RAX: ffffffffffffffda RBX: 00007fb2d7b294c0 RCX: 00007fb2d7aa0789 RDX: 0000000000000000 RSI: 0000000020000400 RDI: 0000000000000003 RBP: 00007fb2d7b294cc R08: 0000000000000002 R09: 0000000000003131 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb2d7a512f0 R13: 00007fb2d7b294c8 R14: 0000000700050008 R15: 0000000000000002 BUG: unable to handle kernel NULL pointer dereference at 0000000000000080 PGD 0 P4D 0 Oops: 0002 [#1] PREEMPT SMP KASAN CPU: 0 PID: 14 Comm: kworker/0:1 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events cfg80211_destroy_iface_wk RIP: 0010:test_and_set_bit arch/x86/include/asm/bitops.h:209 [inline] RIP: 0010:try_to_grab_pending+0xcd/0x6f0 kernel/workqueue.c:1229 Code: 3c 02 00 0f 85 26 05 00 00 4c 89 6d 00 e8 4b 53 29 00 31 ff 44 89 e6 e8 81 2c 24 00 45 84 e4 0f 85 da 01 00 00 e8 43 2b 24 00 48 0f ba 2b 00 41 0f 92 c4 31 ff 44 89 e6 e8 5f 2c 24 00 45 84 RSP: 0018:ffff8880b5a97870 EFLAGS: 00010093 RAX: ffff8880b5a82380 RBX: 0000000000000080 RCX: ffffffff813e5a1f RDX: 0000000000000000 RSI: ffffffff813e5a2d RDI: 0000000000000001 RBP: ffff8880b5a978e8 R08: 0000000000400000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000293 R14: dffffc0000000010 R15: ffff8880b5a82380 FS: 0000000000000000(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000080 CR3: 00000000a8b63000 CR4: 00000000003406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __cancel_work_timer+0xa6/0x590 kernel/workqueue.c:2972 rhashtable_free_and_destroy+0x2b/0x970 lib/rhashtable.c:1145 mesh_table_free net/mac80211/mesh_pathtbl.c:73 [inline] mesh_pathtbl_unregister+0x42/0xa0 net/mac80211/mesh_pathtbl.c:825 ieee80211_teardown_sdata net/mac80211/iface.c:1122 [inline] ieee80211_uninit+0x7e/0x90 net/mac80211/iface.c:1127 rollback_registered_many+0x927/0xe70 net/core/dev.c:8210 rollback_registered+0xe9/0x1b0 net/core/dev.c:8238 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 8203 Comm: syz-executor410 Not tainted 4.19.211-syzkaller #0 unregister_netdevice_queue+0x1de/0x3e0 net/core/dev.c:9305 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 unregister_netdevice include/linux/netdevice.h:2615 [inline] ieee80211_if_remove+0x213/0x390 net/mac80211/iface.c:1920 Call Trace: ieee80211_del_iface+0x12/0x20 net/mac80211/cfg.c:144 __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 rdev_del_virtual_intf net/wireless/rdev-ops.h:57 [inline] cfg80211_destroy_ifaces+0x1d0/0x750 net/wireless/core.c:317 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold+0xa/0xf lib/fault-inject.c:149 cfg80211_destroy_iface_wk+0x1a/0x20 net/wireless/core.c:329 process_one_work+0x864/0x1570 kernel/workqueue.c:2153 worker_thread+0x64c/0x1130 kernel/workqueue.c:2296 __should_failslab+0x115/0x180 mm/failslab.c:32 should_failslab+0x5/0x10 mm/slab_common.c:1590 slab_pre_alloc_hook mm/slab.h:424 [inline] slab_alloc mm/slab.c:3383 [inline] kmem_cache_alloc+0x3f/0x370 mm/slab.c:3557 kthread+0x33f/0x460 kernel/kthread.c:259 kmem_cache_zalloc include/linux/slab.h:699 [inline] fill_pool lib/debugobjects.c:134 [inline] __debug_object_init+0x6d9/0x9b0 lib/debugobjects.c:379 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 Modules linked in: CR2: 0000000000000080 debug_object_init lib/debugobjects.c:431 [inline] debug_object_activate+0x382/0x450 lib/debugobjects.c:512 ---[ end trace 35f022831dcf777c ]--- RIP: 0010:test_and_set_bit arch/x86/include/asm/bitops.h:209 [inline] RIP: 0010:try_to_grab_pending+0xcd/0x6f0 kernel/workqueue.c:1229 Code: 3c 02 00 0f 85 26 05 00 00 4c 89 6d 00 e8 4b 53 29 00 31 ff 44 89 e6 e8 81 2c 24 00 45 84 e4 0f 85 da 01 00 00 e8 43 2b 24 00 48 0f ba 2b 00 41 0f 92 c4 31 ff 44 89 e6 e8 5f 2c 24 00 45 84 RSP: 0018:ffff8880b5a97870 EFLAGS: 00010093 RAX: ffff8880b5a82380 RBX: 0000000000000080 RCX: ffffffff813e5a1f RDX: 0000000000000000 RSI: ffffffff813e5a2d RDI: 0000000000000001 RBP: ffff8880b5a978e8 R08: 0000000000400000 R09: 0000000000000000 debug_rcu_head_queue kernel/rcu/rcu.h:193 [inline] __call_rcu.constprop.0+0x31/0x7f0 kernel/rcu/tree.c:2977 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000293 R14: dffffc0000000010 R15: ffff8880b5a82380 exit_notify kernel/exit.c:745 [inline] do_exit+0x15be/0x2be0 kernel/exit.c:890 FS: 0000000000000000(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000080 CR3: 00000000a8b63000 CR4: 00000000003406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 do_group_exit+0x125/0x310 kernel/exit.c:967 ---------------- Code disassembly (best guess): 0: 3c 02 cmp $0x2,%al 2: 00 0f add %cl,(%rdi) 4: 85 26 test %esp,(%rsi) 6: 05 00 00 4c 89 add $0x894c0000,%eax b: 6d insl (%dx),%es:(%rdi) c: 00 e8 add %ch,%al e: 4b 53 rex.WXB push %r11 10: 29 00 sub %eax,(%rax) 12: 31 ff xor %edi,%edi 14: 44 89 e6 mov %r12d,%esi 17: e8 81 2c 24 00 callq 0x242c9d 1c: 45 84 e4 test %r12b,%r12b 1f: 0f 85 da 01 00 00 jne 0x1ff 25: e8 43 2b 24 00 callq 0x242b6d * 2a: f0 48 0f ba 2b 00 lock btsq $0x0,(%rbx) <-- trapping instruction 30: 41 0f 92 c4 setb %r12b 34: 31 ff xor %edi,%edi 36: 44 89 e6 mov %r12d,%esi 39: e8 5f 2c 24 00 callq 0x242c9d 3e: 45 rex.RB 3f: 84 .byte 0x84