./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor3287561941
<...>
DUID 00:04:e3:a1:4c:5b:a4:47:39:93:9a:5d:f6:69:14:97:a9:57
forked to background, child pid 3178
[ 27.496416][ T3179] 8021q: adding VLAN 0 to HW filter on device bond0
[ 27.509923][ T3179] eql: remember to turn off Van-Jacobson compression on your slave devices
Starting sshd: OK
syzkaller
Warning: Permanently added '10.128.0.37' (ECDSA) to the list of known hosts.
execve("./syz-executor3287561941", ["./syz-executor3287561941"], 0x7ffd5e879a00 /* 10 vars */) = 0
brk(NULL) = 0x555556242000
brk(0x555556242c40) = 0x555556242c40
arch_prctl(ARCH_SET_FS, 0x555556242300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor3287561941", 4096) = 28
brk(0x555556263c40) = 0x555556263c40
brk(0x555556264000) = 0x555556264000
mprotect(0x7f187b844000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3
socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4
sendto(4, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32
recvfrom(4, [{nlmsg_len=2416, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=3600}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x22\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x3b\x01\x00\x00\x9c\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2416
recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=3600}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
close(4) = 0
ioctl(3, SIOCGIFINDEX, {ifr_name="wlan0", ifr_ifindex=8}) = 0
sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x24\x00\x00\x00\x22\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x08\x00\x03\x00\x08\x00\x00\x00\x08\x00\x05\x00\x03\x00\x00\x00", iov_len=36}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 36
socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4
sendto(4, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32
recvfrom(4, [{nlmsg_len=2416, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=-2021962151}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x22\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x3b\x01\x00\x00\x9c\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2416
recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=-2021962151}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
close(4) = 0
syzkaller login: [ 50.484218][ T3600] ------------[ cut here ]------------
[ 50.489799][ T3600] WARNING: CPU: 0 PID: 3600 at net/mac80211/cfg.c:3868 ieee80211_probe_client+0x706/0x800
[ 50.500140][ T3600] Modules linked in:
[ 50.504505][ T3600] CPU: 0 PID: 3600 Comm: syz-executor328 Not tainted 5.19.0-rc4-next-20220628-syzkaller #0
[ 50.514584][ T3600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[ 50.524702][ T3600] RIP: 0010:ieee80211_probe_client+0x706/0x800
[ 50.530860][ T3600] Code: 0e de 04 01 e8 ff 97 6a 00 e9 4e fe ff ff e8 b1 b8 b0 f8 be 01 00 00 00 4c 89 ff e8 d4 34 84 fe e9 1a fe ff ff e8 9a b8 b0 f8 <0f> 0b 41 bc ea ff ff ff e9 08 fe ff ff 48 89 ef e8 a5 bd fc f8 e9
[ 50.550584][ T3600] RSP: 0018:ffffc90002d6f4f8 EFLAGS: 00010293
[ 50.556685][ T3600] RAX: 0000000000000000 RBX: ffff88801ff10000 RCX: 0000000000000000
[ 50.564771][ T3600] RDX: ffff88801f493a80 RSI: ffffffff88c9fe76 RDI: 0000000000000005
[ 50.572750][ T3600] RBP: ffff88801f6e3c5c R08: 0000000000000005 R09: 0000000000000000
[ 50.580749][ T3600] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88801ffc8de0
[ 50.589003][ T3600] R13: 0000000000000000 R14: 0000000000000001 R15: ffffc90002d6f67c
[ 50.597015][ T3600] FS: 0000555556242300(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
[ 50.606273][ T3600] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 50.612882][ T3600] CR2: 00000000005decc0 CR3: 000000001cb98000 CR4: 00000000003506f0
[ 50.620907][ T3600] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 50.628958][ T3600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 50.637250][ T3600] Call Trace:
[ 50.640534][ T3600]
[ 50.643464][ T3600] nl80211_probe_client+0x3a4/0xb90
[ 50.648845][ T3600] ? nl80211_probe_mesh_link+0xa20/0xa20
[ 50.654551][ T3600] ? nl80211_pre_doit+0x11c/0xaa0
[ 50.659585][ T3600] genl_family_rcv_msg_doit+0x228/0x320
[ 50.665197][ T3600] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x290/0x290
[ 50.672598][ T3600] ? ns_capable+0xd9/0x100
[ 50.677062][ T3600] genl_rcv_msg+0x328/0x580
[ 50.681597][ T3600] ? genl_get_cmd+0x480/0x480
[ 50.686344][ T3600] ? nl80211_probe_mesh_link+0xa20/0xa20
[ 50.692004][ T3600] ? lock_release+0x780/0x780
[ 50.696947][ T3600] netlink_rcv_skb+0x153/0x420
[ 50.701726][ T3600] ? genl_get_cmd+0x480/0x480
[ 50.706466][ T3600] ? netlink_ack+0xa80/0xa80
[ 50.711079][ T3600] ? netlink_deliver_tap+0x1b1/0xc40
[ 50.716428][ T3600] genl_rcv+0x24/0x40
[ 50.720449][ T3600] netlink_unicast+0x543/0x7f0
[ 50.725366][ T3600] ? netlink_attachskb+0x880/0x880
[ 50.730505][ T3600] ? __phys_addr+0xc4/0x140
[ 50.735065][ T3600] ? __phys_addr_symbol+0x2c/0x70
[ 50.740108][ T3600] ? __check_object_size+0x2de/0x700
[ 50.745468][ T3600] netlink_sendmsg+0x917/0xe10
[ 50.750254][ T3600] ? netlink_unicast+0x7f0/0x7f0
[ 50.755232][ T3600] ? bpf_lsm_socket_sendmsg+0x5/0x10
[ 50.760532][ T3600] ? netlink_unicast+0x7f0/0x7f0
[ 50.765525][ T3600] sock_sendmsg+0xcf/0x120
[ 50.769959][ T3600] ____sys_sendmsg+0x6eb/0x810
[ 50.774758][ T3600] ? kernel_sendmsg+0x50/0x50
[ 50.779451][ T3600] ? do_recvmmsg+0x6d0/0x6d0
[ 50.784135][ T3600] ? lockdep_hardirqs_on_prepare+0x400/0x400
[ 50.790132][ T3600] ? lockdep_hardirqs_on+0x79/0x100
[ 50.795389][ T3600] ___sys_sendmsg+0xf3/0x170
[ 50.800005][ T3600] ? sendmsg_copy_msghdr+0x160/0x160
[ 50.805360][ T3600] ? lock_release+0x780/0x780
[ 50.810048][ T3600] ? ptrace_stop.part.0+0x5ec/0xa80
[ 50.815287][ T3600] ? do_raw_spin_lock+0x120/0x2a0
[ 50.820329][ T3600] ? rwlock_bug.part.0+0x90/0x90
[ 50.825320][ T3600] ? _raw_spin_lock_irq+0x41/0x50
[ 50.830371][ T3600] ? __fget_light+0x20a/0x270
[ 50.835112][ T3600] __x64_sys_sendmsg+0x132/0x220
[ 50.840078][ T3600] ? __sys_sendmsg+0x1b0/0x1b0
[ 50.844948][ T3600] ? _raw_spin_unlock_irq+0x2a/0x40
[ 50.850178][ T3600] ? ptrace_notify+0xfa/0x140
[ 50.854926][ T3600] do_syscall_64+0x35/0xb0
[ 50.859355][ T3600] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 50.865300][ T3600] RIP: 0033:0x7f187b7d7e59
[ 50.869721][ T3600] Code: 28 c3 e8 5a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 50.889378][ T3600] RSP: 002b:00007ffc234d90b8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 50.897860][ T3600] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f187b7d7e59
[ 50.905894][ T3600] RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000003
[ 50.913873][ T3600] RBP: 00007f187b79b820 R08: 000000000000000a R09: 0000000000000000
[ 50.921884][ T3600] R10: 0000000000000006 R11: 0000000000000246 R12: 00007f187b79b8b0
[ 50.929903][ T3600] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 50.937929][ T3600]
[ 50.940955][ T3600] Kernel panic - not syncing: panic_on_warn set ...
[ 50.947525][ T3600] CPU: 0 PID: 3600 Comm: syz-executor328 Not tainted 5.19.0-rc4-next-20220628-syzkaller #0
[ 50.957498][ T3600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
[ 50.967548][ T3600] Call Trace:
[ 50.970829][ T3600]
[ 50.973759][ T3600] dump_stack_lvl+0xcd/0x134
[ 50.978360][ T3600] panic+0x2d7/0x636
[ 50.982354][ T3600] ? panic_print_sys_info.part.0+0x10b/0x10b
[ 50.988350][ T3600] ? __warn.cold+0x248/0x2c4
[ 50.992946][ T3600] ? ieee80211_probe_client+0x706/0x800
[ 50.998601][ T3600] __warn.cold+0x259/0x2c4
[ 51.003039][ T3600] ? ieee80211_probe_client+0x706/0x800
[ 51.008598][ T3600] report_bug+0x1bc/0x210
[ 51.012948][ T3600] handle_bug+0x3c/0x60
[ 51.017111][ T3600] exc_invalid_op+0x14/0x40
[ 51.021626][ T3600] asm_exc_invalid_op+0x1b/0x20
[ 51.026482][ T3600] RIP: 0010:ieee80211_probe_client+0x706/0x800
[ 51.032642][ T3600] Code: 0e de 04 01 e8 ff 97 6a 00 e9 4e fe ff ff e8 b1 b8 b0 f8 be 01 00 00 00 4c 89 ff e8 d4 34 84 fe e9 1a fe ff ff e8 9a b8 b0 f8 <0f> 0b 41 bc ea ff ff ff e9 08 fe ff ff 48 89 ef e8 a5 bd fc f8 e9
[ 51.052258][ T3600] RSP: 0018:ffffc90002d6f4f8 EFLAGS: 00010293
[ 51.058336][ T3600] RAX: 0000000000000000 RBX: ffff88801ff10000 RCX: 0000000000000000
[ 51.066318][ T3600] RDX: ffff88801f493a80 RSI: ffffffff88c9fe76 RDI: 0000000000000005
[ 51.074293][ T3600] RBP: ffff88801f6e3c5c R08: 0000000000000005 R09: 0000000000000000
[ 51.082269][ T3600] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88801ffc8de0
[ 51.090256][ T3600] R13: 0000000000000000 R14: 0000000000000001 R15: ffffc90002d6f67c
[ 51.098259][ T3600] ? ieee80211_probe_client+0x706/0x800
[ 51.103831][ T3600] ? ieee80211_probe_client+0x706/0x800
[ 51.109404][ T3600] nl80211_probe_client+0x3a4/0xb90
[ 51.114617][ T3600] ? nl80211_probe_mesh_link+0xa20/0xa20
[ 51.120268][ T3600] ? nl80211_pre_doit+0x11c/0xaa0
[ 51.125320][ T3600] genl_family_rcv_msg_doit+0x228/0x320
[ 51.130896][ T3600] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x290/0x290
[ 51.138328][ T3600] ? ns_capable+0xd9/0x100
[ 51.142761][ T3600] genl_rcv_msg+0x328/0x580
[ 51.147305][ T3600] ? genl_get_cmd+0x480/0x480
[ 51.152002][ T3600] ? nl80211_probe_mesh_link+0xa20/0xa20
[ 51.157650][ T3600] ? lock_release+0x780/0x780
[ 51.162338][ T3600] netlink_rcv_skb+0x153/0x420
[ 51.167126][ T3600] ? genl_get_cmd+0x480/0x480
[ 51.171809][ T3600] ? netlink_ack+0xa80/0xa80
[ 51.176408][ T3600] ? netlink_deliver_tap+0x1b1/0xc40
[ 51.181705][ T3600] genl_rcv+0x24/0x40
[ 51.185732][ T3600] netlink_unicast+0x543/0x7f0
[ 51.190527][ T3600] ? netlink_attachskb+0x880/0x880
[ 51.195658][ T3600] ? __phys_addr+0xc4/0x140
[ 51.200186][ T3600] ? __phys_addr_symbol+0x2c/0x70
[ 51.205219][ T3600] ? __check_object_size+0x2de/0x700
[ 51.210518][ T3600] netlink_sendmsg+0x917/0xe10
[ 51.215301][ T3600] ? netlink_unicast+0x7f0/0x7f0
[ 51.220259][ T3600] ? bpf_lsm_socket_sendmsg+0x5/0x10
[ 51.225553][ T3600] ? netlink_unicast+0x7f0/0x7f0
[ 51.230496][ T3600] sock_sendmsg+0xcf/0x120
[ 51.234916][ T3600] ____sys_sendmsg+0x6eb/0x810
[ 51.239687][ T3600] ? kernel_sendmsg+0x50/0x50
[ 51.244382][ T3600] ? do_recvmmsg+0x6d0/0x6d0
[ 51.248983][ T3600] ? lockdep_hardirqs_on_prepare+0x400/0x400
[ 51.254963][ T3600] ? lockdep_hardirqs_on+0x79/0x100
[ 51.260172][ T3600] ___sys_sendmsg+0xf3/0x170
[ 51.264769][ T3600] ? sendmsg_copy_msghdr+0x160/0x160
[ 51.270064][ T3600] ? lock_release+0x780/0x780
[ 51.274737][ T3600] ? ptrace_stop.part.0+0x5ec/0xa80
[ 51.279940][ T3600] ? do_raw_spin_lock+0x120/0x2a0
[ 51.284966][ T3600] ? rwlock_bug.part.0+0x90/0x90
[ 51.289897][ T3600] ? _raw_spin_lock_irq+0x41/0x50
[ 51.294937][ T3600] ? __fget_light+0x20a/0x270
[ 51.299626][ T3600] __x64_sys_sendmsg+0x132/0x220
[ 51.304569][ T3600] ? __sys_sendmsg+0x1b0/0x1b0
[ 51.309348][ T3600] ? _raw_spin_unlock_irq+0x2a/0x40
[ 51.314552][ T3600] ? ptrace_notify+0xfa/0x140
[ 51.319233][ T3600] do_syscall_64+0x35/0xb0
[ 51.323652][ T3600] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 51.329542][ T3600] RIP: 0033:0x7f187b7d7e59
[ 51.333954][ T3600] Code: 28 c3 e8 5a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 51.353557][ T3600] RSP: 002b:00007ffc234d90b8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 51.361965][ T3600] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f187b7d7e59
[ 51.369933][ T3600] RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000003
[ 51.377913][ T3600] RBP: 00007f187b79b820 R08: 000000000000000a R09: 0000000000000000
[ 51.385883][ T3600] R10: 0000000000000006 R11: 0000000000000246 R12: 00007f187b79b8b0
[ 51.393848][ T3600] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 51.401829][ T3600]
[ 51.405125][ T3600] Kernel Offset: disabled
[ 51.409516][ T3600] Rebooting in 86400 seconds..