program: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="05000000009927da52000600000008000300", @ANYRES32=r2, @ANYBLOB="0800050009"], 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000540)=ANY=[@ANYBLOB='x\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="051a26bd70fd030c00000f00000006000300", @ANYRES32=r2, @ANYBLOB="44000e0080000000ffffffffffff08021100000008021100000000000000000000000000640001002d1a01001d00000000000000a60200fe000400000000000900000003080026006c09000008000c006400000008000d0000000000"], 0x78}}, 0x20000014) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r4, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000000)={0x44, r5, 0xb97534d5fe9704cf, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x580}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6}, @NL80211_ATTR_STA_SUPPORT_P2P_PS={0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0xc0}, 0x0) [ 101.943621][ T5291] Bluetooth: hci0: command tx timeout [ 102.090857][ T5326] netlink: 'syz.0.0': attribute type 3 has an invalid length. [ 102.099692][ T5326] ------------[ cut here ]------------ [ 102.099706][ T5326] !chanctx_conf [ 102.099712][ T5326] WARNING: net/mac80211/rate.c:51 at rate_control_rate_init+0x5a6/0x630, CPU#0: syz.0.0/5326 [ 102.109428][ T5326] Modules linked in: [ 102.111971][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 102.116141][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.120903][ T5326] RIP: 0010:rate_control_rate_init+0x5a6/0x630 [ 102.123755][ T5326] Code: 82 01 00 00 20 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 36 52 6f f6 90 0f 0b 90 eb e1 e8 2b 52 6f f6 90 <0f> 0b 90 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 84 00 00 00 [ 102.132248][ T5326] RSP: 0018:ffffc9000dcaefe8 EFLAGS: 00010287 [ 102.134934][ T5326] RAX: ffffffff8b589145 RBX: ffff88801fdac050 RCX: 0000000000100000 [ 102.138644][ T5326] RDX: ffffc9000f591000 RSI: 0000000000000435 RDI: 0000000000000436 [ 102.142224][ T5326] RBP: dffffc0000000000 R08: ffffffff8b588cb7 R09: 0000000000000000 [ 102.145596][ T5326] R10: dffffc0000000000 R11: ffffed1003fb5831 R12: ffffffff8b588cb7 [ 102.149093][ T5326] R13: ffff888051e40f40 R14: 0000000000000001 R15: 0000000000000000 [ 102.153690][ T5326] FS: 00007f13aa6bf6c0(0000) GS:ffff88808c2c6000(0000) knlGS:0000000000000000 [ 102.157724][ T5326] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 102.160559][ T5326] CR2: 0000200000001080 CR3: 000000001265a000 CR4: 0000000000352ef0 [ 102.165190][ T5326] Call Trace: [ 102.167079][ T5326] [ 102.168433][ T5326] rate_control_rate_init_all_links+0xf4/0x190 [ 102.171083][ T5326] sta_apply_auth_flags+0x1bc/0x430 [ 102.173467][ T5326] sta_apply_parameters+0x1291/0x1b50 [ 102.175684][ T5326] ieee80211_add_station+0x3de/0x700 [ 102.177747][ T5326] rdev_add_station+0xfc/0x290 [ 102.179732][ T5326] nl80211_new_station+0x1b4e/0x1fd0 [ 102.181958][ T5326] ? trace_contention_end+0x3d/0x140 [ 102.183877][ T5326] ? __pfx_nl80211_new_station+0x10/0x10 [ 102.185900][ T5326] ? __rtnl_unlock+0xc8/0xf0 [ 102.187706][ T5326] ? nl80211_pre_doit+0x53d/0x890 [ 102.189543][ T5326] genl_family_rcv_msg_doit+0x233/0x340 [ 102.191517][ T5326] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 102.193745][ T5326] ? bpf_lsm_capable+0x9/0x20 [ 102.195414][ T5326] ? security_capable+0x7e/0x2c0 [ 102.197544][ T5326] genl_rcv_msg+0x614/0x7a0 [ 102.199532][ T5326] ? __pfx_genl_rcv_msg+0x10/0x10 [ 102.201713][ T5326] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 102.203951][ T5326] ? __pfx_nl80211_new_station+0x10/0x10 [ 102.206636][ T5326] ? __pfx_nl80211_post_doit+0x10/0x10 [ 102.209027][ T5326] ? __asan_memcpy+0x40/0x70 [ 102.211003][ T5326] ? __skb_clone+0x5c/0x6c0 [ 102.213092][ T5326] netlink_rcv_skb+0x226/0x4a0 [ 102.215305][ T5326] ? __pfx_genl_rcv_msg+0x10/0x10 [ 102.217710][ T5326] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 102.220103][ T5326] ? down_read+0x2be/0x330 [ 102.222176][ T5326] genl_rcv+0x28/0x40 [ 102.223951][ T5326] netlink_unicast+0x7bd/0x940 [ 102.226115][ T5326] netlink_sendmsg+0x813/0xb40 [ 102.228387][ T5326] ? __pfx_netlink_sendmsg+0x10/0x10 [ 102.230739][ T5326] ? apparmor_socket_sendmsg+0x98/0x360 [ 102.233289][ T5326] ? __pfx_netlink_sendmsg+0x10/0x10 [ 102.235588][ T5326] sock_sendmsg_nosec+0x13a/0x180 [ 102.237921][ T5326] ____sys_sendmsg+0x54e/0x850 [ 102.240064][ T5326] ? __pfx_____sys_sendmsg+0x10/0x10 [ 102.242400][ T5326] ? import_iovec+0x73/0xa0 [ 102.244354][ T5326] ___sys_sendmsg+0x2a5/0x360 [ 102.246493][ T5326] ? __lock_acquire+0x747/0x2de0 [ 102.248708][ T5326] ? __pfx____sys_sendmsg+0x10/0x10 [ 102.250904][ T5326] ? futex_wait+0x2a2/0x390 [ 102.252902][ T5326] ? __fget_files+0x2a/0x420 [ 102.254912][ T5326] ? __fget_files+0x3a2/0x420 [ 102.257165][ T5326] __x64_sys_sendmsg+0x1b1/0x290 [ 102.259312][ T5326] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 102.261770][ T5326] do_syscall_64+0x166/0x520 [ 102.263865][ T5326] ? trace_irq_disable+0x3b/0x140 [ 102.266111][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.268961][ T5326] ? clear_bhb_loop+0x70/0xc0 [ 102.271225][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.273915][ T5326] RIP: 0033:0x7f13a979e159 [ 102.275865][ T5326] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 102.284246][ T5326] RSP: 002b:00007f13aa6befe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 102.287964][ T5326] RAX: ffffffffffffffda RBX: 00007f13a9a25fa0 RCX: 00007f13a979e159 [ 102.291372][ T5326] RDX: 0000000000000000 RSI: 0000200000001080 RDI: 0000000000000006 [ 102.294528][ T5326] RBP: 00007f13a983506b R08: 0000000000000000 R09: 0000000000000000 [ 102.297965][ T5326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.301550][ T5326] R13: 00007f13a9a26038 R14: 00007f13a9a25fa0 R15: 00007ffc42cc0df8 [ 102.304751][ T5326] [ 102.306079][ T5326] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 102.309143][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 102.312857][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.316946][ T5326] Call Trace: [ 102.318336][ T5326] [ 102.319676][ T5326] vpanic+0x56d/0xa60 [ 102.321443][ T5326] ? __pfx__printk+0x10/0x10 [ 102.323361][ T5326] ? __pfx_vpanic+0x10/0x10 [ 102.325080][ T5326] ? is_bpf_text_address+0x292/0x2b0 [ 102.327190][ T5326] ? is_bpf_text_address+0x26/0x2b0 [ 102.329459][ T5326] panic+0xc5/0xd0 [ 102.331072][ T5326] ? __pfx_panic+0x10/0x10 [ 102.333018][ T5326] __warn+0x315/0x4c0 [ 102.334772][ T5326] ? rate_control_rate_init+0x5a6/0x630 [ 102.337214][ T5326] ? rate_control_rate_init+0x5a6/0x630 [ 102.339522][ T5326] __report_bug+0x276/0x570 [ 102.341338][ T5326] ? rate_control_rate_init+0x5a6/0x630 [ 102.343715][ T5326] ? __pfx___report_bug+0x10/0x10 [ 102.345858][ T5326] ? __lock_acquire+0x747/0x2de0 [ 102.347938][ T5326] ? __lock_acquire+0x747/0x2de0 [ 102.349629][ T5326] ? rate_control_rate_init+0x5a6/0x630 [ 102.351735][ T5326] report_bug+0x16b/0x220 [ 102.353473][ T5326] ? rate_control_rate_init+0x5a6/0x630 [ 102.355591][ T5326] ? rate_control_rate_init+0x5a8/0x630 [ 102.357701][ T5326] handle_bug+0x9c/0x200 [ 102.359307][ T5326] exc_invalid_op+0x1a/0x50 [ 102.361067][ T5326] asm_exc_invalid_op+0x1a/0x20 [ 102.363082][ T5326] RIP: 0010:rate_control_rate_init+0x5a6/0x630 [ 102.365728][ T5326] Code: 82 01 00 00 20 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 36 52 6f f6 90 0f 0b 90 eb e1 e8 2b 52 6f f6 90 <0f> 0b 90 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 84 00 00 00 [ 102.373770][ T5326] RSP: 0018:ffffc9000dcaefe8 EFLAGS: 00010287 [ 102.376382][ T5326] RAX: ffffffff8b589145 RBX: ffff88801fdac050 RCX: 0000000000100000 [ 102.379786][ T5326] RDX: ffffc9000f591000 RSI: 0000000000000435 RDI: 0000000000000436 [ 102.383136][ T5326] RBP: dffffc0000000000 R08: ffffffff8b588cb7 R09: 0000000000000000 [ 102.386362][ T5326] R10: dffffc0000000000 R11: ffffed1003fb5831 R12: ffffffff8b588cb7 [ 102.389849][ T5326] R13: ffff888051e40f40 R14: 0000000000000001 R15: 0000000000000000 [ 102.393239][ T5326] ? rate_control_rate_init+0x117/0x630 [ 102.395785][ T5326] ? rate_control_rate_init+0x117/0x630 [ 102.398258][ T5326] ? rate_control_rate_init+0x5a5/0x630 [ 102.400783][ T5326] ? rate_control_rate_init+0x5a5/0x630 [ 102.403192][ T5326] rate_control_rate_init_all_links+0xf4/0x190 [ 102.405845][ T5326] sta_apply_auth_flags+0x1bc/0x430 [ 102.408013][ T5326] sta_apply_parameters+0x1291/0x1b50 [ 102.410315][ T5326] ieee80211_add_station+0x3de/0x700 [ 102.412558][ T5326] rdev_add_station+0xfc/0x290 [ 102.414625][ T5326] nl80211_new_station+0x1b4e/0x1fd0 [ 102.416903][ T5326] ? trace_contention_end+0x3d/0x140 [ 102.419175][ T5326] ? __pfx_nl80211_new_station+0x10/0x10 [ 102.421528][ T5326] ? __rtnl_unlock+0xc8/0xf0 [ 102.423582][ T5326] ? nl80211_pre_doit+0x53d/0x890 [ 102.425699][ T5326] genl_family_rcv_msg_doit+0x233/0x340 [ 102.428193][ T5326] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 102.430849][ T5326] ? bpf_lsm_capable+0x9/0x20 [ 102.432956][ T5326] ? security_capable+0x7e/0x2c0 [ 102.435151][ T5326] genl_rcv_msg+0x614/0x7a0 [ 102.437166][ T5326] ? __pfx_genl_rcv_msg+0x10/0x10 [ 102.439500][ T5326] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 102.441873][ T5326] ? __pfx_nl80211_new_station+0x10/0x10 [ 102.444178][ T5326] ? __pfx_nl80211_post_doit+0x10/0x10 [ 102.446509][ T5326] ? __asan_memcpy+0x40/0x70 [ 102.448489][ T5326] ? __skb_clone+0x5c/0x6c0 [ 102.450405][ T5326] netlink_rcv_skb+0x226/0x4a0 [ 102.452272][ T5326] ? __pfx_genl_rcv_msg+0x10/0x10 [ 102.454338][ T5326] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 102.456830][ T5326] ? down_read+0x2be/0x330 [ 102.459128][ T5326] genl_rcv+0x28/0x40 [ 102.460927][ T5326] netlink_unicast+0x7bd/0x940 [ 102.463093][ T5326] netlink_sendmsg+0x813/0xb40 [ 102.465084][ T5326] ? __pfx_netlink_sendmsg+0x10/0x10 [ 102.467219][ T5326] ? apparmor_socket_sendmsg+0x98/0x360 [ 102.469369][ T5326] ? __pfx_netlink_sendmsg+0x10/0x10 [ 102.471315][ T5326] sock_sendmsg_nosec+0x13a/0x180 [ 102.473281][ T5326] ____sys_sendmsg+0x54e/0x850 [ 102.475187][ T5326] ? __pfx_____sys_sendmsg+0x10/0x10 [ 102.477195][ T5326] ? import_iovec+0x73/0xa0 [ 102.478946][ T5326] ___sys_sendmsg+0x2a5/0x360 [ 102.480849][ T5326] ? __lock_acquire+0x747/0x2de0 [ 102.483022][ T5326] ? __pfx____sys_sendmsg+0x10/0x10 [ 102.485334][ T5326] ? futex_wait+0x2a2/0x390 [ 102.487387][ T5326] ? __fget_files+0x2a/0x420 [ 102.489459][ T5326] ? __fget_files+0x3a2/0x420 [ 102.491456][ T5326] __x64_sys_sendmsg+0x1b1/0x290 [ 102.493682][ T5326] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 102.496061][ T5326] do_syscall_64+0x166/0x520 [ 102.498267][ T5326] ? trace_irq_disable+0x3b/0x140 [ 102.500461][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.503060][ T5326] ? clear_bhb_loop+0x70/0xc0 [ 102.505029][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.507596][ T5326] RIP: 0033:0x7f13a979e159 [ 102.509615][ T5326] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 102.517822][ T5326] RSP: 002b:00007f13aa6befe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 102.521443][ T5326] RAX: ffffffffffffffda RBX: 00007f13a9a25fa0 RCX: 00007f13a979e159 [ 102.524753][ T5326] RDX: 0000000000000000 RSI: 0000200000001080 RDI: 0000000000000006 [ 102.527852][ T5326] RBP: 00007f13a983506b R08: 0000000000000000 R09: 0000000000000000 [ 102.530890][ T5326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.533999][ T5326] R13: 00007f13a9a26038 R14: 00007f13a9a25fa0 R15: 00007ffc42cc0df8 [ 102.537273][ T5326] [ 102.539037][ T5326] Kernel Offset: disabled [ 102.541058][ T5326] Rebooting in 86400 seconds..