[ OK ] Started Getty on tty4. [ OK ] Started Getty on tty3. [ OK ] Started Getty on tty2. [ OK ] Started Serial Getty on ttyS0. [ OK ] Started Getty on tty1. [ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.131' (ECDSA) to the list of known hosts. syzkaller login: [ 62.911193][ T6877] IPVS: ftp: loaded support on port[0] = 21 [ 62.991922][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 63.004880][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 executing program [ 63.040005][ T57] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 63.048029][ T57] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 63.052850][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 63.065520][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 63.078228][ T6877] ================================================================================ [ 63.087700][ T6877] UBSAN: array-index-out-of-bounds in net/mac80211/cfg.c:524:9 [ 63.095411][ T6877] index 255 is out of range for type 'ieee80211_key *[8]' [ 63.102813][ T6877] CPU: 0 PID: 6877 Comm: syz-executor819 Not tainted 5.9.0-rc8-syzkaller #0 [ 63.111488][ T6877] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 63.121547][ T6877] Call Trace: [ 63.124841][ T6877] dump_stack+0x198/0x1fd [ 63.129167][ T6877] ubsan_epilogue+0xb/0x5a [ 63.133593][ T6877] __ubsan_handle_out_of_bounds.cold+0x62/0x6c [ 63.139829][ T6877] ? lock_is_held_type+0xbb/0xf0 [ 63.144810][ T6877] ieee80211_del_key+0x428/0x440 [ 63.149752][ T6877] nl80211_del_key+0x493/0x980 [ 63.154512][ T6877] ? cfg80211_tdls_oper_request+0x7f0/0x7f0 [ 63.160409][ T6877] ? nl80211_pre_doit+0xa2/0x630 [ 63.165362][ T6877] ? nl80211_dump_wiphy_parse.constprop.0+0x580/0x580 [ 63.172124][ T6877] genl_rcv_msg+0x61d/0x980 [ 63.176635][ T6877] ? genl_family_rcv_msg_attrs_parse.isra.0+0x250/0x250 [ 63.183598][ T6877] ? lock_release+0x8f0/0x8f0 [ 63.188278][ T6877] netlink_rcv_skb+0x15a/0x430 [ 63.193041][ T6877] ? genl_family_rcv_msg_attrs_parse.isra.0+0x250/0x250 [ 63.199972][ T6877] ? netlink_ack+0xa10/0xa10 [ 63.204569][ T6877] ? __kmalloc_node_track_caller+0x38/0x60 [ 63.210376][ T6877] genl_rcv+0x24/0x40 [ 63.214358][ T6877] netlink_unicast+0x533/0x7d0 [ 63.219120][ T6877] ? netlink_attachskb+0x810/0x810 [ 63.224226][ T6877] ? __phys_addr_symbol+0x2c/0x70 [ 63.229253][ T6877] ? __check_object_size+0x171/0x3e4 [ 63.234566][ T6877] netlink_sendmsg+0x856/0xd90 [ 63.239344][ T6877] ? netlink_unicast+0x7d0/0x7d0 [ 63.244287][ T6877] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 63.249566][ T6877] ? netlink_unicast+0x7d0/0x7d0 [ 63.254494][ T6877] sock_sendmsg+0xcf/0x120 [ 63.258907][ T6877] ____sys_sendmsg+0x6e8/0x810 [ 63.263669][ T6877] ? kernel_sendmsg+0x50/0x50 [ 63.268333][ T6877] ? do_recvmmsg+0x6d0/0x6d0 [ 63.272935][ T6877] ? lock_is_held_type+0xbb/0xf0 [ 63.277869][ T6877] ? find_held_lock+0x2d/0x110 [ 63.282631][ T6877] ? __might_fault+0x11f/0x1d0 [ 63.287392][ T6877] ___sys_sendmsg+0xf3/0x170 [ 63.291980][ T6877] ? sendmsg_copy_msghdr+0x160/0x160 [ 63.297268][ T6877] ? __might_fault+0x190/0x1d0 [ 63.302027][ T6877] ? _copy_to_user+0x126/0x160 [ 63.306789][ T6877] ? sock_do_ioctl+0x168/0x2d0 [ 63.311548][ T6877] ? compat_ifr_data_ioctl+0x150/0x150 [ 63.317008][ T6877] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 63.322901][ T6877] ? __fget_light+0x215/0x280 [ 63.327578][ T6877] __sys_sendmsg+0xe5/0x1b0 [ 63.332076][ T6877] ? __sys_sendmsg_sock+0xb0/0xb0 [ 63.337114][ T6877] ? check_preemption_disabled+0x50/0x130 [ 63.342833][ T6877] ? syscall_enter_from_user_mode+0x1d/0x60 [ 63.348727][ T6877] do_syscall_64+0x2d/0x70 [ 63.353140][ T6877] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 63.359024][ T6877] RIP: 0033:0x4426e9 [ 63.362914][ T6877] Code: e8 ac 0e 03 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b 0b fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 63.382509][ T6877] RSP: 002b:00007ffe09708968 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 63.390913][ T6877] RAX: ffffffffffffffda RBX: 00007ffe097089a0 RCX: 00000000004426e9 [ 63.398881][ T6877] RDX: 0000000000000000 RSI: 0000000020000380 RDI: 0000000000000003 [ 63.406885][ T6877] RBP: 0000000000000032 R08: 00000000006d5c64 R09: 00000000006d5c64 [ 63.414842][ T6877] R10: 00000000006d5c64 R11: 0000000000000246 R12: 0000000000000003 [ 63.422856][ T6877] R13: 0000000000000000 R14: 000000000000000d R15: 0000000000000004 [ 63.433369][ T6877] ================================================================================ [ 63.443287][ T6877] Kernel panic - not syncing: panic_on_warn set ... [ 63.449899][ T6877] CPU: 0 PID: 6877 Comm: syz-executor819 Not tainted 5.9.0-rc8-syzkaller #0 [ 63.458578][ T6877] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 63.468616][ T6877] Call Trace: [ 63.471914][ T6877] dump_stack+0x198/0x1fd [ 63.477451][ T6877] panic+0x382/0x7fb [ 63.481413][ T6877] ? __warn_printk+0xf3/0xf3 [ 63.486052][ T6877] ? ubsan_epilogue+0x3e/0x5a [ 63.490710][ T6877] ? ubsan_epilogue+0x35/0x5a [ 63.495372][ T6877] ubsan_epilogue+0x54/0x5a [ 63.499871][ T6877] __ubsan_handle_out_of_bounds.cold+0x62/0x6c [ 63.506027][ T6877] ? lock_is_held_type+0xbb/0xf0 [ 63.510952][ T6877] ieee80211_del_key+0x428/0x440 [ 63.515877][ T6877] nl80211_del_key+0x493/0x980 [ 63.520628][ T6877] ? cfg80211_tdls_oper_request+0x7f0/0x7f0 [ 63.526512][ T6877] ? nl80211_pre_doit+0xa2/0x630 [ 63.531440][ T6877] ? nl80211_dump_wiphy_parse.constprop.0+0x580/0x580 [ 63.538190][ T6877] genl_rcv_msg+0x61d/0x980 [ 63.542688][ T6877] ? genl_family_rcv_msg_attrs_parse.isra.0+0x250/0x250 [ 63.549665][ T6877] ? lock_release+0x8f0/0x8f0 [ 63.554329][ T6877] netlink_rcv_skb+0x15a/0x430 [ 63.559075][ T6877] ? genl_family_rcv_msg_attrs_parse.isra.0+0x250/0x250 [ 63.565991][ T6877] ? netlink_ack+0xa10/0xa10 [ 63.570569][ T6877] ? __kmalloc_node_track_caller+0x38/0x60 [ 63.576385][ T6877] genl_rcv+0x24/0x40 [ 63.580350][ T6877] netlink_unicast+0x533/0x7d0 [ 63.585099][ T6877] ? netlink_attachskb+0x810/0x810 [ 63.590242][ T6877] ? __phys_addr_symbol+0x2c/0x70 [ 63.595248][ T6877] ? __check_object_size+0x171/0x3e4 [ 63.600516][ T6877] netlink_sendmsg+0x856/0xd90 [ 63.605265][ T6877] ? netlink_unicast+0x7d0/0x7d0 [ 63.610192][ T6877] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 63.615458][ T6877] ? netlink_unicast+0x7d0/0x7d0 [ 63.620377][ T6877] sock_sendmsg+0xcf/0x120 [ 63.624820][ T6877] ____sys_sendmsg+0x6e8/0x810 [ 63.629567][ T6877] ? kernel_sendmsg+0x50/0x50 [ 63.634223][ T6877] ? do_recvmmsg+0x6d0/0x6d0 [ 63.638798][ T6877] ? lock_is_held_type+0xbb/0xf0 [ 63.643723][ T6877] ? find_held_lock+0x2d/0x110 [ 63.648468][ T6877] ? __might_fault+0x11f/0x1d0 [ 63.653215][ T6877] ___sys_sendmsg+0xf3/0x170 [ 63.657787][ T6877] ? sendmsg_copy_msghdr+0x160/0x160 [ 63.663055][ T6877] ? __might_fault+0x190/0x1d0 [ 63.667798][ T6877] ? _copy_to_user+0x126/0x160 [ 63.672547][ T6877] ? sock_do_ioctl+0x168/0x2d0 [ 63.677292][ T6877] ? compat_ifr_data_ioctl+0x150/0x150 [ 63.682733][ T6877] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 63.688611][ T6877] ? __fget_light+0x215/0x280 [ 63.693274][ T6877] __sys_sendmsg+0xe5/0x1b0 [ 63.697761][ T6877] ? __sys_sendmsg_sock+0xb0/0xb0 [ 63.702776][ T6877] ? check_preemption_disabled+0x50/0x130 [ 63.708478][ T6877] ? syscall_enter_from_user_mode+0x1d/0x60 [ 63.714353][ T6877] do_syscall_64+0x2d/0x70 [ 63.718748][ T6877] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 63.724617][ T6877] RIP: 0033:0x4426e9 [ 63.728493][ T6877] Code: e8 ac 0e 03 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b 0b fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 63.748075][ T6877] RSP: 002b:00007ffe09708968 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 63.756466][ T6877] RAX: ffffffffffffffda RBX: 00007ffe097089a0 RCX: 00000000004426e9 [ 63.764416][ T6877] RDX: 0000000000000000 RSI: 0000000020000380 RDI: 0000000000000003 [ 63.772383][ T6877] RBP: 0000000000000032 R08: 00000000006d5c64 R09: 00000000006d5c64 [ 63.780333][ T6877] R10: 00000000006d5c64 R11: 0000000000000246 R12: 0000000000000003 [ 63.788284][ T6877] R13: 0000000000000000 R14: 000000000000000d R15: 0000000000000004 [ 63.797707][ T6877] Kernel Offset: disabled [ 63.802090][ T6877] Rebooting in 86400 seconds..