[syzbot] [wireless?] divide error in mac80211_hwsim_set_tsf

[syzbot] [wireless?] divide error in mac80211_hwsim_set_tsf

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    0af2f6be1b42 Linux 6.15-rc1
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1741cc04580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=d444e5269179368a
dashboard link: https://syzkaller.appspot.com/bug?extid=064815c6cd721082a52a
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=140f9070580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8909dc8a51ee/disk-0af2f6be.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e216afa338a8/vmlinux-0af2f6be.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4d21115804e3/bzImage-0af2f6be.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+064815c6cd721082a52a@syzkaller.appspotmail.com

Oops: divide error: 0000 [#1] SMP KASAN PTI
CPU: 0 UID: 0 PID: 1148 Comm: kworker/u8:6 Not tainted 6.15.0-rc1-syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: events_unbound cfg80211_wiphy_work
RIP: 0010:mac80211_hwsim_set_tsf+0x139/0x170 drivers/net/wireless/virtual/mac80211_hwsim.c:1239
Code: 48 89 9d 30 3f 00 00 4c 89 b5 28 3f 00 00 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc e8 9f cf c4 fa 45 89 ff 4c 89 e8 31 d2 <49> f7 f7 4d 29 ee 48 89 d3 48 f7 db eb a5 e8 54 40 29 fb e9 e7 fe
RSP: 0018:ffffc90003ff7ad8 EFLAGS: 00010246
RAX: 00063249cd8022f2 RBX: 00063249cd8022f3 RCX: ffffffff86f66d11
RDX: 0000000000000000 RSI: ffffffff86f66d71 RDI: 0000000000000006
RBP: ffff8880236830a0 R08: 0000000000000006 R09: 0000000000000001
R10: 00063249cd8022f3 R11: 0000000000000000 R12: 0000000000000001
R13: 00063249cd8022f2 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8881249b9000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7019ad56c0 CR3: 00000000336ea000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 drv_set_tsf+0x223/0x590 net/mac80211/driver-ops.c:277
 ieee80211_if_parse_tsf+0x2c8/0x560 net/mac80211/debugfs_netdev.c:701
 wiphy_locked_debugfs_write_work+0xe3/0x1c0 net/wireless/debugfs.c:215
 cfg80211_wiphy_work+0x3dc/0x550 net/wireless/core.c:435
 process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3319 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400
 kthread+0x3c2/0x780 kernel/kthread.c:464
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:mac80211_hwsim_set_tsf+0x139/0x170 drivers/net/wireless/virtual/mac80211_hwsim.c:1239
Code: 48 89 9d 30 3f 00 00 4c 89 b5 28 3f 00 00 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc e8 9f cf c4 fa 45 89 ff 4c 89 e8 31 d2 <49> f7 f7 4d 29 ee 48 89 d3 48 f7 db eb a5 e8 54 40 29 fb e9 e7 fe
RSP: 0018:ffffc90003ff7ad8 EFLAGS: 00010246
RAX: 00063249cd8022f2 RBX: 00063249cd8022f3 RCX: ffffffff86f66d11
RDX: 0000000000000000 RSI: ffffffff86f66d71 RDI: 0000000000000006
RBP: ffff8880236830a0 R08: 0000000000000006 R09: 0000000000000001
R10: 00063249cd8022f3 R11: 0000000000000000 R12: 0000000000000001
R13: 00063249cd8022f2 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8881249b9000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7019ad56c0 CR3: 0000000034a5e000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	48 89 9d 30 3f 00 00 	mov    %rbx,0x3f30(%rbp)
   7:	4c 89 b5 28 3f 00 00 	mov    %r14,0x3f28(%rbp)
   e:	5b                   	pop    %rbx
   f:	5d                   	pop    %rbp
  10:	41 5c                	pop    %r12
  12:	41 5d                	pop    %r13
  14:	41 5e                	pop    %r14
  16:	41 5f                	pop    %r15
  18:	c3                   	ret
  19:	cc                   	int3
  1a:	cc                   	int3
  1b:	cc                   	int3
  1c:	cc                   	int3
  1d:	e8 9f cf c4 fa       	call   0xfac4cfc1
  22:	45 89 ff             	mov    %r15d,%r15d
  25:	4c 89 e8             	mov    %r13,%rax
  28:	31 d2                	xor    %edx,%edx
* 2a:	49 f7 f7             	div    %r15 <-- trapping instruction
  2d:	4d 29 ee             	sub    %r13,%r14
  30:	48 89 d3             	mov    %rdx,%rbx
  33:	48 f7 db             	neg    %rbx
  36:	eb a5                	jmp    0xffffffdd
  38:	e8 54 40 29 fb       	call   0xfb294091
  3d:	e9                   	.byte 0xe9
  3e:	e7 fe                	out    %eax,$0xfe


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[PATCH] wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled

[Edward Adam Davis]

Setting tsf is meaningless if beacon is disabled, so check that beacon
is enabled before setting tsf.

Reported-by: syzbot+064815c6cd721082a52a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=064815c6cd721082a52a
Tested-by: syzbot+064815c6cd721082a52a@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
 drivers/net/wireless/virtual/mac80211_hwsim.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.c b/drivers/net/wireless/virtual/mac80211_hwsim.c
index cf3e976471c6..cd9e89aebb83 100644
--- a/drivers/net/wireless/virtual/mac80211_hwsim.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim.c
@@ -1226,6 +1226,11 @@ static void mac80211_hwsim_set_tsf(struct ieee80211_hw *hw,
 {
 	struct mac80211_hwsim_data *data = hw->priv;
 	u64 now = mac80211_hwsim_get_tsf(hw, vif);
+	struct ieee80211_bss_conf *conf = link_conf_dereference_protected(vif,
+			data->link_data[0].link_id);
+
+	if (conf && !conf->enable_beacon)
+		return;
 	/* MLD not supported here */
 	u32 bcn_int = data->link_data[0].beacon_int;
 	u64 delta = abs(tsf - now);
-- 
2.43.0

Re: [PATCH] wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled

[Johannes Berg]

On Sun, 2025-04-13 at 14:11 +0800, Edward Adam Davis wrote:
> 
> --- a/drivers/net/wireless/virtual/mac80211_hwsim.c
> +++ b/drivers/net/wireless/virtual/mac80211_hwsim.c
> @@ -1226,6 +1226,11 @@ static void mac80211_hwsim_set_tsf(struct ieee80211_hw *hw,
>  {
>  	struct mac80211_hwsim_data *data = hw->priv;
>  	u64 now = mac80211_hwsim_get_tsf(hw, vif);
> +	struct ieee80211_bss_conf *conf = link_conf_dereference_protected(vif,
> +			data->link_data[0].link_id);
> +
> +	if (conf && !conf->enable_beacon)
> +		return;
>  	/* MLD not supported here */
>  	u32 bcn_int = data->link_data[0].beacon_int;
>  	u64 delta = abs(tsf - now);

Please keep kernel coding style - the line break there is awful (but
with "conf = ..." on a line by itself it can be just one line), and you
shouldn't have code before variable declarations.

The comment should probably also move because it's relevant for your new
[0] as well.

johannes

Re: [PATCH] wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled

[Edward Adam Davis]

On Wed, 23 Apr 2025 14:53:53 +0200, Johannes Berg wrote:
> > --- a/drivers/net/wireless/virtual/mac80211_hwsim.c
> > +++ b/drivers/net/wireless/virtual/mac80211_hwsim.c
> > @@ -1226,6 +1226,11 @@ static void mac80211_hwsim_set_tsf(struct ieee80211_hw *hw,
> >  {
> >  	struct mac80211_hwsim_data *data = hw->priv;
> >  	u64 now = mac80211_hwsim_get_tsf(hw, vif);
> > +	struct ieee80211_bss_conf *conf = link_conf_dereference_protected(vif,
> > +			data->link_data[0].link_id);
> > +
> > +	if (conf && !conf->enable_beacon)
> > +		return;
> >  	/* MLD not supported here */
> >  	u32 bcn_int = data->link_data[0].beacon_int;
> >  	u64 delta = abs(tsf - now);
> 
> Please keep kernel coding style - the line break there is awful (but
> with "conf = ..." on a line by itself it can be just one line), and you
> shouldn't have code before variable declarations.
like this?
diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.c b/drivers/net/wireless/virtual/mac80211_hwsim.c
index cf3e976471c6..6ca5d9d0fe53 100644
--- a/drivers/net/wireless/virtual/mac80211_hwsim.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim.c
@@ -1229,6 +1229,11 @@ static void mac80211_hwsim_set_tsf(struct ieee80211_hw *hw,
        /* MLD not supported here */
        u32 bcn_int = data->link_data[0].beacon_int;
        u64 delta = abs(tsf - now);
+       struct ieee80211_bss_conf *conf;
+
+       conf = link_conf_dereference_protected(vif, data->link_data[0].link_id);
+       if (conf && !conf->enable_beacon)
+               return;

        /* adjust after beaconing with new timestamp at old TBTT */
        if (tsf > now) {

> 
> The comment should probably also move because it's relevant for your new
> [0] as well.
I don't understand what you mean.

Edward

Re: [PATCH] wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled

[Johannes Berg]

On Wed, 2025-04-23 at 21:56 +0800, Edward Adam Davis wrote:
> On Wed, 23 Apr 2025 14:53:53 +0200, Johannes Berg wrote:
> > > --- a/drivers/net/wireless/virtual/mac80211_hwsim.c
> > > +++ b/drivers/net/wireless/virtual/mac80211_hwsim.c
> > > @@ -1226,6 +1226,11 @@ static void mac80211_hwsim_set_tsf(struct ieee80211_hw *hw,
> > >  {
> > >  	struct mac80211_hwsim_data *data = hw->priv;
> > >  	u64 now = mac80211_hwsim_get_tsf(hw, vif);
> > > +	struct ieee80211_bss_conf *conf = link_conf_dereference_protected(vif,
> > > +			data->link_data[0].link_id);
> > > +
> > > +	if (conf && !conf->enable_beacon)
> > > +		return;
> > >  	/* MLD not supported here */
> > >  	u32 bcn_int = data->link_data[0].beacon_int;
> > >  	u64 delta = abs(tsf - now);
> > 
> > Please keep kernel coding style - the line break there is awful (but
> > with "conf = ..." on a line by itself it can be just one line), and you
> > shouldn't have code before variable declarations.
> like this?

Looks good I guess, not sure you wanted bcn_int/delta to be calculated
before or after.

> > The comment should probably also move because it's relevant for your new
> > [0] as well.
> I don't understand what you mean.

The "/* MLD not supported here */" comment refers to the [0] - it
explains why the [0] (rather than link id) is OK. So it also applies to
your [0], if you're going to put it before the comment then IMHO it
makes sense to move the comment. With what you did now the comment is
still earlier though, of course.

johannes

Re: [PATCH] wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled

[Edward Adam Davis]

On Wed, 23 Apr 2025 16:04:04 +0200, Johannes Berg wrote:
> On Wed, 2025-04-23 at 21:56 +0800, Edward Adam Davis wrote:
> > On Wed, 23 Apr 2025 14:53:53 +0200, Johannes Berg wrote:
> > > > --- a/drivers/net/wireless/virtual/mac80211_hwsim.c
> > > > +++ b/drivers/net/wireless/virtual/mac80211_hwsim.c
> > > > @@ -1226,6 +1226,11 @@ static void mac80211_hwsim_set_tsf(struct ieee80211_hw *hw,
> > > >  {
> > > >  	struct mac80211_hwsim_data *data = hw->priv;
> > > >  	u64 now = mac80211_hwsim_get_tsf(hw, vif);
> > > > +	struct ieee80211_bss_conf *conf = link_conf_dereference_protected(vif,
> > > > +			data->link_data[0].link_id);
> > > > +
> > > > +	if (conf && !conf->enable_beacon)
> > > > +		return;
> > > >  	/* MLD not supported here */
> > > >  	u32 bcn_int = data->link_data[0].beacon_int;
> > > >  	u64 delta = abs(tsf - now);
> > >
> > > Please keep kernel coding style - the line break there is awful (but
> > > with "conf = ..." on a line by itself it can be just one line), and you
> > > shouldn't have code before variable declarations.
> > like this?
> 
> Looks good I guess, not sure you wanted bcn_int/delta to be calculated
> before or after.
It will be all right.
I will send V2 patch.
> 
> > > The comment should probably also move because it's relevant for your new
> > > [0] as well.
> > I don't understand what you mean.
> 
> The "/* MLD not supported here */" comment refers to the [0] - it
> explains why the [0] (rather than link id) is OK. So it also applies to
> your [0], if you're going to put it before the comment then IMHO it
> makes sense to move the comment. With what you did now the comment is
> still earlier though, of course.
Oh, Got it.

Edward

[PATCH V2] wifi: mac80211_hwsim: Prevent tsf from setting if beacon is disabled

[Edward Adam Davis]

Setting tsf is meaningless if beacon is disabled, so check that beacon
is enabled before setting tsf.

Reported-by: syzbot+064815c6cd721082a52a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=064815c6cd721082a52a
Tested-by: syzbot+064815c6cd721082a52a@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
V1 -> V2: Move initialization and judgment to after delta.

 drivers/net/wireless/virtual/mac80211_hwsim.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.c b/drivers/net/wireless/virtual/mac80211_hwsim.c
index cf3e976471c6..6ca5d9d0fe53 100644
--- a/drivers/net/wireless/virtual/mac80211_hwsim.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim.c
@@ -1229,6 +1229,11 @@ static void mac80211_hwsim_set_tsf(struct ieee80211_hw *hw,
 	/* MLD not supported here */
 	u32 bcn_int = data->link_data[0].beacon_int;
 	u64 delta = abs(tsf - now);
+	struct ieee80211_bss_conf *conf;
+
+	conf = link_conf_dereference_protected(vif, data->link_data[0].link_id);
+	if (conf && !conf->enable_beacon)
+		return;
 
 	/* adjust after beaconing with new timestamp at old TBTT */
 	if (tsf > now) {
-- 
2.43.0