In the MT7915 info, the fields for the WLAN index / queue overlap with the token id, and the MT_TX_FREE_PAIR bit indicates, which one is present. If MT_TX_FREE_PAIR is set, skip processing the token index, since the data will not be valid. This fixes accidentally freeing tokens which are still in use by the hardware with a wrong station pointer. Signed-off-by: Felix Fietkau <nbd@xxxxxxxx> --- drivers/net/wireless/mediatek/mt76/mt7915/mac.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c index 44a5b4f8e43c..3456d9532f29 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c @@ -972,6 +972,7 @@ void mt7915_mac_tx_free(struct mt7915_dev *dev, struct sk_buff *skb) if (list_empty(&msta->poll_list)) list_add_tail(&msta->poll_list, &dev->sta_poll_list); spin_unlock_bh(&dev->sta_poll_lock); + continue; } msdu = FIELD_GET(MT_TX_FREE_MSDU_ID, info); -- 2.28.0
