syzbot
WARNING in ieee80211_change_chanctx
Status:
upstream: reported on 2026/09/23 15:45
Reported-by: syzbot+a051f476dfe362f00c24@syzkaller.appspotmail.com
First crash: 27d, last: 27d
Sample crash report:
------------[ cut here ]------------
WARNING: CPU: 1 PID: 14651 at net/mac80211/chan.c:430 ieee80211_change_chanctx+0x64/0x490 net/mac80211/chan.c:430
Modules linked in:
CPU: 1 PID: 14651 Comm: kworker/u4:8 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: phy17 ieee80211_csa_finalize_work
RIP: 0010:ieee80211_change_chanctx+0x64/0x490 net/mac80211/chan.c:430
Code: c0 0f 85 17 03 00 00 45 8b 75 00 bf 06 00 00 00 44 89 f6 e8 ae ce 21 f8 41 83 fe 05 77 07 e8 43 cb 21 f8 eb 07 e8 3c cb 21 f8 <0f> 0b 48 89 df 48 8b 34 24 ba 01 00 00 00 e8 19 f1 ff ff 4d 8d 77
RSP: 0018:ffffc90003ccfab0 EFLAGS: 00010293
RAX: ffffffff89574964 RBX: ffff888076788e00 RCX: ffff88804d239dc0
RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006
RBP: 1ffff1100c2e645d R08: ffffffff8d8b1eef R09: 1ffffffff1b163dd
R10: dffffc0000000000 R11: fffffbfff1b163de R12: ffff8880617322e0
R13: ffff8880617322e8 R14: 0000000000000006 R15: ffff88804c3afd00
FS: 0000000000000000(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b33a18ff8 CR3: 000000007dcaf000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
ieee80211_vif_use_reserved_switch+0x16e2/0x26d0 net/mac80211/chan.c:1537
ieee80211_vif_use_reserved_context+0x345/0x590 net/mac80211/chan.c:1768
__ieee80211_csa_finalize net/mac80211/cfg.c:3236 [inline]
ieee80211_csa_finalize+0x44d/0xb20 net/mac80211/cfg.c:3268
ieee80211_csa_finalize_work+0xf2/0x130 net/mac80211/cfg.c:3293
process_one_work+0x867/0xff0 kernel/workqueue.c:2310
worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
kthread+0x42e/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>
irq event stamp: 8979013
hardirqs last enabled at (8979027): [<ffffffff81545cdd>] raw_spin_rq_unlock_irq kernel/sched/sched.h:1338 [inline]
hardirqs last enabled at (8979027): [<ffffffff81545cdd>] finish_lock_switch+0x12d/0x290 kernel/sched/core.c:4803
hardirqs last disabled at (8979038): [<ffffffff89c939cc>] __schedule+0x2fc/0x4350 kernel/sched/core.c:6291
softirqs last enabled at (8978816): [<ffffffff814944db>] __do_softirq kernel/softirq.c:610 [inline]
softirqs last enabled at (8978816): [<ffffffff814944db>] invoke_softirq kernel/softirq.c:450 [inline]
softirqs last enabled at (8978816): [<ffffffff814944db>] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659
softirqs last disabled at (8971407): [<ffffffff814944db>] __do_softirq kernel/softirq.c:610 [inline]
softirqs last disabled at (8971407): [<ffffffff814944db>] invoke_softirq kernel/softirq.c:450 [inline]
softirqs last disabled at (8971407): [<ffffffff814944db>] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659
* Struck through repros no longer work on HEAD.