wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
Oops: general protection fault, probably for non-canonical address 0xdffffc000000069f: 0000 [#1] SMP KASAN PTI
KASAN: probably user-memory-access in range [0x00000000000034f8-0x00000000000034ff]
CPU: 0 UID: 0 PID: 7823 Comm: kworker/u8:9 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue: events_unbound cfg80211_wiphy_work
RIP: 0010:__ieee80211_get_radio_mask+0xa1/0x420 net/mac80211/util.c:4225
Code: 04 00 00 00 00 eb 1e e8 ed 06 9f f6 49 89 de 49 83 fc 0e 0f 84 71 03 00 00 e8 db 06 9f f6 48 83 c5 08 49 ff c4 48 8b 44 24 30 <42> 0f b6 04 38 84 c0 0f 85 f6 02 00 00 48 8b 44 24 08 44 0f b7 28
RSP: 0018:ffffc90003636fb8 EFLAGS: 00010202
RAX: 000000000000069f RBX: 0000000000000ec0 RCX: ffff8880276f8000
RDX: 0000000000000330 RSI: 0000000000000000 RDI: 0000000000000ec0
RBP: 0000000000003480 R08: ffff888079520ad7 R09: 1ffff1100f2a415a
R10: dffffc0000000000 R11: ffffffff8b26ee80 R12: 0000000000000000
R13: ffff888079520020 R14: 0000000000000ed0 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff88812527c000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00002000001d4000 CR3: 0000000052412000 CR4: 00000000003526f0
Call Trace:
<TASK>
rdev_get_radio_mask net/wireless/rdev-ops.h:1605 [inline]
cfg80211_calculate_bi_data net/wireless/util.c:2431 [inline]
cfg80211_iter_combinations+0x260/0x1c90 net/wireless/util.c:2504
ieee80211_max_num_channels+0x186/0x250 net/mac80211/util.c:4389
ieee80211_can_create_new_chanctx+0x1df/0x270 net/mac80211/chan.c:256
ieee80211_find_available_radio net/mac80211/chan.c:1529 [inline]
ieee80211_find_or_create_chanctx+0x4e2/0x7b0 net/mac80211/chan.c:2208
_ieee80211_link_use_channel+0x4fd/0xcb0 net/mac80211/chan.c:2319
ieee80211_link_use_channel net/mac80211/ieee80211_i.h:2823 [inline]
__ieee80211_sta_join_ibss+0x6a4/0x1660 net/mac80211/ibss.c:292
ieee80211_sta_create_ibss+0x300/0x480 net/mac80211/ibss.c:1286
ieee80211_sta_find_ibss net/mac80211/ibss.c:1415 [inline]
ieee80211_ibss_work+0xd99/0x1060 net/mac80211/ibss.c:1636
cfg80211_wiphy_work+0x29e/0x420 net/wireless/core.c:538
process_one_work kernel/workqueue.c:3314 [inline]
process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3397
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3478
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__ieee80211_get_radio_mask+0xa1/0x420 net/mac80211/util.c:4225
Code: 04 00 00 00 00 eb 1e e8 ed 06 9f f6 49 89 de 49 83 fc 0e 0f 84 71 03 00 00 e8 db 06 9f f6 48 83 c5 08 49 ff c4 48 8b 44 24 30 <42> 0f b6 04 38 84 c0 0f 85 f6 02 00 00 48 8b 44 24 08 44 0f b7 28
RSP: 0018:ffffc90003636fb8 EFLAGS: 00010202
RAX: 000000000000069f RBX: 0000000000000ec0 RCX: ffff8880276f8000
RDX: 0000000000000330 RSI: 0000000000000000 RDI: 0000000000000ec0
RBP: 0000000000003480 R08: ffff888079520ad7 R09: 1ffff1100f2a415a
R10: dffffc0000000000 R11: ffffffff8b26ee80 R12: 0000000000000000
R13: ffff888079520020 R14: 0000000000000ed0 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff88812527c000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00002000004f9000 CR3: 0000000084fec000 CR4: 00000000003526f0
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 00 00 add %al,(%rax)
2: 00 00 add %al,(%rax)
4: eb 1e jmp 0x24
6: e8 ed 06 9f f6 call 0xf69f06f8
b: 49 89 de mov %rbx,%r14
e: 49 83 fc 0e cmp $0xe,%r12
12: 0f 84 71 03 00 00 je 0x389
18: e8 db 06 9f f6 call 0xf69f06f8
1d: 48 83 c5 08 add $0x8,%rbp
21: 49 ff c4 inc %r12
24: 48 8b 44 24 30 mov 0x30(%rsp),%rax
* 29: 42 0f b6 04 38 movzbl (%rax,%r15,1),%eax <-- trapping instruction
2e: 84 c0 test %al,%al
30: 0f 85 f6 02 00 00 jne 0x32c
36: 48 8b 44 24 08 mov 0x8(%rsp),%rax
3b: 44 0f b7 28 movzwl (%rax),%r13d