[ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.1.58' (ECDSA) to the list of known hosts. syzkaller login: [ 57.387882][ T6853] IPVS: ftp: loaded support on port[0] = 21 [ 57.475621][ T26] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 57.483600][ T26] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 57.507673][ T3112] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready executing program [ 57.525339][ T7] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 57.533247][ T7] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 57.542189][ T3112] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 57.558803][ T6853] netlink: 8 bytes leftover after parsing attributes in process `syz-executor227'. [ 57.569313][ T6853] ================================================================================ [ 57.582457][ T6853] UBSAN: array-index-out-of-bounds in net/mac80211/cfg.c:524:9 [ 57.590768][ T6853] index 255 is out of range for type 'ieee80211_key *[8]' [ 57.598731][ T6853] CPU: 1 PID: 6853 Comm: syz-executor227 Not tainted 5.9.0-rc6-syzkaller #0 [ 57.607404][ T6853] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 57.617642][ T6853] Call Trace: [ 57.621048][ T6853] dump_stack+0x198/0x1fd [ 57.625490][ T6853] ubsan_epilogue+0xb/0x5a [ 57.629891][ T6853] __ubsan_handle_out_of_bounds.cold+0x62/0x6c [ 57.636021][ T6853] ? lock_is_held_type+0xbb/0xf0 [ 57.640939][ T6853] ieee80211_del_key+0x428/0x440 [ 57.645856][ T6853] nl80211_del_key+0x493/0x980 [ 57.650600][ T6853] ? cfg80211_tdls_oper_request+0x7f0/0x7f0 [ 57.656477][ T6853] ? nl80211_pre_doit+0xa2/0x630 [ 57.661390][ T6853] ? nl80211_dump_wiphy_parse.constprop.0+0x580/0x580 [ 57.668128][ T6853] genl_rcv_msg+0x61d/0x980 [ 57.672621][ T6853] ? genl_family_rcv_msg_attrs_parse.isra.0+0x250/0x250 [ 57.679665][ T6853] ? lock_release+0x8f0/0x8f0 [ 57.684324][ T6853] netlink_rcv_skb+0x15a/0x430 [ 57.689134][ T6853] ? genl_family_rcv_msg_attrs_parse.isra.0+0x250/0x250 [ 57.696047][ T6853] ? netlink_ack+0xa10/0xa10 [ 57.700657][ T6853] ? __kmalloc_node_track_caller+0x38/0x60 [ 57.706440][ T6853] genl_rcv+0x24/0x40 [ 57.710399][ T6853] netlink_unicast+0x533/0x7d0 [ 57.715143][ T6853] ? netlink_attachskb+0x810/0x810 [ 57.720322][ T6853] ? __phys_addr_symbol+0x2c/0x70 [ 57.725329][ T6853] ? __check_object_size+0x171/0x3e4 [ 57.730603][ T6853] netlink_sendmsg+0x856/0xd90 [ 57.735358][ T6853] ? netlink_unicast+0x7d0/0x7d0 [ 57.740278][ T6853] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 57.745557][ T6853] ? netlink_unicast+0x7d0/0x7d0 [ 57.750469][ T6853] sock_sendmsg+0xcf/0x120 [ 57.754949][ T6853] ____sys_sendmsg+0x6e8/0x810 [ 57.759865][ T6853] ? kernel_sendmsg+0x50/0x50 [ 57.764526][ T6853] ? do_recvmmsg+0x6d0/0x6d0 [ 57.769093][ T6853] ? get_max_files+0x10/0x10 [ 57.773660][ T6853] ? stack_trace_save+0x8c/0xc0 [ 57.778489][ T6853] ? stack_trace_consume_entry+0x160/0x160 [ 57.784301][ T6853] ___sys_sendmsg+0xf3/0x170 [ 57.788880][ T6853] ? sendmsg_copy_msghdr+0x160/0x160 [ 57.794141][ T6853] ? do_fast_syscall_32+0x2f/0x70 [ 57.799147][ T6853] ? check_preemption_disabled+0x50/0x130 [ 57.804845][ T6853] ? _raw_spin_unlock_irqrestore+0x6f/0x90 [ 57.810631][ T6853] ? lockdep_hardirqs_on_prepare+0x354/0x530 [ 57.816589][ T6853] ? _raw_spin_unlock_irqrestore+0x6f/0x90 [ 57.822504][ T6853] ? lockdep_hardirqs_on+0x53/0x100 [ 57.827680][ T6853] ? _raw_spin_unlock_irqrestore+0x5c/0x90 [ 57.833463][ T6853] ? debug_object_active_state+0x260/0x350 [ 57.839364][ T6853] ? debug_object_init_on_stack+0x20/0x20 [ 57.845064][ T6853] ? lock_is_held_type+0xbb/0xf0 [ 57.849989][ T6853] ? __fget_light+0x215/0x280 [ 57.854652][ T6853] __sys_sendmsg+0xe5/0x1b0 [ 57.859132][ T6853] ? __sys_sendmsg_sock+0xb0/0xb0 [ 57.864148][ T6853] ? syscall_enter_from_user_mode_prepare+0x13/0x30 [ 57.870711][ T6853] ? check_preemption_disabled+0x50/0x130 [ 57.876407][ T6853] ? syscall_enter_from_user_mode_prepare+0x13/0x30 [ 57.882988][ T6853] __do_fast_syscall_32+0x60/0x90 [ 57.887989][ T6853] do_fast_syscall_32+0x2f/0x70 [ 57.892817][ T6853] entry_SYSENTER_compat_after_hwframe+0x4d/0x5c [ 57.899131][ T6853] RIP: 0023:0xf7fa3549 [ 57.903191][ T6853] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 57.922768][ T6853] RSP: 002b:00000000ff8fce1c EFLAGS: 00000246 ORIG_RAX: 0000000000000172 [ 57.931164][ T6853] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000020000380 [ 57.939124][ T6853] RDX: 0000000000000000 RSI: 00000000f7fa328c RDI: 0000000000000004 [ 57.947085][ T6853] RBP: 00000000097e4018 R08: 0000000000000000 R09: 0000000000000000 [ 57.955032][ T6853] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 57.962980][ T6853] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 57.972767][ T6853] ================================================================================ [ 57.982823][ T6853] Kernel panic - not syncing: panic_on_warn set ... [ 57.989427][ T6853] CPU: 1 PID: 6853 Comm: syz-executor227 Not tainted 5.9.0-rc6-syzkaller #0 [ 57.998085][ T6853] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 58.008116][ T6853] Call Trace: [ 58.011388][ T6853] dump_stack+0x198/0x1fd [ 58.015700][ T6853] panic+0x382/0x7fb [ 58.019659][ T6853] ? __warn_printk+0xf3/0xf3 [ 58.024232][ T6853] ? ubsan_epilogue+0x3e/0x5a [ 58.028902][ T6853] ? ubsan_epilogue+0x35/0x5a [ 58.033561][ T6853] ubsan_epilogue+0x54/0x5a [ 58.038045][ T6853] __ubsan_handle_out_of_bounds.cold+0x62/0x6c [ 58.044171][ T6853] ? lock_is_held_type+0xbb/0xf0 [ 58.049087][ T6853] ieee80211_del_key+0x428/0x440 [ 58.054004][ T6853] nl80211_del_key+0x493/0x980 [ 58.058761][ T6853] ? cfg80211_tdls_oper_request+0x7f0/0x7f0 [ 58.064638][ T6853] ? nl80211_pre_doit+0xa2/0x630 [ 58.069550][ T6853] ? nl80211_dump_wiphy_parse.constprop.0+0x580/0x580 [ 58.076286][ T6853] genl_rcv_msg+0x61d/0x980 [ 58.080769][ T6853] ? genl_family_rcv_msg_attrs_parse.isra.0+0x250/0x250 [ 58.087687][ T6853] ? lock_release+0x8f0/0x8f0 [ 58.092344][ T6853] netlink_rcv_skb+0x15a/0x430 [ 58.097095][ T6853] ? genl_family_rcv_msg_attrs_parse.isra.0+0x250/0x250 [ 58.104009][ T6853] ? netlink_ack+0xa10/0xa10 [ 58.108582][ T6853] ? __kmalloc_node_track_caller+0x38/0x60 [ 58.114370][ T6853] genl_rcv+0x24/0x40 [ 58.118329][ T6853] netlink_unicast+0x533/0x7d0 [ 58.123087][ T6853] ? netlink_attachskb+0x810/0x810 [ 58.128177][ T6853] ? __phys_addr_symbol+0x2c/0x70 [ 58.133187][ T6853] ? __check_object_size+0x171/0x3e4 [ 58.138454][ T6853] netlink_sendmsg+0x856/0xd90 [ 58.143207][ T6853] ? netlink_unicast+0x7d0/0x7d0 [ 58.148127][ T6853] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 58.153388][ T6853] ? netlink_unicast+0x7d0/0x7d0 [ 58.158301][ T6853] sock_sendmsg+0xcf/0x120 [ 58.162692][ T6853] ____sys_sendmsg+0x6e8/0x810 [ 58.167446][ T6853] ? kernel_sendmsg+0x50/0x50 [ 58.172097][ T6853] ? do_recvmmsg+0x6d0/0x6d0 [ 58.176924][ T6853] ? get_max_files+0x10/0x10 [ 58.181490][ T6853] ? stack_trace_save+0x8c/0xc0 [ 58.186326][ T6853] ? stack_trace_consume_entry+0x160/0x160 [ 58.192127][ T6853] ___sys_sendmsg+0xf3/0x170 [ 58.196696][ T6853] ? sendmsg_copy_msghdr+0x160/0x160 [ 58.201955][ T6853] ? do_fast_syscall_32+0x2f/0x70 [ 58.206962][ T6853] ? check_preemption_disabled+0x50/0x130 [ 58.212660][ T6853] ? _raw_spin_unlock_irqrestore+0x6f/0x90 [ 58.218456][ T6853] ? lockdep_hardirqs_on_prepare+0x354/0x530 [ 58.224410][ T6853] ? _raw_spin_unlock_irqrestore+0x6f/0x90 [ 58.230194][ T6853] ? lockdep_hardirqs_on+0x53/0x100 [ 58.235369][ T6853] ? _raw_spin_unlock_irqrestore+0x5c/0x90 [ 58.241159][ T6853] ? debug_object_active_state+0x260/0x350 [ 58.246953][ T6853] ? debug_object_init_on_stack+0x20/0x20 [ 58.252661][ T6853] ? lock_is_held_type+0xbb/0xf0 [ 58.257575][ T6853] ? __fget_light+0x215/0x280 [ 58.262233][ T6853] __sys_sendmsg+0xe5/0x1b0 [ 58.266712][ T6853] ? __sys_sendmsg_sock+0xb0/0xb0 [ 58.271731][ T6853] ? syscall_enter_from_user_mode_prepare+0x13/0x30 [ 58.278309][ T6853] ? check_preemption_disabled+0x50/0x130 [ 58.284002][ T6853] ? syscall_enter_from_user_mode_prepare+0x13/0x30 [ 58.290574][ T6853] __do_fast_syscall_32+0x60/0x90 [ 58.295603][ T6853] do_fast_syscall_32+0x2f/0x70 [ 58.300430][ T6853] entry_SYSENTER_compat_after_hwframe+0x4d/0x5c [ 58.306730][ T6853] RIP: 0023:0xf7fa3549 [ 58.310776][ T6853] Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 58.330454][ T6853] RSP: 002b:00000000ff8fce1c EFLAGS: 00000246 ORIG_RAX: 0000000000000172 [ 58.338856][ T6853] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000020000380 [ 58.346802][ T6853] RDX: 0000000000000000 RSI: 00000000f7fa328c RDI: 0000000000000004 [ 58.354763][ T6853] RBP: 00000000097e4018 R08: 0000000000000000 R09: 0000000000000000 [ 58.362707][ T6853] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 58.370674][ T6853] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 58.380000][ T6853] Kernel Offset: disabled [ 58.384375][ T6853] Rebooting in 86400 seconds..