RAX: ffffffffffffffda RBX: 00007fb2d7b294c0 RCX: 00007fb2d7aa0789
RDX: 0000000000000000 RSI: 0000000020000400 RDI: 0000000000000003
RBP: 00007fb2d7b294cc R08: 0000000000000002 R09: 0000000000003131
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb2d7a512f0
R13: 00007fb2d7b294c8 R14: 0000000700050008 R15: 0000000000000002
BUG: unable to handle kernel NULL pointer dereference at 0000000000000080
PGD 0 P4D 0
Oops: 0002 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 14 Comm: kworker/0:1 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events cfg80211_destroy_iface_wk
RIP: 0010:test_and_set_bit arch/x86/include/asm/bitops.h:209 [inline]
RIP: 0010:try_to_grab_pending+0xcd/0x6f0 kernel/workqueue.c:1229
Code: 3c 02 00 0f 85 26 05 00 00 4c 89 6d 00 e8 4b 53 29 00 31 ff 44 89 e6 e8 81 2c 24 00 45 84 e4 0f 85 da 01 00 00 e8 43 2b 24 00 <f0> 48 0f ba 2b 00 41 0f 92 c4 31 ff 44 89 e6 e8 5f 2c 24 00 45 84
RSP: 0018:ffff8880b5a97870 EFLAGS: 00010093
RAX: ffff8880b5a82380 RBX: 0000000000000080 RCX: ffffffff813e5a1f
RDX: 0000000000000000 RSI: ffffffff813e5a2d RDI: 0000000000000001
RBP: ffff8880b5a978e8 R08: 0000000000400000 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000293 R14: dffffc0000000010 R15: ffff8880b5a82380
FS: 0000000000000000(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000080 CR3: 00000000a8b63000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__cancel_work_timer+0xa6/0x590 kernel/workqueue.c:2972
rhashtable_free_and_destroy+0x2b/0x970 lib/rhashtable.c:1145
mesh_table_free net/mac80211/mesh_pathtbl.c:73 [inline]
mesh_pathtbl_unregister+0x42/0xa0 net/mac80211/mesh_pathtbl.c:825
ieee80211_teardown_sdata net/mac80211/iface.c:1122 [inline]
ieee80211_uninit+0x7e/0x90 net/mac80211/iface.c:1127
rollback_registered_many+0x927/0xe70 net/core/dev.c:8210
rollback_registered+0xe9/0x1b0 net/core/dev.c:8238
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 8203 Comm: syz-executor410 Not tainted 4.19.211-syzkaller #0
unregister_netdevice_queue+0x1de/0x3e0 net/core/dev.c:9305
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
unregister_netdevice include/linux/netdevice.h:2615 [inline]
ieee80211_if_remove+0x213/0x390 net/mac80211/iface.c:1920
Call Trace:
ieee80211_del_iface+0x12/0x20 net/mac80211/cfg.c:144
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
rdev_del_virtual_intf net/wireless/rdev-ops.h:57 [inline]
cfg80211_destroy_ifaces+0x1d0/0x750 net/wireless/core.c:317
fail_dump lib/fault-inject.c:51 [inline]
should_fail.cold+0xa/0xf lib/fault-inject.c:149
cfg80211_destroy_iface_wk+0x1a/0x20 net/wireless/core.c:329
process_one_work+0x864/0x1570 kernel/workqueue.c:2153
worker_thread+0x64c/0x1130 kernel/workqueue.c:2296
__should_failslab+0x115/0x180 mm/failslab.c:32
should_failslab+0x5/0x10 mm/slab_common.c:1590
slab_pre_alloc_hook mm/slab.h:424 [inline]
slab_alloc mm/slab.c:3383 [inline]
kmem_cache_alloc+0x3f/0x370 mm/slab.c:3557
kthread+0x33f/0x460 kernel/kthread.c:259
kmem_cache_zalloc include/linux/slab.h:699 [inline]
fill_pool lib/debugobjects.c:134 [inline]
__debug_object_init+0x6d9/0x9b0 lib/debugobjects.c:379
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Modules linked in:
CR2: 0000000000000080
debug_object_init lib/debugobjects.c:431 [inline]
debug_object_activate+0x382/0x450 lib/debugobjects.c:512
---[ end trace 35f022831dcf777c ]---
RIP: 0010:test_and_set_bit arch/x86/include/asm/bitops.h:209 [inline]
RIP: 0010:try_to_grab_pending+0xcd/0x6f0 kernel/workqueue.c:1229
Code: 3c 02 00 0f 85 26 05 00 00 4c 89 6d 00 e8 4b 53 29 00 31 ff 44 89 e6 e8 81 2c 24 00 45 84 e4 0f 85 da 01 00 00 e8 43 2b 24 00 <f0> 48 0f ba 2b 00 41 0f 92 c4 31 ff 44 89 e6 e8 5f 2c 24 00 45 84
RSP: 0018:ffff8880b5a97870 EFLAGS: 00010093
RAX: ffff8880b5a82380 RBX: 0000000000000080 RCX: ffffffff813e5a1f
RDX: 0000000000000000 RSI: ffffffff813e5a2d RDI: 0000000000000001
RBP: ffff8880b5a978e8 R08: 0000000000400000 R09: 0000000000000000
debug_rcu_head_queue kernel/rcu/rcu.h:193 [inline]
__call_rcu.constprop.0+0x31/0x7f0 kernel/rcu/tree.c:2977
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000293 R14: dffffc0000000010 R15: ffff8880b5a82380
exit_notify kernel/exit.c:745 [inline]
do_exit+0x15be/0x2be0 kernel/exit.c:890
FS: 0000000000000000(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000080 CR3: 00000000a8b63000 CR4: 00000000003406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
do_group_exit+0x125/0x310 kernel/exit.c:967
----------------
Code disassembly (best guess):
0: 3c 02 cmp $0x2,%al
2: 00 0f add %cl,(%rdi)
4: 85 26 test %esp,(%rsi)
6: 05 00 00 4c 89 add $0x894c0000,%eax
b: 6d insl (%dx),%es:(%rdi)
c: 00 e8 add %ch,%al
e: 4b 53 rex.WXB push %r11
10: 29 00 sub %eax,(%rax)
12: 31 ff xor %edi,%edi
14: 44 89 e6 mov %r12d,%esi
17: e8 81 2c 24 00 callq 0x242c9d
1c: 45 84 e4 test %r12b,%r12b
1f: 0f 85 da 01 00 00 jne 0x1ff
25: e8 43 2b 24 00 callq 0x242b6d
* 2a: f0 48 0f ba 2b 00 lock btsq $0x0,(%rbx) <-- trapping instruction
30: 41 0f 92 c4 setb %r12b
34: 31 ff xor %edi,%edi
36: 44 89 e6 mov %r12d,%esi
39: e8 5f 2c 24 00 callq 0x242c9d
3e: 45 rex.RB
3f: 84 .byte 0x84