mt7996_tx() translates the MLD addresses of a frame into link addresses for an MLD interface. It casts skb->data to struct ieee80211_hdr, but a frame with IEEE80211_TX_CTL_HW_80211_ENCAP set carries an Ethernet header, so the writes to addr1 and addr2 corrupt the Ethernet header and the start of the payload. Skip the translation for such a frame. This is currently not reachable, because mac80211 queues encap offload frames to a TXQ and mt7996_tx() receives them only when they bypass the TXQ. Found by inspection. Signed-off-by: Felix Fietkau --- drivers/net/wireless/mediatek/mt76/mt7996/main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/main.c b/drivers/net/wireless/mediatek/mt76/mt7996/main.c index e97af1828444..f715817243a6 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7996/main.c +++ b/drivers/net/wireless/mediatek/mt76/mt7996/main.c @@ -2089,7 +2089,8 @@ static void mt7996_tx(struct ieee80211_hw *hw, if (link_id == IEEE80211_LINK_UNSPECIFIED) link_id = deflink_id; - if (vif && ieee80211_vif_is_mld(vif)) { + if (vif && ieee80211_vif_is_mld(vif) && + !(info->flags & IEEE80211_TX_CTL_HW_80211_ENCAP)) { struct ieee80211_bss_conf *link_conf; if (msta) { -- 2.47.3