[PATCH wireless] wifi: mac80211: abort chanswitch when leaving an IBSS

[PATCH wireless] wifi: mac80211: abort chanswitch when leaving an IBSS

[Mehmet Fide]

From: Mehmet Fide <mehmet.fide@screeningeagle.com>

ieee80211_ibss_disconnect() leaves CSA active, as ieee80211_stop_mesh()
did until commit ac7472a24bd4 ("wifi: mac80211: abort chanswitch when
leaving a mesh"). An IBSS left during its countdown and joined again
refuses every new channel switch with -EBUSY.

Abort the channel switch the same way.

Fixes: cd7760e62c2a ("mac80211: add support for CSA in IBSS mode")
Reported-by: Luka Gejak <luka.gejak@linux.dev>
Closes: https://lore.kernel.org/linux-wireless/796598480d47c5bf474d11828769e864b8209558@linux.dev/
Signed-off-by: Mehmet Fide <mehmet.fide@screeningeagle.com>
---

Notes:
    Tested with mac80211_hwsim and on an RTL8822CU.

 net/mac80211/ibss.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index d74b66426349..b9ab4ceb0332 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -669,6 +669,10 @@ static void ieee80211_ibss_disconnect(struct ieee80211_sub_if_data *sdata)
 	ifibss->state = IEEE80211_IBSS_MLME_SEARCH;
 
 	netif_carrier_off(sdata->dev);
+
+	sdata->vif.bss_conf.csa_active = false;
+	ieee80211_vif_unblock_queues_csa(sdata);
+
 	if (!sta_info_flush(sdata, -1))
 		synchronize_net();
 

base-commit: 9d8ec0b5b5295bd23d979d1b2b905de25c36fff2
-- 
2.55.0

Re: [PATCH wireless] wifi: mac80211: abort chanswitch when leaving an IBSS

[Luka Gejak]

Hi Mehmet,

Thanks for picking this up. One comment below.

October 25, 2026 at 8:36 PM, "Mehmet Fide" <mehmet.fide@gmail.com> wrote:

> diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
> index d74b66426349..b9ab4ceb0332 100644
> --- a/net/mac80211/ibss.c
> +++ b/net/mac80211/ibss.c
> @@ -669,6 +669,10 @@ static void ieee80211_ibss_disconnect(struct ieee80211_sub_if_data *sdata)
>       ifibss->state = IEEE80211_IBSS_MLME_SEARCH;
>
>       netif_carrier_off(sdata->dev);
> +
> +     sdata->vif.bss_conf.csa_active = false;
> +     ieee80211_vif_unblock_queues_csa(sdata);
> +

As far as I can see, the driver never finds out that the switch was
dropped here. ath9k_htc only clears priv->csa_vif once the countdown
completes with csa_active still set, or when the interface goes away.

So if I read it right, after leaving mid countdown and joining again, the
next switch with a countdown now gets past mac80211 and runs into this in
ath9k_htc_channel_switch_beacon():

        if (WARN_ON(priv->csa_vif))
                return;

Before this patch mac80211 stopped it earlier, so this couldn't happen in
IBSS. AP mode seems to have the same problem already after
ieee80211_stop_ap(), so I think it is better fixed in ath9k_htc, maybe by
dropping csa_vif when beaconing stops.

Since you have worked on ath9k already, would you be willing to send a
fix for that too?

Best regards,
Luka Gejak