program: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) r2 = openat$cdrom(0xffffff9c, &(0x7f0000000000), 0x101000, 0x0) ioctl$CDROMRESUME(r2, 0x5302) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x0, 0x32, &(0x7f0000000100)=ANY=[@ANYBLOB="120100020000004025057a120001010200010902200001010080320904"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/ttyUSB0\x00', 0x802, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYBLOB="80000000", @ANYRES16=r1, @ANYBLOB="050026bd7000000000000f00000008000300", @ANYRES32=r3, @ANYBLOB="4c00b4a0ca96000008021100000108021100000008021100000000000000000000000000640001002d1a01001d00000000000000a60200fe0004000000000809000000037206030303030303080026006c09000008000c00640000aef80000000000000032cd9b7334"], 0x80}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000014) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) sendmsg$NL80211_CMD_NEW_STATION(r4, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000240)={0x48, r5, 0xb97534d5fe9704cf, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x580}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6}, @NL80211_ATTR_STA_FLAGS2={0xc, 0x43, {0xe, 0x2}}]}, 0x48}, 0x1, 0x0, 0x0, 0xc0}, 0x0) [ 93.790186][ T5279] Bluetooth: hci0: command tx timeout [ 94.244049][ T49] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 94.395775][ T49] usb 5-1: New USB device found, idVendor=0525, idProduct=127a, bcdDevice= 1.00 [ 94.402953][ T49] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 94.409423][ T49] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 94.412935][ T49] usb 5-1: Product: syz [ 94.415340][ T49] usb 5-1: Manufacturer: syz [ 94.438854][ T49] usb_debug 5-1:1.0: debug converter detected [ 94.451628][ T49] usb 5-1: debug converter now attached to ttyUSB0 [ 94.666609][ T5320] netlink: 8 bytes leftover after parsing attributes in process `syz.0.0'. [ 94.677606][ T5320] ------------[ cut here ]------------ [ 94.679734][ T5320] !chanctx_conf [ 94.679749][ T5320] WARNING: net/mac80211/rate.c:51 at rate_control_rate_init+0x5a6/0x630, CPU#0: syz.0.0/5320 [ 94.685295][ T5320] Modules linked in: [ 94.687910][ T5320] CPU: 0 UID: 0 PID: 5320 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.691810][ T5320] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.696310][ T5320] RIP: 0010:rate_control_rate_init+0x5a6/0x630 [ 94.700040][ T5320] Code: 82 01 00 00 20 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 3c 97 91 00 cc e8 d6 ef 77 f6 90 0f 0b 90 eb e1 e8 cb ef 77 f6 90 <0f> 0b 90 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 84 00 00 00 [ 94.708305][ T5320] RSP: 0018:ffffc9000eb7efe8 EFLAGS: 00010287 [ 94.712192][ T5320] RAX: ffffffff8b4f44f5 RBX: ffff88803fd44050 RCX: 0000000000100000 [ 94.715566][ T5320] RDX: ffffc9000f521000 RSI: 000000000000047c RDI: 000000000000047d [ 94.718811][ T5320] RBP: dffffc0000000000 R08: ffffffff8b4f4067 R09: 0000000000000000 [ 94.722204][ T5320] R10: 0000000000000000 R11: ffffffff8ed5a360 R12: ffffffff8b4f4067 [ 94.725731][ T5320] R13: ffff88801af30f40 R14: 0000000000000001 R15: 0000000000000000 [ 94.729121][ T5320] FS: 00007f96099476c0(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000 [ 94.732951][ T5320] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.735974][ T5320] CR2: 0000200000001080 CR3: 000000004352a000 CR4: 0000000000352ef0 [ 94.739280][ T5320] Call Trace: [ 94.740706][ T5320] [ 94.741988][ T5320] rate_control_rate_init_all_links+0xf4/0x190 [ 94.744671][ T5320] sta_apply_auth_flags+0x1bc/0x430 [ 94.747025][ T5320] sta_apply_parameters+0x1291/0x1b50 [ 94.749378][ T5320] ieee80211_add_station+0x3de/0x700 [ 94.751589][ T5320] rdev_add_station+0xfc/0x290 [ 94.753594][ T5320] nl80211_new_station+0x1b4e/0x1fd0 [ 94.755979][ T5320] ? trace_contention_end+0x3d/0x140 [ 94.758205][ T5320] ? __pfx_nl80211_new_station+0x10/0x10 [ 94.760500][ T5320] ? __rtnl_unlock+0xc8/0xf0 [ 94.771302][ T5320] ? nl80211_pre_doit+0x53d/0x890 [ 94.773546][ T5320] genl_family_rcv_msg_doit+0x233/0x340 [ 94.787180][ T5320] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 94.789913][ T5320] ? bpf_lsm_capable+0x9/0x20 [ 94.793662][ T5320] ? security_capable+0x7e/0x2c0 [ 94.795818][ T5320] genl_rcv_msg+0x614/0x7a0 [ 94.797569][ T5320] ? __pfx_genl_rcv_msg+0x10/0x10 [ 94.799612][ T5320] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 94.801835][ T5320] ? __pfx_nl80211_new_station+0x10/0x10 [ 94.804195][ T5320] ? __pfx_nl80211_post_doit+0x10/0x10 [ 94.806424][ T5320] ? __pfx_ref_tracker_free+0x10/0x10 [ 94.808757][ T5320] ? __asan_memcpy+0x40/0x70 [ 94.810678][ T5320] ? __skb_clone+0x5c/0x6c0 [ 94.812609][ T5320] netlink_rcv_skb+0x226/0x4a0 [ 94.814748][ T5320] ? __pfx_genl_rcv_msg+0x10/0x10 [ 94.816925][ T5320] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 94.819175][ T5320] ? down_read+0x2be/0x330 [ 94.821081][ T5320] genl_rcv+0x28/0x40 [ 94.822820][ T5320] netlink_unicast+0x7bd/0x940 [ 94.825079][ T5320] netlink_sendmsg+0x813/0xb40 [ 94.827231][ T5320] ? __pfx_netlink_sendmsg+0x10/0x10 [ 94.829537][ T5320] ? aa_sock_msg_perm+0xf6/0x1c0 [ 94.831602][ T5320] ? __pfx_netlink_sendmsg+0x10/0x10 [ 94.834041][ T5320] sock_sendmsg_nosec+0x13a/0x180 [ 94.836228][ T5320] ____sys_sendmsg+0x54e/0x850 [ 94.838287][ T5320] ? __pfx_____sys_sendmsg+0x10/0x10 [ 94.840537][ T5320] ? import_iovec+0x73/0xa0 [ 94.842647][ T5320] ___sys_sendmsg+0x2a5/0x360 [ 94.845771][ T5320] ? __lock_acquire+0x683/0x2cf0 [ 94.847855][ T5320] ? __pfx____sys_sendmsg+0x10/0x10 [ 94.850058][ T5320] ? futex_wait+0x2a2/0x390 [ 94.852152][ T5320] ? __fget_files+0x2a/0x420 [ 94.861813][ T5320] ? __fget_files+0x3a2/0x420 [ 94.864016][ T5320] __x64_sys_sendmsg+0x1b1/0x290 [ 94.866345][ T5320] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 94.868691][ T5320] do_syscall_64+0x166/0x520 [ 94.870612][ T5320] ? trace_irq_disable+0x3b/0x140 [ 94.872632][ T5320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.875174][ T5320] ? clear_bhb_loop+0x70/0xc0 [ 94.877171][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.879722][ T5320] RIP: 0033:0x7f960899e159 [ 94.882526][ T5320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.890598][ T5320] RSP: 002b:00007f9609946fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 94.894345][ T5320] RAX: ffffffffffffffda RBX: 00007f9608c25fa0 RCX: 00007f960899e159 [ 94.897755][ T5320] RDX: 0000000000000000 RSI: 0000200000001080 RDI: 0000000000000007 [ 94.901034][ T5320] RBP: 00007f9608a35024 R08: 0000000000000000 R09: 0000000000000000 [ 94.904353][ T5320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.907655][ T5320] R13: 00007f9608c26038 R14: 00007f9608c25fa0 R15: 00007fff150b20a8 [ 94.913854][ T5320] [ 94.915310][ T5320] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 94.918582][ T5320] CPU: 0 UID: 0 PID: 5320 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.922012][ T5320] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.925916][ T5320] Call Trace: [ 94.927300][ T5320] [ 94.928493][ T5320] vpanic+0x56d/0xa60 [ 94.930156][ T5320] ? __pfx__printk+0x10/0x10 [ 94.932191][ T5320] ? __pfx_vpanic+0x10/0x10 [ 94.934243][ T5320] ? is_bpf_text_address+0x292/0x2b0 [ 94.936462][ T5320] ? is_bpf_text_address+0x26/0x2b0 [ 94.938722][ T5320] panic+0xc5/0xd0 [ 94.940460][ T5320] ? __pfx_panic+0x10/0x10 [ 94.942426][ T5320] __warn+0x315/0x4c0 [ 94.944275][ T5320] ? rate_control_rate_init+0x5a6/0x630 [ 94.946630][ T5320] ? rate_control_rate_init+0x5a6/0x630 [ 94.948899][ T5320] __report_bug+0x276/0x570 [ 94.950916][ T5320] ? stack_depot_save_flags+0x404/0x7f0 [ 94.953398][ T5320] ? rate_control_rate_init+0x5a6/0x630 [ 94.956037][ T5320] ? __pfx___report_bug+0x10/0x10 [ 94.958248][ T5320] ? __lock_acquire+0x683/0x2cf0 [ 94.960440][ T5320] ? __lock_acquire+0x683/0x2cf0 [ 94.962671][ T5320] ? rate_control_rate_init+0x5a6/0x630 [ 94.964990][ T5320] report_bug+0x16b/0x220 [ 94.966772][ T5320] ? rate_control_rate_init+0x5a6/0x630 [ 94.969023][ T5320] ? rate_control_rate_init+0x5a8/0x630 [ 94.971353][ T5320] handle_bug+0x9c/0x200 [ 94.973131][ T5320] exc_invalid_op+0x1a/0x50 [ 94.975095][ T5320] asm_exc_invalid_op+0x1a/0x20 [ 94.977232][ T5320] RIP: 0010:rate_control_rate_init+0x5a6/0x630 [ 94.979804][ T5320] Code: 82 01 00 00 20 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 3c 97 91 00 cc e8 d6 ef 77 f6 90 0f 0b 90 eb e1 e8 cb ef 77 f6 90 <0f> 0b 90 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 84 00 00 00 [ 94.987798][ T5320] RSP: 0018:ffffc9000eb7efe8 EFLAGS: 00010287 [ 94.990371][ T5320] RAX: ffffffff8b4f44f5 RBX: ffff88803fd44050 RCX: 0000000000100000 [ 94.993630][ T5320] RDX: ffffc9000f521000 RSI: 000000000000047c RDI: 000000000000047d [ 94.996678][ T5320] RBP: dffffc0000000000 R08: ffffffff8b4f4067 R09: 0000000000000000 [ 94.999795][ T5320] R10: 0000000000000000 R11: ffffffff8ed5a360 R12: ffffffff8b4f4067 [ 95.003195][ T5320] R13: ffff88801af30f40 R14: 0000000000000001 R15: 0000000000000000 [ 95.006435][ T5320] ? rate_control_rate_init+0x117/0x630 [ 95.008662][ T5320] ? rate_control_rate_init+0x117/0x630 [ 95.010948][ T5320] ? rate_control_rate_init+0x5a5/0x630 [ 95.013048][ T5320] ? rate_control_rate_init+0x5a5/0x630 [ 95.015321][ T5320] rate_control_rate_init_all_links+0xf4/0x190 [ 95.018003][ T5320] sta_apply_auth_flags+0x1bc/0x430 [ 95.020173][ T5320] sta_apply_parameters+0x1291/0x1b50 [ 95.022332][ T5320] ieee80211_add_station+0x3de/0x700 [ 95.024507][ T5320] rdev_add_station+0xfc/0x290 [ 95.026452][ T5320] nl80211_new_station+0x1b4e/0x1fd0 [ 95.029449][ T5320] ? trace_contention_end+0x3d/0x140 [ 95.031710][ T5320] ? __pfx_nl80211_new_station+0x10/0x10 [ 95.033930][ T5320] ? __rtnl_unlock+0xc8/0xf0 [ 95.035863][ T5320] ? nl80211_pre_doit+0x53d/0x890 [ 95.037859][ T5320] genl_family_rcv_msg_doit+0x233/0x340 [ 95.040186][ T5320] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 95.042695][ T5320] ? bpf_lsm_capable+0x9/0x20 [ 95.044628][ T5320] ? security_capable+0x7e/0x2c0 [ 95.046644][ T5320] genl_rcv_msg+0x614/0x7a0 [ 95.048614][ T5320] ? __pfx_genl_rcv_msg+0x10/0x10 [ 95.050810][ T5320] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 95.053178][ T5320] ? __pfx_nl80211_new_station+0x10/0x10 [ 95.055626][ T5320] ? __pfx_nl80211_post_doit+0x10/0x10 [ 95.057991][ T5320] ? __pfx_ref_tracker_free+0x10/0x10 [ 95.060347][ T5320] ? __asan_memcpy+0x40/0x70 [ 95.065232][ T5320] ? __skb_clone+0x5c/0x6c0 [ 95.067383][ T5320] netlink_rcv_skb+0x226/0x4a0 [ 95.069442][ T5320] ? __pfx_genl_rcv_msg+0x10/0x10 [ 95.071548][ T5320] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 95.073919][ T5320] ? down_read+0x2be/0x330 [ 95.076330][ T5320] genl_rcv+0x28/0x40 [ 95.078388][ T5320] netlink_unicast+0x7bd/0x940 [ 95.080579][ T5320] netlink_sendmsg+0x813/0xb40 [ 95.082938][ T5320] ? __pfx_netlink_sendmsg+0x10/0x10 [ 95.085678][ T5320] ? aa_sock_msg_perm+0xf6/0x1c0 [ 95.087938][ T5320] ? __pfx_netlink_sendmsg+0x10/0x10 [ 95.090213][ T5320] sock_sendmsg_nosec+0x13a/0x180 [ 95.092405][ T5320] ____sys_sendmsg+0x54e/0x850 [ 95.094571][ T5320] ? __pfx_____sys_sendmsg+0x10/0x10 [ 95.096828][ T5320] ? import_iovec+0x73/0xa0 [ 95.098889][ T5320] ___sys_sendmsg+0x2a5/0x360 [ 95.101054][ T5320] ? __lock_acquire+0x683/0x2cf0 [ 95.103116][ T5320] ? __pfx____sys_sendmsg+0x10/0x10 [ 95.105318][ T5320] ? futex_wait+0x2a2/0x390 [ 95.107344][ T5320] ? __fget_files+0x2a/0x420 [ 95.109277][ T5320] ? __fget_files+0x3a2/0x420 [ 95.111228][ T5320] __x64_sys_sendmsg+0x1b1/0x290 [ 95.113383][ T5320] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 95.115868][ T5320] do_syscall_64+0x166/0x520 [ 95.117778][ T5320] ? trace_irq_disable+0x3b/0x140 [ 95.119920][ T5320] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.122535][ T5320] ? clear_bhb_loop+0x70/0xc0 [ 95.124558][ T5320] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.127064][ T5320] RIP: 0033:0x7f960899e159 [ 95.129017][ T5320] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.137678][ T5320] RSP: 002b:00007f9609946fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 95.141247][ T5320] RAX: ffffffffffffffda RBX: 00007f9608c25fa0 RCX: 00007f960899e159 [ 95.144452][ T5320] RDX: 0000000000000000 RSI: 0000200000001080 RDI: 0000000000000007 [ 95.147775][ T5320] RBP: 00007f9608a35024 R08: 0000000000000000 R09: 0000000000000000 [ 95.151102][ T5320] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.154414][ T5320] R13: 00007f9608c26038 R14: 00007f9608c25fa0 R15: 00007fff150b20a8 [ 95.157635][ T5320] [ 95.159319][ T5320] Kernel Offset: disabled [ 95.161195][ T5320] Rebooting in 86400 seconds..