program: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) sendto$inet6(r0, &(0x7f0000000000)='X', 0x1, 0x4000000, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x300) r1 = socket(0x2, 0x3, 0x9) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x64, r3, 0x10, 0x70bd26, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x30, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @val={0x72, 0x6}, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x64}}, 0x20000014) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r6, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000040)={0x3c, r7, 0xb97534d5fe9704cf, 0x0, 0x0, {{}, {@val={0x8, 0x3, r8}, @void}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x580}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc0}, 0x0) r9 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r9, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x1}, 0x8) sendmmsg$inet(r1, &(0x7f0000000f40)=[{{&(0x7f0000000300)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000000b40)=[@ip_ttl={{0xffffffffffffffda, 0x0, 0x2, 0x7}}], 0x18}}], 0x1, 0x0) [ 84.777990][ T5322] ------------[ cut here ]------------ [ 84.780384][ T5322] !chanctx_conf [ 84.780397][ T5322] WARNING: net/mac80211/rate.c:53 at rate_control_rate_init+0x64a/0x6e0, CPU#0: syz.0.0/5322 [ 84.787347][ T5322] Modules linked in: [ 84.789543][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 84.793770][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 84.798011][ T5322] RIP: 0010:rate_control_rate_init+0x64a/0x6e0 [ 84.800967][ T5322] Code: 82 01 00 00 20 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 48 07 90 00 cc e8 a2 8d b8 f6 90 0f 0b 90 eb e1 e8 97 8d b8 f6 90 <0f> 0b 90 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 90 00 00 00 [ 84.809541][ T5322] RSP: 0018:ffffc90001a3ef60 EFLAGS: 00010283 [ 84.812510][ T5322] RAX: ffffffff8b0bfc29 RBX: ffff88803791c000 RCX: 0000000000100000 [ 84.816165][ T5322] RDX: ffffc9000f432000 RSI: 0000000000000390 RDI: 0000000000000391 [ 84.819582][ T5322] RBP: 0000000000000000 R08: ffffffff8b0bf743 R09: ffffffff8e55a360 [ 84.822947][ T5322] R10: dffffc0000000000 R11: ffffed1006f23831 R12: 1ffff11006f2380a [ 84.826802][ T5322] R13: ffff888040d10e80 R14: 0000000000000001 R15: ffffffff8b0bf743 [ 84.830155][ T5322] FS: 00007f978dc116c0(0000) GS:ffff88808cce8000(0000) knlGS:0000000000000000 [ 84.834319][ T5322] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 84.837072][ T5322] CR2: 0000200000001080 CR3: 000000001f0d2000 CR4: 0000000000352ef0 [ 84.840714][ T5322] Call Trace: [ 84.842188][ T5322] [ 84.844203][ T5322] rate_control_rate_init_all_links+0x109/0x1a0 [ 84.846911][ T5322] sta_apply_auth_flags+0x1c2/0x400 [ 84.849205][ T5322] sta_apply_parameters+0xe27/0x1570 [ 84.851476][ T5322] ieee80211_add_station+0x424/0x6a0 [ 84.854287][ T5322] rdev_add_station+0xfc/0x270 [ 84.856623][ T5322] nl80211_new_station+0x1860/0x1c70 [ 84.859184][ T5322] ? __pfx_nl80211_new_station+0x10/0x10 [ 84.861568][ T5322] ? netdev_run_todo+0xd5c/0xde0 [ 84.863972][ T5322] ? nl80211_pre_doit+0x4f1/0x930 [ 84.866255][ T5322] genl_family_rcv_msg_doit+0x22a/0x330 [ 84.868828][ T5322] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 84.871520][ T5322] ? bpf_lsm_capable+0x9/0x20 [ 84.873711][ T5322] ? security_capable+0x7e/0x2c0 [ 84.875982][ T5322] genl_rcv_msg+0x61c/0x7a0 [ 84.878141][ T5322] ? __pfx_genl_rcv_msg+0x10/0x10 [ 84.880427][ T5322] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 84.882684][ T5322] ? __pfx_nl80211_new_station+0x10/0x10 [ 84.885313][ T5322] ? __pfx_nl80211_post_doit+0x10/0x10 [ 84.887817][ T5322] ? __pfx_ref_tracker_free+0x10/0x10 [ 84.890295][ T5322] ? __skb_clone+0x63/0x7a0 [ 84.892524][ T5322] netlink_rcv_skb+0x232/0x4b0 [ 84.894712][ T5322] ? __pfx_genl_rcv_msg+0x10/0x10 [ 84.896970][ T5322] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 84.899357][ T5322] ? genl_rcv+0x19/0x40 [ 84.901210][ T5322] ? down_read+0x272/0x2e0 [ 84.903435][ T5322] ? genl_rcv+0xd/0x40 [ 84.905358][ T5322] genl_rcv+0x28/0x40 [ 84.907153][ T5322] netlink_unicast+0x80f/0x9b0 [ 84.909346][ T5322] ? __pfx_netlink_unicast+0x10/0x10 [ 84.911580][ T5322] ? __alloc_skb+0x193/0x390 [ 84.913528][ T5322] ? netlink_sendmsg+0x650/0xb40 [ 84.916692][ T5322] ? skb_put+0x11b/0x210 [ 84.918502][ T5322] netlink_sendmsg+0x813/0xb40 [ 84.920585][ T5322] ? __pfx_netlink_sendmsg+0x10/0x10 [ 84.922881][ T5322] ? aa_sock_msg_perm+0xf1/0x1b0 [ 84.925513][ T5322] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 84.927855][ T5322] ? __pfx_netlink_sendmsg+0x10/0x10 [ 84.930299][ T5322] ____sys_sendmsg+0xa68/0xad0 [ 84.932507][ T5322] ? __might_fault+0xaf/0x130 [ 84.934820][ T5322] ? __pfx_____sys_sendmsg+0x10/0x10 [ 84.937087][ T5322] ? import_iovec+0x73/0xa0 [ 84.939085][ T5322] ___sys_sendmsg+0x2a5/0x360 [ 84.941161][ T5322] ? __lock_acquire+0x6b5/0x2cf0 [ 84.943513][ T5322] ? __pfx____sys_sendmsg+0x10/0x10 [ 84.945904][ T5322] ? futex_wait+0x29a/0x380 [ 84.948034][ T5322] ? __fget_files+0x2a/0x420 [ 84.950094][ T5322] ? __fget_files+0x3a0/0x420 [ 84.952092][ T5322] __x64_sys_sendmsg+0x1bd/0x2a0 [ 84.954469][ T5322] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 84.956883][ T5322] ? rcu_is_watching+0x15/0xb0 [ 84.959052][ T5322] do_syscall_64+0xe2/0xf80 [ 84.961118][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.963809][ T5322] ? trace_irq_disable+0x37/0x100 [ 84.965992][ T5322] ? clear_bhb_loop+0x60/0xb0 [ 84.968142][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.970577][ T5322] RIP: 0033:0x7f978cd9aeb9 [ 84.972460][ T5322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 84.980023][ T5322] RSP: 002b:00007f978dc11028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 84.983300][ T5322] RAX: ffffffffffffffda RBX: 00007f978d015fa0 RCX: 00007f978cd9aeb9 [ 84.986848][ T5322] RDX: 0000000000000000 RSI: 0000200000001080 RDI: 0000000000000008 [ 84.990315][ T5322] RBP: 00007f978ce08c1f R08: 0000000000000000 R09: 0000000000000000 [ 84.993675][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 84.997545][ T5322] R13: 00007f978d016038 R14: 00007f978d015fa0 R15: 00007ffe81b87e88 [ 85.001109][ T5322] [ 85.002443][ T5322] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 85.005670][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 85.009707][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 85.014008][ T5322] Call Trace: [ 85.015503][ T5322] [ 85.016859][ T5322] vpanic+0x1e0/0x670 [ 85.018677][ T5322] panic+0xc5/0xd0 [ 85.020352][ T5322] ? __pfx_panic+0x10/0x10 [ 85.022307][ T5322] __warn+0x315/0x4a0 [ 85.024082][ T5322] ? rate_control_rate_init+0x64a/0x6e0 [ 85.026407][ T5322] ? rate_control_rate_init+0x64a/0x6e0 [ 85.028875][ T5322] __report_bug+0x29a/0x540 [ 85.031010][ T5322] ? trace_sched_exit_tp+0x36/0xf0 [ 85.033144][ T5322] ? rate_control_rate_init+0x64a/0x6e0 [ 85.035408][ T5322] ? __pfx___report_bug+0x10/0x10 [ 85.037645][ T5322] ? __lock_acquire+0x6b5/0x2cf0 [ 85.039843][ T5322] ? __lock_acquire+0x6b5/0x2cf0 [ 85.042284][ T5322] ? rate_control_rate_init+0x64a/0x6e0 [ 85.044655][ T5322] report_bug+0x16a/0x220 [ 85.046507][ T5322] ? rate_control_rate_init+0x64a/0x6e0 [ 85.049022][ T5322] ? rate_control_rate_init+0x64c/0x6e0 [ 85.051450][ T5322] handle_bug+0x98/0x200 [ 85.053348][ T5322] exc_invalid_op+0x1a/0x50 [ 85.055331][ T5322] asm_exc_invalid_op+0x1a/0x20 [ 85.057394][ T5322] RIP: 0010:rate_control_rate_init+0x64a/0x6e0 [ 85.060294][ T5322] Code: 82 01 00 00 20 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 48 07 90 00 cc e8 a2 8d b8 f6 90 0f 0b 90 eb e1 e8 97 8d b8 f6 90 <0f> 0b 90 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 90 00 00 00 [ 85.068697][ T5322] RSP: 0018:ffffc90001a3ef60 EFLAGS: 00010283 [ 85.071368][ T5322] RAX: ffffffff8b0bfc29 RBX: ffff88803791c000 RCX: 0000000000100000 [ 85.074934][ T5322] RDX: ffffc9000f432000 RSI: 0000000000000390 RDI: 0000000000000391 [ 85.078446][ T5322] RBP: 0000000000000000 R08: ffffffff8b0bf743 R09: ffffffff8e55a360 [ 85.081981][ T5322] R10: dffffc0000000000 R11: ffffed1006f23831 R12: 1ffff11006f2380a [ 85.085512][ T5322] R13: ffff888040d10e80 R14: 0000000000000001 R15: ffffffff8b0bf743 [ 85.089029][ T5322] ? rate_control_rate_init+0x163/0x6e0 [ 85.091544][ T5322] ? rate_control_rate_init+0x163/0x6e0 [ 85.094050][ T5322] ? rate_control_rate_init+0x649/0x6e0 [ 85.096509][ T5322] rate_control_rate_init_all_links+0x109/0x1a0 [ 85.099415][ T5322] sta_apply_auth_flags+0x1c2/0x400 [ 85.101785][ T5322] sta_apply_parameters+0xe27/0x1570 [ 85.104229][ T5322] ieee80211_add_station+0x424/0x6a0 [ 85.106320][ T5322] rdev_add_station+0xfc/0x270 [ 85.108808][ T5322] nl80211_new_station+0x1860/0x1c70 [ 85.111187][ T5322] ? __pfx_nl80211_new_station+0x10/0x10 [ 85.113739][ T5322] ? netdev_run_todo+0xd5c/0xde0 [ 85.116033][ T5322] ? nl80211_pre_doit+0x4f1/0x930 [ 85.118411][ T5322] genl_family_rcv_msg_doit+0x22a/0x330 [ 85.120847][ T5322] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 85.123583][ T5322] ? bpf_lsm_capable+0x9/0x20 [ 85.125630][ T5322] ? security_capable+0x7e/0x2c0 [ 85.127807][ T5322] genl_rcv_msg+0x61c/0x7a0 [ 85.130206][ T5322] ? __pfx_genl_rcv_msg+0x10/0x10 [ 85.133083][ T5322] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 85.135471][ T5322] ? __pfx_nl80211_new_station+0x10/0x10 [ 85.137861][ T5322] ? __pfx_nl80211_post_doit+0x10/0x10 [ 85.140310][ T5322] ? __pfx_ref_tracker_free+0x10/0x10 [ 85.142758][ T5322] ? __skb_clone+0x63/0x7a0 [ 85.144672][ T5322] netlink_rcv_skb+0x232/0x4b0 [ 85.146806][ T5322] ? __pfx_genl_rcv_msg+0x10/0x10 [ 85.149062][ T5322] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 85.151390][ T5322] ? genl_rcv+0x19/0x40 [ 85.153257][ T5322] ? down_read+0x272/0x2e0 [ 85.155270][ T5322] ? genl_rcv+0xd/0x40 [ 85.157057][ T5322] genl_rcv+0x28/0x40 [ 85.158840][ T5322] netlink_unicast+0x80f/0x9b0 [ 85.160927][ T5322] ? __pfx_netlink_unicast+0x10/0x10 [ 85.163257][ T5322] ? __alloc_skb+0x193/0x390 [ 85.165221][ T5322] ? netlink_sendmsg+0x650/0xb40 [ 85.167362][ T5322] ? skb_put+0x11b/0x210 [ 85.169322][ T5322] netlink_sendmsg+0x813/0xb40 [ 85.171504][ T5322] ? __pfx_netlink_sendmsg+0x10/0x10 [ 85.173931][ T5322] ? aa_sock_msg_perm+0xf1/0x1b0 [ 85.176164][ T5322] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 85.178476][ T5322] ? __pfx_netlink_sendmsg+0x10/0x10 [ 85.180802][ T5322] ____sys_sendmsg+0xa68/0xad0 [ 85.182885][ T5322] ? __might_fault+0xaf/0x130 [ 85.184926][ T5322] ? __pfx_____sys_sendmsg+0x10/0x10 [ 85.187167][ T5322] ? import_iovec+0x73/0xa0 [ 85.189205][ T5322] ___sys_sendmsg+0x2a5/0x360 [ 85.191298][ T5322] ? __lock_acquire+0x6b5/0x2cf0 [ 85.193397][ T5322] ? __pfx____sys_sendmsg+0x10/0x10 [ 85.195796][ T5322] ? futex_wait+0x29a/0x380 [ 85.197628][ T5322] ? __fget_files+0x2a/0x420 [ 85.199763][ T5322] ? __fget_files+0x3a0/0x420 [ 85.202042][ T5322] __x64_sys_sendmsg+0x1bd/0x2a0 [ 85.204267][ T5322] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 85.206901][ T5322] ? rcu_is_watching+0x15/0xb0 [ 85.210383][ T5322] do_syscall_64+0xe2/0xf80 [ 85.212401][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.214994][ T5322] ? trace_irq_disable+0x37/0x100 [ 85.217202][ T5322] ? clear_bhb_loop+0x60/0xb0 [ 85.219444][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.221976][ T5322] RIP: 0033:0x7f978cd9aeb9 [ 85.223979][ T5322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 85.232169][ T5322] RSP: 002b:00007f978dc11028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 85.235915][ T5322] RAX: ffffffffffffffda RBX: 00007f978d015fa0 RCX: 00007f978cd9aeb9 [ 85.239450][ T5322] RDX: 0000000000000000 RSI: 0000200000001080 RDI: 0000000000000008 [ 85.242761][ T5322] RBP: 00007f978ce08c1f R08: 0000000000000000 R09: 0000000000000000 [ 85.246107][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 85.249355][ T5322] R13: 00007f978d016038 R14: 00007f978d015fa0 R15: 00007ffe81b87e88 [ 85.252755][ T5322] [ 85.254429][ T5322] Kernel Offset: disabled [ 85.256300][ T5322] Rebooting in 86400 seconds..