[PATCH] wifi: ath11k: Unprepare MHI on power up failure

[Rameshkumar Sundaram]

On 10/28/2026 4:13 PM, Vladimir Zapolskiy wrote:
> If MHI power up fails, for instance it happens due to a missing firmware,
> ath11k_mhi_start() returns without undoing mhi_prepare_for_power_up().
> Then the failed probe or power up unwinding frees the MHI controller,
> but the MHI device context and the RDDM image table allocated by
> mhi_prepare_for_power_up() are leaked along with their DMA buffers:
> 
>    % cat /sys/kernel/debug/kmemleak
>    unreferenced object 0xffff00079156a140 (size 64):
>      comm "(udev-worker)", pid 595, jiffies 4294893781
>      hex dump (first 32 bytes):
>        00 d0 f1 80 00 80 ff ff 00 50 f1 80 00 80 ff ff  .........P......
>        00 d0 f7 80 00 80 ff ff 00 30 fc ff 00 00 00 00  .........0......
>      backtrace (crc 62662f0a):
>        kmemleak_alloc+0x34/0x40
>        __kmalloc_cache_noprof+0x224/0x3b8
>        mhi_prepare_for_power_up+0x58/0x548 [mhi]
>        ath11k_mhi_start+0x30/0xb8 [ath11k_pci]
>        ath11k_pci_power_up+0xcc/0x188 [ath11k_pci]
>        ath11k_core_init+0x8c/0x190 [ath11k]
>        ath11k_pci_probe+0x4e0/0x870 [ath11k_pci]
>        local_pci_probe+0x40/0xa8
>        pci_call_probe+0x64/0x190
>        pci_device_probe+0xac/0x138
>        really_probe+0xbc/0x298
>        __driver_probe_device+0x16c/0x19c
>        driver_probe_device+0x3c/0x114
>        __driver_attach+0x98/0x19c
>        bus_for_each_dev+0x74/0xd0
>        driver_attach+0x24/0x30
>    unreferenced object 0xffff0007916fb800 (size 512):
>      comm "(udev-worker)", pid 595, jiffies 4294893781
>      hex dump (first 32 bytes):
>        00 60 04 81 00 80 ff ff 0a 00 00 00 00 00 00 00  .`..............
>        00 10 e0 82 00 80 ff ff 00 00 00 00 00 00 00 00  ................
>      backtrace (crc 52e9e075):
>        kmemleak_alloc+0x34/0x40
>        __kmalloc_noprof+0x280/0x440
>        mhi_alloc_bhie_table+0x54/0x168 [mhi]
>        mhi_prepare_for_power_up+0x318/0x548 [mhi]
>        ath11k_mhi_start+0x30/0xb8 [ath11k_pci]
>        ath11k_pci_power_up+0xcc/0x188 [ath11k_pci]
>        ath11k_core_init+0x8c/0x190 [ath11k]
>        ath11k_pci_probe+0x4e0/0x870 [ath11k_pci]
>        local_pci_probe+0x40/0xa8
>        pci_call_probe+0x64/0x190
>        pci_device_probe+0xac/0x138
>        really_probe+0xbc/0x298
>        __driver_probe_device+0x16c/0x19c
>        driver_probe_device+0x3c/0x114
>        __driver_attach+0x98/0x19c
>        bus_for_each_dev+0x74/0xd0
> 
> The MHI device is already powered down by mhi_sync_power_up() on
> failure, but mhi_unprepare_after_power_down() still has to be
> called on error path to release the allocated resources.
> 
> Fixes: 3df6d74aedfd ("ath11k: mhi: use mhi_sync_power_up()")
> Signed-off-by: Vladimir Zapolskiy <vz at kernel.org>
> ---
>   drivers/net/wireless/ath/ath11k/mhi.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/wireless/ath/ath11k/mhi.c b/drivers/net/wireless/ath/ath11k/mhi.c
> index a6c9ff112c68..76c194573ec7 100644
> --- a/drivers/net/wireless/ath/ath11k/mhi.c
> +++ b/drivers/net/wireless/ath/ath11k/mhi.c
> @@ -446,6 +446,7 @@ int ath11k_mhi_start(struct ath11k_pci *ab_pci)
>   	ret = mhi_sync_power_up(ab_pci->mhi_ctrl);
>   	if (ret) {
>   		ath11k_warn(ab, "failed to power up mhi: %d", ret);
> +		mhi_unprepare_after_power_down(ab_pci->mhi_ctrl);
>   		return ret;
>   	}
>   

Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram at oss.qualcomm.com>