ath12k_wifi7_dp_rx_mon_dest_process() allocates a dp_mon_mpdu with kzalloc(GFP_ATOMIC) for each delivered MPDU. On allocation failure it breaks out of the reap loop without calling ath12k_hal_srng_dst_get_next_entry(), leaving the destination ring tail pointer parked on the current entry -- the same entry will be peek()ed on every subsequent NAPI schedule, stalling monitor RX until the mon_dest_ring_stuck_cnt recovery path resyncs the PPDU ID. The head_msdu chain accumulated for this iteration is also orphaned since the break bypasses both the delivery and the cleanup paths. kmemleak reports these skbs in field testing: kmemleak_alloc() __netdev_alloc_skb() ath12k_dp_rx_bufs_replenish() ath12k_wifi7_dp_rx_mon_dest_process() dp_mon_mpdu is used only within a single reap loop iteration and is passed synchronously to ath12k_wifi7_dp_mon_rx_deliver(); the callee does not retain the pointer. Place it on the stack instead of using kzalloc(GFP_ATOMIC). This eliminates the allocation failure path (and the ring stall it caused) and saves a kzalloc/kfree pair per delivered MPDU. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3 Fixes: 72bfbf19b7da ("wifi: ath12k: add support to reap and process mon dest ring") Signed-off-by: Kang Yang --- .../net/wireless/ath/ath12k/wifi7/dp_mon.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/drivers/net/wireless/ath/ath12k/wifi7/dp_mon.c b/drivers/net/wireless/ath/ath12k/wifi7/dp_mon.c index 8fca777041d1..1e29c13ad66d 100644 --- a/drivers/net/wireless/ath/ath12k/wifi7/dp_mon.c +++ b/drivers/net/wireless/ath/ath12k/wifi7/dp_mon.c @@ -2827,7 +2827,6 @@ ath12k_wifi7_dp_rx_mon_dest_process(struct ath12k *ar, int mac_id, struct ath12k_base *ab = ar->ab; struct ath12k_dp *dp = ath12k_ab_to_dp(ab); void *ring_entry, *mon_dst_srng; - struct dp_mon_mpdu *tmp_mpdu; LIST_HEAD(rx_desc_used_list); struct hal_srng *srng; @@ -2893,18 +2892,16 @@ ath12k_wifi7_dp_rx_mon_dest_process(struct ath12k *ar, int mac_id, } if (head_msdu && tail_msdu) { - tmp_mpdu = kzalloc_obj(*tmp_mpdu, GFP_ATOMIC); - if (!tmp_mpdu) - break; - - tmp_mpdu->head = head_msdu; - tmp_mpdu->tail = tail_msdu; - tmp_mpdu->err_bitmap = pmon->err_bitmap; - tmp_mpdu->decap_format = pmon->decap_format; - ath12k_wifi7_dp_mon_rx_deliver(&ar->dp, tmp_mpdu, + struct dp_mon_mpdu tmp_mpdu = { + .head = head_msdu, + .tail = tail_msdu, + .err_bitmap = pmon->err_bitmap, + .decap_format = pmon->decap_format, + }; + + ath12k_wifi7_dp_mon_rx_deliver(&ar->dp, &tmp_mpdu, &pmon->mon_ppdu_info, napi); rx_mon_stats->dest_mpdu_done++; - kfree(tmp_mpdu); } ring_entry = ath12k_hal_srng_dst_get_next_entry(ar->ab, -- 2.34.1