[v6.1] WARNING: suspicious RCU usage in sta_remove_link

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: f1bb70486c9c Linux 6.1.77
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1334f648180000
kernel config: https://syzkaller.appspot.com/x/.config?x=f184113a4001bfd2
dashboard link: https://syzkaller.appspot.com/bug?extid=032c719ad778939ed041
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d8aab4ddaaf8/disk-f1bb7048.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/af884bbced3d/vmlinux-f1bb7048.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4516cd7b87c3/Image-f1bb7048.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+032c71...@syzkaller.appspotmail.com

wlan1: authenticate with 08:02:11:00:00:00
wlan1: No legacy rates in association response
=============================
WARNING: suspicious RCU usage
6.1.77-syzkaller #0 Not tainted
-----------------------------
net/mac80211/sta_info.c:361 suspicious rcu_dereference_protected() usage!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
4 locks held by kworker/0:2/1510:
#0: ffff0000c0020d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x664/0x1404 kernel/workqueue.c:2265
#1: ffff800022437c20 ((work_completion)(&rdev->conn_work)){+.+.}-{0:0}, at: process_one_work+0x6a8/0x1404 kernel/workqueue.c:2267
#2: ffff0000d27087c8 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: wiphy_lock include/net/cfg80211.h:5639 [inline]
#2: ffff0000d27087c8 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: cfg80211_conn_work+0xc4/0x428 net/wireless/sme.c:252
#3: ffff00012083cd40 (&wdev->mtx){+.+.}-{3:3}, at: wdev_lock net/wireless/core.h:231 [inline]
#3: ffff00012083cd40 (&wdev->mtx){+.+.}-{3:3}, at: cfg80211_conn_work+0x138/0x428 net/wireless/sme.c:258

stack backtrace:
CPU: 0 PID: 1510 Comm: kworker/0:2 Not tainted 6.1.77-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Workqueue: events cfg80211_conn_work
Call trace:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
lockdep_rcu_suspicious+0x260/0x464 kernel/locking/lockdep.c:6592
sta_remove_link+0x38c/0x474 net/mac80211/sta_info.c:360
sta_info_free+0x68/0x2ec net/mac80211/sta_info.c:405
ieee80211_prep_connection+0xbdc/0xf34
ieee80211_mgd_auth+0x8d0/0xd9c net/mac80211/mlme.c:6755
ieee80211_auth+0x28/0x38 net/mac80211/cfg.c:2789
rdev_auth net/wireless/rdev-ops.h:469 [inline]
cfg80211_mlme_auth+0x4a4/0x980 net/wireless/mlme.c:285
cfg80211_conn_do_work+0x3b8/0xb84 net/wireless/sme.c:181
cfg80211_conn_work+0x248/0x428 net/wireless/sme.c:273
process_one_work+0x7ac/0x1404 kernel/workqueue.c:2292
worker_thread+0x8e4/0xfec kernel/workqueue.c:2439
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864
usb 1-1: new high-speed USB device number 41 using dummy_hcd
usb 1-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config
usb 1-1: config 27 has 0 interfaces, different from the descriptor's value: 1
usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d
usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
usb 1-1: new high-speed USB device number 42 using dummy_hcd
usb 1-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config
usb 1-1: config 27 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping
usb 1-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d
usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
snd-usb-audio: probe of 1-1:27.0 failed with error -2
usb 1-1: USB disconnect, device number 42
usb 1-1: USB disconnect, device number 43
wlan1: authenticate with 08:02:11:00:00:00
wlan1: send auth to 08:02:11:00:00:00 (try 1/3)


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: f1bb70486c9c Linux 6.1.77
git tree: linux-6.1.y

console output: https://syzkaller.appspot.com/x/log.txt?x=144c86ec180000

kernel config: https://syzkaller.appspot.com/x/.config?x=f184113a4001bfd2
dashboard link: https://syzkaller.appspot.com/bug?extid=032c719ad778939ed041
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16efae42180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1191eee0180000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d8aab4ddaaf8/disk-f1bb7048.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/af884bbced3d/vmlinux-f1bb7048.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4516cd7b87c3/Image-f1bb7048.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+032c71...@syzkaller.appspotmail.com

wlan1: authenticate with 08:02:11:00:00:00
wlan1: No legacy rates in association response
=============================
WARNING: suspicious RCU usage
6.1.77-syzkaller #0 Not tainted
-----------------------------
net/mac80211/sta_info.c:361 suspicious rcu_dereference_protected() usage!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1

3 locks held by syz-executor101/6754:
#0: ffff800017e77fb0 (cb_lock){++++}-{3:3}, at: genl_rcv+0x28/0x50 net/netlink/genetlink.c:860
#1: ffff0000cd4c07c8 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: wiphy_lock include/net/cfg80211.h:5639 [inline]
#1: ffff0000cd4c07c8 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: nl80211_pre_doit+0x484/0x764 net/wireless/nl80211.c:16259
#2: ffff0000d21a4d40 (&wdev->mtx){+.+.}-{3:3}, at: wdev_lock net/wireless/core.h:231 [inline]
#2: ffff0000d21a4d40 (&wdev->mtx){+.+.}-{3:3}, at: nl80211_connect+0x12b4/0x1958 net/wireless/nl80211.c:11799

stack backtrace:
CPU: 1 PID: 6754 Comm: syz-executor101 Not tainted 6.1.77-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023

Call trace:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
dump_stack+0x1c/0x58 lib/dump_stack.c:113
lockdep_rcu_suspicious+0x260/0x464 kernel/locking/lockdep.c:6592
sta_remove_link+0x38c/0x474 net/mac80211/sta_info.c:360
sta_info_free+0x68/0x2ec net/mac80211/sta_info.c:405
ieee80211_prep_connection+0xbdc/0xf34
ieee80211_mgd_auth+0x8d0/0xd9c net/mac80211/mlme.c:6755
ieee80211_auth+0x28/0x38 net/mac80211/cfg.c:2789
rdev_auth net/wireless/rdev-ops.h:469 [inline]
cfg80211_mlme_auth+0x4a4/0x980 net/wireless/mlme.c:285
cfg80211_conn_do_work+0x3b8/0xb84 net/wireless/sme.c:181

cfg80211_sme_connect net/wireless/sme.c:623 [inline]
cfg80211_connect+0x11bc/0x1aa8 net/wireless/sme.c:1499
nl80211_connect+0x12dc/0x1958 net/wireless/nl80211.c:11801
genl_family_rcv_msg_doit net/netlink/genetlink.c:756 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:833 [inline]
genl_rcv_msg+0x948/0xc2c net/netlink/genetlink.c:850
netlink_rcv_skb+0x20c/0x3b8 net/netlink/af_netlink.c:2508
genl_rcv+0x38/0x50 net/netlink/genetlink.c:861
netlink_unicast_kernel net/netlink/af_netlink.c:1326 [inline]
netlink_unicast+0x65c/0x898 net/netlink/af_netlink.c:1352
netlink_sendmsg+0x834/0xb18 net/netlink/af_netlink.c:1874
sock_sendmsg_nosec net/socket.c:718 [inline]
__sock_sendmsg net/socket.c:730 [inline]
____sys_sendmsg+0x55c/0x848 net/socket.c:2514
___sys_sendmsg net/socket.c:2568 [inline]
__sys_sendmsg+0x26c/0x33c net/socket.c:2597
__do_sys_sendmsg net/socket.c:2606 [inline]
__se_sys_sendmsg net/socket.c:2604 [inline]
__arm64_sys_sendmsg+0x80/0x94 net/socket.c:2604
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.