Re: [PATCH] wifi: mt76: mt7925: fix NULL dereference in CSA worker

[Andreas Haerter]

On Sun, Oct 25, 2026 at 10:01:18PM +0800, Gris Ge wrote:
> Reproduced the panic by injecting CSA-less "abort" beacon, works well
> after patched.

I hit the same oops in normal use, with no injected frames, on a
ThinkPad X13 Gen 6 (MT7925, 14c3:7925) running Fedora's
7.2.14-200.fc44.x86_64, not tainted:

  BUG: kernel NULL pointer dereference, address: 0000000000000000
  Workqueue: phy0 mt7925_csa_work [mt7925_common]
  RIP: 0010:mt7925_csa_work+0x83/0x160 [mt7925_common]
  RAX: 0000000000000000 RBX: ffff8eeb5bbb3910 RCX: 0000000000000fa0

The code bytes decode to the dev->new_ctx load followed by the read of
def.chan for mt7925_set_roc(), and RCX holds the duration of 4000.

The access point announced a channel switch just after a roam:

  10:58:02.90  associated with the new BSS on 5180 MHz
  10:58:04.05  CTRL-EVENT-STARTED-CHANNEL-SWITCH freq=5180 (80 MHz)
  10:58:04.47  oops

It has happened once. Two earlier channel switches on this machine
completed normally, and the log does not show what tore the context
down.

The impact MAY be worth a line in the changelog. The oops lands between
mt792x_mutex_acquire() and the release, so dev->mt76.mutex stays held
for good. WiFi did not come back, and at shutdown wpa_supplicant,
NetworkManager, avahi-daemon and systemd-resolved all survived SIGKILL.
The machine needed a forced power-off, so the stable tag looks right to
me.

I read the patch against master and v7.2.14. The chanctx hunks apply to
v7.2.14 with an offset and mt7925_csa_work() is identical there. I see
no new lock ordering problem.

I have no reproducer, so I cannot offer a Tested-by.

Thanks,
Andreas

-- 
foundata GmbH
Steinhäuserstr. 20
76135 Karlsruhe


Web: https://foundata.com
Sitz der Gesellschaft: Karlsruhe
Registergericht: Amtsgericht Mannheim, HRB 714807
Geschäftsführung: Andreas Haerter
USt-IdNr.: DE284122682