./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor754229776 <...> Warning: Permanently added '10.128.0.177' (ED25519) to the list of known hosts. execve("./syz-executor754229776", ["./syz-executor754229776"], 0x7ffeaf721600 /* 10 vars */) = 0 brk(NULL) = 0x555556296000 brk(0x555556296d00) = 0x555556296d00 arch_prctl(ARCH_SET_FS, 0x555556296380) = 0 set_tid_address(0x555556296650) = 5038 set_robust_list(0x555556296660, 24) = 0 rseq(0x555556296ca0, 0x20, 0, 0x53053053) = 0 prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor754229776", 4096) = 27 getrandom("\x96\x23\xfb\xd7\xa1\xcc\x2c\x49", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555556296d00 brk(0x5555562b7d00) = 0x5555562b7d00 brk(0x5555562b8000) = 0x5555562b8000 mprotect(0x7ff1ff1c5000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3 [ 83.125549][ T5038] netlink: 'syz-executor754': attribute type 27 has an invalid length. [ 83.325311][ T5038] ------------[ cut here ]------------ [ 83.330815][ T5038] wlan1: Failed check-sdata-in-driver check, flags: 0x0 [ 83.339583][ T5038] WARNING: CPU: 0 PID: 5038 at net/mac80211/main.c:236 ieee80211_bss_info_change_notify+0x2c9/0x820 [ 83.350471][ T5038] Modules linked in: [ 83.354418][ T5038] CPU: 0 PID: 5038 Comm: syz-executor754 Not tainted 6.5.0-rc5-next-20230809-syzkaller #0 [ 83.364347][ T5038] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 [ 83.374445][ T5038] RIP: 0010:ieee80211_bss_info_change_notify+0x2c9/0x820 [ 83.381654][ T5038] Code: 00 00 e8 7a f9 db f7 48 8b 74 24 08 48 89 74 24 08 e8 6b f9 db f7 8b 14 24 48 c7 c7 20 90 a3 8b 48 8b 74 24 08 e8 f7 30 a2 f7 <0f> 0b e8 50 f9 db f7 4c 89 f2 48 b8 00 00 00 00 00 fc ff df 48 c1 [ 83.401380][ T5038] RSP: 0018:ffffc90003bdf520 EFLAGS: 00010286 [ 83.407479][ T5038] RAX: 0000000000000000 RBX: ffff88801fa18c80 RCX: 0000000000000000 [ 83.415521][ T5038] RDX: ffff888025901dc0 RSI: ffffffff814e00c6 RDI: 0000000000000001 [ 83.423553][ T5038] RBP: 0000000000400000 R08: 0000000000000001 R09: 0000000000000000 [ 83.431629][ T5038] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88801f7d8e20 [ 83.439623][ T5038] R13: ffff88801fa1a898 R14: ffff88801fa19588 R15: 0000000000000000 [ 83.447694][ T5038] FS: 0000555556296380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 [ 83.456684][ T5038] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 83.463340][ T5038] CR2: 00000000005fdeb8 CR3: 0000000073ff5000 CR4: 00000000003506f0 [ 83.471365][ T5038] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 83.479387][ T5038] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 83.487611][ T5038] Call Trace: [ 83.490959][ T5038] [ 83.493903][ T5038] ? show_regs+0x8f/0xa0 [ 83.498181][ T5038] ? __warn+0xe6/0x380 [ 83.502326][ T5038] ? ieee80211_bss_info_change_notify+0x2c9/0x820 [ 83.508822][ T5038] ? report_bug+0x3bc/0x580 [ 83.513419][ T5038] ? handle_bug+0x3c/0x70 [ 83.517771][ T5038] ? exc_invalid_op+0x17/0x40 [ 83.522662][ T5038] ? asm_exc_invalid_op+0x1a/0x20 [ 83.527751][ T5038] ? __warn_printk+0x1a6/0x350 [ 83.532598][ T5038] ? ieee80211_bss_info_change_notify+0x2c9/0x820 [ 83.539074][ T5038] ? trace_irq_enable.constprop.0+0xd0/0x100 [ 83.545527][ T5038] ieee80211_ocb_leave+0x256/0x3d0 [ 83.550642][ T5038] __cfg80211_leave_ocb+0x1eb/0x480 [ 83.556353][ T5038] cfg80211_leave_ocb+0x51/0x70 [ 83.561462][ T5038] cfg80211_change_iface+0x869/0xdf0 [ 83.566746][ T5038] nl80211_set_interface+0x708/0x9b0 [ 83.572414][ T5038] ? nl80211_notify_iface+0x190/0x190 [ 83.577817][ T5038] ? nl80211_pre_doit+0x713/0xb00 [ 83.583247][ T5038] ? nl80211_pre_doit+0x1b0/0xb00 [ 83.588286][ T5038] genl_family_rcv_msg_doit.isra.0+0x1ef/0x2d0 [ 83.594871][ T5038] ? genl_start+0x650/0x650 [ 83.599445][ T5038] ? ns_capable+0xd5/0x110 [ 83.604412][ T5038] genl_rcv_msg+0x559/0x800 [ 83.609042][ T5038] ? genl_family_rcv_msg_doit.isra.0+0x2d0/0x2d0 [ 83.615863][ T5038] ? nl80211_post_doit+0x2f0/0x2f0 [ 83.621301][ T5038] ? nl80211_notify_iface+0x190/0x190 [ 83.626668][ T5038] ? nl80211_parse_sta_wme+0x3d0/0x3d0 [ 83.632163][ T5038] netlink_rcv_skb+0x16b/0x440 [ 83.636959][ T5038] ? genl_family_rcv_msg_doit.isra.0+0x2d0/0x2d0 [ 83.643451][ T5038] ? netlink_ack+0x1370/0x1370 [ 83.648211][ T5038] ? rcu_is_watching+0x12/0xb0 [ 83.653007][ T5038] ? down_write+0x200/0x200 [ 83.657527][ T5038] ? netlink_deliver_tap+0x1b1/0xd00 [ 83.662841][ T5038] genl_rcv+0x28/0x40 [ 83.666836][ T5038] netlink_unicast+0x539/0x800 [ 83.671634][ T5038] ? netlink_attachskb+0x880/0x880 [ 83.676764][ T5038] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 83.682687][ T5038] ? __phys_addr_symbol+0x30/0x70 [ 83.687728][ T5038] ? __check_object_size+0x323/0x740 [ 83.693049][ T5038] netlink_sendmsg+0x93c/0xe40 [ 83.697831][ T5038] ? netlink_unicast+0x800/0x800 [ 83.702799][ T5038] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 83.708199][ T5038] ? netlink_unicast+0x800/0x800 [ 83.713196][ T5038] sock_sendmsg+0xd9/0x180 [ 83.717634][ T5038] __sys_sendto+0x255/0x340 [ 83.722161][ T5038] ? __ia32_sys_getpeername+0xb0/0xb0 [ 83.727579][ T5038] ? cgroup_update_frozen+0x144/0x6b0 [ 83.732999][ T5038] ? rcu_is_watching+0x12/0xb0 [ 83.737778][ T5038] ? rcu_is_watching+0x12/0xb0 [ 83.742570][ T5038] ? trace_irq_enable.constprop.0+0xd0/0x100 [ 83.748586][ T5038] __x64_sys_sendto+0xe0/0x1b0 [ 83.753417][ T5038] ? syscall_trace_enter.constprop.0+0xaf/0x1e0 [ 83.759691][ T5038] do_syscall_64+0x38/0xb0 [ 83.764201][ T5038] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 83.770226][ T5038] RIP: 0033:0x7ff1ff150153 [ 83.774687][ T5038] Code: 64 89 02 48 c7 c0 ff ff ff ff eb b7 66 2e 0f 1f 84 00 00 00 00 00 90 80 3d 71 9f 07 00 00 41 89 ca 74 14 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 75 c3 0f 1f 40 00 55 48 83 ec 30 44 89 4c 24 [ 83.794334][ T5038] RSP: 002b:00007ffec35443f8 EFLAGS: 00000202 ORIG_RAX: 000000000000002c [ 83.802764][ T5038] RAX: ffffffffffffffda RBX: 00007ffec35444d0 RCX: 00007ff1ff150153 [ 83.810746][ T5038] RDX: 0000000000000024 RSI: 00007ffec3544520 RDI: 0000000000000006 [ 83.818742][ T5038] RBP: 0000000000000006 R08: 00007ffec3544414 R09: 000000000000000c [ 83.826744][ T5038] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000001 [ 83.834735][ T5038] R13: 0000000000000000 R14: 00007ffec3544520 R15: 0000000000000000 [ 83.842750][ T5038] [ 83.845759][ T5038] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 83.853043][ T5038] CPU: 0 PID: 5038 Comm: syz-executor754 Not tainted 6.5.0-rc5-next-20230809-syzkaller #0 [ 83.862941][ T5038] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 [ 83.873066][ T5038] Call Trace: [ 83.876329][ T5038] [ 83.879245][ T5038] dump_stack_lvl+0xd9/0x1b0 [ 83.883843][ T5038] panic+0x6a6/0x750 [ 83.887728][ T5038] ? panic_smp_self_stop+0xa0/0xa0 [ 83.892977][ T5038] ? ieee80211_bss_info_change_notify+0x2c9/0x820 [ 83.899385][ T5038] check_panic_on_warn+0xab/0xb0 [ 83.904322][ T5038] __warn+0xf2/0x380 [ 83.908228][ T5038] ? ieee80211_bss_info_change_notify+0x2c9/0x820 [ 83.914662][ T5038] report_bug+0x3bc/0x580 [ 83.919012][ T5038] handle_bug+0x3c/0x70 [ 83.923171][ T5038] exc_invalid_op+0x17/0x40 [ 83.927771][ T5038] asm_exc_invalid_op+0x1a/0x20 [ 83.932645][ T5038] RIP: 0010:ieee80211_bss_info_change_notify+0x2c9/0x820 [ 83.939689][ T5038] Code: 00 00 e8 7a f9 db f7 48 8b 74 24 08 48 89 74 24 08 e8 6b f9 db f7 8b 14 24 48 c7 c7 20 90 a3 8b 48 8b 74 24 08 e8 f7 30 a2 f7 <0f> 0b e8 50 f9 db f7 4c 89 f2 48 b8 00 00 00 00 00 fc ff df 48 c1 [ 83.959389][ T5038] RSP: 0018:ffffc90003bdf520 EFLAGS: 00010286 [ 83.965462][ T5038] RAX: 0000000000000000 RBX: ffff88801fa18c80 RCX: 0000000000000000 [ 83.973443][ T5038] RDX: ffff888025901dc0 RSI: ffffffff814e00c6 RDI: 0000000000000001 [ 83.981416][ T5038] RBP: 0000000000400000 R08: 0000000000000001 R09: 0000000000000000 [ 83.989385][ T5038] R10: 0000000000000001 R11: 0000000000000001 R12: ffff88801f7d8e20 [ 83.997363][ T5038] R13: ffff88801fa1a898 R14: ffff88801fa19588 R15: 0000000000000000 [ 84.005341][ T5038] ? __warn_printk+0x1a6/0x350 [ 84.010132][ T5038] ? trace_irq_enable.constprop.0+0xd0/0x100 [ 84.016122][ T5038] ieee80211_ocb_leave+0x256/0x3d0 [ 84.021247][ T5038] __cfg80211_leave_ocb+0x1eb/0x480 [ 84.026458][ T5038] cfg80211_leave_ocb+0x51/0x70 [ 84.031325][ T5038] cfg80211_change_iface+0x869/0xdf0 [ 84.036628][ T5038] nl80211_set_interface+0x708/0x9b0 [ 84.041921][ T5038] ? nl80211_notify_iface+0x190/0x190 [ 84.047296][ T5038] ? nl80211_pre_doit+0x713/0xb00 [ 84.052331][ T5038] ? nl80211_pre_doit+0x1b0/0xb00 [ 84.057368][ T5038] genl_family_rcv_msg_doit.isra.0+0x1ef/0x2d0 [ 84.063535][ T5038] ? genl_start+0x650/0x650 [ 84.068052][ T5038] ? ns_capable+0xd5/0x110 [ 84.072494][ T5038] genl_rcv_msg+0x559/0x800 [ 84.077012][ T5038] ? genl_family_rcv_msg_doit.isra.0+0x2d0/0x2d0 [ 84.083362][ T5038] ? nl80211_post_doit+0x2f0/0x2f0 [ 84.088493][ T5038] ? nl80211_notify_iface+0x190/0x190 [ 84.093867][ T5038] ? nl80211_parse_sta_wme+0x3d0/0x3d0 [ 84.099339][ T5038] netlink_rcv_skb+0x16b/0x440 [ 84.104110][ T5038] ? genl_family_rcv_msg_doit.isra.0+0x2d0/0x2d0 [ 84.110449][ T5038] ? netlink_ack+0x1370/0x1370 [ 84.115220][ T5038] ? rcu_is_watching+0x12/0xb0 [ 84.120000][ T5038] ? down_write+0x200/0x200 [ 84.124511][ T5038] ? netlink_deliver_tap+0x1b1/0xd00 [ 84.129804][ T5038] genl_rcv+0x28/0x40 [ 84.133792][ T5038] netlink_unicast+0x539/0x800 [ 84.138565][ T5038] ? netlink_attachskb+0x880/0x880 [ 84.143680][ T5038] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 84.149593][ T5038] ? __phys_addr_symbol+0x30/0x70 [ 84.154630][ T5038] ? __check_object_size+0x323/0x740 [ 84.159930][ T5038] netlink_sendmsg+0x93c/0xe40 [ 84.164705][ T5038] ? netlink_unicast+0x800/0x800 [ 84.169651][ T5038] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 84.174953][ T5038] ? netlink_unicast+0x800/0x800 [ 84.179899][ T5038] sock_sendmsg+0xd9/0x180 [ 84.184336][ T5038] __sys_sendto+0x255/0x340 [ 84.188845][ T5038] ? __ia32_sys_getpeername+0xb0/0xb0 [ 84.194311][ T5038] ? cgroup_update_frozen+0x144/0x6b0 [ 84.199788][ T5038] ? rcu_is_watching+0x12/0xb0 [ 84.204564][ T5038] ? rcu_is_watching+0x12/0xb0 [ 84.209330][ T5038] ? trace_irq_enable.constprop.0+0xd0/0x100 [ 84.215323][ T5038] __x64_sys_sendto+0xe0/0x1b0 [ 84.220091][ T5038] ? syscall_trace_enter.constprop.0+0xaf/0x1e0 [ 84.226342][ T5038] do_syscall_64+0x38/0xb0 [ 84.230781][ T5038] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 84.236703][ T5038] RIP: 0033:0x7ff1ff150153 [ 84.241128][ T5038] Code: 64 89 02 48 c7 c0 ff ff ff ff eb b7 66 2e 0f 1f 84 00 00 00 00 00 90 80 3d 71 9f 07 00 00 41 89 ca 74 14 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 75 c3 0f 1f 40 00 55 48 83 ec 30 44 89 4c 24 [ 84.260742][ T5038] RSP: 002b:00007ffec35443f8 EFLAGS: 00000202 ORIG_RAX: 000000000000002c [ 84.269161][ T5038] RAX: ffffffffffffffda RBX: 00007ffec35444d0 RCX: 00007ff1ff150153 [ 84.277143][ T5038] RDX: 0000000000000024 RSI: 00007ffec3544520 RDI: 0000000000000006 [ 84.285205][ T5038] RBP: 0000000000000006 R08: 00007ffec3544414 R09: 000000000000000c [ 84.293180][ T5038] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000001 [ 84.301678][ T5038] R13: 0000000000000000 R14: 00007ffec3544520 R15: 0000000000000000 [ 84.309658][ T5038] [ 84.312951][ T5038] Kernel Offset: disabled [ 84.317263][ T5038] Rebooting in 86400 seconds..