program: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYBLOB="8000b500006608c2ae5b7f8dd9ccf3c4dfd456bacf4686989307b3d3671165007c81cb2b399943cae52e0d3d892cbe116e11b4c53c6b0746bbe199ddadc9c65c049828bf7d1453ab068e0983fc26dbd341d919fcf3e5dc44ebfc81bc4413cf19a378cbb83a85ce873e7814665c7bf819ccf7f8cec000c23faff4b7262a1bcae32659c00bfd60e066c370564523cba2bd389635a1096bb696928074d88f0542fdf6b52fdf47c09a418dff9ea915598ecac8", @ANYRES16=r1, @ANYBLOB="050026bd7000000000000f00000008000300", @ANYRES32=r2, @ANYBLOB="4c000e008000000008021100000108021100000008021100000000000000000000000000640001002d1a01001d00000000000000a60200fe0004000000000809000000037206030303030303080026006c09000008000c006400000008000d0000000000"], 0x80}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000014) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_STATION(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000240)={0x48, r4, 0xb97534d5fe9704cf, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x580}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6}, @NL80211_ATTR_STA_FLAGS2={0xc, 0x43, {0xe, 0x2}}]}, 0x48}, 0x1, 0x0, 0x0, 0xc0}, 0x0) [ 93.240958][ T5288] Bluetooth: hci0: command tx timeout [ 93.267072][ T1125] cfg80211: failed to load regulatory.db [ 93.402703][ T5324] ------------[ cut here ]------------ [ 93.402716][ T5324] !chanctx_conf [ 93.402721][ T5324] WARNING: net/mac80211/rate.c:51 at rate_control_rate_init+0x5a6/0x630, CPU#0: syz.0.0/5324 [ 93.411133][ T5324] Modules linked in: [ 93.413740][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.418651][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.423440][ T5324] RIP: 0010:rate_control_rate_init+0x5a6/0x630 [ 93.426022][ T5324] Code: 82 01 00 00 20 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 36 52 6f f6 90 0f 0b 90 eb e1 e8 2b 52 6f f6 90 <0f> 0b 90 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 84 00 00 00 [ 93.434169][ T5324] RSP: 0000:ffffc9000ecaefe8 EFLAGS: 00010283 [ 93.436839][ T5324] RAX: ffffffff8b589145 RBX: ffff88803dce0050 RCX: 0000000000100000 [ 93.440244][ T5324] RDX: ffffc9000f491000 RSI: 00000000000003be RDI: 00000000000003bf [ 93.443858][ T5324] RBP: dffffc0000000000 R08: ffffffff8b588cb7 R09: 0000000000000000 [ 93.447696][ T5324] R10: dffffc0000000000 R11: ffffed1007b9c031 R12: ffffffff8b588cb7 [ 93.451378][ T5324] R13: ffff888050bf0f40 R14: 0000000000000001 R15: 0000000000000000 [ 93.454994][ T5324] FS: 00007f18363f56c0(0000) GS:ffff88808c2c6000(0000) knlGS:0000000000000000 [ 93.459034][ T5324] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 93.461988][ T5324] CR2: 00007fb4a73d6250 CR3: 0000000013934000 CR4: 0000000000352ef0 [ 93.465555][ T5324] Call Trace: [ 93.467021][ T5324] [ 93.468340][ T5324] rate_control_rate_init_all_links+0xf4/0x190 [ 93.471217][ T5324] sta_apply_auth_flags+0x1bc/0x430 [ 93.473476][ T5324] sta_apply_parameters+0x1291/0x1b50 [ 93.475831][ T5324] ieee80211_add_station+0x3de/0x700 [ 93.478259][ T5324] rdev_add_station+0xfc/0x290 [ 93.480517][ T5324] nl80211_new_station+0x1b4e/0x1fd0 [ 93.482975][ T5324] ? trace_contention_end+0x3d/0x140 [ 93.485220][ T5324] ? __pfx_nl80211_new_station+0x10/0x10 [ 93.487723][ T5324] ? __rtnl_unlock+0xc8/0xf0 [ 93.489883][ T5324] ? nl80211_pre_doit+0x53d/0x890 [ 93.492304][ T5324] genl_family_rcv_msg_doit+0x233/0x340 [ 93.494760][ T5324] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 93.497419][ T5324] ? bpf_lsm_capable+0x9/0x20 [ 93.499528][ T5324] ? security_capable+0x7e/0x2c0 [ 93.502010][ T5324] genl_rcv_msg+0x614/0x7a0 [ 93.503907][ T5324] ? __pfx_genl_rcv_msg+0x10/0x10 [ 93.506010][ T5324] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 93.508263][ T5324] ? __pfx_nl80211_new_station+0x10/0x10 [ 93.510832][ T5324] ? __pfx_nl80211_post_doit+0x10/0x10 [ 93.513063][ T5324] ? __asan_memcpy+0x40/0x70 [ 93.515129][ T5324] ? __skb_clone+0x5c/0x6c0 [ 93.517136][ T5324] netlink_rcv_skb+0x226/0x4a0 [ 93.519243][ T5324] ? __pfx_genl_rcv_msg+0x10/0x10 [ 93.521480][ T5324] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 93.523970][ T5324] ? down_read+0x2be/0x330 [ 93.525950][ T5324] genl_rcv+0x28/0x40 [ 93.527654][ T5324] netlink_unicast+0x7bd/0x940 [ 93.529774][ T5324] netlink_sendmsg+0x813/0xb40 [ 93.532018][ T5324] ? __pfx_netlink_sendmsg+0x10/0x10 [ 93.534383][ T5324] ? apparmor_socket_sendmsg+0x98/0x360 [ 93.536948][ T5324] ? __pfx_netlink_sendmsg+0x10/0x10 [ 93.539017][ T5324] sock_sendmsg_nosec+0x13a/0x180 [ 93.541249][ T5324] ____sys_sendmsg+0x54e/0x850 [ 93.543359][ T5324] ? __pfx_____sys_sendmsg+0x10/0x10 [ 93.545498][ T5324] ? import_iovec+0x73/0xa0 [ 93.547350][ T5324] ___sys_sendmsg+0x2a5/0x360 [ 93.549400][ T5324] ? __lock_acquire+0x747/0x2de0 [ 93.551712][ T5324] ? __pfx____sys_sendmsg+0x10/0x10 [ 93.553914][ T5324] ? futex_wake+0x51b/0x5f0 [ 93.555792][ T5324] ? __fget_files+0x2a/0x420 [ 93.557726][ T5324] ? __fget_files+0x3a2/0x420 [ 93.559616][ T5324] __x64_sys_sendmsg+0x1b1/0x290 [ 93.561778][ T5324] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 93.564219][ T5324] do_syscall_64+0x166/0x520 [ 93.566248][ T5324] ? trace_irq_disable+0x3b/0x140 [ 93.568323][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.571046][ T5324] ? clear_bhb_loop+0x70/0xc0 [ 93.573114][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.575722][ T5324] RIP: 0033:0x7f1839f9e159 [ 93.577789][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.586102][ T5324] RSP: 002b:00007f18363f4fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 93.589677][ T5324] RAX: ffffffffffffffda RBX: 00007f183a225fa0 RCX: 00007f1839f9e159 [ 93.593240][ T5324] RDX: 0000000000000000 RSI: 0000200000001080 RDI: 0000000000000004 [ 93.596711][ T5324] RBP: 00007f183a03506b R08: 0000000000000000 R09: 0000000000000000 [ 93.599827][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 93.603035][ T5324] R13: 00007f183a226038 R14: 00007f183a225fa0 R15: 00007ffe6cf001d8 [ 93.606435][ T5324] [ 93.607837][ T5324] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 93.610975][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.614928][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.619305][ T5324] Call Trace: [ 93.620736][ T5324] [ 93.621958][ T5324] vpanic+0x56d/0xa60 [ 93.623741][ T5324] ? __pfx__printk+0x10/0x10 [ 93.625733][ T5324] ? __pfx_vpanic+0x10/0x10 [ 93.627770][ T5324] ? is_bpf_text_address+0x292/0x2b0 [ 93.630094][ T5324] ? is_bpf_text_address+0x26/0x2b0 [ 93.632379][ T5324] panic+0xc5/0xd0 [ 93.633949][ T5324] ? __pfx_panic+0x10/0x10 [ 93.635767][ T5324] __warn+0x315/0x4c0 [ 93.637448][ T5324] ? rate_control_rate_init+0x5a6/0x630 [ 93.639813][ T5324] ? rate_control_rate_init+0x5a6/0x630 [ 93.642105][ T5324] __report_bug+0x276/0x570 [ 93.643997][ T5324] ? rate_control_rate_init+0x5a6/0x630 [ 93.646250][ T5324] ? __pfx___report_bug+0x10/0x10 [ 93.648627][ T5324] ? __lock_acquire+0x747/0x2de0 [ 93.650920][ T5324] ? __lock_acquire+0x747/0x2de0 [ 93.653186][ T5324] ? rate_control_rate_init+0x5a6/0x630 [ 93.655657][ T5324] report_bug+0x16b/0x220 [ 93.657513][ T5324] ? rate_control_rate_init+0x5a6/0x630 [ 93.660002][ T5324] ? rate_control_rate_init+0x5a8/0x630 [ 93.662288][ T5324] handle_bug+0x9c/0x200 [ 93.664180][ T5324] exc_invalid_op+0x1a/0x50 [ 93.666707][ T5324] asm_exc_invalid_op+0x1a/0x20 [ 93.669315][ T5324] RIP: 0010:rate_control_rate_init+0x5a6/0x630 [ 93.672702][ T5324] Code: 82 01 00 00 20 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 36 52 6f f6 90 0f 0b 90 eb e1 e8 2b 52 6f f6 90 <0f> 0b 90 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 84 00 00 00 [ 93.682697][ T5324] RSP: 0000:ffffc9000ecaefe8 EFLAGS: 00010283 [ 93.685425][ T5324] RAX: ffffffff8b589145 RBX: ffff88803dce0050 RCX: 0000000000100000 [ 93.688819][ T5324] RDX: ffffc9000f491000 RSI: 00000000000003be RDI: 00000000000003bf [ 93.692000][ T5324] RBP: dffffc0000000000 R08: ffffffff8b588cb7 R09: 0000000000000000 [ 93.695511][ T5324] R10: dffffc0000000000 R11: ffffed1007b9c031 R12: ffffffff8b588cb7 [ 93.699006][ T5324] R13: ffff888050bf0f40 R14: 0000000000000001 R15: 0000000000000000 [ 93.702531][ T5324] ? rate_control_rate_init+0x117/0x630 [ 93.705074][ T5324] ? rate_control_rate_init+0x117/0x630 [ 93.707533][ T5324] ? rate_control_rate_init+0x5a5/0x630 [ 93.710016][ T5324] ? rate_control_rate_init+0x5a5/0x630 [ 93.712511][ T5324] rate_control_rate_init_all_links+0xf4/0x190 [ 93.715236][ T5324] sta_apply_auth_flags+0x1bc/0x430 [ 93.717545][ T5324] sta_apply_parameters+0x1291/0x1b50 [ 93.719712][ T5324] ieee80211_add_station+0x3de/0x700 [ 93.722055][ T5324] rdev_add_station+0xfc/0x290 [ 93.724098][ T5324] nl80211_new_station+0x1b4e/0x1fd0 [ 93.726411][ T5324] ? trace_contention_end+0x3d/0x140 [ 93.728767][ T5324] ? __pfx_nl80211_new_station+0x10/0x10 [ 93.731305][ T5324] ? __rtnl_unlock+0xc8/0xf0 [ 93.733507][ T5324] ? nl80211_pre_doit+0x53d/0x890 [ 93.735720][ T5324] genl_family_rcv_msg_doit+0x233/0x340 [ 93.738201][ T5324] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 93.740822][ T5324] ? bpf_lsm_capable+0x9/0x20 [ 93.743030][ T5324] ? security_capable+0x7e/0x2c0 [ 93.745193][ T5324] genl_rcv_msg+0x614/0x7a0 [ 93.747156][ T5324] ? __pfx_genl_rcv_msg+0x10/0x10 [ 93.749192][ T5324] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 93.751432][ T5324] ? __pfx_nl80211_new_station+0x10/0x10 [ 93.753733][ T5324] ? __pfx_nl80211_post_doit+0x10/0x10 [ 93.755744][ T5324] ? __asan_memcpy+0x40/0x70 [ 93.757532][ T5324] ? __skb_clone+0x5c/0x6c0 [ 93.759247][ T5324] netlink_rcv_skb+0x226/0x4a0 [ 93.760907][ T5324] ? __pfx_genl_rcv_msg+0x10/0x10 [ 93.762729][ T5324] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 93.764852][ T5324] ? down_read+0x2be/0x330 [ 93.766753][ T5324] genl_rcv+0x28/0x40 [ 93.768408][ T5324] netlink_unicast+0x7bd/0x940 [ 93.770425][ T5324] netlink_sendmsg+0x813/0xb40 [ 93.772540][ T5324] ? __pfx_netlink_sendmsg+0x10/0x10 [ 93.774956][ T5324] ? apparmor_socket_sendmsg+0x98/0x360 [ 93.777422][ T5324] ? __pfx_netlink_sendmsg+0x10/0x10 [ 93.779765][ T5324] sock_sendmsg_nosec+0x13a/0x180 [ 93.782000][ T5324] ____sys_sendmsg+0x54e/0x850 [ 93.784193][ T5324] ? __pfx_____sys_sendmsg+0x10/0x10 [ 93.786576][ T5324] ? import_iovec+0x73/0xa0 [ 93.788592][ T5324] ___sys_sendmsg+0x2a5/0x360 [ 93.790716][ T5324] ? __lock_acquire+0x747/0x2de0 [ 93.792961][ T5324] ? __pfx____sys_sendmsg+0x10/0x10 [ 93.795173][ T5324] ? futex_wake+0x51b/0x5f0 [ 93.797183][ T5324] ? __fget_files+0x2a/0x420 [ 93.799138][ T5324] ? __fget_files+0x3a2/0x420 [ 93.801049][ T5324] __x64_sys_sendmsg+0x1b1/0x290 [ 93.803165][ T5324] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 93.805362][ T5324] do_syscall_64+0x166/0x520 [ 93.807277][ T5324] ? trace_irq_disable+0x3b/0x140 [ 93.809263][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.812248][ T5324] ? clear_bhb_loop+0x70/0xc0 [ 93.814640][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.817894][ T5324] RIP: 0033:0x7f1839f9e159 [ 93.820466][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.830493][ T5324] RSP: 002b:00007f18363f4fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 93.834549][ T5324] RAX: ffffffffffffffda RBX: 00007f183a225fa0 RCX: 00007f1839f9e159 [ 93.837732][ T5324] RDX: 0000000000000000 RSI: 0000200000001080 RDI: 0000000000000004 [ 93.841007][ T5324] RBP: 00007f183a03506b R08: 0000000000000000 R09: 0000000000000000 [ 93.844576][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 93.848104][ T5324] R13: 00007f183a226038 R14: 00007f183a225fa0 R15: 00007ffe6cf001d8 [ 93.851633][ T5324] [ 93.853442][ T5324] Kernel Offset: disabled [ 93.855467][ T5324] Rebooting in 86400 seconds..