program: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000300)={'wlan0\x00', 0x1000}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x24}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000000)={'wlan0\x00', 0x1}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000dc0)={0x28, r1, 0x1, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}]}, 0x28}, 0x1, 0x0, 0x0, 0x85}, 0x4c040) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000032c0)={0x2c, r4, 0x1, 0x70bd2a, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xf9}]}, 0x2c}}, 0x0) (fail_nth: 10) [ 92.862390][ T4653] Bluetooth: hci0: command tx timeout [ 92.882814][ T10] cfg80211: failed to load regulatory.db [ 93.043227][ T5330] FAULT_INJECTION: forcing a failure. [ 93.043227][ T5330] name failslab, interval 1, probability 0, space 0, times 1 [ 93.054026][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.054066][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.054072][ T5330] Call Trace: [ 93.054077][ T5330] [ 93.054082][ T5330] dump_stack_lvl+0xe8/0x150 [ 93.054146][ T5330] should_fail_ex+0x40c/0x560 [ 93.054195][ T5330] should_failslab+0xa8/0x100 [ 93.054213][ T5330] __kmalloc_noprof+0xfe/0x720 [ 93.054227][ T5330] ? ieee80211_mesh_build_beacon+0xbe/0x1b90 [ 93.054268][ T5330] ? ieee80211_mesh_build_beacon+0xbe/0x1b90 [ 93.054307][ T5330] ieee80211_mesh_build_beacon+0xbe/0x1b90 [ 93.054328][ T5330] ieee80211_mesh_rebuild_beacon+0xc7/0x170 [ 93.054341][ T5330] ieee80211_mesh_csa_beacon+0x140/0x2c0 [ 93.054360][ T5330] ieee80211_set_csa_beacon+0x3e2/0x9c0 [ 93.054382][ T5330] ieee80211_channel_switch+0x8b0/0xcb0 [ 93.054404][ T5330] ? __pfx_ieee80211_channel_switch+0x10/0x10 [ 93.054417][ T5330] ? cfg80211_chandef_valid+0xa75/0xe60 [ 93.054435][ T5330] ? cfg80211_get_end_freq+0xff/0x1b0 [ 93.054456][ T5330] ? cfg80211_get_end_freq+0xff/0x1b0 [ 93.054479][ T5330] ? rcu_is_watching+0x15/0xb0 [ 93.054493][ T5330] ? cfg80211_reg_check_beaconing+0xcf3/0x11d0 [ 93.054511][ T5330] rdev_channel_switch+0xfc/0x290 [ 93.054528][ T5330] nl80211_channel_switch+0xb8a/0xe90 [ 93.054549][ T5330] ? __pfx_nl80211_channel_switch+0x10/0x10 [ 93.054596][ T5330] ? __pfx___cfg80211_wdev_from_attrs+0x10/0x10 [ 93.054617][ T5330] ? __nla_parse+0x40/0x60 [ 93.054636][ T5330] ? nl80211_pre_doit+0x53d/0x890 [ 93.054654][ T5330] genl_family_rcv_msg_doit+0x233/0x340 [ 93.054676][ T5330] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 93.054698][ T5330] ? bpf_lsm_capable+0x9/0x20 [ 93.054711][ T5330] ? security_capable+0x7e/0x2c0 [ 93.054732][ T5330] genl_rcv_msg+0x614/0x7a0 [ 93.054751][ T5330] ? __pfx_genl_rcv_msg+0x10/0x10 [ 93.054766][ T5330] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 93.054781][ T5330] ? __pfx_nl80211_channel_switch+0x10/0x10 [ 93.054793][ T5330] ? __pfx_nl80211_post_doit+0x10/0x10 [ 93.054809][ T5330] ? __pfx_ref_tracker_free+0x10/0x10 [ 93.054824][ T5330] ? __asan_memcpy+0x40/0x70 [ 93.054834][ T5330] ? __skb_clone+0x5c/0x6c0 [ 93.054850][ T5330] netlink_rcv_skb+0x226/0x4a0 [ 93.054863][ T5330] ? __pfx_genl_rcv_msg+0x10/0x10 [ 93.054880][ T5330] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 93.054901][ T5330] ? down_read+0x2be/0x330 [ 93.054919][ T5330] genl_rcv+0x28/0x40 [ 93.054934][ T5330] netlink_unicast+0x7bb/0x940 [ 93.054952][ T5330] netlink_sendmsg+0x813/0xb40 [ 93.054973][ T5330] ? __pfx_netlink_sendmsg+0x10/0x10 [ 93.054988][ T5330] ? aa_sock_msg_perm+0xf1/0x1b0 [ 93.055003][ T5330] ? __pfx_netlink_sendmsg+0x10/0x10 [ 93.055015][ T5330] sock_sendmsg_nosec+0x13a/0x180 [ 93.055033][ T5330] ____sys_sendmsg+0x54e/0x850 [ 93.055048][ T5330] ? __pfx_____sys_sendmsg+0x10/0x10 [ 93.055066][ T5330] ? import_iovec+0x73/0xa0 [ 93.055084][ T5330] ___sys_sendmsg+0x2a5/0x360 [ 93.055095][ T5330] ? __lock_acquire+0x683/0x2cf0 [ 93.055114][ T5330] ? __pfx____sys_sendmsg+0x10/0x10 [ 93.055148][ T5330] ? __fget_files+0x2a/0x420 [ 93.055161][ T5330] ? __fget_files+0x3a2/0x420 [ 93.055181][ T5330] __x64_sys_sendmsg+0x1b1/0x290 [ 93.055195][ T5330] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 93.055219][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.055232][ T5330] do_syscall_64+0x174/0x580 [ 93.055247][ T5330] ? clear_bhb_loop+0x70/0xc0 [ 93.055261][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.055273][ T5330] RIP: 0033:0x7f586179e0d9 [ 93.055284][ T5330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.055293][ T5330] RSP: 002b:00007f5862640fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 93.055307][ T5330] RAX: ffffffffffffffda RBX: 00007f5861a25fa0 RCX: 00007f586179e0d9 [ 93.055316][ T5330] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000005 [ 93.055322][ T5330] RBP: 00007f5862641050 R08: 0000000000000000 R09: 0000000000000000 [ 93.055328][ T5330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 93.055333][ T5330] R13: 00007f5861a26038 R14: 00007f5861a25fa0 R15: 00007ffc5f76bbe8 [ 93.055358][ T5330] [ 93.057110][ T5330] [ 93.237614][ T5330] ============================= [ 93.239744][ T5330] WARNING: suspicious RCU usage [ 93.241925][ T5330] syzkaller #0 Not tainted [ 93.244041][ T5330] ----------------------------- [ 93.246179][ T5330] net/mac80211/mesh.c:1558 suspicious rcu_dereference_check() usage! [ 93.249697][ T5330] [ 93.249697][ T5330] other info that might help us debug this: [ 93.249697][ T5330] [ 93.254357][ T5330] [ 93.254357][ T5330] rcu_scheduler_active = 2, debug_locks = 1 [ 93.257743][ T5330] 2 locks held by syz.0.0/5330: [ 93.259784][ T5330] #0: ffffffff900a1068 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 93.263563][ T5330] #1: ffff8880507e07a0 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: nl80211_pre_doit+0x3c0/0x890 [ 93.267506][ T5330] [ 93.267506][ T5330] stack backtrace: [ 93.269867][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.269881][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.269887][ T5330] Call Trace: [ 93.269894][ T5330] [ 93.269899][ T5330] dump_stack_lvl+0xe8/0x150 [ 93.269919][ T5330] lockdep_rcu_suspicious+0x13f/0x1d0 [ 93.269937][ T5330] ieee80211_mesh_csa_beacon+0x280/0x2c0 [ 93.269958][ T5330] ieee80211_set_csa_beacon+0x3e2/0x9c0 [ 93.269975][ T5330] ieee80211_channel_switch+0x8b0/0xcb0 [ 93.269995][ T5330] ? __pfx_ieee80211_channel_switch+0x10/0x10 [ 93.270007][ T5330] ? cfg80211_chandef_valid+0xa75/0xe60 [ 93.270023][ T5330] ? cfg80211_get_end_freq+0xff/0x1b0 [ 93.270041][ T5330] ? cfg80211_get_end_freq+0xff/0x1b0 [ 93.270062][ T5330] ? rcu_is_watching+0x15/0xb0 [ 93.270072][ T5330] ? cfg80211_reg_check_beaconing+0xcf3/0x11d0 [ 93.270090][ T5330] rdev_channel_switch+0xfc/0x290 [ 93.270106][ T5330] nl80211_channel_switch+0xb8a/0xe90 [ 93.270127][ T5330] ? __pfx_nl80211_channel_switch+0x10/0x10 [ 93.270166][ T5330] ? __pfx___cfg80211_wdev_from_attrs+0x10/0x10 [ 93.270184][ T5330] ? __nla_parse+0x40/0x60 [ 93.270201][ T5330] ? nl80211_pre_doit+0x53d/0x890 [ 93.270218][ T5330] genl_family_rcv_msg_doit+0x233/0x340 [ 93.270230][ T5330] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 93.270243][ T5330] ? bpf_lsm_capable+0x9/0x20 [ 93.270251][ T5330] ? security_capable+0x7e/0x2c0 [ 93.270263][ T5330] genl_rcv_msg+0x614/0x7a0 [ 93.270299][ T5330] ? __pfx_genl_rcv_msg+0x10/0x10 [ 93.270308][ T5330] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 93.270317][ T5330] ? __pfx_nl80211_channel_switch+0x10/0x10 [ 93.270326][ T5330] ? __pfx_nl80211_post_doit+0x10/0x10 [ 93.270339][ T5330] ? __pfx_ref_tracker_free+0x10/0x10 [ 93.270351][ T5330] ? __asan_memcpy+0x40/0x70 [ 93.270362][ T5330] ? __skb_clone+0x5c/0x6c0 [ 93.270377][ T5330] netlink_rcv_skb+0x226/0x4a0 [ 93.270388][ T5330] ? __pfx_genl_rcv_msg+0x10/0x10 [ 93.270402][ T5330] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 93.270422][ T5330] ? down_read+0x2be/0x330 [ 93.270438][ T5330] genl_rcv+0x28/0x40 [ 93.270451][ T5330] netlink_unicast+0x7bb/0x940 [ 93.270468][ T5330] netlink_sendmsg+0x813/0xb40 [ 93.270486][ T5330] ? __pfx_netlink_sendmsg+0x10/0x10 [ 93.270499][ T5330] ? aa_sock_msg_perm+0xf1/0x1b0 [ 93.270511][ T5330] ? __pfx_netlink_sendmsg+0x10/0x10 [ 93.270522][ T5330] sock_sendmsg_nosec+0x13a/0x180 [ 93.270537][ T5330] ____sys_sendmsg+0x54e/0x850 [ 93.270551][ T5330] ? __pfx_____sys_sendmsg+0x10/0x10 [ 93.270568][ T5330] ? import_iovec+0x73/0xa0 [ 93.270585][ T5330] ___sys_sendmsg+0x2a5/0x360 [ 93.270595][ T5330] ? __lock_acquire+0x683/0x2cf0 [ 93.270610][ T5330] ? __pfx____sys_sendmsg+0x10/0x10 [ 93.270626][ T5330] ? __fget_files+0x2a/0x420 [ 93.270635][ T5330] ? __fget_files+0x3a2/0x420 [ 93.270646][ T5330] __x64_sys_sendmsg+0x1b1/0x290 [ 93.270655][ T5330] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 93.270675][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.270687][ T5330] do_syscall_64+0x174/0x580 [ 93.270701][ T5330] ? clear_bhb_loop+0x70/0xc0 [ 93.270713][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.270723][ T5330] RIP: 0033:0x7f586179e0d9 [ 93.270734][ T5330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.270742][ T5330] RSP: 002b:00007f5862640fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 93.270753][ T5330] RAX: ffffffffffffffda RBX: 00007f5861a25fa0 RCX: 00007f586179e0d9 [ 93.270760][ T5330] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000005 [ 93.270766][ T5330] RBP: 00007f5862641050 R08: 0000000000000000 R09: 0000000000000000 [ 93.270772][ T5330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 93.270778][ T5330] R13: 00007f5861a26038 R14: 00007f5861a25fa0 R15: 00007ffc5f76bbe8 [ 93.270793][ T5330]