[PATCH RFC] wifi: mac80211: reject station association if AP is not started

[syzbot]

If an interface is changed to AP mode but not started, its channel context
configuration (chanctx_conf) remains NULL. If a station is then added to
this interface, the kernel may automatically set the
NL80211_STA_FLAG_ASSOCIATED flag for compatibility with older userspace
applications.

When this flag is set, sta_apply_auth_flags() attempts to initialize rate
control for the station by calling rate_control_rate_init_all_links(). This
eventually leads to rate_control_rate_init(), which dereferences the NULL
chanctx_conf, triggering a WARN_ON:

WARNING: net/mac80211/rate.c:51 at rate_control_rate_init+0x5a6/0x630
...
Call Trace:
rate_control_rate_init_all_links+0xf4/0x190 net/mac80211/rate.c:84
sta_apply_auth_flags+0x1bc/0x430 net/mac80211/cfg.c:2152
sta_apply_parameters+0x126d/0x1b10 net/mac80211/cfg.c:2618
ieee80211_add_station+0x3de/0x700 net/mac80211/cfg.c:2684
rdev_add_station+0xfc/0x290 net/wireless/rdev-ops.h:201
nl80211_new_station+0x1b4e/0x1fd0 net/wireless/nl80211.c:9505

Fix this by rejecting the addition or modification of a station to the
associated state if the AP has not been started (chanctx_conf is NULL).
Exempt Multi-Link Operation (MLO) interfaces from this check, as they
handle chanctx_conf per-link rather than globally on the VIF, and
rate_control_rate_init() already handles them correctly.

Fixes: 55de908ab292 ("mac80211: use channel contexts")
Assisted-by: Gemini:gemini-3.1-pro-preview best-expensive syzbot
Reported-by: syzbot+9bdc0c...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9bdc0c5998ab45b05030
Link: https://syzkaller.appspot.com/ai_job?id=86851195-2aa0-410f-9fc9-952d95ae035d
To: "Johannes Berg" <joha...@sipsolutions.net>
To: <linux-w...@vger.kernel.org>
Cc: <linux-...@vger.kernel.org>

---
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 3b58af59f..b45d7923c 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2143,6 +2143,10 @@ static int sta_apply_auth_flags(struct ieee80211_local *local,
if (mask & BIT(NL80211_STA_FLAG_ASSOCIATED) &&
set & BIT(NL80211_STA_FLAG_ASSOCIATED) &&
!test_sta_flag(sta, WLAN_STA_ASSOC)) {
+ if (!ieee80211_vif_is_mld(&sta->sdata->vif) &&
+ !rcu_access_pointer(sta->sdata->vif.bss_conf.chanctx_conf))
+ return -EINVAL;
+
/*
* When peer becomes associated, init rate control as
* well. Some drivers require rate control initialized


base-commit: dc59e4fea9d83f03bad6bddf3fa2e52491777482
--
This is an AI-generated patch subject to moderation.
Reply with '#syz upstream' to Sign-off the patch as a human author
and send it to the upstream kernel mailing lists.
Reply with '#syz reject' to reject it ('#syz unreject' to undo).

See https://goo.gle/syzbot-ai-patches for information about AI-generated patches.
You can comment on the patch as usual, syzbot will try to address
the comments and send a new version of the patch if necessary.
syzbot engineers can be reached at syzk...@googlegroups.com.

[Slawomir Stepien]

On lip 01, 2026 09:52, syzbot wrote:
> If an interface is changed to AP mode but not started, its channel context
> configuration (chanctx_conf) remains NULL. If a station is then added to
> this interface, the kernel may automatically set the
> NL80211_STA_FLAG_ASSOCIATED flag for compatibility with older userspace
> applications.
>
> When this flag is set, sta_apply_auth_flags() attempts to initialize rate
> control for the station by calling rate_control_rate_init_all_links(). This
> eventually leads to rate_control_rate_init(), which dereferences the NULL
> chanctx_conf, triggering a WARN_ON:
>
> WARNING: net/mac80211/rate.c:51 at rate_control_rate_init+0x5a6/0x630
> ...
> Call Trace:
> rate_control_rate_init_all_links+0xf4/0x190 net/mac80211/rate.c:84
> sta_apply_auth_flags+0x1bc/0x430 net/mac80211/cfg.c:2152
> sta_apply_parameters+0x126d/0x1b10 net/mac80211/cfg.c:2618
> ieee80211_add_station+0x3de/0x700 net/mac80211/cfg.c:2684
> rdev_add_station+0xfc/0x290 net/wireless/rdev-ops.h:201
> nl80211_new_station+0x1b4e/0x1fd0 net/wireless/nl80211.c:9505
>
> Fix this by rejecting the addition or modification of a station to the
> associated state if the AP has not been started (chanctx_conf is NULL).
> Exempt Multi-Link Operation (MLO) interfaces from this check, as they
> handle chanctx_conf per-link rather than globally on the VIF, and
> rate_control_rate_init() already handles them correctly.

Well, the rate_control_rate_init() isn't really handling the MLO devices yet:

/* SW rate control isn't supported with MLO right now */
if (WARN_ON(ieee80211_vif_is_mld(&sta->sdata->vif)))
return;

I think we can tackle this some other time, but maybe at the moment it is wise to remove the "and
rate_control_rate_init() already handles them correctly" from commit message?

> Fixes: 55de908ab292 ("mac80211: use channel contexts")
> Assisted-by: Gemini:gemini-3.1-pro-preview best-expensive syzbot
> Reported-by: syzbot+9bdc0c...@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=9bdc0c5998ab45b05030
> Link: https://syzkaller.appspot.com/ai_job?id=86851195-2aa0-410f-9fc9-952d95ae035d
> To: "Johannes Berg" <joha...@sipsolutions.net>
> To: <linux-w...@vger.kernel.org>
> Cc: <linux-...@vger.kernel.org>
>
> ---
> diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
> index 3b58af59f..b45d7923c 100644
> --- a/net/mac80211/cfg.c
> +++ b/net/mac80211/cfg.c
> @@ -2143,6 +2143,10 @@ static int sta_apply_auth_flags(struct ieee80211_local *local,
> if (mask & BIT(NL80211_STA_FLAG_ASSOCIATED) &&
> set & BIT(NL80211_STA_FLAG_ASSOCIATED) &&
> !test_sta_flag(sta, WLAN_STA_ASSOC)) {
> + if (!ieee80211_vif_is_mld(&sta->sdata->vif) &&
> + !rcu_access_pointer(sta->sdata->vif.bss_conf.chanctx_conf))
> + return -EINVAL;
> +

Could you move this check to the if body below (after the comment) where the WLAN_STA_RATE_CONTROL
flag is checked for? I think having it there, right before calling the
rate_control_rate_init_all_links(sta); is more readable and done only when the WLAN_STA_RATE_CONTROL
is not set.

> /*
> * When peer becomes associated, init rate control as
> * well. Some drivers require rate control initialized
>
>
> base-commit: dc59e4fea9d83f03bad6bddf3fa2e52491777482

--

Slawomir Stepien

[syzbot]

If an interface is changed to AP mode but not started, its channel context
configuration (chanctx_conf) remains NULL. If a station is then added to
this interface, the kernel may automatically set the
NL80211_STA_FLAG_ASSOCIATED flag for compatibility with older userspace
applications.

When this flag is set, sta_apply_auth_flags() attempts to initialize rate
control for the station by calling rate_control_rate_init_all_links(). This
eventually leads to rate_control_rate_init(), which dereferences the NULL
chanctx_conf, triggering a WARN_ON:

WARNING: net/mac80211/rate.c:51 at rate_control_rate_init+0x5a6/0x630
...
Call Trace:

<TASK>

rate_control_rate_init_all_links+0xf4/0x190 net/mac80211/rate.c:84
sta_apply_auth_flags+0x1bc/0x430 net/mac80211/cfg.c:2152
sta_apply_parameters+0x126d/0x1b10 net/mac80211/cfg.c:2618
ieee80211_add_station+0x3de/0x700 net/mac80211/cfg.c:2684
rdev_add_station+0xfc/0x290 net/wireless/rdev-ops.h:201
nl80211_new_station+0x1b4e/0x1fd0 net/wireless/nl80211.c:9505

Fix this by rejecting the addition or modification of a station to the
associated state if the AP has not been started (chanctx_conf is NULL).
Exempt Multi-Link Operation (MLO) interfaces from this check, as they

handle chanctx_conf per-link rather than globally on the VIF.

Fixes: 55de908ab292 ("mac80211: use channel contexts")

Assisted-by: Gemini:gemini-3.1-pro-preview Gemini:gemini-3-flash-preview syzbot

Reported-by: syzbot+9bdc0c...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9bdc0c5998ab45b05030

Link: https://syzkaller.appspot.com/ai_job?id=6a1e0fff-0cb4-4d35-acf2-c84eee3af15c

To: "Johannes Berg" <joha...@sipsolutions.net>
To: <linux-w...@vger.kernel.org>
Cc: <linux-...@vger.kernel.org>

---

v2:
- Moved the chanctx_conf check inside the WLAN_STA_RATE_CONTROL check block.
- Removed a phrase from the commit description as requested by reviewers.

v1:
https://lore.kernel.org/all/8e8a5122-a09e-43b2...@mail.kernel.org/T/

---
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c

index 3b58af59f..ae29f799b 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2148,8 +2148,13 @@ static int sta_apply_auth_flags(struct ieee80211_local *local,

* well. Some drivers require rate control initialized

* before drv_sta_state() is called.
*/
- if (!test_sta_flag(sta, WLAN_STA_RATE_CONTROL))
+ if (!test_sta_flag(sta, WLAN_STA_RATE_CONTROL)) {

+ if (!ieee80211_vif_is_mld(&sta->sdata->vif) &&
+ !rcu_access_pointer(

+ sta->sdata->vif.bss_conf.chanctx_conf))
+ return -EINVAL;
rate_control_rate_init_all_links(sta);
+ }

ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
if (ret)

[Slawomir Stepien]

Don't worry about 80 column limit (it is 100 for some time now in scripts/checkpatch.pl). Make this
a one line please: !rcu_access_pointer(sta->sdata->vif.bss_conf.chanctx_conf)).

> + return -EINVAL;

Add empty line here, so the early return block is separated from the call to
rate_control_rate_init_all_links(sta). I think this will make it more readable.

> rate_control_rate_init_all_links(sta);
> + }
>
> ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
> if (ret)
>
>
> base-commit: dc59e4fea9d83f03bad6bddf3fa2e52491777482

--

Slawomir Stepien

[syzbot]

Link: https://syzkaller.appspot.com/ai_job?id=0c474d56-8871-480a-8ac4-9a9658930b46

To: "Johannes Berg" <joha...@sipsolutions.net>
To: <linux-w...@vger.kernel.org>
Cc: <linux-...@vger.kernel.org>

---

v3:
- Added an empty line after the newly added code block for better readability.

v2:
- Moved the chanctx_conf check inside the WLAN_STA_RATE_CONTROL check block.
- Removed a phrase from the commit description as requested by reviewers.

https://lore.kernel.org/all/79cbf145-6652-4e15...@mail.kernel.org/T/

v1:
https://lore.kernel.org/all/8e8a5122-a09e-43b2...@mail.kernel.org/T/
---
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c

index 3b58af59f..d4331fbae 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2148,8 +2148,14 @@ static int sta_apply_auth_flags(struct ieee80211_local *local,

* well. Some drivers require rate control initialized
* before drv_sta_state() is called.
*/
- if (!test_sta_flag(sta, WLAN_STA_RATE_CONTROL))
+ if (!test_sta_flag(sta, WLAN_STA_RATE_CONTROL)) {
+ if (!ieee80211_vif_is_mld(&sta->sdata->vif) &&
+ !rcu_access_pointer(
+ sta->sdata->vif.bss_conf.chanctx_conf))

+ return -EINVAL;
+

rate_control_rate_init_all_links(sta);
+ }

ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
if (ret)


base-commit: dc59e4fea9d83f03bad6bddf3fa2e52491777482
--

[Slawomir Stepien]

Don't worry about 80 column limit (it is 100 for some time now in scripts/checkpatch.pl). Make this

a one line please: !rcu_access_pointer(sta->sdata->vif.bss_conf.chanctx_conf))

> + return -EINVAL;
> +
> rate_control_rate_init_all_links(sta);
> + }
>
> ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
> if (ret)
>
>
> base-commit: dc59e4fea9d83f03bad6bddf3fa2e52491777482

--

Slawomir Stepien

[syzbot]

If an interface is changed to AP mode but not started, its channel context
configuration (chanctx_conf) remains NULL. If a station is then added to
this interface, the kernel may automatically set the
NL80211_STA_FLAG_ASSOCIATED flag for compatibility with older userspace
applications.

When this flag is set, sta_apply_auth_flags() attempts to initialize rate
control for the station by calling rate_control_rate_init_all_links(). This
eventually leads to rate_control_rate_init(), which dereferences the NULL
chanctx_conf, triggering a WARN_ON:

WARNING: net/mac80211/rate.c:51 at rate_control_rate_init+0x5a6/0x630
...
Call Trace:
<TASK>
rate_control_rate_init_all_links+0xf4/0x190 net/mac80211/rate.c:84
sta_apply_auth_flags+0x1bc/0x430 net/mac80211/cfg.c:2152
sta_apply_parameters+0x126d/0x1b10 net/mac80211/cfg.c:2618
ieee80211_add_station+0x3de/0x700 net/mac80211/cfg.c:2684
rdev_add_station+0xfc/0x290 net/wireless/rdev-ops.h:201
nl80211_new_station+0x1b4e/0x1fd0 net/wireless/nl80211.c:9505

Fix this by rejecting the addition or modification of a station to the
associated state if the AP has not been started (chanctx_conf is NULL).
Exempt Multi-Link Operation (MLO) interfaces from this check, as they
handle chanctx_conf per-link rather than globally on the VIF.

Fixes: 55de908ab292 ("mac80211: use channel contexts")

Assisted-by: Gemini:gemini-3.5-flash Gemini:gemini-3.1-pro-preview syzbot

Reported-by: syzbot+9bdc0c...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9bdc0c5998ab45b05030

Link: https://syzkaller.appspot.com/ai_job?id=64f3e3ae-e43e-4917-b403-f9b7799fe1bc

To: "Johannes Berg" <joha...@sipsolutions.net>
To: <linux-w...@vger.kernel.org>
Cc: <linux-...@vger.kernel.org>

---

v4:
- Avoid unnecessary line wrapping in the chanctx_conf check.

v3:
- Added an empty line after the newly added code block for better readability.

https://lore.kernel.org/all/9524f34c-7766-4543...@mail.kernel.org/T/

v2:
- Moved the chanctx_conf check inside the WLAN_STA_RATE_CONTROL check block.
- Removed a phrase from the commit description as requested by reviewers.
https://lore.kernel.org/all/79cbf145-6652-4e15...@mail.kernel.org/T/

v1:
https://lore.kernel.org/all/8e8a5122-a09e-43b2...@mail.kernel.org/T/
---
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c

index 3b58af59f..830c9fc95 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2148,8 +2148,13 @@ static int sta_apply_auth_flags(struct ieee80211_local *local,

* well. Some drivers require rate control initialized
* before drv_sta_state() is called.
*/
- if (!test_sta_flag(sta, WLAN_STA_RATE_CONTROL))
+ if (!test_sta_flag(sta, WLAN_STA_RATE_CONTROL)) {
+ if (!ieee80211_vif_is_mld(&sta->sdata->vif) &&

+ !rcu_access_pointer(sta->sdata->vif.bss_conf.chanctx_conf))

+ return -EINVAL;
+
rate_control_rate_init_all_links(sta);
+ }

ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
if (ret)


base-commit: dc59e4fea9d83f03bad6bddf3fa2e52491777482
--

[Slawomir Stepien]

#syz upstream

Slawomir Stepien