./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1411654769
<...>
Warning: Permanently added '10.128.1.90' (ED25519) to the list of known hosts.
execve("./syz-executor1411654769", ["./syz-executor1411654769"], 0x7ffe41d54af0 /* 10 vars */) = 0
brk(NULL) = 0x555556d4a000
brk(0x555556d4ad00) = 0x555556d4ad00
arch_prctl(ARCH_SET_FS, 0x555556d4a380) = 0
set_tid_address(0x555556d4a650) = 5051
set_robust_list(0x555556d4a660, 24) = 0
rseq(0x555556d4aca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor1411654769", 4096) = 28
getrandom("\xec\xbc\xb1\x6f\x6f\x54\xff\x71", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x555556d4ad00
brk(0x555556d6bd00) = 0x555556d6bd00
brk(0x555556d6c000) = 0x555556d6c000
mprotect(0x7f243146f000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d4a650) = 5052
./strace-static-x86_64: Process 5052 attached
[pid 5052] set_robust_list(0x555556d4a660, 24) = 0
[pid 5052] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5052] setpgid(0, 0) = 0
[pid 5052] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5052] write(3, "1000", 4) = 4
[pid 5052] close(3) = 0
[pid 5052] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3
[pid 5052] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4
[pid 5052] sendto(4, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32
[pid 5052] recvfrom(4, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5052}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496
[pid 5052] recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5052}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid 5052] close(4) = 0
[pid 5052] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4
[pid 5052] ioctl(4, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0
[pid 5052] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x28\x00\x00\x00\x23\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x39\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x0c\x00\x5a\x80\x08\x00\x00\x80\x04\x00\x01\x00", iov_len=40}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 40
[pid 5052] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 5
[pid 5052] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 6
[pid 5052] sendto(6, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32
[pid 5052] recvfrom(6, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=-1385490500}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496
[pid 5052] recvfrom(6, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=-1385490500}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid 5052] close(6) = 0
[pid 5052] ioctl(5, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0
[pid 5052] sendmsg(5, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x24\x00\x00\x00\x23\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x08\x00\x05\x00\x02\x00\x00\x00", iov_len=36}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 36
[pid 5052] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 6
[pid 5052] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 7
[pid 5052] sendto(7, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32
[pid 5052] recvfrom(7, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=-913832976}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496
[pid 5052] recvfrom(7, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=-913832976}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid 5052] close(7) = 0
[pid 5052] socket(AF_UNIX, SOCK_STREAM, 0) = 7
[pid 5052] ioctl(7, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0
[pid 5052] sendmsg(6, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x28\x00\x00\x00\x23\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2e\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x0a\x00\x34\x00\x02\x02\x02\x02\x02\x02\x00\x00", iov_len=40}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 40
[pid 5052] exit_group(0) = ?
[pid 5052] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5052, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
restart_syscall(<... resuming interrupted clone ...>) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 5053 attached
, child_tidptr=0x555556d4a650) = 5053
[pid 5053] set_robust_list(0x555556d4a660, 24) = 0
[pid 5053] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5053] setpgid(0, 0) = 0
[pid 5053] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5053] write(3, "1000", 4) = 4
[pid 5053] close(3) = 0
[pid 5053] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3
[pid 5053] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4
[pid 5053] sendto(4, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32
[pid 5053] recvfrom(4, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5053}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496
[pid 5053] recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5053}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid 5053] close(4) = 0
[pid 5053] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4
[pid 5053] ioctl(4, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0
[pid 5053] sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x28\x00\x00\x00\x23\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x39\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x0c\x00\x5a\x80\x08\x00\x00\x80\x04\x00\x01\x00", iov_len=40}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 40
[pid 5053] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 5
[pid 5053] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 6
[pid 5053] sendto(6, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32
[pid 5053] recvfrom(6, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=-1039776116}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496
[pid 5053] recvfrom(6, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=-1039776116}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid 5053] close(6) = 0
[pid 5053] ioctl(5, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0
[pid 5053] sendmsg(5, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x24\x00\x00\x00\x23\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x08\x00\x05\x00\x02\x00\x00\x00", iov_len=36}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 36
[pid 5053] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 6
[pid 5053] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 7
[pid 5053] sendto(7, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32
[pid 5053] recvfrom(7, [{nlmsg_len=2496, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=-1512206723}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x23\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x46\x01\x00\x00\xec\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2496
[pid 5053] recvfrom(7, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=-1512206723}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
[pid 5053] close(7) = 0
[pid 5053] socket(AF_UNIX, SOCK_STREAM, 0) = 7
[pid 5053] ioctl(7, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0
[pid 5053] sendmsg(6, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x28\x00\x00\x00\x23\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2e\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x0a\x00\x34\x00\x02\x02\x02\x02\x02\x02\x00\x00", iov_len=40}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 40
[pid 5053] exit_group(0) = ?
[pid 5053] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=5053, si_uid=0, si_status=0, si_utime=0, si_stime=1 /* 0.01 s */} ---
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d4a650) = 5054
./strace-static-x86_64: Process 5054 attached
[pid 5054] set_robust_list(0x555556d4a660, 24) = 0
[pid 5054] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 5054] setpgid(0, 0) = 0
[pid 5054] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 5054] write(3, "1000", 4) = 4
[pid 5054] close(3) = 0
[pid 5054] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3
[pid 5054] socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4
[pid 5054] sendto(4, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32
[ 88.837078][ T43] ------------[ cut here ]------------
[ 88.842616][ T43] no supported rates for sta (null) (0xffffffff, band 0) in rate_mask 0x0 with flags 0x0
[ 88.853836][ T43] WARNING: CPU: 1 PID: 43 at net/mac80211/rate.c:379 __rate_control_send_low+0x6d7/0x800
[ 88.863761][ T43] Modules linked in:
[ 88.867723][ T43] CPU: 1 PID: 43 Comm: kworker/u4:3 Not tainted 6.5.0-rc5-next-20230808-syzkaller #0
[ 88.877246][ T43] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
[ 88.887373][ T43] Workqueue: phy1 ieee80211_scan_work
[ 88.892824][ T43] RIP: 0010:__rate_control_send_low+0x6d7/0x800
[ 88.899161][ T43] Code: 8b a4 a0 d4 00 00 00 e8 87 ed d3 f7 44 8b 44 24 3c 45 89 e9 89 d9 48 8b 74 24 18 44 89 e2 48 c7 c7 00 e0 a3 8b e8 89 24 9a f7 <0f> 0b e9 03 fd ff ff 48 8b 7c 24 30 e8 d8 22 29 f8 e9 e5 fb ff ff
[ 88.918858][ T43] RSP: 0018:ffffc90000b3f580 EFLAGS: 00010286
[ 88.924987][ T43] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 88.933056][ T43] RDX: ffff888016e6d940 RSI: ffffffff814df046 RDI: 0000000000000001
[ 88.941092][ T43] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
[ 88.949139][ T43] R10: 0000000000000000 R11: 0000000000000001 R12: 00000000ffffffff
[ 88.957268][ T43] R13: 0000000000000000 R14: 000000000000000c R15: dffffc0000000000
[ 88.965282][ T43] FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
[ 88.974311][ T43] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 88.980979][ T43] CR2: 00007f24313ca68c CR3: 000000000c776000 CR4: 00000000003506e0
[ 88.989039][ T43] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 88.997679][ T43] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 89.005698][ T43] Call Trace:
[ 89.009074][ T43]
[ 89.012038][ T43] ? show_regs+0x8f/0xa0
[ 89.016336][ T43] ? __warn+0xe6/0x380
[ 89.020500][ T43] ? __rate_control_send_low+0x6d7/0x800
[ 89.026203][ T43] ? report_bug+0x3bc/0x580
[ 89.030808][ T43] ? handle_bug+0x3c/0x70
[ 89.035204][ T43] ? exc_invalid_op+0x17/0x40
[ 89.039979][ T43] ? asm_exc_invalid_op+0x1a/0x20
[ 89.045100][ T43] ? __warn_printk+0x1a6/0x350
[ 89.049955][ T43] ? __rate_control_send_low+0x6d7/0x800
[ 89.055653][ T43] rate_control_send_low+0x296/0x820
[ 89.061030][ T43] rate_control_get_rate+0x1be/0x590
[ 89.066372][ T43] ieee80211_tx_h_rate_ctrl+0xa70/0x19d0
[ 89.072104][ T43] ? ieee80211_probereq_get+0x290/0x290
[ 89.077743][ T43] invoke_tx_handlers_late+0xd15/0x2c90
[ 89.083346][ T43] ? ieee80211_queue_skb+0x472/0x1fb0
[ 89.088814][ T43] ? ieee80211_ie_build_eht_cap+0x3e0/0x3e0
[ 89.094874][ T43] ? invoke_tx_handlers_early+0x663/0x26c0
[ 89.100785][ T43] ieee80211_tx+0x2ff/0x420
[ 89.105340][ T43] ? ieee80211_tx_prepare_skb+0x470/0x470
[ 89.111173][ T43] ? rcu_is_watching+0x12/0xb0
[ 89.115985][ T43] ? lock_acquire+0x464/0x510
[ 89.120852][ T43] ? ieee80211_skb_resize+0x22a/0x620
[ 89.126277][ T43] ? ieee80211_set_qos_hdr+0xba/0x3e0
[ 89.131763][ T43] ieee80211_xmit+0x30e/0x3e0
[ 89.136489][ T43] __ieee80211_tx_skb_tid_band+0x2a0/0x700
[ 89.142431][ T43] ieee80211_scan_state_send_probe+0x33c/0x970
[ 89.148691][ T43] ieee80211_scan_work+0x6f8/0x1fc0
[ 89.153978][ T43] ? lock_sync+0x190/0x190
[ 89.158579][ T43] ? reacquire_held_locks+0x4b0/0x4b0
[ 89.164019][ T43] ? __schedule+0xee9/0x59f0
[ 89.168783][ T43] ? ieee80211_run_deferred_scan+0x340/0x340
[ 89.174827][ T43] ? spin_bug+0x1d0/0x1d0
[ 89.179354][ T43] ? rcu_is_watching+0x12/0xb0
[ 89.184171][ T43] process_one_work+0x887/0x15d0
[ 89.189207][ T43] ? lock_sync+0x190/0x190
[ 89.193683][ T43] ? init_worker_pool+0x770/0x770
[ 89.198810][ T43] ? assign_work+0x1a0/0x240
[ 89.203457][ T43] worker_thread+0x8bb/0x1290
[ 89.208950][ T43] ? __kthread_parkme+0x152/0x220
[ 89.214029][ T43] ? process_one_work+0x15d0/0x15d0
[ 89.219414][ T43] kthread+0x33a/0x430
[ 89.223532][ T43] ? kthread_complete_and_exit+0x40/0x40
[ 89.229260][ T43] ret_from_fork+0x45/0x80
[ 89.233732][ T43] ? kthread_complete_and_exit+0x40/0x40
[ 89.239457][ T43] ret_from_fork_asm+0x11/0x20
[ 89.244296][ T43]
[ 89.247402][ T43] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 89.254704][ T43] CPU: 1 PID: 43 Comm: kworker/u4:3 Not tainted 6.5.0-rc5-next-20230808-syzkaller #0
[ 89.264184][ T43] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
[ 89.274273][ T43] Workqueue: phy1 ieee80211_scan_work
[ 89.279709][ T43] Call Trace:
[ 89.283033][ T43]
[ 89.285997][ T43] dump_stack_lvl+0xd9/0x1b0
[ 89.290652][ T43] panic+0x6a6/0x750
[ 89.294601][ T43] ? panic_smp_self_stop+0xa0/0xa0
[ 89.299780][ T43] ? __rate_control_send_low+0x6d7/0x800
[ 89.305468][ T43] check_panic_on_warn+0xab/0xb0
[ 89.310473][ T43] __warn+0xf2/0x380
[ 89.314445][ T43] ? __rate_control_send_low+0x6d7/0x800
[ 89.320139][ T43] report_bug+0x3bc/0x580
[ 89.324536][ T43] handle_bug+0x3c/0x70
[ 89.328756][ T43] exc_invalid_op+0x17/0x40
[ 89.333325][ T43] asm_exc_invalid_op+0x1a/0x20
[ 89.338246][ T43] RIP: 0010:__rate_control_send_low+0x6d7/0x800
[ 89.344539][ T43] Code: 8b a4 a0 d4 00 00 00 e8 87 ed d3 f7 44 8b 44 24 3c 45 89 e9 89 d9 48 8b 74 24 18 44 89 e2 48 c7 c7 00 e0 a3 8b e8 89 24 9a f7 <0f> 0b e9 03 fd ff ff 48 8b 7c 24 30 e8 d8 22 29 f8 e9 e5 fb ff ff
[ 89.364279][ T43] RSP: 0018:ffffc90000b3f580 EFLAGS: 00010286
[ 89.370390][ T43] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 89.378488][ T43] RDX: ffff888016e6d940 RSI: ffffffff814df046 RDI: 0000000000000001
[ 89.386519][ T43] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
[ 89.394538][ T43] R10: 0000000000000000 R11: 0000000000000001 R12: 00000000ffffffff
[ 89.402554][ T43] R13: 0000000000000000 R14: 000000000000000c R15: dffffc0000000000
[ 89.410577][ T43] ? __warn_printk+0x1a6/0x350
[ 89.415411][ T43] rate_control_send_low+0x296/0x820
[ 89.420759][ T43] rate_control_get_rate+0x1be/0x590
[ 89.426116][ T43] ieee80211_tx_h_rate_ctrl+0xa70/0x19d0
[ 89.431817][ T43] ? ieee80211_probereq_get+0x290/0x290
[ 89.437448][ T43] invoke_tx_handlers_late+0xd15/0x2c90
[ 89.443051][ T43] ? ieee80211_queue_skb+0x472/0x1fb0
[ 89.448476][ T43] ? ieee80211_ie_build_eht_cap+0x3e0/0x3e0
[ 89.454438][ T43] ? invoke_tx_handlers_early+0x663/0x26c0
[ 89.460389][ T43] ieee80211_tx+0x2ff/0x420
[ 89.464949][ T43] ? ieee80211_tx_prepare_skb+0x470/0x470
[ 89.470738][ T43] ? rcu_is_watching+0x12/0xb0
[ 89.475551][ T43] ? lock_acquire+0x464/0x510
[ 89.480287][ T43] ? ieee80211_skb_resize+0x22a/0x620
[ 89.485710][ T43] ? ieee80211_set_qos_hdr+0xba/0x3e0
[ 89.491175][ T43] ieee80211_xmit+0x30e/0x3e0
[ 89.495912][ T43] __ieee80211_tx_skb_tid_band+0x2a0/0x700
[ 89.501787][ T43] ieee80211_scan_state_send_probe+0x33c/0x970
[ 89.508022][ T43] ieee80211_scan_work+0x6f8/0x1fc0
[ 89.513287][ T43] ? lock_sync+0x190/0x190
[ 89.517770][ T43] ? reacquire_held_locks+0x4b0/0x4b0
[ 89.523200][ T43] ? __schedule+0xee9/0x59f0
[ 89.527835][ T43] ? ieee80211_run_deferred_scan+0x340/0x340
[ 89.533873][ T43] ? spin_bug+0x1d0/0x1d0
[ 89.538264][ T43] ? rcu_is_watching+0x12/0xb0
[ 89.543175][ T43] process_one_work+0x887/0x15d0
[ 89.548183][ T43] ? lock_sync+0x190/0x190
[ 89.552657][ T43] ? init_worker_pool+0x770/0x770
[ 89.557745][ T43] ? assign_work+0x1a0/0x240
[ 89.562394][ T43] worker_thread+0x8bb/0x1290
[ 89.567130][ T43] ? __kthread_parkme+0x152/0x220
[ 89.572213][ T43] ? process_one_work+0x15d0/0x15d0
[ 89.577480][ T43] kthread+0x33a/0x430
[ 89.581602][ T43] ? kthread_complete_and_exit+0x40/0x40
[ 89.587296][ T43] ret_from_fork+0x45/0x80
[ 89.591764][ T43] ? kthread_complete_and_exit+0x40/0x40
[ 89.597456][ T43] ret_from_fork_asm+0x11/0x20
[ 89.602299][ T43]
[ 89.605675][ T43] Kernel Offset: disabled
[ 89.610006][ T43] Rebooting in 86400 seconds..