------------[ cut here ]------------
WARNING: CPU: 0 PID: 62 at kernel/kcov.c:871 kcov_remote_start+0x5a2/0x7e0 kernel/kcov.c:871
Modules linked in:
CPU: 0 PID: 62 Comm: kworker/u8:4 Not tainted 6.10.0-rc7-syzkaller-00003-g4376e966ecb7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: events_unbound cfg80211_wiphy_work
RIP: 0010:kcov_remote_start+0x5a2/0x7e0 kernel/kcov.c:871
Code: 24 00 00 00 00 9c 8f 04 24 f7 04 24 00 02 00 00 0f 85 a6 01 00 00 41 f7 c6 00 02 00 00 0f 84 93 fa ff ff fb e9 8d fa ff ff 90 <0f> 0b 90 e8 66 cd ef 09 89 c0 48 c7 c7 c8 d4 02 00 48 03 3c c5 e0
RSP: 0018:ffffc900000061b0 EFLAGS: 00010002
RAX: 0000000080010302 RBX: ffff8880183d5a00 RCX: 0000000000000002
RDX: dffffc0000000000 RSI: ffffffff8bcaccc0 RDI: ffffffff8c1fe980
RBP: 0100000000000002 R08: ffffffff92fa75f7 R09: 1ffffffff25f4ebe
R10: dffffc0000000000 R11: fffffbfff25f4ebf R12: ffffffff8196315e
R13: ffff888029478700 R14: 0000000000000006 R15: ffff8880b942d4c8
FS: 0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002007d000 CR3: 000000007d7d8000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
kcov_remote_start_usb include/linux/kcov.h:55 [inline]
kcov_remote_start_usb_softirq include/linux/kcov.h:89 [inline]
__usb_hcd_giveback_urb+0x405/0x6e0 drivers/usb/core/hcd.c:1649
dummy_timer+0x830/0x45d0 drivers/usb/gadget/udc/dummy_hcd.c:1987
__run_hrtimer kernel/time/hrtimer.c:1689 [inline]
__hrtimer_run_queues+0x59b/0xd50 kernel/time/hrtimer.c:1753
hrtimer_interrupt+0x396/0x990 kernel/time/hrtimer.c:1815
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline]
__sysvec_apic_timer_interrupt+0x110/0x3f0 arch/x86/kernel/apic/apic.c:1049
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0x52/0xc0 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:_ieee802_11_parse_elems_full+0x6e0/0x49f0 net/mac80211/parse.c:215
Code: ff 84 c0 0f 84 b0 00 00 00 e8 6c 5a 91 f6 eb 05 e8 65 5a 91 f6 4c 89 f7 48 c7 c6 d0 6f 86 8f e8 d6 5f 91 f6 41 83 fe 64 7f 46 <41> 83 fe 24 0f 8f 8f 00 00 00 41 83 fe 04 0f 8f 0c 01 00 00 41 83
RSP: 0018:ffffc90000006940 EFLAGS: 00000297
RAX: 0000000000000002 RBX: 0000000000000014 RCX: 0000000000040000
RDX: 0000000000000028 RSI: ffffffff8f866fd0 RDI: 0000000000000000
RBP: ffffc90000006d30 R08: 0000000000000001 R09: ffffffff8b04cd5a
R10: 0000000000000028 R11: ffff8880183d5a00 R12: ffff888068b9a333
R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000
ieee802_11_parse_elems_full+0xde7/0x2870 net/mac80211/parse.c:902
ieee802_11_parse_elems_crc net/mac80211/ieee80211_i.h:2332 [inline]
ieee802_11_parse_elems net/mac80211/ieee80211_i.h:2339 [inline]
ieee80211_inform_bss+0x15f/0x1080 net/mac80211/scan.c:79
rdev_inform_bss net/wireless/rdev-ops.h:418 [inline]
cfg80211_inform_single_bss_data+0x1121/0x2360 net/wireless/scan.c:2293
cfg80211_inform_bss_data+0x3dd/0x5a70 net/wireless/scan.c:3117
cfg80211_inform_bss_frame_data+0x3bc/0x720 net/wireless/scan.c:3207
ieee80211_bss_info_update+0x8a7/0xbc0 net/mac80211/scan.c:226
ieee80211_scan_rx+0x526/0x9c0 net/mac80211/scan.c:340
__ieee80211_rx_handle_packet net/mac80211/rx.c:5222 [inline]
ieee80211_rx_list+0x2b00/0x3780 net/mac80211/rx.c:5459
ieee80211_rx_napi+0x18a/0x3c0 net/mac80211/rx.c:5482
ieee80211_rx include/net/mac80211.h:5093 [inline]
ieee80211_handle_queued_frames+0xe7/0x1e0 net/mac80211/main.c:438
tasklet_action_common+0x321/0x4d0 kernel/softirq.c:785
handle_softirqs+0x2c4/0x970 kernel/softirq.c:554
do_softirq+0x11b/0x1e0 kernel/softirq.c:455
__local_bh_enable_ip+0x1bb/0x200 kernel/softirq.c:382
ieee80211_tx_skb_tid_band net/mac80211/ieee80211_i.h:2268 [inline]
ieee80211_handle_roc_started+0x267/0x440 net/mac80211/offchannel.c:248
_ieee80211_start_next_roc+0x7a1/0xb00 net/mac80211/offchannel.c:381
cfg80211_wiphy_work+0x221/0x260 net/wireless/core.c:437
process_one_work kernel/workqueue.c:3248 [inline]
process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3329
worker_thread+0x86d/0xd50 kernel/workqueue.c:3409
kthread+0x2f0/0x390 kernel/kthread.c:389
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
----------------
Code disassembly (best guess):
0: ff 84 c0 0f 84 b0 00 incl 0xb0840f(%rax,%rax,8)
7: 00 00 add %al,(%rax)
9: e8 6c 5a 91 f6 call 0xf6915a7a
e: eb 05 jmp 0x15
10: e8 65 5a 91 f6 call 0xf6915a7a
15: 4c 89 f7 mov %r14,%rdi
18: 48 c7 c6 d0 6f 86 8f mov $0xffffffff8f866fd0,%rsi
1f: e8 d6 5f 91 f6 call 0xf6915ffa
24: 41 83 fe 64 cmp $0x64,%r14d
28: 7f 46 jg 0x70
* 2a: 41 83 fe 24 cmp $0x24,%r14d <-- trapping instruction
2e: 0f 8f 8f 00 00 00 jg 0xc3
34: 41 83 fe 04 cmp $0x4,%r14d
38: 0f 8f 0c 01 00 00 jg 0x14a
3e: 41 rex.B
3f: 83 .byte 0x83