| Message ID | 20180515123323.24702-2-nbd@nbd.name (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 66a77cbe63eb326513632cc88e1260e877be8123 |
| Delegated to: | Kalle Valo |
| Headers | show |
diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2_mac.c b/drivers/net/wireless/mediatek/mt76/mt76x2_mac.c index dab713756004..b49aea4da2d6 100644 --- a/drivers/net/wireless/mediatek/mt76/mt76x2_mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt76x2_mac.c @@ -301,6 +301,9 @@ int mt76x2_mac_process_rx(struct mt76x2_dev *dev, struct sk_buff *skb, u8 wcid; int len; + if (!test_bit(MT76_STATE_RUNNING, &dev->mt76.state)) + return -EINVAL; + if (rxinfo & MT_RXINFO_L2PAD) pad_len += 2;
If the radio was previously in running state, it can receive some packets before it is able to process them. This can lead to a crash if the channel is not initialized yet. Discard all rx packets until start() is called Signed-off-by: Felix Fietkau <nbd@nbd.name> --- drivers/net/wireless/mediatek/mt76/mt76x2_mac.c | 3 +++ 1 file changed, 3 insertions(+)