[PATCH v1] wifi: mt76: mt792x: fix memory leak in USB TX path

[Devin Wittmayer]

> 	err = mt76u_tx_setup_buffers(dev, tx_info.skb, q->entry[idx].urb);
> 	if (err < 0)
> -		return err;
> +		goto err_free_skb;

The first hunk looks right, that is what mt76s_tx_queue_skb already does.

The second one I think is a problem. By then tx_prepare_skb has succeeded, so
the skb can already be in wcid->pktid, and nothing takes it out before the
free. mt76_tx_status_skb_get walks that idr on every tx status event and reads
the cb off each entry, so this looks like it turns the leak into a
use-after-free. mt7925 asks for tx status every quarter second per station, so
there is usually an entry there.

mt76_tx_complete_skb would cover it instead. It marks the skb DMA_DONE and
leaves it in the idr for the existing timeout to reap.