[ OK ] Started Getty on tty2. [ OK ] Started Getty on tty1. [ OK ] Started Serial Getty on ttyS0. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.6' (ECDSA) to the list of known hosts. syzkaller login: [ 60.019010][ T6882] IPVS: ftp: loaded support on port[0] = 21 [ 60.105115][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 60.113059][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 60.135928][ T234] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 60.144456][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready executing program [ 60.145503][ T234] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 60.174211][ T12] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 60.193152][ T6882] netlink: 24 bytes leftover after parsing attributes in process `syz-executor700'. [ 60.203017][ T6882] ================================================================================ [ 60.214171][ T6882] UBSAN: array-index-out-of-bounds in net/mac80211/cfg.c:524:9 [ 60.221964][ T6882] index 255 is out of range for type 'ieee80211_key *[8]' [ 60.230519][ T6882] CPU: 1 PID: 6882 Comm: syz-executor700 Not tainted 5.9.0-rc6-syzkaller #0 [ 60.239207][ T6882] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 60.249266][ T6882] Call Trace: [ 60.252632][ T6882] dump_stack+0x198/0x1fd [ 60.256952][ T6882] ubsan_epilogue+0xb/0x5a [ 60.261342][ T6882] __ubsan_handle_out_of_bounds.cold+0x62/0x6c [ 60.267471][ T6882] ? lock_is_held_type+0xbb/0xf0 [ 60.272384][ T6882] ieee80211_del_key+0x428/0x440 [ 60.277321][ T6882] nl80211_del_key+0x493/0x980 [ 60.282099][ T6882] ? cfg80211_tdls_oper_request+0x7f0/0x7f0 [ 60.287992][ T6882] ? nl80211_pre_doit+0xa2/0x630 [ 60.292907][ T6882] genl_family_rcv_msg_doit+0x228/0x320 [ 60.298430][ T6882] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x280/0x280 [ 60.305827][ T6882] ? ns_capable+0xde/0x100 [ 60.310219][ T6882] genl_rcv_msg+0x328/0x580 [ 60.314701][ T6882] ? genl_get_cmd+0x480/0x480 [ 60.319388][ T6882] ? lock_acquire+0x1f3/0xaf0 [ 60.324041][ T6882] ? cfg80211_tdls_oper_request+0x7f0/0x7f0 [ 60.329927][ T6882] ? lock_release+0x8f0/0x8f0 [ 60.334585][ T6882] netlink_rcv_skb+0x15a/0x430 [ 60.339323][ T6882] ? genl_get_cmd+0x480/0x480 [ 60.344014][ T6882] ? netlink_ack+0xa10/0xa10 [ 60.348588][ T6882] ? __kmalloc_node_track_caller+0x38/0x60 [ 60.354370][ T6882] genl_rcv+0x24/0x40 [ 60.358327][ T6882] netlink_unicast+0x533/0x7d0 [ 60.363069][ T6882] ? netlink_attachskb+0x810/0x810 [ 60.368158][ T6882] ? __phys_addr_symbol+0x2c/0x70 [ 60.373197][ T6882] ? __check_object_size+0x171/0x3e4 [ 60.378461][ T6882] netlink_sendmsg+0x856/0xd90 [ 60.383206][ T6882] ? netlink_unicast+0x7d0/0x7d0 [ 60.388124][ T6882] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 60.393382][ T6882] ? netlink_unicast+0x7d0/0x7d0 [ 60.398293][ T6882] sock_sendmsg+0xcf/0x120 [ 60.402812][ T6882] ____sys_sendmsg+0x6e8/0x810 [ 60.407553][ T6882] ? kernel_sendmsg+0x50/0x50 [ 60.412206][ T6882] ? do_recvmmsg+0x6d0/0x6d0 [ 60.416823][ T6882] ? stack_trace_consume_entry+0x160/0x160 [ 60.422608][ T6882] ___sys_sendmsg+0xf3/0x170 [ 60.427175][ T6882] ? sendmsg_copy_msghdr+0x160/0x160 [ 60.432433][ T6882] ? syscall_exit_to_user_mode+0x7e/0x2e0 [ 60.438128][ T6882] ? lock_downgrade+0x830/0x830 [ 60.442952][ T6882] ? check_preemption_disabled+0x50/0x130 [ 60.448690][ T6882] ? _raw_spin_unlock_irqrestore+0x6f/0x90 [ 60.454469][ T6882] ? lockdep_hardirqs_on_prepare+0x354/0x530 [ 60.460421][ T6882] ? _raw_spin_unlock_irqrestore+0x6f/0x90 [ 60.466202][ T6882] ? lockdep_hardirqs_on+0x53/0x100 [ 60.471387][ T6882] ? _raw_spin_unlock_irqrestore+0x5c/0x90 [ 60.477170][ T6882] ? debug_object_active_state+0x260/0x350 [ 60.482968][ T6882] ? debug_object_init_on_stack+0x20/0x20 [ 60.488678][ T6882] ? __fget_light+0x215/0x280 [ 60.493332][ T6882] __sys_sendmsg+0xe5/0x1b0 [ 60.497810][ T6882] ? __sys_sendmsg_sock+0xb0/0xb0 [ 60.502808][ T6882] ? lock_is_held_type+0xbb/0xf0 [ 60.507730][ T6882] ? check_preemption_disabled+0x50/0x130 [ 60.513437][ T6882] ? syscall_enter_from_user_mode+0x1d/0x60 [ 60.519310][ T6882] do_syscall_64+0x2d/0x70 [ 60.523704][ T6882] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 60.529571][ T6882] RIP: 0033:0x4416f9 [ 60.533443][ T6882] Code: e8 dc 05 03 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 0d fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 60.553282][ T6882] RSP: 002b:00007ffc1bb97bb8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 60.561668][ T6882] RAX: ffffffffffffffda RBX: 00007ffc1bb97be0 RCX: 00000000004416f9 [ 60.569615][ T6882] RDX: 0000000000000000 RSI: 0000000020000540 RDI: 0000000000000003 [ 60.577563][ T6882] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000002000000000 [ 60.585526][ T6882] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000032 [ 60.593480][ T6882] R13: 0000000000000000 R14: 000000000000000c R15: 0000000000000004 [ 60.604017][ T6882] ================================================================================ [ 60.614648][ T6882] Kernel panic - not syncing: panic_on_warn set ... [ 60.621593][ T6882] CPU: 1 PID: 6882 Comm: syz-executor700 Not tainted 5.9.0-rc6-syzkaller #0 [ 60.630259][ T6882] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 60.640301][ T6882] Call Trace: [ 60.643573][ T6882] dump_stack+0x198/0x1fd [ 60.647880][ T6882] panic+0x382/0x7fb [ 60.651773][ T6882] ? __warn_printk+0xf3/0xf3 [ 60.656345][ T6882] ? mark_lock+0x82/0x1660 [ 60.660736][ T6882] ? ubsan_epilogue+0x3e/0x5a [ 60.665387][ T6882] ? ubsan_epilogue+0x35/0x5a [ 60.670041][ T6882] ubsan_epilogue+0x54/0x5a [ 60.674520][ T6882] __ubsan_handle_out_of_bounds.cold+0x62/0x6c [ 60.680648][ T6882] ? lock_is_held_type+0xbb/0xf0 [ 60.685574][ T6882] ieee80211_del_key+0x428/0x440 [ 60.690541][ T6882] nl80211_del_key+0x493/0x980 [ 60.695287][ T6882] ? cfg80211_tdls_oper_request+0x7f0/0x7f0 [ 60.701205][ T6882] ? nl80211_pre_doit+0xa2/0x630 [ 60.706123][ T6882] genl_family_rcv_msg_doit+0x228/0x320 [ 60.711648][ T6882] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x280/0x280 [ 60.719002][ T6882] ? ns_capable+0xde/0x100 [ 60.723394][ T6882] genl_rcv_msg+0x328/0x580 [ 60.727876][ T6882] ? genl_get_cmd+0x480/0x480 [ 60.732530][ T6882] ? lock_acquire+0x1f3/0xaf0 [ 60.737183][ T6882] ? cfg80211_tdls_oper_request+0x7f0/0x7f0 [ 60.743053][ T6882] ? lock_release+0x8f0/0x8f0 [ 60.747709][ T6882] netlink_rcv_skb+0x15a/0x430 [ 60.752447][ T6882] ? genl_get_cmd+0x480/0x480 [ 60.757105][ T6882] ? netlink_ack+0xa10/0xa10 [ 60.761676][ T6882] ? __kmalloc_node_track_caller+0x38/0x60 [ 60.767456][ T6882] genl_rcv+0x24/0x40 [ 60.771452][ T6882] netlink_unicast+0x533/0x7d0 [ 60.776197][ T6882] ? netlink_attachskb+0x810/0x810 [ 60.781283][ T6882] ? __phys_addr_symbol+0x2c/0x70 [ 60.786282][ T6882] ? __check_object_size+0x171/0x3e4 [ 60.791547][ T6882] netlink_sendmsg+0x856/0xd90 [ 60.796295][ T6882] ? netlink_unicast+0x7d0/0x7d0 [ 60.801208][ T6882] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 60.806467][ T6882] ? netlink_unicast+0x7d0/0x7d0 [ 60.811409][ T6882] sock_sendmsg+0xcf/0x120 [ 60.815810][ T6882] ____sys_sendmsg+0x6e8/0x810 [ 60.820550][ T6882] ? kernel_sendmsg+0x50/0x50 [ 60.825202][ T6882] ? do_recvmmsg+0x6d0/0x6d0 [ 60.829768][ T6882] ? stack_trace_consume_entry+0x160/0x160 [ 60.835556][ T6882] ___sys_sendmsg+0xf3/0x170 [ 60.840127][ T6882] ? sendmsg_copy_msghdr+0x160/0x160 [ 60.845509][ T6882] ? syscall_exit_to_user_mode+0x7e/0x2e0 [ 60.851242][ T6882] ? lock_downgrade+0x830/0x830 [ 60.856072][ T6882] ? check_preemption_disabled+0x50/0x130 [ 60.861786][ T6882] ? _raw_spin_unlock_irqrestore+0x6f/0x90 [ 60.867569][ T6882] ? lockdep_hardirqs_on_prepare+0x354/0x530 [ 60.873652][ T6882] ? _raw_spin_unlock_irqrestore+0x6f/0x90 [ 60.879433][ T6882] ? lockdep_hardirqs_on+0x53/0x100 [ 60.884607][ T6882] ? _raw_spin_unlock_irqrestore+0x5c/0x90 [ 60.890393][ T6882] ? debug_object_active_state+0x260/0x350 [ 60.896177][ T6882] ? debug_object_init_on_stack+0x20/0x20 [ 60.901912][ T6882] ? __fget_light+0x215/0x280 [ 60.906599][ T6882] __sys_sendmsg+0xe5/0x1b0 [ 60.911335][ T6882] ? __sys_sendmsg_sock+0xb0/0xb0 [ 60.916349][ T6882] ? lock_is_held_type+0xbb/0xf0 [ 60.921274][ T6882] ? check_preemption_disabled+0x50/0x130 [ 60.926968][ T6882] ? syscall_enter_from_user_mode+0x1d/0x60 [ 60.932872][ T6882] do_syscall_64+0x2d/0x70 [ 60.937273][ T6882] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 60.943170][ T6882] RIP: 0033:0x4416f9 [ 60.947040][ T6882] Code: e8 dc 05 03 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 0d fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 60.966831][ T6882] RSP: 002b:00007ffc1bb97bb8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 60.975223][ T6882] RAX: ffffffffffffffda RBX: 00007ffc1bb97be0 RCX: 00000000004416f9 [ 60.983186][ T6882] RDX: 0000000000000000 RSI: 0000000020000540 RDI: 0000000000000003 [ 60.991281][ T6882] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000002000000000 [ 60.999230][ T6882] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000032 [ 61.007178][ T6882] R13: 0000000000000000 R14: 000000000000000c R15: 0000000000000004 [ 61.016486][ T6882] Kernel Offset: disabled [ 61.020856][ T6882] Rebooting in 86400 seconds..