------------[ cut here ]------------
WARNING: CPU: 0 PID: 5390 at net/mac80211/tx.c:5024 __ieee80211_beacon_update_cntdwn net/mac80211/tx.c:5024 [inline]
WARNING: CPU: 0 PID: 5390 at net/mac80211/tx.c:5024 __ieee80211_beacon_get+0x125d/0x1630 net/mac80211/tx.c:5453
Modules linked in:
CPU: 0 UID: 0 PID: 5390 Comm: syz-executor385 Not tainted 6.16.0-rc1-syzkaller-00236-g8c6bc74c7f89 #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:__ieee80211_beacon_update_cntdwn net/mac80211/tx.c:5024 [inline]
RIP: 0010:__ieee80211_beacon_get+0x125d/0x1630 net/mac80211/tx.c:5453
Code: e7 e8 67 92 32 f7 45 31 f6 4c 8b bc 24 a0 00 00 00 e9 78 fe ff ff e8 52 0c da f6 90 0f 0b 90 e9 e0 f7 ff ff e8 44 0c da f6 90 <0f> 0b 90 e9 38 fb ff ff e8 36 0c da f6 48 c7 c7 80 16 79 8f 4c 89
RSP: 0018:ffffc900000079f8 EFLAGS: 00010246
RAX: ffffffff8ae64ffc RBX: ffffffff8ae63dd6 RCX: ffff888035570000
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffff888035570000 R09: 0000000000000003
R10: 0000000000000007 R11: 0000000000000100 R12: ffff888047542500
R13: dffffc0000000000 R14: ffff8880475429d0 R15: ffff8880400fc824
FS: 000055558d63d380(0000) GS:ffff88808d251000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000020000002f000 CR3: 00000000442a3000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
ieee80211_beacon_get_tim+0xb4/0x2b0 net/mac80211/tx.c:5580
ieee80211_beacon_get include/net/mac80211.h:5638 [inline]
mac80211_hwsim_beacon_tx+0x3ce/0x860 drivers/net/wireless/virtual/mac80211_hwsim.c:2319
__iterate_interfaces+0x2a8/0x590 net/mac80211/util.c:761
ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 net/mac80211/util.c:797
mac80211_hwsim_beacon+0xbb/0x1c0 drivers/net/wireless/virtual/mac80211_hwsim.c:2353
__run_hrtimer kernel/time/hrtimer.c:1761 [inline]
__hrtimer_run_queues+0x52c/0xc60 kernel/time/hrtimer.c:1825
hrtimer_run_softirq+0x187/0x2b0 kernel/time/hrtimer.c:1842
handle_softirqs+0x286/0x870 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:generic_exec_single+0x481/0x500 kernel/smp.c:447
Code: 75 11 e8 22 89 0b 00 48 85 db 75 16 e8 18 89 0b 00 eb 15 e8 11 89 0b 00 e8 5c 85 b1 09 48 85 db 74 ea e8 02 89 0b 00 fb 31 c0 <48> c7 44 24 20 0e 36 e0 45 4b c7 04 2c 00 00 00 00 66 43 c7 44 2c
RSP: 0018:ffffc9000d06f920 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000000200 RCX: ffff888035570000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc9000d06f9f8 R08: ffffffff8fa10cf7 R09: 1ffffffff1f4219e
R10: dffffc0000000000 R11: fffffbfff1f4219f R12: 1ffff92001a0df28
R13: dffffc0000000000 R14: 0000000000000000 R15: 1ffff92001a0df51
smp_call_function_single_async+0x79/0x110 kernel/smp.c:724
rdmsr_safe_on_cpu+0x127/0x230 arch/x86/lib/msr-smp.c:179
msr_read+0x14d/0x250 arch/x86/kernel/msr.c:66
vfs_read+0x200/0x980 fs/read_write.c:570
ksys_read+0x145/0x250 fs/read_write.c:715
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f854b5394e9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 01 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcefa4f298 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f854b5394e9
RDX: 0000000000018ff8 RSI: 0000200000019680 RDI: 0000000000000003
RBP: 00000000000f4240 R08: 0000000000000000 R09: 0000000000000000
R10: 0072736d2f232f75 R11: 0000000000000246 R12: 00000000000183bc
R13: 00007ffcefa4f310 R14: 00007ffcefa4f2cc R15: 00007ffcefa4f300
----------------
Code disassembly (best guess):
0: 75 11 jne 0x13
2: e8 22 89 0b 00 call 0xb8929
7: 48 85 db test %rbx,%rbx
a: 75 16 jne 0x22
c: e8 18 89 0b 00 call 0xb8929
11: eb 15 jmp 0x28
13: e8 11 89 0b 00 call 0xb8929
18: e8 5c 85 b1 09 call 0x9b18579
1d: 48 85 db test %rbx,%rbx
20: 74 ea je 0xc
22: e8 02 89 0b 00 call 0xb8929
27: fb sti
28: 31 c0 xor %eax,%eax
* 2a: 48 c7 44 24 20 0e 36 movq $0x45e0360e,0x20(%rsp) <-- trapping instruction
31: e0 45
33: 4b c7 04 2c 00 00 00 movq $0x0,(%r12,%r13,1)
3a: 00
3b: 66 data16
3c: 43 rex.XB
3d: c7 .byte 0xc7
3e: 44 rex.R
3f: 2c .byte 0x2c