[PATCH v2] wifi: mt76: mt792x: fix memory leak in USB TX path

[Devin Wittmayer]

On Mon, 2026-08-17 at 09:23 +0000, Eason Lai wrote:
> If you have time, please help test the v2 on mt7921u.

Done, on an MT7921AU. Unpatched, the socket fills after 111 zero-length
frames and is still blocked 20 s later. With both patches it runs 3000 with
no block, and the driver still rejects all 3000, so only the cleanup changed.

Tested-by: Devin Wittmayer <lucid_duck at justthetip.ca>

That is the tx_prepare_skb exit. The other two never fired in any arm, and
the buffer-setup one cannot fire here at all, since mac80211 caps the
fragment count below the table size. Those two hunks are untested.

One correction from the 16th: mt76s_tx_queue_skb's prepare exit already
frees, from your July patch. Only its queue-full exit still misses it.

Before this lands. The two patches are not marked as a series, and this one
does not say it needs the skb_pad change first. I tried it alone and it
still passes, because the frame returns before the padding runs, so passing
alone proves nothing. Worth sending both as one series.

The skb_pad patch also needs my sign-off under the Co-developed-by, or
checkpatch objects:

Signed-off-by: Devin Wittmayer <lucid_duck at justthetip.ca>

And it is worth Cc: stable. The Fixes goes back to 2018, and on mt7921 and
mt7925 USB this silently kills wpa_supplicant with the link still up, so
nothing notices until a group rekey. The reporter there hit it on different
hardware and ran the equivalent change:

Closes: https://github.com/morrownr/mt76/issues/83

Devin