[PATCH wireless] wifi: mac80211: clear beaconing state in ieee80211_do_stop()

[PATCH wireless] wifi: mac80211: clear beaconing state in ieee80211_do_stop()

[Hojun Choi]

ieee80211_do_stop() zeroes vif.bss_conf.beacon_int but, unlike
ieee80211_stop_ap(), ieee80211_ibss_disconnect() and
ieee80211_stop_mesh(), leaves enable_beacon set and the
SDATA_STATE_OFFCHANNEL_BEACON_STOPPED bit pending. cfg80211 rejects a
beacon interval below 10, so a zero interval comes from this teardown,
not from userspace.

do_stop() clears SDATA_STATE_RUNNING first, so nothing acts on the stale
state while the interface is down. But do_open() re-sets RUNNING without
restoring beacon_int or clearing enable_beacon and the bit, so the state
survives a down/up cycle. A later ieee80211_offchannel_return() on scan
completion then consumes the stale bit and re-enables beaconing while
beacon_int is still 0, and drivers arming a beacon timer from the
interval divide by zero. syzbot reported this as a divide error in
mac80211_hwsim_link_info_changed(); the exact sequence that leaves
do_stop() with beaconing still enabled was not reproduced.

Clear enable_beacon and the bit in ieee80211_do_stop() as well,
mirroring the other teardown paths, so the state cannot outlive the
interface. do_stop() warns on a vif that still has valid links, so MLD
links are already torn down here and only the deflink beacon_int is
zeroed; clearing the deflink enable_beacon is sufficient.

Fixes: d6a83228823f ("mac80211: track enable_beacon explicitly")
Reported-by: syzbot+ca7a2759caaa6cd4e3db@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ca7a2759caaa6cd4e3db
Link: https://lore.kernel.org/all/20251205153502.273426-1-dkarn@redhat.com/
Signed-off-by: Hojun Choi <ghwns6743@gmail.com>
---
 net/mac80211/iface.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 086272c3ec08..c070d47cb631 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -719,6 +719,10 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, bool going_do
 
 	sdata->vif.bss_conf.beacon_int = 0;
 
+	/* mirror stop_ap()/IBSS/mesh: also clear the beaconing state */
+	sdata->vif.bss_conf.enable_beacon = false;
+	clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
+
 	/*
 	 * If the interface goes down while suspended, presumably because
 	 * the device was unplugged and that happens before our resume,
-- 
2.54.0

Re: [PATCH wireless] wifi: mac80211: clear beaconing state in ieee80211_do_stop()

[Hojun Choi]

Following up with the concrete path, since the question is whether
cfg80211_leave() already covers this. It does not for AP start failure:
ieee80211_start_ap() sets enable_beacon before its fail-able steps, but
its error path (cfg.c:1930) only releases the channel, never clearing it
(unlike the IBSS/mesh paths), while cfg80211 leaves ap.beacon_interval at
0. A later interface-down then makes ___cfg80211_stop_ap() short-circuit
(-ENOENT, net/wireless/ap.c:30) and skip the stop_ap clear, so
ieee80211_do_stop() runs with enable_beacon still set. I could not get a
driver to fail start_ap() there, so this is by inspection, not a
reproducer.

I can fold this into the commit message in a v2, or instead fix the
producer by clearing enable_beacon on the start_ap() error path
(mirroring IBSS/mesh) - whichever you prefer. I used do_stop() since
you suggested it might need to clear that bit.

Thanks,
Hojun