From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794064504; b=fS8gDFzWsLgFUjSGP0b7B2UVVGaU9Sn18oET3V6BrpQ/D8OUuKVvJ+MmbpOFc35a/5iF 3NS/8F6C/sa3jXwuyUNebsVRBfy6psaWwAtHEXmY6gE918FKwEkWsqZopXDvpuGTdMWlH 2LM9VuZK2j7RYcU5FBr1ig4ukvAw39ACPHgSfHQK3NpzClX2aViXlVT5sAnzMfnz0LpyB YxJsXm1a5CssiN19xGCaE1wVIEMqkWlhDS9+iGHM1HMfCbWySFc57M07QCB9THDjvkacm Hb2l98t4J5RbIXhUhxeT8zJlcXms2H0TGoEtGYOJdvDtaW1vSFPVBimrcjZPgaJZz2Q== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794064504; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=acpBiEMYQo1HDdfz+l0vR7R8iFzDsGmQ98DiO7DDPEU=; b=J751XSNenBF0gRGMZQsRGNbxLsI4MCxd/rnu5Or632cNJrY6/fdZuuEQx9WuIBl1hXPJ rp8yrpVP0LhaRdfj4HFxwGx4CIg1FlKz4m4h70c9QaNf3ecZBYEhnu0SEIqiZp/qN8H5i qJpaH1MDpgvIXwpPMLFwWdf0OXGqR3X3/E+TDoFUjJ9bfkhvD2cAWsebHqnFuitoSoRhj oRHfYALEgP3sMG08DB3VGB/+s2dzm+dMelgxUl8IppQrQHXrPtbzq9dSav9qvHUY6yPCj 0zW+lDgcarB0roGEbzf/t1DQvrzte5ge1wZeAD4voyseJNgUnIzyCfYAG6XgEgE36yw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=tRs7U2eJ; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E8F49606A33A; Sat, 7 Nov 2026 15:15:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=tRs7U2eJ Received: by smtp.kernel.org (Postfix) with ESMTPSA id 961771F008A7; Sat, 7 Nov 2026 15:15:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794064503; bh=acpBiEMYQo1HDdfz+l0vR7R8iFzDsGmQ98DiO7DDPEU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=tRs7U2eJR26Ho9pvzUD6ZcV9aJy/V/IcZs6fp7qua/4v4mY4TLDJhiYmQgW0njqvC w5YB2O8zXgTjWfD7z+DsEtOCEAetdiy0jnn9uA8KdjwB4sUzelGaqtMsKr704KvG0G Cd8W7hf5nSUk3+g2auy0Z8N7gm7Io8xsdAh/kFrY= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Orly Orge , Inanix , Mark Anthony Agarro , Devin Wittmayer , Felix Fietkau , Sasha Levin Subject: [PATCH 7.3 0536/1257] wifi: mt76: mt7615: do not tear down BSS/STA state for monitor vifs Date: Sat, 7 Nov 2026 08:47:12 -0500 Message-ID: <20261107134954.209724091@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134939.434104957@linuxfoundation.org> References: <20261107134939.434104957@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Mark Anthony Agarro [ Upstream commit f7517b3d8b7f1008e07edcb8bb692c6ca53ef23b ] Tearing down a monitor interface oopses: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:mt76_connac_mcu_uni_add_bss+0x144/0x370 [mt76_connac_lib] Call Trace: mt7615_remove_interface+0x6a/0x200 [mt7615_common] drv_remove_interface+0x60/0x140 [mac80211] ieee80211_del_virtual_monitor+0x8f/0xc0 [mac80211] ieee80211_do_open+0x550/0x7d0 [mac80211] ieee80211_open+0xaa/0xb0 [mac80211] __dev_open+0x11b/0x280 mt7615_remove_interface() tears down BSS and STA state for every vif type. On MT7663 with offload firmware that reaches mt76_connac_mcu_uni_add_bss(), which has no monitor case in its iftype switch. It takes WARN_ON(1), then copies ETH_ALEN from vif->bss_conf.bssid, which is NULL for a monitor vif. mt76_connac_mcu_bss_basic_tlv() in the same file handles this. It has an NL80211_IFTYPE_MONITOR case and it copies phy->macaddr in place of the bssid. The uni variant has neither. There is nothing to tear down. mt7615_add_interface() only calls mt7615_mcu_add_dev_info(). The BSS and STA state comes from beacon enable in mt7615_bss_info_changed(), from mt7615_set_key() and from mt7615_mac_sta_add(), so a monitor vif never has any. Reported on mt7615e going from monitor back to managed, and on mt7663u on an "ip link set down", both through ieee80211_del_virtual_monitor(). Fixes: d9852ab2f362 ("mt76: mt7615: keep mcu_add_bss_info enabled till interface removal") Cc: stable@vger.kernel.org Reported-by: Orly Orge Closes: https://lore.kernel.org/linux-wireless/CANj5C4mTOHs6riyWee=dFdkE5p=714J8xs-x3hq3ewQ+r6O_Nw@mail.gmail.com/ Reported-by: Inanix Closes: https://github.com/morrownr/mt76/issues/79 Tested-by: Inanix Signed-off-by: Mark Anthony Agarro Signed-off-by: Devin Wittmayer Link: https://patch.msgid.link/20260813152059.15747-1-lucid_duck@justthetip.ca Signed-off-by: Felix Fietkau Signed-off-by: Sasha Levin --- drivers/net/wireless/mediatek/mt76/mt7615/main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/main.c b/drivers/net/wireless/mediatek/mt76/mt7615/main.c index 67f56e428d9a1..175e847f49efd 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7615/main.c +++ b/drivers/net/wireless/mediatek/mt76/mt7615/main.c @@ -254,8 +254,10 @@ static void mt7615_remove_interface(struct ieee80211_hw *hw, mt7615_mutex_acquire(dev); - mt7615_mcu_add_bss_info(phy, vif, NULL, false); - mt7615_mcu_sta_add(phy, vif, NULL, false); + if (vif->type != NL80211_IFTYPE_MONITOR) { + mt7615_mcu_add_bss_info(phy, vif, NULL, false); + mt7615_mcu_sta_add(phy, vif, NULL, false); + } mt76_testmode_reset(phy->mt76, true); if (vif == phy->monitor_vif) -- 2.53.0