* [PATCH] wifi: mt76: mt792x: fix NULL dereference during CSA beacon handling
@ 2026-05-03 0:46 Sean Wang
2026-05-09 8:23 ` Bongani Hlope
0 siblings, 1 reply; 2+ messages in thread
From: Sean Wang @ 2026-05-03 0:46 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi
Cc: linux-wireless, linux-mediatek, Sean Wang, Bongani Hlope
From: Sean Wang <sean.wang@mediatek.com>
mac80211 may call channel_switch_rx_beacon() while CSA is active, but
mt76's cached dev->new_ctx is not guaranteed to be valid at that point.
Avoid dereferencing dev->new_ctx when the target channel context is not
available and leave the existing CSA timer unchanged.
kernel: Workqueue: events_unbound cfg80211_wiphy_work [cfg80211]
kernel: RIP: 0010:mt7921_channel_switch_rx_beacon+0x1f/0x100
[mt7921_common]
kernel: RAX: 0000000000000000
kernel: CR2: 0000000000000000
kernel: Call Trace:
kernel: <TASK>
kernel: ieee80211_sta_process_chanswitch+0x67c/0xee0 [mac80211]
kernel: ieee80211_rx_mgmt_beacon+0x842/0x22a0 [mac80211]
kernel: ieee80211_sta_rx_queued_mgmt+0xa7/0xbb0 [mac80211]
kernel: ieee80211_iface_work+0x62e/0x890 [mac80211]
kernel: cfg80211_wiphy_work+0x1ee/0x280 [cfg80211]
kernel: process_scheduled_works+0x180/0x680
kernel: worker_thread+0x1aa/0x450
kernel: kthread+0x181/0x1e0
kernel: ret_from_fork+0x405/0x600
kernel: ret_from_fork_asm+0x11/0x20
kernel: </TASK>
kernel: CR2: 0000000000000000
kernel: ---[ end trace 0000000000000000 ]---
mt7925 has the same unsafe dev->new_ctx dereference in its CSA beacon
handling path, so guard both drivers against the missing target channel
context and leave the existing CSA timer unchanged.
Reported-by: Bongani Hlope <developer@hlope.org.za>
Closes: https://lore.kernel.org/linux-wireless/20260502140616.7672da98@bongani-mini.home.org.za/
Fixes: 8aa2f59260eb ("wifi: mt76: mt7921: introduce CSA support")
Fixes: 7900da40e315 ("wifi: mt76: mt7925: introduce CSA support in non-MLO mode")
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
---
drivers/net/wireless/mediatek/mt76/mt7921/main.c | 3 +++
drivers/net/wireless/mediatek/mt76/mt7925/main.c | 3 +++
2 files changed, 6 insertions(+)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
index 3d74fabe7408..a326f4c95c7c 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c
@@ -1508,6 +1508,9 @@ static void mt7921_channel_switch_rx_beacon(struct ieee80211_hw *hw,
struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
u16 beacon_interval = vif->bss_conf.beacon_int;
+ if (!dev->new_ctx)
+ return;
+
if (cfg80211_chandef_identical(&chsw->chandef,
&dev->new_ctx->def) &&
chsw->count) {
diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c b/drivers/net/wireless/mediatek/mt76/mt7925/main.c
index 73d3722739d0..b96a8e2efcbc 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/main.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/main.c
@@ -2402,6 +2402,9 @@ static void mt7925_channel_switch_rx_beacon(struct ieee80211_hw *hw,
beacon_interval = vif->bss_conf.beacon_int;
+ if (!dev->new_ctx)
+ return;
+
if (cfg80211_chandef_identical(&chsw->chandef,
&dev->new_ctx->def) &&
chsw->count) {
--
2.43.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] wifi: mt76: mt792x: fix NULL dereference during CSA beacon handling
2026-05-03 0:46 [PATCH] wifi: mt76: mt792x: fix NULL dereference during CSA beacon handling Sean Wang
@ 2026-05-09 8:23 ` Bongani Hlope
0 siblings, 0 replies; 2+ messages in thread
From: Bongani Hlope @ 2026-05-09 8:23 UTC (permalink / raw)
To: Sean Wang
Cc: Felix Fietkau, Lorenzo Bianconi, linux-wireless, linux-mediatek,
Sean Wang
Sorry I had some down time on my mail server. I can confirm this patch
works for me, I have been running with it since you sent it through.
Regards
On Sat, 2 May 2026 19:46:13 -0500
Sean Wang <sean.wang@kernel.org> wrote:
> From: Sean Wang <sean.wang@mediatek.com>
>
> mac80211 may call channel_switch_rx_beacon() while CSA is active, but
> mt76's cached dev->new_ctx is not guaranteed to be valid at that
> point.
>
> Avoid dereferencing dev->new_ctx when the target channel context is
> not available and leave the existing CSA timer unchanged.
>
> kernel: Workqueue: events_unbound cfg80211_wiphy_work [cfg80211]
> kernel: RIP: 0010:mt7921_channel_switch_rx_beacon+0x1f/0x100
> [mt7921_common]
> kernel: RAX: 0000000000000000
> kernel: CR2: 0000000000000000
> kernel: Call Trace:
> kernel: <TASK>
> kernel: ieee80211_sta_process_chanswitch+0x67c/0xee0 [mac80211]
> kernel: ieee80211_rx_mgmt_beacon+0x842/0x22a0 [mac80211]
> kernel: ieee80211_sta_rx_queued_mgmt+0xa7/0xbb0 [mac80211]
> kernel: ieee80211_iface_work+0x62e/0x890 [mac80211]
> kernel: cfg80211_wiphy_work+0x1ee/0x280 [cfg80211]
> kernel: process_scheduled_works+0x180/0x680
> kernel: worker_thread+0x1aa/0x450
> kernel: kthread+0x181/0x1e0
> kernel: ret_from_fork+0x405/0x600
> kernel: ret_from_fork_asm+0x11/0x20
> kernel: </TASK>
> kernel: CR2: 0000000000000000
> kernel: ---[ end trace 0000000000000000 ]---
>
> mt7925 has the same unsafe dev->new_ctx dereference in its CSA beacon
> handling path, so guard both drivers against the missing target
> channel context and leave the existing CSA timer unchanged.
>
> Reported-by: Bongani Hlope <developer@hlope.org.za>
> Closes:
> https://lore.kernel.org/linux-wireless/20260502140616.7672da98@bongani-mini.home.org.za/
> Fixes: 8aa2f59260eb ("wifi: mt76: mt7921: introduce CSA support")
> Fixes: 7900da40e315 ("wifi: mt76: mt7925: introduce CSA support in
> non-MLO mode") Signed-off-by: Sean Wang <sean.wang@mediatek.com> ---
> drivers/net/wireless/mediatek/mt76/mt7921/main.c | 3 +++
> drivers/net/wireless/mediatek/mt76/mt7925/main.c | 3 +++
> 2 files changed, 6 insertions(+)
>
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c
> b/drivers/net/wireless/mediatek/mt76/mt7921/main.c index
> 3d74fabe7408..a326f4c95c7c 100644 ---
> a/drivers/net/wireless/mediatek/mt76/mt7921/main.c +++
> b/drivers/net/wireless/mediatek/mt76/mt7921/main.c @@ -1508,6 +1508,9
> @@ static void mt7921_channel_switch_rx_beacon(struct ieee80211_hw
> *hw, struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
> u16 beacon_interval = vif->bss_conf.beacon_int;
> + if (!dev->new_ctx)
> + return;
> +
> if (cfg80211_chandef_identical(&chsw->chandef,
> &dev->new_ctx->def) &&
> chsw->count) {
> diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/main.c
> b/drivers/net/wireless/mediatek/mt76/mt7925/main.c index
> 73d3722739d0..b96a8e2efcbc 100644 ---
> a/drivers/net/wireless/mediatek/mt76/mt7925/main.c +++
> b/drivers/net/wireless/mediatek/mt76/mt7925/main.c @@ -2402,6 +2402,9
> @@ static void mt7925_channel_switch_rx_beacon(struct ieee80211_hw
> *hw, beacon_interval = vif->bss_conf.beacon_int;
>
> + if (!dev->new_ctx)
> + return;
> +
> if (cfg80211_chandef_identical(&chsw->chandef,
> &dev->new_ctx->def) &&
> chsw->count) {
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-05-09 9:36 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-03 0:46 [PATCH] wifi: mt76: mt792x: fix NULL dereference during CSA beacon handling Sean Wang
2026-05-09 8:23 ` Bongani Hlope
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox