linux-toradex.git/drivers/net/wireless/realtek/rtw88, branch master

wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()

2026-07-30T05:37:50+00:00

The skb passed to the rtw_hci_tx_write() is expected to be freed when
the function fails, but the error path in rtw_txq_push_skb() does not
free the skb before returning. This can lead to a memory leak in
rtw_txq_push() where a dequeued skb is passed to rtw_txq_push_skb().

Fixes: aaab5d0e6737 ("rtw88: kick off TX packets once for higher efficiency")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal 
Acked-by: Ping-Ke Shih 
Signed-off-by: Ping-Ke Shih 
Link: https://patch.msgid.link/20260727064223.61836-1-nihaal@cse.iitm.ac.in

wifi: rtw88: disable ASPM and deep PS on ASUS TUF Gaming A15 FA506II

2026-07-24T03:38:52+00:00

The RTL8822CE on the ASUS TUF Gaming A15 FA506II wedges during normal
use. The driver watchdog toggles PCIe ASPM while leaving power save;
the DBI read of the ASPM link-config register fails with -EIO, the PCIe
link becomes unstable, and the device drops off the bus, taking Wi-Fi
down until a cold power cycle:

  rtw88_8822ce 0000:03:00.0: failed to read ASPM, ret=-5
  rtw88_8822ce 0000:03:00.0: firmware failed to leave lps state
  rtw88_8822ce 0000:03:00.0: mac power on failed

This is the same platform ASPM inter-operability problem already
handled for other machines through rtw_pci_quirks[]. Disabling PCI
ASPM and deep power save on this model stops the failure. Add a DMI
quirk so the workaround is applied automatically.

Signed-off-by: Mihail Dimoski 
Acked-by: Ping-Ke Shih 
Signed-off-by: Ping-Ke Shih 
Link: https://patch.msgid.link/20260718124045.23493-1-mihaildimoski@gmail.com

wifi: rtw88: Enable receiving control frames in monitor mode

2026-07-03T02:48:41+00:00

By default RTL8723D, RTL8703B, RTL8812A, RTL8821A, and RTL8814A are
configured to filter out all control frames except PS-Poll, even in
monitor mode.

Handle FIF_CONTROL in rtw_ops_configure_filter(). When it's set,
configure REG_RXFLTMAP1 to let all control frames through. When it's
unset, restore the original value. Because some drivers configure
REG_RXFLTMAP1 differently, keep track of its value in a new member of
struct rtw_hal.

Signed-off-by: Bitterblue Smith (S.E.A. Datentechnik GmbH) 
Acked-by: Ping-Ke Shih 
Signed-off-by: Ping-Ke Shih 
Link: https://patch.msgid.link/2a52d718-9e46-47f2-84a1-d8e7b1ed89a8@gmail.com

wifi: rtw88: pci: fix resource leak on failed NAPI setup

2026-07-03T02:39:42+00:00

rtw_pci_probe() allocates PCI resources through
rtw_pci_setup_resource() before it sets up NAPI. If
rtw_pci_napi_init() fails, the error path jumps straight to
err_pci_declaim and skips rtw_pci_destroy(), leaving the PCI
resources allocated by rtw_pci_setup_resource() behind.

Add a dedicated cleanup label for the NAPI setup failure path so probe
destroys the PCI resources.

The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing current
mainline kernels. The tool is still under development and is not yet
publicly available. Manual inspection confirms that the bug is still
present in v7.1-rc7.

An x86_64 allyesconfig build showed no new warnings. As we do not have a
suitable rtw88 PCI board to test with, no runtime testing was able to be
performed.

Fixes: d0bcb10e7b94 ("wifi: rtw88: Un-embed dummy device")
Cc: stable@vger.kernel.org
Signed-off-by: Dawei Feng 
Acked-by: Ping-Ke Shih 
Signed-off-by: Ping-Ke Shih 
Link: https://patch.msgid.link/20260617013502.114057-1-dawei.feng@seu.edu.cn

wifi: rtw88: 8822c: replace msleep() with fsleep() for DPK delays

2026-07-03T02:36:47+00:00

Replace msleep() with fsleep(), because msleep() may oversleep
to as much as 20 ms when used for a 10 ms delay.
According to the kernel documentation, fsleep() is more suitable
and aligns better with modern kernel style.

Signed-off-by: Chen Jung Ku 
Acked-by: Ping-Ke Shih 
Signed-off-by: Ping-Ke Shih 
Link: https://patch.msgid.link/20260613170434.23645-1-ku.loong@gapp.nthu.edu.tw

wifi: rtw88: 8822b: Don't process RF path C in query_phy_status_page1

2026-07-03T02:24:55+00:00

Replace <= with < in the loop in query_phy_status_page1(). It was
processing data related to RF path C, which this chip doesn't have.
The only bad effect seems to be that the phy_info file in debugfs was
printing unexpected values for RF path C.

Signed-off-by: Bitterblue Smith 
Acked-by: Ping-Ke Shih 
Signed-off-by: Ping-Ke Shih 
Link: https://patch.msgid.link/9c4beb36-2954-4db0-844a-74ba5eacf21b@gmail.com

wifi: rtw88: 8822c: Don't process RF path C in query_phy_status_page{0,1}

2026-07-03T02:24:43+00:00

Replace <= with < in the loops in query_phy_status_page{0,1}(). They
were processing data related to RF path C, which this chip doesn't have.
The only bad effect seems to be that the phy_info file in debugfs was
printing unexpected values for RF path C.

Signed-off-by: Bitterblue Smith 
Acked-by: Ping-Ke Shih 
Signed-off-by: Ping-Ke Shih 
Link: https://patch.msgid.link/ee30b95f-bc68-4711-9b15-cf5fd23c3c48@gmail.com

wifi: rtw88: Add more validation for the RX descriptor

2026-05-27T08:43:49+00:00

Some RTL8821CE cards can return frames with corrupted RX descriptor,
causing warnings and crashes if they are passed to the upper layers.

The PHY status size field is 4 bits wide, but in rtw88 its value should
only be 0 or 4. Checking this catches most of the corrupt frames.

If a PHY status is present, the PHY status size should not be 0.

The frame size should not be less than or equal to 4 and should not
exceed 11454.

The rate should not exceed 4SS MCS9.

Discard the frame if any of these checks fail.

Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221286
Signed-off-by: Bitterblue Smith 
Tested-by: Oleksandr Havrylov 
Acked-by: Ping-Ke Shih 
Signed-off-by: Ping-Ke Shih 
Link: https://patch.msgid.link/5bfecba3-8a90-4e0f-9558-af5cd8a14975@gmail.com

wifi: rtw88: usb: fix memory leaks on USB write failures

2026-05-25T06:33:43+00:00

When rtw_usb_write_port() fails to submit a USB Request Block (URB)
(e.g., due to device disconnect or ENOMEM), the completion callback is
never executed.

Currently, the driver ignores the return value of rtw_usb_write_port()
in rtw_usb_write_data() and rtw_usb_tx_agg_skb(). Because these
functions rely on the completion callback to free the socket buffers
(skbs) and the transaction control block (txcb), a submission failure
results in:
1. A memory leak of the allocated skb in rtw_usb_write_data().
2. A memory leak of the txcb structure and all aggregated skbs in
   rtw_usb_tx_agg_skb().

Fix this by checking the return value of rtw_usb_write_port(). If it
fails, explicitly free the skb in rtw_usb_write_data(), and properly
purge the tx_ack_queue and free the txcb in rtw_usb_tx_agg_skb().

The issue was discovered in practice during device disconnect/reconnect
scenarios and memory pressure conditions. Tested by verifying normal TX
operation continues after the fix without regressions.

Fixes: a82dfd33d123 ("wifi: rtw88: Add common USB chip support")
Cc: stable@vger.kernel.org
Acked-by: Ping-Ke Shih 
Tested-by: Luka Gejak 
Signed-off-by: Luka Gejak 
Signed-off-by: Ping-Ke Shih 
Link: https://patch.msgid.link/20260518142311.10328-2-luka.gejak@linux.dev

wifi: rtw88: increase TX report timeout to fix race condition

2026-05-25T06:30:20+00:00

The driver expects the firmware to report TX status within 500ms.
However, a timeout can be triggered when the hardware performs
background scans while under TX load. During these scans, the firmware
stays off-channel for periods exceeding 500ms, delaying the delivery of
TX reports back to the driver.

When this occurs, the purge timer fires prematurely and drops the
tracking skbs from the queue. This results in the host stack
interpreting the missing status as packet loss, leading to TCP window
collapse. In testing with iperf3, this causes throughput to drop from
~90 Mbps to near-zero for approximately 2 seconds until the connection
recovers.

Increase RTW_TX_PROBE_TIMEOUT to 2500ms for RTL8723DU. This duration is
sufficient to accommodate off-channel dwell time during full background
scans, ensuring the purge timer only trips during genuine firmware
lockups and preventing unnecessary TCP retransmission cycles.

Fixes: a82dfd33d123 ("wifi: rtw88: Add common USB chip support")
Cc: stable@vger.kernel.org
Acked-by: Ping-Ke Shih 
Tested-by: Luka Gejak 
Signed-off-by: Luka Gejak 
Signed-off-by: Ping-Ke Shih 
Link: https://patch.msgid.link/20260518142311.10328-1-luka.gejak@linux.dev