./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2033334888 <...> Warning: Permanently added '10.128.1.150' (ED25519) to the list of known hosts. execve("./syz-executor2033334888", ["./syz-executor2033334888"], 0x7ffd1f19c970 /* 10 vars */) = 0 brk(NULL) = 0x555556479000 brk(0x555556479d00) = 0x555556479d00 arch_prctl(ARCH_SET_FS, 0x555556479380) = 0 set_tid_address(0x555556479650) = 5039 set_robust_list(0x555556479660, 24) = 0 rseq(0x555556479ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor2033334888", 4096) = 28 getrandom("\xa2\xe1\x6a\x48\xa4\x61\x5a\xee", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555556479d00 brk(0x55555649ad00) = 0x55555649ad00 brk(0x55555649b000) = 0x55555649b000 mprotect(0x7fd0ef317000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5040 attached [pid 5040] set_robust_list(0x555556479660, 24) = 0 [pid 5040] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5039] <... clone resumed>, child_tidptr=0x555556479650) = 5040 [pid 5040] <... prctl resumed>) = 0 [pid 5040] setpgid(0, 0) = 0 [pid 5040] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5040] write(3, "1000", 4) = 4 [pid 5040] close(3) = 0 [pid 5040] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5040] ioctl(3, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0 [pid 5040] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 [pid 5040] sendto(4, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5040] recvfrom(4, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5040}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496 [pid 5040] recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5040}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5040] close(4) = 0 [pid 5040] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x30\x00\x00\x00\x23\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x39\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x14\x00\x5a\x80\x10\x00\x00\x80\x06\x00\x02\x00\x00\x00\x00\x00\x04\x00\x01\x00", iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5040] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 [pid 5040] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 5 [pid 5040] sendto(5, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5040] recvfrom(5, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=-53304890}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496 [pid 5040] recvfrom(5, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=-53304890}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5040] close(5) = 0 [pid 5040] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 5 [pid 5040] ioctl(5, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0 [pid 5040] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x24\x00\x00\x00\x23\x00\x05\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x08\x00\x05\x00\x02\x00\x00\x00", iov_len=36}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_DONTROUTE}, 0) = 36 [pid 5040] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 6 [pid 5040] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 7 [pid 5040] sendto(7, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5040] recvfrom(7, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=-915333754}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496 [pid 5040] recvfrom(7, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=-915333754}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5040] close(7) = 0 [pid 5040] ioctl(6, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0 [pid 5040] sendmsg(6, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x2c\x00\x00\x00\x23\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2e\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x05\x00\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=44}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 44 [pid 5040] exit_group(0) = ? [pid 5040] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5040, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5041 attached [pid 5041] set_robust_list(0x555556479660, 24) = 0 [pid 5041] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 5039] <... clone resumed>, child_tidptr=0x555556479650) = 5041 [pid 5041] <... prctl resumed>) = 0 [pid 5041] setpgid(0, 0) = 0 [pid 5041] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5041] write(3, "1000", 4) = 4 [pid 5041] close(3) = 0 [pid 5041] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5041] ioctl(3, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0 [pid 5041] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 [pid 5041] sendto(4, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5041] recvfrom(4, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5041}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496 [pid 5041] recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5041}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5041] close(4) = 0 [pid 5041] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x30\x00\x00\x00\x23\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x39\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x14\x00\x5a\x80\x10\x00\x00\x80\x06\x00\x02\x00\x00\x00\x00\x00\x04\x00\x01\x00", iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5041] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 [pid 5041] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 5 [pid 5041] sendto(5, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5041] recvfrom(5, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=-1899271953}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496 [pid 5041] recvfrom(5, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=-1899271953}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5041] close(5) = 0 [pid 5041] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 5 [pid 5041] ioctl(5, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0 [pid 5041] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x24\x00\x00\x00\x23\x00\x05\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x08\x00\x05\x00\x02\x00\x00\x00", iov_len=36}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_DONTROUTE}, 0) = 36 [pid 5041] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 6 [pid 5041] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 7 [pid 5041] sendto(7, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5041] recvfrom(7, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=-1660267338}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496 [ 53.394993][ T5040] netlink: 8 bytes leftover after parsing attributes in process `syz-executor203'. [ 53.441094][ T2883] ------------[ cut here ]------------ [ 53.446802][ T2883] no supported rates for sta (null) (0xffffffff, band 0) in rate_mask 0x0 with flags 0x0 [ 53.457429][ T2883] WARNING: CPU: 0 PID: 2883 at net/mac80211/rate.c:379 __rate_control_send_low+0x6d7/0x800 [ 53.467506][ T2883] Modules linked in: [ 53.471448][ T2883] CPU: 0 PID: 2883 Comm: kworker/u4:11 Not tainted 6.6.0-rc5-syzkaller-00250-g70f8c6f8f880 #0 [ 53.481735][ T2883] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023 [ 53.491851][ T2883] Workqueue: phy1 ieee80211_scan_work [ 53.497297][ T2883] RIP: 0010:__rate_control_send_low+0x6d7/0x800 [ 53.503571][ T2883] Code: 8b a4 a0 d4 00 00 00 e8 87 ae ce f7 44 8b 44 24 3c 45 89 e9 89 d9 48 8b 74 24 18 44 89 e2 48 c7 c7 40 18 c5 8b e8 a9 d6 94 f7 <0f> 0b e9 03 fd ff ff 48 8b 7c 24 30 e8 88 66 24 f8 e9 e5 fb ff ff [ 53.523234][ T2883] RSP: 0018:ffffc9000aac7578 EFLAGS: 00010282 [ 53.529329][ T2883] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [pid 5041] recvfrom(7, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=-1660267338}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5041] close(7) = 0 [pid 5041] ioctl(6, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0 [pid 5041] sendmsg(6, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x2c\x00\x00\x00\x23\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2e\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x05\x00\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=44}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 44 [pid 5041] exit_group(0) = ? [ 53.537386][ T2883] RDX: ffff888027693b80 RSI: ffffffff814df0c6 RDI: 0000000000000001 [ 53.545401][ T2883] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 [ 53.553751][ T2883] R10: 0000000000000000 R11: 0000000000000001 R12: 00000000ffffffff [ 53.561771][ T2883] R13: 0000000000000000 R14: 000000000000000c R15: dffffc0000000000 [ 53.569772][ T2883] FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 [ 53.575555][ T5041] netlink: 8 bytes leftover after parsing attributes in process `syz-executor203'. [pid 5041] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5041, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556479650) = 5042 ./strace-static-x86_64: Process 5042 attached [pid 5042] set_robust_list(0x555556479660, 24) = 0 [pid 5042] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5042] setpgid(0, 0) = 0 [pid 5042] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5042] write(3, "1000", 4) = 4 [pid 5042] close(3) = 0 [pid 5042] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5042] ioctl(3, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0 [pid 5042] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 [pid 5042] sendto(4, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5042] recvfrom(4, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5042}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496 [pid 5042] recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5042}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5042] close(4) = 0 [pid 5042] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x30\x00\x00\x00\x23\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x39\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x14\x00\x5a\x80\x10\x00\x00\x80\x06\x00\x02\x00\x00\x00\x00\x00\x04\x00\x01\x00", iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5042] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 [pid 5042] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 5 [pid 5042] sendto(5, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5042] recvfrom(5, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=-454859010}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496 [pid 5042] recvfrom(5, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=-454859010}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [ 53.578720][ T2883] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 53.594647][ T2883] CR2: 0000000020000040 CR3: 0000000075b5c000 CR4: 0000000000350ef0 [ 53.602682][ T2883] Call Trace: [ 53.605961][ T2883] [ 53.608881][ T2883] ? show_regs+0x8f/0xa0 [ 53.613160][ T2883] ? __warn+0xe6/0x380 [ 53.617259][ T2883] ? __rate_control_send_low+0x6d7/0x800 [ 53.622979][ T2883] ? report_bug+0x3bc/0x580 [ 53.627507][ T2883] ? handle_bug+0x3c/0x70 [ 53.631902][ T2883] ? exc_invalid_op+0x17/0x40 [ 53.636597][ T2883] ? asm_exc_invalid_op+0x1a/0x20 [pid 5042] close(5) = 0 [pid 5042] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 5 [pid 5042] ioctl(5, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0 [pid 5042] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x24\x00\x00\x00\x23\x00\x05\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x08\x00\x05\x00\x02\x00\x00\x00", iov_len=36}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_DONTROUTE}, 0) = 36 [pid 5042] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 6 [pid 5042] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 7 [pid 5042] sendto(7, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5042] recvfrom(7, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=-558828410}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496 [pid 5042] recvfrom(7, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=-558828410}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5042] close(7) = 0 [pid 5042] ioctl(6, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0 [pid 5042] sendmsg(6, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x2c\x00\x00\x00\x23\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2e\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x05\x00\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=44}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 44 [pid 5042] exit_group(0) = ? [pid 5042] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5042, si_uid=0, si_status=0, si_utime=0, si_stime=2 /* 0.02 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 [ 53.641952][ T2883] ? __warn_printk+0x1a6/0x350 [ 53.646750][ T2883] ? __rate_control_send_low+0x6d7/0x800 [ 53.652451][ T2883] ? __rate_control_send_low+0x6d7/0x800 [ 53.658117][ T2883] rate_control_send_low+0x296/0x820 [ 53.660338][ T5042] netlink: 8 bytes leftover after parsing attributes in process `syz-executor203'. [ 53.663443][ T2883] rate_control_get_rate+0x1be/0x590 [ 53.663478][ T2883] ieee80211_tx_h_rate_ctrl+0xa70/0x19d0 [ 53.683722][ T2883] ? mark_lock+0x105/0x1950 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556479650) = 5043 ./strace-static-x86_64: Process 5043 attached [pid 5043] set_robust_list(0x555556479660, 24) = 0 [pid 5043] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5043] setpgid(0, 0) = 0 [pid 5043] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5043] write(3, "1000", 4) = 4 [pid 5043] close(3) = 0 [pid 5043] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5043] ioctl(3, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0 [pid 5043] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 [pid 5043] sendto(4, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5043] recvfrom(4, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5043}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496 [pid 5043] recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5043}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5043] close(4) = 0 [pid 5043] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x30\x00\x00\x00\x23\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x39\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x14\x00\x5a\x80\x10\x00\x00\x80\x06\x00\x02\x00\x00\x00\x00\x00\x04\x00\x01\x00", iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5043] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 [pid 5043] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 5 [ 53.688266][ T2883] ? ieee80211_probereq_get+0x290/0x290 [ 53.693906][ T2883] invoke_tx_handlers_late+0xd15/0x2c90 [ 53.699486][ T2883] ? ieee80211_queue_skb+0x472/0x1fb0 [ 53.704943][ T2883] ? ieee80211_ie_build_eht_cap+0x3e0/0x3e0 [ 53.710882][ T2883] ? invoke_tx_handlers_early+0x663/0x26c0 [ 53.716699][ T2883] ieee80211_tx+0x2ff/0x420 [ 53.721244][ T2883] ? ieee80211_tx_prepare_skb+0x470/0x470 [ 53.726990][ T2883] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 53.733080][ T2883] ? ieee80211_skb_resize+0x22a/0x620 [pid 5043] sendto(5, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5043] recvfrom(5, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=-841873359}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496 [pid 5043] recvfrom(5, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=-841873359}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5043] close(5) = 0 [pid 5043] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 5 [pid 5043] ioctl(5, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0 [pid 5043] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x24\x00\x00\x00\x23\x00\x05\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x08\x00\x05\x00\x02\x00\x00\x00", iov_len=36}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_DONTROUTE}, 0) = 36 [pid 5043] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 6 [pid 5043] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 7 [pid 5043] sendto(7, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5043] recvfrom(7, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=-262083319}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496 [pid 5043] recvfrom(7, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=-262083319}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5043] close(7) = 0 [pid 5043] ioctl(6, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0 [pid 5043] sendmsg(6, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x2c\x00\x00\x00\x23\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2e\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x05\x00\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=44}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 44 [pid 5043] exit_group(0) = ? [pid 5043] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5043, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} --- restart_syscall(<... resuming interrupted clone ...>) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556479650) = 5044 [ 53.738480][ T2883] ? ieee80211_set_qos_hdr+0xba/0x3e0 [ 53.743924][ T2883] ieee80211_xmit+0x30e/0x3e0 [ 53.748642][ T2883] __ieee80211_tx_skb_tid_band+0x29b/0x6f0 [ 53.754522][ T2883] ieee80211_scan_state_send_probe+0x33a/0x970 [ 53.760748][ T2883] ieee80211_scan_work+0x6f8/0x1fb0 [ 53.764973][ T5043] netlink: 8 bytes leftover after parsing attributes in process `syz-executor203'. [ 53.765972][ T2883] ? lock_sync+0x190/0x190 [ 53.779712][ T2883] ? lock_sync+0x190/0x190 [ 53.784182][ T2883] ? reacquire_held_locks+0x4b0/0x4b0 ./strace-static-x86_64: Process 5044 attached [pid 5044] set_robust_list(0x555556479660, 24) = 0 [pid 5044] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [ 53.789568][ T2883] ? ieee80211_run_deferred_scan+0x340/0x340 [ 53.795616][ T2883] process_one_work+0x884/0x15c0 [ 53.800618][ T2883] ? lock_sync+0x190/0x190 [ 53.805060][ T2883] ? init_worker_pool+0x770/0x770 [ 53.810084][ T2883] ? assign_work+0x1a0/0x240 [ 53.814733][ T2883] worker_thread+0x8b9/0x1290 [ 53.819445][ T2883] ? process_one_work+0x15c0/0x15c0 [ 53.824725][ T2883] kthread+0x33c/0x440 [ 53.828906][ T2883] ? _raw_spin_unlock_irq+0x23/0x50 [ 53.834176][ T2883] ? kthread_complete_and_exit+0x40/0x40 [pid 5044] setpgid(0, 0) = 0 [pid 5044] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5044] write(3, "1000", 4) = 4 [pid 5044] close(3) = 0 [pid 5044] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5044] ioctl(3, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0 [pid 5044] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 [pid 5044] sendto(4, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5044] recvfrom(4, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5044}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496 [pid 5044] recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5044}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5044] close(4) = 0 [pid 5044] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x30\x00\x00\x00\x23\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x39\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x14\x00\x5a\x80\x10\x00\x00\x80\x06\x00\x02\x00\x00\x00\x00\x00\x04\x00\x01\x00", iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5044] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 [pid 5044] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 5 [pid 5044] sendto(5, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5044] recvfrom(5, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=-1594187111}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496 [pid 5044] recvfrom(5, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=-1594187111}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5044] close(5) = 0 [pid 5044] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 5 [pid 5044] ioctl(5, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0 [pid 5044] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x24\x00\x00\x00\x23\x00\x05\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x08\x00\x05\x00\x02\x00\x00\x00", iov_len=36}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_DONTROUTE}, 0) = 36 [pid 5044] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 6 [pid 5044] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 7 [pid 5044] sendto(7, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5044] recvfrom(7, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=-925867519}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496 [pid 5044] recvfrom(7, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=-925867519}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5044] close(7) = 0 [pid 5044] ioctl(6, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0 [pid 5044] sendmsg(6, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x2c\x00\x00\x00\x23\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2e\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x05\x00\x34\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", iov_len=44}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 44 [pid 5044] exit_group(0) = ? [pid 5044] +++ exited with 0 +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5044, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556479650) = 5045 [ 53.839839][ T2883] ret_from_fork+0x45/0x80 [ 53.844321][ T2883] ? kthread_complete_and_exit+0x40/0x40 [ 53.849986][ T2883] ret_from_fork_asm+0x11/0x20 [ 53.854842][ T2883] [ 53.857880][ T2883] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 53.865171][ T2883] CPU: 0 PID: 2883 Comm: kworker/u4:11 Not tainted 6.6.0-rc5-syzkaller-00250-g70f8c6f8f880 #0 [ 53.875456][ T2883] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023 ./strace-static-x86_64: Process 5045 attached [pid 5045] set_robust_list(0x555556479660, 24) = 0 [pid 5045] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 5045] setpgid(0, 0) = 0 [pid 5045] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 5045] write(3, "1000", 4) = 4 [pid 5045] close(3) = 0 [pid 5045] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3 [pid 5045] ioctl(3, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0 [pid 5045] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 [pid 5045] sendto(4, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5045] recvfrom(4, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5045}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496 [pid 5045] recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5045}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5045] close(4) = 0 [pid 5045] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x30\x00\x00\x00\x23\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x39\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x14\x00\x5a\x80\x10\x00\x00\x80\x06\x00\x02\x00\x00\x00\x00\x00\x04\x00\x01\x00", iov_len=48}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 48 [pid 5045] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4 [pid 5045] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 5 [pid 5045] sendto(5, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5045] recvfrom(5, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=-644294759}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496 [pid 5045] recvfrom(5, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=-644294759}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [pid 5045] close(5) = 0 [pid 5045] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 5 [pid 5045] ioctl(5, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0 [pid 5045] sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x24\x00\x00\x00\x23\x00\x05\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x08\x00\x05\x00\x02\x00\x00\x00", iov_len=36}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_DONTROUTE}, 0) = 36 [pid 5045] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 6 [pid 5045] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 7 [pid 5045] sendto(7, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32 [pid 5045] recvfrom(7, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=-930199605}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496 [pid 5045] recvfrom(7, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=-930199605}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36 [ 53.884547][ T5044] netlink: 8 bytes leftover after parsing attributes in process `syz-executor203'. [ 53.894804][ T2883] Workqueue: phy1 ieee80211_scan_work [ 53.900335][ T2883] Call Trace: [ 53.903615][ T2883] [ 53.906552][ T2883] dump_stack_lvl+0xd9/0x1b0 [ 53.911157][ T2883] panic+0x6a6/0x750 [ 53.915072][ T2883] ? panic_smp_self_stop+0xa0/0xa0 [ 53.920219][ T2883] ? __rate_control_send_low+0x6d7/0x800 [ 53.925876][ T2883] check_panic_on_warn+0xab/0xb0 [ 53.930845][ T2883] __warn+0xf2/0x380 [ 53.934751][ T2883] ? __rate_control_send_low+0x6d7/0x800 [ 53.940407][ T2883] report_bug+0x3bc/0x580 [ 53.944760][ T2883] handle_bug+0x3c/0x70 [ 53.948913][ T2883] exc_invalid_op+0x17/0x40 [ 53.953414][ T2883] asm_exc_invalid_op+0x1a/0x20 [ 53.958262][ T2883] RIP: 0010:__rate_control_send_low+0x6d7/0x800 [ 53.964495][ T2883] Code: 8b a4 a0 d4 00 00 00 e8 87 ae ce f7 44 8b 44 24 3c 45 89 e9 89 d9 48 8b 74 24 18 44 89 e2 48 c7 c7 40 18 c5 8b e8 a9 d6 94 f7 <0f> 0b e9 03 fd ff ff 48 8b 7c 24 30 e8 88 66 24 f8 e9 e5 fb ff ff [ 53.984105][ T2883] RSP: 0018:ffffc9000aac7578 EFLAGS: 00010282 [ 53.990161][ T2883] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 53.998124][ T2883] RDX: ffff888027693b80 RSI: ffffffff814df0c6 RDI: 0000000000000001 [ 54.006087][ T2883] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 [ 54.014130][ T2883] R10: 0000000000000000 R11: 0000000000000001 R12: 00000000ffffffff [ 54.022093][ T2883] R13: 0000000000000000 R14: 000000000000000c R15: dffffc0000000000 [ 54.030060][ T2883] ? __warn_printk+0x1a6/0x350 [ 54.034824][ T2883] ? __rate_control_send_low+0x6d7/0x800 [ 54.040457][ T2883] rate_control_send_low+0x296/0x820 [ 54.045828][ T2883] rate_control_get_rate+0x1be/0x590 [ 54.051117][ T2883] ieee80211_tx_h_rate_ctrl+0xa70/0x19d0 [ 54.056940][ T2883] ? mark_lock+0x105/0x1950 [ 54.061443][ T2883] ? ieee80211_probereq_get+0x290/0x290 [ 54.066996][ T2883] invoke_tx_handlers_late+0xd15/0x2c90 [ 54.072556][ T2883] ? ieee80211_queue_skb+0x472/0x1fb0 [ 54.078039][ T2883] ? ieee80211_ie_build_eht_cap+0x3e0/0x3e0 [ 54.083944][ T2883] ? invoke_tx_handlers_early+0x663/0x26c0 [ 54.089749][ T2883] ieee80211_tx+0x2ff/0x420 [ 54.094277][ T2883] ? ieee80211_tx_prepare_skb+0x470/0x470 [ 54.099998][ T2883] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 54.105988][ T2883] ? ieee80211_skb_resize+0x22a/0x620 [ 54.111352][ T2883] ? ieee80211_set_qos_hdr+0xba/0x3e0 [ 54.116738][ T2883] ieee80211_xmit+0x30e/0x3e0 [ 54.121509][ T2883] __ieee80211_tx_skb_tid_band+0x29b/0x6f0 [ 54.127329][ T2883] ieee80211_scan_state_send_probe+0x33a/0x970 [ 54.133497][ T2883] ieee80211_scan_work+0x6f8/0x1fb0 [ 54.138746][ T2883] ? lock_sync+0x190/0x190 [ 54.143158][ T2883] ? lock_sync+0x190/0x190 [ 54.147573][ T2883] ? reacquire_held_locks+0x4b0/0x4b0 [ 54.152942][ T2883] ? ieee80211_run_deferred_scan+0x340/0x340 [ 54.158926][ T2883] process_one_work+0x884/0x15c0 [ 54.163862][ T2883] ? lock_sync+0x190/0x190 [ 54.168273][ T2883] ? init_worker_pool+0x770/0x770 [ 54.173300][ T2883] ? assign_work+0x1a0/0x240 [ 54.177973][ T2883] worker_thread+0x8b9/0x1290 [ 54.182657][ T2883] ? process_one_work+0x15c0/0x15c0 [ 54.187863][ T2883] kthread+0x33c/0x440 [ 54.192009][ T2883] ? _raw_spin_unlock_irq+0x23/0x50 [ 54.197199][ T2883] ? kthread_complete_and_exit+0x40/0x40 [ 54.202840][ T2883] ret_from_fork+0x45/0x80 [ 54.207252][ T2883] ? kthread_complete_and_exit+0x40/0x40 [ 54.212877][ T2883] ret_from_fork_asm+0x11/0x20 [ 54.217646][ T2883] [ 54.221375][ T2883] Kernel Offset: disabled [ 54.225769][ T2883] Rebooting in 86400 seconds..