program: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000540)=ANY=[@ANYBLOB="80000000", @ANYRES16=r1, @ANYBLOB="050026bd7000000000000f00000008000300", @ANYRES32=r2, @ANYBLOB="4c000e008000000008021100000108000008021100000000000000000000000000640001002d1a01001d00000000000000a60200fe0004000000000809000000037206030303030303080026006009000008000c006400000025000d0000000000"], 0x80}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000014) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_STATION(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000240)={0x48, r4, 0xb97534d5fe9704cf, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x580}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6}, @NL80211_ATTR_STA_FLAGS2={0xc, 0x43, {0xe, 0x2}}]}, 0x48}, 0x1, 0x0, 0x0, 0xc0}, 0x0) [ 94.250476][ T5285] Bluetooth: hci0: command tx timeout [ 94.377647][ T5323] netlink: 24 bytes leftover after parsing attributes in process `syz.0.0'. [ 94.402908][ T5322] ------------[ cut here ]------------ [ 94.405346][ T5322] !chanctx_conf [ 94.405355][ T5322] WARNING: net/mac80211/rate.c:51 at rate_control_rate_init+0x5a6/0x630, CPU#0: syz.0.0/5322 [ 94.410981][ T5322] Modules linked in: [ 94.412945][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.416491][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.420270][ T5322] RIP: 0010:rate_control_rate_init+0x5a6/0x630 [ 94.422557][ T5322] Code: 82 01 00 00 20 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 fc 96 91 00 cc e8 16 72 82 f6 90 0f 0b 90 eb e1 e8 0b 72 82 f6 90 <0f> 0b 90 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 84 00 00 00 [ 94.430483][ T5322] RSP: 0018:ffffc9000e3eefe8 EFLAGS: 00010283 [ 94.433078][ T5322] RAX: ffffffff8b44b0b5 RBX: ffff888036de4050 RCX: 0000000000100000 [ 94.436529][ T5322] RDX: ffffc9000f052000 RSI: 000000000000038e RDI: 000000000000038f [ 94.439897][ T5322] RBP: dffffc0000000000 R08: ffffffff8b44ac27 R09: 0000000000000000 [ 94.443214][ T5322] R10: 0000000000000000 R11: ffffffff8eb59c60 R12: ffffffff8b44ac27 [ 94.446517][ T5322] R13: ffff888051aa0f40 R14: 0000000000000001 R15: 0000000000000000 [ 94.449730][ T5322] FS: 00007f4c45f946c0(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000 [ 94.453449][ T5322] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.456280][ T5322] CR2: 0000200000001080 CR3: 0000000043e13000 CR4: 0000000000352ef0 [ 94.459659][ T5322] Call Trace: [ 94.460953][ T5322] [ 94.462146][ T5322] rate_control_rate_init_all_links+0xf4/0x190 [ 94.464718][ T5322] sta_apply_auth_flags+0x1bc/0x430 [ 94.467041][ T5322] sta_apply_parameters+0x1291/0x1b50 [ 94.469290][ T5322] ieee80211_add_station+0x3de/0x700 [ 94.471357][ T5322] rdev_add_station+0xfc/0x290 [ 94.473360][ T5322] nl80211_new_station+0x1b4e/0x1fd0 [ 94.475878][ T5322] ? trace_contention_end+0x3d/0x140 [ 94.478197][ T5322] ? __pfx_nl80211_new_station+0x10/0x10 [ 94.480568][ T5322] ? __rtnl_unlock+0xc8/0xf0 [ 94.482614][ T5322] ? nl80211_pre_doit+0x53d/0x890 [ 94.484841][ T5322] genl_family_rcv_msg_doit+0x233/0x340 [ 94.487140][ T5322] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 94.489591][ T5322] ? bpf_lsm_capable+0x9/0x20 [ 94.491474][ T5322] ? security_capable+0x7e/0x2c0 [ 94.493617][ T5322] genl_rcv_msg+0x614/0x7a0 [ 94.495507][ T5322] ? __pfx_genl_rcv_msg+0x10/0x10 [ 94.497754][ T5322] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 94.499974][ T5322] ? __pfx_nl80211_new_station+0x10/0x10 [ 94.502371][ T5322] ? __pfx_nl80211_post_doit+0x10/0x10 [ 94.504654][ T5322] ? __pfx_ref_tracker_free+0x10/0x10 [ 94.507048][ T5322] ? __asan_memcpy+0x40/0x70 [ 94.508973][ T5322] ? __skb_clone+0x5c/0x6c0 [ 94.510837][ T5322] netlink_rcv_skb+0x226/0x4a0 [ 94.513115][ T5322] ? __pfx_genl_rcv_msg+0x10/0x10 [ 94.515383][ T5322] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 94.517603][ T5322] ? down_read+0x2be/0x330 [ 94.519368][ T5322] genl_rcv+0x28/0x40 [ 94.521087][ T5322] netlink_unicast+0x7bb/0x940 [ 94.523168][ T5322] netlink_sendmsg+0x813/0xb40 [ 94.525222][ T5322] ? __pfx_netlink_sendmsg+0x10/0x10 [ 94.527396][ T5322] ? aa_sock_msg_perm+0xf1/0x1b0 [ 94.529744][ T5322] ? __pfx_netlink_sendmsg+0x10/0x10 [ 94.532477][ T5322] sock_sendmsg_nosec+0x13a/0x180 [ 94.535075][ T5322] ____sys_sendmsg+0x54e/0x850 [ 94.537037][ T5322] ? __pfx_____sys_sendmsg+0x10/0x10 [ 94.539181][ T5322] ? import_iovec+0x73/0xa0 [ 94.541107][ T5322] ___sys_sendmsg+0x2a5/0x360 [ 94.543065][ T5322] ? __lock_acquire+0x683/0x2cf0 [ 94.545263][ T5322] ? __pfx____sys_sendmsg+0x10/0x10 [ 94.547391][ T5322] ? futex_wait+0x2a2/0x390 [ 94.549299][ T5322] ? __fget_files+0x2a/0x420 [ 94.551204][ T5322] ? __fget_files+0x3a2/0x420 [ 94.553047][ T5322] __x64_sys_sendmsg+0x1b1/0x290 [ 94.556634][ T5322] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 94.558723][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.561250][ T5322] do_syscall_64+0x174/0x580 [ 94.563267][ T5322] ? clear_bhb_loop+0x40/0x90 [ 94.565307][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.567817][ T5322] RIP: 0033:0x7f4c4519e019 [ 94.569521][ T5322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.578559][ T5322] RSP: 002b:00007f4c45f93fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 94.582314][ T5322] RAX: ffffffffffffffda RBX: 00007f4c45425fa0 RCX: 00007f4c4519e019 [ 94.585598][ T5322] RDX: 0000000000000000 RSI: 0000200000001080 RDI: 0000000000000004 [ 94.588792][ T5322] RBP: 00007f4c4523500c R08: 0000000000000000 R09: 0000000000000000 [ 94.592078][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.595515][ T5322] R13: 00007f4c45426038 R14: 00007f4c45425fa0 R15: 00007ffe8b765278 [ 94.598826][ T5322] [ 94.600171][ T5322] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 94.603009][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.606342][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.610020][ T5322] Call Trace: [ 94.611408][ T5322] [ 94.612675][ T5322] vpanic+0x56c/0xa60 [ 94.614470][ T5322] ? __pfx__printk+0x10/0x10 [ 94.616341][ T5322] ? __pfx_vpanic+0x10/0x10 [ 94.618266][ T5322] ? is_bpf_text_address+0x292/0x2b0 [ 94.620368][ T5322] ? is_bpf_text_address+0x26/0x2b0 [ 94.622511][ T5322] panic+0xc5/0xd0 [ 94.624086][ T5322] ? __pfx_panic+0x10/0x10 [ 94.625871][ T5322] __warn+0x315/0x4c0 [ 94.627452][ T5322] ? rate_control_rate_init+0x5a6/0x630 [ 94.629749][ T5322] ? rate_control_rate_init+0x5a6/0x630 [ 94.632055][ T5322] __report_bug+0x276/0x570 [ 94.634052][ T5322] ? stack_depot_save_flags+0x3ec/0x800 [ 94.636438][ T5322] ? rate_control_rate_init+0x5a6/0x630 [ 94.638835][ T5322] ? __pfx___report_bug+0x10/0x10 [ 94.641006][ T5322] ? __lock_acquire+0x683/0x2cf0 [ 94.643071][ T5322] ? __lock_acquire+0x683/0x2cf0 [ 94.644737][ T5322] ? rate_control_rate_init+0x5a6/0x630 [ 94.646854][ T5322] report_bug+0x16a/0x220 [ 94.648570][ T5322] ? rate_control_rate_init+0x5a6/0x630 [ 94.650760][ T5322] ? rate_control_rate_init+0x5a8/0x630 [ 94.652925][ T5322] handle_bug+0x9c/0x200 [ 94.654639][ T5322] exc_invalid_op+0x1a/0x50 [ 94.656457][ T5322] asm_exc_invalid_op+0x1a/0x20 [ 94.658424][ T5322] RIP: 0010:rate_control_rate_init+0x5a6/0x630 [ 94.661078][ T5322] Code: 82 01 00 00 20 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 fc 96 91 00 cc e8 16 72 82 f6 90 0f 0b 90 eb e1 e8 0b 72 82 f6 90 <0f> 0b 90 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 84 00 00 00 [ 94.669642][ T5322] RSP: 0018:ffffc9000e3eefe8 EFLAGS: 00010283 [ 94.672508][ T5322] RAX: ffffffff8b44b0b5 RBX: ffff888036de4050 RCX: 0000000000100000 [ 94.676023][ T5322] RDX: ffffc9000f052000 RSI: 000000000000038e RDI: 000000000000038f [ 94.679444][ T5322] RBP: dffffc0000000000 R08: ffffffff8b44ac27 R09: 0000000000000000 [ 94.682924][ T5322] R10: 0000000000000000 R11: ffffffff8eb59c60 R12: ffffffff8b44ac27 [ 94.686553][ T5322] R13: ffff888051aa0f40 R14: 0000000000000001 R15: 0000000000000000 [ 94.690078][ T5322] ? rate_control_rate_init+0x117/0x630 [ 94.692541][ T5322] ? rate_control_rate_init+0x117/0x630 [ 94.694995][ T5322] ? rate_control_rate_init+0x5a5/0x630 [ 94.697372][ T5322] ? rate_control_rate_init+0x5a5/0x630 [ 94.699365][ T5322] rate_control_rate_init_all_links+0xf4/0x190 [ 94.701511][ T5322] sta_apply_auth_flags+0x1bc/0x430 [ 94.703468][ T5322] sta_apply_parameters+0x1291/0x1b50 [ 94.705524][ T5322] ieee80211_add_station+0x3de/0x700 [ 94.707428][ T5322] rdev_add_station+0xfc/0x290 [ 94.709133][ T5322] nl80211_new_station+0x1b4e/0x1fd0 [ 94.710941][ T5322] ? trace_contention_end+0x3d/0x140 [ 94.712799][ T5322] ? __pfx_nl80211_new_station+0x10/0x10 [ 94.715104][ T5322] ? __rtnl_unlock+0xc8/0xf0 [ 94.717090][ T5322] ? nl80211_pre_doit+0x53d/0x890 [ 94.719261][ T5322] genl_family_rcv_msg_doit+0x233/0x340 [ 94.721686][ T5322] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 94.724344][ T5322] ? bpf_lsm_capable+0x9/0x20 [ 94.726485][ T5322] ? security_capable+0x7e/0x2c0 [ 94.728637][ T5322] genl_rcv_msg+0x614/0x7a0 [ 94.730507][ T5322] ? __pfx_genl_rcv_msg+0x10/0x10 [ 94.732653][ T5322] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 94.734934][ T5322] ? __pfx_nl80211_new_station+0x10/0x10 [ 94.737244][ T5322] ? __pfx_nl80211_post_doit+0x10/0x10 [ 94.739466][ T5322] ? __pfx_ref_tracker_free+0x10/0x10 [ 94.741729][ T5322] ? __asan_memcpy+0x40/0x70 [ 94.743712][ T5322] ? __skb_clone+0x5c/0x6c0 [ 94.745608][ T5322] netlink_rcv_skb+0x226/0x4a0 [ 94.747644][ T5322] ? __pfx_genl_rcv_msg+0x10/0x10 [ 94.749730][ T5322] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 94.751940][ T5322] ? down_read+0x2be/0x330 [ 94.753773][ T5322] genl_rcv+0x28/0x40 [ 94.755418][ T5322] netlink_unicast+0x7bb/0x940 [ 94.757248][ T5322] netlink_sendmsg+0x813/0xb40 [ 94.759050][ T5322] ? __pfx_netlink_sendmsg+0x10/0x10 [ 94.760987][ T5322] ? aa_sock_msg_perm+0xf1/0x1b0 [ 94.762753][ T5322] ? __pfx_netlink_sendmsg+0x10/0x10 [ 94.764674][ T5322] sock_sendmsg_nosec+0x13a/0x180 [ 94.766589][ T5322] ____sys_sendmsg+0x54e/0x850 [ 94.768496][ T5322] ? __pfx_____sys_sendmsg+0x10/0x10 [ 94.770621][ T5322] ? import_iovec+0x73/0xa0 [ 94.772498][ T5322] ___sys_sendmsg+0x2a5/0x360 [ 94.774529][ T5322] ? __lock_acquire+0x683/0x2cf0 [ 94.776457][ T5322] ? __pfx____sys_sendmsg+0x10/0x10 [ 94.778572][ T5322] ? futex_wait+0x2a2/0x390 [ 94.780553][ T5322] ? __fget_files+0x2a/0x420 [ 94.782772][ T5322] ? __fget_files+0x3a2/0x420 [ 94.785403][ T5322] __x64_sys_sendmsg+0x1b1/0x290 [ 94.787989][ T5322] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 94.790447][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.793256][ T5322] do_syscall_64+0x174/0x580 [ 94.795704][ T5322] ? clear_bhb_loop+0x40/0x90 [ 94.797700][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.800300][ T5322] RIP: 0033:0x7f4c4519e019 [ 94.802645][ T5322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.811553][ T5322] RSP: 002b:00007f4c45f93fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 94.815139][ T5322] RAX: ffffffffffffffda RBX: 00007f4c45425fa0 RCX: 00007f4c4519e019 [ 94.818395][ T5322] RDX: 0000000000000000 RSI: 0000200000001080 RDI: 0000000000000004 [ 94.821699][ T5322] RBP: 00007f4c4523500c R08: 0000000000000000 R09: 0000000000000000 [ 94.825091][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.828367][ T5322] R13: 00007f4c45426038 R14: 00007f4c45425fa0 R15: 00007ffe8b765278 [ 94.831463][ T5322] [ 94.832961][ T5322] Kernel Offset: disabled [ 94.834755][ T5322] Rebooting in 86400 seconds..