[ OK ] Started Getty on tty2. [ OK ] Started Getty on tty1. [ OK ] Started Serial Getty on ttyS0. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.165' (ECDSA) to the list of known hosts. executing program executing program syzkaller login: [ 29.116699] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready [ 29.140192] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 29.173262] kasan: CONFIG_KASAN_INLINE enabled [ 29.184900] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 29.205050] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 29.211291] Modules linked in: [ 29.214479] CPU: 0 PID: 8015 Comm: syz-executor951 Not tainted 4.14.203-syzkaller #0 [ 29.222348] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 29.231781] task: ffff8880b418e180 task.stack: ffff8880aa9c8000 [ 29.237869] RIP: 0010:ieee80211_chanctx_num_assigned+0xa5/0x120 [ 29.243919] RSP: 0018:ffff8880aa9cf4a8 EFLAGS: 00010a02 [ 29.249273] RAX: 1bd5a00000000020 RBX: deacfffffffff920 RCX: 1ffffffff1279f10 [ 29.256538] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: dead000000000100 [ 29.263800] RBP: ffff8880a50bbe20 R08: 0000000000000000 R09: 0000000000040583 [ 29.271086] R10: ffff8880b418ead0 R11: ffff8880b418e180 R12: 0000000000000002 [ 29.278349] R13: dffffc0000000000 R14: ffff8880a50bbe00 R15: 0000000000000000 [ 29.285654] FS: 0000000000897940(0000) GS:ffff8880ba400000(0000) knlGS:0000000000000000 [ 29.293859] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.299731] CR2: 00007f39bb75c000 CR3: 0000000098fb6000 CR4: 00000000001406f0 [ 29.307000] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 29.314256] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 29.321516] Call Trace: [ 29.324096] ieee80211_assign_vif_chanctx+0x65e/0x1370 [ 29.329367] __ieee80211_vif_release_channel+0x1ef/0x3f0 [ 29.334837] ieee80211_vif_release_channel+0xef/0x1f0 [ 29.340010] ieee80211_ibss_disconnect+0x527/0xd40 [ 29.344918] ieee80211_ibss_leave+0x12/0xd8 [ 29.349218] __cfg80211_leave_ibss+0x14c/0x6d0 [ 29.353780] cfg80211_leave_ibss+0x54/0x70 [ 29.358011] cfg80211_change_iface+0x791/0x13d0 [ 29.362699] nl80211_set_interface+0x588/0x760 [ 29.367277] ? nl80211_nan_del_func+0x830/0x830 [ 29.371942] ? nl80211_dump_interface+0x640/0x640 [ 29.376767] ? nl80211_pre_doit+0x79/0x510 [ 29.381017] genl_family_rcv_msg+0x572/0xb20 [ 29.385404] ? genl_rcv+0x40/0x40 [ 29.388836] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 29.394264] ? trace_hardirqs_on+0x10/0x10 [ 29.398476] ? sock_sendmsg+0xb5/0x100 [ 29.402342] genl_rcv_msg+0xaf/0x140 [ 29.406046] netlink_rcv_skb+0x125/0x390 [ 29.410114] ? genl_family_rcv_msg+0xb20/0xb20 [ 29.414678] ? netlink_ack+0x9a0/0x9a0 [ 29.418595] ? lock_acquire+0x170/0x3f0 [ 29.422553] genl_rcv+0x24/0x40 [ 29.425827] netlink_unicast+0x437/0x610 [ 29.429886] ? netlink_sendskb+0xd0/0xd0 [ 29.433929] ? __check_object_size+0x179/0x22c [ 29.438491] netlink_sendmsg+0x62e/0xb80 [ 29.442575] ? nlmsg_notify+0x170/0x170 [ 29.446529] ? kernel_recvmsg+0x210/0x210 [ 29.450656] ? security_socket_sendmsg+0x83/0xb0 [ 29.455397] ? nlmsg_notify+0x170/0x170 [ 29.459366] sock_sendmsg+0xb5/0x100 [ 29.463064] ___sys_sendmsg+0x6c8/0x800 [ 29.467015] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 29.471748] ? dev_ioctl+0xe7/0xbe0 [ 29.475351] ? dev_ifsioc+0x7d0/0x7d0 [ 29.479129] ? __dentry_kill+0x3f7/0x550 [ 29.483167] ? trace_hardirqs_on+0x10/0x10 [ 29.487403] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 29.492403] ? kmem_cache_free+0x23a/0x2b0 [ 29.496620] ? sock_ioctl+0x16c/0x4c0 [ 29.500433] ? sock_release+0x1e0/0x1e0 [ 29.504385] ? __fdget+0x167/0x1f0 [ 29.507939] ? sockfd_lookup_light+0xb2/0x160 [ 29.512429] __sys_sendmsg+0xa3/0x120 [ 29.516212] ? SyS_shutdown+0x160/0x160 [ 29.520172] ? security_file_ioctl+0x83/0xb0 [ 29.524561] SyS_sendmsg+0x27/0x40 [ 29.528080] ? __sys_sendmsg+0x120/0x120 [ 29.532124] do_syscall_64+0x1d5/0x640 [ 29.536017] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 29.541238] RIP: 0033:0x4429b9 [ 29.544463] RSP: 002b:00007ffee01d70e8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 29.552147] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004429b9 [ 29.559435] RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000004 [ 29.566683] RBP: 00000000000071b8 R08: 00000000004035b0 R09: 00000000004035b0 [ 29.573934] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000403520 [ 29.581195] R13: 00000000004035b0 R14: 0000000000000000 R15: 0000000000000000 [ 29.588531] Code: 98 20 f8 ff ff 48 39 c5 74 3b 49 bd 00 00 00 00 00 fc ff df e8 fd dd 7b fa 48 8d bb e0 07 00 00 41 83 c4 01 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 75 5d 48 8b 83 e0 07 00 00 48 8d 98 20 f8 ff ff [ 29.607622] RIP: ieee80211_chanctx_num_assigned+0xa5/0x120 RSP: ffff8880aa9cf4a8 [ 29.615481] ---[ end trace 2ea871d509a6443f ]--- [ 29.620259] Kernel panic - not syncing: Fatal exception [ 29.626095] Kernel Offset: disabled [ 29.629705] Rebooting in 86400 seconds..