[PATCH v2] wifi: mt76: mt792x: fix memory leak in USB TX path

[Eason Lai (賴易聖)]

On Mon, 2026-08-17 at 09:45 -0700, Devin Wittmayer wrote:
> 
> On Mon, 2026-08-17 at 09:23 +0000, Eason Lai wrote:
> > If you have time, please help test the v2 on mt7921u.
> 
> Done, on an MT7921AU. Unpatched, the socket fills after 111 zero-
> length
> frames and is still blocked 20 s later. With both patches it runs
> 3000 with
> no block, and the driver still rejects all 3000, so only the cleanup
> changed.
> 
> Tested-by: Devin Wittmayer <lucid_duck at justthetip.ca>
> 

Thank you!

> That is the tx_prepare_skb exit. The other two never fired in any
> arm, and
> the buffer-setup one cannot fire here at all, since mac80211 caps the
> fragment count below the table size. Those two hunks are untested.
> 
> One correction from the 16th: mt76s_tx_queue_skb's prepare exit
> already
> frees, from your July patch. Only its queue-full exit still misses
> it.
> 
> Before this lands. The two patches are not marked as a series, and
> this one
> does not say it needs the skb_pad change first. I tried it alone and
> it
> still passes, because the frame returns before the padding runs, so
> passing
> alone proves nothing. Worth sending both as one series.
> 
> The skb_pad patch also needs my sign-off under the Co-developed-by,
> or
> checkpatch objects:
> 
> Signed-off-by: Devin Wittmayer <lucid_duck at justthetip.ca>
> 
> And it is worth Cc: stable. The Fixes goes back to 2018, and on
> mt7921 and
> mt7925 USB this silently kills wpa_supplicant with the link still up,
> so
> nothing notices until a group rekey. The reporter there hit it on
> different
> hardware and ran the equivalent change:
> 
> Closes:
> https://urldefense.com/v3/__https://github.com/morrownr/mt76/issues/83__;!!CTRNKA9wMg0ARbw!jaCVAu-c7m1FK3VHzS-4Y0UfZ3DGfVxoZQHc6AZ5oYxy2J9cHmfvc1WGtG3aIgN3iBaAThD-fBxAqSxr0Q3zw__dOA$
> 
> Devin

No problem. I will send the patches as a series and verify them on an
mt7925u device before sending to the mailing list this week.