wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
Oops: general protection fault, probably for non-canonical address 0xdffffc000000069f: 0000 [#1] SMP KASAN PTI
KASAN: probably user-memory-access in range [0x00000000000034f8-0x00000000000034ff]
CPU: 0 UID: 0 PID: 7823 Comm: kworker/u8:9 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue: events_unbound cfg80211_wiphy_work
RIP: 0010:__ieee80211_get_radio_mask+0xa1/0x420 net/mac80211/util.c:4225
Code: 04 00 00 00 00 eb 1e e8 ed 06 9f f6 49 89 de 49 83 fc 0e 0f 84 71 03 00 00 e8 db 06 9f f6 48 83 c5 08 49 ff c4 48 8b 44 24 30 <42> 0f b6 04 38 84 c0 0f 85 f6 02 00 00 48 8b 44 24 08 44 0f b7 28
RSP: 0018:ffffc90003636fb8 EFLAGS: 00010202
RAX: 000000000000069f RBX: 0000000000000ec0 RCX: ffff8880276f8000
RDX: 0000000000000330 RSI: 0000000000000000 RDI: 0000000000000ec0
RBP: 0000000000003480 R08: ffff888079520ad7 R09: 1ffff1100f2a415a
R10: dffffc0000000000 R11: ffffffff8b26ee80 R12: 0000000000000000
R13: ffff888079520020 R14: 0000000000000ed0 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff88812527c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00002000001d4000 CR3: 0000000052412000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 rdev_get_radio_mask net/wireless/rdev-ops.h:1605 [inline]
 cfg80211_calculate_bi_data net/wireless/util.c:2431 [inline]
 cfg80211_iter_combinations+0x260/0x1c90 net/wireless/util.c:2504
 ieee80211_max_num_channels+0x186/0x250 net/mac80211/util.c:4389
 ieee80211_can_create_new_chanctx+0x1df/0x270 net/mac80211/chan.c:256
 ieee80211_find_available_radio net/mac80211/chan.c:1529 [inline]
 ieee80211_find_or_create_chanctx+0x4e2/0x7b0 net/mac80211/chan.c:2208
 _ieee80211_link_use_channel+0x4fd/0xcb0 net/mac80211/chan.c:2319
 ieee80211_link_use_channel net/mac80211/ieee80211_i.h:2823 [inline]
 __ieee80211_sta_join_ibss+0x6a4/0x1660 net/mac80211/ibss.c:292
 ieee80211_sta_create_ibss+0x300/0x480 net/mac80211/ibss.c:1286
 ieee80211_sta_find_ibss net/mac80211/ibss.c:1415 [inline]
 ieee80211_ibss_work+0xd99/0x1060 net/mac80211/ibss.c:1636
 cfg80211_wiphy_work+0x29e/0x420 net/wireless/core.c:538
 process_one_work kernel/workqueue.c:3314 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3397
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3478
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__ieee80211_get_radio_mask+0xa1/0x420 net/mac80211/util.c:4225
Code: 04 00 00 00 00 eb 1e e8 ed 06 9f f6 49 89 de 49 83 fc 0e 0f 84 71 03 00 00 e8 db 06 9f f6 48 83 c5 08 49 ff c4 48 8b 44 24 30 <42> 0f b6 04 38 84 c0 0f 85 f6 02 00 00 48 8b 44 24 08 44 0f b7 28
RSP: 0018:ffffc90003636fb8 EFLAGS: 00010202
RAX: 000000000000069f RBX: 0000000000000ec0 RCX: ffff8880276f8000
RDX: 0000000000000330 RSI: 0000000000000000 RDI: 0000000000000ec0
RBP: 0000000000003480 R08: ffff888079520ad7 R09: 1ffff1100f2a415a
R10: dffffc0000000000 R11: ffffffff8b26ee80 R12: 0000000000000000
R13: ffff888079520020 R14: 0000000000000ed0 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff88812527c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00002000004f9000 CR3: 0000000084fec000 CR4: 00000000003526f0
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	00 00                	add    %al,(%rax)
   2:	00 00                	add    %al,(%rax)
   4:	eb 1e                	jmp    0x24
   6:	e8 ed 06 9f f6       	call   0xf69f06f8
   b:	49 89 de             	mov    %rbx,%r14
   e:	49 83 fc 0e          	cmp    $0xe,%r12
  12:	0f 84 71 03 00 00    	je     0x389
  18:	e8 db 06 9f f6       	call   0xf69f06f8
  1d:	48 83 c5 08          	add    $0x8,%rbp
  21:	49 ff c4             	inc    %r12
  24:	48 8b 44 24 30       	mov    0x30(%rsp),%rax
* 29:	42 0f b6 04 38       	movzbl (%rax,%r15,1),%eax <-- trapping instruction
  2e:	84 c0                	test   %al,%al
  30:	0f 85 f6 02 00 00    	jne    0x32c
  36:	48 8b 44 24 08       	mov    0x8(%rsp),%rax
  3b:	44 0f b7 28          	movzwl (%rax),%r13d