[PATCH] wifi: wcn36xx: Fix tx-rings-empty state leak in platform_get_resources()

[Loic Poulain]

On Thu, Sep 17, 2026 at 2:08 PM Wentao Liang <vulab at iscas.ac.cn> wrote:
>
> wcn36xx_platform_get_resources() gets the "tx-rings-empty" smem state,
> which holds a reference, but only the wcn36xx_remove() path releases it.
> The reference is leaked on all the error paths taken when the mmio node
> cannot be parsed or the CCU or DXE memory cannot be mapped. Release it in
> the common cleanup label.
>
> Fixes: f303a9311065 ("wcn36xx: Transition driver to SMD client")
> Cc: stable at vger.kernel.org
> Signed-off-by: Wentao Liang <vulab at iscas.ac.cn>
> ---
>  drivers/net/wireless/ath/wcn36xx/main.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
> index f34d64464f64..a55861e65481 100644
> --- a/drivers/net/wireless/ath/wcn36xx/main.c
> +++ b/drivers/net/wireless/ath/wcn36xx/main.c
> @@ -1555,6 +1555,7 @@ static int wcn36xx_platform_get_resources(struct wcn36xx *wcn,
>  put_mmio_node:
>         of_node_put(mmio_node);
>         qcom_smem_state_put(wcn->tx_enable_state);
> +       qcom_smem_state_put(wcn->tx_rings_empty_state);

Look like you depend on another patch you submitted separately? Please
keep them in the same series.

>         return ret;
>  }
>
> --
> 2.34.1
>