[PATCH] net: ipa: fix SMEM state handle leaks in SMP2P init

[PATCH] net: ipa: fix SMEM state handle leaks in SMP2P init

[Haoxiang Li]

ipa_smp2p_init() acquires two Qualcomm SMEM state handles with
qcom_smem_state_get(). However, neither the init error paths
nor ipa_smp2p_exit() release them.

Use devm_qcom_smem_state_get() for both state handles so the
references are released automatically when the platform device
is removed.

Fixes: 530f9216a953 ("soc: qcom: ipa: AP/modem communications")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
---
 drivers/net/ipa/ipa_smp2p.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ipa/ipa_smp2p.c b/drivers/net/ipa/ipa_smp2p.c
index 2f0ccdd937cc..d8fd56949082 100644
--- a/drivers/net/ipa/ipa_smp2p.c
+++ b/drivers/net/ipa/ipa_smp2p.c
@@ -228,15 +228,15 @@ ipa_smp2p_init(struct ipa *ipa, struct platform_device *pdev, bool modem_init)
 	u32 valid_bit;
 	int ret;
 
-	valid_state = qcom_smem_state_get(dev, "ipa-clock-enabled-valid",
-					  &valid_bit);
+	valid_state = devm_qcom_smem_state_get(dev, "ipa-clock-enabled-valid",
+					       &valid_bit);
 	if (IS_ERR(valid_state))
 		return PTR_ERR(valid_state);
 	if (valid_bit >= 32)		/* BITS_PER_U32 */
 		return -EINVAL;
 
-	enabled_state = qcom_smem_state_get(dev, "ipa-clock-enabled",
-					    &enabled_bit);
+	enabled_state = devm_qcom_smem_state_get(dev, "ipa-clock-enabled",
+						 &enabled_bit);
 	if (IS_ERR(enabled_state))
 		return PTR_ERR(enabled_state);
 	if (enabled_bit >= 32)		/* BITS_PER_U32 */
-- 
2.25.1

Re: [PATCH] net: ipa: fix SMEM state handle leaks in SMP2P init

[Alex Elder]

On 6/22/26 10:18 PM, Haoxiang Li wrote:
> ipa_smp2p_init() acquires two Qualcomm SMEM state handles with
> qcom_smem_state_get(). However, neither the init error paths
> nor ipa_smp2p_exit() release them.
> 
> Use devm_qcom_smem_state_get() for both state handles so the
> references are released automatically when the platform device
> is removed.
> 
> Fixes: 530f9216a953 ("soc: qcom: ipa: AP/modem communications")
> Cc: stable@vger.kernel.org
> Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>

So I guess they were never "put" before?

This looks OK, but I'll just mention that the IPA code
doesn't use devm_*() (managed) interfaces.  So it would
be more consistent to just call qcom_smem_state_put()
at the end of ipa_smp2p_exit() for both ipa->enabled_state
and ipa->valid_state.

					-Alex

> ---
>   drivers/net/ipa/ipa_smp2p.c | 8 ++++----
>   1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/net/ipa/ipa_smp2p.c b/drivers/net/ipa/ipa_smp2p.c
> index 2f0ccdd937cc..d8fd56949082 100644
> --- a/drivers/net/ipa/ipa_smp2p.c
> +++ b/drivers/net/ipa/ipa_smp2p.c
> @@ -228,15 +228,15 @@ ipa_smp2p_init(struct ipa *ipa, struct platform_device *pdev, bool modem_init)
>   	u32 valid_bit;
>   	int ret;
>   
> -	valid_state = qcom_smem_state_get(dev, "ipa-clock-enabled-valid",
> -					  &valid_bit);
> +	valid_state = devm_qcom_smem_state_get(dev, "ipa-clock-enabled-valid",
> +					       &valid_bit);
>   	if (IS_ERR(valid_state))
>   		return PTR_ERR(valid_state);
>   	if (valid_bit >= 32)		/* BITS_PER_U32 */
>   		return -EINVAL;
>   
> -	enabled_state = qcom_smem_state_get(dev, "ipa-clock-enabled",
> -					    &enabled_bit);
> +	enabled_state = devm_qcom_smem_state_get(dev, "ipa-clock-enabled",
> +						 &enabled_bit);
>   	if (IS_ERR(enabled_state))
>   		return PTR_ERR(enabled_state);
>   	if (enabled_bit >= 32)		/* BITS_PER_U32 */

Re: [PATCH] net: ipa: fix SMEM state handle leaks in SMP2P init

[Jakub Kicinski]

On Tue, 23 Jun 2026 10:53:49 -0500 Alex Elder wrote:
> So I guess they were never "put" before?
> 
> This looks OK, but I'll just mention that the IPA code
> doesn't use devm_*() (managed) interfaces.  So it would
> be more consistent to just call qcom_smem_state_put()
> at the end of ipa_smp2p_exit() for both ipa->enabled_state
> and ipa->valid_state.

Let's do that instead. The devm_ APIs prevent about as many bugs
as they cause.