From 11c34671d168acc8b434fbfc4427c3a2324d8ef6 Mon Sep 17 00:00:00 2001 From: Ryan Chen Date: Fri, 20 Mar 2026 16:55:37 -0500 Subject: [PATCH] wifi: mt76: mt7996: guard tx_retries against TXFREE count=0 In mt7996_mac_tx_free(), the tx_retries calculation unconditionally subtracts 1 from the MT_TXFREE_INFO_COUNT field. When the count is 0, which occurs with NPU/WED WiFi offload (offloaded packets don't always generate TXFREE entries with valid counts), this causes an unsigned integer underflow producing bogus values like 4294967295. These corrupted counters accumulate in wcid->stats.tx_retries and propagate to userspace via iw station dump, making retry statistics meaningless when NPU offload is active. Fix by extracting the count into a local variable and checking it before the subtraction. Signed-off-by: Ryan Chen --- mt7996/mac.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/mt7996/mac.c b/mt7996/mac.c index f7694faf2..31157112a 100644 --- a/mt7996/mac.c +++ b/mt7996/mac.c @@ -1360,13 +1360,14 @@ mt7996_mac_tx_free(struct mt7996_dev *dev, void *data, int len) cur_info++; continue; } else if (info & MT_TXFREE_INFO_HEADER) { - u32 tx_retries = 0, tx_failed = 0; + u32 tx_retries = 0, tx_failed = 0, tx_count; if (!wcid) continue; - tx_retries = - FIELD_GET(MT_TXFREE_INFO_COUNT, info) - 1; + tx_count = FIELD_GET(MT_TXFREE_INFO_COUNT, info); + if (tx_count) + tx_retries = tx_count - 1; tx_failed = tx_retries + !!FIELD_GET(MT_TXFREE_INFO_STAT, info);