mt76: discard early received packets if not running yet

If the radio was previously in running state, it can receive some
packets before it is able to process them.
This can lead to a crash if the channel is not initialized yet.
Discard all rx packets until start() is called

Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2_mac.c b/drivers/net/wireless/mediatek/mt76/mt76x2_mac.c
index dab7137560044c6c34ba433b8615be4e1ce5863c..b49aea4da2d664e5dd4bcae392c457b9a548d200 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/mt76x2_mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x2_mac.c
@@ -301,6 +301,9 @@ int mt76x2_mac_process_rx(struct mt76x2_dev *dev, struct sk_buff *skb,
        u8 wcid;
        int len;
 
+       if (!test_bit(MT76_STATE_RUNNING, &dev->mt76.state))
+               return -EINVAL;
+
        if (rxinfo & MT_RXINFO_L2PAD)
                pad_len += 2;