------------[ cut here ]------------ wlan1: Failed check-sdata-in-driver check, flags: 0x0 WARNING: CPU: 1 PID: 3099 at net/mac80211/main.c:235 ieee80211_bss_info_change_notify+0x1d4/0x2f4 net/mac80211/main.c:235 Modules linked in: CPU: 1 PID: 3099 Comm: syz-executor137 Not tainted 6.1.0-rc8-syzkaller-33330-ga5541c0811a0 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : ieee80211_bss_info_change_notify+0x1d4/0x2f4 net/mac80211/main.c:235 lr : ieee80211_bss_info_change_notify+0x1d4/0x2f4 net/mac80211/main.c:235 sp : ffff80000ffb3700 x29: ffff80000ffb3700 x28: ffff0000c6799a40 x27: 0000000000000000 x26: ffff80000d37c000 x25: ffff0000c68206c0 x24: ffff80000d95e000 x23: 0000000000000000 x22: 0000000000000000 x21: ffff0000c3bf0c80 x20: 0000000000400000 x19: ffff0000c6820e00 x18: 000000000000005a x17: 0000000000000000 x16: ffff80000dbe6158 x15: ffff0000c6799a40 x14: 0000000000000000 x13: 00000000ffffffff x12: ffff0000c6799a40 x11: ff808000081c4d64 x10: 0000000000000000 x9 : 9e145f44d4a1cc00 x8 : 9e145f44d4a1cc00 x7 : ffff80000816678c x6 : 0000000000000000 x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000 x2 : 0000000000000006 x1 : 0000000100000000 x0 : 0000000000000035 Call trace: ieee80211_bss_info_change_notify+0x1d4/0x2f4 net/mac80211/main.c:235 ieee80211_ocb_leave+0xf0/0x170 net/mac80211/ocb.c:229 ieee80211_leave_ocb+0x20/0x30 net/mac80211/cfg.c:2817 rdev_leave_ocb net/wireless/rdev-ops.h:393 [inline] __cfg80211_leave_ocb net/wireless/ocb.c:71 [inline] cfg80211_leave_ocb+0xcc/0x150 net/wireless/ocb.c:85 cfg80211_change_iface+0x2f8/0x5e8 net/wireless/util.c:1069 nl80211_set_interface+0x15c/0x33c net/wireless/nl80211.c:4166 genl_family_rcv_msg_doit net/netlink/genetlink.c:756 [inline] genl_family_rcv_msg net/netlink/genetlink.c:833 [inline] genl_rcv_msg+0x458/0x4f4 net/netlink/genetlink.c:850 netlink_rcv_skb+0xe8/0x1d4 net/netlink/af_netlink.c:2540 genl_rcv+0x38/0x50 net/netlink/genetlink.c:861 netlink_unicast_kernel+0xfc/0x1dc net/netlink/af_netlink.c:1319 netlink_unicast+0x164/0x248 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x484/0x584 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] ____sys_sendmsg+0x2f8/0x440 net/socket.c:2482 ___sys_sendmsg net/socket.c:2536 [inline] __sys_sendmsg+0x1ac/0x228 net/socket.c:2565 __do_sys_sendmsg net/socket.c:2574 [inline] __se_sys_sendmsg net/socket.c:2572 [inline] __arm64_sys_sendmsg+0x2c/0x3c net/socket.c:2572 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall arch/arm64/kernel/syscall.c:52 [inline] el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x48/0x140 arch/arm64/kernel/syscall.c:197 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584 irq event stamp: 712 hardirqs last enabled at (711): [] raw_spin_rq_unlock_irq kernel/sched/sched.h:1366 [inline] hardirqs last enabled at (711): [] finish_lock_switch+0x94/0xe8 kernel/sched/core.c:4968 hardirqs last disabled at (712): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405 softirqs last enabled at (690): [] _stext+0x2e4/0x37c softirqs last disabled at (679): [] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 ---[ end trace 0000000000000000 ]--- netlink: 'syz-executor137': attribute type 27 has an invalid length.