Commit 58bab0d4 authored by Felix Fietkau's avatar Felix Fietkau
Browse files

mt76: stop rx aggregation on station removal 



Fixes use-after-free issues on forced station removal during hardware restart
on MT76x02

Fixes: aee5b8cf ("mt76: implement A-MPDU rx reordering in the driver code")
Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
parent 5a90107d

drivers/net/wireless/mediatek/mt76/mac80211.c

+3 −0
Original line number Diff line number Diff line
@@ -708,6 +708,9 @@ void __mt76_sta_remove(struct mt76_dev *dev, struct ieee80211_vif *vif, 
	rcu_assign_pointer(dev->wcid[idx], NULL);

	synchronize_rcu();



	for (i = 0; i < ARRAY_SIZE(wcid->aggr); i++)

		mt76_rx_aggr_stop(dev, wcid, i);



	if (dev->drv->sta_remove)

		dev->drv->sta_remove(dev, vif, sta);

CRA Git | Maintained and supported by SUSTech CRA and CCSE