_vars(struct ieee80211_hw *hw)
-- 
2.43.0

Abdun Nihaal <nihaal@cse.iitm.ac.in> wrote:
> Sent: Wednesday, July 22, 2026 8:13 PM
> The memory allocated inside rtl92du_init_shared_data() is not freed in
> any of the subsequent error paths in rtl92du_init_sw_vars().
> Fix that by adding a call to rtl92du_deinit_shared_data() in the error
> path.
> 
> Fixes: b5dc8873b6ff ("wifi: rtlwifi: Add rtl8192du/sw.c")
> Cc: stable@vger.kernel.org
> Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
> ---
> Compile tested only. Issue found with static analysis.
> 
>  .../net/wireless/realtek/rtlwifi/rtl8192du/sw.c    | 14 ++++++++++----
>  1 file changed, 10 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192du/sw.c
> b/drivers/net/wireless/realtek/rtlwifi/rtl8192du/sw.c
> index 7bafb051d5ec..c7eab3382b73 100644
> --- a/drivers/net/wireless/realtek/rtlwifi/rtl8192du/sw.c
> +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192du/sw.c
> @@ -118,7 +118,7 @@ static int rtl92du_init_sw_vars(struct ieee80211_hw *hw)
> 
>         err = rtl92du_init_shared_data(hw);
>         if (err)
> -               return err;
> +               goto error;

I think here is not necessary to do rtl92du_deinit_shared_data().

> 
>         rtlpriv->dm.dm_initialgain_enable = true;
>         rtlpriv->dm.dm_flag = 0;
> @@ -145,8 +145,10 @@ static int rtl92du_init_sw_vars(struct ieee80211_hw *hw)
> 
>         /* for firmware buf */
>         rtlpriv->rtlhal.pfirmware = kmalloc(0x8000, GFP_KERNEL);
> -       if (!rtlpriv->rtlhal.pfirmware)
> -               return -ENOMEM;
> +       if (!rtlpriv->rtlhal.pfirmware) {
> +               err = -ENOMEM;
> +               goto error;
> +       }
> 
>         rtlpriv->max_fw_size = 0x8000;
>         pr_info("Driver for Realtek RTL8192DU WLAN interface\n");
> @@ -160,10 +162,14 @@ static int rtl92du_init_sw_vars(struct ieee80211_hw *hw)
>                 pr_err("Failed to request firmware!\n");
>                 kfree(rtlpriv->rtlhal.pfirmware);
>                 rtlpriv->rtlhal.pfirmware = NULL;
> -               return err;
> +               goto error;
>         }
> 
>         return 0;
> +
> +error:
> +       rtl92du_deinit_shared_data(hw);
> +       return err;
>  }
> 
>  static void rtl92du_deinit_sw_vars(struct ieee80211_hw *hw)
> --
> 2.43.0