------------[ cut here ]------------
WARNING: CPU: 1 PID: 4364 at net/mac80211/tx.c:4934 __ieee80211_beacon_get+0x1abc/0x2110 net/mac80211/tx.c:5255
Modules linked in:
CPU: 1 PID: 4364 Comm: syz-executor350 Not tainted 6.1.129-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
RIP: 0010:__ieee80211_beacon_update_cntdwn net/mac80211/tx.c:4934 [inline]
RIP: 0010:__ieee80211_beacon_get+0x1abc/0x2110 net/mac80211/tx.c:5255
Code: ff ff ff e8 76 86 52 f7 0f 0b 48 8b 7c 24 20 e8 fa a6 66 fe e9 6f e8 ff ff e8 60 86 52 f7 0f 0b e9 92 ed ff ff e8 54 86 52 f7 <0f> 0b e9 26 f1 ff ff 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c fc e8
RSP: 0018:ffffc900001e0820 EFLAGS: 00010246
RAX: ffffffff8a38107c RBX: 0000000000000000 RCX: ffff888075498000
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900001e0a30 R08: ffffffff8a38019c R09: ffffffff8a37f9a2
R10: 0000000000000003 R11: ffff888075498000 R12: dffffc0000000000
R13: 1ffff9200003c11c R14: ffff88802a876258 R15: ffffffff8a37f670
FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f98d8f53270 CR3: 000000000d08e000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
ieee80211_beacon_get_tim+0xb1/0x5d0 net/mac80211/tx.c:5342
ieee80211_beacon_get include/net/mac80211.h:5249 [inline]
mac80211_hwsim_beacon_tx+0x1d2/0xaa0 drivers/net/wireless/mac80211_hwsim.c:2086
__iterate_interfaces+0x21e/0x4b0 net/mac80211/util.c:788
ieee80211_iterate_active_interfaces_atomic+0xd4/0x170 net/mac80211/util.c:824
mac80211_hwsim_beacon+0xd0/0x1e0 drivers/net/wireless/mac80211_hwsim.c:2142
__run_hrtimer kernel/time/hrtimer.c:1689 [inline]
__hrtimer_run_queues+0x5e5/0xe50 kernel/time/hrtimer.c:1753
hrtimer_run_softirq+0x196/0x2c0 kernel/time/hrtimer.c:1770
handle_softirqs+0x2ee/0xa40 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0x157/0x240 kernel/softirq.c:661
irq_exit_rcu+0x5/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:on_stack arch/x86/include/asm/stacktrace.h:55 [inline]
RIP: 0010:stack_access_ok arch/x86/kernel/unwind_orc.c:347 [inline]
RIP: 0010:deref_stack_reg arch/x86/kernel/unwind_orc.c:357 [inline]
RIP: 0010:unwind_next_frame+0xc0e/0x2220 arch/x86/kernel/unwind_orc.c:539
Code: 4c 89 7c 24 50 48 89 6c 24 10 49 8d 5c 24 08 49 89 df 49 c1 ef 03 41 80 3c 3f 00 74 08 48 89 df e8 b7 0d a5 00 48 89 5c 24 78 <4d> 8b 74 24 08 49 8d 5c 24 10 48 89 dd 48 c1 ed 03 48 b8 00 00 00
RSP: 0018:ffffc90003d96f60 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffffc90003d97048 RCX: ffffffff8eb274dc
RDX: 1ffffffff1e40f8e RSI: 0000000000000000 RDI: dffffc0000000000
RBP: ffffffff8f207c6e R08: 000000000000000c R09: ffffc90003d97130
R10: 0000000000000000 R11: dffffc0000000001 R12: ffffc90003d97040
R13: ffffffff8f207c72 R14: ffffffff8eb274d4 R15: 1ffff920007b2e09
arch_stack_walk+0x10d/0x140 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x113/0x1c0 kernel/stacktrace.c:122
save_stack+0xf6/0x1e0 mm/page_owner.c:127
__reset_page_owner+0x52/0x1a0 mm/page_owner.c:148
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1459 [inline]
free_pcp_prepare mm/page_alloc.c:1509 [inline]
free_unref_page_prepare+0x12a6/0x15b0 mm/page_alloc.c:3384
free_unref_page_list+0x663/0x900 mm/page_alloc.c:3525
release_pages+0x24c4/0x27a0 mm/swap.c:1035
__pagevec_release+0x80/0xf0 mm/swap.c:1055
pagevec_release include/linux/pagevec.h:71 [inline]
folio_batch_release include/linux/pagevec.h:135 [inline]
shmem_undo_range+0x865/0x2390 mm/shmem.c:946
shmem_truncate_range mm/shmem.c:1062 [inline]
shmem_evict_inode+0x265/0xa60 mm/shmem.c:1171
evict+0x529/0x930 fs/inode.c:705
__dentry_kill+0x436/0x650 fs/dcache.c:611
dentry_kill+0xbb/0x290
dput+0xfb/0x1d0 fs/dcache.c:918
__fput+0x62e/0x8d0 fs/file_table.c:328
task_work_run+0x246/0x300 kernel/task_work.c:203
exit_task_work include/linux/task_work.h:39 [inline]
do_exit+0xa6e/0x26a0 kernel/exit.c:871
do_group_exit+0x202/0x2b0 kernel/exit.c:1021
__do_sys_exit_group kernel/exit.c:1032 [inline]
__se_sys_exit_group kernel/exit.c:1030 [inline]
__x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1030
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f98d8ed0d59
Code: Unable to access opcode bytes at 0x7f98d8ed0d2f.
RSP: 002b:00007ffda5dde508 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f98d8ed0d59
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000
RBP: 00007f98d8f51390 R08: ffffffffffffffb8 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f98d8f51390
R13: 0000000000000000 R14: 00007f98d8f52e60 R15: 00007f98d8ea1160
----------------
Code disassembly (best guess):
0: 4c 89 7c 24 50 mov %r15,0x50(%rsp)
5: 48 89 6c 24 10 mov %rbp,0x10(%rsp)
a: 49 8d 5c 24 08 lea 0x8(%r12),%rbx
f: 49 89 df mov %rbx,%r15
12: 49 c1 ef 03 shr $0x3,%r15
16: 41 80 3c 3f 00 cmpb $0x0,(%r15,%rdi,1)
1b: 74 08 je 0x25
1d: 48 89 df mov %rbx,%rdi
20: e8 b7 0d a5 00 call 0xa50ddc
25: 48 89 5c 24 78 mov %rbx,0x78(%rsp)
* 2a: 4d 8b 74 24 08 mov 0x8(%r12),%r14 <-- trapping instruction
2f: 49 8d 5c 24 10 lea 0x10(%r12),%rbx
34: 48 89 dd mov %rbx,%rbp
37: 48 c1 ed 03 shr $0x3,%rbp
3b: 48 rex.W
3c: b8 .byte 0xb8
3d: 00 00 add %al,(%rax)