------------[ cut here ]------------ WARNING: CPU: 0 PID: 17308 at net/mac80211/rx.c:4592 ieee80211_rx_napi.cold+0x11/0x80 net/mac80211/rx.c:4592 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 17308 Comm: syz-executor.3 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 panic+0x26a/0x50e kernel/panic.c:186 __warn.cold+0x20/0x5a kernel/panic.c:541 report_bug+0x262/0x2b0 lib/bug.c:183 fixup_bug arch/x86/kernel/traps.c:178 [inline] fixup_bug arch/x86/kernel/traps.c:173 [inline] do_error_trap+0x1d7/0x310 arch/x86/kernel/traps.c:296 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1038 RIP: 0010:ieee80211_rx_napi.cold+0x11/0x80 net/mac80211/rx.c:4592 Code: ff e8 c4 15 4e f9 48 c7 c7 c0 c0 67 89 e8 23 47 df ff 0f 0b e9 02 0c 8c ff e8 ac 15 4e f9 48 c7 c7 c0 c0 67 89 e8 0b 47 df ff <0f> 0b e9 64 82 8c ff e8 94 15 4e f9 48 c7 c7 c0 c0 67 89 e8 f3 46 RSP: 0018:ffff8880ba007d00 EFLAGS: 00010282 RAX: 0000000000000024 RBX: ffff888051cbb488 RCX: 0000000000000000 RDX: 0000000000000100 RSI: ffffffff814dff01 RDI: ffffed1017400f92 RBP: 0000000000000000 R08: 0000000000000024 R09: 0000000000000000 R10: 0000000000000005 R11: 0000000000000000 R12: ffff8880aa847280 R13: ffff888051cb9b40 R14: ffff888051cb9b40 R15: ffff8880aa847280 ieee80211_rx include/net/mac80211.h:4109 [inline] ieee80211_tasklet_handler+0x101/0x160 net/mac80211/main.c:229 tasklet_action_common.constprop.0+0x265/0x360 kernel/softirq.c:522 __do_softirq+0x265/0x980 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x215/0x260 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:deref_stack_reg arch/x86/kernel/unwind_orc.c:334 [inline] RIP: 0010:deref_stack_reg+0x14d/0x1d0 arch/x86/kernel/unwind_orc.c:328 Code: 32 48 8d 74 24 28 48 89 ef 4c 89 ea e8 cc fc ff ff 48 c1 ea 03 48 8b 6c 24 28 48 b8 00 00 00 00 00 fc ff df 80 3c 02 00 75 4c <49> 89 6d 00 b8 01 00 00 00 48 ba 00 00 00 00 00 fc ff df 48 c7 04 RSP: 0018:ffff88808d50f658 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 RAX: dffffc0000000000 RBX: 1ffff11011aa1ecc RCX: 0000000000000000 RDX: 1ffff11011aa1f0c RSI: ffff88808d50f680 RDI: ffff88808d50fd70 RBP: 0000000000000021 R08: 0000000000000001 R09: 0000000000000001 R10: ffff88808d50f87f R11: 0000000000074071 R12: ffff88808d50f820 R13: ffff88808d50f860 R14: ffff88808d508000 R15: ffffffff8c059f64 unwind_next_frame+0xf83/0x1400 arch/x86/kernel/unwind_orc.c:555 __save_stack_trace+0x9f/0x190 arch/x86/kernel/stacktrace.c:44 save_stack mm/kasan/kasan.c:448 [inline] set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:553 slab_post_alloc_hook mm/slab.h:445 [inline] slab_alloc mm/slab.c:3397 [inline] kmem_cache_alloc_trace+0x11a/0x380 mm/slab.c:3623 kmalloc include/linux/slab.h:515 [inline] dccp_feat_entry_new+0x1a6/0x390 net/dccp/feat.c:467 dccp_feat_push_change net/dccp/feat.c:487 [inline] __feat_register_sp+0x369/0x5a0 net/dccp/feat.c:741 dccp_feat_init+0x2bb/0x820 net/dccp/feat.c:1469 dccp_init_sock+0x2fc/0x3d0 net/dccp/proto.c:208 dccp_v6_init_sock+0x1b/0xa0 net/dccp/ipv6.c:1010 inet6_create net/ipv6/af_inet6.c:255 [inline] inet6_create+0x9bf/0xf70 net/ipv6/af_inet6.c:110 __sock_create+0x3d8/0x740 net/socket.c:1365 sock_create net/socket.c:1416 [inline] __sys_socket+0xef/0x200 net/socket.c:1458 __do_sys_socket net/socket.c:1467 [inline] __se_sys_socket net/socket.c:1465 [inline] __x64_sys_socket+0x6f/0xb0 net/socket.c:1465 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f490e21e5a9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f490cb91168 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 RAX: ffffffffffffffda RBX: 00007f490e33ef80 RCX: 00007f490e21e5a9 RDX: 0000000000000000 RSI: 0000000000000006 RDI: 000000000000000a RBP: 00007f490e279580 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc4de3f1ef R14: 00007f490cb91300 R15: 0000000000022000 Kernel Offset: disabled Rebooting in 86400 seconds.. ---------------- Code disassembly (best guess): 0: 32 48 8d xor -0x73(%rax),%cl 3: 74 24 je 0x29 5: 28 48 89 sub %cl,-0x77(%rax) 8: ef out %eax,(%dx) 9: 4c 89 ea mov %r13,%rdx c: e8 cc fc ff ff callq 0xfffffcdd 11: 48 c1 ea 03 shr $0x3,%rdx 15: 48 8b 6c 24 28 mov 0x28(%rsp),%rbp 1a: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 21: fc ff df 24: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) 28: 75 4c jne 0x76 * 2a: 49 89 6d 00 mov %rbp,0x0(%r13) <-- trapping instruction 2e: b8 01 00 00 00 mov $0x1,%eax 33: 48 ba 00 00 00 00 00 movabs $0xdffffc0000000000,%rdx 3a: fc ff df 3d: 48 rex.W 3e: c7 .byte 0xc7 3f: 04 .byte 0x4