wlan0: failed to finalize CSA, disconnecting
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 PID: 5931 Comm: kworker/u4:13 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: phy7 ieee80211_csa_finalize_work
RIP: 0010:ieee80211_mesh_build_beacon+0x130/0x1ab0 net/mac80211/mesh.c:985
Code: d6 df 4c f7 89 c5 31 ff 89 c6 e8 5b 47 64 f7 85 ed 0f 84 98 00 00 00 e8 9e 43 64 f7 eb 05 e8 97 43 64 f7 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 b2 24 bd f7 4d 8b 36 4c 89 f0 48 c1
RSP: 0000:ffffc9000fe179a0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff88802424bc00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 0000000000000001 R08: dffffc0000000000 R09: 1ffffffff23fe2a0
R10: dffffc0000000000 R11: fffffbfff23fe2a1 R12: ffff88805c765a68
R13: ffffffff8a234c12 R14: 0000000000000000 R15: ffff88805c765a68
FS:  0000000000000000(0000) GS:ffff8880b8c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2e50cff8 CR3: 00000000659b7000 CR4: 00000000003506f0
DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000002
DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 ieee80211_mesh_rebuild_beacon+0x8a/0x130 net/mac80211/mesh.c:1165
 ieee80211_mesh_finish_csa+0xf7/0x1d0 net/mac80211/mesh.c:1552
 ieee80211_set_after_csa_beacon net/mac80211/cfg.c:3637 [inline]
 __ieee80211_csa_finalize net/mac80211/cfg.c:3685 [inline]
 ieee80211_csa_finalize+0x5c8/0xeb0 net/mac80211/cfg.c:3715
 ieee80211_csa_finalize_work+0xf6/0x140 net/mac80211/cfg.c:3740
 process_one_work kernel/workqueue.c:2657 [inline]
 process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:ieee80211_mesh_build_beacon+0x130/0x1ab0 net/mac80211/mesh.c:985
Code: d6 df 4c f7 89 c5 31 ff 89 c6 e8 5b 47 64 f7 85 ed 0f 84 98 00 00 00 e8 9e 43 64 f7 eb 05 e8 97 43 64 f7 4c 89 f0 48 c1 e8 03 <80> 3c 18 00 74 08 4c 89 f7 e8 b2 24 bd f7 4d 8b 36 4c 89 f0 48 c1
RSP: 0000:ffffc9000fe179a0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff88802424bc00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 0000000000000001 R08: dffffc0000000000 R09: 1ffffffff23fe2a0
R10: dffffc0000000000 R11: fffffbfff23fe2a1 R12: ffff88805c765a68
R13: ffffffff8a234c12 R14: 0000000000000000 R15: ffff88805c765a68
FS:  0000000000000000(0000) GS:ffff8880b8d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4721bf12f8 CR3: 000000002f320000 CR4: 00000000003506e0
----------------
Code disassembly (best guess), 2 bytes skipped:
   0:	4c f7 89 c5 31 ff 89 	rex.WR testq $0x475be8c6,-0x7600ce3b(%rcx)
   7:	c6 e8 5b 47
   b:	64 f7 85 ed 0f 84 98 	testl  $0xe8000000,%fs:-0x677bf013(%rbp)
  12:	00 00 00 e8
  16:	9e                   	sahf
  17:	43                   	rex.XB
  18:	64 f7 eb             	fs imul %ebx
  1b:	05 e8 97 43 64       	add    $0x644397e8,%eax
  20:	f7 4c 89 f0 48 c1 e8 	testl  $0x3e8c148,-0x10(%rcx,%rcx,4)
  27:	03
* 28:	80 3c 18 00          	cmpb   $0x0,(%rax,%rbx,1) <-- trapping instruction
  2c:	74 08                	je     0x36
  2e:	4c 89 f7             	mov    %r14,%rdi
  31:	e8 b2 24 bd f7       	call   0xf7bd24e8
  36:	4d 8b 36             	mov    (%r14),%r14
  39:	4c 89 f0             	mov    %r14,%rax
  3c:	48                   	rex.W
  3d:	c1                   	.byte 0xc1