From 8b1d2f4c3805b9f1bddd5dc3bd241edd1f9ab2d9 Mon Sep 17 00:00:00 2001 From: Kang Yang Date: Wed, 16 Sep 2026 14:03:23 +0800 Subject: [PATCH] wifi: ath12k: place dp_mon_mpdu on stack in mon dst reap loop ath12k_wifi7_dp_rx_mon_dest_process() allocates a dp_mon_mpdu with kzalloc(GFP_ATOMIC) for each delivered MPDU. On allocation failure it breaks out of the reap loop without calling ath12k_hal_srng_dst_get_next_entry(), leaving the destination ring tail pointer parked on the current entry -- the same entry will be peek()ed on every subsequent NAPI schedule, stalling monitor RX until the mon_dest_ring_stuck_cnt recovery path resyncs the PPDU ID. The head_msdu chain accumulated for this iteration is also orphaned since the break bypasses both the delivery and the cleanup paths. kmemleak reports these skbs in field testing: kmemleak_alloc() __netdev_alloc_skb() ath12k_dp_rx_bufs_replenish() ath12k_wifi7_dp_rx_mon_dest_process() dp_mon_mpdu is used only within a single reap loop iteration and is passed synchronously to ath12k_wifi7_dp_mon_rx_deliver(); the callee does not retain the pointer. Place it on the stack instead of using kzalloc(GFP_ATOMIC). This eliminates the allocation failure path (and the ring stall it caused) and saves a kzalloc/kfree pair per delivered MPDU. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3 Fixes: 72bfbf19b7da ("wifi: ath12k: add support to reap and process mon dest ring") Signed-off-by: Kang Yang Reviewed-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20260916060325.854-5-kang.yang@oss.qualcomm.com Signed-off-by: Jeff Johnson --- drivers/net/wireless/ath/ath12k/wifi7/dp_mon.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) diff --git a/drivers/net/wireless/ath/ath12k/wifi7/dp_mon.c b/drivers/net/wireless/ath/ath12k/wifi7/dp_mon.c index 8fca777041d1..1e29c13ad66d 100644 --- a/drivers/net/wireless/ath/ath12k/wifi7/dp_mon.c +++ b/drivers/net/wireless/ath/ath12k/wifi7/dp_mon.c @@ -2827,7 +2827,6 @@ ath12k_wifi7_dp_rx_mon_dest_process(struct ath12k *ar, int mac_id, struct ath12k_base *ab = ar->ab; struct ath12k_dp *dp = ath12k_ab_to_dp(ab); void *ring_entry, *mon_dst_srng; - struct dp_mon_mpdu *tmp_mpdu; LIST_HEAD(rx_desc_used_list); struct hal_srng *srng; @@ -2893,18 +2892,16 @@ ath12k_wifi7_dp_rx_mon_dest_process(struct ath12k *ar, int mac_id, } if (head_msdu && tail_msdu) { - tmp_mpdu = kzalloc_obj(*tmp_mpdu, GFP_ATOMIC); - if (!tmp_mpdu) - break; + struct dp_mon_mpdu tmp_mpdu = { + .head = head_msdu, + .tail = tail_msdu, + .err_bitmap = pmon->err_bitmap, + .decap_format = pmon->decap_format, + }; - tmp_mpdu->head = head_msdu; - tmp_mpdu->tail = tail_msdu; - tmp_mpdu->err_bitmap = pmon->err_bitmap; - tmp_mpdu->decap_format = pmon->decap_format; - ath12k_wifi7_dp_mon_rx_deliver(&ar->dp, tmp_mpdu, + ath12k_wifi7_dp_mon_rx_deliver(&ar->dp, &tmp_mpdu, &pmon->mon_ppdu_info, napi); rx_mon_stats->dest_mpdu_done++; - kfree(tmp_mpdu); } ring_entry = ath12k_hal_srng_dst_get_next_entry(ar->ab,