wifi: mt76: free pending offchannel tx frames on wcid cleanup

Avoid leaking them or keeping the wcid on the tx list

Fixes: 0b3be9d1d34e ("wifi: mt76: add separate tx scheduling queue for off-channel tx")
Link: https://patch.msgid.link/20250827085352.51636-5-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>

diff --git a/drivers/net/wireless/mediatek/mt76/mac80211.c b/drivers/net/wireless/mediatek/mt76/mac80211.c
index 0e0d7b3bfe42d83018577063413a26d0d39bb98c..59adf33126170cdd4e68fd75be67981fc3576085 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mac80211.c
+++ b/drivers/net/wireless/mediatek/mt76/mac80211.c
@@ -1716,6 +1716,10 @@ void mt76_wcid_cleanup(struct mt76_dev *dev, struct mt76_wcid *wcid)
        skb_queue_splice_tail_init(&wcid->tx_pending, &list);
        spin_unlock(&wcid->tx_pending.lock);
 
+       spin_lock(&wcid->tx_offchannel.lock);
+       skb_queue_splice_tail_init(&wcid->tx_offchannel, &list);
+       spin_unlock(&wcid->tx_offchannel.lock);
+
        spin_unlock_bh(&phy->tx_lock);
 
        while ((skb = __skb_dequeue(&list)) != NULL) {