bisecting cause commit starting from c85fb28b6f999db9928b841f63f1beeb3074eeca building syzkaller on 92390980c13f2571a66bfdca5802d55b137f0ccc testing commit c85fb28b6f999db9928b841f63f1beeb3074eeca with gcc (GCC) 8.1.0 kernel signature: a512d59d3d32f24295f4696188aa059d16ffa2b55eb07d5622470be2d0df03fa run #0: crashed: WARNING in ieee80211_free_ack_frame run #1: crashed: WARNING in ieee80211_free_ack_frame run #2: crashed: WARNING in ieee80211_free_ack_frame run #3: crashed: WARNING in ieee80211_free_ack_frame run #4: crashed: WARNING in ieee80211_free_ack_frame run #5: crashed: WARNING in ieee80211_free_ack_frame run #6: crashed: WARNING in ieee80211_free_ack_frame run #7: crashed: WARNING in ieee80211_free_ack_frame run #8: crashed: WARNING in ieee80211_free_ack_frame run #9: OK testing release v5.8 testing commit bcf876870b95592b52519ed4aafcf9d95999bc9c with gcc (GCC) 8.1.0 kernel signature: c8e76bd576d17a3da7d4c04675d695d50c50a29d2841a6f17b484f81b639c306 run #0: crashed: WARNING in ieee80211_free_ack_frame run #1: crashed: WARNING in ieee80211_free_ack_frame run #2: crashed: WARNING in ieee80211_free_ack_frame run #3: crashed: WARNING in ieee80211_free_ack_frame run #4: crashed: WARNING in ieee80211_free_ack_frame run #5: crashed: WARNING in ieee80211_free_ack_frame run #6: crashed: WARNING in ieee80211_free_ack_frame run #7: crashed: WARNING in ieee80211_free_ack_frame run #8: crashed: WARNING in ieee80211_free_ack_frame run #9: OK testing release v5.7 testing commit 3d77e6a8804abcc0504c904bd6e5cdf3a5cf8162 with gcc (GCC) 8.1.0 kernel signature: 6c79a1274846e1dd35e051f11e5da60649d2f713717c461e4116c55f65b7924c all runs: crashed: WARNING in ieee80211_free_ack_frame testing release v5.6 testing commit 7111951b8d4973bda27ff663f2cf18b663d15b48 with gcc (GCC) 8.1.0 kernel signature: 31cb6ec86e01e8d2d4c6c243fb9d4b5e3a51b51fb0a78db6365b00d2381e9dc2 all runs: crashed: WARNING in ieee80211_free_ack_frame testing release v5.5 testing commit d5226fa6dbae0569ee43ecfc08bdcd6770fc4755 with gcc (GCC) 8.1.0 kernel signature: ee6d31c410c6a9c95c364337774192866a3f8e6eb95d2e0a8e905e81ddddb9a3 all runs: crashed: WARNING in ieee80211_free_ack_frame testing release v5.4 testing commit 219d54332a09e8d8741c1e1982f5eae56099de85 with gcc (GCC) 8.1.0 kernel signature: c884ac6ac81875c7ea10781f22397d722e91708db5eed37129946e0cfe28bc72 all runs: crashed: WARNING in ieee80211_free_ack_frame testing release v5.3 testing commit 4d856f72c10ecb060868ed10ff1b1453943fc6c8 with gcc (GCC) 8.1.0 kernel signature: 65d2cbf91e25155d7a7b2b15f0c9e9a7fd39b232e78d8edb58ea3e8cc3e3d4c3 all runs: crashed: WARNING in ieee80211_free_ack_frame testing release v5.2 testing commit 0ecfebd2b52404ae0c54a878c872bb93363ada36 with gcc (GCC) 8.1.0 kernel signature: acfbe3f2a17e328a185a3e5d3df112e857a8808e3bd5bf95db1a2be729f32f18 all runs: crashed: WARNING in ieee80211_free_ack_frame testing release v5.1 testing commit e93c9c99a629c61837d5a7fc2120cd2b6c70dbdd with gcc (GCC) 8.1.0 kernel signature: 73d1766980e639fa5d0a5b0cd6b21ba7d56f30b781ea31ce17e077b6c18918f2 all runs: crashed: WARNING in ieee80211_free_ack_frame testing release v5.0 testing commit 1c163f4c7b3f621efff9b28a47abb36f7378d783 with gcc (GCC) 8.1.0 kernel signature: d40f7b5b06a0e44d9d5e451d2b2e184d5566e2d3b8a42a1bf54cdeafa1f9ba4c all runs: crashed: WARNING in ieee80211_free_ack_frame testing release v4.20 testing commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be with gcc (GCC) 8.1.0 certs/signing_key.pem: Permission denied testing release v4.19 testing commit 84df9525b0c27f3ebc2ebb1864fa62a97fdedb7d with gcc (GCC) 8.1.0 certs/signing_key.pem: Permission denied testing release v4.18 testing commit 94710cac0ef4ee177a63b5227664b38c95bbf703 with gcc (GCC) 8.1.0 certs/signing_key.pem: Permission denied testing release v4.17 testing commit 29dcea88779c856c7dc92040a0c01233263101d4 with gcc (GCC) 8.1.0 certs/signing_key.pem: Permission denied testing release v4.16 testing commit 0adb32858b0bddf4ada5f364a84ed60b196dbcda with gcc (GCC) 8.1.0 certs/signing_key.pem: Permission denied testing release v4.15 testing commit d8a5b80568a9cb66810e75b182018e9edb68e8ff with gcc (GCC) 8.1.0 certs/signing_key.pem: Permission denied testing release v4.14 testing commit bebc6082da0a9f5d47a1ea2edc099bf671058bd4 with gcc (GCC) 8.1.0 certs/signing_key.pem: Permission denied testing release v4.13 testing commit 569dbb88e80deb68974ef6fdd6a13edb9d686261 with gcc (GCC) 8.1.0 certs/signing_key.pem: Permission denied testing release v4.12 testing commit 6f7da290413ba713f0cdd9ff1a2a9bb129ef4f6c with gcc (GCC) 8.1.0 certs/signing_key.pem: Permission denied testing release v4.11 testing commit a351e9b9fc24e982ec2f0e76379a49826036da12 with gcc (GCC) 7.3.0 certs/signing_key.pem: Permission denied testing release v4.10 testing commit c470abd4fde40ea6a0846a2beab642a578c0b8cd with gcc (GCC) 5.5.0 certs/signing_key.pem: Permission denied testing release v4.9 testing commit 69973b830859bc6529a7a0468ba0d80ee5117826 with gcc (GCC) 5.5.0 certs/signing_key.pem: Permission denied testing release v4.8 testing commit c8d2bc9bc39ebea8437fd974fdbc21847bb897a3 with gcc (GCC) 5.5.0 certs/signing_key.pem: Permission denied testing release v4.7 testing commit 523d939ef98fd712632d93a5a2b588e477a7565e with gcc (GCC) 5.5.0 certs/signing_key.pem: Permission denied testing release v4.6 testing commit 2dcd0af568b0cf583645c8a317dd12e344b1c72a with gcc (GCC) 5.5.0 certs/signing_key.pem: Permission denied revisions tested: 25, total time: 2h34m47.045324785s (build: 1h24m28.827274709s, test: 1h6m35.066011983s) the crash already happened on the oldest tested release commit msg: Linux 5.0 crash: WARNING in ieee80211_free_ack_frame mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium ------------[ cut here ]------------ Have pending ack frames! WARNING: CPU: 0 PID: 4226 at net/mac80211/main.c:1331 ieee80211_free_ack_frame+0x34/0x40 net/mac80211/main.c:1331 mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 4226 Comm: kworker/u4:5 Not tainted 5.0.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: netns cleanup_net Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x165/0x21a lib/dump_stack.c:113 panic+0x212/0x40b kernel/panic.c:214 __warn.cold.7+0x1b/0x38 kernel/panic.c:571 report_bug+0x1a4/0x200 lib/bug.c:186 fixup_bug arch/x86/kernel/traps.c:178 [inline] do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:271 do_invalid_op+0x36/0x40 arch/x86/kernel/traps.c:290 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:973 RIP: 0010:ieee80211_free_ack_frame+0x34/0x40 net/mac80211/main.c:1331 Code: 1b c4 bd 02 00 74 0c 48 89 f7 e8 77 b0 e1 fe 31 c0 c9 c3 48 c7 c7 e0 e5 17 88 48 89 75 f8 c6 05 fb c3 bd 02 01 e8 6f b0 97 fa <0f> 0b 48 8b 75 f8 eb d5 0f 1f 40 00 55 be 04 00 00 00 48 89 e5 41 RSP: 0018:ffff88808a467948 EFLAGS: 00010286 RAX: 0000000000000000 RBX: dffffc0000000000 RCX: 0000000000000000 RDX: 0000000000000004 RSI: 0000000000000008 RDI: ffffffff8a5a4de0 RBP: ffff88808a467950 R08: ffffed1015d03f01 R09: ffffed1015d03f00 R10: ffffed1015d03f00 R11: ffff8880ae81f807 R12: 0000000000000000 R13: ffffffff86a3e710 R14: ffff88807cdd84b0 R15: ffff88808a467a08 idr_for_each+0x10c/0x1f0 lib/idr.c:207 ieee80211_free_hw+0x87/0x250 net/mac80211/main.c:1347 mac80211_hwsim_del_radio+0x2b0/0x360 drivers/net/wireless/mac80211_hwsim.c:3028 mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium hwsim_exit_net+0x869/0x1200 drivers/net/wireless/mac80211_hwsim.c:3764 ops_exit_list.isra.0+0x8b/0x120 net/core/net_namespace.c:153 cleanup_net+0x363/0x840 net/core/net_namespace.c:551 process_one_work+0x7b9/0x15e0 kernel/workqueue.c:2173 worker_thread+0x85/0xb60 kernel/workqueue.c:2319 kthread+0x324/0x3e0 kernel/kthread.c:246 mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Kernel Offset: disabled Rebooting in 86400 seconds..