------------[ cut here ]------------
WARNING: CPU: 1 PID: 4476 at net/mac80211/tx.c:4934 __ieee80211_beacon_get+0x1abc/0x2110 net/mac80211/tx.c:5255
Modules linked in:
CPU: 1 PID: 4476 Comm: syz-executor311 Not tainted 6.1.119-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:__ieee80211_beacon_update_cntdwn net/mac80211/tx.c:4934 [inline]
RIP: 0010:__ieee80211_beacon_get+0x1abc/0x2110 net/mac80211/tx.c:5255
Code: ff ff ff e8 86 71 51 f7 0f 0b 48 8b 7c 24 20 e8 aa 92 66 fe e9 6f e8 ff ff e8 70 71 51 f7 0f 0b e9 92 ed ff ff e8 64 71 51 f7 <0f> 0b e9 26 f1 ff ff 44 89 f1 80 e1 07 80 c1 03 38 c1 0f 8c fc e8
RSP: 0018:ffffc900001e0820 EFLAGS: 00010246
RAX: ffffffff8a392a8c RBX: 0000000000000000 RCX: ffff88807be28000
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900001e0a30 R08: ffffffff8a391bac R09: ffffffff8a3913b2
R10: 0000000000000003 R11: ffff88807be28000 R12: dffffc0000000000
R13: 1ffff9200003c11c R14: ffff8880776aa258 R15: ffffffff8a391080
FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc401beb888 CR3: 0000000031303000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
ieee80211_beacon_get_tim+0xb1/0x5d0 net/mac80211/tx.c:5342
ieee80211_beacon_get include/net/mac80211.h:5249 [inline]
mac80211_hwsim_beacon_tx+0x1d2/0xaa0 drivers/net/wireless/mac80211_hwsim.c:2086
__iterate_interfaces+0x21e/0x4b0 net/mac80211/util.c:788
ieee80211_iterate_active_interfaces_atomic+0xd4/0x170 net/mac80211/util.c:824
mac80211_hwsim_beacon+0xd0/0x1e0 drivers/net/wireless/mac80211_hwsim.c:2142
__run_hrtimer kernel/time/hrtimer.c:1689 [inline]
__hrtimer_run_queues+0x5e5/0xe50 kernel/time/hrtimer.c:1753
hrtimer_run_softirq+0x196/0x2c0 kernel/time/hrtimer.c:1770
handle_softirqs+0x2ee/0xa40 kernel/softirq.c:571
__do_softirq kernel/softirq.c:605 [inline]
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x157/0x240 kernel/softirq.c:654
irq_exit_rcu+0x5/0x20 kernel/softirq.c:666
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:deref_stack_reg+0x5/0x210 arch/x86/kernel/unwind_orc.c:356
Code: df e8 bf 2d a5 00 e9 8c f1 ff ff 89 d9 80 e1 07 38 c1 0f 8c f1 f7 ff ff 48 89 df e8 a5 2d a5 00 e9 e4 f7 ff ff 55 41 57 41 56 <41> 55 41 54 53 48 83 ec 20 48 89 54 24 18 49 89 f0 49 89 fe 48 ba
RSP: 0018:ffffc90004266f80 EFLAGS: 00000283
RAX: fffffffffffffff0 RBX: ffffffff8f20a750 RCX: 0000000000000000
RDX: ffffc900042670c0 RSI: ffffc900042676b0 RDI: ffffc90004267080
RBP: dffffc0000000000 R08: dffffc0000000000 R09: ffffc900042670d0
R10: 0000000000000000 R11: dffffc0000000001 R12: ffffc90004267080
R13: ffffffff8f20a752 R14: ffffffff8f20a751 R15: ffffc900042670d0
unwind_next_frame+0x18db/0x2220
arch_stack_walk+0x10d/0x140 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x113/0x1c0 kernel/stacktrace.c:122
save_stack+0xf6/0x1e0 mm/page_owner.c:127
__reset_page_owner+0x52/0x1a0 mm/page_owner.c:148
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1444 [inline]
free_pcp_prepare mm/page_alloc.c:1494 [inline]
free_unref_page_prepare+0xf63/0x1120 mm/page_alloc.c:3369
free_unref_page_list+0x663/0x900 mm/page_alloc.c:3510
release_pages+0x2836/0x2b40 mm/swap.c:1055
tlb_batch_pages_flush mm/mmu_gather.c:59 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:254 [inline]
tlb_flush_mmu+0xfc/0x210 mm/mmu_gather.c:261
tlb_finish_mmu+0xce/0x1f0 mm/mmu_gather.c:361
exit_mmap+0x3b3/0x980 mm/mmap.c:3246
__mmput+0x115/0x3c0 kernel/fork.c:1200
exit_mm+0x226/0x300 kernel/exit.c:565
do_exit+0x9f6/0x26a0 kernel/exit.c:858
do_group_exit+0x202/0x2b0 kernel/exit.c:1021
get_signal+0x16f7/0x17d0 kernel/signal.c:2871
arch_do_signal_or_restart+0xb0/0x1a10 arch/x86/kernel/signal.c:871
exit_to_user_mode_loop+0x6a/0x100 kernel/entry/common.c:174
exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
syscall_exit_to_user_mode+0x60/0x270 kernel/entry/common.c:303
do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:87
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fc401b957a9
Code: Unable to access opcode bytes at 0x7fc401b9577f.
RSP: 002b:00007fc401b54228 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: 0000000000000116 RBX: 00007fc401c1f428 RCX: 00007fc401b957a9
RDX: 0000000000000318 RSI: 00000000200bd000 RDI: 0000000000000004
RBP: 00007fc401c1f420 R08: 00007fc401b546c0 R09: 00007fc401b546c0
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc401c1f42c
R13: 00007fc401bec364 R14: 0031313230386c6e R15: 00007ffc54274d18
----------------
Code disassembly (best guess), 1 bytes skipped:
0: e8 bf 2d a5 00 call 0xa52dc4
5: e9 8c f1 ff ff jmp 0xfffff196
a: 89 d9 mov %ebx,%ecx
c: 80 e1 07 and $0x7,%cl
f: 38 c1 cmp %al,%cl
11: 0f 8c f1 f7 ff ff jl 0xfffff808
17: 48 89 df mov %rbx,%rdi
1a: e8 a5 2d a5 00 call 0xa52dc4
1f: e9 e4 f7 ff ff jmp 0xfffff808
24: 55 push %rbp
25: 41 57 push %r15
27: 41 56 push %r14
* 29: 41 55 push %r13 <-- trapping instruction
2b: 41 54 push %r12
2d: 53 push %rbx
2e: 48 83 ec 20 sub $0x20,%rsp
32: 48 89 54 24 18 mov %rdx,0x18(%rsp)
37: 49 89 f0 mov %rsi,%r8
3a: 49 89 fe mov %rdi,%r14
3d: 48 rex.W
3e: ba .byte 0xba