[PATCH wireless v2] wifi: mac80211: refuse to make a monitor active when it has no queue

A monitor interface only gets a TXQ if it's created active, and one can't
be added later. Setting the flag on a down interface is still allowed, so
the driver is handed a monitor with no queue. ath9k dereferences it:

  BUG: kernel NULL pointer dereference, address: 0000000000000066
  RIP: 0010:ath_tx_node_init+0x49/0x170 [ath9k]
   ath9k_add_interface+0x10c/0x140 [ath9k]
   drv_add_interface+0x54/0x250 [mac80211]
   ieee80211_do_open+0x32f/0x800 [mac80211]

Reached with CAP_NET_ADMIN by "iw dev X set monitor active" followed by
"ip link set X up". RTNL is held, so netlink operations block behind it.

Refuse the flag when there is no queue to give.

Fixes: 79af1f866193 ("mac80211: avoid allocating TXQs that won't be used")
Cc: stable@vger.kernel.org
Signed-off-by: Devin Wittmayer <redacted>
---
Only drivers that advertise active monitor can reach this, since cfg80211
refuses the flag otherwise.

  crashes   ath9k, mt7603
  checks    mt7615, mt7915, mt7921, mt7925, mt7996

On the ones that check, the promotion works. A monitor promoted while down
captures the same as one created active:

  promoted        89, 89, 89 beacons in ten seconds
  created active  88, 89, 88
  passive         176

So this refuses something that currently functions on five drivers.
Reserving a queue for every monitor instead would keep it, at the cost of
undoing the commit named above.

Tested on a 7921 USB part: the promotion is refused, and both creating a
monitor active and toggling one that already has a queue still work.

v2: changelog and comment rewritten by hand. Dropped mt76x02 from the list
    above, it does not use the interface queue at all.

v1: https://lore.kernel.org/linux-wireless/20260824003656.27049-1-lucid_duck@justthetip.ca/ (local)

 net/mac80211/cfg.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 23f4f9ec86d0..8b47468dd5c0 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c

@@ -115,6 +115,10 @@ static int ieee80211_set_mon_options(struct ieee80211_sub_if_data *sdata,
 			return -EBUSY;
 	}
 
+	/* TXQs are reserved in ieee80211_if_add() and cannot be added later */
+	if ((params->flags & MONITOR_FLAG_ACTIVE) && !sdata->vif.txq)
+		return -EOPNOTSUPP;
+
 	/* validate whether MU-MIMO can be configured */
 	if (!ieee80211_hw_check(&local->hw, WANT_MONITOR_VIF) &&
 	    !ieee80211_hw_check(&local->hw, NO_VIRTUAL_MONITOR) &&

-- 
2.55.0