For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: Private message regarding: [syzbot] [wireless?] WARNING in drv_get_tsf (2)
Author: kapoorarnav43@gmail.com
#syz test
From 0cd0a5cff75a12d3cf1fa0675950ef0dcc647799 Mon Sep 17 00:00:00 2001
From: Arnav Kapoor <kapoorarnav43@gmail.com>
Date: Mon, 19 Jan 2026 03:03:18 +0530
Subject: [PATCH] mac80211: Fix WARNING in drv_get_tsf debugfs access
The debugfs tsf read function was calling drv_get_tsf() even when the
interface was not registered with the driver, causing a WARN_ON to be
triggered. This is inappropriate for debugfs access.
Fix this by checking the IEEE80211_SDATA_IN_DRIVER flag in the debugfs
read function and returning -1ULL directly when the interface is not
in the driver, avoiding the warning.
Reported-by: syzbot+15f88dfa580000@syzkaller.appspotmail.com
Signed-off-by: Arnav Rawat <arnavrawat2000@gmail.com>
---
net/mac80211/debugfs_netdev.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 30a5a978a..669e7c519 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -656,7 +656,10 @@ static ssize_t ieee80211_if_fmt_tsf(
struct ieee80211_local *local = sdata->local;
u64 tsf;
- tsf = drv_get_tsf(local, (struct ieee80211_sub_if_data *)sdata);
+ if (!(sdata->flags & IEEE80211_SDATA_IN_DRIVER))
+ tsf = -1ULL;
+ else
+ tsf = drv_get_tsf(local, (struct ieee80211_sub_if_data
*)sdata);
return scnprintf(buf, buflen, "0x%016llx\n", (unsigned long long)
tsf);
}
--
2.43.0
On Monday, 19 January 2026 at 04:05:04 UTC+5:30 syzbot wrote:
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
net/mac80211/debugfs_netdev.c:662:70: error: expected ')' before 'return'
net/mac80211/debugfs_netdev.c:665:1: error: expected expression before '}'
token
net/mac80211/debugfs_netdev.c:664:80: error: expected ';' before '}' token
net/mac80211/debugfs_netdev.c:665:1: error: no return statement in function
returning non-void [-Werror=return-type]
Tested on:
commit: e84d9601 Merge tag 'for-6.19-rc5-tag' of git://git.ker..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=ae589cd0a6acd9be
dashboard link: https://syzkaller.appspot.com/bug?extid=2cecf0e829ae2219d419
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for
Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=13ff6b9a580000