control->sta is set to NULL early when encryption is turned on for the
station and info->control.hw_key is not set.
This code is missing a check for the 802.11 header protected flag, otherwise
it resets the station for other frames, e.g. client probing frames.

Signed-off-by: Felix Fietkau <n...@nbd.name>
---
 drivers/net/wireless/mediatek/mt76/mt76x02_txrx.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_txrx.c 
b/drivers/net/wireless/mediatek/mt76/mt76x02_txrx.c
index 7ec3f8f5f228..c008e08602f3 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x02_txrx.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x02_txrx.c
@@ -22,6 +22,7 @@
 void mt76x02_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control,
                struct sk_buff *skb)
 {
+       struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
        struct mt76x02_dev *dev = hw->priv;
        struct ieee80211_vif *vif = info->control.vif;
@@ -33,7 +34,8 @@ void mt76x02_tx(struct ieee80211_hw *hw, struct 
ieee80211_tx_control *control,
                msta = (struct mt76x02_sta *)control->sta->drv_priv;
                wcid = &msta->wcid;
                /* sw encrypted frames */
-               if (!info->control.hw_key && wcid->hw_key_idx != 0xff)
+               if (!info->control.hw_key && wcid->hw_key_idx != 0xff &&
+                   ieee80211_has_protected(hdr->frame_control))
                        control->sta = NULL;
        }
 
-- 
2.17.0

Reply via email to