------------[ cut here ]------------
WARNING: CPU: 0 PID: 12086 at net/mac80211/chan.c:2016 ieee80211_link_release_channel+0x16c/0x19c net/mac80211/chan.c:2016
Modules linked in:
CPU: 0 PID: 12086 Comm: syz.4.1912 Not tainted 6.1.147-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/18/2025
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : ieee80211_link_release_channel+0x16c/0x19c net/mac80211/chan.c:2016
lr : ieee80211_link_release_channel+0x16c/0x19c net/mac80211/chan.c:2016
sp : ffff800021167100
x29: ffff800021167100 x28: ffff0000f6ad5c80 x27: dfff800000000000
x26: 1fffe0001ed5ad6e x25: 1fffe000197b1000 x24: ffff0000f6ad6b72
x23: 1fffe0001ed5aab5 x22: dfff800000000000 x21: 0000000000000000
x20: ffff0000f6ad6258 x19: ffff0000f6ad55a8 x18: 0000000000000000
x17: ffff8000181e7000 x16: ffff8000082d0ec4 x15: ffff80000fcaa280
x14: ffff80000fcaa13c x13: 1ffff00002a160b1 x12: 0000000000080000
x11: 0000000000034d2b x10: ffff80002aca5000 x9 : ffff800011281c10
x8 : 0000000000034d2c x7 : ffff800011281b10 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff8000082c9668
x2 : ffff0000c9620000 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
 ieee80211_link_release_channel+0x16c/0x19c net/mac80211/chan.c:2016
 ieee80211_link_stop+0x9c/0xc4 net/mac80211/link.c:72
 ieee80211_teardown_sdata net/mac80211/iface.c:847 [inline]
 ieee80211_if_change_type+0x1d8/0xc6c net/mac80211/iface.c:1987
 ieee80211_change_iface+0x68/0x400 net/mac80211/cfg.c:217
 rdev_change_virtual_intf net/wireless/rdev-ops.h:74 [inline]
 cfg80211_change_iface+0x718/0xf2c net/wireless/util.c:1207
 nl80211_set_interface+0x41c/0x6e8 net/wireless/nl80211.c:4209
 genl_family_rcv_msg_doit+0x1f8/0x2f4 net/netlink/genetlink.c:756
 genl_family_rcv_msg net/netlink/genetlink.c:833 [inline]
 genl_rcv_msg+0x444/0x62c net/netlink/genetlink.c:850
 netlink_rcv_skb+0x208/0x3c4 net/netlink/af_netlink.c:2511
 genl_rcv+0x38/0x50 net/netlink/genetlink.c:861
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x60c/0x824 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x6e8/0x9b0 net/netlink/af_netlink.c:1872
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg net/socket.c:730 [inline]
 ____sys_sendmsg+0x5b8/0x918 net/socket.c:2519
 ___sys_sendmsg net/socket.c:2573 [inline]
 __sys_sendmsg+0x25c/0x320 net/socket.c:2602
 __do_sys_sendmsg net/socket.c:2611 [inline]
 __se_sys_sendmsg net/socket.c:2609 [inline]
 __arm64_sys_sendmsg+0x80/0x94 net/socket.c:2609
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x1fc/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 3348
hardirqs last  enabled at (3347): [<ffff8000081f51d8>] __cancel_work_timer+0x2b0/0x448 kernel/workqueue.c:3156
hardirqs last disabled at (3348): [<ffff8000119455d8>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last  enabled at (1954): [<ffff8000110ae644>] spin_unlock_bh include/linux/spinlock.h:396 [inline]
softirqs last  enabled at (1954): [<ffff8000110ae644>] cfg80211_mgmt_registrations_update+0x440/0x838 net/wireless/mlme.c:509
softirqs last disabled at (1952): [<ffff8000110ae310>] spin_lock_bh include/linux/spinlock.h:356 [inline]
softirqs last disabled at (1952): [<ffff8000110ae310>] cfg80211_mgmt_registrations_update+0x10c/0x838 net/wireless/mlme.c:482
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
wlan1: Failed check-sdata-in-driver check, flags: 0x0
WARNING: CPU: 0 PID: 12086 at net/mac80211/driver-ops.c:315 drv_unassign_vif_chanctx+0x358/0x63c net/mac80211/driver-ops.c:315
Modules linked in:
CPU: 0 PID: 12086 Comm: syz.4.1912 Tainted: G        W          6.1.147-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/18/2025
pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : drv_unassign_vif_chanctx+0x358/0x63c net/mac80211/driver-ops.c:315
lr : drv_unassign_vif_chanctx+0x358/0x63c net/mac80211/driver-ops.c:315
sp : ffff800021166fb0
x29: ffff800021166fb0 x28: 0000000000000000 x27: ffff0000f6ad4c80
x26: ffff0000f6ad6698 x25: dfff800000000000 x24: ffff0000f6ad67e8
x23: 0000000000000000 x22: ffff0000ca1eaa00 x21: ffff0000f6ad67e8
x20: ffff800017a78000 x19: ffff0000f6ad4c80 x18: ffff800011aabce0
x17: 1fffe00033ed9d7e x16: ffff8000082d2374 x15: 0000000040000000
x14: 0000000000000002 x13: 1ffff00002a160b1 x12: 0000000000ff0100
x11: ff0080000a88c734 x10: 0000000000000003 x9 : 6149dbc6a228df00
x8 : 6149dbc6a228df00 x7 : ffff800008251ec8 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000006 x1 : ffff800011aad7e0 x0 : ffff80018a6c9000
Call trace:
 drv_unassign_vif_chanctx+0x358/0x63c net/mac80211/driver-ops.c:315
 ieee80211_assign_link_chanctx+0x140/0x82c net/mac80211/chan.c:868
 __ieee80211_link_release_channel+0x29c/0x55c net/mac80211/chan.c:1798
 ieee80211_link_release_channel+0x130/0x19c net/mac80211/chan.c:2017
 ieee80211_link_stop+0x9c/0xc4 net/mac80211/link.c:72
 ieee80211_teardown_sdata net/mac80211/iface.c:847 [inline]
 ieee80211_if_change_type+0x1d8/0xc6c net/mac80211/iface.c:1987
 ieee80211_change_iface+0x68/0x400 net/mac80211/cfg.c:217
 rdev_change_virtual_intf net/wireless/rdev-ops.h:74 [inline]
 cfg80211_change_iface+0x718/0xf2c net/wireless/util.c:1207
 nl80211_set_interface+0x41c/0x6e8 net/wireless/nl80211.c:4209
 genl_family_rcv_msg_doit+0x1f8/0x2f4 net/netlink/genetlink.c:756
 genl_family_rcv_msg net/netlink/genetlink.c:833 [inline]
 genl_rcv_msg+0x444/0x62c net/netlink/genetlink.c:850
 netlink_rcv_skb+0x208/0x3c4 net/netlink/af_netlink.c:2511
 genl_rcv+0x38/0x50 net/netlink/genetlink.c:861
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x60c/0x824 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x6e8/0x9b0 net/netlink/af_netlink.c:1872
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg net/socket.c:730 [inline]
 ____sys_sendmsg+0x5b8/0x918 net/socket.c:2519
 ___sys_sendmsg net/socket.c:2573 [inline]
 __sys_sendmsg+0x25c/0x320 net/socket.c:2602
 __do_sys_sendmsg net/socket.c:2611 [inline]
 __se_sys_sendmsg net/socket.c:2609 [inline]
 __arm64_sys_sendmsg+0x80/0x94 net/socket.c:2609
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x1fc/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 3674
hardirqs last  enabled at (3673): [<ffff800008251f5c>] raw_spin_rq_unlock_irq kernel/sched/sched.h:1367 [inline]
hardirqs last  enabled at (3673): [<ffff800008251f5c>] finish_lock_switch+0xb0/0x1c4 kernel/sched/core.c:5003
hardirqs last disabled at (3674): [<ffff8000119455d8>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last  enabled at (3666): [<ffff8000081a9670>] softirq_handle_end kernel/softirq.c:439 [inline]
softirqs last  enabled at (3666): [<ffff8000081a9670>] handle_softirqs+0xaf8/0xc6c kernel/softirq.c:624
softirqs last disabled at (3641): [<ffff800008020164>] __do_softirq+0x14/0x20 kernel/softirq.c:630
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
wlan1: Failed check-sdata-in-driver check, flags: 0x0
WARNING: CPU: 1 PID: 12086 at net/mac80211/driver-ops.h:156 drv_vif_cfg_changed net/mac80211/driver-ops.h:156 [inline]
WARNING: CPU: 1 PID: 12086 at net/mac80211/driver-ops.h:156 ieee80211_vif_cfg_change_notify+0x21c/0x25c net/mac80211/main.c:275
Modules linked in:
CPU: 1 PID: 12086 Comm: syz.4.1912 Tainted: G        W          6.1.147-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/18/2025
pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : drv_vif_cfg_changed net/mac80211/driver-ops.h:156 [inline]
pc : ieee80211_vif_cfg_change_notify+0x21c/0x25c net/mac80211/main.c:275
lr : drv_vif_cfg_changed net/mac80211/driver-ops.h:156 [inline]
lr : ieee80211_vif_cfg_change_notify+0x21c/0x25c net/mac80211/main.c:275
sp : ffff800021166fb0
x29: ffff800021166fb0 x28: ffff8000150b0000 x27: ffff8000150b0584
x26: ffff0000ca1eaa20 x25: 0000000000000000 x24: dfff800000000000
x23: 0000000000000000 x22: ffff0000f6ad6790 x21: ffff0000cbd88ea0
x20: ffff800017a78000 x19: ffff0000f6ad4c80 x18: ffff800011aabce0
x17: 1fffe00033eddf7e x16: ffff8000082d2374 x15: 0000000040000000
x14: 0000000000000002 x13: 1ffff00002a160b1 x12: 0000000000ff0100
x11: ff0080000a88c734 x10: 0000000000000003 x9 : 6149dbc6a228df00
x8 : 6149dbc6a228df00 x7 : ffff800008251ec8 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000006 x1 : ffff800011aad7e0 x0 : ffff80018a6ea000
Call trace:
 drv_vif_cfg_changed net/mac80211/driver-ops.h:156 [inline]
 ieee80211_vif_cfg_change_notify+0x21c/0x25c net/mac80211/main.c:275
 ieee80211_assign_link_chanctx+0x6e8/0x82c net/mac80211/chan.c:905
 __ieee80211_link_release_channel+0x29c/0x55c net/mac80211/chan.c:1798
 ieee80211_link_release_channel+0x130/0x19c net/mac80211/chan.c:2017
 ieee80211_link_stop+0x9c/0xc4 net/mac80211/link.c:72
 ieee80211_teardown_sdata net/mac80211/iface.c:847 [inline]
 ieee80211_if_change_type+0x1d8/0xc6c net/mac80211/iface.c:1987
 ieee80211_change_iface+0x68/0x400 net/mac80211/cfg.c:217
 rdev_change_virtual_intf net/wireless/rdev-ops.h:74 [inline]
 cfg80211_change_iface+0x718/0xf2c net/wireless/util.c:1207
 nl80211_set_interface+0x41c/0x6e8 net/wireless/nl80211.c:4209
 genl_family_rcv_msg_doit+0x1f8/0x2f4 net/netlink/genetlink.c:756
 genl_family_rcv_msg net/netlink/genetlink.c:833 [inline]
 genl_rcv_msg+0x444/0x62c net/netlink/genetlink.c:850
 netlink_rcv_skb+0x208/0x3c4 net/netlink/af_netlink.c:2511
 genl_rcv+0x38/0x50 net/netlink/genetlink.c:861
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x60c/0x824 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x6e8/0x9b0 net/netlink/af_netlink.c:1872
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg net/socket.c:730 [inline]
 ____sys_sendmsg+0x5b8/0x918 net/socket.c:2519
 ___sys_sendmsg net/socket.c:2573 [inline]
 __sys_sendmsg+0x25c/0x320 net/socket.c:2602
 __do_sys_sendmsg net/socket.c:2611 [inline]
 __se_sys_sendmsg net/socket.c:2609 [inline]
 __arm64_sys_sendmsg+0x80/0x94 net/socket.c:2609
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x1fc/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 3898
hardirqs last  enabled at (3897): [<ffff800008251f5c>] raw_spin_rq_unlock_irq kernel/sched/sched.h:1367 [inline]
hardirqs last  enabled at (3897): [<ffff800008251f5c>] finish_lock_switch+0xb0/0x1c4 kernel/sched/core.c:5003
hardirqs last disabled at (3898): [<ffff8000119455d8>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last  enabled at (3862): [<ffff8000081a9670>] softirq_handle_end kernel/softirq.c:439 [inline]
softirqs last  enabled at (3862): [<ffff8000081a9670>] handle_softirqs+0xaf8/0xc6c kernel/softirq.c:624
softirqs last disabled at (3677): [<ffff800008020164>] __do_softirq+0x14/0x20 kernel/softirq.c:630
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
WARNING: CPU: 1 PID: 12086 at net/mac80211/iface.c:113 __ieee80211_recalc_idle net/mac80211/iface.c:113 [inline]
WARNING: CPU: 1 PID: 12086 at net/mac80211/iface.c:113 ieee80211_recalc_idle+0x298/0x338 net/mac80211/iface.c:149
Modules linked in:
CPU: 1 PID: 12086 Comm: syz.4.1912 Tainted: G        W          6.1.147-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/18/2025
pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : __ieee80211_recalc_idle net/mac80211/iface.c:113 [inline]
pc : ieee80211_recalc_idle+0x298/0x338 net/mac80211/iface.c:149
lr : __ieee80211_recalc_idle net/mac80211/iface.c:113 [inline]
lr : ieee80211_recalc_idle+0x298/0x338 net/mac80211/iface.c:149
sp : ffff800021166fa0
x29: ffff800021166fa0 x28: 0000000000000000 x27: ffff8000150b0000
x26: ffff0000ca1eaa20 x25: 0000000000000000 x24: dfff800000000000
x23: 000000000000096c x22: 1fffe000197b11db x21: dfff800000000000
x20: 0000000000000000 x19: ffff0000cbd88ea0 x18: ffff800011aabce0
x17: 1fffe00033eddf7e x16: ffff8000082d0ec4 x15: 0000000000000002
x14: 0000000000000007 x13: 1ffff00002a160b1 x12: 0000000000080000
x11: 000000000007ffff x10: ffff80002aca5000 x9 : ffff8000111bc040
x8 : 0000000000080000 x7 : ffff80001115c2a4 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000002
x2 : 0000000000000008 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
 __ieee80211_recalc_idle net/mac80211/iface.c:113 [inline]
 ieee80211_recalc_idle+0x298/0x338 net/mac80211/iface.c:149
 ieee80211_del_chanctx+0x35c/0x710 net/mac80211/chan.c:750
 ieee80211_free_chanctx+0x250/0x334 net/mac80211/chan.c:761
 __ieee80211_link_release_channel+0x3d4/0x55c net/mac80211/chan.c:1800
 ieee80211_link_release_channel+0x130/0x19c net/mac80211/chan.c:2017
 ieee80211_link_stop+0x9c/0xc4 net/mac80211/link.c:72
 ieee80211_teardown_sdata net/mac80211/iface.c:847 [inline]
 ieee80211_if_change_type+0x1d8/0xc6c net/mac80211/iface.c:1987
 ieee80211_change_iface+0x68/0x400 net/mac80211/cfg.c:217
 rdev_change_virtual_intf net/wireless/rdev-ops.h:74 [inline]
 cfg80211_change_iface+0x718/0xf2c net/wireless/util.c:1207
 nl80211_set_interface+0x41c/0x6e8 net/wireless/nl80211.c:4209
 genl_family_rcv_msg_doit+0x1f8/0x2f4 net/netlink/genetlink.c:756
 genl_family_rcv_msg net/netlink/genetlink.c:833 [inline]
 genl_rcv_msg+0x444/0x62c net/netlink/genetlink.c:850
 netlink_rcv_skb+0x208/0x3c4 net/netlink/af_netlink.c:2511
 genl_rcv+0x38/0x50 net/netlink/genetlink.c:861
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x60c/0x824 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x6e8/0x9b0 net/netlink/af_netlink.c:1872
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg net/socket.c:730 [inline]
 ____sys_sendmsg+0x5b8/0x918 net/socket.c:2519
 ___sys_sendmsg net/socket.c:2573 [inline]
 __sys_sendmsg+0x25c/0x320 net/socket.c:2602
 __do_sys_sendmsg net/socket.c:2611 [inline]
 __se_sys_sendmsg net/socket.c:2609 [inline]
 __arm64_sys_sendmsg+0x80/0x94 net/socket.c:2609
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x1fc/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
irq event stamp: 3948
hardirqs last  enabled at (3947): [<ffff8000119476b4>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:84 [inline]
hardirqs last  enabled at (3947): [<ffff8000119476b4>] exit_to_kernel_mode+0xcc/0xfc arch/arm64/kernel/entry-common.c:94
hardirqs last disabled at (3948): [<ffff8000119455d8>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405
softirqs last  enabled at (3942): [<ffff8000081a9670>] softirq_handle_end kernel/softirq.c:439 [inline]
softirqs last  enabled at (3942): [<ffff8000081a9670>] handle_softirqs+0xaf8/0xc6c kernel/softirq.c:624
softirqs last disabled at (3901): [<ffff800008020164>] __do_softirq+0x14/0x20 kernel/softirq.c:630
---[ end trace 0000000000000000 ]---