Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.38' (ECDSA) to the list of known hosts. syzkaller login: [ 63.987357][ T6870] IPVS: ftp: loaded support on port[0] = 21 [ 64.078557][ T21] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.086524][ T21] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 executing program [ 64.123585][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 64.144511][ T21] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.153500][ T21] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.163947][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 64.186070][ T6870] ================================================================================ [ 64.197997][ T6870] UBSAN: array-index-out-of-bounds in net/mac80211/cfg.c:520:10 [ 64.205652][ T6870] index 255 is out of range for type 'ieee80211_key *[4]' [ 64.213394][ T6870] CPU: 1 PID: 6870 Comm: syz-executor660 Not tainted 5.9.0-rc6-syzkaller #0 [ 64.222076][ T6870] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.232256][ T6870] Call Trace: [ 64.235556][ T6870] dump_stack+0x198/0x1fd [ 64.239885][ T6870] ubsan_epilogue+0xb/0x5a [ 64.244283][ T6870] __ubsan_handle_out_of_bounds.cold+0x62/0x6c [ 64.250416][ T6870] ? lock_is_held_type+0xbb/0xf0 [ 64.255335][ T6870] ieee80211_del_key+0x3f6/0x440 [ 64.260261][ T6870] nl80211_del_key+0x493/0x980 [ 64.265007][ T6870] ? cfg80211_tdls_oper_request+0x7f0/0x7f0 [ 64.270886][ T6870] ? nl80211_pre_doit+0xa2/0x630 [ 64.275802][ T6870] genl_family_rcv_msg_doit+0x228/0x320 [ 64.281328][ T6870] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x280/0x280 [ 64.288737][ T6870] ? ns_capable+0xde/0x100 [ 64.293133][ T6870] genl_rcv_msg+0x328/0x580 [ 64.297620][ T6870] ? genl_get_cmd+0x480/0x480 [ 64.302293][ T6870] ? lock_acquire+0x1f3/0xaf0 [ 64.306951][ T6870] ? cfg80211_tdls_oper_request+0x7f0/0x7f0 [ 64.312827][ T6870] ? lock_release+0x8f0/0x8f0 [ 64.317488][ T6870] netlink_rcv_skb+0x15a/0x430 [ 64.322229][ T6870] ? genl_get_cmd+0x480/0x480 [ 64.326886][ T6870] ? netlink_ack+0xa10/0xa10 [ 64.331459][ T6870] ? __kmalloc_node_track_caller+0x38/0x60 [ 64.337263][ T6870] genl_rcv+0x24/0x40 [ 64.341224][ T6870] netlink_unicast+0x533/0x7d0 [ 64.345968][ T6870] ? netlink_attachskb+0x810/0x810 [ 64.351059][ T6870] ? __phys_addr_symbol+0x2c/0x70 [ 64.356061][ T6870] ? __check_object_size+0x171/0x3e4 [ 64.361328][ T6870] netlink_sendmsg+0x856/0xd90 [ 64.366088][ T6870] ? netlink_unicast+0x7d0/0x7d0 [ 64.371024][ T6870] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 64.376290][ T6870] ? netlink_unicast+0x7d0/0x7d0 [ 64.381214][ T6870] sock_sendmsg+0xcf/0x120 [ 64.385616][ T6870] ____sys_sendmsg+0x6e8/0x810 [ 64.390390][ T6870] ? kernel_sendmsg+0x50/0x50 [ 64.395060][ T6870] ? do_recvmmsg+0x6d0/0x6d0 [ 64.399632][ T6870] ? lock_is_held_type+0xbb/0xf0 [ 64.404559][ T6870] ? find_held_lock+0x2d/0x110 [ 64.409304][ T6870] ? __might_fault+0x11f/0x1d0 [ 64.414062][ T6870] ___sys_sendmsg+0xf3/0x170 [ 64.418631][ T6870] ? sendmsg_copy_msghdr+0x160/0x160 [ 64.423901][ T6870] ? __might_fault+0x190/0x1d0 [ 64.428644][ T6870] ? _copy_to_user+0x126/0x160 [ 64.433386][ T6870] ? sock_do_ioctl+0x168/0x2d0 [ 64.438127][ T6870] ? compat_ifr_data_ioctl+0x150/0x150 [ 64.443572][ T6870] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 64.449455][ T6870] ? __fget_light+0x215/0x280 [ 64.454123][ T6870] __sys_sendmsg+0xe5/0x1b0 [ 64.458611][ T6870] ? __sys_sendmsg_sock+0xb0/0xb0 [ 64.463627][ T6870] ? lock_is_held_type+0xbb/0xf0 [ 64.468550][ T6870] ? check_preemption_disabled+0x50/0x130 [ 64.474244][ T6870] ? syscall_enter_from_user_mode+0x1d/0x60 [ 64.480122][ T6870] do_syscall_64+0x2d/0x70 [ 64.484523][ T6870] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 64.490396][ T6870] RIP: 0033:0x4418f9 [ 64.494274][ T6870] Code: e8 3c 0b 03 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 1b 0d fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 64.513865][ T6870] RSP: 002b:00007fff92ba3648 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 64.522258][ T6870] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004418f9 [ 64.530214][ T6870] RDX: 0000000000000000 RSI: 0000000020001100 RDI: 0000000000000004 [ 64.538169][ T6870] RBP: 0000000000000003 R08: 000000200169a668 R09: 000000200169a668 [ 64.546125][ T6870] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000032 [ 64.554094][ T6870] R13: 0000000000000000 R14: 000000000000000c R15: 0000000000000004 [ 64.565075][ T6870] ================================================================================ [ 64.574427][ T6870] Kernel panic - not syncing: panic_on_warn set ... [ 64.581029][ T6870] CPU: 1 PID: 6870 Comm: syz-executor660 Not tainted 5.9.0-rc6-syzkaller #0 [ 64.589694][ T6870] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.599750][ T6870] Call Trace: [ 64.603021][ T6870] dump_stack+0x198/0x1fd [ 64.607332][ T6870] panic+0x382/0x7fb [ 64.611206][ T6870] ? __warn_printk+0xf3/0xf3 [ 64.615777][ T6870] ? mark_lock+0x82/0x1660 [ 64.620190][ T6870] ? ubsan_epilogue+0x3e/0x5a [ 64.624845][ T6870] ? ubsan_epilogue+0x35/0x5a [ 64.629502][ T6870] ubsan_epilogue+0x54/0x5a [ 64.633998][ T6870] __ubsan_handle_out_of_bounds.cold+0x62/0x6c [ 64.640135][ T6870] ? lock_is_held_type+0xbb/0xf0 [ 64.645060][ T6870] ieee80211_del_key+0x3f6/0x440 [ 64.649982][ T6870] nl80211_del_key+0x493/0x980 [ 64.654743][ T6870] ? cfg80211_tdls_oper_request+0x7f0/0x7f0 [ 64.660623][ T6870] ? nl80211_pre_doit+0xa2/0x630 [ 64.665606][ T6870] genl_family_rcv_msg_doit+0x228/0x320 [ 64.671149][ T6870] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x280/0x280 [ 64.678524][ T6870] ? ns_capable+0xde/0x100 [ 64.682927][ T6870] genl_rcv_msg+0x328/0x580 [ 64.687442][ T6870] ? genl_get_cmd+0x480/0x480 [ 64.692123][ T6870] ? lock_acquire+0x1f3/0xaf0 [ 64.696797][ T6870] ? cfg80211_tdls_oper_request+0x7f0/0x7f0 [ 64.702669][ T6870] ? lock_release+0x8f0/0x8f0 [ 64.707332][ T6870] netlink_rcv_skb+0x15a/0x430 [ 64.712077][ T6870] ? genl_get_cmd+0x480/0x480 [ 64.716733][ T6870] ? netlink_ack+0xa10/0xa10 [ 64.721310][ T6870] ? __kmalloc_node_track_caller+0x38/0x60 [ 64.727119][ T6870] genl_rcv+0x24/0x40 [ 64.731081][ T6870] netlink_unicast+0x533/0x7d0 [ 64.735826][ T6870] ? netlink_attachskb+0x810/0x810 [ 64.740925][ T6870] ? __phys_addr_symbol+0x2c/0x70 [ 64.745929][ T6870] ? __check_object_size+0x171/0x3e4 [ 64.751202][ T6870] netlink_sendmsg+0x856/0xd90 [ 64.755952][ T6870] ? netlink_unicast+0x7d0/0x7d0 [ 64.760876][ T6870] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 64.766164][ T6870] ? netlink_unicast+0x7d0/0x7d0 [ 64.771084][ T6870] sock_sendmsg+0xcf/0x120 [ 64.775481][ T6870] ____sys_sendmsg+0x6e8/0x810 [ 64.780227][ T6870] ? kernel_sendmsg+0x50/0x50 [ 64.784880][ T6870] ? do_recvmmsg+0x6d0/0x6d0 [ 64.789453][ T6870] ? lock_is_held_type+0xbb/0xf0 [ 64.794391][ T6870] ? find_held_lock+0x2d/0x110 [ 64.799137][ T6870] ? __might_fault+0x11f/0x1d0 [ 64.803883][ T6870] ___sys_sendmsg+0xf3/0x170 [ 64.808459][ T6870] ? sendmsg_copy_msghdr+0x160/0x160 [ 64.813756][ T6870] ? __might_fault+0x190/0x1d0 [ 64.818503][ T6870] ? _copy_to_user+0x126/0x160 [ 64.823247][ T6870] ? sock_do_ioctl+0x168/0x2d0 [ 64.827996][ T6870] ? compat_ifr_data_ioctl+0x150/0x150 [ 64.833489][ T6870] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 64.839369][ T6870] ? __fget_light+0x215/0x280 [ 64.844028][ T6870] __sys_sendmsg+0xe5/0x1b0 [ 64.848517][ T6870] ? __sys_sendmsg_sock+0xb0/0xb0 [ 64.853519][ T6870] ? lock_is_held_type+0xbb/0xf0 [ 64.858444][ T6870] ? check_preemption_disabled+0x50/0x130 [ 64.864144][ T6870] ? syscall_enter_from_user_mode+0x1d/0x60 [ 64.870042][ T6870] do_syscall_64+0x2d/0x70 [ 64.874448][ T6870] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 64.880331][ T6870] RIP: 0033:0x4418f9 [ 64.884213][ T6870] Code: e8 3c 0b 03 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 1b 0d fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 64.903803][ T6870] RSP: 002b:00007fff92ba3648 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 64.912196][ T6870] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004418f9 [ 64.920149][ T6870] RDX: 0000000000000000 RSI: 0000000020001100 RDI: 0000000000000004 [ 64.928139][ T6870] RBP: 0000000000000003 R08: 000000200169a668 R09: 000000200169a668 [ 64.936091][ T6870] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000032 [ 64.944052][ T6870] R13: 0000000000000000 R14: 000000000000000c R15: 0000000000000004 [ 64.953189][ T6870] Kernel Offset: disabled [ 64.957777][ T6870] Rebooting in 86400 seconds..