./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1551835867
<...>
Warning: Permanently added '10.128.1.37' (ED25519) to the list of known hosts.
execve("./syz-executor1551835867", ["./syz-executor1551835867"], 0x7ffeec2255a0 /* 10 vars */) = 0
brk(NULL) = 0x5555555b8000
brk(0x5555555b8d00) = 0x5555555b8d00
arch_prctl(ARCH_SET_FS, 0x5555555b8380) = 0
set_tid_address(0x5555555b8650) = 5025
set_robust_list(0x5555555b8660, 24) = 0
rseq(0x5555555b8ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor1551835867", 4096) = 28
getrandom("\x75\x36\x63\x13\x1e\x6e\x08\xa2", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x5555555b8d00
brk(0x5555555d9d00) = 0x5555555d9d00
brk(0x5555555da000) = 0x5555555da000
mprotect(0x7fcf77e65000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555555b8650) = 5026
./strace-static-x86_64: Process 5026 attached
[pid 5026] set_robust_list(0x5555555b8660, 24) = 0
[pid 5026] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5026] setpgid(0, 0) = 0
[pid 5026] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5026] write(3, "1000", 4) = 4
[pid 5026] close(3) = 0
[pid 5026] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3
[pid 5026] ioctl(3, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0
[pid 5026] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4
[pid 5026] sendto(4, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32
[pid 5026] recvfrom(4, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5026}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496
[pid 5026] recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5026}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid 5026] close(4) = 0
[pid 5026] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x30\x00\x00\x00\x23\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x39\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x14\x00\x5a\x80\x10\x00\x00\x80\x06\x00\x02\x00\x00\x00\x00\x00\x04\x00\x01\x00", iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48
[pid 5026] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4
[pid 5026] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 5
[pid 5026] sendto(5, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32
[pid 5026] recvfrom(5, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=-676258464}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496
[pid 5026] recvfrom(5, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=-676258464}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid 5026] close(5) = 0
[pid 5026] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 5
[pid 5026] ioctl(5, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0
[pid 5026] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x24\x00\x00\x00\x23\x00\x05\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x08\x00\x05\x00\x02\x00\x00\x00", iov_len=36}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_DONTROUTE}, 0) = 36
[pid 5026] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 6
[pid 5026] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 7
[pid 5026] sendto(7, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32
[pid 5026] recvfrom(7, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=-2060942140}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496
[pid 5026] recvfrom(7, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=-2060942140}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid 5026] close(7) = 0
[pid 5026] ioctl(6, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0
[pid 5026] sendmsg(6, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x2c\x00\x00\x00\x23\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2e\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x05\x00\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=44}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 44
[pid 5026] exit_group(0) = ?
[pid 5026] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5026, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5027 attached
, child_tidptr=0x5555555b8650) = 5027
[pid 5027] set_robust_list(0x5555555b8660, 24) = 0
[pid 5027] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5027] setpgid(0, 0) = 0
[pid 5027] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5027] write(3, "1000", 4) = 4
[pid 5027] close(3) = 0
[pid 5027] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3
[pid 5027] ioctl(3, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0
[pid 5027] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4
[pid 5027] sendto(4, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32
[pid 5027] recvfrom(4, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5027}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496
[pid 5027] recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5027}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid 5027] close(4) = 0
[pid 5027] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x30\x00\x00\x00\x23\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x39\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x14\x00\x5a\x80\x10\x00\x00\x80\x06\x00\x02\x00\x00\x00\x00\x00\x04\x00\x01\x00", iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48
[pid 5027] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4
[pid 5027] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 5
[pid 5027] sendto(5, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32
[pid 5027] recvfrom(5, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=-1117278008}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496
[pid 5027] recvfrom(5, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=-1117278008}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid 5027] close(5) = 0
[pid 5027] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 5
[pid 5027] ioctl(5, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0
[pid 5027] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x24\x00\x00\x00\x23\x00\x05\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x08\x00\x05\x00\x02\x00\x00\x00", iov_len=36}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_DONTROUTE}, 0) = 36
[pid 5027] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 6
[pid 5027] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 7
[pid 5027] sendto(7, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32
[pid 5027] recvfrom(7, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=-1444302004}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496
[pid 5027] recvfrom(7, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=-1444302004}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid 5027] close(7) = 0
[pid 5027] ioctl(6, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0
[ 59.469267][ T5026] netlink: 8 bytes leftover after parsing attributes in process `syz-executor155'.
[ 59.509183][ T5027] netlink: 8 bytes leftover after parsing attributes in process `syz-executor155'.
[pid 5027] sendmsg(6, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x2c\x00\x00\x00\x23\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2e\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x05\x00\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=44}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 44
[pid 5027] exit_group(0) = ?
[pid 5027] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5027, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555555b8650) = 5028
./strace-static-x86_64: Process 5028 attached
[pid 5028] set_robust_list(0x5555555b8660, 24) = 0
[pid 5028] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5028] setpgid(0, 0) = 0
[pid 5028] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5028] write(3, "1000", 4) = 4
[pid 5028] close(3) = 0
[pid 5028] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3
[pid 5028] ioctl(3, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0
[pid 5028] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4
[pid 5028] sendto(4, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32
[pid 5028] recvfrom(4, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5028}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496
[pid 5028] recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5028}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid 5028] close(4) = 0
[pid 5028] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x30\x00\x00\x00\x23\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x39\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x14\x00\x5a\x80\x10\x00\x00\x80\x06\x00\x02\x00\x00\x00\x00\x00\x04\x00\x01\x00", iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48
[pid 5028] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4
[pid 5028] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 5
[pid 5028] sendto(5, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32
[pid 5028] recvfrom(5, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=-288025706}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496
[pid 5028] recvfrom(5, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=-288025706}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid 5028] close(5) = 0
[pid 5028] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 5
[pid 5028] ioctl(5, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0
[pid 5028] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x24\x00\x00\x00\x23\x00\x05\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x08\x00\x05\x00\x02\x00\x00\x00", iov_len=36}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_DONTROUTE}, 0) = 36
[pid 5028] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 6
[pid 5028] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 7
[pid 5028] sendto(7, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32
[pid 5028] recvfrom(7, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=-1342551480}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496
[pid 5028] recvfrom(7, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=-1342551480}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid 5028] close(7) = 0
[pid 5028] ioctl(6, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0
[pid 5028] sendmsg(6, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x2c\x00\x00\x00\x23\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2e\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x05\x00\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=44}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 44
[pid 5028] exit_group(0) = ?
[pid 5028] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5028, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555555b8650) = 5029
./strace-static-x86_64: Process 5029 attached
[pid 5029] set_robust_list(0x5555555b8660, 24) = 0
[pid 5029] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5029] setpgid(0, 0) = 0
[ 59.517070][ T1254] ------------[ cut here ]------------
[ 59.524183][ T1254] no supported rates for sta (null) (0xffffffff, band 0) in rate_mask 0x0 with flags 0x0
[ 59.534894][ T1254] WARNING: CPU: 1 PID: 1254 at net/mac80211/rate.c:379 __rate_control_send_low+0x6d7/0x800
[ 59.545186][ T1254] Modules linked in:
[ 59.548040][ T5028] netlink: 8 bytes leftover after parsing attributes in process `syz-executor155'.
[ 59.549156][ T1254] CPU: 1 PID: 1254 Comm: kworker/u4:5 Not tainted 6.5.0-rc6-syzkaller-00253-g9e6c269de404 #0
[pid 5029] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5029] write(3, "1000", 4) = 4
[pid 5029] close(3) = 0
[pid 5029] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3
[pid 5029] ioctl(3, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0
[pid 5029] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4
[pid 5029] sendto(4, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32
[ 59.568671][ T1254] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
[ 59.578920][ T1254] Workqueue: phy1 ieee80211_scan_work
[ 59.584451][ T1254] RIP: 0010:__rate_control_send_low+0x6d7/0x800
[ 59.590900][ T1254] Code: 8b a4 a0 d4 00 00 00 e8 b7 e9 d9 f7 44 8b 44 24 3c 45 89 e9 89 d9 48 8b 74 24 18 44 89 e2 48 c7 c7 40 d3 a2 8b e8 d9 ab a0 f7 <0f> 0b e9 03 fd ff ff 48 8b 7c 24 30 e8 a8 f6 2d f8 e9 e5 fb ff ff
[ 59.599912][ T5029] netlink: 8 bytes leftover after parsing attributes in process `syz-executor155'.
[ 59.610571][ T1254] RSP: 0018:ffffc900055bf578 EFLAGS: 00010282
[ 59.610599][ T1254] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 59.610620][ T1254] RDX: ffff8880221ad940 RSI: ffffffff814ccc86 RDI: 0000000000000001
[ 59.610638][ T1254] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
[ 59.610655][ T1254] R10: 0000000000000000 R11: 0000000000000001 R12: 00000000ffffffff
[ 59.610670][ T1254] R13: 0000000000000000 R14: 000000000000000c R15: dffffc0000000000
[ 59.610685][ T1254] FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
[ 59.610711][ T1254] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 59.610729][ T1254] CR2: 0000000020000040 CR3: 00000000172a2000 CR4: 00000000003506e0
[ 59.610748][ T1254] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 59.610768][ T1254] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 59.610785][ T1254] Call Trace:
[ 59.610793][ T1254]
[ 59.610804][ T1254] ? __warn+0xe6/0x380
[ 59.610838][ T1254] ? __wake_up_klogd.part.0+0x99/0xf0
[ 59.610879][ T1254] ? __rate_control_send_low+0x6d7/0x800
[ 59.610916][ T1254] ? report_bug+0x3bc/0x580
[ 59.610947][ T1254] ? handle_bug+0x3c/0x70
[ 59.610975][ T1254] ? exc_invalid_op+0x17/0x40
[ 59.611004][ T1254] ? asm_exc_invalid_op+0x1a/0x20
[ 59.611042][ T1254] ? __warn_printk+0x1a6/0x350
[ 59.611068][ T1254] ? __rate_control_send_low+0x6d7/0x800
[ 59.611105][ T1254] ? __rate_control_send_low+0x6d7/0x800
[ 59.611145][ T1254] rate_control_send_low+0x296/0x820
[ 59.611179][ T1254] rate_control_get_rate+0x1be/0x590
[ 59.611216][ T1254] ieee80211_tx_h_rate_ctrl+0xa70/0x19d0
[ 59.611257][ T1254] ? mark_lock+0x105/0x1950
[ 59.611288][ T1254] ? ieee80211_probereq_get+0x290/0x290
[ 59.611334][ T1254] invoke_tx_handlers_late+0xd15/0x2c90
[ 59.611368][ T1254] ? ieee80211_queue_skb+0x472/0x1fb0
[ 59.611402][ T1254] ? ieee80211_ie_build_eht_cap+0x3e0/0x3e0
[ 59.665640][ T5030] netlink: 8 bytes leftover after parsing attributes in process `syz-executor155'.
[ 59.666960][ T1254] ? invoke_tx_handlers_early+0x663/0x26c0
[ 59.714942][ T5031] netlink: 8 bytes leftover after parsing attributes in process `syz-executor155'.
[ 59.717177][ T1254] ieee80211_tx+0x2ff/0x420
[ 59.763553][ T5032] netlink: 8 bytes leftover after parsing attributes in process `syz-executor155'.
[ 59.768399][ T1254] ? ieee80211_tx_prepare_skb+0x470/0x470
[ 59.813512][ T5033] netlink: 8 bytes leftover after parsing attributes in process `syz-executor155'.
[ 59.815790][ T1254] ? lockdep_hardirqs_on_prepare+0x410/0x410
[ 59.859576][ T5034] netlink: 8 bytes leftover after parsing attributes in process `syz-executor155'.
[ 59.859931][ T1254] ? ieee80211_skb_resize+0x22a/0x620
[ 59.880895][ T1254] ? ieee80211_set_qos_hdr+0xba/0x3e0
[ 59.886407][ T1254] ieee80211_xmit+0x30e/0x3e0
[ 59.891149][ T1254] __ieee80211_tx_skb_tid_band+0x2a0/0x700
[ 59.897128][ T1254] ieee80211_scan_state_send_probe+0x33c/0x970
[ 59.903534][ T1254] ieee80211_scan_work+0x6f8/0x1fc0
[ 59.904953][ T5035] netlink: 8 bytes leftover after parsing attributes in process `syz-executor155'.
[ 59.908835][ T1254] ? lock_sync+0x190/0x190
[ 59.922860][ T1254] ? reacquire_held_locks+0x4b0/0x4b0
[ 59.928358][ T1254] ? ieee80211_run_deferred_scan+0x340/0x340
[ 59.934413][ T1254] ? spin_bug+0x1d0/0x1d0
[ 59.938887][ T1254] process_one_work+0xaa2/0x16f0
[ 59.943903][ T1254] ? lock_sync+0x190/0x190
[ 59.948455][ T1254] ? pwq_dec_nr_in_flight+0x2a0/0x2a0
[ 59.953981][ T1254] ? spin_bug+0x1d0/0x1d0
[ 59.958454][ T1254] worker_thread+0x687/0x1110
[ 59.963191][ T1254] ? __kthread_parkme+0x152/0x220
[ 59.968401][ T1254] ? process_one_work+0x16f0/0x16f0
[ 59.973651][ T1254] kthread+0x33a/0x430
[ 59.977843][ T1254] ? kthread_complete_and_exit+0x40/0x40
[ 59.983552][ T1254] ret_from_fork+0x2c/0x70
[ 59.988080][ T1254] ? kthread_complete_and_exit+0x40/0x40
[ 59.993761][ T1254] ret_from_fork_asm+0x11/0x20
[ 59.998663][ T1254]
[ 60.001714][ T1254] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 60.009030][ T1254] CPU: 1 PID: 1254 Comm: kworker/u4:5 Not tainted 6.5.0-rc6-syzkaller-00253-g9e6c269de404 #0
[ 60.019310][ T1254] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
[ 60.029495][ T1254] Workqueue: phy1 ieee80211_scan_work
[ 60.034927][ T1254] Call Trace:
[ 60.038236][ T1254]
[ 60.041199][ T1254] dump_stack_lvl+0xd9/0x1b0
[ 60.045831][ T1254] panic+0x6a4/0x750
[ 60.049775][ T1254] ? panic_smp_self_stop+0xa0/0xa0
[ 60.054935][ T1254] ? show_trace_log_lvl+0x29d/0x3c0
[ 60.060201][ T1254] ? __rate_control_send_low+0x6d7/0x800
[ 60.065893][ T1254] check_panic_on_warn+0xab/0xb0
[ 60.070884][ T1254] __warn+0xf2/0x380
[ 60.074821][ T1254] ? __wake_up_klogd.part.0+0x99/0xf0
[ 60.080244][ T1254] ? __rate_control_send_low+0x6d7/0x800
[ 60.085930][ T1254] report_bug+0x3bc/0x580
[ 60.090311][ T1254] handle_bug+0x3c/0x70
[ 60.094515][ T1254] exc_invalid_op+0x17/0x40
[ 60.099066][ T1254] asm_exc_invalid_op+0x1a/0x20
[ 60.103960][ T1254] RIP: 0010:__rate_control_send_low+0x6d7/0x800
[ 60.110302][ T1254] Code: 8b a4 a0 d4 00 00 00 e8 b7 e9 d9 f7 44 8b 44 24 3c 45 89 e9 89 d9 48 8b 74 24 18 44 89 e2 48 c7 c7 40 d3 a2 8b e8 d9 ab a0 f7 <0f> 0b e9 03 fd ff ff 48 8b 7c 24 30 e8 a8 f6 2d f8 e9 e5 fb ff ff
[ 60.129953][ T1254] RSP: 0018:ffffc900055bf578 EFLAGS: 00010282
[ 60.136061][ T1254] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 60.144064][ T1254] RDX: ffff8880221ad940 RSI: ffffffff814ccc86 RDI: 0000000000000001
[ 60.152086][ T1254] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
[ 60.160097][ T1254] R10: 0000000000000000 R11: 0000000000000001 R12: 00000000ffffffff
[ 60.168189][ T1254] R13: 0000000000000000 R14: 000000000000000c R15: dffffc0000000000
[ 60.176211][ T1254] ? __warn_printk+0x1a6/0x350
[ 60.181040][ T1254] ? __rate_control_send_low+0x6d7/0x800
[ 60.186756][ T1254] rate_control_send_low+0x296/0x820
[ 60.192134][ T1254] rate_control_get_rate+0x1be/0x590
[ 60.197490][ T1254] ieee80211_tx_h_rate_ctrl+0xa70/0x19d0
[ 60.203193][ T1254] ? mark_lock+0x105/0x1950
[ 60.207759][ T1254] ? ieee80211_probereq_get+0x290/0x290
[ 60.213382][ T1254] invoke_tx_handlers_late+0xd15/0x2c90
[ 60.219076][ T1254] ? ieee80211_queue_skb+0x472/0x1fb0
[ 60.224509][ T1254] ? ieee80211_ie_build_eht_cap+0x3e0/0x3e0
[ 60.230461][ T1254] ? invoke_tx_handlers_early+0x663/0x26c0
[ 60.236335][ T1254] ieee80211_tx+0x2ff/0x420
[ 60.240920][ T1254] ? ieee80211_tx_prepare_skb+0x470/0x470
[ 60.246707][ T1254] ? lockdep_hardirqs_on_prepare+0x410/0x410
[ 60.252761][ T1254] ? ieee80211_skb_resize+0x22a/0x620
[ 60.258186][ T1254] ? ieee80211_set_qos_hdr+0xba/0x3e0
[ 60.263609][ T1254] ieee80211_xmit+0x30e/0x3e0
[ 60.268346][ T1254] __ieee80211_tx_skb_tid_band+0x2a0/0x700
[ 60.274221][ T1254] ieee80211_scan_state_send_probe+0x33c/0x970
[ 60.280462][ T1254] ieee80211_scan_work+0x6f8/0x1fc0
[ 60.285733][ T1254] ? lock_sync+0x190/0x190
[ 60.290205][ T1254] ? reacquire_held_locks+0x4b0/0x4b0
[ 60.295641][ T1254] ? ieee80211_run_deferred_scan+0x340/0x340
[ 60.301676][ T1254] ? spin_bug+0x1d0/0x1d0
[ 60.306083][ T1254] process_one_work+0xaa2/0x16f0
[ 60.311081][ T1254] ? lock_sync+0x190/0x190
[ 60.315547][ T1254] ? pwq_dec_nr_in_flight+0x2a0/0x2a0
[ 60.320976][ T1254] ? spin_bug+0x1d0/0x1d0
[ 60.325369][ T1254] worker_thread+0x687/0x1110
[ 60.330210][ T1254] ? __kthread_parkme+0x152/0x220
[ 60.335296][ T1254] ? process_one_work+0x16f0/0x16f0
[ 60.340547][ T1254] kthread+0x33a/0x430
[ 60.344695][ T1254] ? kthread_complete_and_exit+0x40/0x40
[ 60.350373][ T1254] ret_from_fork+0x2c/0x70
[ 60.354838][ T1254] ? kthread_complete_and_exit+0x40/0x40
[ 60.360516][ T1254] ret_from_fork_asm+0x11/0x20
[ 60.365354][ T1254]
[ 60.368607][ T1254] Kernel Offset: disabled
[ 60.373058][ T1254] Rebooting in 86400 seconds..