bisecting fixing commit since 3dd0130f2430decf0cb001b452824515436986d2
building syzkaller on 4a77ae0bdc5cd75ebe88ce7c896aae6bbf457a29
testing commit 3dd0130f2430decf0cb001b452824515436986d2 with gcc (GCC) 8.1.0
kernel signature: 6dcc3a7df9791dc459583be91b7565ef215a2fb21567666a8d5e386f6aeff85a
all runs: crashed: WARNING in ieee80211_free_ack_frame
testing current HEAD eccc876724927ff3b9ff91f36f7b6b159e948f0c
testing commit eccc876724927ff3b9ff91f36f7b6b159e948f0c with gcc (GCC) 8.1.0
kernel signature: 0c6d5899664b2694c47e49cebf96392fd1fce54293279919de26a885d91a84dc
run #0: crashed: BUG: sleeping function called from invalid context in sta_info_move_state
run #1: crashed: WARNING in ieee80211_free_ack_frame
run #2: crashed: WARNING in ieee80211_free_ack_frame
run #3: crashed: WARNING in ieee80211_free_ack_frame
run #4: crashed: WARNING in ieee80211_free_ack_frame
run #5: crashed: WARNING in ieee80211_free_ack_frame
run #6: crashed: WARNING in ieee80211_free_ack_frame
run #7: crashed: WARNING in ieee80211_free_ack_frame
run #8: crashed: WARNING in ieee80211_free_ack_frame
run #9: crashed: WARNING in ieee80211_free_ack_frame
revisions tested: 2, total time: 24m56.319501452s (build: 9m55.018823034s, test: 14m31.876271799s)
the crash still happens on HEAD
commit msg: Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
crash: WARNING in ieee80211_free_ack_frame
------------[ cut here ]------------
Have pending ack frames!
WARNING: CPU: 0 PID: 120 at net/mac80211/main.c:1396 ieee80211_free_ack_frame+0x33/0x40 net/mac80211/main.c:1396
Modules linked in:

CPU: 0 PID: 120 Comm: kworker/u4:3 Not tainted 5.10.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: netns cleanup_net
RIP: 0010:ieee80211_free_ack_frame+0x33/0x40 net/mac80211/main.c:1396
Code: 01 00 74 0f 48 89 f7 e8 7b 5c 9d ff 31 c0 48 83 c4 08 c3 48 c7 c7 d3 52 31 84 48 89 34 24 c6 05 a4 0a ca 01 01 e8 e3 0e 20 00 <0f> 0b 48 8b 34 24 eb d2 0f 1f 44 00 00 53 48 89 fb 0f 1f 44 00 00
RSP: 0018:ffffc90000fc7c70 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000001
RDX: 0000000080000001 RSI: ffffffff842a1aa6 RDI: 00000000ffffffff
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001
R10: ffffc90000fc7a78 R11: 0000000000000001 R12: ffffffff82fb93e0
R13: ffff88811f882fa8 R14: ffff88811fdae4b0 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005645c1453b68 CR3: 0000000102f44000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 idr_for_each+0x57/0xc0 lib/idr.c:208
 ieee80211_free_hw+0x4b/0xd0 net/mac80211/main.c:1412
 mac80211_hwsim_del_radio+0x10f/0x140 drivers/net/wireless/mac80211_hwsim.c:3363
 hwsim_exit_net+0x242/0x440 drivers/net/wireless/mac80211_hwsim.c:4115
 ops_exit_list.isra.9+0x31/0x60 net/core/net_namespace.c:187
 cleanup_net+0x273/0x3d0 net/core/net_namespace.c:604
 process_one_work+0x273/0x600 kernel/workqueue.c:2272
 worker_thread+0x38/0x380 kernel/workqueue.c:2418
 kthread+0x145/0x170 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296