linux-kernel - Forwarded: Private message regarding: [syzbot] [wireless?] WARNING in drv_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <696d6cf6.050a0220.3390f1.0031.GAE@google.com>
Date: Sun, 18 Jan 2026 15:29:58 -0800
From: syzbot <syzbot+2cecf0e829ae2219d419@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Forwarded: Private message regarding: [syzbot] [wireless?] WARNING in
 drv_get_tsf (2)

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com.

***

Subject: Private message regarding: [syzbot] [wireless?] WARNING in drv_get_tsf (2)
Author: kapoorarnav43@...il.com

#syz test

>From 0cd0a5cff75a12d3cf1fa0675950ef0dcc647799 Mon Sep 17 00:00:00 2001
From: Arnav Kapoor <kapoorarnav43@...il.com>
Date: Mon, 19 Jan 2026 03:03:18 +0530
Subject: [PATCH] mac80211: Fix WARNING in drv_get_tsf debugfs access

The debugfs tsf read function was calling drv_get_tsf() even when the
interface was not registered with the driver, causing a WARN_ON to be
triggered. This is inappropriate for debugfs access.

Fix this by checking the IEEE80211_SDATA_IN_DRIVER flag in the debugfs
read function and returning -1ULL directly when the interface is not
in the driver, avoiding the warning.

Reported-by: syzbot+15f88dfa580000@...kaller.appspotmail.com
Signed-off-by: Arnav Rawat <arnavrawat2000@...il.com>
---
 net/mac80211/debugfs_netdev.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 30a5a978a..669e7c519 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -656,7 +656,10 @@ static ssize_t ieee80211_if_fmt_tsf(
        struct ieee80211_local *local = sdata->local;
        u64 tsf;

-       tsf = drv_get_tsf(local, (struct ieee80211_sub_if_data *)sdata);
+       if (!(sdata->flags & IEEE80211_SDATA_IN_DRIVER))
+               tsf = -1ULL;
+       else
+               tsf = drv_get_tsf(local, (struct ieee80211_sub_if_data 
*)sdata);

        return scnprintf(buf, buflen, "0x%016llx\n", (unsigned long long) 
tsf);
 }
-- 
2.43.0

On Monday, 19 January 2026 at 04:58:06 UTC+5:30 syzbot wrote:

Hello, 

syzbot tried to test the proposed patch but the build/boot failed: 

failed to apply patch after dry run: 
patching file net/netfilter/nf_conntrack_core.c 
Hunk #1 succeeded at 1551 (offset -1 lines). 
patching file net/netfilter/nf_conntrack_core.c 
Hunk #1 FAILED at 1552. 
1 out of 1 hunk FAILED -- saving rejects to file 
net/netfilter/nf_conntrack_core.c.rej 
patching file net/netfilter/nf_conntrack_core.c 
Hunk #1 FAILED at 1552. 
1 out of 1 hunk FAILED -- saving rejects to file 
net/netfilter/nf_conntrack_core.c.rej 
patching file net/netfilter/nf_conntrack_core.c 
Hunk #1 FAILED at 1552. 
1 out of 1 hunk FAILED -- saving rejects to file 
net/netfilter/nf_conntrack_core.c.rej 
patching file net/netfilter/nf_conntrack_core.c 
Hunk #1 FAILED at 1552. 
1 out of 1 hunk FAILED -- saving rejects to file 
net/netfilter/nf_conntrack_core.c.rej 

Tested on: 

commit: e84d9601 Merge tag 'for-6.19-rc5-tag' of git://git.ker.. 
git tree: upstream 
kernel config: https://syzkaller.appspot.com/x/.config?x=ae589cd0a6acd9be 
dashboard link: https://syzkaller.appspot.com/bug?extid=2cecf0e829ae2219d419 
compiler: 
patch: https://syzkaller.appspot.com/x/patch.diff?x=112153fa580000