Hello Shitalkumar Gandhi.
On Tue, 21 Apr 2026 13:02:59 +0530, Shitalkumar Gandhi wrote:
> ca8210_spi_transfer() allocates cas_ctl with kzalloc_obj(GFP_ATOMIC)
> and relies entirely on the SPI completion callback
> ca8210_spi_transfer_complete() to free it.
>
> The spi_async() API only invokes the completion callback on successful
> submission. On failure it returns a negative error code without ever
> queuing the callback, which leaves cas_ctl and its embedded spi_message
> and spi_transfer orphaned. Every kfree(cas_ctl) in the driver is
> inside the completion callback, so there is no other reclamation path.
>
> [...]
Applied to wpan/wpan-next.git, thanks!
[1/1] ieee802154: ca8210: fix cas_ctl leak on spi_async failure
https://git.kernel.org/wpan/wpan-next/c/e09390e439bd
regards,
Stefan Schmidt
