Starting Load/Save RF Kill Switch Status... [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.33' (ECDSA) to the list of known hosts. syzkaller login: [ 63.646861][ T6910] IPVS: ftp: loaded support on port[0] = 21 [ 63.724003][ T7] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 63.741660][ T7] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 63.757656][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready executing program [ 63.780827][ T7] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 63.789277][ T7] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 63.797013][ T6944] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 63.811280][ T6910] ================================================================================ [ 63.821540][ T6910] UBSAN: array-index-out-of-bounds in net/mac80211/cfg.c:524:9 [ 63.829187][ T6910] index 255 is out of range for type 'ieee80211_key *[8]' [ 63.836688][ T6910] CPU: 1 PID: 6910 Comm: syz-executor574 Not tainted 5.9.0-rc8-syzkaller #0 [ 63.845337][ T6910] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 63.855369][ T6910] Call Trace: [ 63.858642][ T6910] dump_stack+0x198/0x1fd [ 63.862950][ T6910] ubsan_epilogue+0xb/0x5a [ 63.867387][ T6910] __ubsan_handle_out_of_bounds.cold+0x62/0x6c [ 63.873695][ T6910] ? lock_is_held_type+0xbb/0xf0 [ 63.878615][ T6910] ieee80211_del_key+0x428/0x440 [ 63.883530][ T6910] nl80211_del_key+0x493/0x980 [ 63.888273][ T6910] ? cfg80211_tdls_oper_request+0x7f0/0x7f0 [ 63.894157][ T6910] ? nl80211_pre_doit+0xa2/0x630 [ 63.899070][ T6910] ? nl80211_dump_wiphy_parse.constprop.0+0x580/0x580 [ 63.905820][ T6910] genl_rcv_msg+0x61d/0x980 [ 63.910321][ T6910] ? genl_family_rcv_msg_attrs_parse.isra.0+0x250/0x250 [ 63.917351][ T6910] ? lock_release+0x8f0/0x8f0 [ 63.922027][ T6910] netlink_rcv_skb+0x15a/0x430 [ 63.926789][ T6910] ? genl_family_rcv_msg_attrs_parse.isra.0+0x250/0x250 [ 63.933711][ T6910] ? netlink_ack+0xa10/0xa10 [ 63.938388][ T6910] ? __kmalloc_node_track_caller+0x38/0x60 [ 63.944191][ T6910] genl_rcv+0x24/0x40 [ 63.948164][ T6910] netlink_unicast+0x533/0x7d0 [ 63.952924][ T6910] ? netlink_attachskb+0x810/0x810 [ 63.958038][ T6910] ? __phys_addr_symbol+0x2c/0x70 [ 63.963063][ T6910] ? __check_object_size+0x171/0x3e4 [ 63.968343][ T6910] netlink_sendmsg+0x856/0xd90 [ 63.973104][ T6910] ? netlink_unicast+0x7d0/0x7d0 [ 63.978141][ T6910] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 63.983429][ T6910] ? netlink_unicast+0x7d0/0x7d0 [ 63.988364][ T6910] sock_sendmsg+0xcf/0x120 [ 63.992774][ T6910] ____sys_sendmsg+0x6e8/0x810 [ 63.997540][ T6910] ? kernel_sendmsg+0x50/0x50 [ 64.002204][ T6910] ? do_recvmmsg+0x6d0/0x6d0 [ 64.006787][ T6910] ? lock_is_held_type+0xbb/0xf0 [ 64.011706][ T6910] ? find_held_lock+0x2d/0x110 [ 64.016476][ T6910] ? __might_fault+0x11f/0x1d0 [ 64.021220][ T6910] ___sys_sendmsg+0xf3/0x170 [ 64.025786][ T6910] ? sendmsg_copy_msghdr+0x160/0x160 [ 64.031050][ T6910] ? __might_fault+0x190/0x1d0 [ 64.035789][ T6910] ? _copy_to_user+0x126/0x160 [ 64.040533][ T6910] ? sock_do_ioctl+0x168/0x2d0 [ 64.045312][ T6910] ? compat_ifr_data_ioctl+0x150/0x150 [ 64.050750][ T6910] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 64.056635][ T6910] ? __fget_light+0x215/0x280 [ 64.061293][ T6910] __sys_sendmsg+0xe5/0x1b0 [ 64.065902][ T6910] ? __sys_sendmsg_sock+0xb0/0xb0 [ 64.071032][ T6910] ? check_preemption_disabled+0x50/0x130 [ 64.076734][ T6910] ? syscall_enter_from_user_mode+0x1d/0x60 [ 64.082608][ T6910] do_syscall_64+0x2d/0x70 [ 64.086997][ T6910] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 64.092863][ T6910] RIP: 0033:0x441759 [ 64.096735][ T6910] Code: e8 dc 05 03 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 0d fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 64.116489][ T6910] RSP: 002b:00007ffc4e8ac508 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 64.124877][ T6910] RAX: ffffffffffffffda RBX: 00007ffc4e8ac530 RCX: 0000000000441759 [ 64.132824][ T6910] RDX: 0000000000000000 RSI: 0000000020000400 RDI: 0000000000000003 [ 64.140769][ T6910] RBP: 0000000000000003 R08: 0000002000000000 R09: 0000002000000000 [ 64.148715][ T6910] R10: 0000002000000000 R11: 0000000000000246 R12: 0000000000000032 [ 64.156660][ T6910] R13: 0000000000000000 R14: 000000000000000c R15: 0000000000000004 [ 64.166737][ T6910] ================================================================================ [ 64.176073][ T6910] Kernel panic - not syncing: panic_on_warn set ... [ 64.182661][ T6910] CPU: 1 PID: 6910 Comm: syz-executor574 Not tainted 5.9.0-rc8-syzkaller #0 [ 64.191359][ T6910] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 64.201389][ T6910] Call Trace: [ 64.204672][ T6910] dump_stack+0x198/0x1fd [ 64.208981][ T6910] panic+0x382/0x7fb [ 64.212854][ T6910] ? __warn_printk+0xf3/0xf3 [ 64.217425][ T6910] ? ubsan_epilogue+0x3e/0x5a [ 64.222077][ T6910] ? ubsan_epilogue+0x35/0x5a [ 64.226743][ T6910] ubsan_epilogue+0x54/0x5a [ 64.231244][ T6910] __ubsan_handle_out_of_bounds.cold+0x62/0x6c [ 64.237373][ T6910] ? lock_is_held_type+0xbb/0xf0 [ 64.242289][ T6910] ieee80211_del_key+0x428/0x440 [ 64.247203][ T6910] nl80211_del_key+0x493/0x980 [ 64.251958][ T6910] ? cfg80211_tdls_oper_request+0x7f0/0x7f0 [ 64.257830][ T6910] ? nl80211_pre_doit+0xa2/0x630 [ 64.262746][ T6910] ? nl80211_dump_wiphy_parse.constprop.0+0x580/0x580 [ 64.269484][ T6910] genl_rcv_msg+0x61d/0x980 [ 64.273979][ T6910] ? genl_family_rcv_msg_attrs_parse.isra.0+0x250/0x250 [ 64.280899][ T6910] ? lock_release+0x8f0/0x8f0 [ 64.285557][ T6910] netlink_rcv_skb+0x15a/0x430 [ 64.290303][ T6910] ? genl_family_rcv_msg_attrs_parse.isra.0+0x250/0x250 [ 64.297210][ T6910] ? netlink_ack+0xa10/0xa10 [ 64.301780][ T6910] ? __kmalloc_node_track_caller+0x38/0x60 [ 64.307562][ T6910] genl_rcv+0x24/0x40 [ 64.311522][ T6910] netlink_unicast+0x533/0x7d0 [ 64.316266][ T6910] ? netlink_attachskb+0x810/0x810 [ 64.321364][ T6910] ? __phys_addr_symbol+0x2c/0x70 [ 64.326368][ T6910] ? __check_object_size+0x171/0x3e4 [ 64.331631][ T6910] netlink_sendmsg+0x856/0xd90 [ 64.336389][ T6910] ? netlink_unicast+0x7d0/0x7d0 [ 64.341319][ T6910] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 64.346595][ T6910] ? netlink_unicast+0x7d0/0x7d0 [ 64.351618][ T6910] sock_sendmsg+0xcf/0x120 [ 64.356009][ T6910] ____sys_sendmsg+0x6e8/0x810 [ 64.360748][ T6910] ? kernel_sendmsg+0x50/0x50 [ 64.365397][ T6910] ? do_recvmmsg+0x6d0/0x6d0 [ 64.369964][ T6910] ? lock_is_held_type+0xbb/0xf0 [ 64.374875][ T6910] ? find_held_lock+0x2d/0x110 [ 64.379614][ T6910] ? __might_fault+0x11f/0x1d0 [ 64.384367][ T6910] ___sys_sendmsg+0xf3/0x170 [ 64.388932][ T6910] ? sendmsg_copy_msghdr+0x160/0x160 [ 64.394193][ T6910] ? __might_fault+0x190/0x1d0 [ 64.398934][ T6910] ? _copy_to_user+0x126/0x160 [ 64.403674][ T6910] ? sock_do_ioctl+0x168/0x2d0 [ 64.408412][ T6910] ? compat_ifr_data_ioctl+0x150/0x150 [ 64.413859][ T6910] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 64.419729][ T6910] ? __fget_light+0x215/0x280 [ 64.424384][ T6910] __sys_sendmsg+0xe5/0x1b0 [ 64.428860][ T6910] ? __sys_sendmsg_sock+0xb0/0xb0 [ 64.433875][ T6910] ? check_preemption_disabled+0x50/0x130 [ 64.439582][ T6910] ? syscall_enter_from_user_mode+0x1d/0x60 [ 64.445451][ T6910] do_syscall_64+0x2d/0x70 [ 64.449841][ T6910] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 64.455714][ T6910] RIP: 0033:0x441759 [ 64.459585][ T6910] Code: e8 dc 05 03 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b 0d fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 64.479169][ T6910] RSP: 002b:00007ffc4e8ac508 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 64.487555][ T6910] RAX: ffffffffffffffda RBX: 00007ffc4e8ac530 RCX: 0000000000441759 [ 64.495501][ T6910] RDX: 0000000000000000 RSI: 0000000020000400 RDI: 0000000000000003 [ 64.503459][ T6910] RBP: 0000000000000003 R08: 0000002000000000 R09: 0000002000000000 [ 64.511404][ T6910] R10: 0000002000000000 R11: 0000000000000246 R12: 0000000000000032 [ 64.519348][ T6910] R13: 0000000000000000 R14: 000000000000000c R15: 0000000000000004 [ 64.528638][ T6910] Kernel Offset: disabled [ 64.533009][ T6910] Rebooting in 86400 seconds..