* [PATCH wireless] wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping
@ 2026-09-04 15:01 Johannes Berg
2026-09-06 6:53 ` [syzbot ci] " syzbot ci
2026-09-08 13:46 ` [PATCH wireless] " kernel test robot
0 siblings, 2 replies; 3+ messages in thread
From: Johannes Berg @ 2026-09-04 15:01 UTC (permalink / raw)
To: linux-wireless; +Cc: Johannes Berg, syzbot+b4aa2b672b18f1d4dc5f
From: Johannes Berg <johannes.berg@intel.com>
The code checks ->started for frames coming from wmediumd, but the
radio can be stopped after the check and before frame delivery,
causing mac80211 to hit the WARN_ON(!local->started).
Expand the mutex for this case and synchronise against it when the
radio is stopped to avoid being able to hit the warning with hwsim.
Assisted-by: LLM
Fixes: 7882513bacb1 ("mac80211_hwsim driver support userspace frame tx/rx")
Reported-by: syzbot+b4aa2b672b18f1d4dc5f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=b4aa2b672b18f1d4dc5f
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---
.../wireless/virtual/mac80211_hwsim_main.c | 33 ++++++++++++-------
1 file changed, 22 insertions(+), 11 deletions(-)
diff --git a/drivers/net/wireless/virtual/mac80211_hwsim_main.c b/drivers/net/wireless/virtual/mac80211_hwsim_main.c
index 02b6d81cccd1..7703d31d35de 100644
--- a/drivers/net/wireless/virtual/mac80211_hwsim_main.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim_main.c
@@ -2327,7 +2327,12 @@ static void mac80211_hwsim_stop(struct ieee80211_hw *hw, bool suspend)
struct sk_buff *skb;
int i;
- data->started = false;
+ /*
+ * Serialise against wmediumd userspace, so no more frames
+ * can be handed to mac80211 after this returns.
+ */
+ scoped_guard(mutex, &data->mutex)
+ data->started = false;
for (i = 0; i < ARRAY_SIZE(data->link_data); i++)
hrtimer_cancel(&data->link_data[i].beacon_timer);
@@ -6535,10 +6540,17 @@ static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2,
goto out;
}
+ /*
+ * Serialise against mac80211_hwsim_stop() - mac80211 doesn't allow
+ * frames reported while the HW is down, hence the ->started check
+ * must be under mutex.
+ */
+ mutex_lock(&data2->mutex);
+
/* check if radio is configured properly */
if ((data2->idle && !data2->tmp_chan) || !data2->started)
- goto out;
+ goto out_unlock;
/* A frame is received from user space */
memset(&rx_status, 0, sizeof(rx_status));
@@ -6557,22 +6569,18 @@ static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2,
iter_data.channel = ieee80211_get_channel(data2->hw->wiphy,
rx_status.freq);
if (!iter_data.channel)
- goto out;
+ goto out_unlock;
rx_status.band = iter_data.channel->band;
- mutex_lock(&data2->mutex);
if (!hwsim_chans_compat(iter_data.channel, channel)) {
ieee80211_iterate_active_interfaces_atomic(
data2->hw, IEEE80211_IFACE_ITER_NORMAL,
mac80211_hwsim_tx_iter, &iter_data);
- if (!iter_data.receive) {
- mutex_unlock(&data2->mutex);
- goto out;
- }
+ if (!iter_data.receive)
+ goto out_unlock;
}
- mutex_unlock(&data2->mutex);
} else if (!channel) {
- goto out;
+ goto out_unlock;
} else {
rx_status.freq = channel->center_freq;
rx_status.band = channel->band;
@@ -6580,7 +6588,7 @@ static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2,
rx_status.rate_idx = nla_get_u32(info->attrs[HWSIM_ATTR_RX_RATE]);
if (rx_status.rate_idx >= data2->hw->wiphy->bands[rx_status.band]->n_bitrates)
- goto out;
+ goto out_unlock;
rx_status.signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
hdr = (void *)skb->data;
@@ -6590,10 +6598,13 @@ static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2,
rx_status.boottime_ns = ktime_get_boottime_ns();
mac80211_hwsim_rx(data2, &rx_status, skb);
+ mutex_unlock(&data2->mutex);
return 0;
err:
pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
+out_unlock:
+ mutex_unlock(&data2->mutex);
out:
dev_kfree_skb(skb);
return -EINVAL;
--
2.55.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [syzbot ci] Re: wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping
2026-09-04 15:01 [PATCH wireless] wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping Johannes Berg
@ 2026-09-06 6:53 ` syzbot ci
2026-09-08 13:46 ` [PATCH wireless] " kernel test robot
1 sibling, 0 replies; 3+ messages in thread
From: syzbot ci @ 2026-09-06 6:53 UTC (permalink / raw)
To: johannes.berg, johannes, linux-wireless, syzbot; +Cc: syzbot, syzkaller-bugs
syzbot ci has tested the following series
[v1] wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping
https://lore.kernel.org/all/20260904170140.5f69a10d606b.I4a7921d00643f69e439c7a3b221d104f66a3dcdc@changeid
* [PATCH wireless] wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping
and found the following issue:
BUG: unable to handle kernel paging request in hwsim_cloned_frame_received_nl
Full report is available here:
https://ci.syzbot.org/series/219738fc-ed0e-47c8-8100-a5940fbc20b7
***
BUG: unable to handle kernel paging request in hwsim_cloned_frame_received_nl
tree: wireless-next
URL: https://kernel.googlesource.com/pub/scm/linux/kernel/git/wireless/wireless-next.git
base: 1b60ed34f712e9f606d80951f1586f4274ebadf1
arch: amd64
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
config: https://ci.syzbot.org/builds/f0e5a89a-2d3b-4813-b1a1-01cf1b6e2ce4/config
syz repro: https://ci.syzbot.org/findings/457734e4-6b31-48a4-9aa6-ac6a4c6d65ee/syz_repro
BUG: unable to handle page fault for address: 00000000000048d0
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 10ab48067 P4D 10ab48067 PUD 0
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
CPU: 1 UID: 0 PID: 5793 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:lock_release+0x85/0x3c0 kernel/locking/lockdep.c:5923
Code: 84 26 02 00 00 65 8b 05 71 68 f1 11 85 c0 0f 85 17 02 00 00 65 4c 8b 3d b1 23 f1 11 41 83 bf a4 0b 00 00 00 0f 85 01 02 00 00 <49> 81 3e e0 24 56 94 0f 84 f4 01 00 00 9c 5b fa 48 c7 c7 60 f2 48
RSP: 0018:ffffc900036ef418 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000004870 RCX: 8000000000000001
RDX: 0000000000000000 RSI: ffffffff8c6d9460 RDI: ffffffff8c6d9420
RBP: ffffc900036ef570 R08: ffffc900036ef60f R09: 0000000000000000
R10: ffffc900036ef5e0 R11: fffff520006ddec2 R12: ffff888171777aa4
R13: ffffffff873ae393 R14: 00000000000048d0 R15: ffff88810ccca580
FS: 00007fe9e40d46c0(0000) GS:ffff8882a8cd9000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000000048d0 CR3: 0000000113f11000 CR4: 0000000000352ef0
Call Trace:
<TASK>
__mutex_unlock_slowpath+0x88/0x900 kernel/locking/mutex.c:989
hwsim_cloned_frame_received_nl+0x363/0xcf0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:6607
genl_family_rcv_msg_doit+0x233/0x340 net/netlink/genetlink.c:1114
genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline]
genl_rcv_msg+0x614/0x7a0 net/netlink/genetlink.c:1209
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:800
__sock_sendmsg net/socket.c:815 [inline]
__sys_sendto+0x408/0x5a0 net/socket.c:2281
__do_sys_sendto net/socket.c:2288 [inline]
__se_sys_sendto net/socket.c:2284 [inline]
__x64_sys_sendto+0xde/0x100 net/socket.c:2284
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe9e315e98e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007fe9e40d2ea8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007fe9e40d46c0 RCX: 00007fe9e315e98e
RDX: 0000000000000034 RSI: 00007fe9e40d2fe0 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00007fe9e40d2f24 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 0000000000000000 R14: 00007fe9e40d2fe0 R15: 0000000000000000
</TASK>
Modules linked in:
CR2: 00000000000048d0
---[ end trace 0000000000000000 ]---
RIP: 0010:lock_release+0x85/0x3c0 kernel/locking/lockdep.c:5923
Code: 84 26 02 00 00 65 8b 05 71 68 f1 11 85 c0 0f 85 17 02 00 00 65 4c 8b 3d b1 23 f1 11 41 83 bf a4 0b 00 00 00 0f 85 01 02 00 00 <49> 81 3e e0 24 56 94 0f 84 f4 01 00 00 9c 5b fa 48 c7 c7 60 f2 48
RSP: 0018:ffffc900036ef418 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000004870 RCX: 8000000000000001
RDX: 0000000000000000 RSI: ffffffff8c6d9460 RDI: ffffffff8c6d9420
RBP: ffffc900036ef570 R08: ffffc900036ef60f R09: 0000000000000000
R10: ffffc900036ef5e0 R11: fffff520006ddec2 R12: ffff888171777aa4
R13: ffffffff873ae393 R14: 00000000000048d0 R15: ffff88810ccca580
FS: 00007fe9e40d46c0(0000) GS:ffff8882a8cd9000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000000048d0 CR3: 0000000113f11000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
0: 84 26 test %ah,(%rsi)
2: 02 00 add (%rax),%al
4: 00 65 8b add %ah,-0x75(%rbp)
7: 05 71 68 f1 11 add $0x11f16871,%eax
c: 85 c0 test %eax,%eax
e: 0f 85 17 02 00 00 jne 0x22b
14: 65 4c 8b 3d b1 23 f1 mov %gs:0x11f123b1(%rip),%r15 # 0x11f123cd
1b: 11
1c: 41 83 bf a4 0b 00 00 cmpl $0x0,0xba4(%r15)
23: 00
24: 0f 85 01 02 00 00 jne 0x22b
* 2a: 49 81 3e e0 24 56 94 cmpq $0xffffffff945624e0,(%r14) <-- trapping instruction
31: 0f 84 f4 01 00 00 je 0x22b
37: 9c pushf
38: 5b pop %rbx
39: fa cli
3a: 48 rex.W
3b: c7 .byte 0xc7
3c: c7 (bad)
3d: 60 (bad)
3e: f2 repnz
3f: 48 rex.W
***
If these findings have caused you to resend the series or submit a
separate fix, please add the following tag to your commit message:
Tested-by: syzbot@syzkaller.appspotmail.com
---
This report is generated by a bot. It may contain errors.
syzbot ci engineers can be reached at syzkaller@googlegroups.com.
To test a fix for this bug, please reply with `#syz test`
(on a separate line) and attach the patch to the email.
Notes:
- The patch will be applied on top of the tested series (as an
incremental fix).
- To test a new version of the whole series, please send it directly
to syzbot@lists.linux.dev.
- Arguments like custom git repos and branches are not supported.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH wireless] wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping
2026-09-04 15:01 [PATCH wireless] wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping Johannes Berg
2026-09-06 6:53 ` [syzbot ci] " syzbot ci
@ 2026-09-08 13:46 ` kernel test robot
1 sibling, 0 replies; 3+ messages in thread
From: kernel test robot @ 2026-09-08 13:46 UTC (permalink / raw)
To: Johannes Berg, linux-wireless
Cc: llvm, oe-kbuild-all, Johannes Berg, syzbot+b4aa2b672b18f1d4dc5f
Hi Johannes,
kernel test robot noticed the following build warnings:
[auto build test WARNING on wireless-next/main]
[also build test WARNING on wireless/main linus/master v7.3-rc2 next-20260907]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Johannes-Berg/wifi-mac80211_hwsim-don-t-hand-frames-to-mac80211-while-stopping/20260904-170135
base: https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next.git main
patch link: https://lore.kernel.org/r/20260904170140.5f69a10d606b.I4a7921d00643f69e439c7a3b221d104f66a3dcdc%40changeid
patch subject: [PATCH wireless] wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping
config: sparc64-allmodconfig (https://download.01.org/0day-ci/archive/20260908/202609082134.nNCnnJQL-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260908/202609082134.nNCnnJQL-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202609082134.nNCnnJQL-lkp@intel.com/
All warnings (new ones prefixed by >>):
>> drivers/net/wireless/virtual/mac80211_hwsim_main.c:6517:6: warning: variable 'data2' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
6517 | if (skb == NULL)
| ^~~~~~~~~~~
drivers/net/wireless/virtual/mac80211_hwsim_main.c:6607:16: note: uninitialized use occurs here
6607 | mutex_unlock(&data2->mutex);
| ^~~~~
drivers/net/wireless/virtual/mac80211_hwsim_main.c:6517:2: note: remove the 'if' if its condition is always false
6517 | if (skb == NULL)
| ^~~~~~~~~~~~~~~~
6518 | goto err;
| ~~~~~~~~
drivers/net/wireless/virtual/mac80211_hwsim_main.c:6511:6: warning: variable 'data2' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
6511 | if (frame_data_len < sizeof(struct ieee80211_hdr_3addr) ||
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
6512 | frame_data_len > IEEE80211_MAX_DATA_LEN)
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/net/wireless/virtual/mac80211_hwsim_main.c:6607:16: note: uninitialized use occurs here
6607 | mutex_unlock(&data2->mutex);
| ^~~~~
drivers/net/wireless/virtual/mac80211_hwsim_main.c:6511:2: note: remove the 'if' if its condition is always false
6511 | if (frame_data_len < sizeof(struct ieee80211_hdr_3addr) ||
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
6512 | frame_data_len > IEEE80211_MAX_DATA_LEN)
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
6513 | goto err;
| ~~~~~~~~
>> drivers/net/wireless/virtual/mac80211_hwsim_main.c:6511:6: warning: variable 'data2' is used uninitialized whenever '||' condition is true [-Wsometimes-uninitialized]
6511 | if (frame_data_len < sizeof(struct ieee80211_hdr_3addr) ||
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/net/wireless/virtual/mac80211_hwsim_main.c:6607:16: note: uninitialized use occurs here
6607 | mutex_unlock(&data2->mutex);
| ^~~~~
drivers/net/wireless/virtual/mac80211_hwsim_main.c:6511:6: note: remove the '||' if its condition is always false
6511 | if (frame_data_len < sizeof(struct ieee80211_hdr_3addr) ||
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/net/wireless/virtual/mac80211_hwsim_main.c:6492:35: note: initialize the variable 'data2' to silence this warning
6492 | struct mac80211_hwsim_data *data2;
| ^
| = NULL
3 warnings generated.
vim +6517 drivers/net/wireless/virtual/mac80211_hwsim_main.c
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6488
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6489 static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2,
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6490 struct genl_info *info)
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6491 {
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6492 struct mac80211_hwsim_data *data2;
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6493 struct ieee80211_rx_status rx_status;
05d610af3e71a78 drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2019-07-29 6494 struct ieee80211_hdr *hdr;
9ddd12af103f60f drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2014-01-06 6495 const u8 *dst;
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6496 int frame_data_len;
9ddd12af103f60f drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2014-01-06 6497 void *frame_data;
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6498 struct sk_buff *skb = NULL;
626c30f9e773543 drivers/net/wireless/mac80211_hwsim.c Weilun Du 2021-05-06 6499 struct ieee80211_channel *channel = NULL;
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6500
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6501 if (!info->attrs[HWSIM_ATTR_ADDR_RECEIVER] ||
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6502 !info->attrs[HWSIM_ATTR_FRAME] ||
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6503 !info->attrs[HWSIM_ATTR_RX_RATE] ||
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6504 !info->attrs[HWSIM_ATTR_SIGNAL])
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6505 goto out;
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6506
9ddd12af103f60f drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2014-01-06 6507 dst = (void *)nla_data(info->attrs[HWSIM_ATTR_ADDR_RECEIVER]);
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6508 frame_data_len = nla_len(info->attrs[HWSIM_ATTR_FRAME]);
9ddd12af103f60f drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2014-01-06 6509 frame_data = (void *)nla_data(info->attrs[HWSIM_ATTR_FRAME]);
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6510
fba360a047d5eee drivers/net/wireless/virtual/mac80211_hwsim.c Johannes Berg 2023-08-15 @6511 if (frame_data_len < sizeof(struct ieee80211_hdr_3addr) ||
fba360a047d5eee drivers/net/wireless/virtual/mac80211_hwsim.c Johannes Berg 2023-08-15 6512 frame_data_len > IEEE80211_MAX_DATA_LEN)
fba360a047d5eee drivers/net/wireless/virtual/mac80211_hwsim.c Johannes Berg 2023-08-15 6513 goto err;
fba360a047d5eee drivers/net/wireless/virtual/mac80211_hwsim.c Johannes Berg 2023-08-15 6514
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6515 /* Allocate new skb here */
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6516 skb = alloc_skb(frame_data_len, GFP_KERNEL);
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 @6517 if (skb == NULL)
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6518 goto err;
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6519
9ddd12af103f60f drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2014-01-06 6520 /* Copy the data */
59ae1d127ac0ae4 drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2017-06-16 6521 skb_put_data(skb, frame_data, frame_data_len);
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6522
9ddd12af103f60f drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2014-01-06 6523 data2 = get_hwsim_data_ref_from_addr(dst);
9ddd12af103f60f drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2014-01-06 6524 if (!data2)
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6525 goto out;
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6526
626c30f9e773543 drivers/net/wireless/mac80211_hwsim.c Weilun Du 2021-05-06 6527 if (data2->use_chanctx) {
626c30f9e773543 drivers/net/wireless/mac80211_hwsim.c Weilun Du 2021-05-06 6528 if (data2->tmp_chan)
626c30f9e773543 drivers/net/wireless/mac80211_hwsim.c Weilun Du 2021-05-06 6529 channel = data2->tmp_chan;
626c30f9e773543 drivers/net/wireless/mac80211_hwsim.c Weilun Du 2021-05-06 6530 } else {
626c30f9e773543 drivers/net/wireless/mac80211_hwsim.c Weilun Du 2021-05-06 6531 channel = data2->channel;
626c30f9e773543 drivers/net/wireless/mac80211_hwsim.c Weilun Du 2021-05-06 6532 }
626c30f9e773543 drivers/net/wireless/mac80211_hwsim.c Weilun Du 2021-05-06 6533
5d44fe7c9808c56 drivers/net/wireless/mac80211_hwsim.c Erel Geron 2020-03-05 6534 if (!hwsim_virtio_enabled) {
5d44fe7c9808c56 drivers/net/wireless/mac80211_hwsim.c Erel Geron 2020-03-05 6535 if (hwsim_net_get_netgroup(genl_info_net(info)) !=
5d44fe7c9808c56 drivers/net/wireless/mac80211_hwsim.c Erel Geron 2020-03-05 6536 data2->netgroup)
f21e4d8ed16bb9c drivers/net/wireless/mac80211_hwsim.c Martin Willi 2016-05-14 6537 goto out;
f21e4d8ed16bb9c drivers/net/wireless/mac80211_hwsim.c Martin Willi 2016-05-14 6538
f21e4d8ed16bb9c drivers/net/wireless/mac80211_hwsim.c Martin Willi 2016-05-14 6539 if (info->snd_portid != data2->wmediumd)
f21e4d8ed16bb9c drivers/net/wireless/mac80211_hwsim.c Martin Willi 2016-05-14 6540 goto out;
5d44fe7c9808c56 drivers/net/wireless/mac80211_hwsim.c Erel Geron 2020-03-05 6541 }
f21e4d8ed16bb9c drivers/net/wireless/mac80211_hwsim.c Martin Willi 2016-05-14 6542
a3658dbd0b37b9d drivers/net/wireless/virtual/mac80211_hwsim_main.c Johannes Berg 2026-09-04 6543 /*
a3658dbd0b37b9d drivers/net/wireless/virtual/mac80211_hwsim_main.c Johannes Berg 2026-09-04 6544 * Serialise against mac80211_hwsim_stop() - mac80211 doesn't allow
a3658dbd0b37b9d drivers/net/wireless/virtual/mac80211_hwsim_main.c Johannes Berg 2026-09-04 6545 * frames reported while the HW is down, hence the ->started check
a3658dbd0b37b9d drivers/net/wireless/virtual/mac80211_hwsim_main.c Johannes Berg 2026-09-04 6546 * must be under mutex.
a3658dbd0b37b9d drivers/net/wireless/virtual/mac80211_hwsim_main.c Johannes Berg 2026-09-04 6547 */
a3658dbd0b37b9d drivers/net/wireless/virtual/mac80211_hwsim_main.c Johannes Berg 2026-09-04 6548 mutex_lock(&data2->mutex);
a3658dbd0b37b9d drivers/net/wireless/virtual/mac80211_hwsim_main.c Johannes Berg 2026-09-04 6549
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6550 /* check if radio is configured properly */
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6551
626c30f9e773543 drivers/net/wireless/mac80211_hwsim.c Weilun Du 2021-05-06 6552 if ((data2->idle && !data2->tmp_chan) || !data2->started)
a3658dbd0b37b9d drivers/net/wireless/virtual/mac80211_hwsim_main.c Johannes Berg 2026-09-04 6553 goto out_unlock;
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6554
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6555 /* A frame is received from user space */
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6556 memset(&rx_status, 0, sizeof(rx_status));
641cf2a5ba0345c drivers/net/wireless/mac80211_hwsim.c Adam Welle 2015-12-01 6557 if (info->attrs[HWSIM_ATTR_FREQ]) {
4f4b0f4eed556c9 drivers/net/wireless/virtual/mac80211_hwsim_main.c Benjamin Berg 2026-05-06 6558 struct tx_iter_data iter_data = {
4f4b0f4eed556c9 drivers/net/wireless/virtual/mac80211_hwsim_main.c Benjamin Berg 2026-05-06 6559 .hw = data2->hw,
4f4b0f4eed556c9 drivers/net/wireless/virtual/mac80211_hwsim_main.c Benjamin Berg 2026-05-06 6560 .rx_status = &rx_status,
4f4b0f4eed556c9 drivers/net/wireless/virtual/mac80211_hwsim_main.c Benjamin Berg 2026-05-06 6561 };
c204d9df02020e2 drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2022-07-20 6562
641cf2a5ba0345c drivers/net/wireless/mac80211_hwsim.c Adam Welle 2015-12-01 6563 /* throw away off-channel packets, but allow both the temporary
c204d9df02020e2 drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2022-07-20 6564 * ("hw" scan/remain-on-channel), regular channels and links,
c204d9df02020e2 drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2022-07-20 6565 * since the internal datapath also allows this
4f86ed8f87c07b3 drivers/net/wireless/mac80211_hwsim.c Ben Greear 2014-10-27 6566 */
641cf2a5ba0345c drivers/net/wireless/mac80211_hwsim.c Adam Welle 2015-12-01 6567 rx_status.freq = nla_get_u32(info->attrs[HWSIM_ATTR_FREQ]);
641cf2a5ba0345c drivers/net/wireless/mac80211_hwsim.c Adam Welle 2015-12-01 6568
c204d9df02020e2 drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2022-07-20 6569 iter_data.channel = ieee80211_get_channel(data2->hw->wiphy,
c204d9df02020e2 drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2022-07-20 6570 rx_status.freq);
c204d9df02020e2 drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2022-07-20 6571 if (!iter_data.channel)
a3658dbd0b37b9d drivers/net/wireless/virtual/mac80211_hwsim_main.c Johannes Berg 2026-09-04 6572 goto out_unlock;
c087f9fcd0fb534 drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2022-09-02 6573 rx_status.band = iter_data.channel->band;
c204d9df02020e2 drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2022-07-20 6574
c204d9df02020e2 drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2022-07-20 6575 if (!hwsim_chans_compat(iter_data.channel, channel)) {
c204d9df02020e2 drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2022-07-20 6576 ieee80211_iterate_active_interfaces_atomic(
c204d9df02020e2 drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2022-07-20 6577 data2->hw, IEEE80211_IFACE_ITER_NORMAL,
c204d9df02020e2 drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2022-07-20 6578 mac80211_hwsim_tx_iter, &iter_data);
a3658dbd0b37b9d drivers/net/wireless/virtual/mac80211_hwsim_main.c Johannes Berg 2026-09-04 6579 if (!iter_data.receive)
a3658dbd0b37b9d drivers/net/wireless/virtual/mac80211_hwsim_main.c Johannes Berg 2026-09-04 6580 goto out_unlock;
641cf2a5ba0345c drivers/net/wireless/mac80211_hwsim.c Adam Welle 2015-12-01 6581 }
c087f9fcd0fb534 drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2022-09-02 6582 } else if (!channel) {
a3658dbd0b37b9d drivers/net/wireless/virtual/mac80211_hwsim_main.c Johannes Berg 2026-09-04 6583 goto out_unlock;
641cf2a5ba0345c drivers/net/wireless/mac80211_hwsim.c Adam Welle 2015-12-01 6584 } else {
626c30f9e773543 drivers/net/wireless/mac80211_hwsim.c Weilun Du 2021-05-06 6585 rx_status.freq = channel->center_freq;
c087f9fcd0fb534 drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2022-09-02 6586 rx_status.band = channel->band;
641cf2a5ba0345c drivers/net/wireless/mac80211_hwsim.c Adam Welle 2015-12-01 6587 }
641cf2a5ba0345c drivers/net/wireless/mac80211_hwsim.c Adam Welle 2015-12-01 6588
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6589 rx_status.rate_idx = nla_get_u32(info->attrs[HWSIM_ATTR_RX_RATE]);
1833b6f46d7e283 drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2022-10-05 6590 if (rx_status.rate_idx >= data2->hw->wiphy->bands[rx_status.band]->n_bitrates)
a3658dbd0b37b9d drivers/net/wireless/virtual/mac80211_hwsim_main.c Johannes Berg 2026-09-04 6591 goto out_unlock;
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6592 rx_status.signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6593
05d610af3e71a78 drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2019-07-29 6594 hdr = (void *)skb->data;
05d610af3e71a78 drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2019-07-29 6595
05d610af3e71a78 drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2019-07-29 6596 if (ieee80211_is_beacon(hdr->frame_control) ||
05d610af3e71a78 drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2019-07-29 6597 ieee80211_is_probe_resp(hdr->frame_control))
05d610af3e71a78 drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2019-07-29 6598 rx_status.boottime_ns = ktime_get_boottime_ns();
05d610af3e71a78 drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2019-07-29 6599
b1622adaa55541f drivers/net/wireless/mac80211_hwsim.c Johannes Berg 2022-09-02 6600 mac80211_hwsim_rx(data2, &rx_status, skb);
a3658dbd0b37b9d drivers/net/wireless/virtual/mac80211_hwsim_main.c Johannes Berg 2026-09-04 6601 mutex_unlock(&data2->mutex);
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6602
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6603 return 0;
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6604 err:
62b093b375e3c10 drivers/net/wireless/mac80211_hwsim.c Lubomir Rintel 2017-09-18 6605 pr_debug("mac80211_hwsim: error occurred in %s\n", __func__);
a3658dbd0b37b9d drivers/net/wireless/virtual/mac80211_hwsim_main.c Johannes Berg 2026-09-04 6606 out_unlock:
a3658dbd0b37b9d drivers/net/wireless/virtual/mac80211_hwsim_main.c Johannes Berg 2026-09-04 6607 mutex_unlock(&data2->mutex);
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6608 out:
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6609 dev_kfree_skb(skb);
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6610 return -EINVAL;
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6611 }
7882513bacb176a drivers/net/wireless/mac80211_hwsim.c Javier Lopez 2011-06-01 6612
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-09-08 13:47 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-04 15:01 [PATCH wireless] wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping Johannes Berg
2026-09-06 6:53 ` [syzbot ci] " syzbot ci
2026-09-08 13:46 ` [PATCH wireless] " kernel test robot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).