From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f44.google.com (mail-pj1-f44.google.com [209.85.216.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D388D19ADB0 for ; Wed, 25 Mar 2026 00:15:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774397732; cv=none; b=k19SX7ubw9PIC+wHKIvh1oru79sojFmDN/TSifnJDXilCItvmJVSqcYKDTpzKGmVZBDORu5taXMBSjNFvg04oQX1wZdsMGDww9ILcxvQHsKjrEzsUt2KbfDRTkMtfj9z9GCjMgjgW4/7tzwLv6KH/D12Q+HJHgPFKQkI9YIxntc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774397732; c=relaxed/simple; bh=0P7oBDeyrtiUEeDcuz2XhUSLvG1+u+qDk3LZCKzquw8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=EE6VgTptK80wAX/nOIAsiqYMQ4hON77jxcWgVdvyhnUa3Lp3PlTj+ziwz6JXHKwYKawkGihqkefOLknrFvaEdkFIkHXzO7+t7FJmaZGcc1Qjyq67bfhAq8ggMv8nXgTpThxyvtBT2qVsdpQLEMaQDzwYcUcH08ddw5mljlyrnfg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Cip7d31g; arc=none smtp.client-ip=209.85.216.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Cip7d31g" Received: by mail-pj1-f44.google.com with SMTP id 98e67ed59e1d1-35a1f549e7eso2617712a91.0 for ; Tue, 24 Mar 2026 17:15:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1774397730; x=1775002530; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=CFu/4C9dcZr81R85Vo6ldm6Rbl3IdmjMsm6pyx/n7JI=; b=Cip7d31g/X47oecqaofhDWvVIQDy1CJXls40L1McW3R0uzOyCpcM9y/ZH6QrPtv+Ut rcQhXLL6DFO2cSAtx81nX9OXv+eiYted85+YAoQCUm8FycgM8/d7e6hhYNLCPwm2MvuM RYtfk8/2m6kBgZSflT3Fycs750NGQ0j1Tb92R3ZZw0PR1JvNHeWxfQfmmTFtg6YeyzDo /wFod/ZBe9RlJuI2v7pzWYVjeNWIoksfyC/F/b+LOtIJV9H/9ee7gow6qxf9HUU5P6M/ +YG7osWpz+pIQaZrTuHjb8hIkKsFO/Jnkbc3WE/0EBNMyPD4dP8PJBxzrBMzgA09XRUM Wghg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774397730; x=1775002530; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=CFu/4C9dcZr81R85Vo6ldm6Rbl3IdmjMsm6pyx/n7JI=; b=PPQ8UQ3xh8JULb+U6pVfTmKP/usiPudG/UsYtxF854S7bSmLku1BSuZz7M4EUUMEk9 y3E+uLWMxpLvnruaZyO09Sq5Wl/H5ntuQBAh1+TBQnpzdrY9+76EmjMdwQ1p6jS5Zw7B nLH9QWJKYzthKY52YypF+AxgDPhRmRvRspm+ONSzQVQ7YfipAPc6vQ4327V+IQQqCqI7 Rq1D5M9ZkoD0HvaU5PWFRkMnONNiHm6mRnPzdd069+V0fa/ko58XXtuhduUHcnXjJBfb HW/wuiMZUtIeMdfzCftp4rFqYWQcf0dX+w4U0vFp3kIecoZgtOAnaW1jLnhXCEerjIth 9ZXw== X-Forwarded-Encrypted: i=1; AJvYcCWveGi7qd88Dz7VG4saO2RqHvVqWZZr4TNeS6eR8WZYUP+WnAGZWsGthb9ULa58VitVCNvYWfsOrPFMbz4=@vger.kernel.org X-Gm-Message-State: AOJu0Yy0bhzLXqXdEuo9704jP+gQOykj092pAD/xuPxKQMqd5fSq5UW9 0rgEI2kJtXkquCSbvwOchel9mJkeuJ8p/Kkg59BP0xjq1uTHrh1Ossyd X-Gm-Gg: ATEYQzycuaGUHxSPT0M8xRo5k49abOZW0f444M57Z9AIjifuoG/uWuoHc6KcUmBF5AA go9V9xZMRhymq4a8w7eZ9PU465kdA+/FRkj6ypI2YgiY/4pv5qrhWM4p8Vg6+Qz7dmISMhYFV91 w1V/QKYP8XCGljUSoq7h+WNr05swJCfVkya1h5Hugg0P1gNbg5gC8v2PqqlUeura5BHxyH49gaX E5n6uTozBaoynp9P+vhVuQCIrwDNGrmcOYiQo/0y8jr1ATiWFVLJ9pzR+j73DO9kEL83+y+bWuN V2kEFg7wR76X58pRUmWH3qxJyRvqynMD76LB3DwghhqqrTY1QbCbIP9NYMqSVWy/YzJXyUIF00W XTPPck2aZiXyFGQBG26OMyNxSBPLjMwCR1/HfDGvhe0c0PEJYJxq/RAAf7qApQimCAst8brwBV8 3OoHLVfbzSdBIcUvL6gLfN2ji/Vp5Z5QT3T1dHwYJnFMZ0Uh8cxeR2KK4QhAMqxT4Wgjktx/zW9 h2/ X-Received: by 2002:a17:90b:5783:b0:359:c7ef:97bc with SMTP id 98e67ed59e1d1-35c0dd8076fmr1097254a91.22.1774397730194; Tue, 24 Mar 2026 17:15:30 -0700 (PDT) Received: from localhost.localdomain ([2409:8a28:820:e910:f579:1a1f:54c3:bfb1]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-c744560683bsm11380577a12.30.2026.03.24.17.15.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 24 Mar 2026 17:15:29 -0700 (PDT) From: =?UTF-8?q?=E5=82=85=E7=BB=A7=E6=99=97?= To: oscar.alfonso.diaz@gmail.com Cc: =?UTF-8?q?=E5=82=85=E7=BB=A7=E6=99=97?= , johannes@sipsolutions.net, linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH] wifi: mac80211: fix monitor mode frame capture for real chanctx drivers Date: Wed, 25 Mar 2026 08:15:13 +0800 Message-ID: <20260325001513.1303-1-fjhhz1997@gmail.com> X-Mailer: git-send-email 2.45.0.windows.1 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Hi Oscar, Thank you for testing the v1 patch and reporting the VM hang -- your report was critical in identifying the root cause. Lucid-Duck did extensive debugging and reproduction work on this. The full discussion is here: https://github.com/morrownr/USB-WiFi/issues/682#issuecomment-4120751621 Root cause of the crash: The v1 patch falls back to list_first_entry_or_null(&local->chanctx_list) when the monitor vif has no chanctx. In your Evil Twin + DoS scenario, the AP and monitor interfaces created multiple channel contexts. The fallback blindly grabbed whichever chanctx was first on the list -- which could be the AP's chanctx that the firmware wasn't expecting monitor traffic on. Injecting frames on a chanctx where mt7921_mcu_config_sniffer() was never called is the likely trigger for the hard hang. The v2 patch adds a list_is_singular() guard: injection only proceeds when there is exactly one chanctx (unambiguous), and is refused when multiple chanctxs exist. This covers the common single-channel AP + monitor case while preventing the dangerous multi-chanctx path that caused your crash. Lucid-Duck tested v2 extensively on kernel 6.19.8 with the MT7921AU (ALFA AWUS036AXML) -- single-channel AP + monitor + injection, multi-chanctx via P2P-GO, heavy load injection floods (50k fps, 1.8M packets) -- all stable with zero crashes or kernel warnings. The v2 diff against net/mac80211/tx.c: chanctx_conf = rcu_dereference(sdata->vif.bss_conf.chanctx_conf); - if (chanctx_conf) + if (chanctx_conf) { chandef = &chanctx_conf->def; - else if (local->emulate_chanctx) + } else if (local->emulate_chanctx) { chandef = &local->hw.conf.chandef; - else - goto fail_rcu; + } else { + struct ieee80211_chanctx *ctx; + + ctx = list_first_entry_or_null(&local->chanctx_list, + struct ieee80211_chanctx, + list); + if (ctx && list_is_singular(&local->chanctx_list)) + chandef = &ctx->conf.def; + else + goto fail_rcu; + } If you have time, could you re-test with this v2 patch in your original Evil Twin + DoS setup? That would help confirm the fix before I send v2 to the list. Thanks again for your help! Best regards, 傅继晗