[PATCH v2] wifi: mt76: mt792x: fix memory leak in USB TX path

[PATCH v2] wifi: mt76: mt792x: fix memory leak in USB TX path

[Eason Lai]

When errors occur in mt76u_tx_queue_skb(), the skb is not properly
freed, leading to memory leaks. This can happen when the queue is
full, when tx_prepare_skb() drops zero-length frames (such as WNM
NULL frames) to prevent hardware TX hangs, or when buffer setup
fails.

Fix this by:
1. properly releasing the skb with ieee80211_tx_status_ext()
   when the queue is full or tx_prepare_skb() fails
2. using mt76_tx_complete_skb() when mt76u_tx_setup_buffers()
   fails, since tx_prepare_skb() has already succeeded and may
   have allocated resources that need cleanup

Fixes: b40b15e1521f ("mt76: add usb support to mt76 layer")

Signed-off-by: Eason Lai <eason.lai@mediatek.com>
---
 drivers/net/wireless/mediatek/mt76/usb.c | 31 ++++++++++++++++++++----
 1 file changed, 26 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/usb.c b/drivers/net/wireless/mediatek/mt76/usb.c
index a9af3aa6b80a..dfc12f6944a7 100644
--- a/drivers/net/wireless/mediatek/mt76/usb.c
+++ b/drivers/net/wireless/mediatek/mt76/usb.c
@@ -893,6 +893,9 @@ mt76u_tx_queue_skb(struct mt76_phy *phy, struct mt76_queue *q,
 		   enum mt76_txq_id qid, struct sk_buff *skb,
 		   struct mt76_wcid *wcid, struct ieee80211_sta *sta)
 {
+	struct ieee80211_tx_status status = {
+		.sta = sta,
+	};
 	struct mt76_tx_info tx_info = {
 		.skb = skb,
 	};
@@ -900,17 +903,27 @@ mt76u_tx_queue_skb(struct mt76_phy *phy, struct mt76_queue *q,
 	u16 idx = q->head;
 	int err;
 
-	if (q->queued == q->ndesc)
-		return -ENOSPC;
+	if (q->queued == q->ndesc) {
+		err = -ENOSPC;
+		goto err_free_skb;
+	}
 
 	skb->prev = skb->next = NULL;
 	err = dev->drv->tx_prepare_skb(dev, NULL, qid, wcid, sta, &tx_info);
 	if (err < 0)
-		return err;
+		goto err_free_skb;
 
 	err = mt76u_tx_setup_buffers(dev, tx_info.skb, q->entry[idx].urb);
-	if (err < 0)
-		return err;
+	if (err < 0) {
+		/*
+		 * mt76_tx_status_skb_get() walks the idr and dereferences
+		 * a freed skb. This SKB is not counted in non-AQL counter
+		 * due to error return, so using 0xffff as wcid to keep
+		 * balanced.
+		 */
+		mt76_tx_complete_skb(dev, 0xffff, tx_info.skb);
+		goto err_ret;
+	}
 
 	mt76u_fill_bulk_urb(dev, USB_DIR_OUT, q->ep, q->entry[idx].urb,
 			    mt76u_complete_tx, &q->entry[idx]);
@@ -921,6 +934,14 @@ mt76u_tx_queue_skb(struct mt76_phy *phy, struct mt76_queue *q,
 	q->queued++;
 
 	return idx;
+
+err_free_skb:
+	status.skb = tx_info.skb;
+	spin_lock_bh(&dev->rx_lock);
+	ieee80211_tx_status_ext(dev->hw, &status);
+	spin_unlock_bh(&dev->rx_lock);
+err_ret:
+	return err;
 }
 
 static void mt76u_tx_kick(struct mt76_dev *dev, struct mt76_queue *q)
-- 
2.45.2

Re: [PATCH v2] wifi: mt76: mt792x: fix memory leak in USB TX path

[Devin Wittmayer]

On Mon, 2026-08-17 at 09:23 +0000, Eason Lai wrote:
> If you have time, please help test the v2 on mt7921u.

Done, on an MT7921AU. Unpatched, the socket fills after 111 zero-length
frames and is still blocked 20 s later. With both patches it runs 3000 with
no block, and the driver still rejects all 3000, so only the cleanup changed.

Tested-by: Devin Wittmayer <lucid_duck@justthetip.ca>

That is the tx_prepare_skb exit. The other two never fired in any arm, and
the buffer-setup one cannot fire here at all, since mac80211 caps the
fragment count below the table size. Those two hunks are untested.

One correction from the 16th: mt76s_tx_queue_skb's prepare exit already
frees, from your July patch. Only its queue-full exit still misses it.

Before this lands. The two patches are not marked as a series, and this one
does not say it needs the skb_pad change first. I tried it alone and it
still passes, because the frame returns before the padding runs, so passing
alone proves nothing. Worth sending both as one series.

The skb_pad patch also needs my sign-off under the Co-developed-by, or
checkpatch objects:

Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca>

And it is worth Cc: stable. The Fixes goes back to 2018, and on mt7921 and
mt7925 USB this silently kills wpa_supplicant with the link still up, so
nothing notices until a group rekey. The reporter there hit it on different
hardware and ran the equivalent change:

Closes: https://github.com/morrownr/mt76/issues/83

Devin