* [PATCH 2/2] wifi: mac80211_hwsim: serialize radio removal with frame commands
2026-10-28 14:17 [PATCH 0/2] wifi: mac80211_hwsim: fix netlink release and radio removal races Zhao Li
2026-10-28 14:17 ` [PATCH 1/2] wifi: mac80211_hwsim: ignore non-generic netlink releases Zhao Li
@ 2026-10-28 14:17 ` Zhao Li
2026-10-29 8:38 ` [syzbot ci] Re: wifi: mac80211_hwsim: fix netlink release and radio removal races syzbot ci
2 siblings, 0 replies; 4+ messages in thread
From: Zhao Li @ 2026-10-28 14:17 UTC (permalink / raw)
To: Johannes Berg
Cc: John W. Linville, Javier Lopez, Jukka Rissanen, linux-wireless,
linux-kernel, stable
Destroying a radio while a frame, TX status, or PMSR command is in
progress can make the command access the radio after it has been freed.
The command handlers keep using the result of an RCU rhashtable lookup
after the lookup has finished. Socket release and network namespace
teardown can concurrently remove and free that radio.
Serialize non-dump generic netlink command handlers and asynchronous
removal paths with an hwsim-private mutex. Use the same serialization for
virtio dispatch, which invokes the handlers outside generic netlink.
LLM assistance was used to find the bug and review.
Fixes: e9ed49bf4c2c ("mac80211-hwsim: Add support for HWSIM_ATTR_DESTROY_RADIO_ON_CLOSE")
Cc: stable@vger.kernel.org
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
---
Validation: A W=1 module build with MODPOST passed. A forced
QEMU/KASAN race between HWSIM_CMD_FRAME and socket-close removal changed 13
unique use-after-free reports to 0, with no lockdep splat after the change.
Network-namespace, virtio, TX-status and PMSR paths were not run.
A reproducer is available on request.
Sparse C=2 passed. Targeted Smatch introduced no new diagnostics.
.../wireless/virtual/mac80211_hwsim_main.c | 25 +++++++++++++++++++
1 file changed, 25 insertions(+)
diff --git a/drivers/net/wireless/virtual/mac80211_hwsim_main.c b/drivers/net/wireless/virtual/mac80211_hwsim_main.c
index fcbc7f4355bd..61d0e2c1d00c 100644
--- a/drivers/net/wireless/virtual/mac80211_hwsim_main.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim_main.c
@@ -673,6 +673,7 @@ static const struct nl80211_vendor_cmd_info mac80211_hwsim_vendor_events[] = {
};
DEFINE_SPINLOCK(hwsim_radio_lock);
+static DEFINE_MUTEX(hwsim_radio_mutex);
LIST_HEAD(hwsim_radios);
static struct rhashtable hwsim_radios_rht;
static int hwsim_radio_idx;
@@ -6310,6 +6311,7 @@ static void mac80211_hwsim_free(void)
{
struct mac80211_hwsim_data *data;
+ mutex_lock(&hwsim_radio_mutex);
spin_lock_bh(&hwsim_radio_lock);
while ((data = list_first_entry_or_null(&hwsim_radios,
struct mac80211_hwsim_data,
@@ -6323,6 +6325,7 @@ static void mac80211_hwsim_free(void)
spin_lock_bh(&hwsim_radio_lock);
}
spin_unlock_bh(&hwsim_radio_lock);
+ mutex_unlock(&hwsim_radio_mutex);
class_unregister(&hwsim_class);
}
@@ -7153,12 +7156,28 @@ static const struct genl_small_ops hwsim_ops[] = {
},
};
+static int hwsim_genl_pre_doit(const struct genl_split_ops *ops,
+ struct sk_buff *skb, struct genl_info *info)
+{
+ mutex_lock(&hwsim_radio_mutex);
+
+ return 0;
+}
+
+static void hwsim_genl_post_doit(const struct genl_split_ops *ops,
+ struct sk_buff *skb, struct genl_info *info)
+{
+ mutex_unlock(&hwsim_radio_mutex);
+}
+
static struct genl_family hwsim_genl_family __ro_after_init = {
.name = "MAC80211_HWSIM",
.version = 1,
.maxattr = HWSIM_ATTR_MAX,
.policy = hwsim_genl_policy,
.netnsok = true,
+ .pre_doit = hwsim_genl_pre_doit,
+ .post_doit = hwsim_genl_post_doit,
.module = THIS_MODULE,
.small_ops = hwsim_ops,
.n_small_ops = ARRAY_SIZE(hwsim_ops),
@@ -7172,6 +7191,7 @@ static void remove_user_radios(u32 portid, int netgroup)
struct mac80211_hwsim_data *entry, *tmp;
LIST_HEAD(list);
+ mutex_lock(&hwsim_radio_mutex);
spin_lock_bh(&hwsim_radio_lock);
list_for_each_entry_safe(entry, tmp, &hwsim_radios, list) {
if (entry->destroy_on_close && entry->portid == portid &&
@@ -7189,6 +7209,7 @@ static void remove_user_radios(u32 portid, int netgroup)
mac80211_hwsim_del_radio(entry, wiphy_name(entry->hw->wiphy),
NULL);
}
+ mutex_unlock(&hwsim_radio_mutex);
}
static int mac80211_hwsim_netlink_notify(struct notifier_block *nb,
@@ -7248,6 +7269,7 @@ static void __net_exit hwsim_exit_net(struct net *net)
struct mac80211_hwsim_data *data, *tmp;
LIST_HEAD(list);
+ mutex_lock(&hwsim_radio_mutex);
spin_lock_bh(&hwsim_radio_lock);
list_for_each_entry_safe(data, tmp, &hwsim_radios, list) {
if (!net_eq(wiphy_net(data->hw->wiphy), net))
@@ -7270,6 +7292,7 @@ static void __net_exit hwsim_exit_net(struct net *net)
wiphy_name(data->hw->wiphy),
NULL);
}
+ mutex_unlock(&hwsim_radio_mutex);
ida_free(&hwsim_netgroup_ida, hwsim_net_get_netgroup(net));
}
@@ -7364,7 +7387,9 @@ static void hwsim_virtio_rx_work(struct work_struct *work)
skb_reset_tail_pointer(skb);
len = min(len, skb_end_offset(skb));
skb_put(skb, len);
+ mutex_lock(&hwsim_radio_mutex);
hwsim_virtio_handle_cmd(skb);
+ mutex_unlock(&hwsim_radio_mutex);
spin_lock_irqsave(&hwsim_virtio_lock, flags);
if (!hwsim_virtio_enabled) {
--
2.56.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* [syzbot ci] Re: wifi: mac80211_hwsim: fix netlink release and radio removal races
2026-10-28 14:17 [PATCH 0/2] wifi: mac80211_hwsim: fix netlink release and radio removal races Zhao Li
2026-10-28 14:17 ` [PATCH 1/2] wifi: mac80211_hwsim: ignore non-generic netlink releases Zhao Li
2026-10-28 14:17 ` [PATCH 2/2] wifi: mac80211_hwsim: serialize radio removal with frame commands Zhao Li
@ 2026-10-29 8:38 ` syzbot ci
2 siblings, 0 replies; 4+ messages in thread
From: syzbot ci @ 2026-10-29 8:38 UTC (permalink / raw)
To: enderaoelyther, jlopex, johannes, jukka.rissanen, linux-kernel,
linux-wireless, linville, stable
Cc: syzbot, syzkaller-bugs
syzbot ci has tested the following series
[v1] wifi: mac80211_hwsim: fix netlink release and radio removal races
https://lore.kernel.org/all/20261028141751.6728-1-enderaoelyther@gmail.com
* [PATCH 1/2] wifi: mac80211_hwsim: ignore non-generic netlink releases
* [PATCH 2/2] wifi: mac80211_hwsim: serialize radio removal with frame commands
and found the following issue:
INFO: task hung in mac80211_hwsim_netlink_notify
Full report is available here:
https://ci.syzbot.org/series/fe9cfff2-ef52-45eb-993c-ea84c287686d
***
INFO: task hung in mac80211_hwsim_netlink_notify
tree: wireless-next
URL: https://kernel.googlesource.com/pub/scm/linux/kernel/git/wireless/wireless-next.git
base: 864c07de0c7dcbca58b61625dfa2e461ae63b242
arch: amd64
compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
config: https://ci.syzbot.org/builds/ffa94119-c540-48f2-b244-f5fa2d9531b2/config
INFO: task syz-executor:21314 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D stack:22184 pid:21314 tgid:21314 ppid:1 task_flags:0x400140 flags:0x00080002
Call Trace:
<TASK>
__schedule+0x17dd/0x5820
schedule+0x164/0x2b0
schedule_preempt_disabled+0x13/0x30
__mutex_lock+0x7c4/0x15a0
mac80211_hwsim_netlink_notify+0x193/0x1140
notifier_call_chain+0x1a5/0x3d0
blocking_notifier_call_chain+0x6a/0x90
netlink_release+0x1211/0x1a90
__sock_release+0xa0/0x1f0
sock_close+0x1c/0x30
__fput+0x408/0xa40
fput_close_sync+0x11f/0x240
__se_sys_close+0xa2/0x160
do_syscall_64+0x166/0x520
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fed3715fd8e
RSP: 002b:00007fffadf594c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 000055557b013500 RCX: 00007fed3715fd8e
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005
RBP: 0000000000000005 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fed37f54670
R13: 0000000000000014 R14: 00007fed37f54864 R15: 00000000000001f4
</TASK>
Showing all locks held in the system:
locks held by kworker/u8:1/13: 3, on CPU#0:
#0: ffff888111e50148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
#1: ffffc90000127c40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
#2: ffffffff9125a680 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x116/0x15c0
locks held by khungtaskd/35: 1, last CPU#1:
#0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180
locks held by getty/5413: 2, on CPU#1:
#0: ffff88811659a0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70
#1: ffffc9000348b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360
locks held by kworker/u8:2/5484: 3, last CPU#0:
#0: ffff88810b983148 ((wq_completion)krds_cp_wq#3/0){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
#1: ffffc90004407c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
#2: ffff88811a039280 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920
locks held by kworker/u9:17/30931: 3, last CPU#1:
#0: ffff8881000ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
#1: ffffc90006befc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
#2: ffff888054278258 (&devlink->lock_key#13){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb30
locks held by kworker/u9:38/30947: 3, last CPU#1:
#0: ffff8881000ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
#1: ffffc9000765fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
#2: ffff888075278258 (&devlink->lock_key#12){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb30
locks held by kworker/u9:39/30948: 3, last CPU#1:
#0: ffff8881000ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
#1: ffffc9000768fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
#2: ffff88806cffd258 (&devlink->lock_key#5){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb30
locks held by kworker/u8:7/20795: 7, on CPU#0:
#0: ffff8881012dd948 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
#1: ffffc9000791fc40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
#2: ffffffff9124be48 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810
#3: ffffffff90a92d40 (hwsim_radio_mutex){+.+.}-{4:4}, at: hwsim_exit_net+0xc9/0xf70
#4: ffffffff9125a680 (rtnl_mutex){+.+.}-{4:4}, at: wiphy_unregister+0x26f/0xb20
#5: ffff888068390800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: wiphy_unregister+0x279/0xb20
#6: ffffffff8fd60328 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2cb/0x760
locks held by kworker/u8:8/20796: 2, last CPU#0:
#0: ffff888113926148 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
#1: ffffc9000793fc40 ((work_completion)(&(&bat_priv->dat.work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
locks held by syz-executor/21314: 3, on CPU#0:
#0: ffff8881bfaa2640 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x7a/0x1f0
#1: ffffffff912c9268 ((netlink_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x54/0x90
#2: ffffffff90a92d40 (hwsim_radio_mutex){+.+.}-{4:4}, at: mac80211_hwsim_netlink_notify+0x193/0x1140
locks held by kworker/0:5/21344: 3, on CPU#0:
#0: ffff88810006ad48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
#1: ffffc90003ed7c40 (netdev_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
#2: ffffffff9125a680 (rtnl_mutex){+.+.}-{4:4}, at: netdev_work_proc+0x6f/0x770
locks held by syz-executor/21396: 3, on CPU#0:
#0: ffff888112f5c440 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x7a/0x1f0
#1: ffffffff912c9268 ((netlink_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x54/0x90
#2: ffffffff90a92d40 (hwsim_radio_mutex){+.+.}-{4:4}, at: mac80211_hwsim_netlink_notify+0x193/0x1140
locks held by syz-executor/21403: 3, on CPU#1:
#0: ffff888013e16240 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x7a/0x1f0
#1: ffffffff912c9268 ((netlink_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x54/0x90
#2: ffffffff90a92d40 (hwsim_radio_mutex){+.+.}-{4:4}, at: mac80211_hwsim_netlink_notify+0x193/0x1140
locks held by syz-executor/21473: 3, on CPU#0:
#0: ffff8881a662e240 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x7a/0x1f0
#1: ffffffff912c9268 ((netlink_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x54/0x90
#2: ffffffff90a92d40 (hwsim_radio_mutex){+.+.}-{4:4}, at: mac80211_hwsim_netlink_notify+0x193/0x1140
locks held by syz-executor/21500: 3, on CPU#0:
#0: ffff88816a9b4440 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x7a/0x1f0
#1: ffffffff912c9268 ((netlink_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x54/0x90
#2: ffffffff90a92d40 (hwsim_radio_mutex){+.+.}-{4:4}, at: mac80211_hwsim_netlink_notify+0x193/0x1140
locks held by syz-executor/21503: 3, on CPU#1:
#0: ffff8881a652ee40 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x7a/0x1f0
#1: ffffffff912c9268 ((netlink_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x54/0x90
#2: ffffffff90a92d40 (hwsim_radio_mutex){+.+.}-{4:4}, at: mac80211_hwsim_netlink_notify+0x193/0x1140
locks held by syz-executor/21537: 3, on CPU#1:
#0: ffff8881bfaa5040 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x7a/0x1f0
#1: ffffffff912c9268 ((netlink_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x54/0x90
#2: ffffffff90a92d40 (hwsim_radio_mutex){+.+.}-{4:4}, at: mac80211_hwsim_netlink_notify+0x193/0x1140
locks held by syz-executor/21559: 7, on CPU#0:
#0: ffff888117068460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0
#1: ffff888120412c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540
#2: ffff88816bbcf4b8 (kn->active#49){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540
#3: ffffffff90ad1400 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: new_device_store+0x13c/0x6d0
#4: ffff8881c71ac128 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450
#5: ffff8881c71a9258 (&devlink->lock_key#14){+.+.}-{4:4}, at: nsim_drv_probe+0xfb/0xbb0
#6: ffffffff9125a680 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_dev_lock+0x257/0x2f0
locks held by syz-executor/21566: 3, last CPU#1:
#0: ffff88819720ac40 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x7a/0x1f0
#1: ffffffff912c9268 ((netlink_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x54/0x90
#2: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: nl80211_netlink_notify+0x75/0x860
locks held by kworker/u9:0/21570: 3, last CPU#1:
#0: ffff8881000ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
#1: ffffc90003e87c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
#2: ffff8881bbf09258 (&devlink->lock_key){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb30
locks held by syz-executor/21598: 2, on CPU#0:
#0: ffffffff909c0ba8 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250
#1: ffffffff9125a680 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc10/0x1c30
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 35 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150
nmi_cpu_backtrace+0x274/0x2d0
nmi_trigger_cpumask_backtrace+0x17d/0x390
sys_info+0x135/0x170
watchdog+0xfd2/0x1030
kthread+0x38b/0x480
ret_from_fork+0x514/0xb70
ret_from_fork_asm+0x1a/0x30
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 20796 Comm: kworker/u8:8 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Workqueue: bat_events batadv_dat_purge
RIP: 0010:native_apic_msr_write+0x39/0x50
Code: 74 2a 83 ff 30 74 25 eb 10 81 ff d0 00 00 00 74 1b 81 ff e0 00 00 00 74 13 c1 ef 04 81 c7 00 08 00 00 89 f9 89 f0 31 d2 0f 30 <66> 90 c3 cc cc cc cc cc 89 f6 31 d2 e9 e6 17 aa 03 66 0f 1f 44 00
RSP: 0018:ffffc90000007e50 EFLAGS: 00000046
RAX: 000000000000000f RBX: ffff888120e23f40 RCX: 0000000000000838
RDX: 0000000000000000 RSI: 000000000000000f RDI: 0000000000000838
RBP: ffffc90000007f10 R08: 0000000000000100 R09: 0000000000000001
R10: 0000000000000003 R11: ffffffff81758510 R12: ffffffff81758510
R13: 1ffff110241c47f1 R14: 0000000000000000 R15: ffff888120e23f8c
FS: 0000000000000000(0000) GS:ffff88818c4a4000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f85c76b3866 CR3: 0000000169088000 CR4: 00000000000006f0
Call Trace:
<IRQ>
lapic_next_event+0x11/0x20
clockevents_program_event+0x44e/0x630
hrtimer_run_softirq+0x255/0x2e0
handle_softirqs+0x265/0x8d0
do_softirq+0x77/0xd0
</IRQ>
<TASK>
__local_bh_enable_ip+0x100/0x140
batadv_dat_purge+0x2d7/0x3c0
process_scheduled_works+0xc3d/0x1630
worker_thread+0xa47/0xfb0
kthread+0x38b/0x480
ret_from_fork+0x514/0xb70
ret_from_fork_asm+0x1a/0x30
</TASK>
***
If these findings have caused you to resend the series or submit a
separate fix, please add the following tag to your commit message:
Tested-by: syzbot@syzkaller.appspotmail.com
---
This report is generated by a bot. It may contain errors.
syzbot ci engineers can be reached at syzkaller@googlegroups.com.
To test a fix for this bug, please reply with `#syz test`
(on a separate line) and attach the patch to the email.
Notes:
- The patch will be applied on top of the tested series (as an
incremental fix).
- To test a new version of the whole series, please send it directly
to syzbot@lists.linux.dev.
- Arguments like custom git repos and branches are not supported.
^ permalink raw reply [flat|nested] 4+ messages in thread