From nobody Sat Feb 7 21:16:11 2026 Received: from mail-oi1-f207.google.com (mail-oi1-f207.google.com [209.85.167.207]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 081A21F4CBB for ; Sun, 18 Jan 2026 21:37:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.207 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768772281; cv=none; b=qb1zaDcD9QQX0tPkkj3rdooPaxsv7BU5gU20u4urtmeshRwUo86Q/wjoFTMC4IoFlg0fh5xl3y7FNFNElF4Um7kEZh9oeisd3OR3hA1Rml5y8CuROrfIxQjgLSAdfOELuwd2rZoq9qvX+Rw62ErSIlTDTswwjvJR9tubw1WTcu0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768772281; c=relaxed/simple; bh=oX7vbynPAjrsKK/RkwhoBC2rKDKSeag37IssylGBrLs=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=bHHh2+Iwkxd+OMvAj6y1pQVkhWkUUYB3W1rJ5EpQ0V71oyhwoIAhAjt268OF1IiDACl6KcPGrQRc45yL5ZTzQiZmyON6P/Z3aUiFQlSjyAZNRt7eJ1TjW/yqOHOJQCOTclcWthDDmteFljZiQHdU16IsAyFXg0oD+555qFSy9sk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.167.207 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oi1-f207.google.com with SMTP id 5614622812f47-45ca4a13da3so4683084b6e.2 for ; Sun, 18 Jan 2026 13:37:59 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768772279; x=1769377079; h=to:from:subject:message-id:in-reply-to:date:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=bTm0EElDbCfmRCzGUstHm8BOg0pncr4fQC6ly+NnpyY=; b=hLFK155K+7H/qj8AFtniqOAEHiWTNa+EirhzC39cAntiLlq8BbcSyeDGRBJZlg1fAh 54El8P9uxZ6xLXkWN5zNoGBM+9ToahUx6KZxMYOy2FtCXseMjOryausN3kusRcdsn4vl vfVNuP9UuTkHpN5UgGDL9DMB73LQBGBeponjshNbffecxqRH8143I34T57tcHE7Lc78P ArlZ7qLGw+XHaZgfflYBZI0OF7zW6Q/rm0cNHGjigwvDdSH126CVVtVwq9r1KOAtZyMh r8mkpm6ZCPSEFzabyE8KYNKA90nqlHbpU1ndi0o0+IMrPyrp6IWJy2bGFmIx9O3zRvQA PPXw== X-Gm-Message-State: AOJu0Yyyr+OlkoiwPN004ShnKGizNtNLEpS6A/2N2cPlJIGkRPsMCqtA UpWJSQNuuhIdhOG/WcVrwerMBUUi8i2O6binPYZEUmZlCYk5vTkXgSnkL6KRZIQ46S/VwNSTokb oP0GmCgb4TZAEA8PW3PuhgdPqP15H8vklfQV+WwZZ9+tZTsoL60wJpUftsCm9mg== Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6820:1c89:b0:65f:22fe:6ff8 with SMTP id 006d021491bc7-661179c212emr4209779eaf.47.1768772278969; Sun, 18 Jan 2026 13:37:58 -0800 (PST) Date: Sun, 18 Jan 2026 13:37:58 -0800 In-Reply-To: <696d4ffd.050a0220.3390f1.0024.GAE@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <696d52b6.050a0220.3390f1.0025.GAE@google.com> Subject: Forwarded: Private message regarding: [syzbot] [wireless?] WARNING in drv_get_tsf (2) From: syzbot To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: Private message regarding: [syzbot] [wireless?] WARNING in drv_get= _tsf (2) Author: kapoorarnav43@gmail.com #syz test commit 0cd0a5cff75a12d3cf1fa0675950ef0dcc647799 (HEAD -> master) Author: Arnav Kapoor Date: Mon Jan 19 03:03:18 2026 +0530 mac80211: Fix WARNING in drv_get_tsf debugfs access =20 The debugfs tsf read function was calling drv_get_tsf() even when the interface was not registered with the driver, causing a WARN_ON to be triggered. This is inappropriate for debugfs access. =20 Fix this by checking the IEEE80211_SDATA_IN_DRIVER flag in the debugfs read function and returning -1ULL directly when the interface is not in the driver, avoiding the warning. =20 Reported-by: syzbot+15f88dfa580000@syzkaller.appspotmail.com Signed-off-by: Arnav Kapoor diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c index 30a5a978a..669e7c519 100644 Reported-by: syzbot+2cecf0...@syzkaller.appspotmail.com=20 --- a/net/mac80211/debugfs_netdev.c +++ b/net/mac80211/debugfs_netdev.c @@ -656,7 +656,10 @@ static ssize_t ieee80211_if_fmt_tsf( struct ieee80211_local *local =3D sdata->local; u64 tsf; =20 - tsf =3D drv_get_tsf(local, (struct ieee80211_sub_if_data *)sdata); + if (!(sdata->flags & IEEE80211_SDATA_IN_DRIVER)) + tsf =3D -1ULL; + else + tsf =3D drv_get_tsf(local, (struct ieee80211_sub_if_data=20 *)sdata); =20 return scnprintf(buf, buflen, "0x%016llx\n", (unsigned long long)=20 tsf); } On Monday, 19 January 2026 at 02:56:22 UTC+5:30 syzbot wrote: Hello,=20 syzbot found the following issue on:=20 HEAD commit: 944aacb68baf Merge tag 'scsi-fixes' of git://git.kernel.or..=20 git tree: upstream=20 console output: https://syzkaller.appspot.com/x/log.txt?x=3D15f88dfa580000=20 kernel config: https://syzkaller.appspot.com/x/.config?x=3Dae589cd0a6acd9be=20 dashboard link: https://syzkaller.appspot.com/bug?extid=3D2cecf0e829ae2219d= 419=20 compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for=20 Debian) 2.40=20 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=3D16259d9a580000=20 Downloadable assets:=20 disk image:=20 https://storage.googleapis.com/syzbot-assets/1971a9dd2936/disk-944aacb6.raw= .xz=20 vmlinux:=20 https://storage.googleapis.com/syzbot-assets/cf50ec150c97/vmlinux-944aacb6.= xz=20 kernel image:=20 https://storage.googleapis.com/syzbot-assets/eee3d7722c03/bzImage-944aacb6.= xz=20 IMPORTANT: if you fix the issue, please add the following tag to the=20 commit:=20 Reported-by: syzbot+2cecf0...@syzkaller.appspotmail.com=20 ------------[ cut here ]------------=20 wlan1: Failed check-sdata-in-driver check, flags: 0x0=20 WARNING: net/mac80211/driver-ops.c:255 at drv_get_tsf+0x187/0x6f0=20 net/mac80211/driver-ops.c:255, CPU#0: kworker/u8:11/3538=20 Modules linked in:=20 CPU: 0 UID: 0 PID: 3538 Comm: kworker/u8:11 Not tainted syzkaller #0=20 PREEMPT(full)=20 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS=20 Google 10/25/2025=20 Workqueue: events_unbound cfg80211_wiphy_work=20 RIP: 0010:drv_get_tsf+0x18d/0x6f0 net/mac80211/driver-ops.c:255=20 Code: 0a 00 00 4d 85 e4 0f 84 95 04 00 00 e8 8c 9a dc f6 49 81 c4 20 01 00=20 00 e8 80 9a dc f6 48 8d 3d 49 e9 b6 05 44 89 f2 4c 89 e6 <67> 48 0f b9 3a=20 e8 69 9a dc f6 4c 89 ea 48 b8 00 00 00 00 00 fc ff=20 RSP: 0018:ffffc9000c49fb08 EFLAGS: 00010293=20 RAX: 0000000000000000 RBX: ffff88805c0c4d80 RCX: ffffffff8ae1c32f=20 RDX: 0000000000000000 RSI: ffff88805c0c4120 RDI: ffffffff9098acd0=20 RBP: ffff888031cc8e80 R08: 0000000000000005 R09: 0000000000000000=20 R10: 0000000000000000 R11: ffff88803190c830 R12: ffff88805c0c4120=20 R13: ffff88805c0c57b8 R14: 0000000000000000 R15: ffff888031cc86d0=20 FS: 0000000000000000(0000) GS:ffff8881248f9000(0000) knlGS:0000000000000000=20 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033=20 CR2: 00007f239b3156c0 CR3: 0000000075ed0000 CR4: 00000000003526f0=20 Call Trace:=20 =20 ieee80211_if_fmt_tsf+0x42/0x70 net/mac80211/debugfs_netdev.c:659=20 wiphy_locked_debugfs_read_work+0xe6/0x1c0 net/wireless/debugfs.c:168=20 cfg80211_wiphy_work+0x3fb/0x560 net/wireless/core.c:438=20 process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257=20 process_scheduled_works kernel/workqueue.c:3340 [inline]=20 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421=20 kthread+0x3c5/0x780 kernel/kthread.c:463=20 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158=20 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246=20 =20 ----------------=20 Code disassembly (best guess), 1 bytes skipped:=20 0: 00 00 add %al,(%rax)=20 2: 4d 85 e4 test %r12,%r12=20 5: 0f 84 95 04 00 00 je 0x4a0=20 b: e8 8c 9a dc f6 call 0xf6dc9a9c=20 10: 49 81 c4 20 01 00 00 add $0x120,%r12=20 17: e8 80 9a dc f6 call 0xf6dc9a9c=20 1c: 48 8d 3d 49 e9 b6 05 lea 0x5b6e949(%rip),%rdi # 0x5b6e96c=20 23: 44 89 f2 mov %r14d,%edx=20 26: 4c 89 e6 mov %r12,%rsi=20 * 29: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction=20 2e: e8 69 9a dc f6 call 0xf6dc9a9c=20 33: 4c 89 ea mov %r13,%rdx=20 36: 48 rex.W=20 37: b8 00 00 00 00 mov $0x0,%eax=20 3c: 00 fc add %bh,%ah=20 3e: ff .byte 0xff=20 ---=20 This report is generated by a bot. It may contain errors.=20 See https://goo.gl/tpsmEJ for more information about syzbot.=20 syzbot engineers can be reached at syzk...@googlegroups.com.=20 syzbot will keep track of this issue. See:=20 https://goo.gl/tpsmEJ#status for how to communicate with syzbot.=20 If the report is already addressed, let syzbot know by replying with:=20 #syz fix: exact-commit-title=20 If you want syzbot to run the reproducer, reply with:=20 #syz test: git://repo/address.git branch-or-commit-hash=20 If you attach or paste a git patch, syzbot will apply it before testing.=20 If you want to overwrite report's subsystems, reply with:=20 #syz set subsystems: new-subsystem=20 (See the list of subsystem names on the web dashboard)=20 If the report is a duplicate of another one, reply with:=20 #syz dup: exact-subject-of-another-report=20 If you want to undo deduplication, reply with:=20 #syz undup