[ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... Starting Load/Save RF Kill Switch Status... [ OK ] Started Update UTMP about System Runlevel Changes. [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.24' (ECDSA) to the list of known hosts. executing program executing program executing program syzkaller login: [ 66.372252][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 66.399505][ T8489] general protection fault, probably for non-canonical address 0xfbd59c0000000020: 0000 [#1] PREEMPT SMP KASAN [ 66.425535][ T8489] KASAN: maybe wild-memory-access in range [0xdead000000000100-0xdead000000000107] [ 66.449116][ T8489] CPU: 1 PID: 8489 Comm: syz-executor845 Not tainted 5.10.0-rc6-syzkaller #0 [ 66.460727][ T8489] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 66.471758][ T8489] RIP: 0010:ieee80211_chanctx_num_assigned+0xb1/0x140 [ 66.478928][ T8489] Code: a8 f6 ff ff 48 39 c5 74 3b 49 bd 00 00 00 00 00 fc ff df e8 81 9e 1b f9 48 8d bb 58 09 00 00 41 83 c4 01 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 75 68 48 8b 83 58 09 00 00 48 8d 98 a8 f6 ff ff 48 [ 66.506520][ T8489] RSP: 0018:ffffc900017ff330 EFLAGS: 00010a02 [ 66.512684][ T8489] RAX: 1bd5a00000000020 RBX: deacfffffffff7a8 RCX: ffffffff8854665b [ 66.520662][ T8489] RDX: ffff888016e71a40 RSI: ffffffff885465ff RDI: dead000000000100 [ 66.528736][ T8489] RBP: ffff8880126bcd20 R08: 0000000000000000 R09: ffffffff8cecaacf [ 66.536807][ T8489] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000002 [ 66.544784][ T8489] R13: dffffc0000000000 R14: ffff8880126bcd00 R15: 0000000000000000 [ 66.553397][ T8489] FS: 0000000001e8b880(0000) GS:ffff8880b9f00000(0000) knlGS:0000000000000000 [ 66.564067][ T8489] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 66.570985][ T8489] CR2: 0000000020000200 CR3: 000000001bc14000 CR4: 00000000001506e0 [ 66.579992][ T8489] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 66.588035][ T8489] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 66.595982][ T8489] Call Trace: [ 66.599377][ T8489] ieee80211_assign_vif_chanctx+0x7b8/0x1230 [ 66.605341][ T8489] __ieee80211_vif_release_channel+0x236/0x430 [ 66.611740][ T8489] ieee80211_vif_release_channel+0x117/0x220 [ 66.617792][ T8489] ieee80211_ibss_disconnect+0x44e/0x7b0 [ 66.623420][ T8489] ieee80211_ibss_leave+0x12/0xe0 [ 66.629041][ T8489] __cfg80211_leave_ibss+0x19a/0x4c0 [ 66.634324][ T8489] cfg80211_leave_ibss+0x57/0x80 [ 66.639246][ T8489] cfg80211_change_iface+0x855/0xef0 [ 66.644514][ T8489] nl80211_set_interface+0x65c/0x8d0 [ 66.649865][ T8489] ? nl80211_notify_iface+0x180/0x180 [ 66.655401][ T8489] ? nl80211_pre_doit+0xa2/0x630 [ 66.660317][ T8489] genl_family_rcv_msg_doit+0x228/0x320 [ 66.666304][ T8489] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x280/0x280 [ 66.673760][ T8489] ? ns_capable+0xde/0x100 [ 66.678162][ T8489] genl_rcv_msg+0x328/0x580 [ 66.682682][ T8489] ? genl_get_cmd+0x480/0x480 [ 66.687340][ T8489] ? nl80211_notify_iface+0x180/0x180 [ 66.692686][ T8489] ? lock_release+0x710/0x710 [ 66.697342][ T8489] netlink_rcv_skb+0x153/0x420 [ 66.702086][ T8489] ? genl_get_cmd+0x480/0x480 [ 66.706958][ T8489] ? netlink_ack+0xaa0/0xaa0 [ 66.711622][ T8489] genl_rcv+0x24/0x40 [ 66.715686][ T8489] netlink_unicast+0x533/0x7d0 [ 66.720446][ T8489] ? netlink_attachskb+0x810/0x810 [ 66.725920][ T8489] ? __phys_addr_symbol+0x2c/0x70 [ 66.730934][ T8489] ? __check_object_size+0x171/0x3f0 [ 66.736212][ T8489] netlink_sendmsg+0x856/0xd90 [ 66.740966][ T8489] ? netlink_unicast+0x7d0/0x7d0 [ 66.746143][ T8489] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 66.751407][ T8489] ? netlink_unicast+0x7d0/0x7d0 [ 66.756348][ T8489] sock_sendmsg+0xcf/0x120 [ 66.760855][ T8489] ____sys_sendmsg+0x6e8/0x810 [ 66.765686][ T8489] ? kernel_sendmsg+0x50/0x50 [ 66.770613][ T8489] ? do_recvmmsg+0x6c0/0x6c0 [ 66.775180][ T8489] ? find_held_lock+0x2d/0x110 [ 66.780197][ T8489] ___sys_sendmsg+0xf3/0x170 [ 66.784944][ T8489] ? sendmsg_copy_msghdr+0x160/0x160 [ 66.790222][ T8489] ? _copy_to_user+0xdc/0x150 [ 66.794973][ T8489] ? sock_do_ioctl+0x168/0x2d0 [ 66.799730][ T8489] ? compat_ifr_data_ioctl+0x150/0x150 [ 66.805604][ T8489] ? __sanitizer_cov_trace_switch+0x45/0x70 [ 66.811560][ T8489] ? __fget_light+0x215/0x280 [ 66.816296][ T8489] __sys_sendmsg+0xe5/0x1b0 [ 66.820870][ T8489] ? __sys_sendmsg_sock+0xb0/0xb0 [ 66.825966][ T8489] ? syscall_enter_from_user_mode+0x1d/0x50 [ 66.832022][ T8489] do_syscall_64+0x2d/0x70 [ 66.836530][ T8489] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 66.842495][ T8489] RIP: 0033:0x441f29 [ 66.846371][ T8489] Code: e8 4c ff 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db 06 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 66.866472][ T8489] RSP: 002b:00007ffdc529daa8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 66.875303][ T8489] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441f29 [ 66.883528][ T8489] RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000003 [ 66.891498][ T8489] RBP: 000000000001032c R08: 00000000004002e0 R09: 00000000004002e0 [ 66.901130][ T8489] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000402a90 [ 66.909179][ T8489] R13: 0000000000402b20 R14: 0000000000000000 R15: 0000000000000000 [ 66.917273][ T8489] Modules linked in: [ 66.922984][ T8489] ---[ end trace 51eaa14aceb26595 ]--- [ 66.928546][ T8489] RIP: 0010:ieee80211_chanctx_num_assigned+0xb1/0x140 [ 66.935380][ T8489] Code: a8 f6 ff ff 48 39 c5 74 3b 49 bd 00 00 00 00 00 fc ff df e8 81 9e 1b f9 48 8d bb 58 09 00 00 41 83 c4 01 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 75 68 48 8b 83 58 09 00 00 48 8d 98 a8 f6 ff ff 48 [ 66.955369][ T8489] RSP: 0018:ffffc900017ff330 EFLAGS: 00010a02 [ 66.961431][ T8489] RAX: 1bd5a00000000020 RBX: deacfffffffff7a8 RCX: ffffffff8854665b [ 66.969765][ T8489] RDX: ffff888016e71a40 RSI: ffffffff885465ff RDI: dead000000000100 [ 66.977796][ T8489] RBP: ffff8880126bcd20 R08: 0000000000000000 R09: ffffffff8cecaacf [ 66.985992][ T8489] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000002 [ 66.994194][ T8489] R13: dffffc0000000000 R14: ffff8880126bcd00 R15: 0000000000000000 [ 67.002243][ T8489] FS: 0000000001e8b880(0000) GS:ffff8880b9f00000(0000) knlGS:0000000000000000 [ 67.011282][ T8489] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 67.018071][ T8489] CR2: 0000000020000200 CR3: 000000001bc14000 CR4: 00000000001506e0 [ 67.026281][ T8489] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 67.034603][ T8489] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 67.042634][ T8489] Kernel panic - not syncing: Fatal exception [ 67.050043][ T8489] Kernel Offset: disabled [ 67.054362][ T8489] Rebooting in 86400 seconds..