./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1617330892
<...>
Warning: Permanently added '10.128.0.9' (ECDSA) to the list of known hosts.
execve("./syz-executor1617330892", ["./syz-executor1617330892"], 0x7fff0fe25a80 /* 10 vars */) = 0
brk(NULL) = 0x55555722a000
brk(0x55555722ac40) = 0x55555722ac40
arch_prctl(ARCH_SET_FS, 0x55555722a300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor1617330892", 4096) = 28
brk(0x55555724bc40) = 0x55555724bc40
brk(0x55555724c000) = 0x55555724c000
mprotect(0x7f444e88f000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 3
socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4
sendto(4, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32
recvfrom(4, [{nlmsg_len=2476, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5072}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x22\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x41\x01\x00\x00\xd8\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2476
recvfrom(4, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5072}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
close(4) = 0
socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 4
socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC) = 5
sendto(5, [{nlmsg_len=32, nlmsg_type=0x10 /* NLMSG_??? */, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}, "\x03\x00\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00"], 32, 0, {sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, 12) = 32
recvfrom(5, [{nlmsg_len=2476, nlmsg_type=nlctrl, nlmsg_flags=0, nlmsg_seq=0, nlmsg_pid=5072}, "\x01\x02\x00\x00\x0c\x00\x02\x00\x6e\x6c\x38\x30\x32\x31\x31\x00\x06\x00\x01\x00\x22\x00\x00\x00\x08\x00\x03\x00\x01\x00\x00\x00\x08\x00\x04\x00\x00\x00\x00\x00\x08\x00\x05\x00\x41\x01\x00\x00\xd8\x08\x06\x00\x14\x00\x01\x00\x08\x00\x01\x00\x01\x00\x00\x00\x08\x00\x02\x00\x0e\x00\x00\x00\x14\x00\x02\x00\x08\x00\x01\x00\x02\x00\x00\x00\x08\x00\x02\x00\x1a\x00\x00\x00\x14\x00\x03\x00\x08\x00\x01\x00"...], 4096, 0, NULL, NULL) = 2476
recvfrom(5, [{nlmsg_len=36, nlmsg_type=NLMSG_ERROR, nlmsg_flags=NLM_F_CAPPED, nlmsg_seq=0, nlmsg_pid=5072}, {error=0, msg={nlmsg_len=32, nlmsg_type=nlctrl, nlmsg_flags=NLM_F_REQUEST|NLM_F_ACK, nlmsg_seq=0, nlmsg_pid=0}}], 4096, 0, NULL, NULL) = 36
close(5) = 0
ioctl(4, SIOCGIFINDEX, {ifr_name="wlan1", ifr_ifindex=9}) = 0
sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x24\x00\x00\x00\x22\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x08\x00\x03\x00\x09\x00\x00\x00\x08\x00\x05\x00\x09\x00\x00\x00", iov_len=36}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 36
syzkaller login: [ 59.763650][ T5072] ------------[ cut here ]------------
[ 59.769585][ T5072] WARNING: CPU: 0 PID: 5072 at net/mac80211/cfg.c:3989 ieee80211_probe_client+0x70e/0x810
[ 59.779588][ T5072] Modules linked in:
[ 59.783553][ T5072] CPU: 0 PID: 5072 Comm: syz-executor161 Not tainted 6.1.0-next-20221220-syzkaller #0
[ 59.793151][ T5072] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 59.803257][ T5072] RIP: 0010:ieee80211_probe_client+0x70e/0x810
[ 59.809455][ T5072] Code: 96 12 05 01 e8 54 13 76 00 e9 4e fe ff ff e8 d9 1d 36 f8 be 02 00 00 00 4c 89 ff e8 3c 88 78 fe e9 1a fe ff ff e8 c2 1d 36 f8 <0f> 0b 41 bc ea ff ff ff e9 08 fe ff ff 48 89 ef e8 9d 3d 84 f8 e9
[ 59.829346][ T5072] RSP: 0018:ffffc90003a8f450 EFLAGS: 00010293
[ 59.835420][ T5072] RAX: 0000000000000000 RBX: ffff888020730000 RCX: 0000000000000000
[ 59.843448][ T5072] RDX: ffff88801b823a80 RSI: ffffffff894b371e RDI: 0000000000000005
[ 59.851500][ T5072] RBP: ffff88802772d02c R08: 0000000000000005 R09: 0000000000000000
[ 59.859539][ T5072] R10: 0000000000000001 R11: 0000000000000001 R12: ffff8880207a8de0
[ 59.867549][ T5072] R13: 0000000000000000 R14: 0000000000000001 R15: ffff8880207a86c0
[ 59.875521][ T5072] FS: 000055555722a300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
[ 59.884497][ T5072] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 59.891143][ T5072] CR2: 00000000005fdeb8 CR3: 0000000027a9d000 CR4: 00000000003506f0
[ 59.899173][ T5072] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 59.907185][ T5072] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 59.915154][ T5072] Call Trace:
[ 59.918478][ T5072]
[ 59.921436][ T5072] nl80211_probe_client+0x3f2/0x9c0
[ 59.926697][ T5072] ? parse_station_flags+0x570/0x570
[ 59.932546][ T5072] ? nl80211_pre_doit+0x120/0xab0
[ 59.937626][ T5072] genl_family_rcv_msg_doit.isra.0+0x1e6/0x2d0
[ 59.943829][ T5072] ? genl_start+0x660/0x660
[ 59.948383][ T5072] ? apparmor_capable+0x1dc/0x460
[ 59.958817][ T5072] ? ns_capable+0xdd/0x100
[ 59.963373][ T5072] genl_rcv_msg+0x4ff/0x7e0
[ 59.967938][ T5072] ? genl_family_rcv_msg_doit.isra.0+0x2d0/0x2d0
[ 59.974319][ T5072] ? lockdep_hardirqs_on_prepare+0x410/0x410
[ 59.980368][ T5072] ? validate_beacon_tx_rate+0x790/0x790
[ 59.986048][ T5072] ? parse_station_flags+0x570/0x570
[ 59.991335][ T5072] ? cfg80211_vendor_cmd_reply+0x2f0/0x2f0
[ 59.997203][ T5072] ? lockdep_hardirqs_on_prepare+0x410/0x410
[ 60.003206][ T5072] ? kasan_save_stack+0x22/0x40
[ 60.008101][ T5072] ? kasan_set_track+0x25/0x30
[ 60.012883][ T5072] ? __kasan_kmalloc+0xa5/0xb0
[ 60.017711][ T5072] netlink_rcv_skb+0x165/0x440
[ 60.022519][ T5072] ? genl_family_rcv_msg_doit.isra.0+0x2d0/0x2d0
[ 60.028911][ T5072] ? netlink_ack+0x1370/0x1370
[ 60.033704][ T5072] ? trace_lock_acquire+0x1d1/0x290
[ 60.038966][ T5072] ? rwsem_down_read_slowpath+0xb20/0xb20
[ 60.044715][ T5072] ? netlink_deliver_tap+0x1b1/0xc50
[ 60.050052][ T5072] ? _copy_from_iter+0x277/0xf70
[ 60.055028][ T5072] genl_rcv+0x28/0x40
[ 60.059063][ T5072] netlink_unicast+0x547/0x7f0
[ 60.063867][ T5072] ? netlink_attachskb+0x890/0x890
[ 60.069114][ T5072] ? __virt_addr_valid+0x61/0x2e0
[ 60.074169][ T5072] ? __phys_addr_symbol+0x30/0x70
[ 60.079275][ T5072] ? __check_object_size+0x2e2/0x5a0
[ 60.084612][ T5072] netlink_sendmsg+0x91b/0xe10
[ 60.089483][ T5072] ? netlink_unicast+0x7f0/0x7f0
[ 60.094460][ T5072] ? bpf_lsm_socket_sendmsg+0x9/0x10
[ 60.099802][ T5072] ? netlink_unicast+0x7f0/0x7f0
[ 60.104780][ T5072] sock_sendmsg+0xd3/0x120
[ 60.109265][ T5072] ____sys_sendmsg+0x712/0x8c0
[ 60.114055][ T5072] ? copy_msghdr_from_user+0xfc/0x150
[ 60.119482][ T5072] ? kernel_sendmsg+0x50/0x50
[ 60.124180][ T5072] ? __lock_acquire+0x166e/0x56d0
[ 60.129274][ T5072] ___sys_sendmsg+0x110/0x1b0
[ 60.133985][ T5072] ? do_recvmmsg+0x7b0/0x7b0
[ 60.138654][ T5072] ? lock_release+0x810/0x810
[ 60.143354][ T5072] ? ptrace_stop.part.0+0x4e3/0x8e0
[ 60.148592][ T5072] ? rcu_read_lock_sched_held+0x3e/0x70
[ 60.154160][ T5072] ? do_raw_spin_lock+0x124/0x2b0
[ 60.159260][ T5072] ? rwlock_bug.part.0+0x90/0x90
[ 60.164218][ T5072] ? lock_acquire+0x32/0xc0
[ 60.168778][ T5072] ? ptrace_stop.part.0+0x4e3/0x8e0
[ 60.173998][ T5072] ? __fget_light+0x20a/0x270
[ 60.178729][ T5072] __sys_sendmsg+0xf7/0x1c0
[ 60.183267][ T5072] ? __sys_sendmsg_sock+0x40/0x40
[ 60.188338][ T5072] ? lock_downgrade+0x6e0/0x6e0
[ 60.193216][ T5072] ? lockdep_hardirqs_on+0x7d/0x100
[ 60.198493][ T5072] ? _raw_spin_unlock_irq+0x2e/0x50
[ 60.203730][ T5072] ? ptrace_notify+0xfe/0x140
[ 60.208504][ T5072] do_syscall_64+0x39/0xb0
[ 60.212952][ T5072] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 60.218907][ T5072] RIP: 0033:0x7f444e822d59
[ 60.224652][ T5072] Code: 28 c3 e8 5a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 60.246418][ T5072] RSP: 002b:00007ffdbb38c818 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 60.254854][ T5072] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f444e822d59
[ 60.262887][ T5072] RDX: 0000000000000010 RSI: 00000000200000c0 RDI: 0000000000000003
[ 60.270897][ T5072] RBP: 00007f444e7e6720 R08: 0000000000000001 R09: 0000000000000000
[ 60.278905][ T5072] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f444e7e67b0
[ 60.286915][ T5072] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 60.294893][ T5072]
[ 60.297952][ T5072] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 60.305235][ T5072] CPU: 0 PID: 5072 Comm: syz-executor161 Not tainted 6.1.0-next-20221220-syzkaller #0
[ 60.314771][ T5072] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
[ 60.324837][ T5072] Call Trace:
[ 60.328122][ T5072]
[ 60.331065][ T5072] dump_stack_lvl+0xd1/0x138
[ 60.335683][ T5072] panic+0x2cc/0x626
[ 60.339604][ T5072] ? panic_print_sys_info.part.0+0x110/0x110
[ 60.345627][ T5072] ? ieee80211_probe_client+0x70e/0x810
[ 60.351191][ T5072] check_panic_on_warn.cold+0x19/0x35
[ 60.356591][ T5072] __warn+0xf2/0x1a0
[ 60.360518][ T5072] ? ieee80211_probe_client+0x70e/0x810
[ 60.366077][ T5072] report_bug+0x1c0/0x210
[ 60.370431][ T5072] handle_bug+0x3c/0x70
[ 60.374617][ T5072] exc_invalid_op+0x18/0x50
[ 60.379147][ T5072] asm_exc_invalid_op+0x1a/0x20
[ 60.384033][ T5072] RIP: 0010:ieee80211_probe_client+0x70e/0x810
[ 60.390203][ T5072] Code: 96 12 05 01 e8 54 13 76 00 e9 4e fe ff ff e8 d9 1d 36 f8 be 02 00 00 00 4c 89 ff e8 3c 88 78 fe e9 1a fe ff ff e8 c2 1d 36 f8 <0f> 0b 41 bc ea ff ff ff e9 08 fe ff ff 48 89 ef e8 9d 3d 84 f8 e9
[ 60.409823][ T5072] RSP: 0018:ffffc90003a8f450 EFLAGS: 00010293
[ 60.415907][ T5072] RAX: 0000000000000000 RBX: ffff888020730000 RCX: 0000000000000000
[ 60.423894][ T5072] RDX: ffff88801b823a80 RSI: ffffffff894b371e RDI: 0000000000000005
[ 60.431879][ T5072] RBP: ffff88802772d02c R08: 0000000000000005 R09: 0000000000000000
[ 60.439861][ T5072] R10: 0000000000000001 R11: 0000000000000001 R12: ffff8880207a8de0
[ 60.447860][ T5072] R13: 0000000000000000 R14: 0000000000000001 R15: ffff8880207a86c0
[ 60.455861][ T5072] ? ieee80211_probe_client+0x70e/0x810
[ 60.461440][ T5072] nl80211_probe_client+0x3f2/0x9c0
[ 60.466669][ T5072] ? parse_station_flags+0x570/0x570
[ 60.471985][ T5072] ? nl80211_pre_doit+0x120/0xab0
[ 60.477035][ T5072] genl_family_rcv_msg_doit.isra.0+0x1e6/0x2d0
[ 60.483242][ T5072] ? genl_start+0x660/0x660
[ 60.487792][ T5072] ? apparmor_capable+0x1dc/0x460
[ 60.492867][ T5072] ? ns_capable+0xdd/0x100
[ 60.497323][ T5072] genl_rcv_msg+0x4ff/0x7e0
[ 60.501871][ T5072] ? genl_family_rcv_msg_doit.isra.0+0x2d0/0x2d0
[ 60.508231][ T5072] ? lockdep_hardirqs_on_prepare+0x410/0x410
[ 60.514232][ T5072] ? validate_beacon_tx_rate+0x790/0x790
[ 60.519903][ T5072] ? parse_station_flags+0x570/0x570
[ 60.525209][ T5072] ? cfg80211_vendor_cmd_reply+0x2f0/0x2f0
[ 60.531039][ T5072] ? lockdep_hardirqs_on_prepare+0x410/0x410
[ 60.537037][ T5072] ? kasan_save_stack+0x22/0x40
[ 60.541938][ T5072] ? kasan_set_track+0x25/0x30
[ 60.546717][ T5072] ? __kasan_kmalloc+0xa5/0xb0
[ 60.551504][ T5072] netlink_rcv_skb+0x165/0x440
[ 60.556301][ T5072] ? genl_family_rcv_msg_doit.isra.0+0x2d0/0x2d0
[ 60.562701][ T5072] ? netlink_ack+0x1370/0x1370
[ 60.567489][ T5072] ? trace_lock_acquire+0x1d1/0x290
[ 60.572721][ T5072] ? rwsem_down_read_slowpath+0xb20/0xb20
[ 60.578461][ T5072] ? netlink_deliver_tap+0x1b1/0xc50
[ 60.583782][ T5072] ? _copy_from_iter+0x277/0xf70
[ 60.588768][ T5072] genl_rcv+0x28/0x40
[ 60.592780][ T5072] netlink_unicast+0x547/0x7f0
[ 60.597576][ T5072] ? netlink_attachskb+0x890/0x890
[ 60.602803][ T5072] ? __virt_addr_valid+0x61/0x2e0
[ 60.607859][ T5072] ? __phys_addr_symbol+0x30/0x70
[ 60.612908][ T5072] ? __check_object_size+0x2e2/0x5a0
[ 60.618224][ T5072] netlink_sendmsg+0x91b/0xe10
[ 60.623022][ T5072] ? netlink_unicast+0x7f0/0x7f0
[ 60.627995][ T5072] ? bpf_lsm_socket_sendmsg+0x9/0x10
[ 60.633311][ T5072] ? netlink_unicast+0x7f0/0x7f0
[ 60.638275][ T5072] sock_sendmsg+0xd3/0x120
[ 60.642717][ T5072] ____sys_sendmsg+0x712/0x8c0
[ 60.647502][ T5072] ? copy_msghdr_from_user+0xfc/0x150
[ 60.652900][ T5072] ? kernel_sendmsg+0x50/0x50
[ 60.657595][ T5072] ? __lock_acquire+0x166e/0x56d0
[ 60.662660][ T5072] ___sys_sendmsg+0x110/0x1b0
[ 60.667364][ T5072] ? do_recvmmsg+0x7b0/0x7b0
[ 60.672013][ T5072] ? lock_release+0x810/0x810
[ 60.676730][ T5072] ? ptrace_stop.part.0+0x4e3/0x8e0
[ 60.681965][ T5072] ? rcu_read_lock_sched_held+0x3e/0x70
[ 60.687537][ T5072] ? do_raw_spin_lock+0x124/0x2b0
[ 60.692597][ T5072] ? rwlock_bug.part.0+0x90/0x90
[ 60.697565][ T5072] ? lock_acquire+0x32/0xc0
[ 60.702101][ T5072] ? ptrace_stop.part.0+0x4e3/0x8e0
[ 60.707337][ T5072] ? __fget_light+0x20a/0x270
[ 60.712055][ T5072] __sys_sendmsg+0xf7/0x1c0
[ 60.716602][ T5072] ? __sys_sendmsg_sock+0x40/0x40
[ 60.721656][ T5072] ? lock_downgrade+0x6e0/0x6e0
[ 60.726537][ T5072] ? lockdep_hardirqs_on+0x7d/0x100
[ 60.731774][ T5072] ? _raw_spin_unlock_irq+0x2e/0x50
[ 60.737005][ T5072] ? ptrace_notify+0xfe/0x140
[ 60.741708][ T5072] do_syscall_64+0x39/0xb0
[ 60.746162][ T5072] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 60.752087][ T5072] RIP: 0033:0x7f444e822d59
[ 60.756524][ T5072] Code: 28 c3 e8 5a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 60.776146][ T5072] RSP: 002b:00007ffdbb38c818 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 60.784576][ T5072] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f444e822d59
[ 60.792559][ T5072] RDX: 0000000000000010 RSI: 00000000200000c0 RDI: 0000000000000003
[ 60.800541][ T5072] RBP: 00007f444e7e6720 R08: 0000000000000001 R09: 0000000000000000
[ 60.808555][ T5072] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f444e7e67b0
[ 60.816536][ T5072] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 60.824540][ T5072]
[ 60.827720][ T5072] Kernel Offset: disabled
[ 60.832120][ T5072] Rebooting in 86400 seconds..