Re: [syzbot] [wireless?] divide error in mac80211_hwsim_link_info_changed (3)

[Arjan van de Ven <arjan@linux.intel.com>]

This email is created by automation to help kernel developers
deal with a large volume of AI generated bug reports by decoding
oopses into more actionable information.


Decoded Backtrace

1. mac80211_hwsim_link_info_changed -- crash site
   (drivers/net/wireless/virtual/mac80211_hwsim.c:2734)

2701  static void mac80211_hwsim_link_info_changed(struct ieee80211_hw *hw,
2702  					     struct ieee80211_vif *vif,
2703  					     struct ieee80211_bss_conf *info,
2704  					     u64 changed)
2705  {
2706  	struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
2707  	struct mac80211_hwsim_data *data = hw->priv;
2708  	unsigned int link_id = info->link_id;
2709  	struct mac80211_hwsim_link_data *link_data = &data->link_data[link_id];
        ...
2722  	if (changed & BSS_CHANGED_BEACON_ENABLED) {
2723  		wiphy_dbg(hw->wiphy, "  BCN EN: %d (BI=%u)\n",
2724  			  info->enable_beacon, info->beacon_int);
2725  		vp->bcn_en = info->enable_beacon;
2726  		if (data->started &&
2727  		    !hrtimer_active(&link_data->beacon_timer) &&
2728  		    info->enable_beacon) {
2729  			u64 tsf, until_tbtt;
2730  			u32 bcn_int;
2731  			link_data->beacon_int = info->beacon_int * 1024;
2732  			tsf = mac80211_hwsim_get_tsf(hw, vif);
2733  			bcn_int = link_data->beacon_int;
-> 2734  			until_tbtt = bcn_int - do_div(tsf, bcn_int);  // <- bcn_int=0; RSI=0 -> #DE
2735
2736  			hrtimer_start(&link_data->beacon_timer,
2737  				      ns_to_ktime(until_tbtt * NSEC_PER_USEC),
2738  				      HRTIMER_MODE_REL_SOFT);
2739  		} else if (!info->enable_beacon) {
        ...
2748  				link_data->beacon_int = 0;
        ...
2750  		}
2751  	}

2. drv_link_info_changed -- (net/mac80211/driver-ops.c:497)

460  void drv_link_info_changed(struct ieee80211_local *local,
461  			   struct ieee80211_sub_if_data *sdata,
462  			   struct ieee80211_bss_conf *info,
463  			   int link_id, u64 changed)
464  {
        ...
493  	trace_drv_link_info_changed(local, sdata, info, changed);
494  	if (local->ops->link_info_changed)
495  		local->ops->link_info_changed(&local->hw, &sdata->vif,
496  					      info, changed);
-> 497  	else if (local->ops->bss_info_changed)
498  		local->ops->bss_info_changed(&local->hw, &sdata->vif,
499  					     info, changed);
500  	trace_drv_return_void(local);
501  }

3. ieee80211_offchannel_return -- (net/mac80211/offchannel.c:160)

133  void ieee80211_offchannel_return(struct ieee80211_local *local)
134  {
135  	struct ieee80211_sub_if_data *sdata;
136
137  	lockdep_assert_wiphy(local->hw.wiphy);
        ...
142  	list_for_each_entry(sdata, &local->interfaces, list) {
        ...
157  		if (test_and_clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED,
158  				       &sdata->state)) {
159  			sdata->vif.bss_conf.enable_beacon = true;
-> 160  			ieee80211_link_info_change_notify(
161  				sdata, &sdata->deflink,
162  				BSS_CHANGED_BEACON_ENABLED);
163  		}
164  	}

4. __ieee80211_scan_completed -- (net/mac80211/scan.c:519)

516  	if (!hw_scan && was_scanning) {
517  		ieee80211_configure_filter(local);
518  		drv_sw_scan_complete(local, scan_sdata);
-> 519  		ieee80211_offchannel_return(local);
520  	}

5. cfg80211_wiphy_work -- (net/wireless/core.c:513)
   (workqueue dispatch point for scan completion)


Tentative Analysis

When a software scan completes, __ieee80211_scan_completed calls
ieee80211_offchannel_return, which iterates active interfaces and
re-enables beaconing for any interface that had its beacon stopped
during the scan. It sets bss_conf.enable_beacon = true and issues
a BSS_CHANGED_BEACON_ENABLED notification, but does NOT update
bss_conf.beacon_int.

This notification reaches mac80211_hwsim_link_info_changed. The
condition at lines 2726-2728 (data->started, timer not active,
enable_beacon) is satisfied, so the function enters the beacon
timer setup block at line 2731. It sets link_data->beacon_int =
info->beacon_int * 1024. When info->beacon_int is zero -- which
syzbot achieved by creating an AP interface with beacon_int=0 --
this produces link_data->beacon_int = 0 and bcn_int = 0 (line
2733). The subsequent do_div(tsf, bcn_int) with a zero divisor
triggers the x86 #DE (divide error) exception (RSI = 0, as
confirmed by the register dump).

An identical do_div(tsf, bcn_int) expression in
mac80211_hwsim_config (mac80211_hwsim.c:2635) is protected by a
guard: "if (!data->started || !link_data->beacon_int)" -- this
guard is absent from the BSS_CHANGED_BEACON_ENABLED path.


Potential Solution

Add a zero check for bcn_int immediately after it is loaded from
link_data->beacon_int (line 2733), before the do_div call. A
beacon interval of zero is invalid; when encountered, return
without starting the timer:

    bcn_int = link_data->beacon_int;
    if (!bcn_int)
        return;
    until_tbtt = bcn_int - do_div(tsf, bcn_int);

This mirrors the guard already present in mac80211_hwsim_config
for the same expression. The Fixes tag for the commit would be:

    Fixes: c51f878379b1 ("mac80211_hwsim: fix beacon timing")


More information

Oops-Analysis: http://oops.fenrus.org/reports/lkml/69efb8dd.050a0220.18b4f.0006.GAE_google.com/
Assisted-by: Copilot:claude-sonnet-4.6 linux-kernel-oops-x86.