bisecting cause commit starting from a349e4c659609fd20e4beea89e5c4a4038e33a95 building syzkaller on 0d27f508b6b35d3b12b9fafebd40a1f36950c8f3 testing commit a349e4c659609fd20e4beea89e5c4a4038e33a95 with gcc (GCC) 8.1.0 kernel signature: 4eb607b5952392bd5b7b3817542fba2ad03eba091a2aca9e5345d92fb528b8a1 all runs: crashed: general protection fault in ieee80211_chanctx_num_assigned testing release v5.9 testing commit bbf5c979011a099af5dc76498918ed7df445635b with gcc (GCC) 8.1.0 kernel signature: 1b5b3de9b55a7181ffba9b6457a83807d531a3bbd536e6c35bc5192c1659ed42 all runs: crashed: general protection fault in ieee80211_chanctx_num_assigned testing release v5.8 testing commit bcf876870b95592b52519ed4aafcf9d95999bc9c with gcc (GCC) 8.1.0 kernel signature: 82cdf2423a5af0a98678b8bd92dd3fc56ec26583c958eeed51bda4d4aeb36f3b all runs: crashed: general protection fault in ieee80211_chanctx_num_assigned testing release v5.7 testing commit 3d77e6a8804abcc0504c904bd6e5cdf3a5cf8162 with gcc (GCC) 8.1.0 kernel signature: f4ef9bbf4213b89c508003623c8f8a427547b6b16955c7ee6446b98f4ec03e52 all runs: crashed: general protection fault in ieee80211_chanctx_num_assigned testing release v5.6 testing commit 7111951b8d4973bda27ff663f2cf18b663d15b48 with gcc (GCC) 8.1.0 kernel signature: 7084b229360b1d4c11d1fb2625b5c3c026bb5302e5e9206f26588c5ac59000bc all runs: crashed: general protection fault in ieee80211_chanctx_num_assigned testing release v5.5 testing commit d5226fa6dbae0569ee43ecfc08bdcd6770fc4755 with gcc (GCC) 8.1.0 kernel signature: 373412731a18e276df3a91eb20d2369e6b27d018cdc04ba7be0fbe19947ac887 all runs: crashed: general protection fault in ieee80211_chanctx_num_assigned testing release v5.4 testing commit 219d54332a09e8d8741c1e1982f5eae56099de85 with gcc (GCC) 8.1.0 kernel signature: 6779b4f00aa7600b4736b8eec77e851888325d17e44f4242d76df29dbeb69592 all runs: crashed: general protection fault in ieee80211_chanctx_num_assigned testing release v5.3 testing commit 4d856f72c10ecb060868ed10ff1b1453943fc6c8 with gcc (GCC) 8.1.0 kernel signature: 0f6303c3f816f470b9763a92dd25a9ad42f8414eb150a629d97170c6152b6a42 all runs: crashed: general protection fault in ieee80211_chanctx_num_assigned testing release v5.2 testing commit 0ecfebd2b52404ae0c54a878c872bb93363ada36 with gcc (GCC) 8.1.0 kernel signature: 7e995a2a0f913fb64cd2c14dcbd04046c26ffeef29277131e7b6860c4739a70d all runs: crashed: general protection fault in ieee80211_chanctx_num_assigned testing release v5.1 testing commit e93c9c99a629c61837d5a7fc2120cd2b6c70dbdd with gcc (GCC) 8.1.0 kernel signature: ae3b59540985da0dfb3b22102e28a8992f710dc9c514db67a57a843793f57c1d all runs: crashed: general protection fault in ieee80211_chanctx_num_assigned testing release v5.0 testing commit 1c163f4c7b3f621efff9b28a47abb36f7378d783 with gcc (GCC) 8.1.0 kernel signature: 72b03c0b04ec08b00bf17719ea533594ddaa13003a285ea1a8a1bb4f094ce1cd run #0: crashed: general protection fault in ieee80211_chanctx_num_assigned run #1: crashed: general protection fault in ieee80211_chanctx_num_assigned run #2: crashed: general protection fault in corrupted run #3: crashed: general protection fault in ieee80211_chanctx_num_assigned run #4: crashed: general protection fault in ieee80211_chanctx_num_assigned run #5: crashed: general protection fault in corrupted run #6: crashed: general protection fault in ieee80211_chanctx_num_assigned run #7: crashed: general protection fault in ieee80211_chanctx_num_assigned run #8: crashed: general protection fault in ieee80211_chanctx_num_assigned run #9: crashed: general protection fault in corrupted testing release v4.20 testing commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be with gcc (GCC) 8.1.0 kernel signature: 11ca0ab06d80a8be6b8d183c3439e4933aca3cee9ba7dfae5bcabc06d48acd65 run #0: crashed: general protection fault in ieee80211_chanctx_num_assigned run #1: crashed: general protection fault in ieee80211_chanctx_num_assigned run #2: crashed: general protection fault in ieee80211_chanctx_num_assigned run #3: crashed: general protection fault in ieee80211_chanctx_num_assigned run #4: crashed: general protection fault in corrupted run #5: crashed: general protection fault in ieee80211_chanctx_num_assigned run #6: crashed: general protection fault in corrupted run #7: crashed: general protection fault in ieee80211_chanctx_num_assigned run #8: crashed: general protection fault in ieee80211_chanctx_num_assigned run #9: crashed: general protection fault in ieee80211_chanctx_num_assigned testing release v4.19 testing commit 84df9525b0c27f3ebc2ebb1864fa62a97fdedb7d with gcc (GCC) 8.1.0 kernel signature: 557a89643cf3bd108b6e7ef03ac96bae068db44f5c62379203409846ed1c9eb9 all runs: crashed: general protection fault in ieee80211_chanctx_num_assigned testing release v4.18 testing commit 94710cac0ef4ee177a63b5227664b38c95bbf703 with gcc (GCC) 8.1.0 kernel signature: 9f8816880a49fc7d8badd84d45a304131fbceb03e75891714562f5563f93b4f3 all runs: crashed: general protection fault in ieee80211_chanctx_num_assigned testing release v4.17 testing commit 29dcea88779c856c7dc92040a0c01233263101d4 with gcc (GCC) 8.1.0 kernel signature: eae4bb162e4acdc67e36beb963b2be9b3443497374097fdfd772b6dfbae5c99c all runs: crashed: general protection fault in ieee80211_chanctx_num_assigned testing release v4.16 testing commit 0adb32858b0bddf4ada5f364a84ed60b196dbcda with gcc (GCC) 8.1.0 kernel signature: 0eb8e100bfde25adda70ba8210ad040ae651faecc8c4352b1d7a60bf55c3f170 all runs: crashed: general protection fault in ieee80211_chanctx_num_assigned testing release v4.15 testing commit d8a5b80568a9cb66810e75b182018e9edb68e8ff with gcc (GCC) 8.1.0 kernel signature: ef25270c6c020ed52f5c0ac2ad6df7511bd77402315a9939b0f41db7ac7fd11d all runs: basic kernel testing failed: WARNING in check_flush_dependency testing release v4.14 testing commit bebc6082da0a9f5d47a1ea2edc099bf671058bd4 with gcc (GCC) 8.1.0 kernel signature: 9f33d94452b472e93dd91a65a080688cd1cfede938e902a58b1a540a963d3d0a all runs: crashed: general protection fault in ieee80211_chanctx_num_assigned testing release v4.13 testing commit 569dbb88e80deb68974ef6fdd6a13edb9d686261 with gcc (GCC) 8.1.0 kernel signature: 42d45e510f0de013c95afc84fb33ef77f62b5eca4f2bb3cb13b63b04db3f530a all runs: crashed: general protection fault in ieee80211_chanctx_num_assigned testing release v4.12 testing commit 6f7da290413ba713f0cdd9ff1a2a9bb129ef4f6c with gcc (GCC) 8.1.0 kernel signature: 721f2097ec08399e9d36e2e8394c4780035ec4601b31d83af20467f4dc015008 all runs: basic kernel testing failed: BUG: sleeping function called from invalid context in tap_get_minor testing release v4.11 testing commit a351e9b9fc24e982ec2f0e76379a49826036da12 with gcc (GCC) 7.3.0 kernel signature: 0e19a3effb8bd0cf84fadf6397cbee7e1adc8891ed3dc9beef657dacae07bcec all runs: basic kernel testing failed: BUG: sleeping function called from invalid context in tap_get_minor testing release v4.10 testing commit c470abd4fde40ea6a0846a2beab642a578c0b8cd with gcc (GCC) 5.5.0 kernel signature: 9e548339388e542ad0f0195284b478bc6dbff933242ac6c7ad64508ae5a52500 all runs: crashed: general protection fault in ieee80211_chanctx_num_assigned testing release v4.9 testing commit 69973b830859bc6529a7a0468ba0d80ee5117826 with gcc (GCC) 5.5.0 kernel signature: 388855143bf6989bf557cbcc6ce6e8dad50bad3733733ec149aace5e82ae0775 all runs: crashed: general protection fault in ieee80211_chanctx_num_assigned testing release v4.8 testing commit c8d2bc9bc39ebea8437fd974fdbc21847bb897a3 with gcc (GCC) 5.5.0 kernel signature: dc22fad4e0ab0ac227f09b810993cb107f08fe72d1779bf99dc248a0d423a6e5 all runs: crashed: general protection fault in ieee80211_chanctx_num_assigned testing release v4.7 testing commit 523d939ef98fd712632d93a5a2b588e477a7565e with gcc (GCC) 5.5.0 kernel signature: de01cdae053d7b42740546e4536e81296670a65880a0231463fb516ebd83f485 all runs: basic kernel testing failed: BUG: program execution failed: executor 0: failed to write control pipe: write |1: broken pipe testing release v4.6 testing commit 2dcd0af568b0cf583645c8a317dd12e344b1c72a with gcc (GCC) 5.5.0 kernel signature: f78a90fc8335a1e4def3e214f076cb9e8ae44761c3cf5b44fff5e994aa13ddd6 all runs: basic kernel testing failed: BUG: program execution failed: executor 0: failed to write control pipe: write |1: broken pipe revisions tested: 26, total time: 3h14m19.763520726s (build: 1h59m32.638155383s, test: 1h10m51.737687573s) the crash already happened on the oldest tested release commit msg: Linux 4.8 crash: general protection fault in ieee80211_chanctx_num_assigned IPv6: ADDRCONF(NETDEV_UP): veth1_to_batadv: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth0_to_batadv: link is not ready IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN Modules linked in: CPU: 1 PID: 9541 Comm: syz-executor.4 Not tainted 4.8.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff88013495c800 task.stack: ffff880137650000 RIP: 0010:[] [] ieee80211_chanctx_num_assigned+0x9d/0x120 net/mac80211/chan.c:20 RSP: 0018:ffff8801376573c8 EFLAGS: 00010a02 RAX: 0000000000000002 RBX: deacfffffffff9c8 RCX: ffff88013495d010 RDX: 1bd5a00000000020 RSI: ffff88013312f900 RDI: dead000000000100 RBP: ffff8801376573e8 R08: ffff88013a63d378 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff88013312f920 R13: dffffc0000000000 R14: ffff88013312f900 R15: 0000000000000000 FS: 00007f368a96b700(0000) GS:ffff88013bd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffc29fccf78 CR3: 000000013af37000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: ffff88012df38a60 ffff88013a63cc40 ffff88012df38a60 0000000000000000 ffff880137657448 ffffffff863b2712 0000000000000282 ffff88013a63dc70 ffff88012df39cc0 ffff88012df39a20 ffff88013a63db48 ffff88013a63cc40 Call Trace: [] ieee80211_assign_vif_chanctx+0x3b2/0x1250 net/mac80211/chan.c:675 [] __ieee80211_vif_release_channel+0x138/0x2d0 net/mac80211/chan.c:1542 [] ieee80211_vif_release_channel+0xe3/0x1c0 net/mac80211/chan.c:1756 [] ieee80211_ibss_disconnect+0x59d/0xc50 net/mac80211/ibss.c:742 [] ieee80211_ibss_leave+0xf/0xe0 net/mac80211/ibss.c:1853 [] ieee80211_leave_ibss+0x10/0x20 net/mac80211/cfg.c:2086 [] rdev_leave_ibss net/wireless/rdev-ops.h:519 [inline] [] __cfg80211_leave_ibss+0x135/0x690 net/wireless/ibss.c:211 [] cfg80211_leave_ibss+0x57/0x80 net/wireless/ibss.c:228 [] cfg80211_change_iface+0xcfc/0x12a0 net/wireless/util.c:1035 [] nl80211_set_interface+0x814/0xd90 net/wireless/nl80211.c:2739 [] genl_family_rcv_msg+0x5d7/0x1190 net/netlink/genetlink.c:634 [] genl_rcv_msg+0x162/0x260 net/netlink/genetlink.c:658 [] netlink_rcv_skb+0x242/0x350 net/netlink/af_netlink.c:2280 [] genl_rcv+0x23/0x40 net/netlink/genetlink.c:669 [] netlink_unicast_kernel net/netlink/af_netlink.c:1214 [inline] [] netlink_unicast+0x3df/0x570 net/netlink/af_netlink.c:1240 [] netlink_sendmsg+0x9bb/0xb40 net/netlink/af_netlink.c:1786 [] sock_sendmsg_nosec net/socket.c:609 [inline] [] sock_sendmsg+0xb5/0xf0 net/socket.c:619 [] ___sys_sendmsg+0x6f0/0x860 net/socket.c:1942 [] __sys_sendmsg+0xc1/0x140 net/socket.c:1976 [] SYSC_sendmsg net/socket.c:1987 [inline] [] SyS_sendmsg+0xd/0x20 net/socket.c:1983 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Code: 8d 98 c8 f8 ff ff 49 39 c4 b8 00 00 00 00 74 35 49 bd 00 00 00 00 00 fc ff df 48 8d bb 38 07 00 00 83 c0 01 48 89 fa 48 c1 ea 03 <42> 80 3c 2a 00 75 60 48 8b 93 38 07 00 00 48 8d 9a c8 f8 ff ff RIP [] ieee80211_chanctx_num_assigned+0x9d/0x120 net/mac80211/chan.c:20 RSP ---[ end trace 190e01756436f3f0 ]---