[PATCH v1] wifi: mt76: mt792x: fix memory leak in USB TX path

[Eason Lai (賴易聖)]

On Thu, 2026-08-06 at 15:29 -0700, Devin Wittmayer wrote:
> The second one I think is a problem. By then tx_prepare_skb has
> succeeded, so
> the skb can already be in wcid->pktid, and nothing takes it out
> before the
> free. mt76_tx_status_skb_get walks that idr on every tx status event
> and reads
> the cb off each entry, so this looks like it turns the leak into a
> use-after-free. mt7925 asks for tx status every quarter second per
> station, so
> there is usually an entry there.
> 
> mt76_tx_complete_skb would cover it instead. It marks the skb
> DMA_DONE and
> leaves it in the idr for the existing timeout to reap.

Yes, you are right. The second hunk will cause a use-after-free.
I will use mt76_tx_complete_skb() instead of freeing the SKB directly
in v2.

Thanks,
Eason