From 65a4c39914f07bcb0fc01ea78b974e6901d3377d Mon Sep 17 00:00:00 2001 From: Markus Fritsche Date: Thu, 7 May 2026 21:20:46 +0200 Subject: [PATCH] bes2600: fix missing destroy_workqueue() on error in init_common MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two error paths between create_singlethread_workqueue() (~main.c:489) and the success-path destroy_workqueue() in unregister_common (~609) return without cleaning up the workqueue, leaking it on probe failure: 1. bes2600_queue_stats_init() failure 2. bes2600_queue_init() failure (any of the 4 TID queues) Both call ieee80211_free_hw(hw); return NULL — without first destroy_workqueue(hw_priv->workqueue). Add it. Backport of cw1200 mainline commit 7ec8a926188e ("cw1200: fix missing destroy_workqueue() on error in cw1200_init_common", 2020-11-19), which fixed the identical bug in the same code shape we inherited. Reported on cw1200 by Hulk Robot. Cherry-picked from upstream Linux: 7ec8a926188e cw1200: fix missing destroy_workqueue() on error Author: Qinglang Miao Reported-by: Hulk Robot Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20201119070842.1011-1-miaoqinglang@huawei.com Fixes: a910e4a94f69 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets") --- bes2600/main.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/bes2600/main.c b/bes2600/main.c index d6da84a..90a8ff8 100644 --- a/bes2600/main.c +++ b/bes2600/main.c @@ -497,6 +497,7 @@ static struct ieee80211_hw *bes2600_init_common(size_t hw_priv_data_len) WLAN_LINK_ID_MAX, bes2600_skb_dtor, hw_priv))) { + destroy_workqueue(hw_priv->workqueue); ieee80211_free_hw(hw); return NULL; } @@ -508,6 +509,7 @@ static struct ieee80211_hw *bes2600_init_common(size_t hw_priv_data_len) for (; i > 0; i--) bes2600_queue_deinit(&hw_priv->tx_queue[i - 1]); bes2600_queue_stats_deinit(&hw_priv->tx_queue_stats); + destroy_workqueue(hw_priv->workqueue); ieee80211_free_hw(hw); return NULL; }