WARNING in ieee80211_ibss_csa_beacon

Hello,

syzbot found the following issue on:

HEAD commit:    c85fb28b Merge tag 'arm64-fixes' of git://git.kernel.org/p..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15b2b400500000
kernel config:  https://syzkaller.appspot.com/x/.config?x=de7f697da23057c7
dashboard link: https://syzkaller.appspot.com/bug?extid=b6c9fe29aefe68e4ad34
compiler:       clang version 10.0.0 (https://github.com/llvm/llvm-project/ c2443155a0fb245c8f17f2c1c72b6ea391e86e81)

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: <redacted>

WARNING: CPU: 1 PID: 11321 at net/mac80211/ibss.c:504 ieee80211_ibss_csa_beacon+0x4e9/0x5a0 net/mac80211/ibss.c:504
Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 11321 Comm: kworker/u4:0 Not tainted 5.9.0-rc8-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: phy10 ieee80211_csa_finalize_work
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d6/0x29e lib/dump_stack.c:118
 panic+0x2c0/0x800 kernel/panic.c:231
 __warn+0x227/0x250 kernel/panic.c:600
 report_bug+0x1b1/0x2e0 lib/bug.c:198
 handle_bug+0x42/0x80 arch/x86/kernel/traps.c:234
 exc_invalid_op+0x16/0x40 arch/x86/kernel/traps.c:254
 asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536
RIP: 0010:ieee80211_ibss_csa_beacon+0x4e9/0x5a0 net/mac80211/ibss.c:504
Code: e8 fc 29 8b f9 b8 f4 ff ff ff eb 0a e8 f0 29 8b f9 b8 00 01 00 00 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 d7 29 8b f9 <0f> 0b b8 ea ff ff ff eb e3 e8 c9 29 8b f9 0f 0b e9 88 fb ff ff 48
RSP: 0018:ffffc9000ab5fbf8 EFLAGS: 00010293
RAX: ffffffff87e9d419 RBX: ffff88804cc20580 RCX: ffff888016268280
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff88804cc23490 R08: dffffc0000000000 R09: fffffbfff16c82b4
R10: fffffbfff16c82b4 R11: 0000000000000000 R12: ffff8880a21a18c0
R13: ffff8880a21a18ba R14: ffff8880a21a0c00 R15: ffff8880a21a18e0
 ieee80211_set_after_csa_beacon net/mac80211/cfg.c:3043 [inline]
 __ieee80211_csa_finalize net/mac80211/cfg.c:3099 [inline]

17 more lines

syzbot has found a reproducer for the following issue on:

HEAD commit:    e87297fa Merge tag 'drm-fixes-2020-12-04' of git://anongit..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1412f617500000
kernel config:  https://syzkaller.appspot.com/x/.config?x=e49433cfed49b7d9
dashboard link: https://syzkaller.appspot.com/bug?extid=b6c9fe29aefe68e4ad34
compiler:       gcc (GCC) 10.1.0-syz 20200507
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15131837500000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=14550ecf500000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: <redacted>

wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
------------[ cut here ]------------
WARNING: CPU: 0 PID: 21 at net/mac80211/ibss.c:504 ieee80211_ibss_csa_beacon+0x5ec/0x730 net/mac80211/ibss.c:504
Modules linked in:
CPU: 0 PID: 21 Comm: kworker/u4:1 Not tainted 5.10.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: phy10 ieee80211_csa_finalize_work
RIP: 0010:ieee80211_ibss_csa_beacon+0x5ec/0x730 net/mac80211/ibss.c:504
Code: ff e8 a8 b7 9c 00 31 ff 89 c5 89 c6 e8 9d 2c 27 f9 85 ed 0f 85 84 fa ff ff e8 40 34 27 f9 0f 0b e9 78 fa ff ff e8 34 34 27 f9 <0f> 0b 41 bd ea ff ff ff e9 e1 fd ff ff e8 72 b2 68 f9 e9 8f fa ff
RSP: 0018:ffffc90000dbfc50 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88801c070c00 RCX: ffffffff8155a937
RDX: ffff888010e1b480 RSI: ffffffff8848d04c RDI: 0000000000000000
RBP: 0000000000000002 R08: 0000000000000001 R09: ffffffff8ebaf727
R10: fffffbfff1d75ee4 R11: 0000000000000001 R12: 0000000000000000
R13: ffff88801c0718f0 R14: ffff888022400c80 R15: ffff88801c071248
FS:  0000000000000000(0000) GS:ffff8880b9f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fdcb7060000 CR3: 0000000012b2b000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 ieee80211_set_after_csa_beacon net/mac80211/cfg.c:3133 [inline]
 __ieee80211_csa_finalize+0x504/0xbf0 net/mac80211/cfg.c:3189
 ieee80211_csa_finalize net/mac80211/cfg.c:3212 [inline]
 ieee80211_csa_finalize_work+0x131/0x170 net/mac80211/cfg.c:3237

5 more lines

When we are not connected to a channel, sending channel "switch"
announcement doesn't make any sense.

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c

@@ -530,6 +530,10 @@ int ieee80211_ibss_finish_csa(struct ieee80211_sub_if_data *sdata)
 
 	sdata_assert_lock(sdata);
 
+	/* When not connected/joined, sending CSA doesn't make sense. */
+	if (sdata->u.ibss.state != IEEE80211_IBSS_MLME_JOINED)
+		return -ENOLINK;
+
 	/* update cfg80211 bss information with the new channel */
 	if (!is_zero_ether_addr(ifibss->bssid)) {
 		cbss = cfg80211_get_bss(sdata->local->hw.wiphy,

-- 
2.35.1

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

tered promiscuous mode
[   49.294465][ T3636] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   49.305282][ T3636] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   49.325908][ T3636] team0: Port device team_slave_0 added
[   49.333047][ T3636] team0: Port device team_slave_1 added
[   49.350306][ T3636] batman_adv: batadv0: Adding interface: batadv_slave_0
[   49.357336][ T3636] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   49.383401][ T3636] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   49.395845][ T3636] batman_adv: batadv0: Adding interface: batadv_slave_1
[   49.402957][ T3636] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   49.430471][ T3636] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   49.455720][ T3636] device hsr_slave_0 entered promiscuous mode
[   49.463006][ T3636] device hsr_slave_1 entered promiscuous mode
[   49.538340][ T3636] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   49.549079][ T3636] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   49.558155][ T3636] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   49.569133][ T3636] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   49.590785][ T3636] bridge0: port 2(bridge_slave_1) entered blocking state
[   49.597986][ T3636] bridge0: port 2(bridge_slave_1) entered forwarding state
[   49.605904][ T3636] bridge0: port 1(bridge_slave_0) entered blocking state
[   49.613050][ T3636] bridge0: port 1(bridge_slave_0) entered forwarding state
[   49.657283][ T3636] 8021q: adding VLAN 0 to HW filter on device bond0
[   49.669522][   T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[   49.679945][   T14] bridge0: port 1(bridge_slave_0) entered disabled state
[   49.688892][   T14] bridge0: port 2(bridge_slave_1) entered disabled state
[   49.697602][   T14] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[   49.710449][ T3636] 8021q: adding VLAN 0 to HW filter on device team0
[   49.722894][ T3647] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[   49.732572][ T3647] bridge0: port 1(bridge_slave_0) entered blocking state
[   49.739646][ T3647] bridge0: port 1(bridge_slave_0) entered forwarding state
[   49.750696][  T923] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[   49.759168][  T923] bridge0: port 2(bridge_slave_1) entered blocking state
[   49.766347][  T923] bridge0: port 2(bridge_slave_1) entered forwarding state
[   49.783139][ T3647] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[   49.798118][ T3647] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[   49.807101][ T3647] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready

223 more lines

On Wed, 10 Aug 2022 22:17:12 +0530  syzbot  wrote:

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

Trying again.

#syz test https://github.com/siddhpant/linux.git warning_ibss_csa_beacon

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

 active interface with an up link
[   50.263416][ T3638] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   50.285671][ T3638] team0: Port device team_slave_0 added
[   50.292792][ T3638] team0: Port device team_slave_1 added
[   50.310141][ T3638] batman_adv: batadv0: Adding interface: batadv_slave_0
[   50.317225][ T3638] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   50.343683][ T3638] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   50.356731][ T3638] batman_adv: batadv0: Adding interface: batadv_slave_1
[   50.364022][ T3638] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   50.390221][ T3638] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   50.416765][ T3638] device hsr_slave_0 entered promiscuous mode
[   50.423796][ T3638] device hsr_slave_1 entered promiscuous mode
[   50.500816][ T3638] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   50.511693][ T3638] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   50.521112][ T3638] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   50.530709][ T3638] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   50.551898][ T3638] bridge0: port 2(bridge_slave_1) entered blocking state
[   50.559135][ T3638] bridge0: port 2(bridge_slave_1) entered forwarding state
[   50.566985][ T3638] bridge0: port 1(bridge_slave_0) entered blocking state
[   50.574182][ T3638] bridge0: port 1(bridge_slave_0) entered forwarding state
[   50.620324][ T3638] 8021q: adding VLAN 0 to HW filter on device bond0
[   50.634712][   T14] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[   50.644519][   T14] bridge0: port 1(bridge_slave_0) entered disabled state
[   50.653256][   T14] bridge0: port 2(bridge_slave_1) entered disabled state
[   50.661875][   T14] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[   50.675639][ T3638] 8021q: adding VLAN 0 to HW filter on device team0
[   50.686683][   T14] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[   50.696048][   T14] bridge0: port 1(bridge_slave_0) entered blocking state
[   50.703313][   T14] bridge0: port 1(bridge_slave_0) entered forwarding state
[   50.716587][  T143] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[   50.726078][  T143] bridge0: port 2(bridge_slave_1) entered blocking state
[   50.733163][  T143] bridge0: port 2(bridge_slave_1) entered forwarding state
[   50.751866][   T14] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[   50.766290][   T14] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[   50.775160][   T14] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[   50.787909][ T3650] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready

223 more lines