[PATCH rtw-next v4] wifi: rtw88: usb: don't report the aggregation buffer as a frame

[PATCH rtw-next v4] wifi: rtw88: usb: don't report the aggregation buffer as a frame

[Ho Jie Feng]

When rtw_usb_tx_agg_skb() has more than one frame queued, it copies them
into a new buffer. That buffer was also handed to mac80211, as one
additional TX completion.

Report TX status only for the original frames, and free the aggregate
buffer without passing it to mac80211.

In the case the ieee80211_purge_tx_queue is called, the frame is
passed to ieee80211_report_used_skb. Since it fulfills none of the
conditions within the function, the frame is freed as normal without
a TX status in that case too

Fixes: a82dfd33d123 ("wifi: rtw88: Add common USB chip support")
Signed-off-by: Ho Jie Feng <hjf3108@gmail.com>
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
---
Changes in v4:
- Add reviewed by
- Add description for ieee80211_purge_tx_queue
Changes in v3:
- Change to dev_consume_skb_any from a suggestion by Luka Gejak
Changes in v2:
- Remove unused drv_frame members in structs drivers/net/wireless/realtek/rtw88/usb.c | 9 +++++++++
 drivers/net/wireless/realtek/rtw88/usb.h | 1 +
 2 files changed, 10 insertions(+)

diff --git a/drivers/net/wireless/realtek/rtw88/usb.c b/drivers/net/wireless/realtek/rtw88/usb.c
index 715a2ce342d92..10f6d3bea0dfd 100644
--- a/drivers/net/wireless/realtek/rtw88/usb.c
+++ b/drivers/net/wireless/realtek/rtw88/usb.c
@@ -342,6 +342,11 @@ static void rtw_usb_write_port_tx_complete(struct urb *urb)
 
 		skb_pull(skb, rtwdev->chip->tx_pkt_desc_sz);
 
+		if (tx_data->drv_frame) {
+			dev_consume_skb_any(skb);
+			continue;
+		}
+
 		/* enqueue to wait for tx report */
 		if (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS) {
 			rtw_tx_report_enqueue(rtwdev, skb, tx_data->sn);
@@ -431,6 +436,9 @@ static bool rtw_usb_tx_agg_skb(struct rtw_usb *rtwusb, struct sk_buff_head *list
 		goto queue;
 	}
 
+	/* report TX status only for the original frames */
+	rtw_usb_get_tx_data(skb_head)->drv_frame = true;
+
 	while (skb_iter) {
 		unsigned long flags;
 
@@ -655,6 +663,7 @@ static int rtw_usb_tx_write(struct rtw_dev *rtwdev,
 	rtw_tx_fill_txdesc_checksum(rtwdev, pkt_info, skb->data);
 	tx_data = rtw_usb_get_tx_data(skb);
 	tx_data->sn = pkt_info->sn;
+	tx_data->drv_frame = false;
 
 	skb_queue_tail(&rtwusb->tx_queue[ep], skb);
 
diff --git a/drivers/net/wireless/realtek/rtw88/usb.h b/drivers/net/wireless/realtek/rtw88/usb.h
index 94ff21dd08463..e861e9a66ab22 100644
--- a/drivers/net/wireless/realtek/rtw88/usb.h
+++ b/drivers/net/wireless/realtek/rtw88/usb.h
@@ -59,6 +59,7 @@ struct rx_usb_ctrl_block {
 
 struct rtw_usb_tx_data {
 	u8 sn;
+	bool drv_frame;
 };
 
 struct rtw_usb {

base-commit: 9b0be45d4d52fd223994e151f169743a97abd290
-- 
2.55.0

RE: [PATCH rtw-next v4] wifi: rtw88: usb: don't report the aggregation buffer as a frame

[Ping-Ke Shih]

Ho Jie Feng <hjf3108@gmail.com> wrote:
> When rtw_usb_tx_agg_skb() has more than one frame queued, it copies them
> into a new buffer. That buffer was also handed to mac80211, as one
> additional TX completion.
> 
> Report TX status only for the original frames, and free the aggregate
> buffer without passing it to mac80211.
> 
> In the case the ieee80211_purge_tx_queue is called, the frame is
> passed to ieee80211_report_used_skb. Since it fulfills none of the
> conditions within the function, the frame is freed as normal without
> a TX status in that case too

Miss a period. I'll add it while getting merged. 

> 
> Fixes: a82dfd33d123 ("wifi: rtw88: Add common USB chip support")
> Signed-off-by: Ho Jie Feng <hjf3108@gmail.com>
> Reviewed-by: Luka Gejak <luka.gejak@linux.dev>

Acked-by: Ping-Ke Shih <pkshih@realtek.com>

Re: [PATCH rtw-next v4] wifi: rtw88: usb: don't report the aggregation buffer as a frame

[Jie Feng]

On Mon, 2 Nov 2026 at 11:36, Ping-Ke Shih <pkshih@realtek.com> wrote:
>
> Ho Jie Feng <hjf3108@gmail.com> wrote:
> > When rtw_usb_tx_agg_skb() has more than one frame queued, it copies them
> > into a new buffer. That buffer was also handed to mac80211, as one
> > additional TX completion.
> >
> > Report TX status only for the original frames, and free the aggregate
> > buffer without passing it to mac80211.
> >
> > In the case the ieee80211_purge_tx_queue is called, the frame is
> > passed to ieee80211_report_used_skb. Since it fulfills none of the
> > conditions within the function, the frame is freed as normal without
> > a TX status in that case too
>
> Miss a period. I'll add it while getting merged.
Thanks, will be more careful about this.

> >
> > Fixes: a82dfd33d123 ("wifi: rtw88: Add common USB chip support")
> > Signed-off-by: Ho Jie Feng <hjf3108@gmail.com>
> > Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
>
> Acked-by: Ping-Ke Shih <pkshih@realtek.com>
>
>

Re: [PATCH rtw-next v4] wifi: rtw88: usb: don't report the aggregation buffer as a frame

[Jie Feng]

Hi,

Please ignore this v4, I forgot to add the reviewed-by, will resend.

[PATCH rtw-next v4] wifi: rtw88: usb: don't report the aggregation buffer as a frame

[Ho Jie Feng]

When rtw_usb_tx_agg_skb() has more than one frame queued, it copies them
into a new buffer. That buffer was also handed to mac80211, as one
additional TX completion.

Report TX status only for the original frames, and free the aggregate
buffer without passing it to mac80211.

In the case the ieee80211_purge_tx_queue is called, the frame is
passed to ieee80211_report_used_skb. Since it fulfills none of the
conditions within the function, the frame is freed as normal without
a TX status in that case too

Fixes: a82dfd33d123 ("wifi: rtw88: Add common USB chip support")
Signed-off-by: Ho Jie Feng <hjf3108@gmail.com>
---
 drivers/net/wireless/realtek/rtw88/usb.c | 9 +++++++++
 drivers/net/wireless/realtek/rtw88/usb.h | 1 +
 2 files changed, 10 insertions(+)

diff --git a/drivers/net/wireless/realtek/rtw88/usb.c b/drivers/net/wireless/realtek/rtw88/usb.c
index 715a2ce342d92..10f6d3bea0dfd 100644
--- a/drivers/net/wireless/realtek/rtw88/usb.c
+++ b/drivers/net/wireless/realtek/rtw88/usb.c
@@ -342,6 +342,11 @@ static void rtw_usb_write_port_tx_complete(struct urb *urb)
 
 		skb_pull(skb, rtwdev->chip->tx_pkt_desc_sz);
 
+		if (tx_data->drv_frame) {
+			dev_consume_skb_any(skb);
+			continue;
+		}
+
 		/* enqueue to wait for tx report */
 		if (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS) {
 			rtw_tx_report_enqueue(rtwdev, skb, tx_data->sn);
@@ -431,6 +436,9 @@ static bool rtw_usb_tx_agg_skb(struct rtw_usb *rtwusb, struct sk_buff_head *list
 		goto queue;
 	}
 
+	/* report TX status only for the original frames */
+	rtw_usb_get_tx_data(skb_head)->drv_frame = true;
+
 	while (skb_iter) {
 		unsigned long flags;
 
@@ -655,6 +663,7 @@ static int rtw_usb_tx_write(struct rtw_dev *rtwdev,
 	rtw_tx_fill_txdesc_checksum(rtwdev, pkt_info, skb->data);
 	tx_data = rtw_usb_get_tx_data(skb);
 	tx_data->sn = pkt_info->sn;
+	tx_data->drv_frame = false;
 
 	skb_queue_tail(&rtwusb->tx_queue[ep], skb);
 
diff --git a/drivers/net/wireless/realtek/rtw88/usb.h b/drivers/net/wireless/realtek/rtw88/usb.h
index 94ff21dd08463..e861e9a66ab22 100644
--- a/drivers/net/wireless/realtek/rtw88/usb.h
+++ b/drivers/net/wireless/realtek/rtw88/usb.h
@@ -59,6 +59,7 @@ struct rx_usb_ctrl_block {
 
 struct rtw_usb_tx_data {
 	u8 sn;
+	bool drv_frame;
 };
 
 struct rtw_usb {

base-commit: 9b0be45d4d52fd223994e151f169743a97abd290
-- 
2.55.0