wcn36xx_platform_get_resources() gets the "tx-rings-empty" smem state,
which holds a reference, but only the wcn36xx_remove() path releases it.
The reference is leaked on all the error paths taken when the mmio node
cannot be parsed or the CCU or DXE memory cannot be mapped. Release it in
the common cleanup label.

Fixes: f303a9311065 ("wcn36xx: Transition driver to SMD client")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/net/wireless/ath/wcn36xx/main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
index f34d64464f64..a55861e65481 100644
--- a/drivers/net/wireless/ath/wcn36xx/main.c
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -1555,6 +1555,7 @@ static int wcn36xx_platform_get_resources(struct wcn36xx *wcn,
 put_mmio_node:
 	of_node_put(mmio_node);
 	qcom_smem_state_put(wcn->tx_enable_state);
+	qcom_smem_state_put(wcn->tx_rings_empty_state);
 	return ret;
 }
 
-- 
2.34.1

On Thu, Sep 17, 2026 at 2:08 PM Wentao Liang <vulab@iscas.ac.cn> wrote:
>
> wcn36xx_platform_get_resources() gets the "tx-rings-empty" smem state,
> which holds a reference, but only the wcn36xx_remove() path releases it.
> The reference is leaked on all the error paths taken when the mmio node
> cannot be parsed or the CCU or DXE memory cannot be mapped. Release it in
> the common cleanup label.
>
> Fixes: f303a9311065 ("wcn36xx: Transition driver to SMD client")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/net/wireless/ath/wcn36xx/main.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
> index f34d64464f64..a55861e65481 100644
> --- a/drivers/net/wireless/ath/wcn36xx/main.c
> +++ b/drivers/net/wireless/ath/wcn36xx/main.c
> @@ -1555,6 +1555,7 @@ static int wcn36xx_platform_get_resources(struct wcn36xx *wcn,
>  put_mmio_node:
>         of_node_put(mmio_node);
>         qcom_smem_state_put(wcn->tx_enable_state);
> +       qcom_smem_state_put(wcn->tx_rings_empty_state);

Look like you depend on another patch you submitted separately? Please
keep them in the same series.

>         return ret;
>  }
>
> --
> 2.34.1
>