program: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="05000000009927da52000600000008000300", @ANYRES32=r2, @ANYBLOB="0800050009"], 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000540)={0x78, r1, 0x5, 0x70bd26, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x44, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @val={0x2d, 0x1a, {0x1, 0x1, 0x7, 0x0, {0xa600000000000000, 0x2, 0x0, 0x3fe, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x9, 0x3}}, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x78}}, 0x20000014) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r4, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000000)={0x44, r5, 0xb97534d5fe9704cf, 0x0, 0x9000000, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x580}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6}, @NL80211_ATTR_STA_SUPPORT_P2P_PS={0x5}]}, 0x44}, 0x1, 0x0, 0x0, 0xc0}, 0x0) [ 94.650923][ T4637] Bluetooth: hci0: command tx timeout [ 94.868690][ T5317] ------------[ cut here ]------------ [ 94.871218][ T5317] !chanctx_conf [ 94.871229][ T5317] WARNING: net/mac80211/rate.c:51 at rate_control_rate_init+0x5a6/0x630, CPU#0: syz.0.0/5317 [ 94.877046][ T5317] Modules linked in: [ 94.878742][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.882837][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.887781][ T5317] RIP: 0010:rate_control_rate_init+0x5a6/0x630 [ 94.890408][ T5317] Code: 82 01 00 00 20 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 3c 97 91 00 cc e8 d6 ef 77 f6 90 0f 0b 90 eb e1 e8 cb ef 77 f6 90 <0f> 0b 90 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 84 00 00 00 [ 94.898539][ T5317] RSP: 0018:ffffc9000eacefe8 EFLAGS: 00010287 [ 94.901397][ T5317] RAX: ffffffff8b4f44f5 RBX: ffff888012fe0050 RCX: 0000000000100000 [ 94.904681][ T5317] RDX: ffffc90020802000 RSI: 00000000000003b1 RDI: 00000000000003b2 [ 94.907915][ T5317] RBP: dffffc0000000000 R08: ffffffff8b4f4067 R09: 0000000000000000 [ 94.911264][ T5317] R10: 0000000000000000 R11: ffffffff8ed5a360 R12: ffffffff8b4f4067 [ 94.914495][ T5317] R13: ffff888011f40f40 R14: 0000000000000001 R15: 0000000000000000 [ 94.917831][ T5317] FS: 00007f1d8e85c6c0(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000 [ 94.921445][ T5317] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.924253][ T5317] CR2: 00007f1d8e85af68 CR3: 0000000042ff3000 CR4: 0000000000352ef0 [ 94.927559][ T5317] Call Trace: [ 94.928989][ T5317] [ 94.930255][ T5317] rate_control_rate_init_all_links+0xf4/0x190 [ 94.932747][ T5317] sta_apply_auth_flags+0x1bc/0x430 [ 94.934913][ T5317] sta_apply_parameters+0x1291/0x1b50 [ 94.937205][ T5317] ieee80211_add_station+0x3de/0x700 [ 94.939199][ T5317] rdev_add_station+0xfc/0x290 [ 94.941206][ T5317] nl80211_new_station+0x1b4e/0x1fd0 [ 94.943345][ T5317] ? trace_contention_end+0x3d/0x140 [ 94.945419][ T5317] ? __pfx_nl80211_new_station+0x10/0x10 [ 94.947790][ T5317] ? __rtnl_unlock+0xc8/0xf0 [ 94.949714][ T5317] ? nl80211_pre_doit+0x53d/0x890 [ 94.952102][ T5317] genl_family_rcv_msg_doit+0x233/0x340 [ 94.954317][ T5317] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 94.956928][ T5317] ? bpf_lsm_capable+0x9/0x20 [ 94.958983][ T5317] ? security_capable+0x7e/0x2c0 [ 94.961340][ T5317] genl_rcv_msg+0x614/0x7a0 [ 94.963380][ T5317] ? __pfx_genl_rcv_msg+0x10/0x10 [ 94.965675][ T5317] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 94.968028][ T5317] ? __pfx_nl80211_new_station+0x10/0x10 [ 94.970383][ T5317] ? __pfx_nl80211_post_doit+0x10/0x10 [ 94.972807][ T5317] ? __pfx_ref_tracker_free+0x10/0x10 [ 94.975236][ T5317] ? __asan_memcpy+0x40/0x70 [ 94.977126][ T5317] ? __skb_clone+0x5c/0x6c0 [ 94.979037][ T5317] netlink_rcv_skb+0x226/0x4a0 [ 94.981582][ T5317] ? __pfx_genl_rcv_msg+0x10/0x10 [ 94.984032][ T5317] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 94.986325][ T5317] ? down_read+0x2be/0x330 [ 94.988272][ T5317] genl_rcv+0x28/0x40 [ 94.990006][ T5317] netlink_unicast+0x7bd/0x940 [ 94.992165][ T5317] netlink_sendmsg+0x813/0xb40 [ 94.994279][ T5317] ? __pfx_netlink_sendmsg+0x10/0x10 [ 94.996625][ T5317] ? aa_sock_msg_perm+0xf6/0x1c0 [ 94.998695][ T5317] ? __pfx_netlink_sendmsg+0x10/0x10 [ 95.001008][ T5317] sock_sendmsg_nosec+0x13a/0x180 [ 95.003217][ T5317] ____sys_sendmsg+0x54e/0x850 [ 95.005269][ T5317] ? __pfx_____sys_sendmsg+0x10/0x10 [ 95.007523][ T5317] ? import_iovec+0x73/0xa0 [ 95.009418][ T5317] ___sys_sendmsg+0x2a5/0x360 [ 95.011592][ T5317] ? __lock_acquire+0x683/0x2cf0 [ 95.013796][ T5317] ? __pfx____sys_sendmsg+0x10/0x10 [ 95.016113][ T5317] ? futex_wait+0x2a2/0x390 [ 95.018087][ T5317] ? __fget_files+0x2a/0x420 [ 95.020153][ T5317] ? __fget_files+0x3a2/0x420 [ 95.022256][ T5317] __x64_sys_sendmsg+0x1b1/0x290 [ 95.024353][ T5317] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 95.026587][ T5317] do_syscall_64+0x166/0x520 [ 95.028598][ T5317] ? trace_irq_disable+0x3b/0x140 [ 95.030745][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.033234][ T5317] ? clear_bhb_loop+0x70/0xc0 [ 95.035196][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.037366][ T5317] RIP: 0033:0x7f1d8d99e159 [ 95.039285][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.048220][ T5317] RSP: 002b:00007f1d8e85bfe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 95.051918][ T5317] RAX: ffffffffffffffda RBX: 00007f1d8dc26180 RCX: 00007f1d8d99e159 [ 95.055447][ T5317] RDX: 0000000000000000 RSI: 0000200000001080 RDI: 0000000000000006 [ 95.058921][ T5317] RBP: 00007f1d8da35024 R08: 0000000000000000 R09: 0000000000000000 [ 95.063176][ T5317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.066975][ T5317] R13: 00007f1d8dc26218 R14: 00007f1d8dc26180 R15: 00007ffcd323b598 [ 95.070372][ T5317] [ 95.071749][ T5317] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 95.074791][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.078517][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.082767][ T5317] Call Trace: [ 95.084242][ T5317] [ 95.085502][ T5317] vpanic+0x56d/0xa60 [ 95.087252][ T5317] ? __pfx__printk+0x10/0x10 [ 95.089195][ T5317] ? __pfx_vpanic+0x10/0x10 [ 95.091006][ T5317] ? is_bpf_text_address+0x292/0x2b0 [ 95.093204][ T5317] ? is_bpf_text_address+0x26/0x2b0 [ 95.095427][ T5317] panic+0xc5/0xd0 [ 95.096960][ T5317] ? __pfx_panic+0x10/0x10 [ 95.098862][ T5317] __warn+0x315/0x4c0 [ 95.100585][ T5317] ? rate_control_rate_init+0x5a6/0x630 [ 95.102925][ T5317] ? rate_control_rate_init+0x5a6/0x630 [ 95.105270][ T5317] __report_bug+0x276/0x570 [ 95.107226][ T5317] ? rate_control_rate_init+0x5a6/0x630 [ 95.109534][ T5317] ? __pfx___report_bug+0x10/0x10 [ 95.111617][ T5317] ? __lock_acquire+0x683/0x2cf0 [ 95.113742][ T5317] ? __lock_acquire+0x683/0x2cf0 [ 95.115774][ T5317] ? rate_control_rate_init+0x5a6/0x630 [ 95.118079][ T5317] report_bug+0x16b/0x220 [ 95.119886][ T5317] ? rate_control_rate_init+0x5a6/0x630 [ 95.122151][ T5317] ? rate_control_rate_init+0x5a8/0x630 [ 95.124502][ T5317] handle_bug+0x9c/0x200 [ 95.126293][ T5317] exc_invalid_op+0x1a/0x50 [ 95.128224][ T5317] asm_exc_invalid_op+0x1a/0x20 [ 95.130317][ T5317] RIP: 0010:rate_control_rate_init+0x5a6/0x630 [ 95.132931][ T5317] Code: 82 01 00 00 20 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 3c 97 91 00 cc e8 d6 ef 77 f6 90 0f 0b 90 eb e1 e8 cb ef 77 f6 90 <0f> 0b 90 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 84 00 00 00 [ 95.140766][ T5317] RSP: 0018:ffffc9000eacefe8 EFLAGS: 00010287 [ 95.143273][ T5317] RAX: ffffffff8b4f44f5 RBX: ffff888012fe0050 RCX: 0000000000100000 [ 95.146464][ T5317] RDX: ffffc90020802000 RSI: 00000000000003b1 RDI: 00000000000003b2 [ 95.149721][ T5317] RBP: dffffc0000000000 R08: ffffffff8b4f4067 R09: 0000000000000000 [ 95.153407][ T5317] R10: 0000000000000000 R11: ffffffff8ed5a360 R12: ffffffff8b4f4067 [ 95.156701][ T5317] R13: ffff888011f40f40 R14: 0000000000000001 R15: 0000000000000000 [ 95.160199][ T5317] ? rate_control_rate_init+0x117/0x630 [ 95.162639][ T5317] ? rate_control_rate_init+0x117/0x630 [ 95.165189][ T5317] ? rate_control_rate_init+0x5a5/0x630 [ 95.168073][ T5317] ? rate_control_rate_init+0x5a5/0x630 [ 95.170953][ T5317] rate_control_rate_init_all_links+0xf4/0x190 [ 95.173848][ T5317] sta_apply_auth_flags+0x1bc/0x430 [ 95.176171][ T5317] sta_apply_parameters+0x1291/0x1b50 [ 95.178387][ T5317] ieee80211_add_station+0x3de/0x700 [ 95.180567][ T5317] rdev_add_station+0xfc/0x290 [ 95.182670][ T5317] nl80211_new_station+0x1b4e/0x1fd0 [ 95.185506][ T5317] ? trace_contention_end+0x3d/0x140 [ 95.187738][ T5317] ? __pfx_nl80211_new_station+0x10/0x10 [ 95.189982][ T5317] ? __rtnl_unlock+0xc8/0xf0 [ 95.192069][ T5317] ? nl80211_pre_doit+0x53d/0x890 [ 95.194260][ T5317] genl_family_rcv_msg_doit+0x233/0x340 [ 95.196596][ T5317] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 95.199200][ T5317] ? bpf_lsm_capable+0x9/0x20 [ 95.201174][ T5317] ? security_capable+0x7e/0x2c0 [ 95.203432][ T5317] genl_rcv_msg+0x614/0x7a0 [ 95.205675][ T5317] ? __pfx_genl_rcv_msg+0x10/0x10 [ 95.208009][ T5317] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 95.210424][ T5317] ? __pfx_nl80211_new_station+0x10/0x10 [ 95.212865][ T5317] ? __pfx_nl80211_post_doit+0x10/0x10 [ 95.215036][ T5317] ? __pfx_ref_tracker_free+0x10/0x10 [ 95.217337][ T5317] ? __asan_memcpy+0x40/0x70 [ 95.219285][ T5317] ? __skb_clone+0x5c/0x6c0 [ 95.221022][ T5317] netlink_rcv_skb+0x226/0x4a0 [ 95.222669][ T5317] ? __pfx_genl_rcv_msg+0x10/0x10 [ 95.224546][ T5317] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 95.226509][ T5317] ? down_read+0x2be/0x330 [ 95.228279][ T5317] genl_rcv+0x28/0x40 [ 95.229838][ T5317] netlink_unicast+0x7bd/0x940 [ 95.231986][ T5317] netlink_sendmsg+0x813/0xb40 [ 95.234183][ T5317] ? __pfx_netlink_sendmsg+0x10/0x10 [ 95.236614][ T5317] ? aa_sock_msg_perm+0xf6/0x1c0 [ 95.238903][ T5317] ? __pfx_netlink_sendmsg+0x10/0x10 [ 95.241568][ T5317] sock_sendmsg_nosec+0x13a/0x180 [ 95.243925][ T5317] ____sys_sendmsg+0x54e/0x850 [ 95.246373][ T5317] ? __pfx_____sys_sendmsg+0x10/0x10 [ 95.248689][ T5317] ? import_iovec+0x73/0xa0 [ 95.250606][ T5317] ___sys_sendmsg+0x2a5/0x360 [ 95.252649][ T5317] ? __lock_acquire+0x683/0x2cf0 [ 95.254708][ T5317] ? __pfx____sys_sendmsg+0x10/0x10 [ 95.256930][ T5317] ? futex_wait+0x2a2/0x390 [ 95.258805][ T5317] ? __fget_files+0x2a/0x420 [ 95.260943][ T5317] ? __fget_files+0x3a2/0x420 [ 95.263033][ T5317] __x64_sys_sendmsg+0x1b1/0x290 [ 95.265217][ T5317] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 95.267471][ T5317] do_syscall_64+0x166/0x520 [ 95.269414][ T5317] ? trace_irq_disable+0x3b/0x140 [ 95.271508][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.273920][ T5317] ? clear_bhb_loop+0x70/0xc0 [ 95.275918][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.278450][ T5317] RIP: 0033:0x7f1d8d99e159 [ 95.280279][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.287950][ T5317] RSP: 002b:00007f1d8e85bfe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 95.291208][ T5317] RAX: ffffffffffffffda RBX: 00007f1d8dc26180 RCX: 00007f1d8d99e159 [ 95.294392][ T5317] RDX: 0000000000000000 RSI: 0000200000001080 RDI: 0000000000000006 [ 95.297590][ T5317] RBP: 00007f1d8da35024 R08: 0000000000000000 R09: 0000000000000000 [ 95.300944][ T5317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.304266][ T5317] R13: 00007f1d8dc26218 R14: 00007f1d8dc26180 R15: 00007ffcd323b598 [ 95.307273][ T5317] [ 95.308719][ T5317] Kernel Offset: disabled [ 95.310519][ T5317] Rebooting in 86400 seconds..