[PATCH] wifi: ath12k: fix tx_status memory leak on allocation failure

[Alex]

From: clowdyffs <alex at clowdydev.com>

When kmalloc() for tx_status fails partway through the TX ring
allocation loop in ath12k_dp_setup(), the previously allocated
tx_status buffers from earlier iterations are not freed on the
error path.

Add a cleanup loop to the existing failure path that frees all
allocated tx_status buffers. The cleanup loop mirrors the existing
pattern in ath12k_dp_device_deinit() (the normal teardown path)
rather than extracting a shared helper, to avoid adding call
overhead to the common deinit path. Happy to refactor into a helper
if preferred.

Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices")

Signed-off-by: clowdyffs <alex at clowdydev.com>
---
 drivers/net/wireless/ath/ath12k/dp.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/ath/ath12k/dp.c b/drivers/net/wireless/ath/ath12k/dp.c
index 1c82d927d27b..8ea0d41f9829 100644
--- a/drivers/net/wireless/ath/ath12k/dp.c
+++ b/drivers/net/wireless/ath/ath12k/dp.c
@@ -1548,9 +1548,6 @@ static int ath12k_dp_setup(struct ath12k_base *ab)
 		dp->tx_ring[i].tx_status = kmalloc(size, GFP_KERNEL);
 		if (!dp->tx_ring[i].tx_status) {
 			ret = -ENOMEM;
-			/* FIXME: The allocated tx status is not freed
-			 * properly here
-			 */
 			goto fail_cmn_reoq_cleanup;
 		}
 	}
@@ -1570,6 +1567,10 @@ static int ath12k_dp_setup(struct ath12k_base *ab)
 	ath12k_dp_rx_free(ab);
 
 fail_cmn_reoq_cleanup:
+	for (i = 0; i < ab->hw_params->max_tx_ring; i++) {
+		kfree(dp->tx_ring[i].tx_status);
+		dp->tx_ring[i].tx_status = NULL;
+	}
 	ath12k_dp_reoq_lut_cleanup(ab);
 
 fail_cmn_srng_cleanup:
-- 
2.53.0