From nobody Fri Sep 25 02:44:22 2026 Received: from cstnet.cn (smtp25.cstnet.cn [159.226.251.25]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8298D4B53E4; Thu, 17 Sep 2026 12:08:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=159.226.251.25 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789646911; cv=none; b=uw29Z2NfeKLaISNZElvvrt5KOqP51E20UxN6Y/MfdoOHzQFL7PmquUtoGZ7apWRzhNXI8hh+l/T79+r9sUlpF/MS3V52GwG56mUKvNUP5bqz3n7q6C8qYKqz/oxY3MiSd9Qs6ZEu6dpS7BtMjuqWo8YmnD0eh7g0GxiC+Mgax34= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789646911; c=relaxed/simple; bh=73+Q1OkGANOcwLIX6DZlsDyL6LquW8x11o9IXwKoigw=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=JY2tfZlKS7wyT2TJlyncTVbcYsgUqtLa/q5CdbDtkRQSOHbbHH6m929YRFiKAflQE5GOkIRKKU9GX0OlbktFpEfGL3r+eYaVflsrXND18gIM7+4SeIF5waEonfDHSlMkbbNWd+erARU7OiBFP8UsHRXJuur5HERlmFPGmpkPEtI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn; spf=pass smtp.mailfrom=iscas.ac.cn; arc=none smtp.client-ip=159.226.251.25 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iscas.ac.cn Received: from dfae2b116770.home.arpa (unknown [36.110.52.2]) by APP-05 (Coremail) with SMTP id zQCowAAHKkMq2KtqlDCACA--.42913S2; Thu, 17 Sep 2026 20:08:10 +0800 (CST) From: Wentao Liang To: andersson@kernel.org Cc: kvalo@qca.qualcomm.com, linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org, loic.poulain@oss.qualcomm.com, wcn36xx@lists.infradead.org, Wentao Liang , stable@vger.kernel.org Subject: [PATCH] wifi: wcn36xx: Fix tx-rings-empty state leak in platform_get_resources() Date: Thu, 17 Sep 2026 12:08:10 +0000 Message-Id: <20260917120810.2150534-1-vulab@iscas.ac.cn> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: zQCowAAHKkMq2KtqlDCACA--.42913S2 X-Coremail-Antispam: 1UD129KBjvdXoWrKrW3Zw45Gw13Kr47WFyDJrb_yoWkJrc_GF 48WFZ7Jrs3Gr4UKF4kCr43Z3yFyr97W3WkG3ZrKa43A3y7A39rXry5Zw13Jwnrur4YyFnI krnrJF1Yv342vjkaLaAFLSUrUUUUjb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT 9fnUUIcSsGvfJTRUUUbS8YjsxI4VWkCwAYFVCjjxCrM7CY07I20VC2zVCF04k26cxKx2IY s7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48ve4 kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI0_Xr0_Ar1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_ Cr0_Gr1UM28EF7xvwVC2z280aVAFwI0_GcCE3s1l84ACjcxK6I8E87Iv6xkF7I0E14v26r xl6s0DM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVACY4xI64kE6c02F40Ex7xfMcIj 6xIIjxv20xvE14v26r1q6rW5McIj6I8E87Iv67AKxVW8Jr0_Cr1UMcvjeVCFs4IE7xkEbV WUJVW8JwACjcxG0xvY0x0EwIxGrwACjI8F5VAI37AI020EjII2zVCS5cI20VAGYxC7MxkF 7I0En4kS14v26r126r1DMxAIw28IcxkI7VAKI48JMxAIw28IcVCjz48v1sIEY20_Gr43Wr 1UJr1l4I8I3I0E4IkC6x0Yz7v_Jr0_Gr1lx2IqxVAqx4xG67AKxVWUJVWUGwC20s026x8G jcxK67AKxVWUGVWUWwC2zVAF1VAY17CE14v26r1q6r43MIIYrxkI7VAKI48JMIIF0xvE2I x0cI8IcVAFwI0_JFI_Gr1lIxAIcVC0I7IYx2IY6xkF7I0E14v26F4j6r4UJwCI42IY6xAI w20EY4v20xvaj40_Jr0_JF4lIxAIcVC2z280aVAFwI0_Gr1j6F4UJwCI42IY6I8E87Iv6x kF7I0E14v26rxl6s0DYxBIdaVFxhVjvjDU0xZFpf9x07je0PfUUUUU= X-CM-SenderInfo: pyxotu46lvutnvoduhdfq/1tbiBwcNA2qrrRmDwQAAs5 Content-Type: text/plain; charset="utf-8" wcn36xx_platform_get_resources() gets the "tx-rings-empty" smem state, which holds a reference, but only the wcn36xx_remove() path releases it. The reference is leaked on all the error paths taken when the mmio node cannot be parsed or the CCU or DXE memory cannot be mapped. Release it in the common cleanup label. Fixes: f303a9311065 ("wcn36xx: Transition driver to SMD client") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang --- drivers/net/wireless/ath/wcn36xx/main.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless= /ath/wcn36xx/main.c index f34d64464f64..a55861e65481 100644 --- a/drivers/net/wireless/ath/wcn36xx/main.c +++ b/drivers/net/wireless/ath/wcn36xx/main.c @@ -1555,6 +1555,7 @@ static int wcn36xx_platform_get_resources(struct wcn3= 6xx *wcn, put_mmio_node: of_node_put(mmio_node); qcom_smem_state_put(wcn->tx_enable_state); + qcom_smem_state_put(wcn->tx_rings_empty_state); return ret; } =20 --=20 2.34.1