syzbot


WARNING in ieee80211_free_ack_frame (2)

Status: upstream: reported on 2021/11/15 07:38
Reported-by: syzbot+ac648b0525be1feba506@syzkaller.appspotmail.com
First crash: 319d, last: 39d
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 WARNING in ieee80211_free_ack_frame syz error 77 79d 719d 0/1 upstream: reported syz repro on 2020/10/07 07:47
upstream WARNING in ieee80211_free_ack_frame syz done 117 324d 719d 22/24 fixed on 2021/11/10 00:50

Sample crash report:
------------[ cut here ]------------
Have pending ack frames!
WARNING: CPU: 1 PID: 4093 at net/mac80211/main.c:1496 ieee80211_free_ack_frame+0x4d/0x60 net/mac80211/main.c:1496
Modules linked in:
CPU: 0 PID: 4093 Comm: kworker/u4:7 Not tainted 5.19.0-syzkaller-13930-g7ebfc85e2cd7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
Workqueue: netns cleanup_net
RIP: 0010:ieee80211_free_ack_frame+0x4d/0x60 net/mac80211/main.c:1496
Code: 48 89 ef be 01 00 00 00 e8 50 f4 8b fe 31 c0 5b 5d c3 e8 16 58 b8 f8 48 c7 c7 80 9b 14 8b c6 05 88 08 06 05 01 e8 30 99 76 00 <0f> 0b eb cd 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 41 57 41
RSP: 0018:ffffc900002ef9d0 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88807cd26100 RSI: ffffffff81611b48 RDI: fffff5200005df2c
RBP: ffff888021b89cc0 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000080000000 R11: 0000000000000000 R12: dffffc0000000000
R13: ffffffff88c2dd70 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007faba5db2000 CR3: 000000007d04d000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 idr_for_each+0x113/0x220 lib/idr.c:208
 ieee80211_free_hw+0x9b/0x2b0 net/mac80211/main.c:1512
 mac80211_hwsim_del_radio drivers/net/wireless/mac80211_hwsim.c:4233 [inline]
 hwsim_exit_net+0x55f/0xca0 drivers/net/wireless/mac80211_hwsim.c:5017
 ops_exit_list+0xb0/0x170 net/core/net_namespace.c:163
 cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:595
 process_one_work+0x991/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e4/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
 </TASK>

Crashes (26):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-selinux-root 2022/08/15 09:51 upstream 7ebfc85e2cd7 8dfcaa3d .config log report info WARNING in ieee80211_free_ack_frame
ci-upstream-kasan-gce-selinux-root 2022/08/03 03:01 upstream 7d0d3fa7339e 1c9013ac .config log report info WARNING in ieee80211_free_ack_frame
ci-upstream-kasan-gce-smack-root 2022/07/13 01:53 upstream 72a8e05d4f66 d91dd8ea .config log report info WARNING in ieee80211_free_ack_frame
ci-upstream-kasan-gce-selinux-root 2022/06/25 12:07 upstream 6a0a17e6c6d1 a371c43c .config log report info WARNING in ieee80211_free_ack_frame
ci-upstream-kasan-gce-root 2022/06/17 19:58 upstream f0ec9c65a8d6 cb58b3b2 .config log report info WARNING in ieee80211_free_ack_frame
ci-upstream-kasan-gce-root 2022/06/14 22:08 upstream 24625f7d91fb 127d1faf .config log report info WARNING in ieee80211_free_ack_frame
ci-upstream-kasan-gce-root 2022/01/15 23:11 upstream a33f5c380c4b 723cfaf0 .config log report info WARNING in ieee80211_free_ack_frame
ci-upstream-kasan-gce-smack-root 2022/01/14 05:02 upstream 455e73a07f6e b8d780ab .config log report info WARNING in ieee80211_free_ack_frame
ci-upstream-kasan-gce-smack-root 2022/01/09 18:11 upstream 4634129ad9fd 2ca0d385 .config log report info WARNING in ieee80211_free_ack_frame
ci-upstream-kasan-gce-selinux-root 2021/12/11 05:11 upstream b8a98b6bf66a 49ca1f59 .config log report info WARNING in ieee80211_free_ack_frame
ci-upstream-kasan-gce-selinux-root 2021/11/11 07:31 upstream 89d714ab6043 75b04091 .config log report info WARNING in ieee80211_free_ack_frame
ci-upstream-net-this-kasan-gce 2022/08/01 03:11 net 9e98f8c7707f fef302b1 .config log report info WARNING in ieee80211_free_ack_frame
ci-upstream-net-this-kasan-gce 2022/07/13 16:53 net 22b9c41a3fb8 5d921b08 .config log report info WARNING in ieee80211_free_ack_frame
ci-upstream-net-this-kasan-gce 2022/06/24 16:58 net 399bd66e219e a5dbd430 .config log report info WARNING in ieee80211_free_ack_frame
ci-upstream-net-this-kasan-gce 2022/01/19 15:42 net 99845220d3c3 0620189b .config log report info WARNING in ieee80211_free_ack_frame
ci-upstream-net-this-kasan-gce 2022/01/18 03:55 net 9ea674d7ca4f 731a2d23 .config log report info WARNING in ieee80211_free_ack_frame
ci-upstream-net-kasan-gce 2022/08/17 21:50 net-next 52327d2e3996 4e72d229 .config log report info WARNING in ieee80211_free_ack_frame
ci-upstream-net-kasan-gce 2022/08/13 12:21 net-next 7ebfc85e2cd7 8dfcaa3d .config log report info WARNING in ieee80211_free_ack_frame
ci-upstream-net-kasan-gce 2022/06/26 12:19 net-next ebeae54d3a77 a371c43c .config log report info WARNING in ieee80211_free_ack_frame
ci-upstream-net-kasan-gce 2022/06/21 08:17 net-next 4336487e30c3 0fc5c330 .config log report info WARNING in ieee80211_free_ack_frame
ci-upstream-net-kasan-gce 2022/06/10 00:17 net-next 263efe85a4b6 0d5abf15 .config log report info WARNING in ieee80211_free_ack_frame
ci-upstream-net-kasan-gce 2022/06/08 19:08 net-next da6e113ff010 b2706118 .config log report info WARNING in ieee80211_free_ack_frame
ci-upstream-net-kasan-gce 2022/06/08 12:31 net-next ba36c5b7ac93 b2706118 .config log report info WARNING in ieee80211_free_ack_frame
ci-upstream-net-kasan-gce 2022/06/07 20:28 net-next 12de1ebd2ae3 c8857892 .config log report info WARNING in ieee80211_free_ack_frame
ci-upstream-net-kasan-gce 2022/03/04 00:05 net-next 80901bff8129 45a13a73 .config log report info WARNING in ieee80211_free_ack_frame
ci-upstream-linux-next-kasan-gce-root 2022/08/03 07:29 linux-next cb71b93c2dc3 1c9013ac .config log report info WARNING in ieee80211_free_ack_frame
* Struck through repros no longer work on HEAD.