[v6.1] WARNING: lock held when returning to user space in cfg80211_wext_siwgenie

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: a500ba24937a Linux 6.1.189
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=142d5725580000
kernel config: https://syzkaller.appspot.com/x/.config?x=31dfefc4a14efea3
dashboard link: https://syzkaller.appspot.com/bug?extid=516663279b40dfd4a718
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/17c01f7b2570/disk-a500ba24.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/cdc2bcc08d57/vmlinux-a500ba24.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a5169f9f5b84/bzImage-a500ba24.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+516663...@syzkaller.appspotmail.com

================================================
WARNING: lock held when returning to user space!
syzkaller #0 Not tainted
------------------------------------------------
syz.0.7538/20716 is leaving the kernel with locks still held!
1 lock held by syz.0.7538/20716:
#0: ffff8880270a8d40 (&wdev->mtx){+.+.}-{3:3}, at: wdev_lock net/wireless/core.h:231 [inline]
#0: ffff8880270a8d40 (&wdev->mtx){+.+.}-{3:3}, at: cfg80211_wext_siwgenie+0xd4/0x3f0 net/wireless/wext-sme.c:340


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: a051a4bf909f Linux 5.15.222
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=172f3b15580000
kernel config: https://syzkaller.appspot.com/x/.config?x=21845b39f8fc6be8
dashboard link: https://syzkaller.appspot.com/bug?extid=b822dedaa07eee372599

compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:

disk image: https://storage.googleapis.com/syzbot-assets/17dbe20864e0/disk-a051a4bf.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9d4dd272dd21/vmlinux-a051a4bf.xz
kernel image: https://storage.googleapis.com/syzbot-assets/cb07d17a095e/bzImage-a051a4bf.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+b822de...@syzkaller.appspotmail.com

================================================
WARNING: lock held when returning to user space!
syzkaller #0 Not tainted
------------------------------------------------

syz.2.3095/13100 is leaving the kernel with locks still held!
1 lock held by syz.2.3095/13100:
#0: ffff8880233e8d40 (&wdev->mtx){+.+.}-{3:3}, at: wdev_lock net/wireless/core.h:226 [inline]
#0: ffff8880233e8d40 (&wdev->mtx){+.+.}-{3:3}, at: cfg80211_wext_siwgenie+0xd4/0x3f0 net/wireless/wext-sme.c:327

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: a91a6aa9253c Linux 6.6.158
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=11265bf5580000
kernel config: https://syzkaller.appspot.com/x/.config?x=7be9809cedd6b69c
dashboard link: https://syzkaller.appspot.com/bug?extid=4a8a0cae8222a7a96a15

compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:

disk image: https://storage.googleapis.com/syzbot-assets/6f079ef666e3/disk-a91a6aa9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/70dcdc8f8689/vmlinux-a91a6aa9.xz
kernel image: https://storage.googleapis.com/syzbot-assets/590b05004bff/bzImage-a91a6aa9.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+4a8a0c...@syzkaller.appspotmail.com

netlink: 272 bytes leftover after parsing attributes in process `syz.7.7398'.

================================================
WARNING: lock held when returning to user space!
syzkaller #0 Not tainted
------------------------------------------------

syz.7.7398/1682 is leaving the kernel with locks still held!
2 locks held by syz.7.7398/1682:
#0: ffff888024290768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: wiphy_lock include/net/cfg80211.h:5777 [inline]
#0: ffff888024290768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: cfg80211_wext_siwgenie+0xd5/0x3f0 net/wireless/wext-sme.c:341
#1: ffff8880242f8dc0 (&wdev->mtx){+.+.}-{3:3}, at: wdev_lock net/wireless/core.h:231 [inline]
#1: ffff8880242f8dc0 (&wdev->mtx){+.+.}-{3:3}, at: cfg80211_wext_siwgenie+0xe0/0x3f0 net/wireless/wext-sme.c:342

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: a051a4bf909f Linux 5.15.222
git tree: linux-5.15.y

console output: https://syzkaller.appspot.com/x/log.txt?x=16ff87f5580000

kernel config: https://syzkaller.appspot.com/x/.config?x=21845b39f8fc6be8
dashboard link: https://syzkaller.appspot.com/bug?extid=b822dedaa07eee372599
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10fe6ec9580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14fe6ec9580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/17dbe20864e0/disk-a051a4bf.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9d4dd272dd21/vmlinux-a051a4bf.xz
kernel image: https://storage.googleapis.com/syzbot-assets/cb07d17a095e/bzImage-a051a4bf.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b822de...@syzkaller.appspotmail.com

================================================
WARNING: lock held when returning to user space!
syzkaller #0 Not tainted
------------------------------------------------

syz.0.17/4334 is leaving the kernel with locks still held!
1 lock held by syz.0.17/4334:
#0: ffff888022860d40 (&wdev->mtx){+.+.}-{3:3}, at: wdev_lock net/wireless/core.h:226 [inline]
#0: ffff888022860d40 (&wdev->mtx){+.+.}-{3:3}, at: cfg80211_wext_siwgenie+0xd4/0x3f0 net/wireless/wext-sme.c:327


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: a500ba24937a Linux 6.1.189
git tree: linux-6.1.y

console output: https://syzkaller.appspot.com/x/log.txt?x=12f8b725580000

kernel config: https://syzkaller.appspot.com/x/.config?x=31dfefc4a14efea3
dashboard link: https://syzkaller.appspot.com/bug?extid=516663279b40dfd4a718
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=122397f5580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=114947f5580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/17c01f7b2570/disk-a500ba24.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/cdc2bcc08d57/vmlinux-a500ba24.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a5169f9f5b84/bzImage-a500ba24.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+516663...@syzkaller.appspotmail.com

================================================
WARNING: lock held when returning to user space!
syzkaller #0 Not tainted
------------------------------------------------

syz.0.17/4425 is leaving the kernel with locks still held!
1 lock held by syz.0.17/4425:
#0: ffff888027680d40 (&wdev->mtx){+.+.}-{3:3}, at: wdev_lock net/wireless/core.h:231 [inline]
#0: ffff888027680d40 (&wdev->mtx){+.+.}-{3:3}, at: cfg80211_wext_siwgenie+0xd4/0x3f0 net/wireless/wext-sme.c:340


---

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: a91a6aa9253c Linux 6.6.158
git tree: linux-6.6.y

console output: https://syzkaller.appspot.com/x/log.txt?x=17e68835580000

kernel config: https://syzkaller.appspot.com/x/.config?x=7be9809cedd6b69c
dashboard link: https://syzkaller.appspot.com/bug?extid=4a8a0cae8222a7a96a15
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=134ce7f5580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=174ce7f5580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/6f079ef666e3/disk-a91a6aa9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/70dcdc8f8689/vmlinux-a91a6aa9.xz
kernel image: https://storage.googleapis.com/syzbot-assets/590b05004bff/bzImage-a91a6aa9.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4a8a0c...@syzkaller.appspotmail.com

warning: `syz.0.17' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211

================================================
WARNING: lock held when returning to user space!
syzkaller #0 Not tainted
------------------------------------------------

syz.0.17/5935 is leaving the kernel with locks still held!
2 locks held by syz.0.17/5935:
#0: ffff888024130768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: wiphy_lock include/net/cfg80211.h:5777 [inline]
#0: ffff888024130768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: cfg80211_wext_siwgenie+0xd5/0x3f0 net/wireless/wext-sme.c:341
#1: ffff888023ab0dc0 (&wdev->mtx){+.+.}-{3:3}, at: wdev_lock net/wireless/core.h:231 [inline]
#1: ffff888023ab0dc0 (&wdev->mtx){+.+.}-{3:3}, at: cfg80211_wext_siwgenie+0xe0/0x3f0 net/wireless/wext-sme.c:342


---