=====================================================
BUG: KMSAN: uninit-value in ieee80211_ac_from_tid net/mac80211/ieee80211_i.h:2050 [inline]
BUG: KMSAN: uninit-value in ieee80211_sta_tx_wmm_ac_notify net/mac80211/mlme.c:2524 [inline]
BUG: KMSAN: uninit-value in ieee80211_sta_tx_notify+0x3b1/0x920 net/mac80211/mlme.c:2556
CPU: 0 PID: 8 Comm: kworker/u4:0 Tainted: G W 5.12.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: phy14 ieee80211_beacon_connection_loss_work
Call Trace:
__dump_stack lib/dump_stack.c:79 [inline]
dump_stack+0x24c/0x2e0 lib/dump_stack.c:120
kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118
__msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197
ieee80211_ac_from_tid net/mac80211/ieee80211_i.h:2050 [inline]
ieee80211_sta_tx_wmm_ac_notify net/mac80211/mlme.c:2524 [inline]
ieee80211_sta_tx_notify+0x3b1/0x920 net/mac80211/mlme.c:2556
ieee80211_tx_status_ext+0x1291/0x4fa0 net/mac80211/status.c:1116
ieee80211_tx_status+0x221/0x270 net/mac80211/status.c:1059
ieee80211_tasklet_handler+0x322/0x390 net/mac80211/main.c:239
tasklet_action_common+0x3de/0x640 kernel/softirq.c:557
tasklet_action+0x30/0x40 kernel/softirq.c:577
__do_softirq+0x1b9/0x715 kernel/softirq.c:345
do_softirq+0x123/0x1c0 kernel/softirq.c:248
__local_bh_enable_ip+0xa1/0xb0 kernel/softirq.c:198
local_bh_enable+0x36/0x40 include/linux/bottom_half.h:32
__ieee80211_tx_skb_tid_band+0x28f/0x390 net/mac80211/tx.c:5404
ieee80211_tx_skb_tid net/mac80211/ieee80211_i.h:2019 [inline]
ieee80211_tx_skb net/mac80211/ieee80211_i.h:2028 [inline]
ieee80211_send_nullfunc+0x59a/0x6e0 net/mac80211/mlme.c:1120
ieee80211_mgd_probe_ap_send+0x88d/0xb30 net/mac80211/mlme.c:2621
ieee80211_mgd_probe_ap+0x52c/0x6e0 net/mac80211/mlme.c:2697
ieee80211_beacon_connection_loss_work+0x19b/0x420 net/mac80211/mlme.c:2830
process_one_work+0x1219/0x1fe0 kernel/workqueue.c:2275
worker_thread+0x10ec/0x2340 kernel/workqueue.c:2421
kthread+0x521/0x560 kernel/kthread.c:292
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
Uninit was created at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline]
kmsan_internal_poison_shadow+0x5c/0xf0 mm/kmsan/kmsan.c:104
kmsan_slab_alloc+0x8e/0xe0 mm/kmsan/kmsan_hooks.c:76
slab_alloc_node mm/slub.c:2922 [inline]
__kmalloc_node_track_caller+0xa4f/0x1470 mm/slub.c:4609
kmalloc_reserve net/core/skbuff.c:353 [inline]
__alloc_skb+0x4dd/0xe90 net/core/skbuff.c:424
__netdev_alloc_skb+0x45d/0x810 net/core/skbuff.c:491
netdev_alloc_skb include/linux/skbuff.h:2864 [inline]
dev_alloc_skb include/linux/skbuff.h:2877 [inline]
ieee80211_nullfunc_get+0x2b6/0x820 net/mac80211/tx.c:5118
ieee80211_send_nullfunc+0x216/0x6e0 net/mac80211/mlme.c:1102
ieee80211_mgd_probe_ap_send+0x88d/0xb30 net/mac80211/mlme.c:2621
ieee80211_mgd_probe_ap+0x52c/0x6e0 net/mac80211/mlme.c:2697
ieee80211_beacon_connection_loss_work+0x19b/0x420 net/mac80211/mlme.c:2830
process_one_work+0x1219/0x1fe0 kernel/workqueue.c:2275
worker_thread+0x10ec/0x2340 kernel/workqueue.c:2421
kthread+0x521/0x560 kernel/kthread.c:292
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
=====================================================
=====================================================
BUG: KMSAN: uninit-value in ieee80211_ac_from_tid net/mac80211/ieee80211_i.h:2050 [inline]
BUG: KMSAN: uninit-value in ieee80211_sta_tx_wmm_ac_notify net/mac80211/mlme.c:2524 [inline]
BUG: KMSAN: uninit-value in ieee80211_sta_tx_notify+0x3b1/0x920 net/mac80211/mlme.c:2556
CPU: 0 PID: 1258 Comm: kworker/u4:17 Tainted: G B W 5.12.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: phy14 ieee80211_beacon_connection_loss_work
Call Trace:
__dump_stack lib/dump_stack.c:79 [inline]
dump_stack+0x24c/0x2e0 lib/dump_stack.c:120
kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118
__msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197
ieee80211_ac_from_tid net/mac80211/ieee80211_i.h:2050 [inline]
ieee80211_sta_tx_wmm_ac_notify net/mac80211/mlme.c:2524 [inline]
ieee80211_sta_tx_notify+0x3b1/0x920 net/mac80211/mlme.c:2556
ieee80211_tx_status_ext+0x1291/0x4fa0 net/mac80211/status.c:1116
ieee80211_tx_status+0x221/0x270 net/mac80211/status.c:1059
ieee80211_tasklet_handler+0x322/0x390 net/mac80211/main.c:239
tasklet_action_common+0x3de/0x640 kernel/softirq.c:557
tasklet_action+0x30/0x40 kernel/softirq.c:577
__do_softirq+0x1b9/0x715 kernel/softirq.c:345
do_softirq+0x123/0x1c0 kernel/softirq.c:248
__local_bh_enable_ip+0xa1/0xb0 kernel/softirq.c:198
local_bh_enable+0x36/0x40 include/linux/bottom_half.h:32
__ieee80211_tx_skb_tid_band+0x28f/0x390 net/mac80211/tx.c:5404
ieee80211_tx_skb_tid net/mac80211/ieee80211_i.h:2019 [inline]
ieee80211_tx_skb net/mac80211/ieee80211_i.h:2028 [inline]
ieee80211_send_nullfunc+0x59a/0x6e0 net/mac80211/mlme.c:1120
ieee80211_mgd_probe_ap_send+0x88d/0xb30 net/mac80211/mlme.c:2621
ieee80211_mgd_probe_ap+0x52c/0x6e0 net/mac80211/mlme.c:2697
ieee80211_beacon_connection_loss_work+0x19b/0x420 net/mac80211/mlme.c:2830
process_one_work+0x1219/0x1fe0 kernel/workqueue.c:2275
worker_thread+0x10ec/0x2340 kernel/workqueue.c:2421
kthread+0x521/0x560 kernel/kthread.c:292
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
Uninit was created at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline]
kmsan_internal_poison_shadow+0x5c/0xf0 mm/kmsan/kmsan.c:104
kmsan_slab_alloc+0x8e/0xe0 mm/kmsan/kmsan_hooks.c:76
slab_alloc_node mm/slub.c:2922 [inline]
__kmalloc_node_track_caller+0xa4f/0x1470 mm/slub.c:4609
kmalloc_reserve net/core/skbuff.c:353 [inline]
__alloc_skb+0x4dd/0xe90 net/core/skbuff.c:424
__netdev_alloc_skb+0x45d/0x810 net/core/skbuff.c:491
netdev_alloc_skb include/linux/skbuff.h:2864 [inline]
dev_alloc_skb include/linux/skbuff.h:2877 [inline]
ieee80211_nullfunc_get+0x2b6/0x820 net/mac80211/tx.c:5118
ieee80211_send_nullfunc+0x216/0x6e0 net/mac80211/mlme.c:1102
ieee80211_mgd_probe_ap_send+0x88d/0xb30 net/mac80211/mlme.c:2621
ieee80211_mgd_probe_ap+0x52c/0x6e0 net/mac80211/mlme.c:2697
ieee80211_beacon_connection_loss_work+0x19b/0x420 net/mac80211/mlme.c:2830
process_one_work+0x1219/0x1fe0 kernel/workqueue.c:2275
worker_thread+0x10ec/0x2340 kernel/workqueue.c:2421
kthread+0x521/0x560 kernel/kthread.c:292
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
=====================================================
------------[ cut here ]------------
WARNING: CPU: 0 PID: 1258 at drivers/gpu/drm/vkms/vkms_crtc.c:21 vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21
Modules linked in:
CPU: 0 PID: 1258 Comm: kworker/u4:17 Tainted: G B W 5.12.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: phy14 ieee80211_beacon_connection_loss_work
RIP: 0010:vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21
Code: 22 fb e9 b2 fe ff ff 8b 3a e8 71 77 22 fb e9 bf fe ff ff 44 89 e7 e8 64 77 22 fb 49 83 fe 01 0f 84 6e ff ff ff e8 65 86 9f fa <0f> 0b e9 67 ff ff ff 41 8b bf a8 0f 00 00 e8 42 77 22 fb 84 db 75
RSP: 0018:ffff88813fc056e8 EFLAGS: 00010046
RAX: ffffffff871cad8b RBX: 0000000000000000 RCX: ffff888103dd5dc0
RDX: 0000000000010101 RSI: 0000000000000013 RDI: 0000000000000001
RBP: ffff88813fc05768 R08: ffffffff871cacd2 R09: ffff88813fffa000
R10: 000000004d1d8650 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000013 R15: ffff88813fc27b00
FS: 0000000000000000(0000) GS:ffff88813fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000541198 CR3: 000000007d8dc000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__run_hrtimer+0x48b/0xd20 kernel/time/hrtimer.c:1537
__hrtimer_run_queues kernel/time/hrtimer.c:1601 [inline]
hrtimer_interrupt+0x6e2/0x1b50 kernel/time/hrtimer.c:1663
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1089 [inline]
__sysvec_apic_timer_interrupt+0xfd/0x470 arch/x86/kernel/apic/apic.c:1106
sysvec_apic_timer_interrupt+0x6a/0xf0 arch/x86/kernel/apic/apic.c:1100
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:650
RIP: 0010:__msan_warning+0x88/0xa0 mm/kmsan/kmsan_instr.c:201
Code: c4 08 e8 db e8 ff ff 8b b0 b0 0f 00 00 ff ce 89 b0 b0 0f 00 00 75 1a e8 86 df 0b ff 41 f7 c6 00 02 00 00 74 01 fb 48 83 c4 08 <5b> 41 5e 5d c3 0f 0b 48 c7 c7 f9 18 7c 90 31 c0 e8 fc f8 25 ff 0f
RSP: 0018:ffff88813fc05b08 EFLAGS: 00000282
RAX: ffff88813fc27b00 RBX: 00000000063f0192 RCX: ffff888103dd5dc0
RDX: ffffffff92456000 RSI: 0000000000000000 RDI: ffffffff92455b90
RBP: ffff88813fc05b18 R08: ffffffff8165313c R09: 00000000ffffdfff
R10: 3d3d3d3d3d3d3d00 R11: 3d3d3d3d3d3d3d3d R12: 0000000000000100
R13: 0000000000000000 R14: 0000000000000246 R15: 0000000000000000
ieee80211_ac_from_tid net/mac80211/ieee80211_i.h:2050 [inline]
ieee80211_sta_tx_wmm_ac_notify net/mac80211/mlme.c:2524 [inline]
ieee80211_sta_tx_notify+0x3b1/0x920 net/mac80211/mlme.c:2556
ieee80211_tx_status_ext+0x1291/0x4fa0 net/mac80211/status.c:1116
ieee80211_tx_status+0x221/0x270 net/mac80211/status.c:1059
ieee80211_tasklet_handler+0x322/0x390 net/mac80211/main.c:239
tasklet_action_common+0x3de/0x640 kernel/softirq.c:557
tasklet_action+0x30/0x40 kernel/softirq.c:577
__do_softirq+0x1b9/0x715 kernel/softirq.c:345
do_softirq+0x123/0x1c0 kernel/softirq.c:248
__local_bh_enable_ip+0xa1/0xb0 kernel/softirq.c:198
local_bh_enable+0x36/0x40 include/linux/bottom_half.h:32
__ieee80211_tx_skb_tid_band+0x28f/0x390 net/mac80211/tx.c:5404
ieee80211_tx_skb_tid net/mac80211/ieee80211_i.h:2019 [inline]
ieee80211_tx_skb net/mac80211/ieee80211_i.h:2028 [inline]
ieee80211_send_nullfunc+0x59a/0x6e0 net/mac80211/mlme.c:1120
ieee80211_mgd_probe_ap_send+0x88d/0xb30 net/mac80211/mlme.c:2621
ieee80211_mgd_probe_ap+0x52c/0x6e0 net/mac80211/mlme.c:2697
ieee80211_beacon_connection_loss_work+0x19b/0x420 net/mac80211/mlme.c:2830
process_one_work+0x1219/0x1fe0 kernel/workqueue.c:2275
worker_thread+0x10ec/0x2340 kernel/workqueue.c:2421
kthread+0x521/0x560 kernel/kthread.c:292
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
---[ end trace 0a2d13bb130eff87 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 1258 at drivers/gpu/drm/vkms/vkms_crtc.c:21 vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21
Modules linked in:
CPU: 0 PID: 1258 Comm: kworker/u4:17 Tainted: G B W 5.12.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: phy14 ieee80211_beacon_connection_loss_work
RIP: 0010:vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21
Code: 22 fb e9 b2 fe ff ff 8b 3a e8 71 77 22 fb e9 bf fe ff ff 44 89 e7 e8 64 77 22 fb 49 83 fe 01 0f 84 6e ff ff ff e8 65 86 9f fa <0f> 0b e9 67 ff ff ff 41 8b bf a8 0f 00 00 e8 42 77 22 fb 84 db 75
RSP: 0018:ffff88813fc056e8 EFLAGS: 00010046
RAX: ffffffff871cad8b RBX: 0000000000000000 RCX: ffff888103dd5dc0
RDX: 0000000000010101 RSI: 000000000000001d RDI: 0000000000000001
RBP: ffff88813fc05768 R08: ffffffff871cacd2 R09: ffff88813fffa000
R10: 000000004d1d8650 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 000000000000001d R15: ffff88813fc27b00
FS: 0000000000000000(0000) GS:ffff88813fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000541198 CR3: 000000007d8dc000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__run_hrtimer+0x48b/0xd20 kernel/time/hrtimer.c:1537
__hrtimer_run_queues kernel/time/hrtimer.c:1601 [inline]
hrtimer_interrupt+0x6e2/0x1b50 kernel/time/hrtimer.c:1663
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1089 [inline]
__sysvec_apic_timer_interrupt+0xfd/0x470 arch/x86/kernel/apic/apic.c:1106
sysvec_apic_timer_interrupt+0x6a/0xf0 arch/x86/kernel/apic/apic.c:1100
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:650
RIP: 0010:__msan_warning+0x88/0xa0 mm/kmsan/kmsan_instr.c:201
Code: c4 08 e8 db e8 ff ff 8b b0 b0 0f 00 00 ff ce 89 b0 b0 0f 00 00 75 1a e8 86 df 0b ff 41 f7 c6 00 02 00 00 74 01 fb 48 83 c4 08 <5b> 41 5e 5d c3 0f 0b 48 c7 c7 f9 18 7c 90 31 c0 e8 fc f8 25 ff 0f
RSP: 0018:ffff88813fc05b08 EFLAGS: 00000282
RAX: ffff88813fc27b00 RBX: 00000000063f0192 RCX: ffff888103dd5dc0
RDX: ffffffff92456000 RSI: 0000000000000000 RDI: ffffffff92455b90
RBP: ffff88813fc05b18 R08: ffffffff8165313c R09: 00000000ffffdfff
R10: 3d3d3d3d3d3d3d00 R11: 3d3d3d3d3d3d3d3d R12: 0000000000000100
R13: 0000000000000000 R14: 0000000000000246 R15: 0000000000000000
ieee80211_ac_from_tid net/mac80211/ieee80211_i.h:2050 [inline]
ieee80211_sta_tx_wmm_ac_notify net/mac80211/mlme.c:2524 [inline]
ieee80211_sta_tx_notify+0x3b1/0x920 net/mac80211/mlme.c:2556
ieee80211_tx_status_ext+0x1291/0x4fa0 net/mac80211/status.c:1116
ieee80211_tx_status+0x221/0x270 net/mac80211/status.c:1059
ieee80211_tasklet_handler+0x322/0x390 net/mac80211/main.c:239
tasklet_action_common+0x3de/0x640 kernel/softirq.c:557
tasklet_action+0x30/0x40 kernel/softirq.c:577
__do_softirq+0x1b9/0x715 kernel/softirq.c:345
do_softirq+0x123/0x1c0 kernel/softirq.c:248
__local_bh_enable_ip+0xa1/0xb0 kernel/softirq.c:198
local_bh_enable+0x36/0x40 include/linux/bottom_half.h:32
__ieee80211_tx_skb_tid_band+0x28f/0x390 net/mac80211/tx.c:5404
ieee80211_tx_skb_tid net/mac80211/ieee80211_i.h:2019 [inline]
ieee80211_tx_skb net/mac80211/ieee80211_i.h:2028 [inline]
ieee80211_send_nullfunc+0x59a/0x6e0 net/mac80211/mlme.c:1120
ieee80211_mgd_probe_ap_send+0x88d/0xb30 net/mac80211/mlme.c:2621
ieee80211_mgd_probe_ap+0x52c/0x6e0 net/mac80211/mlme.c:2697
ieee80211_beacon_connection_loss_work+0x19b/0x420 net/mac80211/mlme.c:2830
process_one_work+0x1219/0x1fe0 kernel/workqueue.c:2275
worker_thread+0x10ec/0x2340 kernel/workqueue.c:2421
kthread+0x521/0x560 kernel/kthread.c:292
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
---[ end trace 0a2d13bb130eff88 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 1258 at drivers/gpu/drm/vkms/vkms_crtc.c:21 vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21
Modules linked in:
CPU: 0 PID: 1258 Comm: kworker/u4:17 Tainted: G B W 5.12.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: phy14 ieee80211_beacon_connection_loss_work
RIP: 0010:vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21
Code: 22 fb e9 b2 fe ff ff 8b 3a e8 71 77 22 fb e9 bf fe ff ff 44 89 e7 e8 64 77 22 fb 49 83 fe 01 0f 84 6e ff ff ff e8 65 86 9f fa <0f> 0b e9 67 ff ff ff 41 8b bf a8 0f 00 00 e8 42 77 22 fb 84 db 75
RSP: 0018:ffff88813fc056e8 EFLAGS: 00010046
RAX: ffffffff871cad8b RBX: 0000000000000000 RCX: ffff888103dd5dc0
RDX: 0000000000010101 RSI: 000000000000001c RDI: 0000000000000001
RBP: ffff88813fc05768 R08: ffffffff871cacd2 R09: ffff88813fffa000
R10: 00000000b56c2fd0 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 000000000000001c R15: ffff88813fc27b00
FS: 0000000000000000(0000) GS:ffff88813fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000541198 CR3: 000000007d8dc000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__run_hrtimer+0x48b/0xd20 kernel/time/hrtimer.c:1537
__hrtimer_run_queues kernel/time/hrtimer.c:1601 [inline]
hrtimer_interrupt+0x6e2/0x1b50 kernel/time/hrtimer.c:1663
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1089 [inline]
__sysvec_apic_timer_interrupt+0xfd/0x470 arch/x86/kernel/apic/apic.c:1106
sysvec_apic_timer_interrupt+0x6a/0xf0 arch/x86/kernel/apic/apic.c:1100
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:650
RIP: 0010:__msan_warning+0x88/0xa0 mm/kmsan/kmsan_instr.c:201
Code: c4 08 e8 db e8 ff ff 8b b0 b0 0f 00 00 ff ce 89 b0 b0 0f 00 00 75 1a e8 86 df 0b ff 41 f7 c6 00 02 00 00 74 01 fb 48 83 c4 08 <5b> 41 5e 5d c3 0f 0b 48 c7 c7 f9 18 7c 90 31 c0 e8 fc f8 25 ff 0f
RSP: 0018:ffff88813fc05b08 EFLAGS: 00000282
RAX: ffff88813fc27b00 RBX: 00000000063f0192 RCX: ffff888103dd5dc0
RDX: ffffffff92456000 RSI: 0000000000000000 RDI: ffffffff92455b90
RBP: ffff88813fc05b18 R08: ffffffff8165313c R09: 00000000ffffdfff
R10: 3d3d3d3d3d3d3d00 R11: 3d3d3d3d3d3d3d3d R12: 0000000000000100
R13: 0000000000000000 R14: 0000000000000246 R15: 0000000000000000
ieee80211_ac_from_tid net/mac80211/ieee80211_i.h:2050 [inline]
ieee80211_sta_tx_wmm_ac_notify net/mac80211/mlme.c:2524 [inline]
ieee80211_sta_tx_notify+0x3b1/0x920 net/mac80211/mlme.c:2556
ieee80211_tx_status_ext+0x1291/0x4fa0 net/mac80211/status.c:1116
ieee80211_tx_status+0x221/0x270 net/mac80211/status.c:1059
ieee80211_tasklet_handler+0x322/0x390 net/mac80211/main.c:239
tasklet_action_common+0x3de/0x640 kernel/softirq.c:557
tasklet_action+0x30/0x40 kernel/softirq.c:577
__do_softirq+0x1b9/0x715 kernel/softirq.c:345
do_softirq+0x123/0x1c0 kernel/softirq.c:248
__local_bh_enable_ip+0xa1/0xb0 kernel/softirq.c:198
local_bh_enable+0x36/0x40 include/linux/bottom_half.h:32
__ieee80211_tx_skb_tid_band+0x28f/0x390 net/mac80211/tx.c:5404
ieee80211_tx_skb_tid net/mac80211/ieee80211_i.h:2019 [inline]
ieee80211_tx_skb net/mac80211/ieee80211_i.h:2028 [inline]
ieee80211_send_nullfunc+0x59a/0x6e0 net/mac80211/mlme.c:1120
ieee80211_mgd_probe_ap_send+0x88d/0xb30 net/mac80211/mlme.c:2621
ieee80211_mgd_probe_ap+0x52c/0x6e0 net/mac80211/mlme.c:2697
ieee80211_beacon_connection_loss_work+0x19b/0x420 net/mac80211/mlme.c:2830
process_one_work+0x1219/0x1fe0 kernel/workqueue.c:2275
worker_thread+0x10ec/0x2340 kernel/workqueue.c:2421
kthread+0x521/0x560 kernel/kthread.c:292
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
---[ end trace 0a2d13bb130eff89 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 7 at drivers/gpu/drm/vkms/vkms_crtc.c:21 vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21
Modules linked in:
CPU: 0 PID: 7 Comm: kworker/0:1 Tainted: G B W 5.12.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events_power_efficient wg_ratelimiter_gc_entries
RIP: 0010:vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21
Code: 22 fb e9 b2 fe ff ff 8b 3a e8 71 77 22 fb e9 bf fe ff ff 44 89 e7 e8 64 77 22 fb 49 83 fe 01 0f 84 6e ff ff ff e8 65 86 9f fa <0f> 0b e9 67 ff ff ff 41 8b bf a8 0f 00 00 e8 42 77 22 fb 84 db 75
RSP: 0018:ffff88813fc05cb0 EFLAGS: 00010046
RAX: ffffffff871cad8b RBX: 0000000000000000 RCX: ffff888101bcbe80
RDX: 0000000080010000 RSI: 0000000000000022 RDI: 0000000000000001
RBP: ffff88813fc05d30 R08: ffffffff871cacd2 R09: ffff88813fffa000
R10: 00000000b56c2fd0 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000022 R15: ffff88813fc27b00
FS: 0000000000000000(0000) GS:ffff88813fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd36c02bda0 CR3: 0000000011629000 CR4: 00000000001526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__run_hrtimer+0x48b/0xd20 kernel/time/hrtimer.c:1537
__hrtimer_run_queues kernel/time/hrtimer.c:1601 [inline]
hrtimer_interrupt+0x6e2/0x1b50 kernel/time/hrtimer.c:1663
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1089 [inline]
__sysvec_apic_timer_interrupt+0xfd/0x470 arch/x86/kernel/apic/apic.c:1106
sysvec_apic_timer_interrupt+0xc1/0xf0 arch/x86/kernel/apic/apic.c:1100
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:650
RIP: 0010:pfn_valid include/linux/mmzone.h:1420 [inline]
RIP: 0010:kmsan_virt_addr_valid mm/kmsan/kmsan_shadow.c:87 [inline]
RIP: 0010:virt_to_page_or_null+0x74/0xf0 mm/kmsan/kmsan_shadow.c:125
Code: 2f 48 89 d6 48 c1 ee 23 4c 8b 0c f1 4d 85 c9 74 1f 48 89 d1 48 c1 e9 1b 0f b6 f1 48 c1 e6 04 4c 89 c9 48 01 f1 74 09 4c 8b 01 <41> f6 c0 02 75 04 31 c0 5d c3 41 f6 c0 08 75 12 48 c1 ea 15 49 8b
RSP: 0018:ffff888101bd7b38 EFLAGS: 00000282
RAX: 0000000012530850 RBX: ffffffff92530850 RCX: ffff88813fffa020
RDX: 0000000012530850 RSI: 0000000000000020 RDI: ffffffff92530850
RBP: ffff888101bd7b38 R08: ffffea000000000f R09: ffff88813fffa000
R10: 0000000049bbcbe7 R11: 00000000ffffffff R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
kmsan_get_metadata+0x116/0x180 mm/kmsan/kmsan_shadow.c:190
kmsan_get_shadow_origin_ptr+0x6f/0xb0 mm/kmsan/kmsan_shadow.c:145
__msan_metadata_ptr_for_store_1+0x13/0x20 mm/kmsan/kmsan_instr.c:52
queued_spin_unlock include/asm-generic/qspinlock.h:99 [inline]
do_raw_spin_unlock include/linux/spinlock.h:212 [inline]
__raw_spin_unlock include/linux/spinlock_api_smp.h:151 [inline]
spin_unlock include/linux/spinlock.h:394 [inline]
wg_ratelimiter_gc_entries+0x941/0xfb0 drivers/net/wireguard/ratelimiter.c:76
process_one_work+0x1219/0x1fe0 kernel/workqueue.c:2275
worker_thread+0x10ec/0x2340 kernel/workqueue.c:2421
kthread+0x521/0x560 kernel/kthread.c:292
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
---[ end trace 0a2d13bb130eff8a ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 7 at drivers/gpu/drm/vkms/vkms_crtc.c:21 vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21
Modules linked in:
CPU: 0 PID: 7 Comm: kworker/0:1 Tainted: G B W 5.12.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events_power_efficient wg_ratelimiter_gc_entries
RIP: 0010:vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21
Code: 22 fb e9 b2 fe ff ff 8b 3a e8 71 77 22 fb e9 bf fe ff ff 44 89 e7 e8 64 77 22 fb 49 83 fe 01 0f 84 6e ff ff ff e8 65 86 9f fa <0f> 0b e9 67 ff ff ff 41 8b bf a8 0f 00 00 e8 42 77 22 fb 84 db 75
RSP: 0018:ffff88813fc05cb0 EFLAGS: 00010046
RAX: ffffffff871cad8b RBX: 0000000000000000 RCX: ffff888101bcbe80
RDX: 0000000080010000 RSI: 0000000000000017 RDI: 0000000000000001
RBP: ffff88813fc05d30 R08: ffffffff871cacd2 R09: ffff88813fffa000
R10: 00000000b56c2fd0 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000017 R15: ffff88813fc27b00
FS: 0000000000000000(0000) GS:ffff88813fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd36c02bda0 CR3: 0000000011629000 CR4: 00000000001526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__run_hrtimer+0x48b/0xd20 kernel/time/hrtimer.c:1537
__hrtimer_run_queues kernel/time/hrtimer.c:1601 [inline]
hrtimer_interrupt+0x6e2/0x1b50 kernel/time/hrtimer.c:1663
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1089 [inline]
__sysvec_apic_timer_interrupt+0xfd/0x470 arch/x86/kernel/apic/apic.c:1106
sysvec_apic_timer_interrupt+0xc1/0xf0 arch/x86/kernel/apic/apic.c:1100
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:650
RIP: 0010:pfn_valid include/linux/mmzone.h:1420 [inline]
RIP: 0010:kmsan_virt_addr_valid mm/kmsan/kmsan_shadow.c:87 [inline]
RIP: 0010:virt_to_page_or_null+0x74/0xf0 mm/kmsan/kmsan_shadow.c:125
Code: 2f 48 89 d6 48 c1 ee 23 4c 8b 0c f1 4d 85 c9 74 1f 48 89 d1 48 c1 e9 1b 0f b6 f1 48 c1 e6 04 4c 89 c9 48 01 f1 74 09 4c 8b 01 <41> f6 c0 02 75 04 31 c0 5d c3 41 f6 c0 08 75 12 48 c1 ea 15 49 8b
RSP: 0018:ffff888101bd7b38 EFLAGS: 00000282
RAX: 0000000012530850 RBX: ffffffff92530850 RCX: ffff88813fffa020
RDX: 0000000012530850 RSI: 0000000000000020 RDI: ffffffff92530850
RBP: ffff888101bd7b38 R08: ffffea000000000f R09: ffff88813fffa000
R10: 0000000049bbcbe7 R11: 00000000ffffffff R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
kmsan_get_metadata+0x116/0x180 mm/kmsan/kmsan_shadow.c:190
kmsan_get_shadow_origin_ptr+0x6f/0xb0 mm/kmsan/kmsan_shadow.c:145
__msan_metadata_ptr_for_store_1+0x13/0x20 mm/kmsan/kmsan_instr.c:52
queued_spin_unlock include/asm-generic/qspinlock.h:99 [inline]
do_raw_spin_unlock include/linux/spinlock.h:212 [inline]
__raw_spin_unlock include/linux/spinlock_api_smp.h:151 [inline]
spin_unlock include/linux/spinlock.h:394 [inline]
wg_ratelimiter_gc_entries+0x941/0xfb0 drivers/net/wireguard/ratelimiter.c:76
process_one_work+0x1219/0x1fe0 kernel/workqueue.c:2275
worker_thread+0x10ec/0x2340 kernel/workqueue.c:2421
kthread+0x521/0x560 kernel/kthread.c:292
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
---[ end trace 0a2d13bb130eff8b ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 7 at drivers/gpu/drm/vkms/vkms_crtc.c:21 vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21
Modules linked in:
CPU: 0 PID: 7 Comm: kworker/0:1 Tainted: G B W 5.12.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events_power_efficient wg_ratelimiter_gc_entries
RIP: 0010:vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21
Code: 22 fb e9 b2 fe ff ff 8b 3a e8 71 77 22 fb e9 bf fe ff ff 44 89 e7 e8 64 77 22 fb 49 83 fe 01 0f 84 6e ff ff ff e8 65 86 9f fa <0f> 0b e9 67 ff ff ff 41 8b bf a8 0f 00 00 e8 42 77 22 fb 84 db 75
RSP: 0018:ffff88813fc05cb0 EFLAGS: 00010046
RAX: ffffffff871cad8b RBX: 0000000000000000 RCX: ffff888101bcbe80
RDX: 0000000080010000 RSI: 0000000000000017 RDI: 0000000000000001
RBP: ffff88813fc05d30 R08: ffffffff871cacd2 R09: ffff88813fffa000
R10: 00000000b56c2fd0 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000017 R15: ffff88813fc27b00
FS: 0000000000000000(0000) GS:ffff88813fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd36c02bda0 CR3: 0000000011629000 CR4: 00000000001526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__run_hrtimer+0x48b/0xd20 kernel/time/hrtimer.c:1537
__hrtimer_run_queues kernel/time/hrtimer.c:1601 [inline]
hrtimer_interrupt+0x6e2/0x1b50 kernel/time/hrtimer.c:1663
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1089 [inline]
__sysvec_apic_timer_interrupt+0xfd/0x470 arch/x86/kernel/apic/apic.c:1106
sysvec_apic_timer_interrupt+0xc1/0xf0 arch/x86/kernel/apic/apic.c:1100
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:650
RIP: 0010:pfn_valid include/linux/mmzone.h:1420 [inline]
RIP: 0010:kmsan_virt_addr_valid mm/kmsan/kmsan_shadow.c:87 [inline]
RIP: 0010:virt_to_page_or_null+0x74/0xf0 mm/kmsan/kmsan_shadow.c:125
Code: 2f 48 89 d6 48 c1 ee 23 4c 8b 0c f1 4d 85 c9 74 1f 48 89 d1 48 c1 e9 1b 0f b6 f1 48 c1 e6 04 4c 89 c9 48 01 f1 74 09 4c 8b 01 <41> f6 c0 02 75 04 31 c0 5d c3 41 f6 c0 08 75 12 48 c1 ea 15 49 8b
RSP: 0018:ffff888101bd7b38 EFLAGS: 00000282
RAX: 0000000012530850 RBX: ffffffff92530850 RCX: ffff88813fffa020
RDX: 0000000012530850 RSI: 0000000000000020 RDI: ffffffff92530850
RBP: ffff888101bd7b38 R08: ffffea000000000f R09: ffff88813fffa000
R10: 0000000049bbcbe7 R11: 00000000ffffffff R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
kmsan_get_metadata+0x116/0x180 mm/kmsan/kmsan_shadow.c:190
kmsan_get_shadow_origin_ptr+0x6f/0xb0 mm/kmsan/kmsan_shadow.c:145
__msan_metadata_ptr_for_store_1+0x13/0x20 mm/kmsan/kmsan_instr.c:52
queued_spin_unlock include/asm-generic/qspinlock.h:99 [inline]
do_raw_spin_unlock include/linux/spinlock.h:212 [inline]
__raw_spin_unlock include/linux/spinlock_api_smp.h:151 [inline]
spin_unlock include/linux/spinlock.h:394 [inline]
wg_ratelimiter_gc_entries+0x941/0xfb0 drivers/net/wireguard/ratelimiter.c:76
process_one_work+0x1219/0x1fe0 kernel/workqueue.c:2275
worker_thread+0x10ec/0x2340 kernel/workqueue.c:2421
kthread+0x521/0x560 kernel/kthread.c:292
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
---[ end trace 0a2d13bb130eff8c ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 17652 at drivers/gpu/drm/vkms/vkms_crtc.c:21 vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21
Modules linked in:
CPU: 0 PID: 17652 Comm: syz-executor.4 Tainted: G B W 5.12.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21
Code: 22 fb e9 b2 fe ff ff 8b 3a e8 71 77 22 fb e9 bf fe ff ff 44 89 e7 e8 64 77 22 fb 49 83 fe 01 0f 84 6e ff ff ff e8 65 86 9f fa <0f> 0b e9 67 ff ff ff 41 8b bf a8 0f 00 00 e8 42 77 22 fb 84 db 75
RSP: 0018:ffff88813fc05cb0 EFLAGS: 00010046
RAX: ffffffff871cad8b RBX: 0000000000000000 RCX: ffff8881512abe80
RDX: 0000000080010000 RSI: 000000000000001c RDI: 0000000000000001
RBP: ffff88813fc05d30 R08: ffffffff871cacd2 R09: ffff88813fffa000
R10: 00000000b56c2fd0 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 000000000000001c R15: ffff88813fc27b00
FS: 0000000000000000(0000) GS:ffff88813fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000544038 CR3: 0000000011629000 CR4: 00000000001526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__run_hrtimer+0x48b/0xd20 kernel/time/hrtimer.c:1537
__hrtimer_run_queues kernel/time/hrtimer.c:1601 [inline]
hrtimer_interrupt+0x6e2/0x1b50 kernel/time/hrtimer.c:1663
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1089 [inline]
__sysvec_apic_timer_interrupt+0xfd/0x470 arch/x86/kernel/apic/apic.c:1106
sysvec_apic_timer_interrupt+0xc1/0xf0 arch/x86/kernel/apic/apic.c:1100
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:650
RIP: 0010:kmsan_get_metadata+0x11f/0x180 mm/kmsan/kmsan_shadow.c:193
Code: 02 00 45 84 f6 48 0f 45 c2 48 01 c8 49 63 cf 48 03 04 cd 30 46 a2 90 75 5f 48 89 df e8 6a 00 00 00 48 85 c0 74 50 48 8b 48 40 <48> 85 c9 74 47 48 8b 40 48 48 85 c0 74 3e 81 e3 ff 0f 00 00 45 84
RSP: 0018:ffff8881597af1b0 EFLAGS: 00000286
RAX: ffffea0006bf58a0 RBX: ffff888159782008 RCX: ffffea0006bcd8a0
RDX: 0000000159782008 RSI: 00000000000002b0 RDI: ffff888159782008
RBP: ffff8881597af1c8 R08: ffffea000000000f R09: ffff88813fffa000
R10: 00000000181d6f4f R11: 0000000000000000 R12: ffff888159782000
R13: ffff888159782008 R14: 0000000000000001 R15: 0000000000000000
kmsan_get_shadow_origin_ptr+0x84/0xb0 mm/kmsan/kmsan_shadow.c:150
__msan_metadata_ptr_for_store_4+0x13/0x20 mm/kmsan/kmsan_instr.c:54
__tlb_remove_page_size+0xb1/0x600 mm/mmu_gather.c:82
__tlb_remove_page include/asm-generic/tlb.h:440 [inline]
zap_pte_range+0x1a65/0x3cb0 mm/memory.c:1274
zap_pmd_range mm/memory.c:1375 [inline]
zap_pud_range mm/memory.c:1404 [inline]
zap_p4d_range mm/memory.c:1425 [inline]
unmap_page_range+0x1154/0x1440 mm/memory.c:1446
unmap_single_vma+0x56b/0x750 mm/memory.c:1491
unmap_vmas+0x3c8/0x500 mm/memory.c:1523
exit_mmap+0x5f1/0xb80 mm/mmap.c:3218
__mmput+0x1b7/0x630 kernel/fork.c:1092
mmput+0x8c/0xb0 kernel/fork.c:1113
exit_mm+0x7a9/0x9a0 kernel/exit.c:502
do_exit+0xdbb/0x3c20 kernel/exit.c:814
do_group_exit+0x1e1/0x3c0 kernel/exit.c:924
get_signal+0x2e5f/0x39e0 kernel/signal.c:2781
arch_do_signal_or_restart+0xa4/0xe10 arch/x86/kernel/signal.c:789
handle_signal_work kernel/entry/common.c:147 [inline]
exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
exit_to_user_mode_prepare+0x2d2/0x560 kernel/entry/common.c:208
__syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline]
syscall_exit_to_user_mode+0x35/0x60 kernel/entry/common.c:301
do_syscall_64+0xc5/0x140 arch/x86/entry/common.c:58
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665d9
Code: Unable to access opcode bytes at RIP 0x4665af.
RSP: 002b:00007f78172e6218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 000000000056bf68 RCX: 00000000004665d9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000056bf68
RBP: 000000000056bf60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf6c
R13: 0000000000a9fb1f R14: 00007f78172e6300 R15: 0000000000022000
---[ end trace 0a2d13bb130eff8d ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 17652 at drivers/gpu/drm/vkms/vkms_crtc.c:21 vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21
Modules linked in:
CPU: 0 PID: 17652 Comm: syz-executor.4 Tainted: G B W 5.12.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21
Code: 22 fb e9 b2 fe ff ff 8b 3a e8 71 77 22 fb e9 bf fe ff ff 44 89 e7 e8 64 77 22 fb 49 83 fe 01 0f 84 6e ff ff ff e8 65 86 9f fa <0f> 0b e9 67 ff ff ff 41 8b bf a8 0f 00 00 e8 42 77 22 fb 84 db 75
RSP: 0018:ffff88813fc05cb0 EFLAGS: 00010046
RAX: ffffffff871cad8b RBX: 0000000000000000 RCX: ffff8881512abe80
RDX: 0000000080010000 RSI: 0000000000000029 RDI: 0000000000000001
RBP: ffff88813fc05d30 R08: ffffffff871cacd2 R09: ffff88813fffa000
R10: 000000004d1d8650 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000029 R15: ffff88813fc27b00
FS: 0000000000000000(0000) GS:ffff88813fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000544038 CR3: 0000000011629000 CR4: 00000000001526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__run_hrtimer+0x48b/0xd20 kernel/time/hrtimer.c:1537
__hrtimer_run_queues kernel/time/hrtimer.c:1601 [inline]
hrtimer_interrupt+0x6e2/0x1b50 kernel/time/hrtimer.c:1663
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1089 [inline]
__sysvec_apic_timer_interrupt+0xfd/0x470 arch/x86/kernel/apic/apic.c:1106
sysvec_apic_timer_interrupt+0xc1/0xf0 arch/x86/kernel/apic/apic.c:1100
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:650
RIP: 0010:kmsan_get_metadata+0x11f/0x180 mm/kmsan/kmsan_shadow.c:193
Code: 02 00 45 84 f6 48 0f 45 c2 48 01 c8 49 63 cf 48 03 04 cd 30 46 a2 90 75 5f 48 89 df e8 6a 00 00 00 48 85 c0 74 50 48 8b 48 40 <48> 85 c9 74 47 48 8b 40 48 48 85 c0 74 3e 81 e3 ff 0f 00 00 45 84
RSP: 0018:ffff8881597af1b0 EFLAGS: 00000286
RAX: ffffea0006bf58a0 RBX: ffff888159782008 RCX: ffffea0006bcd8a0
RDX: 0000000159782008 RSI: 00000000000002b0 RDI: ffff888159782008
RBP: ffff8881597af1c8 R08: ffffea000000000f R09: ffff88813fffa000
R10: 00000000181d6f4f R11: 0000000000000000 R12: ffff888159782000
R13: ffff888159782008 R14: 0000000000000001 R15: 0000000000000000
kmsan_get_shadow_origin_ptr+0x84/0xb0 mm/kmsan/kmsan_shadow.c:150
__msan_metadata_ptr_for_store_4+0x13/0x20 mm/kmsan/kmsan_instr.c:54
__tlb_remove_page_size+0xb1/0x600 mm/mmu_gather.c:82
__tlb_remove_page include/asm-generic/tlb.h:440 [inline]
zap_pte_range+0x1a65/0x3cb0 mm/memory.c:1274
zap_pmd_range mm/memory.c:1375 [inline]
zap_pud_range mm/memory.c:1404 [inline]
zap_p4d_range mm/memory.c:1425 [inline]
unmap_page_range+0x1154/0x1440 mm/memory.c:1446
unmap_single_vma+0x56b/0x750 mm/memory.c:1491
unmap_vmas+0x3c8/0x500 mm/memory.c:1523
exit_mmap+0x5f1/0xb80 mm/mmap.c:3218
__mmput+0x1b7/0x630 kernel/fork.c:1092
mmput+0x8c/0xb0 kernel/fork.c:1113
exit_mm+0x7a9/0x9a0 kernel/exit.c:502
do_exit+0xdbb/0x3c20 kernel/exit.c:814
do_group_exit+0x1e1/0x3c0 kernel/exit.c:924
get_signal+0x2e5f/0x39e0 kernel/signal.c:2781
arch_do_signal_or_restart+0xa4/0xe10 arch/x86/kernel/signal.c:789
handle_signal_work kernel/entry/common.c:147 [inline]
exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
exit_to_user_mode_prepare+0x2d2/0x560 kernel/entry/common.c:208
__syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline]
syscall_exit_to_user_mode+0x35/0x60 kernel/entry/common.c:301
do_syscall_64+0xc5/0x140 arch/x86/entry/common.c:58
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665d9
Code: Unable to access opcode bytes at RIP 0x4665af.
RSP: 002b:00007f78172e6218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 000000000056bf68 RCX: 00000000004665d9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000056bf68
RBP: 000000000056bf60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf6c
R13: 0000000000a9fb1f R14: 00007f78172e6300 R15: 0000000000022000
---[ end trace 0a2d13bb130eff8e ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 17652 at drivers/gpu/drm/vkms/vkms_crtc.c:21 vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21
Modules linked in:
CPU: 0 PID: 17652 Comm: syz-executor.4 Tainted: G B W 5.12.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21
Code: 22 fb e9 b2 fe ff ff 8b 3a e8 71 77 22 fb e9 bf fe ff ff 44 89 e7 e8 64 77 22 fb 49 83 fe 01 0f 84 6e ff ff ff e8 65 86 9f fa <0f> 0b e9 67 ff ff ff 41 8b bf a8 0f 00 00 e8 42 77 22 fb 84 db 75
RSP: 0018:ffff88813fc05cb0 EFLAGS: 00010046
RAX: ffffffff871cad8b RBX: 0000000000000000 RCX: ffff8881512abe80
RDX: 0000000000010000 RSI: 0000000000000020 RDI: 0000000000000001
RBP: ffff88813fc05d30 R08: ffffffff871cacd2 R09: ffff88813fffa000
R10: 000000004d1d8650 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000020 R15: ffff88813fc27b00
FS: 0000000000000000(0000) GS:ffff88813fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000544038 CR3: 0000000011629000 CR4: 00000000001526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__run_hrtimer+0x48b/0xd20 kernel/time/hrtimer.c:1537
__hrtimer_run_queues kernel/time/hrtimer.c:1601 [inline]
hrtimer_interrupt+0x6e2/0x1b50 kernel/time/hrtimer.c:1663
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1089 [inline]
__sysvec_apic_timer_interrupt+0xfd/0x470 arch/x86/kernel/apic/apic.c:1106
sysvec_apic_timer_interrupt+0xc1/0xf0 arch/x86/kernel/apic/apic.c:1100
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:650
RIP: 0010:kmsan_get_metadata+0x11f/0x180 mm/kmsan/kmsan_shadow.c:193
Code: 02 00 45 84 f6 48 0f 45 c2 48 01 c8 49 63 cf 48 03 04 cd 30 46 a2 90 75 5f 48 89 df e8 6a 00 00 00 48 85 c0 74 50 48 8b 48 40 <48> 85 c9 74 47 48 8b 40 48 48 85 c0 74 3e 81 e3 ff 0f 00 00 45 84
RSP: 0018:ffff8881597af1b0 EFLAGS: 00000286
RAX: ffffea0006bf58a0 RBX: ffff888159782008 RCX: ffffea0006bcd8a0
RDX: 0000000159782008 RSI: 00000000000002b0 RDI: ffff888159782008
RBP: ffff8881597af1c8 R08: ffffea000000000f R09: ffff88813fffa000
R10: 00000000181d6f4f R11: 0000000000000000 R12: ffff888159782000
R13: ffff888159782008 R14: 0000000000000001 R15: 0000000000000000
kmsan_get_shadow_origin_ptr+0x84/0xb0 mm/kmsan/kmsan_shadow.c:150
__msan_metadata_ptr_for_store_4+0x13/0x20 mm/kmsan/kmsan_instr.c:54
__tlb_remove_page_size+0xb1/0x600 mm/mmu_gather.c:82
__tlb_remove_page include/asm-generic/tlb.h:440 [inline]
zap_pte_range+0x1a65/0x3cb0 mm/memory.c:1274
zap_pmd_range mm/memory.c:1375 [inline]
zap_pud_range mm/memory.c:1404 [inline]
zap_p4d_range mm/memory.c:1425 [inline]
unmap_page_range+0x1154/0x1440 mm/memory.c:1446
unmap_single_vma+0x56b/0x750 mm/memory.c:1491
unmap_vmas+0x3c8/0x500 mm/memory.c:1523
exit_mmap+0x5f1/0xb80 mm/mmap.c:3218
__mmput+0x1b7/0x630 kernel/fork.c:1092
mmput+0x8c/0xb0 kernel/fork.c:1113
exit_mm+0x7a9/0x9a0 kernel/exit.c:502
do_exit+0xdbb/0x3c20 kernel/exit.c:814
do_group_exit+0x1e1/0x3c0 kernel/exit.c:924
get_signal+0x2e5f/0x39e0 kernel/signal.c:2781
arch_do_signal_or_restart+0xa4/0xe10 arch/x86/kernel/signal.c:789
handle_signal_work kernel/entry/common.c:147 [inline]
exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
exit_to_user_mode_prepare+0x2d2/0x560 kernel/entry/common.c:208
__syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline]
syscall_exit_to_user_mode+0x35/0x60 kernel/entry/common.c:301
do_syscall_64+0xc5/0x140 arch/x86/entry/common.c:58
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665d9
Code: Unable to access opcode bytes at RIP 0x4665af.
RSP: 002b:00007f78172e6218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 000000000056bf68 RCX: 00000000004665d9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000056bf68
RBP: 000000000056bf60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf6c
R13: 0000000000a9fb1f R14: 00007f78172e6300 R15: 0000000000022000
---[ end trace 0a2d13bb130eff8f ]---