------------[ cut here ]------------
no supported rates for sta (null) (0xffffffff, band 0) in rate_mask 0xfff with flags 0x20
WARNING: CPU: 1 PID: 9380 at net/mac80211/rate.c:385 __rate_control_send_low+0x659/0x890 net/mac80211/rate.c:380
Modules linked in:
CPU: 1 PID: 9380 Comm: syz-executor.3 Not tainted 6.9.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
RIP: 0010:__rate_control_send_low+0x659/0x890 net/mac80211/rate.c:380
Code: 8b 14 24 0f 85 de 01 00 00 8b 0a 48 c7 c7 60 75 dd 8c 48 8b 74 24 10 44 89 f2 44 8b 44 24 1c 44 8b 4c 24 0c e8 f8 fa 65 f6 90 <0f> 0b 90 90 e9 71 fe ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c db
RSP: 0018:ffffc90000a08740 EFLAGS: 00010246
RAX: 9f3568d7e2a54c00 RBX: 000000000000000c RCX: ffff88802a055a00
RDX: 0000000000000101 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff88801edaade8 R08: ffffffff81587d32 R09: fffffbfff1c39b5c
R10: dffffc0000000000 R11: fffffbfff1c39b5c R12: 0000000000000800
R13: 000000000000000c R14: 00000000ffffffff R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8880b9500000(0063) knlGS:00000000f5ecbb40
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00007f3586d490d0 CR3: 000000006801c000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
rate_control_send_low+0x1a8/0x770 net/mac80211/rate.c:405
rate_control_get_rate+0x20e/0x5e0 net/mac80211/rate.c:921
ieee80211_beacon_get_finish+0x49e/0x870 net/mac80211/tx.c:5254
__ieee80211_beacon_get+0xf7e/0x15c0
ieee80211_beacon_get_tim+0xb4/0x320 net/mac80211/tx.c:5593
ieee80211_beacon_get include/net/mac80211.h:5555 [inline]
mac80211_hwsim_beacon_tx+0x398/0x7e0 drivers/net/wireless/virtual/mac80211_hwsim.c:2296
__iterate_interfaces+0x223/0x4c0 net/mac80211/util.c:772
ieee80211_iterate_active_interfaces_atomic+0xd8/0x170 net/mac80211/util.c:808
mac80211_hwsim_beacon+0xd4/0x1f0 drivers/net/wireless/virtual/mac80211_hwsim.c:2326
__run_hrtimer kernel/time/hrtimer.c:1692 [inline]
__hrtimer_run_queues+0x5a5/0xd50 kernel/time/hrtimer.c:1756
hrtimer_run_softirq+0x19a/0x2c0 kernel/time/hrtimer.c:1773
handle_softirqs+0x2d6/0x990 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:preempt_count_add+0x140/0x190 kernel/sched/core.c:5874
Code: 5c ff ff ff 48 c7 c1 60 d6 72 94 80 e1 07 80 c1 03 38 c1 0f 8c fe fe ff ff 48 c7 c7 60 d6 72 94 e8 25 05 95 00 e9 ed fe ff ff <48> c7 c1 60 d6 72 94 80 e1 07 80 c1 03 38 c1 0f 8c 07 ff ff ff 48
RSP: 0018:ffffc90004ae6928 EFLAGS: 00000202
RAX: 0000000000000004 RBX: 0000000000000001 RCX: ffffffff9472d603
RDX: ffff88802a055a00 RSI: 0000000000000001 RDI: 0000000000000001
RBP: ffffc90004ae6a20 R08: ffffffff81414011 R09: ffffc90004ae6b10
R10: 0000000000000003 R11: ffffffff8181e7c0 R12: ffff88802a055a00
R13: dffffc0000000000 R14: 0000000000000001 R15: dffffc0000000000
unwind_next_frame+0xc1/0x2a00 arch/x86/kernel/unwind_orc.c:479
arch_stack_walk+0x151/0x1b0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x118/0x1d0 kernel/stacktrace.c:122
save_stack+0xfb/0x1f0 mm/page_owner.c:156
__set_page_owner+0x8d/0x810 mm/page_owner.c:325
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1534
prep_new_page mm/page_alloc.c:1541 [inline]
get_page_from_freelist+0x3410/0x35b0 mm/page_alloc.c:3317
__alloc_pages+0x256/0x6c0 mm/page_alloc.c:4575
alloc_pages_mpol+0x3e8/0x680 mm/mempolicy.c:2264
shmem_alloc_folio mm/shmem.c:1628 [inline]
shmem_alloc_and_add_folio+0x24d/0xbc0 mm/shmem.c:1668
shmem_get_folio_gfp+0x82d/0x1f50 mm/shmem.c:2055
shmem_get_folio mm/shmem.c:2160 [inline]
shmem_write_begin+0x170/0x4d0 mm/shmem.c:2744
generic_perform_write+0x322/0x640 mm/filemap.c:3974
shmem_file_write_iter+0xfc/0x120 mm/shmem.c:2920
call_write_iter include/linux/fs.h:2110 [inline]
iter_file_splice_write+0xbd7/0x14e0 fs/splice.c:743
do_splice_from fs/splice.c:941 [inline]
direct_splice_actor+0x11e/0x220 fs/splice.c:1164
splice_direct_to_actor+0x58e/0xc90 fs/splice.c:1108
do_splice_direct_actor fs/splice.c:1207 [inline]
do_splice_direct+0x28c/0x3e0 fs/splice.c:1233
do_sendfile+0x56d/0xdc0 fs/read_write.c:1295
__do_compat_sys_sendfile fs/read_write.c:1383 [inline]
__se_compat_sys_sendfile+0x194/0x1f0 fs/read_write.c:1366
do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]
__do_fast_syscall_32+0xb8/0x120 arch/x86/entry/common.c:386
do_fast_syscall_32+0x34/0x80 arch/x86/entry/common.c:411
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf72d9579
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
RSP: 002b:00000000f5ecb5ac EFLAGS: 00000206 ORIG_RAX: 00000000000000bb
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000003
RDX: 0000000000000000 RSI: 00000000fffffffe RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
----------------
Code disassembly (best guess), 3 bytes skipped:
0: ff 48 c7 decl -0x39(%rax)
3: c1 60 d6 72 shll $0x72,-0x2a(%rax)
7: 94 xchg %eax,%esp
8: 80 e1 07 and $0x7,%cl
b: 80 c1 03 add $0x3,%cl
e: 38 c1 cmp %al,%cl
10: 0f 8c fe fe ff ff jl 0xffffff14
16: 48 c7 c7 60 d6 72 94 mov $0xffffffff9472d660,%rdi
1d: e8 25 05 95 00 call 0x950547
22: e9 ed fe ff ff jmp 0xffffff14
* 27: 48 c7 c1 60 d6 72 94 mov $0xffffffff9472d660,%rcx <-- trapping instruction
2e: 80 e1 07 and $0x7,%cl
31: 80 c1 03 add $0x3,%cl
34: 38 c1 cmp %al,%cl
36: 0f 8c 07 ff ff ff jl 0xffffff43
3c: 48 rex.W