[PATCH RFC] wifi: cfg80211: replace WARN_ON() with pr_err() in netns switch

[syzbot]

The syzkaller reported a kernel panic in cfg802154_switch_netns() when
device_rename() fails with -ENOMEM. The crash occurs because WARN_ON()
is used to handle the memory allocation failure, which escalates into a
kernel panic when panic_on_warn is enabled.

Memory allocation failures are expected runtime events under memory
pressure and should be handled gracefully. The WARN_ON() macro must not
be used for conditions that can legitimately happen. Failing to rename
the device or change the network namespace is not a fatal system error.

Replace the WARN_ON() calls with pr_err() in both
cfg802154_switch_netns() and cfg80211_switch_netns(), as well as in
their respective pernet exit handlers (cfg802154_pernet_exit() and
cfg80211_pernet_exit()). This ensures that memory allocation failures
under pressure are handled gracefully, logging the error for debugging
purposes without bringing down the entire system.

Fixes: 66e5c2672cd11b9310008099faf6a4ffb9dfb6d0 ("ieee802154: add netns support")
Assisted-by: Gemini:gemini-3.1-pro-preview
Reported-by: syzbot+bd5829...@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=bd5829ba3619f08e2341
Link: https://syzkaller.appspot.com/ai_job?id=46668339-436e-4563-9254-73690dc813fe
To: <alex....@gmail.com>
To: <da...@davemloft.net>
To: <edum...@google.com>
To: <ku...@kernel.org>
To: <linux...@vger.kernel.org>
To: <miquel...@bootlin.com>
To: <net...@vger.kernel.org>
To: <pab...@redhat.com>
To: <ste...@datenfreihafen.org>
Cc: <ho...@kernel.org>
Cc: <joha...@sipsolutions.net>
Cc: <linux-...@vger.kernel.org>
Cc: <linux-w...@vger.kernel.org>

---
diff --git a/net/ieee802154/core.c b/net/ieee802154/core.c
index 89b671b12..98c498e3e 100644
--- a/net/ieee802154/core.c
+++ b/net/ieee802154/core.c
@@ -245,7 +245,8 @@ int cfg802154_switch_netns(struct cfg802154_registered_device *rdev,
wpan_dev->netdev->netns_immutable = false;
err = dev_change_net_namespace(wpan_dev->netdev, net,
"wpan%d");
- WARN_ON(err);
+ if (err)
+ pr_err("failed to change netns: %d\n", err);
wpan_dev->netdev->netns_immutable = true;
}

@@ -255,7 +256,8 @@ int cfg802154_switch_netns(struct cfg802154_registered_device *rdev,
wpan_phy_net_set(&rdev->wpan_phy, net);

err = device_rename(&rdev->wpan_phy.dev, dev_name(&rdev->wpan_phy.dev));
- WARN_ON(err);
+ if (err)
+ pr_err("failed to rename device: %d\n", err);

return 0;
}
@@ -350,8 +352,10 @@ static void __net_exit cfg802154_pernet_exit(struct net *net)

rtnl_lock();
list_for_each_entry(rdev, &cfg802154_rdev_list, list) {
- if (net_eq(wpan_phy_net(&rdev->wpan_phy), net))
- WARN_ON(cfg802154_switch_netns(rdev, &init_net));
+ if (net_eq(wpan_phy_net(&rdev->wpan_phy), net)) {
+ if (cfg802154_switch_netns(rdev, &init_net))
+ pr_err("failed to switch netns on exit\n");
+ }
}
rtnl_unlock();
}
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 6783e0672..ed5eac41f 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -184,7 +184,8 @@ int cfg80211_switch_netns(struct cfg80211_registered_device *rdev,
wdev->netdev->netns_immutable = false;
err = dev_change_net_namespace(wdev->netdev, net,
"wlan%d");
- WARN_ON(err);
+ if (err)
+ pr_err("failed to change netns: %d\n", err);
wdev->netdev->netns_immutable = true;
}

@@ -204,7 +205,8 @@ int cfg80211_switch_netns(struct cfg80211_registered_device *rdev,
wiphy_net_set(&rdev->wiphy, net);

err = device_rename(&rdev->wiphy.dev, dev_name(&rdev->wiphy.dev));
- WARN_ON(err);
+ if (err)
+ pr_err("failed to rename device: %d\n", err);

nl80211_notify_wiphy(rdev, NL80211_CMD_NEW_WIPHY);

@@ -1809,8 +1811,10 @@ static void __net_exit cfg80211_pernet_exit(struct net *net)

rtnl_lock();
for_each_rdev(rdev) {
- if (net_eq(wiphy_net(&rdev->wiphy), net))
- WARN_ON(cfg80211_switch_netns(rdev, &init_net));
+ if (net_eq(wiphy_net(&rdev->wiphy), net)) {
+ if (cfg80211_switch_netns(rdev, &init_net))
+ pr_err("failed to switch netns on exit\n");
+ }
}
rtnl_unlock();
}


base-commit: 5d6919055dec134de3c40167a490f33c74c12581
--
This is an AI-generated patch subject to moderation.
Reply with '#syz upstream' to send it to the mailing list.
Reply with '#syz reject' to reject it.

See for more information.