From: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
To: Vladimir Zapolskiy <vz@kernel.org>,
Jeff Johnson <jjohnson@kernel.org>, Kalle Valo <kvalo@kernel.org>
Cc: linux-wireless@vger.kernel.org, ath11k@lists.infradead.org
Subject: Re: [PATCH] wifi: ath11k: Unprepare MHI on power up failure
Date: Thu, 29 Oct 2026 10:40:39 +0530 [thread overview]
Message-ID: <22adbcac-94a9-4528-90fe-ad5ef2b00974@oss.qualcomm.com> (raw)
In-Reply-To: <20261028104336.1686334-1-vz@kernel.org>
On 10/28/2026 4:13 PM, Vladimir Zapolskiy wrote:
> If MHI power up fails, for instance it happens due to a missing firmware,
> ath11k_mhi_start() returns without undoing mhi_prepare_for_power_up().
> Then the failed probe or power up unwinding frees the MHI controller,
> but the MHI device context and the RDDM image table allocated by
> mhi_prepare_for_power_up() are leaked along with their DMA buffers:
>
> % cat /sys/kernel/debug/kmemleak
> unreferenced object 0xffff00079156a140 (size 64):
> comm "(udev-worker)", pid 595, jiffies 4294893781
> hex dump (first 32 bytes):
> 00 d0 f1 80 00 80 ff ff 00 50 f1 80 00 80 ff ff .........P......
> 00 d0 f7 80 00 80 ff ff 00 30 fc ff 00 00 00 00 .........0......
> backtrace (crc 62662f0a):
> kmemleak_alloc+0x34/0x40
> __kmalloc_cache_noprof+0x224/0x3b8
> mhi_prepare_for_power_up+0x58/0x548 [mhi]
> ath11k_mhi_start+0x30/0xb8 [ath11k_pci]
> ath11k_pci_power_up+0xcc/0x188 [ath11k_pci]
> ath11k_core_init+0x8c/0x190 [ath11k]
> ath11k_pci_probe+0x4e0/0x870 [ath11k_pci]
> local_pci_probe+0x40/0xa8
> pci_call_probe+0x64/0x190
> pci_device_probe+0xac/0x138
> really_probe+0xbc/0x298
> __driver_probe_device+0x16c/0x19c
> driver_probe_device+0x3c/0x114
> __driver_attach+0x98/0x19c
> bus_for_each_dev+0x74/0xd0
> driver_attach+0x24/0x30
> unreferenced object 0xffff0007916fb800 (size 512):
> comm "(udev-worker)", pid 595, jiffies 4294893781
> hex dump (first 32 bytes):
> 00 60 04 81 00 80 ff ff 0a 00 00 00 00 00 00 00 .`..............
> 00 10 e0 82 00 80 ff ff 00 00 00 00 00 00 00 00 ................
> backtrace (crc 52e9e075):
> kmemleak_alloc+0x34/0x40
> __kmalloc_noprof+0x280/0x440
> mhi_alloc_bhie_table+0x54/0x168 [mhi]
> mhi_prepare_for_power_up+0x318/0x548 [mhi]
> ath11k_mhi_start+0x30/0xb8 [ath11k_pci]
> ath11k_pci_power_up+0xcc/0x188 [ath11k_pci]
> ath11k_core_init+0x8c/0x190 [ath11k]
> ath11k_pci_probe+0x4e0/0x870 [ath11k_pci]
> local_pci_probe+0x40/0xa8
> pci_call_probe+0x64/0x190
> pci_device_probe+0xac/0x138
> really_probe+0xbc/0x298
> __driver_probe_device+0x16c/0x19c
> driver_probe_device+0x3c/0x114
> __driver_attach+0x98/0x19c
> bus_for_each_dev+0x74/0xd0
>
> The MHI device is already powered down by mhi_sync_power_up() on
> failure, but mhi_unprepare_after_power_down() still has to be
> called on error path to release the allocated resources.
>
> Fixes: 3df6d74aedfd ("ath11k: mhi: use mhi_sync_power_up()")
> Signed-off-by: Vladimir Zapolskiy <vz@kernel.org>
> ---
> drivers/net/wireless/ath/ath11k/mhi.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/net/wireless/ath/ath11k/mhi.c b/drivers/net/wireless/ath/ath11k/mhi.c
> index a6c9ff112c68..76c194573ec7 100644
> --- a/drivers/net/wireless/ath/ath11k/mhi.c
> +++ b/drivers/net/wireless/ath/ath11k/mhi.c
> @@ -446,6 +446,7 @@ int ath11k_mhi_start(struct ath11k_pci *ab_pci)
> ret = mhi_sync_power_up(ab_pci->mhi_ctrl);
> if (ret) {
> ath11k_warn(ab, "failed to power up mhi: %d", ret);
> + mhi_unprepare_after_power_down(ab_pci->mhi_ctrl);
> return ret;
> }
>
Reviewed-by: Rameshkumar Sundaram <rameshkumar.sundaram@oss.qualcomm.com>
next prev parent reply other threads:[~2026-10-29 5:10 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-28 10:43 [PATCH] wifi: ath11k: Unprepare MHI on power up failure Vladimir Zapolskiy
2026-10-29 5:10 ` Rameshkumar Sundaram [this message]
2026-10-29 5:38 ` Baochen Qiang
2026-10-29 8:43 ` Vladimir Zapolskiy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=22adbcac-94a9-4528-90fe-ad5ef2b00974@oss.qualcomm.com \
--to=rameshkumar.sundaram@oss.qualcomm.com \
--cc=ath11k@lists.infradead.org \
--cc=jjohnson@kernel.org \
--cc=kvalo@kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=vz@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox