Re: [v5.15] WARNING in ieee80211_mgd_probe_ap_send

[Hanne-Lotta Mäenpää]

#syz test:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
7a6c2d093c4599727874a7e5e9b27fb313d2bd9c

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in ieee80211_mgd_probe_ap_send

------------[ cut here ]------------
WARNING: CPU: 1 PID: 8116 at net/mac80211/mlme.c:2557 ieee80211_mgd_probe_ap_send+0x5c3/0x680 net/mac80211/mlme.c:2557
Modules linked in:
CPU: 1 PID: 8116 Comm: kworker/u4:0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Workqueue: phy4 ieee80211_beacon_connection_loss_work
RIP: 0010:ieee80211_mgd_probe_ap_send+0x5c3/0x680 net/mac80211/mlme.c:2557
Code: 48 89 df 4c 89 f6 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 5e 14 42 f8 e8 d9 cb 52 f8 0f 0b e9 51 ff ff ff e8 cd cb 52 f8 <0f> 0b e9 6e fb ff ff e8 c1 cb 52 f8 0f 0b 45 31 ed e9 57 fd ff ff
RSP: 0018:ffffc9000a24fba0 EFLAGS: 00010293
RAX: ffffffff89250de3 RBX: ffff88807d0ecc80 RCX: ffff8880757c8000
RDX: 0000000000000000 RSI: ffffffff89eb28c0 RDI: ffffffff8a38d680
RBP: 1ffff1100fa1da51 R08: dffffc0000000000 R09: fffffbfff1a86336
R10: fffffbfff1a86336 R11: 1ffffffff1a86335 R12: ffff88807d40bcb8
R13: ffff88807d0ed288 R14: ffff88807d0edca8 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000000 CR3: 000000007e726000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
ieee80211_mgd_probe_ap+0x2c1/0x330 net/mac80211/mlme.c:2640
process_one_work+0x863/0x1000 kernel/workqueue.c:2310
worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
kthread+0x436/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>


Tested on:

commit: 7a6c2d09 Linux 5.15.191
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=12767134580000
kernel config: https://syzkaller.appspot.com/x/.config?x=91cc3e7d4b349d4f
dashboard link: https://syzkaller.appspot.com/bug?extid=c819c1d6f08fd167aa7e
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

Note: no patches were applied.

[Hanne-Lotta Mäenpää]

#syz test:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
60a9e718726fa7019ae00916e4b1c52498da5b60

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in ieee80211_mgd_probe_ap_send

------------[ cut here ]------------

WARNING: CPU: 1 PID: 2889 at net/mac80211/mlme.c:3206 ieee80211_mgd_probe_ap_send+0x44f/0x500 net/mac80211/mlme.c:3206
Modules linked in:
CPU: 1 PID: 2889 Comm: kworker/u4:11 Not tainted syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025

Workqueue: events_unbound cfg80211_wiphy_work
RIP: 0010:ieee80211_mgd_probe_ap_send+0x44f/0x500 net/mac80211/mlme.c:3206
Code: 10 5b 41 5c 41 5d 41 5e 41 5f 5d e9 5b 5f b5 f7 e8 a6 b1 c5 f7 0f 0b eb bc e8 9d b1 c5 f7 0f 0b e9 4c ff ff ff e8 91 b1 c5 f7 <0f> 0b 41 80 7c 2d 00 00 0f 85 e4 fc ff ff e9 e7 fc ff ff 44 89 f1
RSP: 0018:ffffc90009e07ad8 EFLAGS: 00010293
RAX: ffffffff89bdb1cf RBX: ffff888021a4cc00 RCX: ffff8880249d5a00
RDX: 0000000000000000 RSI: ffffffff8a6aa1c0 RDI: ffffffff8aba24c0
RBP: dffffc0000000000 R08: ffffffff8df9f02f R09: 1ffffffff1bf3e05
R10: dffffc0000000000 R11: fffffbfff1bf3e06 R12: ffff888021a4d518
R13: 1ffff11004349aa3 R14: ffff888021a4dae0 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 000055556479bca8 CR3: 000000000c72f000 CR4: 00000000003506e0
Call Trace:
<TASK>
ieee80211_mgd_probe_ap+0x325/0x3f0 net/mac80211/mlme.c:3290
cfg80211_wiphy_work+0x225/0x260 net/wireless/core.c:437
process_one_work kernel/workqueue.c:2634 [inline]
process_scheduled_works+0x9cb/0x1510 kernel/workqueue.c:2711
worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>


Tested on:

commit: 60a9e718 Linux 6.6.106
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=14691642580000
kernel config: https://syzkaller.appspot.com/x/.config?x=c7bbe38721e2f9d8

[Hanne-Lotta Mäenpää]

#syz test:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
60a9e718726fa7019ae00916e4b1c52498da5b60

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+c819c1...@syzkaller.appspotmail.com
Tested-by: syzbot+c819c1...@syzkaller.appspotmail.com

Tested on:

commit: 60a9e718 Linux 6.6.106
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=16873362580000

kernel config: https://syzkaller.appspot.com/x/.config?x=c7bbe38721e2f9d8
dashboard link: https://syzkaller.appspot.com/bug?extid=c819c1d6f08fd167aa7e
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=15e36b12580000

Note: testing is done by a robot and is best-effort only.

[Hanne-Lotta Mäenpää]

#syz test:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
3db754f56897798e2228b3dd13a117de723c2be6

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in ieee80211_mgd_probe_ap_send

------------[ cut here ]------------

WARNING: CPU: 0 PID: 45 at net/mac80211/mlme.c:3144 ieee80211_mgd_probe_ap_send+0x44f/0x500 net/mac80211/mlme.c:3144
Modules linked in:
CPU: 0 PID: 45 Comm: kworker/u4:2 Not tainted syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025

Workqueue: phy4 ieee80211_beacon_connection_loss_work
RIP: 0010:ieee80211_mgd_probe_ap_send+0x44f/0x500 net/mac80211/mlme.c:3144
Code: 10 5b 41 5c 41 5d 41 5e 41 5f 5d e9 2b 0f f8 f7 e8 b6 3d 08 f8 0f 0b eb bc e8 ad 3d 08 f8 0f 0b e9 4c ff ff ff e8 a1 3d 08 f8 <0f> 0b 41 80 7c 2d 00 00 0f 85 e4 fc ff ff e9 e7 fc ff ff 44 89 f1
RSP: 0018:ffffc90000b67ba8 EFLAGS: 00010293
RAX: ffffffff89768d1f RBX: ffff888078c34c00 RCX: ffff888017b01dc0
RDX: 0000000000000000 RSI: ffffffff8a4bf180 RDI: ffffffff8a9ce280
RBP: dffffc0000000000 R08: dffffc0000000000 R09: fffffbfff1ba2dee
R10: fffffbfff1ba2dee R11: 1ffffffff1ba2ded R12: ffff888078c35528
R13: 1ffff1100f186aa5 R14: ffff888078c35b80 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 0000000020000000 CR3: 00000000280a5000 CR4: 00000000003506f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Call Trace:
<TASK>
ieee80211_mgd_probe_ap+0x325/0x3f0 net/mac80211/mlme.c:3228
process_one_work+0x898/0x1160 kernel/workqueue.c:2292
worker_thread+0xaa2/0x1250 kernel/workqueue.c:2439
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>


Tested on:

commit: 3db754f5 Linux 6.1.152
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1286e362580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f8b4439baa0f070e

dashboard link: https://syzkaller.appspot.com/bug?extid=c819c1d6f08fd167aa7e
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8