On 8/15/25 3:02 AM, Fan Gong wrote: > +int hinic3_init_mbox(struct hinic3_hwdev *hwdev) > +{ > + struct hinic3_mbox *mbox; > + int err; > + > + mbox = kzalloc(sizeof(*mbox), GFP_KERNEL); > + if (!mbox) > + return -ENOMEM; > + > + err = hinic3_mbox_pre_init(hwdev, mbox); > + if (err) > + return err; Given that all the other error paths resort to the usual goto statement, this error handling is confusing (even there are no leak as hinic3_mbox_pre_init() frees 'mbox' on error). Please use 'goto err_kfree' here... > + > + err = init_mgmt_msg_channel(mbox); > + if (err) > + goto err_destroy_workqueue; > + > + err = hinic3_init_func_mbox_msg_channel(hwdev); > + if (err) > + goto err_uninit_mgmt_msg_ch; > + > + err = alloc_mbox_wb_status(mbox); > + if (err) { > + dev_err(hwdev->dev, "Failed to alloc mbox write back status\n"); > + goto err_uninit_func_mbox_msg_ch; > + } > + > + prepare_send_mbox(mbox); > + > + return 0; > + > +err_uninit_func_mbox_msg_ch: > + hinic3_uninit_func_mbox_msg_channel(hwdev); > + > +err_uninit_mgmt_msg_ch: > + uninit_mgmt_msg_channel(mbox); > + > +err_destroy_workqueue: > + destroy_workqueue(mbox->workq); err_kfree: > + kfree(mbox); > + > + return err; > +} And you can remove the kfree call from hinic3_mbox_pre_init(). /P