[PATCH] wifi: ath12k: fix DMA unwind for ext MSDU descriptor retry

[Baochen Qiang]

On 8/14/2026 1:39 AM, Rameshkumar Sundaram wrote:
> ath12k_wifi7_dp_tx() maps the original MSDU into ti.paddr and
> stores the address in skb_cb->paddr. When an extended MSDU descriptor
> is used, the function later maps the ext descriptor and overwrites
> ti.paddr and ti.data_len with the ext-desc DMA address and length.
> 
> If TCL ring allocation then fails, the error path first unmaps the
> ext-desc DMA address from skb_cb->paddr_ext_desc. It then falls through
> to fail_unmap_dma, which uses ti.paddr/ti.data_len for the original
> MSDU unmap. At that point ti.paddr still refers to the ext-desc
> mapping, so the ext descriptor is unmapped twice and the original MSDU
> mapping is left mapped.
> 
> Fix the original MSDU unwind to use skb_cb->paddr and skb->len instead
> of ti.paddr/ti.data_len. The ti fields cannot be used after the ext
> descriptor is mapped because they are intentionally reused for the
> buffer submitted to TCL. Also clear skb_cb->paddr_ext_desc after the
> ext-desc unmap so a TCL ring retry cannot observe stale ext-desc DMA
> state from the previous attempt.
> 
> Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
> 
> Fixes: 37a068fc9dc4 ("wifi: ath12k: Handle error cases during extended skb allocation")
> Signed-off-by: Rameshkumar Sundaram <rameshkumar.sundaram at oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang at oss.qualcomm.com>