program: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r4, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000040)={0x3c, r5, 0xb97534d5fe9704cf, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x580}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6}]}, 0x3c}, 0x1, 0x0, 0x0, 0xc0}, 0x0) [ 73.901438][ T4661] Bluetooth: hci0: command tx timeout [ 73.996562][ T5330] ------------[ cut here ]------------ [ 73.999249][ T5330] !chanctx_conf [ 73.999261][ T5330] WARNING: net/mac80211/rate.c:53 at rate_control_rate_init+0x64a/0x6e0, CPU#0: syz.0.0/5330 [ 74.005479][ T5330] Modules linked in: [ 74.007544][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 74.011818][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 74.016079][ T5330] RIP: 0010:rate_control_rate_init+0x64a/0x6e0 [ 74.018864][ T5330] Code: 82 01 00 00 20 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 e2 96 a9 f6 90 0f 0b 90 eb e1 e8 d7 96 a9 f6 90 <0f> 0b 90 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 90 00 00 00 [ 74.027238][ T5330] RSP: 0018:ffffc9000d1c6fd8 EFLAGS: 00010287 [ 74.029994][ T5330] RAX: ffffffff8b1c3039 RBX: ffff88801fa28000 RCX: 0000000000100000 [ 74.033519][ T5330] RDX: ffffc9000f142000 RSI: 000000000000039e RDI: 000000000000039f [ 74.036487][ T5330] RBP: 0000000000000000 R08: ffffffff8b1c2b53 R09: ffffffff8e95cd20 [ 74.039782][ T5330] R10: dffffc0000000000 R11: ffffed1003f45031 R12: 1ffff11003f4500a [ 74.042867][ T5330] R13: ffff888041fb0f20 R14: 0000000000000001 R15: ffffffff8b1c2b53 [ 74.046094][ T5330] FS: 00007fdfb71de6c0(0000) GS:ffff88808c894000(0000) knlGS:0000000000000000 [ 74.049594][ T5330] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 74.052007][ T5330] CR2: 0000200000001080 CR3: 0000000012766000 CR4: 0000000000352ef0 [ 74.055352][ T5330] Call Trace: [ 74.056859][ T5330] [ 74.058204][ T5330] rate_control_rate_init_all_links+0x109/0x1a0 [ 74.060967][ T5330] sta_apply_auth_flags+0x1c2/0x400 [ 74.063294][ T5330] sta_apply_parameters+0x10ac/0x18b0 [ 74.065757][ T5330] ieee80211_add_station+0x3e6/0x710 [ 74.068055][ T5330] rdev_add_station+0xfc/0x290 [ 74.070260][ T5330] nl80211_new_station+0x1cab/0x2130 [ 74.072648][ T5330] ? __pfx_nl80211_new_station+0x10/0x10 [ 74.075172][ T5330] ? __rtnl_unlock+0xc8/0xf0 [ 74.077233][ T5330] genl_family_rcv_msg_doit+0x22a/0x330 [ 74.079751][ T5330] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 74.082306][ T5330] ? bpf_lsm_capable+0x9/0x20 [ 74.084372][ T5330] ? security_capable+0x7e/0x2c0 [ 74.086480][ T5330] genl_rcv_msg+0x61c/0x7a0 [ 74.088369][ T5330] ? __pfx_genl_rcv_msg+0x10/0x10 [ 74.090610][ T5330] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 74.092776][ T5330] ? __pfx_nl80211_new_station+0x10/0x10 [ 74.095075][ T5330] ? __pfx_nl80211_post_doit+0x10/0x10 [ 74.097464][ T5330] ? __pfx_ref_tracker_free+0x10/0x10 [ 74.099906][ T5330] ? __asan_memcpy+0x40/0x70 [ 74.101900][ T5330] ? __skb_clone+0x63/0x7a0 [ 74.103824][ T5330] netlink_rcv_skb+0x232/0x4b0 [ 74.105610][ T5330] ? __pfx_genl_rcv_msg+0x10/0x10 [ 74.107496][ T5330] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 74.110067][ T5330] ? down_read+0x270/0x2e0 [ 74.112070][ T5330] ? genl_rcv+0xd/0x40 [ 74.113766][ T5330] genl_rcv+0x28/0x40 [ 74.115333][ T5330] netlink_unicast+0x75c/0x8e0 [ 74.117353][ T5330] netlink_sendmsg+0x813/0xb40 [ 74.119474][ T5330] ? __pfx_netlink_sendmsg+0x10/0x10 [ 74.121757][ T5330] ? aa_sock_msg_perm+0xf1/0x1b0 [ 74.123887][ T5330] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 74.126243][ T5330] ____sys_sendmsg+0x972/0x9f0 [ 74.128257][ T5330] ? __might_fault+0xaf/0x130 [ 74.130466][ T5330] ? __pfx_____sys_sendmsg+0x10/0x10 [ 74.132737][ T5330] ? import_iovec+0x73/0xa0 [ 74.134834][ T5330] ___sys_sendmsg+0x2a5/0x360 [ 74.136856][ T5330] ? __lock_acquire+0x6b5/0x2cf0 [ 74.139014][ T5330] ? __pfx____sys_sendmsg+0x10/0x10 [ 74.141299][ T5330] ? futex_wait+0x2a2/0x390 [ 74.143236][ T5330] ? __fget_files+0x2a/0x420 [ 74.145168][ T5330] ? __fget_files+0x3a0/0x420 [ 74.147146][ T5330] __x64_sys_sendmsg+0x1bd/0x2a0 [ 74.149228][ T5330] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 74.151685][ T5330] ? rcu_is_watching+0x15/0xb0 [ 74.153715][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.156209][ T5330] do_syscall_64+0x174/0x580 [ 74.158181][ T5330] ? trace_irq_disable+0x3b/0x140 [ 74.160479][ T5330] ? clear_bhb_loop+0x40/0x90 [ 74.162464][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.164905][ T5330] RIP: 0033:0x7fdfb639ce59 [ 74.166649][ T5330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 74.175089][ T5330] RSP: 002b:00007fdfb71ddfe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 74.178649][ T5330] RAX: ffffffffffffffda RBX: 00007fdfb6615fa0 RCX: 00007fdfb639ce59 [ 74.182209][ T5330] RDX: 0000000000000000 RSI: 0000200000001080 RDI: 0000000000000006 [ 74.185569][ T5330] RBP: 00007fdfb6432d6f R08: 0000000000000000 R09: 0000000000000000 [ 74.188923][ T5330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 74.192463][ T5330] R13: 00007fdfb6616038 R14: 00007fdfb6615fa0 R15: 00007fffc2046ce8 [ 74.195729][ T5330] [ 74.197084][ T5330] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 74.200131][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 74.203789][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 74.208067][ T5330] Call Trace: [ 74.209514][ T5330] [ 74.210769][ T5330] vpanic+0x56c/0xa60 [ 74.212400][ T5330] ? __pfx__printk+0x10/0x10 [ 74.214279][ T5330] ? __pfx_vpanic+0x10/0x10 [ 74.216252][ T5330] ? is_bpf_text_address+0x292/0x2b0 [ 74.218540][ T5330] ? is_bpf_text_address+0x26/0x2b0 [ 74.220820][ T5330] panic+0xc5/0xd0 [ 74.222469][ T5330] ? __pfx_panic+0x10/0x10 [ 74.224363][ T5330] __warn+0x315/0x4c0 [ 74.226094][ T5330] ? rate_control_rate_init+0x64a/0x6e0 [ 74.228497][ T5330] ? rate_control_rate_init+0x64a/0x6e0 [ 74.230911][ T5330] __report_bug+0x29a/0x540 [ 74.232860][ T5330] ? rate_control_rate_init+0x64a/0x6e0 [ 74.235155][ T5330] ? __pfx___report_bug+0x10/0x10 [ 74.237101][ T5330] ? __lock_acquire+0x6b5/0x2cf0 [ 74.239075][ T5330] ? __lock_acquire+0x6b5/0x2cf0 [ 74.241149][ T5330] ? rate_control_rate_init+0x64a/0x6e0 [ 74.243543][ T5330] report_bug+0x16a/0x220 [ 74.245476][ T5330] ? rate_control_rate_init+0x64a/0x6e0 [ 74.247762][ T5330] ? rate_control_rate_init+0x64c/0x6e0 [ 74.250047][ T5330] handle_bug+0x9c/0x200 [ 74.251642][ T5330] exc_invalid_op+0x1a/0x50 [ 74.253461][ T5330] asm_exc_invalid_op+0x1a/0x20 [ 74.255428][ T5330] RIP: 0010:rate_control_rate_init+0x64a/0x6e0 [ 74.257964][ T5330] Code: 82 01 00 00 20 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 e2 96 a9 f6 90 0f 0b 90 eb e1 e8 d7 96 a9 f6 90 <0f> 0b 90 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d e9 90 00 00 00 [ 74.265472][ T5330] RSP: 0018:ffffc9000d1c6fd8 EFLAGS: 00010287 [ 74.267828][ T5330] RAX: ffffffff8b1c3039 RBX: ffff88801fa28000 RCX: 0000000000100000 [ 74.270909][ T5330] RDX: ffffc9000f142000 RSI: 000000000000039e RDI: 000000000000039f [ 74.273933][ T5330] RBP: 0000000000000000 R08: ffffffff8b1c2b53 R09: ffffffff8e95cd20 [ 74.277101][ T5330] R10: dffffc0000000000 R11: ffffed1003f45031 R12: 1ffff11003f4500a [ 74.280314][ T5330] R13: ffff888041fb0f20 R14: 0000000000000001 R15: ffffffff8b1c2b53 [ 74.283694][ T5330] ? rate_control_rate_init+0x163/0x6e0 [ 74.285904][ T5330] ? rate_control_rate_init+0x163/0x6e0 [ 74.288296][ T5330] ? rate_control_rate_init+0x649/0x6e0 [ 74.290650][ T5330] ? rate_control_rate_init+0x649/0x6e0 [ 74.292854][ T5330] rate_control_rate_init_all_links+0x109/0x1a0 [ 74.295393][ T5330] sta_apply_auth_flags+0x1c2/0x400 [ 74.297454][ T5330] sta_apply_parameters+0x10ac/0x18b0 [ 74.299620][ T5330] ieee80211_add_station+0x3e6/0x710 [ 74.301774][ T5330] rdev_add_station+0xfc/0x290 [ 74.303703][ T5330] nl80211_new_station+0x1cab/0x2130 [ 74.305845][ T5330] ? __pfx_nl80211_new_station+0x10/0x10 [ 74.308104][ T5330] ? __rtnl_unlock+0xc8/0xf0 [ 74.310012][ T5330] genl_family_rcv_msg_doit+0x22a/0x330 [ 74.312284][ T5330] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 74.314789][ T5330] ? bpf_lsm_capable+0x9/0x20 [ 74.316841][ T5330] ? security_capable+0x7e/0x2c0 [ 74.318946][ T5330] genl_rcv_msg+0x61c/0x7a0 [ 74.320915][ T5330] ? __pfx_genl_rcv_msg+0x10/0x10 [ 74.322992][ T5330] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 74.325386][ T5330] ? __pfx_nl80211_new_station+0x10/0x10 [ 74.327756][ T5330] ? __pfx_nl80211_post_doit+0x10/0x10 [ 74.329980][ T5330] ? __pfx_ref_tracker_free+0x10/0x10 [ 74.332315][ T5330] ? __asan_memcpy+0x40/0x70 [ 74.334463][ T5330] ? __skb_clone+0x63/0x7a0 [ 74.336467][ T5330] netlink_rcv_skb+0x232/0x4b0 [ 74.338523][ T5330] ? __pfx_genl_rcv_msg+0x10/0x10 [ 74.340456][ T5330] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 74.342839][ T5330] ? down_read+0x270/0x2e0 [ 74.344761][ T5330] ? genl_rcv+0xd/0x40 [ 74.346432][ T5330] genl_rcv+0x28/0x40 [ 74.348116][ T5330] netlink_unicast+0x75c/0x8e0 [ 74.350158][ T5330] netlink_sendmsg+0x813/0xb40 [ 74.352141][ T5330] ? __pfx_netlink_sendmsg+0x10/0x10 [ 74.354422][ T5330] ? aa_sock_msg_perm+0xf1/0x1b0 [ 74.356603][ T5330] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 74.358812][ T5330] ____sys_sendmsg+0x972/0x9f0 [ 74.360807][ T5330] ? __might_fault+0xaf/0x130 [ 74.362673][ T5330] ? __pfx_____sys_sendmsg+0x10/0x10 [ 74.364820][ T5330] ? import_iovec+0x73/0xa0 [ 74.366765][ T5330] ___sys_sendmsg+0x2a5/0x360 [ 74.368733][ T5330] ? __lock_acquire+0x6b5/0x2cf0 [ 74.370894][ T5330] ? __pfx____sys_sendmsg+0x10/0x10 [ 74.373179][ T5330] ? futex_wait+0x2a2/0x390 [ 74.375189][ T5330] ? __fget_files+0x2a/0x420 [ 74.377171][ T5330] ? __fget_files+0x3a0/0x420 [ 74.379140][ T5330] __x64_sys_sendmsg+0x1bd/0x2a0 [ 74.381261][ T5330] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 74.383591][ T5330] ? rcu_is_watching+0x15/0xb0 [ 74.385584][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.388220][ T5330] do_syscall_64+0x174/0x580 [ 74.390206][ T5330] ? trace_irq_disable+0x3b/0x140 [ 74.392337][ T5330] ? clear_bhb_loop+0x40/0x90 [ 74.394388][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 74.397008][ T5330] RIP: 0033:0x7fdfb639ce59 [ 74.398917][ T5330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 74.407787][ T5330] RSP: 002b:00007fdfb71ddfe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 74.411348][ T5330] RAX: ffffffffffffffda RBX: 00007fdfb6615fa0 RCX: 00007fdfb639ce59 [ 74.414786][ T5330] RDX: 0000000000000000 RSI: 0000200000001080 RDI: 0000000000000006 [ 74.418183][ T5330] RBP: 00007fdfb6432d6f R08: 0000000000000000 R09: 0000000000000000 [ 74.421850][ T5330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 74.425590][ T5330] R13: 00007fdfb6616038 R14: 00007fdfb6615fa0 R15: 00007fffc2046ce8 [ 74.428908][ T5330] [ 74.430432][ T5330] Kernel Offset: disabled [ 74.432124][ T5330] Rebooting in 86400 seconds..