bisecting cause commit starting from 80145ac2f739558e66bd8789df3414bc0e111c58 building syzkaller on e34b696c0d7c04dbc824dee8b5123969bbca19b7 testing commit 80145ac2f739558e66bd8789df3414bc0e111c58 with gcc (GCC) 8.1.0 kernel signature: a9236b465490704eeeecf6ba415eefc0312ab5774434aff52a952eb252f6be11 all runs: crashed: WARNING in __rate_control_send_low testing release v5.9 testing commit bbf5c979011a099af5dc76498918ed7df445635b with gcc (GCC) 8.1.0 kernel signature: 38d9063beaf6cde8ef355d72e858607756ef3bf3f439b4b203cb36f2073ef29c all runs: crashed: WARNING in __rate_control_send_low testing release v5.8 testing commit bcf876870b95592b52519ed4aafcf9d95999bc9c with gcc (GCC) 8.1.0 kernel signature: e0d3e879b736a722845388983868f2927775957442f2307f7a7f4c9fbe90d6fe all runs: crashed: WARNING in __rate_control_send_low testing release v5.7 testing commit 3d77e6a8804abcc0504c904bd6e5cdf3a5cf8162 with gcc (GCC) 8.1.0 kernel signature: d39863b19ac02fedeff09aed0f5a85a1bbebb2fa5ce6c2d48bc1d15c86410f70 all runs: crashed: WARNING in __rate_control_send_low testing release v5.6 testing commit 7111951b8d4973bda27ff663f2cf18b663d15b48 with gcc (GCC) 8.1.0 kernel signature: 2ad50d06f869200d2d268556af646936d6d27fc8dbabb9ba100c039fbad08f65 all runs: crashed: WARNING in __rate_control_send_low testing release v5.5 testing commit d5226fa6dbae0569ee43ecfc08bdcd6770fc4755 with gcc (GCC) 8.1.0 kernel signature: 3b8917a24f0c59760a77dba19559fae78218606a32e230ee0541580f4f4907f4 all runs: crashed: WARNING in __rate_control_send_low testing release v5.4 testing commit 219d54332a09e8d8741c1e1982f5eae56099de85 with gcc (GCC) 8.1.0 kernel signature: f3e18f9f7a76b4a38d33fcb18badb775095bbecc0103b3b6ab62907cdb378931 all runs: crashed: WARNING in __rate_control_send_low testing release v5.3 testing commit 4d856f72c10ecb060868ed10ff1b1453943fc6c8 with gcc (GCC) 8.1.0 kernel signature: 97050f6071c725a8d871787b00875202826c133f7bee28b089d61d59201d4fd9 all runs: crashed: WARNING in __rate_control_send_low testing release v5.2 testing commit 0ecfebd2b52404ae0c54a878c872bb93363ada36 with gcc (GCC) 8.1.0 kernel signature: 1a0c4f461a50c0ff600eab3d04f867c48b2747b6ba33a96330092c12d478f2ae all runs: crashed: WARNING in __rate_control_send_low testing release v5.1 testing commit e93c9c99a629c61837d5a7fc2120cd2b6c70dbdd with gcc (GCC) 8.1.0 kernel signature: 7db15bd43ca0cc8756058955ec664b44f15724469e09135ff979b7192e731c75 all runs: crashed: WARNING in __rate_control_send_low testing release v5.0 testing commit 1c163f4c7b3f621efff9b28a47abb36f7378d783 with gcc (GCC) 8.1.0 kernel signature: 4c340efac6fe4308b3cd4794dc0f6897882f6fc74e2c3ce239838849e876656a all runs: crashed: WARNING in __rate_control_send_low testing release v4.20 testing commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be with gcc (GCC) 8.1.0 kernel signature: d276a25f75ba8d4d7d15588ad9e41aea36cce31289f280f5253cafd1efafbeed all runs: crashed: WARNING in __rate_control_send_low testing release v4.19 testing commit 84df9525b0c27f3ebc2ebb1864fa62a97fdedb7d with gcc (GCC) 8.1.0 kernel signature: c1849a564e82c707981b3802e9449d4b946cdae4c78d8da90ed74402a5632b27 all runs: crashed: WARNING in __rate_control_send_low testing release v4.18 testing commit 94710cac0ef4ee177a63b5227664b38c95bbf703 with gcc (GCC) 8.1.0 kernel signature: dfd08b215e03b2a2e00590f900f719bc5d63fb9e754db1fdebc948560abaee4c all runs: crashed: WARNING in __rate_control_send_low testing release v4.17 testing commit 29dcea88779c856c7dc92040a0c01233263101d4 with gcc (GCC) 8.1.0 kernel signature: 6929149d974f59843b129c480fcaae1e68714937b0c01f9784967671c8b299de all runs: crashed: WARNING in __rate_control_send_low testing release v4.16 testing commit 0adb32858b0bddf4ada5f364a84ed60b196dbcda with gcc (GCC) 8.1.0 kernel signature: f62261665202131485df1917221590b65a93ae5c7fa5f46dfb5b687101ade18a all runs: crashed: WARNING in __rate_control_send_low testing release v4.15 testing commit d8a5b80568a9cb66810e75b182018e9edb68e8ff with gcc (GCC) 8.1.0 kernel signature: 41150de37c2c09b576e115450f2b0c52ddf7971f1dfd2c530d2d88cec9030e0b all runs: basic kernel testing failed: WARNING in check_flush_dependency testing release v4.14 testing commit bebc6082da0a9f5d47a1ea2edc099bf671058bd4 with gcc (GCC) 8.1.0 kernel signature: 7c2643816ad977ff0a5bcb8d14ee30a4320f81297ffafb91cfcecc909ae2be63 all runs: crashed: WARNING in __rate_control_send_low testing release v4.13 testing commit 569dbb88e80deb68974ef6fdd6a13edb9d686261 with gcc (GCC) 8.1.0 kernel signature: a32d1335cdea7ff193930ebce04d8333ff97bfcf3aed6a5d98fce3bfe0ec74c2 all runs: crashed: WARNING in __rate_control_send_low testing release v4.12 testing commit 6f7da290413ba713f0cdd9ff1a2a9bb129ef4f6c with gcc (GCC) 8.1.0 kernel signature: d3e21d187638fc8639d8f49680a1c5afe6f81f6c11304f489982950df3b486fa all runs: basic kernel testing failed: BUG: sleeping function called from invalid context in tap_get_minor testing release v4.11 testing commit a351e9b9fc24e982ec2f0e76379a49826036da12 with gcc (GCC) 7.3.0 kernel signature: e41c38c9e0ba748647ca40c2b908c09868b569e029b15ea0ede35b763d6cfd4e all runs: basic kernel testing failed: BUG: sleeping function called from invalid context in tap_get_minor testing release v4.10 testing commit c470abd4fde40ea6a0846a2beab642a578c0b8cd with gcc (GCC) 5.5.0 kernel signature: 48aeaded47ab66e19abbb16d8d8bf75099c565c438b29250ea92b2e0ae6d785e run #0: crashed: WARNING in console_unlock run #1: crashed: WARNING in console_unlock run #2: crashed: WARNING in native_safe_halt run #3: crashed: WARNING in __rate_control_send_low run #4: crashed: WARNING in unlock_page_memcg run #5: crashed: WARNING in preempt_schedule_irq run #6: crashed: WARNING in debug_check_no_obj_freed run #7: crashed: WARNING in __put_unused_fd run #8: crashed: WARNING in dput run #9: crashed: WARNING in batadv_nc_purge_paths testing release v4.9 testing commit 69973b830859bc6529a7a0468ba0d80ee5117826 with gcc (GCC) 5.5.0 kernel signature: 802c48f776f1744ba597961c87314580235ff71c68dbb8c86765fcf28ba877ab all runs: crashed: WARNING in __rate_control_send_low testing release v4.8 testing commit c8d2bc9bc39ebea8437fd974fdbc21847bb897a3 with gcc (GCC) 5.5.0 kernel signature: ce23bf73109642e0c84946e82e12981bd8fee946b9e9ac9a2bc2a9387e0cdb6a all runs: crashed: WARNING in __rate_control_send_low testing release v4.7 testing commit 523d939ef98fd712632d93a5a2b588e477a7565e with gcc (GCC) 5.5.0 kernel signature: 39033e6e1824561462c09812767229e8a8bb74fd2f72be9db4054f9a9e437348 run #0: basic kernel testing failed: BUG: program execution failed: executor 0: failed to write control pipe: write |1: broken pipe run #1: basic kernel testing failed: BUG: program execution failed: executor 0: failed to write control pipe: write |1: broken pipe run #2: basic kernel testing failed: BUG: program execution failed: executor 0: failed to write control pipe: write |1: broken pipe run #3: basic kernel testing failed: BUG: program execution failed: executor 0: failed to write control pipe: write |1: broken pipe run #4: basic kernel testing failed: BUG: program execution failed: executor 0: failed to write control pipe: write |1: broken pipe run #5: basic kernel testing failed: BUG: program execution failed: executor 0: failed to write control pipe: write |1: broken pipe run #6: basic kernel testing failed: BUG: program execution failed: executor 0: failed to write control pipe: write |1: broken pipe run #7: basic kernel testing failed: BUG: program execution failed: executor 0: exit status 67 run #8: basic kernel testing failed: BUG: program execution failed: executor 0: failed to write control pipe: write |1: broken pipe run #9: basic kernel testing failed: BUG: program execution failed: executor 0: failed to write control pipe: write |1: broken pipe testing release v4.6 testing commit 2dcd0af568b0cf583645c8a317dd12e344b1c72a with gcc (GCC) 5.5.0 kernel signature: a54bda77fdf8dc80b6f9fb21f50858fb2f458db046cdb44faf6235aca5518d15 all runs: basic kernel testing failed: BUG: program execution failed: executor 0: failed to write control pipe: write |1: broken pipe revisions tested: 26, total time: 3h14m29.43718975s (build: 1h58m51.386747538s, test: 1h11m42.94949147s) the crash already happened on the oldest tested release commit msg: Linux 4.8 crash: WARNING in __rate_control_send_low IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready device veth0_macvtap entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): veth0_macvtap: link is not ready device veth1_macvtap entered promiscuous mode ------------[ cut here ]------------ WARNING: CPU: 0 PID: 9553 at net/mac80211/rate.c:311 __rate_control_send_low+0x37e/0x550 net/mac80211/rate.c:308 device veth0_macvtap entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): macvtap0: link is not ready device veth1_macvtap entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): veth0_to_batadv: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1_to_batadv: link is not ready no supported rates (0xffffffff) in rate_mask 0x0 with flags 0x0 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 9553 Comm: syz-executor.3 Not tainted 4.8.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 0000000000000000 ffff88013bc07860 ffffffff82e4dd32 ffffffff8687e640 ffff88013bc07938 ffffffff8756d000 ffffffff863259fe 0000000000000009 ffff88013bc07928 ffffffff815e8a02 0000000041b58ab3 ffffffff879e7c23 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0x136/0x1d4 lib/dump_stack.c:51 ieee80211 phy6: Selected rate control algorithm 'minstrel_ht' [] panic+0x1b6/0x351 kernel/panic.c:153 ieee80211 phy6: hwaddr 02:00:00:00:06:00 registered ieee80211 phy6: mac80211_hwsim_start ieee80211 phy6: mac80211_hwsim_add_interface (type=1 mac_addr=02:00:00:00:06:00) ieee80211 phy6: mac80211_hwsim_bss_info_changed(changed=0xe vif->addr=02:00:00:00:06:00) ieee80211 phy6: ERP_CTS_PROT: 0 ieee80211 phy6: ERP_PREAMBLE: 0 ieee80211 phy6: ERP_SLOT: 0 ieee80211 phy6: mac80211_hwsim_conf_tx (queue=0 txop=47 cw_min=3 cw_max=7 aifs=2) ieee80211 phy6: mac80211_hwsim_conf_tx (queue=1 txop=94 cw_min=7 cw_max=15 aifs=2) ieee80211 phy6: mac80211_hwsim_conf_tx (queue=2 txop=0 cw_min=15 cw_max=1023 aifs=3) ieee80211 phy6: mac80211_hwsim_conf_tx (queue=3 txop=0 cw_min=15 cw_max=1023 aifs=7) ieee80211 phy6: mac80211_hwsim_bss_info_changed(changed=0x2000 vif->addr=02:00:00:00:06:00) ieee80211 phy6: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=1 ps=0 smps=static) ieee80211 phy6: mac80211_hwsim_configure_filter ieee80211 phy6: mac80211_hwsim_configure_filter IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready ieee80211 phy6: mac80211_hwsim_bss_info_changed(changed=0x10 vif->addr=02:00:00:00:06:00) ieee80211 phy6: HT: op_mode=0xb wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 ieee80211 phy6: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=0 ps=0 smps=static) ieee80211 phy6: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=0 ps=0 smps=static) ieee80211 phy6: mac80211_hwsim_bss_info_changed(changed=0x40000 vif->addr=02:00:00:00:06:00) ieee80211 phy6: TX Power: 20 dBm ieee80211 phy6: mac80211_hwsim_bss_info_changed(changed=0x4000 vif->addr=02:00:00:00:06:00) ieee80211 phy6: mac80211_hwsim_conf_tx (queue=0 txop=0 cw_min=15 cw_max=1023 aifs=2) ieee80211 phy6: mac80211_hwsim_conf_tx (queue=1 txop=0 cw_min=15 cw_max=1023 aifs=2) ieee80211 phy6: mac80211_hwsim_conf_tx (queue=2 txop=0 cw_min=15 cw_max=1023 aifs=2) ieee80211 phy6: mac80211_hwsim_conf_tx (queue=3 txop=0 cw_min=15 cw_max=1023 aifs=2) ieee80211 phy6: mac80211_hwsim_bss_info_changed(changed=0x2000 vif->addr=02:00:00:00:06:00) ieee80211 phy6: mac80211_hwsim_bss_info_changed(changed=0x8bfe vif->addr=02:00:00:00:06:00) ieee80211 phy6: mac80211_hwsim_bss_info_changed: BSSID changed: 50:50:50:50:50:50 ieee80211 phy6: BCN EN: 1 (BI=100) ieee80211 phy6: ERP_CTS_PROT: 0 ieee80211 phy6: ERP_PREAMBLE: 0 ieee80211 phy6: ERP_SLOT: 0 ieee80211 phy6: HT: op_mode=0xb ieee80211 phy6: BASIC_RATES: 0x1 ieee80211 phy7: Selected rate control algorithm 'minstrel_ht' ieee80211 phy7: hwaddr 02:00:00:00:07:00 registered ieee80211 phy7: mac80211_hwsim_start ieee80211 phy7: mac80211_hwsim_add_interface (type=1 mac_addr=02:00:00:00:07:00) ieee80211 phy7: mac80211_hwsim_bss_info_changed(changed=0xe vif->addr=02:00:00:00:07:00) ieee80211 phy7: ERP_CTS_PROT: 0 ieee80211 phy7: ERP_PREAMBLE: 0 ieee80211 phy7: ERP_SLOT: 0 ieee80211 phy7: mac80211_hwsim_conf_tx (queue=0 txop=47 cw_min=3 cw_max=7 aifs=2) ieee80211 phy7: mac80211_hwsim_conf_tx (queue=1 txop=94 cw_min=7 cw_max=15 aifs=2) ieee80211 phy7: mac80211_hwsim_conf_tx (queue=2 txop=0 cw_min=15 cw_max=1023 aifs=3) ieee80211 phy7: mac80211_hwsim_conf_tx (queue=3 txop=0 cw_min=15 cw_max=1023 aifs=7) ieee80211 phy7: mac80211_hwsim_bss_info_changed(changed=0x2000 vif->addr=02:00:00:00:07:00) ieee80211 phy7: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=1 ps=0 smps=static) ieee80211 phy7: mac80211_hwsim_configure_filter ieee80211 phy7: mac80211_hwsim_configure_filter IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready ieee80211 phy7: mac80211_hwsim_bss_info_changed(changed=0x10 vif->addr=02:00:00:00:07:00) ieee80211 phy7: HT: op_mode=0xb wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 ieee80211 phy7: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=0 ps=0 smps=static) ieee80211 phy7: mac80211_hwsim_config (freq=2412(2412 - 0)/noht idle=0 ps=0 smps=static) ieee80211 phy7: mac80211_hwsim_bss_info_changed(changed=0x40000 vif->addr=02:00:00:00:07:00) ieee80211 phy7: TX Power: 20 dBm ieee80211 phy7: mac80211_hwsim_bss_info_changed(changed=0x4000 vif->addr=02:00:00:00:07:00) ieee80211 phy7: mac80211_hwsim_conf_tx (queue=0 txop=0 cw_min=15 cw_max=1023 aifs=2) ieee80211 phy7: mac80211_hwsim_conf_tx (queue=1 txop=0 cw_min=15 cw_max=1023 aifs=2) ieee80211 phy7: mac80211_hwsim_conf_tx (queue=2 txop=0 cw_min=15 cw_max=1023 aifs=2) ieee80211 phy7: mac80211_hwsim_conf_tx (queue=3 txop=0 cw_min=15 cw_max=1023 aifs=2) ieee80211 phy7: mac80211_hwsim_bss_info_changed(changed=0x2000 vif->addr=02:00:00:00:07:00) ieee80211 phy7: mac80211_hwsim_bss_info_changed(changed=0x8bfe vif->addr=02:00:00:00:07:00) ieee80211 phy7: mac80211_hwsim_bss_info_changed: BSSID changed: 50:50:50:50:50:50 ieee80211 phy7: BCN EN: 1 (BI=100) ieee80211 phy7: ERP_CTS_PROT: 0 ieee80211 phy7: ERP_PREAMBLE: 0 ieee80211 phy7: ERP_SLOT: 0 ieee80211 phy7: HT: op_mode=0xb ieee80211 phy7: BASIC_RATES: 0x1 [] __warn+0x18d/0x1b0 kernel/panic.c:509 [] warn_slowpath_fmt+0x92/0xb0 kernel/panic.c:532 [] __rate_control_send_low+0x37e/0x550 net/mac80211/rate.c:308 [] rate_control_send_low+0x35b/0x5b0 net/mac80211/rate.c:332 [] minstrel_ht_get_rate+0x4f/0x15d0 net/mac80211/rc80211_minstrel_ht.c:1079 [] rate_control_get_rate+0x3c3/0x5c0 net/mac80211/rate.c:859 [] __ieee80211_beacon_get+0x803/0x1770 net/mac80211/tx.c:3990 [] ieee80211_beacon_get_tim+0x83/0x620 net/mac80211/tx.c:4017 [] ieee80211_beacon_get include/net/mac80211.h:4255 [inline] [] mac80211_hwsim_beacon_tx+0xd0/0x630 drivers/net/wireless/mac80211_hwsim.c:1512 [] __iterate_interfaces+0x16f/0x2f0 net/mac80211/util.c:613 [] ieee80211_iterate_active_interfaces_atomic+0x67/0x100 net/mac80211/util.c:649 [] mac80211_hwsim_beacon+0xbb/0x180 drivers/net/wireless/mac80211_hwsim.c:1550 [] __tasklet_hrtimer_trampoline+0x2d/0xb0 kernel/softirq.c:610 [] tasklet_hi_action+0x26b/0x340 kernel/softirq.c:541 [] __do_softirq+0x2cb/0xa1c kernel/softirq.c:273 [] do_softirq_own_stack+0x1c/0x30 arch/x86/entry/entry_64.S:827 [] do_softirq+0x11d/0x150 kernel/softirq.c:317 [] __local_bh_enable_ip+0x136/0x180 kernel/softirq.c:170 [] local_bh_enable include/linux/bottom_half.h:31 [inline] [] rcu_read_unlock_bh include/linux/rcupdate.h:966 [inline] [] __dev_queue_xmit+0xa2b/0x2260 net/core/dev.c:3432 [] dev_queue_xmit+0xb/0x10 net/core/dev.c:3438 [] __netlink_deliver_tap_skb net/netlink/af_netlink.c:238 [inline] [] __netlink_deliver_tap net/netlink/af_netlink.c:256 [inline] [] netlink_deliver_tap+0x4d7/0x850 net/netlink/af_netlink.c:267 [] netlink_deliver_tap_kernel net/netlink/af_netlink.c:276 [inline] [] netlink_unicast_kernel net/netlink/af_netlink.c:1213 [inline] [] netlink_unicast+0x3fe/0x570 net/netlink/af_netlink.c:1240 [] netlink_sendmsg+0x9bb/0xb40 net/netlink/af_netlink.c:1786 [] sock_sendmsg_nosec net/socket.c:609 [inline] [] sock_sendmsg+0xb5/0xf0 net/socket.c:619 [] ___sys_sendmsg+0x6f0/0x860 net/socket.c:1942 [] __sys_sendmsg+0xc1/0x140 net/socket.c:1976 [] C_SYSC_sendmsg net/compat.c:733 [inline] [] compat_SyS_sendmsg+0xf/0x20 net/compat.c:731 [] do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline] [] do_fast_syscall_32+0x324/0xa70 arch/x86/entry/common.c:392 [] entry_SYSENTER_compat+0x51/0x60 arch/x86/entry/entry_64_compat.S:124 Kernel Offset: disabled