[PATCH wireless] wifi: mac80211: abort chanswitch when leaving an IBSS

[PATCH wireless] wifi: mac80211: abort chanswitch when leaving an IBSS

[Mehmet Fide]

From: Mehmet Fide <mehmet.fide@screeningeagle.com>

ieee80211_ibss_disconnect() leaves CSA active, as ieee80211_stop_mesh()
did until commit ac7472a24bd4 ("wifi: mac80211: abort chanswitch when
leaving a mesh"). An IBSS left during its countdown and joined again
refuses every new channel switch with -EBUSY.

Abort the channel switch the same way.

Fixes: cd7760e62c2a ("mac80211: add support for CSA in IBSS mode")
Reported-by: Luka Gejak <luka.gejak@linux.dev>
Closes: https://lore.kernel.org/linux-wireless/796598480d47c5bf474d11828769e864b8209558@linux.dev/
Signed-off-by: Mehmet Fide <mehmet.fide@screeningeagle.com>
---

Notes:
    Tested with mac80211_hwsim and on an RTL8822CU.

 net/mac80211/ibss.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index d74b66426349..b9ab4ceb0332 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -669,6 +669,10 @@ static void ieee80211_ibss_disconnect(struct ieee80211_sub_if_data *sdata)
 	ifibss->state = IEEE80211_IBSS_MLME_SEARCH;
 
 	netif_carrier_off(sdata->dev);
+
+	sdata->vif.bss_conf.csa_active = false;
+	ieee80211_vif_unblock_queues_csa(sdata);
+
 	if (!sta_info_flush(sdata, -1))
 		synchronize_net();
 

base-commit: 9d8ec0b5b5295bd23d979d1b2b905de25c36fff2
-- 
2.55.0

Re: [PATCH wireless] wifi: mac80211: abort chanswitch when leaving an IBSS

[Luka Gejak]

Hi Mehmet,

Thanks for picking this up. One comment below.

October 25, 2026 at 8:36 PM, "Mehmet Fide" <mehmet.fide@gmail.com> wrote:

> diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
> index d74b66426349..b9ab4ceb0332 100644
> --- a/net/mac80211/ibss.c
> +++ b/net/mac80211/ibss.c
> @@ -669,6 +669,10 @@ static void ieee80211_ibss_disconnect(struct ieee80211_sub_if_data *sdata)
>       ifibss->state = IEEE80211_IBSS_MLME_SEARCH;
>
>       netif_carrier_off(sdata->dev);
> +
> +     sdata->vif.bss_conf.csa_active = false;
> +     ieee80211_vif_unblock_queues_csa(sdata);
> +

As far as I can see, the driver never finds out that the switch was
dropped here. ath9k_htc only clears priv->csa_vif once the countdown
completes with csa_active still set, or when the interface goes away.

So if I read it right, after leaving mid countdown and joining again, the
next switch with a countdown now gets past mac80211 and runs into this in
ath9k_htc_channel_switch_beacon():

        if (WARN_ON(priv->csa_vif))
                return;

Before this patch mac80211 stopped it earlier, so this couldn't happen in
IBSS. AP mode seems to have the same problem already after
ieee80211_stop_ap(), so I think it is better fixed in ath9k_htc, maybe by
dropping csa_vif when beaconing stops.

Since you have worked on ath9k already, would you be willing to send a
fix for that too?

Best regards,
Luka Gejak

Re: [PATCH wireless] wifi: mac80211: abort chanswitch when leaving an IBSS

[Mehmet Fide]

Hi Luka,

> So if I read it right, after leaving mid countdown and joining again, the
> next switch with a countdown now gets past mac80211 and runs into this in
> ath9k_htc_channel_switch_beacon():

You read it right, I reproduced it on an AR9271 with this patch. A mesh
point hits the same WARN already without it, since ieee80211_stop_mesh()
aborts the switch the same way.

Dropping csa_vif whenever beaconing stops is too much though: off
channel, e.g. a scan during the countdown, beaconing stops with the
switch still active, and the switch then never completes. So the fix
drops it only when the switch is no longer active, sent as "wifi:
ath9k_htc: clear csa_vif when a switch is aborted". This patch should
go in with or after that one.

Mehmet

Re: [PATCH wireless] wifi: mac80211: abort chanswitch when leaving an IBSS

[Luka Gejak]

October 26, 2026 at 4:25 PM, "Mehmet Fide" <mehmet.fide@gmail.com> wrote:


> 
> Hi Luka,
> 
> > 
> > So if I read it right, after leaving mid countdown and joining again, the
> >  next switch with a countdown now gets past mac80211 and runs into this in
> >  ath9k_htc_channel_switch_beacon():
> > 
> You read it right, I reproduced it on an AR9271 with this patch. A mesh
> point hits the same WARN already without it, since ieee80211_stop_mesh()
> aborts the switch the same way.
> 
> Dropping csa_vif whenever beaconing stops is too much though: off
> channel, e.g. a scan during the countdown, beaconing stops with the
> switch still active, and the switch then never completes. So the fix
> drops it only when the switch is no longer active, sent as "wifi:
> ath9k_htc: clear csa_vif when a switch is aborted". This patch should
> go in with or after that one.
> 
> Mehmet
>

Thanks for sending the patch, for this one:

Reviewed-by: Luka Gejak <luka.gejak@linux.dev>

Best regards,
Luka Gejak