wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 ------------[ cut here ]------------ no supported rates for sta (null) (0xffffffff, band 0) in rate_mask 0x0 with flags 0x0 WARNING: CPU: 1 PID: 106896 at net/mac80211/rate.c:375 __rate_control_send_low+0x4b6/0x680 net/mac80211/rate.c:375 Modules linked in: CPU: 1 PID: 106896 Comm: syz-executor.4 Not tainted 5.10.180 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:__rate_control_send_low+0x4b6/0x680 net/mac80211/rate.c:375 Code: 14 48 89 44 24 10 e8 09 d5 87 fd 44 8b 44 24 24 45 89 e9 44 89 e1 48 8b 74 24 10 44 89 f2 48 c7 c7 00 7b 95 84 e8 17 b7 1d 00 <0f> 0b e9 29 fe ff ff e8 de d4 87 fd 48 8b 44 24 08 48 8d 78 7f 48 RSP: 0018:ffff88806cf09000 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff88802d77fb68 RCX: 0000000000000000 RDX: ffff88803cc24ec0 RSI: ffffffff8129a423 RDI: ffffed100d9e11f2 RBP: ffff8880341431e8 R08: 0000000000000001 R09: ffff88806cf37b4f R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000000 R14: 00000000ffffffff R15: 0000000000000000 FS: 00007f56e5e19700(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f56e5e17ff8 CR3: 000000002ce96000 CR4: 0000000000350ee0 Call Trace: rate_control_send_low+0x1f2/0x600 net/mac80211/rate.c:400 rate_control_get_rate+0x18b/0x510 net/mac80211/rate.c:913 ieee80211_tx_h_rate_ctrl+0x9ed/0x1630 net/mac80211/tx.c:753 invoke_tx_handlers_early+0xaf3/0x2570 net/mac80211/tx.c:1788 ieee80211_tx+0x246/0x410 net/mac80211/tx.c:1930 ieee80211_xmit+0x220/0x2a0 net/mac80211/tx.c:2030 __ieee80211_subif_start_xmit+0x752/0xca0 net/mac80211/tx.c:4060 ieee80211_subif_start_xmit+0xef/0xf70 net/mac80211/tx.c:4196 __netdev_start_xmit include/linux/netdevice.h:4801 [inline] netdev_start_xmit include/linux/netdevice.h:4815 [inline] xmit_one net/core/dev.c:3590 [inline] dev_hard_start_xmit+0x1cb/0x6f0 net/core/dev.c:3606 sch_direct_xmit+0x25f/0x790 net/sched/sch_generic.c:336 qdisc_restart net/sched/sch_generic.c:401 [inline] __qdisc_run+0x4aa/0x1570 net/sched/sch_generic.c:409 qdisc_run include/net/pkt_sched.h:127 [inline] qdisc_run include/net/pkt_sched.h:124 [inline] __dev_xmit_skb net/core/dev.c:3782 [inline] __dev_queue_xmit+0xd99/0x2710 net/core/dev.c:4138 neigh_resolve_output net/core/neighbour.c:1529 [inline] neigh_resolve_output+0x4da/0x7f0 net/core/neighbour.c:1509 neigh_output include/net/neighbour.h:516 [inline] ip6_finish_output2+0xaaf/0x1fe0 net/ipv6/ip6_output.c:145 __ip6_finish_output.part.0+0x4f7/0xb50 net/ipv6/ip6_output.c:210 __ip6_finish_output include/linux/skbuff.h:972 [inline] ip6_finish_output net/ipv6/ip6_output.c:220 [inline] NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip6_output+0x3b1/0x7f0 net/ipv6/ip6_output.c:243 dst_output include/net/dst.h:442 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] NF_HOOK include/linux/netfilter.h:295 [inline] mld_sendpack+0x8f3/0xe40 net/ipv6/mcast.c:1676 mld_send_cr net/ipv6/mcast.c:1972 [inline] mld_ifc_timer_expire+0x60a/0xf10 net/ipv6/mcast.c:2471 call_timer_fn+0x182/0x4a0 kernel/time/timer.c:1414 expire_timers kernel/time/timer.c:1459 [inline] __run_timers.part.0+0x667/0x9a0 kernel/time/timer.c:1753 __run_timers kernel/time/timer.c:1731 [inline] run_timer_softirq+0x80/0x120 kernel/time/timer.c:1766 __do_softirq+0x1b8/0x7c9 kernel/softirq.c:298 asm_call_irq_on_stack+0x12/0x20 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline] do_softirq_own_stack+0x80/0xa0 arch/x86/kernel/irq_64.c:77 invoke_softirq kernel/softirq.c:393 [inline] __irq_exit_rcu kernel/softirq.c:423 [inline] irq_exit_rcu+0x114/0x1b0 kernel/softirq.c:435 sysvec_apic_timer_interrupt+0x43/0xa0 arch/x86/kernel/apic/apic.c:1094 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635 RIP: 0010:stack_trace_consume_entry+0x7a/0x160 kernel/stacktrace.c:88 Code: 0f 8e ad 00 00 00 31 c0 3b 6b 08 0f 83 81 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 0c 48 89 fa 48 c1 ea 03 0f b6 14 02 <48> 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 98 00 00 00 8b RSP: 0018:ffff888030ecf130 EFLAGS: 00000217 RAX: dffffc0000000000 RBX: ffff888030ecf208 RCX: 1ffff110061d9e01 RDX: 0000000000000000 RSI: ffffffff832da5eb RDI: ffff888030ecf214 RBP: 0000000000000008 R08: 0000000000000001 R09: 0000000000000001 R10: 0000000000032041 R11: 1ffff110061d9e17 R12: ffff888030ecf208 R13: 0000000000000000 R14: ffff88803cc24ec0 R15: 0000000000000170 arch_stack_walk+0x73/0xf0 arch/x86/kernel/stacktrace.c:27 stack_trace_save+0x8c/0xc0 kernel/stacktrace.c:121 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_set_track mm/kasan/common.c:56 [inline] __kasan_kmalloc.constprop.0+0xc9/0xd0 mm/kasan/common.c:461 slab_post_alloc_hook mm/slab.h:532 [inline] slab_alloc_node mm/slub.c:2896 [inline] slab_alloc mm/slub.c:2904 [inline] kmem_cache_alloc+0x13b/0x310 mm/slub.c:2909 mem_pool_alloc mm/kmemleak.c:423 [inline] create_object.isra.0+0x3a/0xa20 mm/kmemleak.c:578 kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline] slab_post_alloc_hook mm/slab.h:534 [inline] slab_alloc_node mm/slub.c:2896 [inline] kmem_cache_alloc_node+0x169/0x330 mm/slub.c:2932 __alloc_skb+0x6d/0x5b0 net/core/skbuff.c:198 alloc_skb include/linux/skbuff.h:1102 [inline] nlmsg_new include/net/netlink.h:953 [inline] rtnl_getlink+0x60e/0xaa0 net/core/rtnetlink.c:3593 rtnetlink_rcv_msg+0x41e/0xbb0 net/core/rtnetlink.c:5571 netlink_rcv_skb+0x14b/0x430 net/netlink/af_netlink.c:2496 netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline] netlink_unicast+0x549/0x7f0 net/netlink/af_netlink.c:1348 netlink_sendmsg+0x90f/0xdf0 net/netlink/af_netlink.c:1915 sock_sendmsg_nosec net/socket.c:651 [inline] sock_sendmsg+0x154/0x190 net/socket.c:671 __sys_sendto+0x21c/0x320 net/socket.c:1986 __do_sys_sendto net/socket.c:1998 [inline] __se_sys_sendto net/socket.c:1994 [inline] __x64_sys_sendto+0xdd/0x1b0 net/socket.c:1994 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xc6 RIP: 0033:0x7f56e88568ac Code: fa fa ff ff 44 8b 4c 24 2c 4c 8b 44 24 20 89 c5 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b 7c 24 08 0f 05 <48> 3d 00 f0 ff ff 77 34 89 ef 48 89 44 24 08 e8 20 fb ff ff 48 8b RSP: 002b:00007f56e5e17fc0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f56e5e180f0 RCX: 00007f56e88568ac RDX: 0000000000000020 RSI: 00007f56e5e18140 RDI: 0000000000000005 RBP: 0000000000000000 R08: 00007f56e5e18014 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 00007f56e5e1806c R13: 00007f56e5e18140 R14: 0000000000000005 R15: 0000000000000000 irq event stamp: 21716 hardirqs last enabled at (21724): [] console_unlock+0x92d/0xb40 kernel/printk/printk.c:2561 hardirqs last disabled at (21751): [] sysvec_apic_timer_interrupt+0xb/0xa0 arch/x86/kernel/apic/apic.c:1094 softirqs last enabled at (15576): [] netlink_insert+0x187/0x1720 net/netlink/af_netlink.c:599 softirqs last disabled at (15631): [] asm_call_irq_on_stack+0x12/0x20 ---[ end trace b00a4c32d4140df0 ]--- mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium EXT4-fs (loop2): mounted filesystem without journal. Opts: stripe=0x0000000000000003,,errors=continue EXT4-fs (loop2): mounted filesystem without journal. Opts: stripe=0x0000000000000003,,errors=continue EXT4-fs (loop2): mounted filesystem without journal. Opts: stripe=0x0000000000000003,,errors=continue EXT4-fs (loop2): mounted filesystem without journal. Opts: stripe=0x0000000000000003,,errors=continue EXT4-fs (loop0): mounted filesystem without journal. Opts: noinit_itable,,errors=continue udc-core: couldn't find an available UDC or it's busy misc raw-gadget: fail, usb_gadget_probe_driver returned -19 syz-executor.2 calls setitimer() with new_value NULL pointer. Misfeature support will be removed udc-core: couldn't find an available UDC or it's busy misc raw-gadget: fail, usb_gadget_probe_driver returned -19 udc-core: couldn't find an available UDC or it's busy misc raw-gadget: fail, usb_gadget_probe_driver returned -19 ---------------- Code disassembly (best guess): 0: 0f 8e ad 00 00 00 jle 0xb3 6: 31 c0 xor %eax,%eax 8: 3b 6b 08 cmp 0x8(%rbx),%ebp b: 0f 83 81 00 00 00 jae 0x92 11: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 18: fc ff df 1b: 48 8d 7b 0c lea 0xc(%rbx),%rdi 1f: 48 89 fa mov %rdi,%rdx 22: 48 c1 ea 03 shr $0x3,%rdx 26: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx * 2a: 48 89 f8 mov %rdi,%rax <-- trapping instruction 2d: 83 e0 07 and $0x7,%eax 30: 83 c0 03 add $0x3,%eax 33: 38 d0 cmp %dl,%al 35: 7c 08 jl 0x3f 37: 84 d2 test %dl,%dl 39: 0f 85 98 00 00 00 jne 0xd7 3f: 8b .byte 0x8b