From: 傅继晗 <fjhhz1997@gmail.com>
Commit d594cc6f2c58 ("wifi: mac80211: restore non-chanctx injection
behaviour") restored the monitor injection fallback for drivers using
chanctx emulation but explicitly deferred drivers that transitioned
to real chanctx ops. mt76 falls in that category and still drops
every injected frame when monitor coexists with another interface.
When the monitor has no chanctx of its own, fall back to the only
chanctx in flight if there is exactly one. Refuse if multiple are
present: picking arbitrarily would inject on an unrelated channel.
Emulated and real chanctx drivers both flow through this fallback,
since emulation always presents zero or one chanctx in
local->chanctx_list.
Reran the airgeddon evil-twin flow (hostapd AP + coexisting monitor
VIF on the same phy + aireplay-ng deauth from the monitor) on
mt7921e PCIe and mt7921u USB across 2.4 GHz and 5 GHz, and on a
Kali VM with MT7921U passthrough as the closest match to the
original reporter's setup. None reproduced the hang seen against
the earlier attempt at this fix
(<20251216111909.25076-2-johannes@sipsolutions.net>) or against v1
on lore in March.
Cc: stable@vger.kernel.org # 6.9+
Reported-by: Oscar Alfonso Diaz <oscar.alfonso.diaz@gmail.com>
Closes: https://github.com/morrownr/USB-WiFi/issues/682
Tested-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Fixes: 0a44dfc07074 ("wifi: mac80211: simplify non-chanctx drivers")
Signed-off-by: 傅继晗 <fjhhz1997@gmail.com>
Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca>
---
v4:
- Drop the dedicated local->emulate_chanctx branch. Emulation always
presents zero or one chanctx in local->chanctx_list, so the
single-chanctx walk handles that path too.
- Real-chanctx TX path is unchanged, so v3 Tested-by carries.
v3:
- Replace list_is_singular() + list_first_entry() with
list_first_or_null_rcu() and an rcu_access_pointer() check
that the entry is the only one in the list. The v2 pair
re-read ->next without RCU between the singularity check
and the entry fetch, racing list_del_rcu() of the sole entry
(rculist.h).
v2:
- First respin under my submitter signoff; preserves fjh1997
authorship.
- Verification matrix; airgeddon evil-twin flow on mt7921e/
mt7921u/Kali-VM does not reproduce the hang reported against
the v1 attempt at this fix.
net/mac80211/tx.c | 16 ++++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 933c86ca21c3..a8c5d3a2b1f0 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2407,12 +2407,18 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
rcu_dereference(tmp_sdata->vif.bss_conf.chanctx_conf);
}
- if (chanctx_conf)
+ if (chanctx_conf) {
chandef = &chanctx_conf->def;
- else if (local->emulate_chanctx)
- chandef = &local->hw.conf.chandef;
- else
- goto fail_rcu;
+ } else {
+ struct ieee80211_chanctx *ctx;
+
+ ctx = list_first_or_null_rcu(&local->chanctx_list,
+ struct ieee80211_chanctx, list);
+ if (!ctx ||
+ rcu_access_pointer(ctx->list.next) != &local->chanctx_list)
+ goto fail_rcu;
+ chandef = &ctx->conf.def;
+ }
/*
* If driver/HW supports IEEE80211_CHAN_CAN_MONITOR we still
--
2.54.0
Let me know if any testing of a concrete patch is needed when you feel
it is completely fixed.
P.S. My environment was Kali VM using Vmware.
Regards.
--
Oscar
OpenPGP Key: DA9C60E9 ||
https://pgp.mit.edu/pks/lookup?op=get&search=0x79B17260DA9C60E9
4F74 B302 354D 817D DE38 0A43 79B1 7260 DA9C 60E9
--
El mié, 20 may 2026 a las 1:57, Devin Wittmayer
(<lucid_duck@justthetip.ca>) escribió:
>
> From: 傅继晗 <fjhhz1997@gmail.com>
>
> Commit d594cc6f2c58 ("wifi: mac80211: restore non-chanctx injection
> behaviour") restored the monitor injection fallback for drivers using
> chanctx emulation but explicitly deferred drivers that transitioned
> to real chanctx ops. mt76 falls in that category and still drops
> every injected frame when monitor coexists with another interface.
>
> When the monitor has no chanctx of its own, fall back to the only
> chanctx in flight if there is exactly one. Refuse if multiple are
> present: picking arbitrarily would inject on an unrelated channel.
> Emulated and real chanctx drivers both flow through this fallback,
> since emulation always presents zero or one chanctx in
> local->chanctx_list.
>
> Reran the airgeddon evil-twin flow (hostapd AP + coexisting monitor
> VIF on the same phy + aireplay-ng deauth from the monitor) on
> mt7921e PCIe and mt7921u USB across 2.4 GHz and 5 GHz, and on a
> Kali VM with MT7921U passthrough as the closest match to the
> original reporter's setup. None reproduced the hang seen against
> the earlier attempt at this fix
> (<20251216111909.25076-2-johannes@sipsolutions.net>) or against v1
> on lore in March.
>
> Cc: stable@vger.kernel.org # 6.9+
> Reported-by: Oscar Alfonso Diaz <oscar.alfonso.diaz@gmail.com>
> Closes: https://github.com/morrownr/USB-WiFi/issues/682
> Tested-by: Devin Wittmayer <lucid_duck@justthetip.ca>
> Fixes: 0a44dfc07074 ("wifi: mac80211: simplify non-chanctx drivers")
> Signed-off-by: 傅继晗 <fjhhz1997@gmail.com>
> Signed-off-by: Devin Wittmayer <lucid_duck@justthetip.ca>
> ---
> v4:
> - Drop the dedicated local->emulate_chanctx branch. Emulation always
> presents zero or one chanctx in local->chanctx_list, so the
> single-chanctx walk handles that path too.
> - Real-chanctx TX path is unchanged, so v3 Tested-by carries.
>
> v3:
> - Replace list_is_singular() + list_first_entry() with
> list_first_or_null_rcu() and an rcu_access_pointer() check
> that the entry is the only one in the list. The v2 pair
> re-read ->next without RCU between the singularity check
> and the entry fetch, racing list_del_rcu() of the sole entry
> (rculist.h).
>
> v2:
> - First respin under my submitter signoff; preserves fjh1997
> authorship.
> - Verification matrix; airgeddon evil-twin flow on mt7921e/
> mt7921u/Kali-VM does not reproduce the hang reported against
> the v1 attempt at this fix.
>
> net/mac80211/tx.c | 16 ++++++++++++-----
> 1 file changed, 11 insertions(+), 5 deletions(-)
>
> diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
> index 933c86ca21c3..a8c5d3a2b1f0 100644
> --- a/net/mac80211/tx.c
> +++ b/net/mac80211/tx.c
> @@ -2407,12 +2407,18 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
> rcu_dereference(tmp_sdata->vif.bss_conf.chanctx_conf);
> }
>
> - if (chanctx_conf)
> + if (chanctx_conf) {
> chandef = &chanctx_conf->def;
> - else if (local->emulate_chanctx)
> - chandef = &local->hw.conf.chandef;
> - else
> - goto fail_rcu;
> + } else {
> + struct ieee80211_chanctx *ctx;
> +
> + ctx = list_first_or_null_rcu(&local->chanctx_list,
> + struct ieee80211_chanctx, list);
> + if (!ctx ||
> + rcu_access_pointer(ctx->list.next) != &local->chanctx_list)
> + goto fail_rcu;
> + chandef = &ctx->conf.def;
> + }
>
> /*
> * If driver/HW supports IEEE80211_CHAN_CAN_MONITOR we still
> --
> 2.54.0
On Wed, 2026-05-20 at 08:49 +0200, Óscar Alfonso Díaz wrote: > Let me know if any testing of a concrete patch is needed when you feel > it is completely fixed. I guess Devin is saying it's fixed, and I'm saying it's the same as mine so can't be really fixed unless something else happened in the kernel. Do you recall which kernel version you tested with? (I don't.) Perhaps something else in the kernel changed and it's now OK to make this change, but we know it wasn't working when you tested before, and I'd rather have it not work than crash. johannes
I tested it on 6.18.12 Let me know if you need me to test it again or whatever. I remember during my testing with the Brite's different patches that is not the same testing it on 6.18.x than 6.19 . Some stuff changed and the patch needed to be different. I've added Brite to the thread, he can add more useful data for you. Regarding the approach of fixing the bug on the driver side... I've emailed and contacted by IRC to Lorenzo explaining the problem... but I got no response. So if we feel yet like this is something that needs to be fixed from the "driver side"... how to say it softly... we are f***ed up :) . Maybe the "hack" way dealing with the vif null var is not bad idea after all as it seems the only way to move forward. Let me know if somebody needs more testing. Thanks. -- Oscar OpenPGP Key: DA9C60E9 || https://pgp.mit.edu/pks/lookup?op=get&search=0x79B17260DA9C60E9 4F74 B302 354D 817D DE38 0A43 79B1 7260 DA9C 60E9 -- El mié, 20 may 2026 a las 9:42, Johannes Berg (<johannes@sipsolutions.net>) escribió: > > On Wed, 2026-05-20 at 08:49 +0200, Óscar Alfonso Díaz wrote: > > Let me know if any testing of a concrete patch is needed when you feel > > it is completely fixed. > > I guess Devin is saying it's fixed, and I'm saying it's the same as mine > so can't be really fixed unless something else happened in the kernel. > > Do you recall which kernel version you tested with? (I don't.) Perhaps > something else in the kernel changed and it's now OK to make this > change, but we know it wasn't working when you tested before, and I'd > rather have it not work than crash. > > johannes
On Wed, 2026-05-20 at 10:02 +0200, Óscar Alfonso Díaz wrote: > I tested it on 6.18.12 > > Let me know if you need me to test it again or whatever. I remember > during my testing with the Brite's different patches that is not the > same testing it on 6.18.x than 6.19 . Some stuff changed and the patch > needed to be different. I've added Brite to the thread, he can add > more useful data for you. I guess I don't really care about 6.18.x or 6.19.x, only about 7.1-rcX at this point. We'll want to explicitly _not_ backport this fix to older kernel versions since it caused driver crashes. > Regarding the approach of fixing the bug on the driver side... I've > emailed and contacted by IRC to Lorenzo explaining the problem... but > I got no response. So if we feel yet like this is something that needs > to be fixed from the "driver side"... how to say it softly... we are > f***ed up :) . Maybe the "hack" way dealing with the vif null var is > not bad idea after all as it seems the only way to move forward. I feel I've tried to say this before, but maybe it helps if I summarise: There's one feature and one (possible) bug here. The feature is: - monitor mode injection works for chanctx drivers. The bug is: - monitor mode injection with the feature patch crashes at least some mt76 devices, which you reported, which I consider to be a bug in the driver that needs to be fixed there. To me, the trade-off is crystal clear - as long as the bug exists, I'm not going to apply this or a similar patch to enable the feature. I'm also not going to apply a patch like proposed before that hacks it by redirecting the vif pointer to a (more or less random) other vif, that's a lazy hack that happens to fix the problem in your _specific_ use case, but will almost certainly still expose the crash in other use cases. I do think there's a chance that between 6.18/6.19 and 7.1-rcX the bug in the driver has already been fixed, that's why I keep asking about versions etc. But I also think there's a chance you're just testing different subdrivers of mt76 with different devices, so I'm also asking you to compare the specific devices. I'm happy to apply this patch if the people who previously reported it to crash (i.e. mostly you, not sure about others) are saying that against a more recent kernel it no longer causes the test to crash (rather than just not work, which is clearly better than crashing.) You could always just claim you've tested this patch without the crash and I'll apply it, but then if someone still finds a crash I'm just going to have to revert it, and we'd be back to square one. I hope this explains what I'm thinking and going to do (and not do), make of it what you will. johannes
Ok, let me do one final test using Johannes’ v2 patch. The expected behavior is as follows: 6.18 or lower: no need to test, it will not work. It’s clear now that this does not matter, since the goal is only to fix newer kernel versions. 6.19: some versions of the 6.19 will crash and others will not. The crash was fixed at some point between 6.18.12 and 6.19.12. No need to test. 7.0, or 7.1: the expected result is that there will be no crash, and VIF + deauth will work only on 2.4 GHz. It will not work on 5 GHz (I'll test both, normal DoS and VIF+DoS). There should be no crash, but it will not work. So I'll focus my testing on 7.0 and 7.1 and I'll get back to you with the results. I'll be testing this patch (v2): https://patchwork.kernel.org/project/linux-wireless/patch/20251216111909.25076-2-johannes@sipsolutions.net/ Give me some time to do these tests. I'll test it on both 7.0 and 7.1 kernels. Thanks and regards. -- Oscar OpenPGP Key: DA9C60E9 || https://pgp.mit.edu/pks/lookup?op=get&search=0x79B17260DA9C60E9 4F74 B302 354D 817D DE38 0A43 79B1 7260 DA9C 60E9 -- El mié, 20 may 2026 a las 10:58, Johannes Berg (<johannes@sipsolutions.net>) escribió: > > On Wed, 2026-05-20 at 10:02 +0200, Óscar Alfonso Díaz wrote: > > I tested it on 6.18.12 > > > > Let me know if you need me to test it again or whatever. I remember > > during my testing with the Brite's different patches that is not the > > same testing it on 6.18.x than 6.19 . Some stuff changed and the patch > > needed to be different. I've added Brite to the thread, he can add > > more useful data for you. > > I guess I don't really care about 6.18.x or 6.19.x, only about 7.1-rcX > at this point. We'll want to explicitly _not_ backport this fix to older > kernel versions since it caused driver crashes. > > > Regarding the approach of fixing the bug on the driver side... I've > > emailed and contacted by IRC to Lorenzo explaining the problem... but > > I got no response. So if we feel yet like this is something that needs > > to be fixed from the "driver side"... how to say it softly... we are > > f***ed up :) . Maybe the "hack" way dealing with the vif null var is > > not bad idea after all as it seems the only way to move forward. > > I feel I've tried to say this before, but maybe it helps if I summarise: > > There's one feature and one (possible) bug here. > > The feature is: > - monitor mode injection works for chanctx drivers. > > The bug is: > - monitor mode injection with the feature patch crashes at least some > mt76 devices, which you reported, which I consider to be a bug in the > driver that needs to be fixed there. > > To me, the trade-off is crystal clear - as long as the bug exists, I'm > not going to apply this or a similar patch to enable the feature. > > I'm also not going to apply a patch like proposed before that hacks it > by redirecting the vif pointer to a (more or less random) other vif, > that's a lazy hack that happens to fix the problem in your _specific_ > use case, but will almost certainly still expose the crash in other use > cases. > > I do think there's a chance that between 6.18/6.19 and 7.1-rcX the bug > in the driver has already been fixed, that's why I keep asking about > versions etc. But I also think there's a chance you're just testing > different subdrivers of mt76 with different devices, so I'm also asking > you to compare the specific devices. > > I'm happy to apply this patch if the people who previously reported it > to crash (i.e. mostly you, not sure about others) are saying that > against a more recent kernel it no longer causes the test to crash > (rather than just not work, which is clearly better than crashing.) > > You could always just claim you've tested this patch without the crash > and I'll apply it, but then if someone still finds a crash I'm just > going to have to revert it, and we'd be back to square one. > > I hope this explains what I'm thinking and going to do (and not do), > make of it what you will. > > johannes
On Wed, 2026-05-20 at 11:51 +0200, Óscar Alfonso Díaz wrote: > Ok, let me do one final test using Johannes’ v2 patch. The expected > behavior is as follows: > > 6.18 or lower: no need to test, it will not work. It’s clear now that > this does not matter, since the goal is only to fix newer kernel > versions. > > 6.19: some versions of the 6.19 will crash and others will not. The > crash was fixed at some point between 6.18.12 and 6.19.12. No need to > test. > > 7.0, or 7.1: the expected result is that there will be no crash, and > VIF + deauth will work only on 2.4 GHz. It will not work on 5 GHz > (I'll test both, normal DoS and VIF+DoS). There should be no crash, > but it will not work. > > So I'll focus my testing on 7.0 and 7.1 and I'll get back to you with > the results. I'll be testing this patch (v2): > https://patchwork.kernel.org/project/linux-wireless/patch/20251216111909.25076-2-johannes@sipsolutions.net/ > Thanks. For testing that one you'd have to revert the other first, I think, you could also just test this one: https://patchwork.kernel.org/project/linux-wireless/patch/20260519235713.49109-2-lucid_duck@justthetip.ca/ But I think they're basically all equivalent. Since we eventually need a patch to apply w/o reverting, Devin's is probably better than my old one. johannes
Ok, I'll do the testing using this one you suggested: https://patchwork.kernel.org/project/linux-wireless/patch/20260519235713.49109-2-lucid_duck@justthetip.ca/ Thanks. -- Oscar OpenPGP Key: DA9C60E9 || https://pgp.mit.edu/pks/lookup?op=get&search=0x79B17260DA9C60E9 4F74 B302 354D 817D DE38 0A43 79B1 7260 DA9C 60E9 -- El mié, 20 may 2026 a las 11:53, Johannes Berg (<johannes@sipsolutions.net>) escribió: > > On Wed, 2026-05-20 at 11:51 +0200, Óscar Alfonso Díaz wrote: > > Ok, let me do one final test using Johannes’ v2 patch. The expected > > behavior is as follows: > > > > 6.18 or lower: no need to test, it will not work. It’s clear now that > > this does not matter, since the goal is only to fix newer kernel > > versions. > > > > 6.19: some versions of the 6.19 will crash and others will not. The > > crash was fixed at some point between 6.18.12 and 6.19.12. No need to > > test. > > > > 7.0, or 7.1: the expected result is that there will be no crash, and > > VIF + deauth will work only on 2.4 GHz. It will not work on 5 GHz > > (I'll test both, normal DoS and VIF+DoS). There should be no crash, > > but it will not work. > > > > So I'll focus my testing on 7.0 and 7.1 and I'll get back to you with > > the results. I'll be testing this patch (v2): > > https://patchwork.kernel.org/project/linux-wireless/patch/20251216111909.25076-2-johannes@sipsolutions.net/ > > > > Thanks. For testing that one you'd have to revert the other first, I > think, you could also just test this one: > > https://patchwork.kernel.org/project/linux-wireless/patch/20260519235713.49109-2-lucid_duck@justthetip.ca/ > > But I think they're basically all equivalent. > > Since we eventually need a patch to apply w/o reverting, Devin's is > probably better than my old one. > > johannes
© 2016 - 2026 Red Hat, Inc.