From: syzbot <syzbot+8bd4574e8c52c48c2595@syzkaller.appspotmail.com>
To: johannes@sipsolutions.net, linux-kernel@vger.kernel.org,
linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [wireless?] WARNING in ieee80211_tx_skb_tid
Date: Sat, 06 Dec 2025 01:12:22 -0800 [thread overview]
Message-ID: <6933f376.a70a0220.38f243.001d.GAE@google.com> (raw)
In-Reply-To: <68a246ad.050a0220.e29e5.0077.GAE@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: d1d36025a617 Merge tag 'probes-v6.19' of git://git.kernel...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12b44992580000
kernel config: https://syzkaller.appspot.com/x/.config?x=eaa3e2adda258a7
dashboard link: https://syzkaller.appspot.com/bug?extid=8bd4574e8c52c48c2595
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14ad46c2580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11d0bc1a580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-d1d36025.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8198d2c1f670/vmlinux-d1d36025.xz
kernel image: https://storage.googleapis.com/syzbot-assets/51df1359897b/bzImage-d1d36025.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8bd4574e8c52c48c2595@syzkaller.appspotmail.com
------------[ cut here ]------------
WARNING: net/mac80211/tx.c:6303 at ieee80211_tx_skb_tid+0x3b4/0x470 net/mac80211/tx.c:6303, CPU#0: syz.0.18/5530
Modules linked in:
CPU: 0 UID: 0 PID: 5530 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:ieee80211_tx_skb_tid+0x3b4/0x470 net/mac80211/tx.c:6303
Code: f6 ce f6 e9 b1 fe ff ff e8 b9 da f1 f6 90 0f 0b 90 e9 e2 fe ff ff e8 ab da f1 f6 90 0f 0b 90 e9 2a fe ff ff e8 9d da f1 f6 90 <0f> 0b 90 e8 c4 e1 fd ff 31 ff 48 8b 34 24 ba 02 00 00 00 48 83 c4
RSP: 0018:ffffc90002a7f458 EFLAGS: 00010293
RAX: ffffffff8acf8083 RBX: ffffffff8acf7cff RCX: ffff888000f54980
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 00000000ffffffff R08: ffffffff8acf7cff R09: ffffffff8df41cc0
R10: dffffc0000000000 R11: ffffed10092eb486 R12: ffff88801c1b8d80
R13: 0000000000000000 R14: 0000000000000001 R15: dffffc0000000000
FS: 00005555853f1500(0000) GS:ffff88808d683000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000564770e69950 CR3: 0000000032ccf000 CR4: 0000000000352ef0
Call Trace:
<TASK>
ieee80211_tx_skb net/mac80211/ieee80211_i.h:2418 [inline]
mesh_plink_frame_tx+0x734/0xc10 net/mac80211/mesh_plink.c:354
mesh_plink_deactivate+0x18e/0x2f0 net/mac80211/mesh_plink.c:410
mesh_sta_cleanup+0x42/0x150 net/mac80211/mesh.c:171
__cleanup_single_sta net/mac80211/sta_info.c:167 [inline]
cleanup_single_sta+0x40f/0x660 net/mac80211/sta_info.c:192
__sta_info_flush+0x5e4/0x710 net/mac80211/sta_info.c:1683
sta_info_flush net/mac80211/sta_info.h:970 [inline]
ieee80211_do_stop+0x397/0x1f70 net/mac80211/iface.c:526
ieee80211_stop+0x1b1/0x240 net/mac80211/iface.c:828
__dev_close_many+0x344/0x6b0 net/core/dev.c:1756
__dev_close net/core/dev.c:1768 [inline]
__dev_change_flags+0x2be/0x680 net/core/dev.c:9732
netif_change_flags+0x88/0x1a0 net/core/dev.c:9797
dev_change_flags+0x130/0x260 net/core/dev_api.c:68
dev_ioctl+0x7b4/0x1150 net/core/dev_ioctl.c:842
sock_do_ioctl+0x22c/0x300 net/socket.c:1259
sock_ioctl+0x576/0x790 net/socket.c:1366
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fba6778f7c9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff8aa47b88 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fba679e5fa0 RCX: 00007fba6778f7c9
RDX: 0000200000000000 RSI: 0000000000008914 RDI: 0000000000000004
RBP: 00007fba67813f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fba679e5fa0 R14: 00007fba679e5fa0 R15: 0000000000000003
</TASK>
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
prev parent reply other threads:[~2025-12-06 9:12 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-08-17 21:16 [syzbot] [wireless?] WARNING in ieee80211_tx_skb_tid syzbot
2025-12-06 9:12 ` syzbot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6933f376.a70a0220.38f243.001d.GAE@google.com \
--to=syzbot+8bd4574e8c52c48c2595@syzkaller.appspotmail.com \
--cc=johannes@sipsolutions.net \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.