program: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000005c0)=ANY=[@ANYBLOB="80000000", @ANYRES16=r1, @ANYBLOB="050026bd7000000000f0faf6b45410111ec99ab807000f001b0808000300fa01c1250f235a7f54d569d2a074786faa04bcdf52e747a051c35542aef795dada81e88e2b4fd8c196ce1d3f23bab20f012ee72971052985a704a3dfb186f4eefff040eb8f1b153ff93547a25760135364bd14d07babd57507a8125d5e11", @ANYRES32=r2, @ANYBLOB="4c000e0080000000ffffffffffff08021100000008021100000000000000000000000000640001002d1a01001d00000000000000a60200fe0004000000000009000000037206030303030303080026006c09000008000c006400000008000d0000000000"], 0x80}}, 0x20000014) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000880)=@updpolicy={0xb8, 0x19, 0xfd3649826d894c67, 0x0, 0x0, {{@in6=@mcast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x5, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f75}, {}, 0x0, 0x0, 0x1, 0x1, 0x2}}, 0xb8}}, 0x0) r6 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r6, 0x8922, &(0x7f0000000000)={'lo\x00'}) syz_emit_ethernet(0xbe, &(0x7f0000000100)={@local, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @dev, @local}, {0x0, 0x0, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "f4cb985d33b16266b5efb88aaa87eda081bac8b2f9a49d564054f1c9218f47b3", "cf8743eb4d9e776f94a6a58d36e006ac614f6f7bce9217cbfea31675d4a860cf6003977b1e4dbb16dc31cc76522bf19d", "5043edd2a8cc8c41345f8feb1a7a8e23043b8a465b1ed5bf8bc91307", {"c7193f7edd1efc4742dc481e6f57f901", "948177bcc5dea4029ba4683a6bdcd7a1"}}}}}}}, 0x0) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) r9 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r9, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @multicast}, 0x10) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff4000/0x4000)=nil, &(0x7f0000000000/0xc000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r10 = io_uring_setup(0x7f9, &(0x7f0000000040)={0x0, 0xc8df, 0xfc00, 0xa, 0x20002f7}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x300, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x1}, {0xfff1, 0xffff}, {0xe, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x40005}, 0x20040000) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, &(0x7f0000000000)=0x6, 0x4) r11 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r11, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000100)=0x8) io_uring_enter(r10, 0x2219, 0x7721, 0x16, 0x0, 0x0) sendmsg$NL80211_CMD_NEW_STATION(r4, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000480)={0x3c, r7, 0xb97534d5fe9704cf, 0x0, 0x0, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x580}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc0}, 0x0) [ 93.566420][ T5324] ------------[ cut here ]------------ [ 93.568517][ T5324] !chanctx_conf [ 93.568530][ T5324] WARNING: net/mac80211/rate.c:51 at rate_control_rate_init+0x5a6/0x630, CPU#0: syz.0.0/5324 [ 93.576652][ T5324] Modules linked in: [ 93.579865][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.583860][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.588383][ T5324] RIP: 0010:rate_control_rate_init+0x5a6/0x630 [ 93.591164][ T5324] Code: 82 01 00 00 20 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 bc 51 91 00 cc e8 26 1e 84 f6 90 0f 0b 90 eb e1 e8 1b 1e 84 f6 90 <0f> 0b 90 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 84 00 00 00 [ 93.600442][ T5324] RSP: 0018:ffffc90003d76fe0 EFLAGS: 00010287 [ 93.603142][ T5324] RAX: ffffffff8b426475 RBX: ffff888034470050 RCX: 0000000000100000 [ 93.606575][ T5324] RDX: ffffc90021003000 RSI: 00000000000005f8 RDI: 00000000000005f9 [ 93.610464][ T5324] RBP: dffffc0000000000 R08: ffffffff8b425fe7 R09: 0000000000000000 [ 93.614760][ T5324] R10: 0000000000000000 R11: ffffffff8eb59c60 R12: ffffffff8b425fe7 [ 93.618086][ T5324] R13: ffff8880522e0f40 R14: 0000000000000001 R15: 0000000000000000 [ 93.621381][ T5324] FS: 00007f80928c36c0(0000) GS:ffff88808c54e000(0000) knlGS:0000000000000000 [ 93.625180][ T5324] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 93.628322][ T5324] CR2: 00007f8091b94e30 CR3: 00000000130b7000 CR4: 0000000000352ef0 [ 93.632476][ T5324] Call Trace: [ 93.634104][ T5324] [ 93.636201][ T5324] rate_control_rate_init_all_links+0xf4/0x190 [ 93.638936][ T5324] sta_apply_auth_flags+0x1bc/0x430 [ 93.641043][ T5324] sta_apply_parameters+0x126d/0x1b10 [ 93.643066][ T5324] ieee80211_add_station+0x3de/0x700 [ 93.645398][ T5324] rdev_add_station+0xfc/0x290 [ 93.648086][ T5324] nl80211_new_station+0x1b4e/0x1fd0 [ 93.651180][ T5324] ? trace_contention_end+0x3d/0x140 [ 93.653787][ T5324] ? __pfx_nl80211_new_station+0x10/0x10 [ 93.656226][ T5324] ? __rtnl_unlock+0xc8/0xf0 [ 93.658162][ T5324] ? nl80211_pre_doit+0x53d/0x890 [ 93.660214][ T5324] genl_family_rcv_msg_doit+0x233/0x340 [ 93.662300][ T5324] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 93.664817][ T5324] ? bpf_lsm_capable+0x9/0x20 [ 93.666688][ T5324] ? security_capable+0x7e/0x2c0 [ 93.668925][ T5324] genl_rcv_msg+0x614/0x7a0 [ 93.671358][ T5324] ? __pfx_genl_rcv_msg+0x10/0x10 [ 93.674085][ T5324] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 93.676492][ T5324] ? __pfx_nl80211_new_station+0x10/0x10 [ 93.678966][ T5324] ? __pfx_nl80211_post_doit+0x10/0x10 [ 93.681078][ T5324] ? __pfx_ref_tracker_free+0x10/0x10 [ 93.683310][ T5324] ? __asan_memcpy+0x40/0x70 [ 93.685329][ T5324] ? __skb_clone+0x5c/0x6c0 [ 93.687218][ T5324] netlink_rcv_skb+0x226/0x4a0 [ 93.689356][ T5324] ? __pfx_genl_rcv_msg+0x10/0x10 [ 93.692140][ T5324] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 93.695097][ T5324] ? down_read+0x2be/0x330 [ 93.697143][ T5324] genl_rcv+0x28/0x40 [ 93.698881][ T5324] netlink_unicast+0x7bb/0x940 [ 93.700964][ T5324] netlink_sendmsg+0x813/0xb40 [ 93.703031][ T5324] ? __pfx_netlink_sendmsg+0x10/0x10 [ 93.705611][ T5324] ? aa_sock_msg_perm+0xf1/0x1b0 [ 93.708470][ T5324] ? __pfx_netlink_sendmsg+0x10/0x10 [ 93.711301][ T5324] sock_sendmsg_nosec+0x13a/0x180 [ 93.713534][ T5324] ____sys_sendmsg+0x54e/0x850 [ 93.717202][ T5324] ? __pfx_____sys_sendmsg+0x10/0x10 [ 93.719554][ T5324] ? import_iovec+0x73/0xa0 [ 93.721530][ T5324] ___sys_sendmsg+0x2a5/0x360 [ 93.723598][ T5324] ? __lock_acquire+0x683/0x2cf0 [ 93.725904][ T5324] ? __pfx____sys_sendmsg+0x10/0x10 [ 93.728540][ T5324] ? futex_wait+0x2a2/0x390 [ 93.731001][ T5324] ? __fget_files+0x2a/0x420 [ 93.733326][ T5324] ? __fget_files+0x3a2/0x420 [ 93.735722][ T5324] __x64_sys_sendmsg+0x1b1/0x290 [ 93.737857][ T5324] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 93.740224][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.742884][ T5324] do_syscall_64+0x174/0x580 [ 93.745300][ T5324] ? trace_irq_disable+0x3b/0x140 [ 93.747695][ T5324] ? clear_bhb_loop+0x40/0x90 [ 93.750085][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.752546][ T5324] RIP: 0033:0x7f809199de59 [ 93.754498][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.763664][ T5324] RSP: 002b:00007f80928c2fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 93.767530][ T5324] RAX: ffffffffffffffda RBX: 00007f8091c26090 RCX: 00007f809199de59 [ 93.770815][ T5324] RDX: 0000000000000000 RSI: 0000200000001080 RDI: 0000000000000006 [ 93.774054][ T5324] RBP: 00007f8091a33e6f R08: 0000000000000000 R09: 0000000000000000 [ 93.777845][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 93.781919][ T5324] R13: 00007f8091c26128 R14: 00007f8091c26090 R15: 00007fffabfe3178 [ 93.785308][ T5324] [ 93.786656][ T5324] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 93.789832][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 93.794080][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 93.799174][ T5324] Call Trace: [ 93.800826][ T5324] [ 93.802271][ T5324] vpanic+0x56c/0xa60 [ 93.803980][ T5324] ? __pfx__printk+0x10/0x10 [ 93.806008][ T5324] ? __pfx_vpanic+0x10/0x10 [ 93.808372][ T5324] ? is_bpf_text_address+0x292/0x2b0 [ 93.811102][ T5324] ? is_bpf_text_address+0x26/0x2b0 [ 93.813225][ T5324] panic+0xc5/0xd0 [ 93.814630][ T5324] ? __pfx_panic+0x10/0x10 [ 93.816465][ T5324] __warn+0x315/0x4c0 [ 93.818126][ T5324] ? rate_control_rate_init+0x5a6/0x630 [ 93.820573][ T5324] ? rate_control_rate_init+0x5a6/0x630 [ 93.823233][ T5324] __report_bug+0x331/0x530 [ 93.825587][ T5324] ? stack_depot_save_flags+0x3ec/0x800 [ 93.828127][ T5324] ? rate_control_rate_init+0x5a6/0x630 [ 93.830447][ T5324] ? __pfx___report_bug+0x10/0x10 [ 93.832611][ T5324] ? __lock_acquire+0x683/0x2cf0 [ 93.834798][ T5324] ? __lock_acquire+0x683/0x2cf0 [ 93.837319][ T5324] ? rate_control_rate_init+0x5a6/0x630 [ 93.840057][ T5324] report_bug+0x16a/0x220 [ 93.842085][ T5324] ? rate_control_rate_init+0x5a6/0x630 [ 93.844423][ T5324] ? rate_control_rate_init+0x5a8/0x630 [ 93.846778][ T5324] handle_bug+0x9c/0x200 [ 93.848844][ T5324] exc_invalid_op+0x1a/0x50 [ 93.851542][ T5324] asm_exc_invalid_op+0x1a/0x20 [ 93.853945][ T5324] RIP: 0010:rate_control_rate_init+0x5a6/0x630 [ 93.856592][ T5324] Code: 82 01 00 00 20 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 bc 51 91 00 cc e8 26 1e 84 f6 90 0f 0b 90 eb e1 e8 1b 1e 84 f6 90 <0f> 0b 90 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 84 00 00 00 [ 93.864803][ T5324] RSP: 0018:ffffc90003d76fe0 EFLAGS: 00010287 [ 93.867694][ T5324] RAX: ffffffff8b426475 RBX: ffff888034470050 RCX: 0000000000100000 [ 93.871007][ T5324] RDX: ffffc90021003000 RSI: 00000000000005f8 RDI: 00000000000005f9 [ 93.874293][ T5324] RBP: dffffc0000000000 R08: ffffffff8b425fe7 R09: 0000000000000000 [ 93.878169][ T5324] R10: 0000000000000000 R11: ffffffff8eb59c60 R12: ffffffff8b425fe7 [ 93.882020][ T5324] R13: ffff8880522e0f40 R14: 0000000000000001 R15: 0000000000000000 [ 93.885304][ T5324] ? rate_control_rate_init+0x117/0x630 [ 93.887628][ T5324] ? rate_control_rate_init+0x117/0x630 [ 93.890001][ T5324] ? rate_control_rate_init+0x5a5/0x630 [ 93.892463][ T5324] rate_control_rate_init_all_links+0xf4/0x190 [ 93.895588][ T5324] sta_apply_auth_flags+0x1bc/0x430 [ 93.898243][ T5324] sta_apply_parameters+0x126d/0x1b10 [ 93.900542][ T5324] ieee80211_add_station+0x3de/0x700 [ 93.902890][ T5324] rdev_add_station+0xfc/0x290 [ 93.905048][ T5324] nl80211_new_station+0x1b4e/0x1fd0 [ 93.907473][ T5324] ? trace_contention_end+0x3d/0x140 [ 93.910603][ T5324] ? __pfx_nl80211_new_station+0x10/0x10 [ 93.913673][ T5324] ? __rtnl_unlock+0xc8/0xf0 [ 93.915647][ T5324] ? nl80211_pre_doit+0x53d/0x890 [ 93.917767][ T5324] genl_family_rcv_msg_doit+0x233/0x340 [ 93.920309][ T5324] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 93.923148][ T5324] ? bpf_lsm_capable+0x9/0x20 [ 93.925278][ T5324] ? security_capable+0x7e/0x2c0 [ 93.927402][ T5324] genl_rcv_msg+0x614/0x7a0 [ 93.929489][ T5324] ? __pfx_genl_rcv_msg+0x10/0x10 [ 93.932094][ T5324] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 93.934973][ T5324] ? __pfx_nl80211_new_station+0x10/0x10 [ 93.937538][ T5324] ? __pfx_nl80211_post_doit+0x10/0x10 [ 93.939816][ T5324] ? __pfx_ref_tracker_free+0x10/0x10 [ 93.942152][ T5324] ? __asan_memcpy+0x40/0x70 [ 93.944188][ T5324] ? __skb_clone+0x5c/0x6c0 [ 93.947420][ T5324] netlink_rcv_skb+0x226/0x4a0 [ 93.950513][ T5324] ? __pfx_genl_rcv_msg+0x10/0x10 [ 93.953116][ T5324] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 93.955393][ T5324] ? down_read+0x2be/0x330 [ 93.957347][ T5324] genl_rcv+0x28/0x40 [ 93.958970][ T5324] netlink_unicast+0x7bb/0x940 [ 93.961049][ T5324] netlink_sendmsg+0x813/0xb40 [ 93.963185][ T5324] ? __pfx_netlink_sendmsg+0x10/0x10 [ 93.965589][ T5324] ? aa_sock_msg_perm+0xf1/0x1b0 [ 93.968219][ T5324] ? __pfx_netlink_sendmsg+0x10/0x10 [ 93.970707][ T5324] sock_sendmsg_nosec+0x13a/0x180 [ 93.972804][ T5324] ____sys_sendmsg+0x54e/0x850 [ 93.974837][ T5324] ? __pfx_____sys_sendmsg+0x10/0x10 [ 93.977091][ T5324] ? import_iovec+0x73/0xa0 [ 93.979222][ T5324] ___sys_sendmsg+0x2a5/0x360 [ 93.981601][ T5324] ? __lock_acquire+0x683/0x2cf0 [ 93.984116][ T5324] ? __pfx____sys_sendmsg+0x10/0x10 [ 93.986375][ T5324] ? futex_wait+0x2a2/0x390 [ 93.988363][ T5324] ? __fget_files+0x2a/0x420 [ 93.990314][ T5324] ? __fget_files+0x3a2/0x420 [ 93.992510][ T5324] __x64_sys_sendmsg+0x1b1/0x290 [ 93.995067][ T5324] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 93.997709][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.000437][ T5324] do_syscall_64+0x174/0x580 [ 94.002433][ T5324] ? trace_irq_disable+0x3b/0x140 [ 94.004644][ T5324] ? clear_bhb_loop+0x40/0x90 [ 94.006883][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.009885][ T5324] RIP: 0033:0x7f809199de59 [ 94.012057][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.020169][ T5324] RSP: 002b:00007f80928c2fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 94.024568][ T5324] RAX: ffffffffffffffda RBX: 00007f8091c26090 RCX: 00007f809199de59 [ 94.027976][ T5324] RDX: 0000000000000000 RSI: 0000200000001080 RDI: 0000000000000006 [ 94.031348][ T5324] RBP: 00007f8091a33e6f R08: 0000000000000000 R09: 0000000000000000 [ 94.034887][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.038851][ T5324] R13: 00007f8091c26128 R14: 00007f8091c26090 R15: 00007fffabfe3178 [ 94.042299][ T5324] [ 94.044009][ T5324] Kernel Offset: disabled [ 94.046013][ T5324] Rebooting in 86400 seconds..