Re: [PATCH] ieee802154: ca8210: fix cas_ctl leak on spi_async failure
Stefan Schmidt <[email protected]> Fri, 19 Jun 2026 22:29:42 +0200
| Newsgroups | org.kernel.vger.linux-wpan,org.kernel.vger.linux-kernel,org.kernel.vger.netdev,org.kernel.vger.stable |
|---|---|
| Message-ID | <178190096345.793016.14917236922404403238.b4-ty@datenfreihafen.org> |
Hello Shitalkumar Gandhi.
On Tue, 21 Apr 2026 13:02:59 +0530, Shitalkumar Gandhi wrote:
> ca8210_spi_transfer() allocates cas_ctl with kzalloc_obj(GFP_ATOMIC)
> and relies entirely on the SPI completion callback
> ca8210_spi_transfer_complete() to free it.
>
> The spi_async() API only invokes the completion callback on successful
> submission. On failure it returns a negative error code without ever
> queuing the callback, which leaves cas_ctl and its embedded spi_message
> and spi_transfer orphaned. Every kfree(cas_ctl) in the driver is
> inside the completion callback, so there is no other reclamation path.
>
> [...]
Applied to wpan/wpan-next.git, thanks!
[1/1] ieee802154: ca8210: fix cas_ctl leak on spi_async failure
https://git.kernel.org/wpan/wpan-next/c/e09390e439bd
regards,
Stefan Schmidt