wifi: mt76: free pending offchannel tx frames on wcid cleanup

[ Upstream commit bdeac7815629c1a32b8784922368742e183747ea ]

Avoid leaking them or keeping the wcid on the tx list

Fixes: 0b3be9d1d34e ("wifi: mt76: add separate tx scheduling queue for off-channel tx")
Link: https://patch.msgid.link/20250827085352.51636-5-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
index 0ca83f1a3e3ea24a19b6730947b6f6eec136c90f..5373f8c419b04578a05a4adf5b392c664e6bdd92 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
@@ -1586,6 +1586,10 @@ void mt76_wcid_cleanup(struct mt76_dev *dev, struct mt76_wcid *wcid)
        skb_queue_splice_tail_init(&wcid->tx_pending, &list);
        spin_unlock(&wcid->tx_pending.lock);
 
+       spin_lock(&wcid->tx_offchannel.lock);
+       skb_queue_splice_tail_init(&wcid->tx_offchannel, &list);
+       spin_unlock(&wcid->tx_offchannel.lock);
+
        spin_unlock_bh(&phy->tx_lock);
 
        while ((skb = __skb_dequeue(&list)) != NULL) {