wifi: mt76: prevent non-offchannel mgmt tx during scan/roc

[ Upstream commit 4c2334587b0a13b8f4eda1336ae657297fcd743b ]

Only put probe request packets in the offchannel queue if
IEEE80211_TX_CTRL_DONT_USE_RATE_MASK is set and IEEE80211_TX_CTL_TX_OFFCHAN
is unset.

Fixes: 0b3be9d1d34e ("wifi: mt76: add separate tx scheduling queue for off-channel tx")
Reported-by: Chad Monroe <chad.monroe@adtran.com>
Link: https://patch.msgid.link/20250813121106.81559-2-nbd@nbd.name
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/wireless/mediatek/mt76/tx.c b/drivers/net/wireless/mediatek/mt76/tx.c
index 065a1e4537457a1bd1112d94fbc35e26909a72e3..5e081972bf445cf98338a38805247281fd4b5ee3 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/tx.c
+++ b/drivers/net/wireless/mediatek/mt76/tx.c
@@ -334,6 +334,7 @@ mt76_tx(struct mt76_phy *phy, struct ieee80211_sta *sta,
        struct mt76_wcid *wcid, struct sk_buff *skb)
 {
        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+       struct ieee80211_hdr *hdr = (void *)skb->data;
        struct sk_buff_head *head;
 
        if (mt76_testmode_enabled(phy)) {
@@ -351,7 +352,8 @@ mt76_tx(struct mt76_phy *phy, struct ieee80211_sta *sta,
        info->hw_queue |= FIELD_PREP(MT_TX_HW_QUEUE_PHY, phy->band_idx);
 
        if ((info->flags & IEEE80211_TX_CTL_TX_OFFCHAN) ||
-           (info->control.flags & IEEE80211_TX_CTRL_DONT_USE_RATE_MASK))
+           ((info->control.flags & IEEE80211_TX_CTRL_DONT_USE_RATE_MASK) &&
+            ieee80211_is_probe_req(hdr->frame_control)))
                head = &wcid->tx_offchannel;
        else
                head = &wcid->tx_pending;