[v6.6] WARNING in ieee80211_mgd_probe_ap_send

[Hanne-Lotta Mäenpää]

#syz test:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
2cf6f68313dcc3c404f49fdee41bbf3c694ad75d

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in ieee80211_mgd_probe_ap_send

------------[ cut here ]------------
WARNING: CPU: 0 PID: 139 at net/mac80211/mlme.c:3206 ieee80211_mgd_probe_ap_send+0x445/0x510 net/mac80211/mlme.c:3206
Modules linked in:
CPU: 0 PID: 139 Comm: kworker/u4:6 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: events_unbound cfg80211_wiphy_work
RIP: 0010:ieee80211_mgd_probe_ap_send+0x445/0x510 net/mac80211/mlme.c:3206
Code: 0d 00 00 48 89 df 4c 89 f6 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f 5d e9 99 40 a6 f7 e8 e4 c0 b6 f7 0f 0b eb bc e8 db c0 b6 f7 <0f> 0b 41 80 7c 2d 00 00 0f 85 ec fc ff ff e9 ef fc ff ff e8 c3 c0
RSP: 0018:ffffc90002d1fad8 EFLAGS: 00010293
RAX: ffffffff89cdb995 RBX: ffff88802766cc00 RCX: ffff8880195a0000
RDX: 0000000000000000 RSI: ffffffff8a8aa2a0 RDI: ffffffff8ada28c0
RBP: dffffc0000000000 R08: ffffffff8e19c9af R09: 1ffffffff1c33935
R10: dffffc0000000000 R11: fffffbfff1c33936 R12: ffff88802766d518
R13: 1ffff11004ecdaa3 R14: ffff88802766e882 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000000 CR3: 00000000743b4000 CR4: 00000000003506f0
Call Trace:
<TASK>
ieee80211_mgd_probe_ap+0x325/0x3f0 net/mac80211/mlme.c:3290
cfg80211_wiphy_work+0x225/0x260 net/wireless/core.c:437
process_one_work kernel/workqueue.c:2634 [inline]
process_scheduled_works+0x9e0/0x1530 kernel/workqueue.c:2711
worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>


Tested on:

commit: 2cf6f683 Linux 6.6.122
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=17eb3c5a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=17f62c7bb0772e2a
dashboard link: https://syzkaller.appspot.com/bug?extid=c819c1d6f08fd167aa7e
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

Note: no patches were applied.

[Hanne-Lotta Mäenpää]

#syz test:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
2cf6f68313dcc3c404f49fdee41bbf3c694ad75d

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+c819c1...@syzkaller.appspotmail.com
Tested-by: syzbot+c819c1...@syzkaller.appspotmail.com

Tested on:

commit: 2cf6f683 Linux 6.6.122
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=169f3bfa580000

kernel config: https://syzkaller.appspot.com/x/.config?x=17f62c7bb0772e2a
dashboard link: https://syzkaller.appspot.com/bug?extid=c819c1d6f08fd167aa7e
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=17095322580000

Note: testing is done by a robot and is best-effort only.

[Hanne-Lotta Mäenpää]

#syz test:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
cd9b81672742d239a3f05fe545bf4212b56d0ac9

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in ieee80211_mgd_probe_ap_send

------------[ cut here ]------------

WARNING: CPU: 0 PID: 4858 at net/mac80211/mlme.c:3218 ieee80211_mgd_probe_ap_send+0x445/0x510 net/mac80211/mlme.c:3218
Modules linked in:
CPU: 0 PID: 4858 Comm: kworker/u4:5 Not tainted syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025

Workqueue: phy4 ieee80211_beacon_connection_loss_work
RIP: 0010:ieee80211_mgd_probe_ap_send+0x445/0x510 net/mac80211/mlme.c:3218
Code: 0d 00 00 48 89 df 4c 89 f6 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f 5d e9 69 46 e8 f7 e8 b4 a3 f8 f7 0f 0b eb bc e8 ab a3 f8 f7 <0f> 0b 41 80 7c 2d 00 00 0f 85 ec fc ff ff e9 ef fc ff ff e8 93 a3
RSP: 0018:ffffc9000585fba8 EFLAGS: 00010293
RAX: ffffffff8987ac85 RBX: ffff88807db3cc00 RCX: ffff888023953b80
RDX: 0000000000000000 RSI: ffffffff8a6bf2a0 RDI: ffffffff8abce3a0
RBP: dffffc0000000000 R08: ffffffff8df14d2f R09: 1ffffffff1be29a5
R10: dffffc0000000000 R11: fffffbfff1be29a6 R12: ffff88807db3d528
R13: 1ffff1100fb67aa5 R14: ffff88807db3e762 R15: dffffc0000000000

FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 000055556f928348 CR3: 000000000c68e000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
ieee80211_mgd_probe_ap+0x325/0x3f0 net/mac80211/mlme.c:3302
process_one_work+0x897/0x1160 kernel/workqueue.c:2292
worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>


Tested on:

commit: cd9b8167 Linux 6.1.161
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=11255322580000
kernel config: https://syzkaller.appspot.com/x/.config?x=21f27a09b2a9ac21

dashboard link: https://syzkaller.appspot.com/bug?extid=c819c1d6f08fd167aa7e
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

[Hanne-Lotta Mäenpää]

#syz test:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
cd9b81672742d239a3f05fe545bf4212b56d0ac9

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+c819c1...@syzkaller.appspotmail.com
Tested-by: syzbot+c819c1...@syzkaller.appspotmail.com

Tested on:

commit: cd9b8167 Linux 6.1.161
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=1509053a580000

kernel config: https://syzkaller.appspot.com/x/.config?x=21f27a09b2a9ac21
dashboard link: https://syzkaller.appspot.com/bug?extid=c819c1d6f08fd167aa7e
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=13373c5a580000

[Hanne-Lotta Mäenpää]

#syz test:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
9eec9a14ee10820a0c00dd3e02ac1e0ab27ad142

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in ieee80211_mgd_probe_ap_send

------------[ cut here ]------------

WARNING: CPU: 1 PID: 2606 at net/mac80211/mlme.c:2557 ieee80211_mgd_probe_ap_send+0x5aa/0x670 net/mac80211/mlme.c:2557
Modules linked in:
CPU: 1 PID: 2606 Comm: kworker/u4:4 Not tainted syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: phy4 ieee80211_beacon_connection_loss_work

RIP: 0010:ieee80211_mgd_probe_ap_send+0x5aa/0x670 net/mac80211/mlme.c:2557
Code: 3c 82 44 f8 48 8b 3c 24 48 81 c7 b8 0d 00 00 4c 89 f6 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 8b a0 33 f8 e8 16 82 44 f8 <0f> 0b e9 74 fb ff ff e8 0a 82 44 f8 0f 0b e9 42 ff ff ff e8 fe 81
RSP: 0018:ffffc9000a98fba0 EFLAGS: 00010293
RAX: ffffffff89349c4a RBX: ffff88807d5dcc80 RCX: ffff888022f41dc0
RDX: 0000000000000000 RSI: ffffffff8a0b2ea0 RDI: ffffffff8a592000
RBP: 1ffff1100fabba51 R08: ffffffff8d62f22f R09: 1ffffffff1ac5e45
R10: dffffc0000000000 R11: fffffbfff1ac5e46 R12: ffff888078fc88b8
R13: ffff88807d5dd288 R14: 0000000000000002 R15: ffff88807d5ddca8
FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007fff4b1cebc8 CR3: 0000000022d44000 CR4: 00000000003506e0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>

ieee80211_mgd_probe_ap+0x2c1/0x330 net/mac80211/mlme.c:2640
process_one_work+0x85f/0x1010 kernel/workqueue.c:2310
worker_thread+0xaa6/0x1290 kernel/workqueue.c:2457
kthread+0x436/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>


Tested on:

commit: 9eec9a14 Linux 5.15.198
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=152e0402580000
kernel config: https://syzkaller.appspot.com/x/.config?x=7be360c39eb88a5a

dashboard link: https://syzkaller.appspot.com/bug?extid=c819c1d6f08fd167aa7e
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

[Hanne-Lotta Mäenpää]

#syz test:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
9eec9a14ee10820a0c00dd3e02ac1e0ab27ad142

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+c819c1...@syzkaller.appspotmail.com
Tested-by: syzbot+c819c1...@syzkaller.appspotmail.com

Tested on:

commit: 9eec9a14 Linux 5.15.198
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=1729bbfa580000

kernel config: https://syzkaller.appspot.com/x/.config?x=7be360c39eb88a5a
dashboard link: https://syzkaller.appspot.com/bug?extid=c819c1d6f08fd167aa7e
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=101e0402580000