kernel oops in mt7915_mac_tx_free

[lts-rad]

what was happening on the system:
0 ran iperf3 from one wifi 6 client continuously @ 800mbps+ / 80mhz, and a wired client continuously (2.5gbps) for two days

[91767.188500] r8125 0000:03:00.0 eth1: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 6604 ms
[91767.197318] r8125 0000:03:00.0 eth1: Transmit timeout reset Device!
[91767.208516] r8125 0000:03:00.0 eth1: Device reseting!
[91767.255279] r8125: eth1: link down
[91771.299116] r8125: eth1: link up
[91774.509032] ------------[ cut here ]------------
[91774.509055] WARNING: CPU: 3 PID: 5457 at drivers/net/wireless/mediatek/mt76/mt7915/mac.c:911 mt7915_mac_tx_free+0x254/0x2f0 [mt7915e]
[91774.509084] Modules linked in: tls xt_nat xt_tcpudp pppoe pppox ppp_generic slhc aes_ce_ccm 8021q garp mrp wireguard libchacha20poly1305 chacha_neon poly1305_neon libcurve25519_generic libchacha ip6_udp_tunnel udp_tunnel nft_masq nft_nat nft_ct nft_log iptable_nat iptable_filter dummy hci_uart btqca btrtl btintel btbcm pwrseq_core nfnetlink_log veth raspberrypi_hwmon vc4 snd_soc_hdmi_codec drm_display_helper cec drm_dma_helper btsdio bluetooth brcmfmac_wcc rpivid_hevc(CE) pwm_brcmstb snd_soc_core pisp_be v4l2_mem2mem videobuf2_dma_contig videobuf2_memops videobuf2_v4l2 snd_compress ac97_bus snd_pcm_dmaengine brcmfmac snd_pcm snd_timer brcmutil videodev v3d r8125(OE) snd mt7915e gpu_sched videobuf2_common pwm_fan drm_shmem_helper rp1_adc mc pwm_rp1 raspberrypi_gpiomem nf_conntrack_netlink bridge stp llc xt_set ip_set nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 xt_addrtype nft_compat nf_tables xfrm_user xfrm_algo qrtr overlay binfmt_misc uio_pdrv_genirq uio mt7921u mt792x_usb mt7921_common mt792x_lib
[91774.509184] mt76_connac_lib mt76_usb mt76 mac80211 libarc4 cfg80211 rfkill sch_fq_codel dm_multipath fuse dm_mod dax nfnetlink ip_tables x_tables autofs4 btrfs blake2b_generic raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor xor_neon raid6_pq libcrc32c raid1 raid0 md_mod xhci_plat_hcd macb spidev dwc3 ulpi phylink spi_dw_mmio i2c_designware_platform i2c_designware_core spi_dw crct10dif_ce polyval_ce polyval_generic ghash_ce gf128mul 8250_bcm7271 rtc_rpi gpio_brcmstb gpio_generic dwc2 i2c_brcmstb spi_bcm2835 roles udc_core sm4 sha2_ce sha256_arm64 reset_brcmstb sha1_ce reset_brcmstb_rescal sdhci_brcmstb cqhci gpio_keys phy_generic nvmem_rmem aes_arm64 aes_ce_blk aes_ce_cipher
[91774.509258] CPU: 3 UID: 0 PID: 5457 Comm: napi/phy0-263 Tainted: G C OE 6.11.0-1004-raspi #4-Ubuntu
[91774.509266] Tainted: [C]=CRAP, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
[91774.509268] Hardware name: Raspberry Pi Compute Module 5 Rev 1.0 (DT)
[91774.509271] pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[91774.509275] pc : mt7915_mac_tx_free+0x254/0x2f0 [mt7915e]
[91774.509287] lr : mt7915_mac_tx_free+0x104/0x2f0 [mt7915e]
[91774.509295] sp : ffff800081133b40
[91774.509297] x29: ffff800081133b90 x28: 0000000000000001 x27: ffff800081133b70
[91774.509301] x26: 0000000000000001 x25: 0000000000000000 x24: 0000000000000007
[91774.509305] x23: ffff0000000e8634 x22: 0000000000000000 x21: ffff0000aae41fe0
[91774.509310] x20: 0000000079563572 x19: 000000000000018b x18: 0000000000000014
[91774.509315] x17: ffff5f84af915000 x16: ffffa07c4f31d408 x15: 7fffffffffffffce
[91774.509319] x14: 0000000000000634 x13: 7fffffffffffffd1 x12: ffff00001bd90848
[91774.509323] x11: 0000000000000600 x10: 000000000000036c x9 : ffffa07c4f31d430
[91774.509327] x8 : ffff8000811339f0 x7 : ffff800081134000 x6 : ffff800081130000
[91774.509330] x5 : 0000000000000000 x4 : ffff800081133ae0 x3 : 0000000000000000
[91774.509334] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000000e8634
[91774.509339] Call trace:
[91774.509343] mt7915_mac_tx_free+0x254/0x2f0 [mt7915e]
[91774.509352] mt7915_rx_check+0x38/0xe0 [mt7915e]
[91774.509361] mt76_dma_rx_process+0x2b8/0x4f8 [mt76]
[91774.509389] mt76_dma_rx_poll+0x90/0x138 [mt76]
[91774.509408] __napi_poll.constprop.0+0x40/0x268
[91774.509419] napi_threaded_poll_loop+0x234/0x2c0
[91774.509422] napi_threaded_poll+0x80/0xa0
[91774.509424] kthread+0xf0/0x108
[91774.509433] ret_from_fork+0x10/0x20
[91774.509442] ---[ end trace 0000000000000000 ]---
[91780.180563] r8125 0000:03:00.0 eth1: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 6265 ms
[91780.189372] r8125 0000:03:00.0 eth1: Transmit timeout reset Device!
[91780.200559] r8125 0000:03:00.0 eth1: Device reseting!
[91780.235869] r8125: eth1: link down
[91784.271893] r8125: eth1: link up
[91786.132980] mt7915e 0000:04:00.0: Message 00002ced (seq 1) timeout
[91792.149613] r8125 0000:03:00.0 eth1: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 6114 ms
[91792.158465] r8125 0000:03:00.0 eth1: Transmit timeout reset Device!
[91792.169624] r8125 0000:03:00.0 eth1: Device reseting!
[91792.209907] r8125: eth1: link down

[lts-rad]

for r8125 one suggestion has tso off

https://unix.stackexchange.com/questions/737187/linux-e1000e-nic-crashes-randomly-with-transmit-queue-0-timed-out
ethtool -K eth1 tso off

[lts-rad]

warning is related to

mt7915_mac_tx_free(struct mt7915_dev *dev, void *data, int len)
{
	struct mt76_connac_tx_free *free = data;
	__le32 *tx_info = (__le32 *)(data + sizeof(*free));
	struct mt76_dev *mdev = &dev->mt76;
	struct mt76_txwi_cache *txwi;
	struct ieee80211_sta *sta = NULL;
	struct mt76_wcid *wcid = NULL;
	LIST_HEAD(free_list);
	void *end = data + len;
	bool v3, wake = false;
	u16 total, count = 0;
	u32 txd = le32_to_cpu(free->txd);
	__le32 *cur_info;

	mt7915_mac_tx_free_prepare(dev);

	total = le16_get_bits(free->ctrl, MT_TX_FREE_MSDU_CNT);
	v3 = (FIELD_GET(MT_TX_FREE_VER, txd) == 0x4);

	for (cur_info = tx_info; count < total; cur_info++) {
		u32 msdu, info;
		u8 i;

		if (WARN_ON_ONCE((void *)cur_info >= end))
			return;

this can happen if data is unaligned or if free->ctrl was wrong.

[lts-rad]

openwrt/mt76#972