[v5.15] WARNING in sta_info_insert_rcu

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 09996673e313 Linux 5.15.123
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16158b26a80000
kernel config: https://syzkaller.appspot.com/x/.config?x=b234d12d7c90a2e8
dashboard link: https://syzkaller.appspot.com/bug?extid=af22409d8084f9c4bac2
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10910161a80000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1532b96ea80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/20ccf0af5ae0/disk-09996673.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3f784a67f3fb/vmlinux-09996673.xz
kernel image: https://storage.googleapis.com/syzbot-assets/27ac27fd1514/Image-09996673.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+af2240...@syzkaller.appspotmail.com

wlan1: authenticate with 08:02:11:00:00:01
------------[ cut here ]------------
WARNING: CPU: 1 PID: 3549 at net/mac80211/sta_info.c:546 sta_info_insert_rcu+0x1b0/0x1f30 net/mac80211/sta_info.c:723
Modules linked in:
CPU: 1 PID: 3549 Comm: kworker/1:3 Not tainted 5.15.123-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2023
Workqueue: events cfg80211_conn_work
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : sta_info_insert_rcu+0x1b0/0x1f30 net/mac80211/sta_info.c:723
lr : sta_info_insert_check net/mac80211/sta_info.c:545 [inline]
lr : sta_info_insert_rcu+0x1ac/0x1f30 net/mac80211/sta_info.c:723
sp : ffff80001f287180
x29: ffff80001f287240 x28: ffff0000d09ccc80 x27: 1fffe000192b0009
x26: 0000000000000000 x25: 0000000000110308 x24: 00000000ffffffea
x23: ffff0000c8ac9768 x22: ffff0000c9580048 x21: 0000000000000100
x20: 0000000000110208 x19: ffff0000c9580000 x18: ffff80001f286c80
x17: ff8080001129e900 x16: ffff8000084c3630 x15: 000000000000d46e
x14: 00000000ffffffff x13: ffffffffffffffff x12: 0000000000000000
x11: ff808000112b7874 x10: 0000000000000000 x9 : ffff8000112b7874
x8 : ffff0000d399d1c0 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000020 x4 : 0000000000000000 x3 : ffff8000082e0518
x2 : ffff0000d399d1c0 x1 : 0000000000110308 x0 : 0000000000000000
Call trace:
sta_info_insert_rcu+0x1b0/0x1f30 net/mac80211/sta_info.c:723
sta_info_insert+0x20/0xcc net/mac80211/sta_info.c:736
ieee80211_prep_connection+0x277c/0x30d4 net/mac80211/mlme.c:5380
ieee80211_mgd_auth+0x7f0/0xbc8 net/mac80211/mlme.c:5525
ieee80211_auth+0x28/0x38 net/mac80211/cfg.c:2547
rdev_auth net/wireless/rdev-ops.h:458 [inline]
cfg80211_mlme_auth+0x428/0x9fc net/wireless/mlme.c:273
cfg80211_conn_do_work+0x31c/0x9f4 net/wireless/sme.c:170
cfg80211_conn_work+0x238/0x410 net/wireless/sme.c:256
process_one_work+0x790/0x11b8 kernel/workqueue.c:2310
worker_thread+0x910/0x1034 kernel/workqueue.c:2457
kthread+0x37c/0x45c kernel/kthread.c:319
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870
irq event stamp: 29002
hardirqs last enabled at (29001): [<ffff800011a31b70>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
hardirqs last enabled at (29001): [<ffff800011a31b70>] _raw_spin_unlock_irqrestore+0xac/0x158 kernel/locking/spinlock.c:194
hardirqs last disabled at (29002): [<ffff800011958ed0>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:387
softirqs last enabled at (28968): [<ffff80001114b200>] spin_unlock_bh include/linux/spinlock.h:408 [inline]
softirqs last enabled at (28968): [<ffff80001114b200>] cfg80211_get_bss+0x840/0xd10 net/wireless/scan.c:1508
softirqs last disabled at (28966): [<ffff80001114aae4>] spin_lock_bh include/linux/spinlock.h:368 [inline]
softirqs last disabled at (28966): [<ffff80001114aae4>] cfg80211_get_bss+0x124/0xd10 net/wireless/scan.c:1482
---[ end trace 91c12091264d0c9e ]---
wlan1: failed to insert STA entry for the AP (error -22)


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup