From be5ce7910521492d4a2e4ce7ee3843680a46c047 Mon Sep 17 00:00:00 2001 From: Mark Anthony Agarro Date: Thu, 13 Aug 2026 08:20:59 -0700 Subject: [PATCH] wifi: mt76: mt7615: do not tear down BSS/STA state for monitor vifs Tearing down a monitor interface oopses: BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:mt76_connac_mcu_uni_add_bss+0x144/0x370 [mt76_connac_lib] Call Trace: mt7615_remove_interface+0x6a/0x200 [mt7615_common] drv_remove_interface+0x60/0x140 [mac80211] ieee80211_del_virtual_monitor+0x8f/0xc0 [mac80211] ieee80211_do_open+0x550/0x7d0 [mac80211] ieee80211_open+0xaa/0xb0 [mac80211] __dev_open+0x11b/0x280 mt7615_remove_interface() tears down BSS and STA state for every vif type. On MT7663 with offload firmware that reaches mt76_connac_mcu_uni_add_bss(), which has no monitor case in its iftype switch. It takes WARN_ON(1), then copies ETH_ALEN from vif->bss_conf.bssid, which is NULL for a monitor vif. mt76_connac_mcu_bss_basic_tlv() in the same file handles this. It has an NL80211_IFTYPE_MONITOR case and it copies phy->macaddr in place of the bssid. The uni variant has neither. There is nothing to tear down. mt7615_add_interface() only calls mt7615_mcu_add_dev_info(). The BSS and STA state comes from beacon enable in mt7615_bss_info_changed(), from mt7615_set_key() and from mt7615_mac_sta_add(), so a monitor vif never has any. Reported on mt7615e going from monitor back to managed, and on mt7663u on an "ip link set down", both through ieee80211_del_virtual_monitor(). Fixes: d9852ab2f362 ("mt76: mt7615: keep mcu_add_bss_info enabled till interface removal") Cc: stable@vger.kernel.org Reported-by: Orly Orge Closes: https://lore.kernel.org/linux-wireless/CANj5C4mTOHs6riyWee=dFdkE5p=714J8xs-x3hq3ewQ+r6O_Nw@mail.gmail.com/ Reported-by: Inanix Closes: https://github.com/morrownr/mt76/issues/79 Tested-by: Inanix Signed-off-by: Mark Anthony Agarro Signed-off-by: Devin Wittmayer Link: https://patch.msgid.link/20260813152059.15747-1-lucid_duck@justthetip.ca Signed-off-by: Felix Fietkau --- mt7615/main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/mt7615/main.c b/mt7615/main.c index 67f56e42..175e847f 100644 --- a/mt7615/main.c +++ b/mt7615/main.c @@ -254,8 +254,10 @@ static void mt7615_remove_interface(struct ieee80211_hw *hw, mt7615_mutex_acquire(dev); - mt7615_mcu_add_bss_info(phy, vif, NULL, false); - mt7615_mcu_sta_add(phy, vif, NULL, false); + if (vif->type != NL80211_IFTYPE_MONITOR) { + mt7615_mcu_add_bss_info(phy, vif, NULL, false); + mt7615_mcu_sta_add(phy, vif, NULL, false); + } mt76_testmode_reset(phy->mt76, true); if (vif == phy->monitor_vif)