------------[ cut here ]------------
no supported rates for sta (null) (0xffffffff, band 0) in rate_mask 0xfff with flags 0x20
WARNING: CPU: 1 PID: 1034 at net/mac80211/rate.c:404 __rate_control_send_low+0x65e/0x8a0 net/mac80211/rate.c:399
Modules linked in:
CPU: 1 UID: 0 PID: 1034 Comm: kworker/u8:6 Not tainted 6.14.0-next-20250404-syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: cfg80211 cfg80211_event_work
RIP: 0010:__rate_control_send_low+0x65e/0x8a0 net/mac80211/rate.c:399
Code: 8b 14 24 0f 85 de 01 00 00 8b 0a 48 c7 c7 80 18 6d 8d 48 8b 74 24 10 44 89 f2 44 8b 44 24 1c 44 8b 4c 24 0c e8 c3 95 e4 f5 90 <0f> 0b 90 90 e9 6e fe ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c d6
RSP: 0018:ffffc90000a08720 EFLAGS: 00010246
RAX: 8607198872369600 RBX: 000000000000000c RCX: ffff8880268f1e00
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff8880337cab68 R08: ffffffff81828012 R09: fffffbfff1d7a980
R10: dffffc0000000000 R11: fffffbfff1d7a980 R12: 0000000000000800
R13: 000000000000000c R14: 00000000ffffffff R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff88812508f000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f74f85705a0 CR3: 0000000025672000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
rate_control_send_low+0x1a8/0x780 net/mac80211/rate.c:424
rate_control_get_rate+0x20e/0x5e0 net/mac80211/rate.c:940
ieee80211_beacon_get_finish+0x442/0x780 net/mac80211/tx.c:5256
__ieee80211_beacon_get+0xf6d/0x1590 include/linux/skbuff.h:-1
ieee80211_beacon_get_tim+0xb7/0x330 net/mac80211/tx.c:5597
ieee80211_beacon_get include/net/mac80211.h:5648 [inline]
mac80211_hwsim_beacon_tx+0x3a2/0x860 drivers/net/wireless/virtual/mac80211_hwsim.c:2313
__iterate_interfaces+0x297/0x570 net/mac80211/util.c:761
ieee80211_iterate_active_interfaces_atomic+0xd8/0x170 net/mac80211/util.c:797
mac80211_hwsim_beacon+0xd4/0x1f0 drivers/net/wireless/virtual/mac80211_hwsim.c:2347
__run_hrtimer kernel/time/hrtimer.c:1791 [inline]
__hrtimer_run_queues+0x5a6/0xd40 kernel/time/hrtimer.c:1855
hrtimer_run_softirq+0x19a/0x2c0 kernel/time/hrtimer.c:1872
handle_softirqs+0x2d6/0x9b0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xfb/0x220 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xd9/0x140 kernel/locking/spinlock.c:194
Code: 9c 8f 44 24 20 42 80 3c 2b 00 74 08 4c 89 f7 e8 fd 9b f9 f5 f6 44 24 21 02 75 55 41 f7 c7 00 02 00 00 74 01 fb bf 01 00 00 00 e2 b5 5c f5 65 8b 05 8b 2c 35 07 85 c0 74 46 48 c7 04 24 0e 36
RSP: 0018:ffffc9000393edc0 EFLAGS: 00000206
RAX: 8607198872369600 RBX: 1ffff92000727dbc RCX: 0000000000000006
RDX: 0000000000000006 RSI: ffffffff8e6a4c4b RDI: 0000000000000001
RBP: ffffc9000393ee50 R08: ffffffff905ffd37 R09: 1ffffffff20bffa6
R10: dffffc0000000000 R11: fffffbfff20bffa7 R12: 1ffff92000727db8
R13: dffffc0000000000 R14: ffffc9000393ede0 R15: 0000000000000246
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
rmqueue_bulk mm/page_alloc.c:2342 [inline]
__rmqueue_pcplist+0x20ce/0x2ae0 mm/page_alloc.c:3041
rmqueue_pcplist mm/page_alloc.c:3083 [inline]
rmqueue mm/page_alloc.c:3114 [inline]
get_page_from_freelist+0x93b/0x3700 mm/page_alloc.c:3652
__alloc_frozen_pages_noprof+0x211/0x5b0 mm/page_alloc.c:4937
alloc_pages_mpol+0x339/0x690 mm/mempolicy.c:2302
alloc_slab_page mm/slub.c:2459 [inline]
allocate_slab+0x8f/0x3a0 mm/slub.c:2623
new_slab mm/slub.c:2676 [inline]
___slab_alloc+0xc3b/0x1500 mm/slub.c:3862
__slab_alloc+0x58/0xa0 mm/slub.c:3952
__slab_alloc_node mm/slub.c:4027 [inline]
slab_alloc_node mm/slub.c:4188 [inline]
__do_kmalloc_node mm/slub.c:4330 [inline]
__kmalloc_node_track_caller_noprof+0x2ef/0x4d0 mm/slub.c:4350
kmalloc_reserve+0x111/0x2a0 net/core/skbuff.c:599
__alloc_skb+0x1f2/0x480 net/core/skbuff.c:668
alloc_skb include/linux/skbuff.h:1340 [inline]
nlmsg_new include/net/netlink.h:1019 [inline]
wireless_send_event+0x2c2/0xd10 net/wireless/wext-core.c:557
__cfg80211_ibss_joined+0x3ab/0x470 net/wireless/ibss.c:55
cfg80211_process_wdev_events+0x3af/0x510 net/wireless/util.c:1122
cfg80211_process_rdev_events+0xac/0x110 net/wireless/util.c:1149
cfg80211_event_work+0x2c/0x60 net/wireless/core.c:331
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xac3/0x18e0 kernel/workqueue.c:3319
worker_thread+0x870/0xd50 kernel/workqueue.c:3400
kthread+0x7b7/0x940 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
----------------
Code disassembly (best guess):
0: 9c pushf
1: 8f 44 24 20 pop 0x20(%rsp)
5: 42 80 3c 2b 00 cmpb $0x0,(%rbx,%r13,1)
a: 74 08 je 0x14
c: 4c 89 f7 mov %r14,%rdi
f: e8 fd 9b f9 f5 call 0xf5f99c11
14: f6 44 24 21 02 testb $0x2,0x21(%rsp)
19: 75 55 jne 0x70
1b: 41 f7 c7 00 02 00 00 test $0x200,%r15d
22: 74 01 je 0x25
24: fb sti
25: bf 01 00 00 00 mov $0x1,%edi
* 2a: e8 e2 b5 5c f5 call 0xf55cb611 <-- trapping instruction
2f: 65 8b 05 8b 2c 35 07 mov %gs:0x7352c8b(%rip),%eax # 0x7352cc1
36: 85 c0 test %eax,%eax
38: 74 46 je 0x80
3a: 48 rex.W
3b: c7 .byte 0xc7
3c: 04 24 add $0x24,%al
3e: 0e (bad)
3f: 36 ss