[PATCH] wifi: ath12k: fix channel list double-free on error paths

[Linkai Gong]

On Thu, Aug 06, 2026 at 18:47:38 -0700, Jeff Johnson wrote:
> https://wireless.docs.kernel.org/en/latest/en/users/drivers/ath12k/submittingpatches.html#tested-on-tag
> Tested-on: tag missing. How was this tested?

Thanks for the review.

This issue was found by code review of the error paths in
ath12k_mac_setup_channels_rates(). I do not have QCN9274/WCN7850
hardware, so I could not provide a Tested-on tag or reproduce the
ENOMEM double-free on a device.

The bug is: after kfree() of sbands[].channels on failure, the
pointer is left non-NULL (or the wrong band is cleared), and
ath12k_mac_cleanup_unregister() frees it again.

I understand Tested-on is required for ath12k. I will follow up
with a v2 including Tested-on once I can test on QCN9274/WCN7850
hardware. Meanwhile, any Tested-by from someone with the hardware
would be appreciated.

Thanks,
Linkai