From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1A1ED33A70E; Thu, 2 Jul 2026 16:50:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783011048; cv=none; b=daN5KESLEWzxGm6wZNDzpw8RiruGPrzqzgeuFw3lFf/C35fUs8BIIF22NAh8/kc/1v8MdXmw/zlIH3auGxXR0cJJTsm5TVkTd8ps0XaxGi9+gTL6vMrOQTpw6+XX+HZH2ewlbjrQXVEzQWIJNKda4kytvIOHOYnKY06zuDCjEBI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783011048; c=relaxed/simple; bh=F/kJIcvdqxx3d0bQYh7E4DNSBxIe/ajkf6l2v57oeXU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=I4cMFV2S9pxADjgX78XbOQ6MjgFeyR1PdXmJiW8pHq0Cw/QJSNiSXQgKwbuWJvhIj3pgzbKfmaS1CwkGJJb+pBPo9sCu1BJ7zSM8Y+KwYlFreo5VUo092qbVXTsb6fe9WyinrJ4VCooi1CTYuGEQElPGZhup6UvwRkbVFHjev9s= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=MM2BIQ+A; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="MM2BIQ+A" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7EE4D1F00A3A; Thu, 2 Jul 2026 16:50:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1783011047; bh=1r+Z+B416/sP0yPNLo+2PTECJfjjrkY0SoHpaGCI7Kk=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=MM2BIQ+AI9uOmZDDExemXEhWeTE3o+eDOWHbFFm0JdOotO+KTdKLNisv2E9BlYJm/ zbRpdWRBsaT/KVQgUgm1hw8wUOLDJcz8Rno4R+bThwACVOEQvdbzwLxlU7MCEU1pOs 8JIdL9wzlIblWJcqOXBsqHz8wPrGasusbzkxHlxQ= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Ping-Ke Shih , Luka Gejak Subject: [PATCH 6.6 134/175] wifi: rtw88: increase TX report timeout to fix race condition Date: Thu, 2 Jul 2026 18:20:35 +0200 Message-ID: <20260702155118.634450215@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260702155115.766838875@linuxfoundation.org> References: <20260702155115.766838875@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Luka Gejak commit c80788f7c5aed8d420366b821f867a8a353d83a5 upstream. The driver expects the firmware to report TX status within 500ms. However, a timeout can be triggered when the hardware performs background scans while under TX load. During these scans, the firmware stays off-channel for periods exceeding 500ms, delaying the delivery of TX reports back to the driver. When this occurs, the purge timer fires prematurely and drops the tracking skbs from the queue. This results in the host stack interpreting the missing status as packet loss, leading to TCP window collapse. In testing with iperf3, this causes throughput to drop from ~90 Mbps to near-zero for approximately 2 seconds until the connection recovers. Increase RTW_TX_PROBE_TIMEOUT to 2500ms for RTL8723DU. This duration is sufficient to accommodate off-channel dwell time during full background scans, ensuring the purge timer only trips during genuine firmware lockups and preventing unnecessary TCP retransmission cycles. Fixes: a82dfd33d123 ("wifi: rtw88: Add common USB chip support") Cc: stable@vger.kernel.org Acked-by: Ping-Ke Shih Tested-by: Luka Gejak Signed-off-by: Luka Gejak Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260518142311.10328-1-luka.gejak@linux.dev Signed-off-by: Greg Kroah-Hartman --- drivers/net/wireless/realtek/rtw88/tx.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) --- a/drivers/net/wireless/realtek/rtw88/tx.c +++ b/drivers/net/wireless/realtek/rtw88/tx.c @@ -190,6 +190,7 @@ void rtw_tx_report_purge_timer(struct ti void rtw_tx_report_enqueue(struct rtw_dev *rtwdev, struct sk_buff *skb, u8 sn) { struct rtw_tx_report *tx_report = &rtwdev->tx_report; + unsigned long timeout = RTW_TX_PROBE_TIMEOUT; unsigned long flags; u8 *drv_data; @@ -201,7 +202,11 @@ void rtw_tx_report_enqueue(struct rtw_de __skb_queue_tail(&tx_report->queue, skb); spin_unlock_irqrestore(&tx_report->q_lock, flags); - mod_timer(&tx_report->purge_timer, jiffies + RTW_TX_PROBE_TIMEOUT); + if (rtwdev->chip->id == RTW_CHIP_TYPE_8723D && + rtwdev->hci.type == RTW_HCI_TYPE_USB) + timeout = msecs_to_jiffies(2500); + + mod_timer(&tx_report->purge_timer, jiffies + timeout); } EXPORT_SYMBOL(rtw_tx_report_enqueue);