program: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller0\x00', 0x7101}) r1 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) copy_file_range(r1, 0x0, r0, &(0x7f00000001c0)=0x4, 0xfffffffffffff70e, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x101002, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x24, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000540)={0x5c, r4, 0x800, 0x70bd26, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@crypto_settings=[@NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0xf6}, @NL80211_ATTR_CONTROL_PORT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0x200}, @NL80211_ATTR_WPA_VERSIONS={0x8, 0x4b, 0x3}, @NL80211_ATTR_AKM_SUITES={0x8, 0x4c, [0xfac14]}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000014) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_STATION(r6, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000240)={0x48, r7, 0xb97534d5fe9704cf, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x580}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6}, @NL80211_ATTR_STA_FLAGS2={0xc, 0x43, {0xe, 0x2}}]}, 0x48}, 0x1, 0x0, 0x0, 0xc0}, 0x0) close(r2) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000500)=@newqdisc={0x40, 0x24, 0x20, 0x3, 0x25dfdbff, {0x0, 0x0, 0x0, r9, {0xffe0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_TIMER_SLACK={0x8, 0xd, 0xfff}, @TCA_FQ_FLOW_MAX_RATE={0x8}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240088c1}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r10 = landlock_create_ruleset(&(0x7f00000000c0)={0xc0f8, 0x1}, 0x18, 0x0) r11 = landlock_create_ruleset(&(0x7f0000000000)={0x7f6a}, 0x18, 0x0) landlock_restrict_self(r11, 0x0) r12 = landlock_create_ruleset(&(0x7f00000002c0)={0x2da8}, 0x18, 0x0) landlock_restrict_self(r12, 0x0) landlock_restrict_self(r10, 0x0) syz_usbip_server_init(0x1) r13 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x124) write$P9_RREADDIR(r13, &(0x7f00000001c0)={0x2a, 0x29, 0x3, {0x5, [{{0x10, 0x9, 0x5}, 0x7, 0x7, 0xf45b3bccc711007a, './file0'}]}}, 0xfffffceb) r14 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x0) write(r14, &(0x7f0000000900)='dummy_udc.0\n\x00', 0xc) write(r14, &(0x7f0000000b00)='\n\x00', 0x1) [ 101.770610][ T5301] Bluetooth: hci0: command tx timeout [ 101.779226][ T5337] ------------[ cut here ]------------ [ 101.781727][ T5337] !chanctx_conf [ 101.781739][ T5337] WARNING: net/mac80211/rate.c:51 at rate_control_rate_init+0x5a6/0x630, CPU#0: syz.0.0/5337 [ 101.788602][ T5337] Modules linked in: [ 101.790686][ T5337] CPU: 0 UID: 0 PID: 5337 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 101.794600][ T5337] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 101.805255][ T5337] RIP: 0010:rate_control_rate_init+0x5a6/0x630 [ 101.807943][ T5337] Code: 82 01 00 00 20 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 fc 96 91 00 cc e8 16 72 82 f6 90 0f 0b 90 eb e1 e8 0b 72 82 f6 90 <0f> 0b 90 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 84 00 00 00 [ 101.816148][ T5337] RSP: 0018:ffffc9000f336fe8 EFLAGS: 00010287 [ 101.818960][ T5337] RAX: ffffffff8b44b0b5 RBX: ffff888036ddc050 RCX: 0000000000100000 [ 101.822380][ T5337] RDX: ffffc90020001000 RSI: 000000000000038a RDI: 000000000000038b [ 101.826387][ T5337] RBP: dffffc0000000000 R08: ffffffff8b44ac27 R09: 0000000000000000 [ 101.829947][ T5337] R10: 0000000000000000 R11: ffffffff8eb59c60 R12: ffffffff8b44ac27 [ 101.833250][ T5337] R13: ffff88801af40f40 R14: 0000000000000001 R15: 0000000000000000 [ 101.836866][ T5337] FS: 00007f63a5e766c0(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 101.840587][ T5337] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 101.843348][ T5337] CR2: 00007f63a4f89180 CR3: 000000001277f000 CR4: 0000000000352ef0 [ 101.847025][ T5337] Call Trace: [ 101.848918][ T5337] [ 101.850194][ T5337] rate_control_rate_init_all_links+0xf4/0x190 [ 101.853116][ T5337] sta_apply_auth_flags+0x1bc/0x430 [ 101.855619][ T5337] sta_apply_parameters+0x1291/0x1b50 [ 101.857860][ T5337] ieee80211_add_station+0x3de/0x700 [ 101.860084][ T5337] rdev_add_station+0xfc/0x290 [ 101.862066][ T5337] nl80211_new_station+0x1b4e/0x1fd0 [ 101.864271][ T5337] ? trace_contention_end+0x3d/0x140 [ 101.866778][ T5337] ? __pfx_nl80211_new_station+0x10/0x10 [ 101.869935][ T5337] ? __rtnl_unlock+0xc8/0xf0 [ 101.871893][ T5337] ? nl80211_pre_doit+0x53d/0x890 [ 101.873983][ T5337] genl_family_rcv_msg_doit+0x233/0x340 [ 101.876362][ T5337] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 101.878907][ T5337] ? bpf_lsm_capable+0x9/0x20 [ 101.880825][ T5337] ? security_capable+0x7e/0x2c0 [ 101.882990][ T5337] genl_rcv_msg+0x614/0x7a0 [ 101.885083][ T5337] ? __pfx_genl_rcv_msg+0x10/0x10 [ 101.887268][ T5337] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 101.890268][ T5337] ? __pfx_nl80211_new_station+0x10/0x10 [ 101.892721][ T5337] ? __pfx_nl80211_post_doit+0x10/0x10 [ 101.895629][ T5337] ? __pfx_ref_tracker_free+0x10/0x10 [ 101.897917][ T5337] ? __asan_memcpy+0x40/0x70 [ 101.900058][ T5337] ? __skb_clone+0x5c/0x6c0 [ 101.902248][ T5337] netlink_rcv_skb+0x226/0x4a0 [ 101.904384][ T5337] ? __pfx_genl_rcv_msg+0x10/0x10 [ 101.906774][ T5337] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 101.909141][ T5337] ? down_read+0x2be/0x330 [ 101.911213][ T5337] genl_rcv+0x28/0x40 [ 101.913040][ T5337] netlink_unicast+0x7bb/0x940 [ 101.915295][ T5337] netlink_sendmsg+0x813/0xb40 [ 101.917489][ T5337] ? __pfx_netlink_sendmsg+0x10/0x10 [ 101.919953][ T5337] ? aa_sock_msg_perm+0xf1/0x1b0 [ 101.922150][ T5337] ? __pfx_netlink_sendmsg+0x10/0x10 [ 101.924536][ T5337] sock_sendmsg_nosec+0x13a/0x180 [ 101.926910][ T5337] ____sys_sendmsg+0x54e/0x850 [ 101.928998][ T5337] ? __pfx_____sys_sendmsg+0x10/0x10 [ 101.931235][ T5337] ? import_iovec+0x73/0xa0 [ 101.933027][ T5337] ___sys_sendmsg+0x2a5/0x360 [ 101.934916][ T5337] ? __lock_acquire+0x683/0x2cf0 [ 101.936886][ T5337] ? __pfx____sys_sendmsg+0x10/0x10 [ 101.939120][ T5337] ? futex_wake+0x51b/0x5f0 [ 101.940958][ T5337] ? __fget_files+0x2a/0x420 [ 101.942775][ T5337] ? __fget_files+0x3a2/0x420 [ 101.944798][ T5337] __x64_sys_sendmsg+0x1b1/0x290 [ 101.946925][ T5337] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 101.949219][ T5337] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.952267][ T5337] do_syscall_64+0x174/0x580 [ 101.954219][ T5337] ? trace_irq_disable+0x3b/0x140 [ 101.956415][ T5337] ? clear_bhb_loop+0x40/0x90 [ 101.958420][ T5337] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 101.960853][ T5337] RIP: 0033:0x7f63a4f9e019 [ 101.962758][ T5337] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.970710][ T5337] RSP: 002b:00007f63a5e75fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 101.974204][ T5337] RAX: ffffffffffffffda RBX: 00007f63a5225fa0 RCX: 00007f63a4f9e019 [ 101.977566][ T5337] RDX: 0000000000000000 RSI: 0000200000001080 RDI: 0000000000000007 [ 101.980852][ T5337] RBP: 00007f63a503500c R08: 0000000000000000 R09: 0000000000000000 [ 101.984167][ T5337] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 101.989663][ T5337] R13: 00007f63a5226038 R14: 00007f63a5225fa0 R15: 00007fffb193d098 [ 101.993033][ T5337] [ 101.994369][ T5337] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 101.997408][ T5337] CPU: 0 UID: 0 PID: 5337 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 102.001039][ T5337] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.005262][ T5337] Call Trace: [ 102.006798][ T5337] [ 102.008067][ T5337] vpanic+0x56c/0xa60 [ 102.009702][ T5337] ? __pfx__printk+0x10/0x10 [ 102.011691][ T5337] ? __pfx_vpanic+0x10/0x10 [ 102.013646][ T5337] ? is_bpf_text_address+0x292/0x2b0 [ 102.015881][ T5337] ? is_bpf_text_address+0x26/0x2b0 [ 102.018003][ T5337] panic+0xc5/0xd0 [ 102.019665][ T5337] ? __pfx_panic+0x10/0x10 [ 102.021592][ T5337] __warn+0x315/0x4c0 [ 102.023280][ T5337] ? rate_control_rate_init+0x5a6/0x630 [ 102.025606][ T5337] ? rate_control_rate_init+0x5a6/0x630 [ 102.028000][ T5337] __report_bug+0x276/0x570 [ 102.029926][ T5337] ? stack_depot_save_flags+0x3ec/0x800 [ 102.032302][ T5337] ? rate_control_rate_init+0x5a6/0x630 [ 102.034625][ T5337] ? __pfx___report_bug+0x10/0x10 [ 102.036807][ T5337] ? __lock_acquire+0x683/0x2cf0 [ 102.038955][ T5337] ? __lock_acquire+0x683/0x2cf0 [ 102.041880][ T5337] ? rate_control_rate_init+0x5a6/0x630 [ 102.044296][ T5337] report_bug+0x16a/0x220 [ 102.046155][ T5337] ? rate_control_rate_init+0x5a6/0x630 [ 102.048549][ T5337] ? rate_control_rate_init+0x5a8/0x630 [ 102.050831][ T5337] handle_bug+0x9c/0x200 [ 102.052667][ T5337] exc_invalid_op+0x1a/0x50 [ 102.054551][ T5337] asm_exc_invalid_op+0x1a/0x20 [ 102.056609][ T5337] RIP: 0010:rate_control_rate_init+0x5a6/0x630 [ 102.059354][ T5337] Code: 82 01 00 00 20 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 fc 96 91 00 cc e8 16 72 82 f6 90 0f 0b 90 eb e1 e8 0b 72 82 f6 90 <0f> 0b 90 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 84 00 00 00 [ 102.067663][ T5337] RSP: 0018:ffffc9000f336fe8 EFLAGS: 00010287 [ 102.070071][ T5337] RAX: ffffffff8b44b0b5 RBX: ffff888036ddc050 RCX: 0000000000100000 [ 102.073367][ T5337] RDX: ffffc90020001000 RSI: 000000000000038a RDI: 000000000000038b [ 102.076760][ T5337] RBP: dffffc0000000000 R08: ffffffff8b44ac27 R09: 0000000000000000 [ 102.080201][ T5337] R10: 0000000000000000 R11: ffffffff8eb59c60 R12: ffffffff8b44ac27 [ 102.083589][ T5337] R13: ffff88801af40f40 R14: 0000000000000001 R15: 0000000000000000 [ 102.087072][ T5337] ? rate_control_rate_init+0x117/0x630 [ 102.089463][ T5337] ? rate_control_rate_init+0x117/0x630 [ 102.091746][ T5337] ? rate_control_rate_init+0x5a5/0x630 [ 102.094258][ T5337] ? rate_control_rate_init+0x5a5/0x630 [ 102.096993][ T5337] rate_control_rate_init_all_links+0xf4/0x190 [ 102.099628][ T5337] sta_apply_auth_flags+0x1bc/0x430 [ 102.101729][ T5337] sta_apply_parameters+0x1291/0x1b50 [ 102.103913][ T5337] ieee80211_add_station+0x3de/0x700 [ 102.105884][ T5337] rdev_add_station+0xfc/0x290 [ 102.107646][ T5337] nl80211_new_station+0x1b4e/0x1fd0 [ 102.109795][ T5337] ? trace_contention_end+0x3d/0x140 [ 102.111959][ T5337] ? __pfx_nl80211_new_station+0x10/0x10 [ 102.114308][ T5337] ? __rtnl_unlock+0xc8/0xf0 [ 102.116366][ T5337] ? nl80211_pre_doit+0x53d/0x890 [ 102.118470][ T5337] genl_family_rcv_msg_doit+0x233/0x340 [ 102.120951][ T5337] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 102.123503][ T5337] ? bpf_lsm_capable+0x9/0x20 [ 102.125514][ T5337] ? security_capable+0x7e/0x2c0 [ 102.127583][ T5337] genl_rcv_msg+0x614/0x7a0 [ 102.129379][ T5337] ? __pfx_genl_rcv_msg+0x10/0x10 [ 102.131474][ T5337] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 102.133702][ T5337] ? __pfx_nl80211_new_station+0x10/0x10 [ 102.136063][ T5337] ? __pfx_nl80211_post_doit+0x10/0x10 [ 102.138461][ T5337] ? __pfx_ref_tracker_free+0x10/0x10 [ 102.140648][ T5337] ? __asan_memcpy+0x40/0x70 [ 102.142570][ T5337] ? __skb_clone+0x5c/0x6c0 [ 102.144505][ T5337] netlink_rcv_skb+0x226/0x4a0 [ 102.146425][ T5337] ? __pfx_genl_rcv_msg+0x10/0x10 [ 102.148463][ T5337] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 102.150626][ T5337] ? down_read+0x2be/0x330 [ 102.152486][ T5337] genl_rcv+0x28/0x40 [ 102.154182][ T5337] netlink_unicast+0x7bb/0x940 [ 102.156059][ T5337] netlink_sendmsg+0x813/0xb40 [ 102.157950][ T5337] ? __pfx_netlink_sendmsg+0x10/0x10 [ 102.160074][ T5337] ? aa_sock_msg_perm+0xf1/0x1b0 [ 102.162088][ T5337] ? __pfx_netlink_sendmsg+0x10/0x10 [ 102.164304][ T5337] sock_sendmsg_nosec+0x13a/0x180 [ 102.166477][ T5337] ____sys_sendmsg+0x54e/0x850 [ 102.168495][ T5337] ? __pfx_____sys_sendmsg+0x10/0x10 [ 102.170746][ T5337] ? import_iovec+0x73/0xa0 [ 102.172681][ T5337] ___sys_sendmsg+0x2a5/0x360 [ 102.174676][ T5337] ? __lock_acquire+0x683/0x2cf0 [ 102.176788][ T5337] ? __pfx____sys_sendmsg+0x10/0x10 [ 102.178975][ T5337] ? futex_wake+0x51b/0x5f0 [ 102.180935][ T5337] ? __fget_files+0x2a/0x420 [ 102.182891][ T5337] ? __fget_files+0x3a2/0x420 [ 102.184858][ T5337] __x64_sys_sendmsg+0x1b1/0x290 [ 102.186928][ T5337] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 102.191179][ T5337] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.193649][ T5337] do_syscall_64+0x174/0x580 [ 102.195589][ T5337] ? trace_irq_disable+0x3b/0x140 [ 102.197807][ T5337] ? clear_bhb_loop+0x40/0x90 [ 102.199799][ T5337] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.202295][ T5337] RIP: 0033:0x7f63a4f9e019 [ 102.204350][ T5337] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 102.212306][ T5337] RSP: 002b:00007f63a5e75fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 102.215797][ T5337] RAX: ffffffffffffffda RBX: 00007f63a5225fa0 RCX: 00007f63a4f9e019 [ 102.219127][ T5337] RDX: 0000000000000000 RSI: 0000200000001080 RDI: 0000000000000007 [ 102.222544][ T5337] RBP: 00007f63a503500c R08: 0000000000000000 R09: 0000000000000000 [ 102.225914][ T5337] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.229249][ T5337] R13: 00007f63a5226038 R14: 00007f63a5225fa0 R15: 00007fffb193d098 [ 102.232613][ T5337] [ 102.234346][ T5337] Kernel Offset: disabled [ 102.236149][ T5337] Rebooting in 86400 seconds..