------------[ cut here ]------------
no supported rates for sta (null) (0xffffffff, band 0) in rate_mask 0xfff with flags 0x20
WARNING: CPU: 1 PID: 5794 at net/mac80211/rate.c:385 __rate_control_send_low+0x635/0x880 net/mac80211/rate.c:380
Modules linked in:
CPU: 1 PID: 5794 Comm: syz-execprog Not tainted 6.6.97-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:__rate_control_send_low+0x635/0x880 net/mac80211/rate.c:380
Code: 30 42 0f b6 04 28 84 c0 0f 85 e6 01 00 00 41 8b 0e 48 c7 c7 c0 87 be 8b 48 8b 74 24 10 44 8b 44 24 1c 45 89 e1 e8 db 6e 69 f7 <0f> 0b e9 78 fe ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 03 fa ff
RSP: 0018:ffffc900001f0560 EFLAGS: 00010246
RAX: 12cae463b0ff2e00 RBX: 000000000000000c RCX: ffff8880770e3c00
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002
RBP: 0000000000000084 R08: ffffc900001f0167 R09: 1ffff9200003e02c
R10: dffffc0000000000 R11: fffff5200003e02d R12: 0000000000000020
R13: dffffc0000000000 R14: ffff88802c41b358 R15: ffff888076eaade8
FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c00003e720 CR3: 0000000018ed3000 CR4: 00000000003506e0
Call Trace:
rate_control_send_low+0x194/0x790 net/mac80211/rate.c:405
rate_control_get_rate+0x20b/0x5c0 net/mac80211/rate.c:921
ieee80211_beacon_get_finish+0x38d/0x6b0 net/mac80211/tx.c:5218
ieee80211_beacon_get_ap+0x1429/0x1970 net/mac80211/tx.c:5321
__ieee80211_beacon_get+0x10eb/0x1600 net/mac80211/tx.c:5417
ieee80211_beacon_get_tim+0xb8/0x560 net/mac80211/tx.c:5559
ieee80211_beacon_get include/net/mac80211.h:5438 [inline]
mac80211_hwsim_beacon_tx+0x3c7/0x780 drivers/net/wireless/virtual/mac80211_hwsim.c:2265
__iterate_interfaces+0x243/0x500 net/mac80211/util.c:766
ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 net/mac80211/util.c:802
mac80211_hwsim_beacon+0xbb/0x1b0 drivers/net/wireless/virtual/mac80211_hwsim.c:2295
__run_hrtimer kernel/time/hrtimer.c:1755 [inline]
__hrtimer_run_queues+0x51e/0xc40 kernel/time/hrtimer.c:1819
hrtimer_run_softirq+0x187/0x2b0 kernel/time/hrtimer.c:1836
handle_softirqs+0x280/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:lock_acquire+0xd3/0x410 kernel/locking/lockdep.c:5727
Code: 06 48 8d 3c c5 e8 92 4a 8e be 08 00 00 00 e8 a4 4d 77 00 4c 0f a3 35 74 99 e3 0c 73 0d e8 e5 96 08 00 84 c0 0f 84 18 02 00 00 <48> c7 c0 9c c7 4a 8e 48 c1 e8 03 42 0f b6 04 38 84 c0 0f 85 07 02
RSP: 0018:ffffc9000468f320 EFLAGS: 00000202
RAX: 0000000000000001 RBX: 0000000000000000 RCX: 12cae463b0ff2e00
RDX: 0000000000000000 RSI: ffffffff8afc7860 RDI: ffffffff8afc7820
RBP: ffffc9000468f430 R08: ffffffff8e4a92ef R09: 1ffffffff1c9525d
R10: dffffc0000000000 R11: fffffbfff1c9525e R12: 1ffff920008d1e70
R13: ffffffff8cd2fb20 R14: 0000000000000001 R15: dffffc0000000000
rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
rcu_read_lock_sched include/linux/rcupdate.h:878 [inline]
pfn_valid+0xe9/0x420 include/linux/mmzone.h:2011
page_table_check_clear+0x1e/0x6a0 mm/page_table_check.c:70
ptep_get_and_clear_full arch/x86/include/asm/jump_label.h:-1 [inline]
zap_pte_range mm/memory.c:1428 [inline]
zap_pmd_range mm/memory.c:1570 [inline]
zap_pud_range mm/memory.c:1599 [inline]
zap_p4d_range mm/memory.c:1620 [inline]
unmap_page_range+0x1ad1/0x2fe0 mm/memory.c:1641
unmap_vmas+0x25e/0x3a0 mm/memory.c:1731
exit_mmap+0x200/0xb50 mm/mmap.c:3298
__mmput+0x118/0x3c0 kernel/fork.c:1355
exit_mm+0x1da/0x2c0 kernel/exit.c:569
do_exit+0x88e/0x23c0 kernel/exit.c:870
do_group_exit+0x21b/0x2d0 kernel/exit.c:1024
get_signal+0x12fc/0x1400 kernel/signal.c:2902
arch_do_signal_or_restart+0x96/0x780 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174
exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302
do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:87
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x480143
Code: Unable to access opcode bytes at 0x480119.
RSP: 002b:000000c004009ef0 EFLAGS: 00000286 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 0000000000000000 RCX: 0000000000480143
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000318d078
RBP: 000000c004009f38 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000286 R12: 000000000047c3c0
R13: 000000c00179c808 R14: 000000c004000000 R15: 0000000000000003
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 48 8d 3c c5 e8 92 4a lea -0x71b56d18(,%rax,8),%rdi
7: 8e
8: be 08 00 00 00 mov $0x8,%esi
d: e8 a4 4d 77 00 call 0x774db6
12: 4c 0f a3 35 74 99 e3 bt %r14,0xce39974(%rip) # 0xce3998e
19: 0c
1a: 73 0d jae 0x29
1c: e8 e5 96 08 00 call 0x89706
21: 84 c0 test %al,%al
23: 0f 84 18 02 00 00 je 0x241
* 29: 48 c7 c0 9c c7 4a 8e mov $0xffffffff8e4ac79c,%rax <-- trapping instruction
30: 48 c1 e8 03 shr $0x3,%rax
34: 42 0f b6 04 38 movzbl (%rax,%r15,1),%eax
39: 84 c0 test %al,%al
3b: 0f .byte 0xf
3c: 85 07 test %eax,(%rdi)
3e: 02 .byte 0x2