On Fri, Sep 26, 2025 at 10:41 PM Pavan Chebbi [off-list ref] wrote:

On Fri, Sep 26, 2025 at 9:31 PM Dave Jiang [off-list ref] wrote:

quoted

quoted

quoted

+     if (msg->num_dma) {
+             if (msg->num_dma > MAX_NUM_DMA_INDICATIONS) {
+                     dev_err(dev, "DMA buffers exceed the number supported\n");
+                     err = -EINVAL;
+                     goto free_msg_out;

Shouldn't rpc_in.resp get freed with an error returned? It's leaking rpc_in.resp on all the error paths from this point onward.

DJ

Isn't the caller taking care of it? The fw_rpc is called as:
void *outbuf __free(kvfree) = fwctl->ops->fw_rpc()
I was expecting that outbuf will be freed once it goes out of scope,
regardless of success or error?

Oh, the buffer is not returned when there is an error :( I should have
seen that.