------------[ cut here ]------------
no supported rates for sta (null) (0xffffffff, band 0) in rate_mask 0x0 with flags 0x0
WARNING: CPU: 2 PID: 26839 at net/mac80211/rate.c:401 __rate_control_send_low+0x667/0x780 net/mac80211/rate.c:401
Modules linked in:
CPU: 2 UID: 0 PID: 26839 Comm: syz.3.5927 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:__rate_control_send_low+0x667/0x780 net/mac80211/rate.c:401
Code: a4 a0 d4 00 00 00 e8 78 dd e8 f6 44 8b 44 24 24 45 89 e9 89 d9 48 8b 74 24 08 44 89 e2 48 c7 c7 60 19 e3 8c e8 8a 60 a7 f6 90 <0f> 0b 90 90 e9 20 fd ff ff 48 8b 3c 24 e8 47 8a 50 f7 e9 f5 fc ff
RSP: 0000:ffffc90000538930 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817adc48
RDX: ffff888028262480 RSI: ffffffff817adc55 RDI: 0000000000000001
RBP: ffff88802411a2a8 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 00000000ffffffff
R13: 0000000000000000 R14: 000000000000000c R15: ffff88802411a2b0
FS: 0000000000000000(0000) GS:ffff888097a0d000(0063) knlGS:00000000583cb440
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 000000002f2b1ffc CR3: 0000000058f5d000 CR4: 0000000000352ef0
Call Trace:
rate_control_send_low+0x52a/0x810 net/mac80211/rate.c:429
rate_control_get_rate+0x1be/0x5e0 net/mac80211/rate.c:943
ieee80211_beacon_get_finish+0x467/0x670 net/mac80211/tx.c:5360
__ieee80211_beacon_get+0xc56/0x1e40 net/mac80211/tx.c:5663
ieee80211_beacon_get_tim+0xa6/0x280 net/mac80211/tx.c:5774
ieee80211_beacon_get include/net/mac80211.h:5667 [inline]
mac80211_hwsim_beacon_tx+0x4dc/0xa40 drivers/net/wireless/virtual/mac80211_hwsim.c:2361
__iterate_interfaces+0x2e5/0x650 net/mac80211/util.c:761
ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 net/mac80211/util.c:797
mac80211_hwsim_beacon+0x105/0x1b0 drivers/net/wireless/virtual/mac80211_hwsim.c:2395
__run_hrtimer kernel/time/hrtimer.c:1777 [inline]
__hrtimer_run_queues+0x202/0xad0 kernel/time/hrtimer.c:1841
hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1858
handle_softirqs+0x219/0x8e0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1052
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 kernel/locking/spinlock.c:194
Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 a6 f1 37 f6 48 89 df e8 8e 45 38 f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 b5 4d 28 f6 65 8b 05 7e d5 40 08 85 c0 74 16 5b
RSP: 0000:ffffc9000423f3f8 EFLAGS: 00000246
RAX: 0000000000000006 RBX: ffff888040000208 RCX: 0000000000000007
RDX: 0000000000000000 RSI: ffffffff8da29329 RDI: ffffffff8bf078c0
RBP: 0000000000000246 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff90824cd7 R11: 0000000000000002 R12: 0000000000000001
R13: 0000000000000246 R14: 0000000000000000 R15: dffffc0000000000
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
__wake_up_common_lock kernel/sched/wait.c:127 [inline]
__wake_up+0x3f/0x60 kernel/sched/wait.c:146
wakeup_kswapd+0x495/0x670 mm/vmscan.c:7449
rmqueue mm/page_alloc.c:3349 [inline]
get_page_from_freelist+0x1060/0x3a30 mm/page_alloc.c:3876
__alloc_frozen_pages_noprof+0x25f/0x2470 mm/page_alloc.c:5178
alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2416
alloc_pages_noprof mm/mempolicy.c:2507 [inline]
folio_alloc_noprof+0x20/0x2d0 mm/mempolicy.c:2517
filemap_alloc_folio_noprof+0x3a1/0x470 mm/filemap.c:1020
ractl_alloc_folio mm/readahead.c:189 [inline]
page_cache_ra_unbounded+0x377/0xa10 mm/readahead.c:275
do_page_cache_ra mm/readahead.c:332 [inline]
page_cache_ra_order+0xc1d/0xf20 mm/readahead.c:535
do_sync_mmap_readahead mm/filemap.c:3340 [inline]
filemap_fault+0x1583/0x29a0 mm/filemap.c:3489
__do_fault+0x10d/0x490 mm/memory.c:5281
do_shared_fault mm/memory.c:5780 [inline]
do_fault mm/memory.c:5854 [inline]
do_pte_missing+0x1a6/0x3ba0 mm/memory.c:4362
handle_pte_fault mm/memory.c:6195 [inline]
__handle_mm_fault+0x1556/0x2aa0 mm/memory.c:6336
handle_mm_fault+0x589/0xd10 mm/memory.c:6505
do_user_addr_fault+0x60c/0x1370 arch/x86/mm/fault.c:1336
handle_page_fault arch/x86/mm/fault.c:1476 [inline]
exc_page_fault+0x64/0xc0 arch/x86/mm/fault.c:1532
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0023:0xf70ff2b0
Code: f0 83 c7 01 83 eb 08 e8 1e 76 fe ff 8b 46 1c 8b 4e 14 8d 50 f8 89 56 1c 8d 51 08 8b 4c 24 14 89 56 14 89 54 24 0c 8b 54 24 10 <89> 48 fc 89 50 f8 8b 44 24 18 39 c7 73 7a 8b 45 24 99 03 03 13 53
RSP: 002b:00000000fff74900 EFLAGS: 00010282
RAX: 000000002f2b2000 RBX: 00000000f68bd710 RCX: 00000000ffffffff
RDX: 000000008acae62a RSI: 00000000f7fb5610 RDI: 00000000000002be
RBP: 00000000f7485080 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
----------------
Code disassembly (best guess):
0: f5 cmc
1: 53 push %rbx
2: 48 8b 74 24 10 mov 0x10(%rsp),%rsi
7: 48 89 fb mov %rdi,%rbx
a: 48 83 c7 18 add $0x18,%rdi
e: e8 a6 f1 37 f6 call 0xf637f1b9
13: 48 89 df mov %rbx,%rdi
16: e8 8e 45 38 f6 call 0xf63845a9
1b: f7 c5 00 02 00 00 test $0x200,%ebp
21: 75 23 jne 0x46
23: 9c pushf
24: 58 pop %rax
25: f6 c4 02 test $0x2,%ah
28: 75 37 jne 0x61
* 2a: bf 01 00 00 00 mov $0x1,%edi <-- trapping instruction
2f: e8 b5 4d 28 f6 call 0xf6284de9
34: 65 8b 05 7e d5 40 08 mov %gs:0x840d57e(%rip),%eax # 0x840d5b9
3b: 85 c0 test %eax,%eax
3d: 74 16 je 0x55
3f: 5b pop %rbx