bisecting fixing commit since 255b58a2b3af0baa0ee11507390349217b8b73b0 building syzkaller on 3e5ed8b45e7a561d6344a4d3d7bf3bfb8f24a7b3 testing commit 255b58a2b3af0baa0ee11507390349217b8b73b0 with gcc (GCC) 8.4.1 20210217 kernel signature: 3d94c5210a684ab13cceb8b5e740e0e56cf400083a3eb4a1be138ed1ff3c8aac all runs: crashed: WARNING in ieee80211_start_next_roc testing current HEAD 2965db2e004cf9c92b87c1f559e9812c0ae878c1 testing commit 2965db2e004cf9c92b87c1f559e9812c0ae878c1 with gcc (GCC) 8.4.1 20210217 kernel signature: 8bc4735e2576e2345f5b5ff2e1b71acc2c4b35bf9ab23f5f437daf547e768dea all runs: crashed: WARNING in ieee80211_start_next_roc revisions tested: 2, total time: 31m59.023810574s (build: 24m36.401310108s, test: 6m44.660771093s) the crash still happens on HEAD commit msg: Linux 4.19.188 crash: WARNING in ieee80211_start_next_roc wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready WARNING: CPU: 1 PID: 10087 at net/mac80211/offchannel.c:419 ieee80211_start_next_roc+0x198/0x220 net/mac80211/offchannel.c:405 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 10087 Comm: syz-executor.5 Not tainted 4.19.188-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x226 lib/dump_stack.c:118 panic+0x1cd/0x375 kernel/panic.c:186 __warn.cold.7+0x1b/0x36 kernel/panic.c:541 report_bug+0x1a1/0x200 lib/bug.c:186 fixup_bug arch/x86/kernel/traps.c:178 [inline] fixup_bug arch/x86/kernel/traps.c:173 [inline] do_error_trap+0x200/0x350 arch/x86/kernel/traps.c:296 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1038 RIP: 0010:ieee80211_start_next_roc net/mac80211/offchannel.c:419 [inline] RIP: 0010:ieee80211_start_next_roc+0x198/0x220 net/mac80211/offchannel.c:401 Code: bb 60 10 00 00 be ff ff ff ff e8 83 3f 19 fa 85 c0 0f 85 c4 fe ff ff 48 c7 c7 20 42 f6 88 e8 8b f1 54 00 0f 0b e9 b1 fe ff ff <0f> 0b eb cb bf 32 00 00 00 e8 0a e5 20 fa 48 8d b3 98 16 00 00 48 RSP: 0018:ffff8880a010f368 EFLAGS: 00010202 RAX: 0000000000000000 RBX: ffff88809ae89a20 RCX: ffffed10167455d0 RDX: 1ffff110156e4714 RSI: 0000000000000000 RDI: ffff8880ab7238a0 RBP: ffff8880a010f378 R08: 1ffff110167455d0 R09: ffffed10135d1524 R10: ffffed10135d1524 R11: ffff88809ae8a927 R12: ffff8880ab723880 R13: ffff88809ae89a20 R14: ffff88809ae8a900 R15: 0000000000000001 __ieee80211_scan_completed+0x47c/0x1180 net/mac80211/scan.c:442 ieee80211_scan_cancel+0x2a3/0x740 net/mac80211/scan.c:1168 ieee80211_do_stop+0x13bb/0x1d90 net/mac80211/iface.c:813 ieee80211_runtime_change_iftype net/mac80211/iface.c:1549 [inline] ieee80211_if_change_type+0x261/0x540 net/mac80211/iface.c:1585 ieee80211_change_iface+0x29/0x1e0 net/mac80211/cfg.c:157 rdev_change_virtual_intf net/wireless/rdev-ops.h:69 [inline] cfg80211_change_iface+0x200/0xff0 net/wireless/util.c:936 nl80211_set_interface+0x45e/0x880 net/wireless/nl80211.c:3205 genl_family_rcv_msg+0x599/0x1000 net/netlink/genetlink.c:602 genl_rcv_msg+0xa7/0x140 net/netlink/genetlink.c:627 netlink_rcv_skb+0x13e/0x3d0 net/netlink/af_netlink.c:2455 genl_rcv+0x23/0x40 net/netlink/genetlink.c:638 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x443/0x660 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x667/0xc60 net/netlink/af_netlink.c:1909 sock_sendmsg_nosec net/socket.c:622 [inline] sock_sendmsg+0xac/0xf0 net/socket.c:632 __sys_sendto+0x1f2/0x2e0 net/socket.c:1787 __do_sys_sendto net/socket.c:1799 [inline] __se_sys_sendto net/socket.c:1795 [inline] __x64_sys_sendto+0xdc/0x1a0 net/socket.c:1795 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4194ac Code: fa fa ff ff 44 8b 4c 24 2c 4c 8b 44 24 20 89 c5 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b 7c 24 08 0f 05 <48> 3d 00 f0 ff ff 77 34 89 ef 48 89 44 24 08 e8 20 fb ff ff 48 8b RSP: 002b:00007f863549df80 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f863549e0f0 RCX: 00000000004194ac RDX: 0000000000000024 RSI: 00007f863549e140 RDI: 0000000000000007 RBP: 0000000000000000 R08: 00007f863549dfd4 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 00007f863549e140 R14: 0000000000000007 R15: 0000000000000000 Kernel Offset: disabled Rebooting in 86400 seconds..