------------[ cut here ]------------
WARNING: CPU: 1 PID: 6561 at net/mac80211/tx.c:5040 __ieee80211_beacon_update_cntdwn net/mac80211/tx.c:5040 [inline]
WARNING: CPU: 1 PID: 6561 at net/mac80211/tx.c:5040 __ieee80211_beacon_update_cntdwn net/mac80211/tx.c:5035 [inline]
WARNING: CPU: 1 PID: 6561 at net/mac80211/tx.c:5040 __ieee80211_beacon_get+0x14ac/0x16b0 net/mac80211/tx.c:5469
Modules linked in:
CPU: 1 UID: 0 PID: 6561 Comm: syz.1.125 Not tainted 6.14.0-rc5-syzkaller-00013-g99fa936e8e4f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:__ieee80211_beacon_update_cntdwn net/mac80211/tx.c:5040 [inline]
RIP: 0010:__ieee80211_beacon_update_cntdwn net/mac80211/tx.c:5035 [inline]
RIP: 0010:__ieee80211_beacon_get+0x14ac/0x16b0 net/mac80211/tx.c:5469
Code: 00 89 df 44 89 e6 e8 63 0d e3 f6 44 38 e3 72 a1 e8 79 13 e3 f6 48 89 ef e8 d1 a1 3a f7 31 ed e9 9c fe ff ff e8 65 13 e3 f6 90 <0f> 0b 90 e9 86 f6 ff ff 48 89 c6 48 c7 c7 e0 fe 2f 90 48 89 04 24
RSP: 0018:ffffc90000a18b70 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8ad6c442
RDX: ffff888025c8bc00 RSI: ffffffff8ad6cdbb RDI: 0000000000000001
RBP: ffffc90000a18c20 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000002 R12: ffff88807b06c400
R13: 0000000000000041 R14: ffff88804b030d80 R15: ffff88804b0329d0
FS: 00007f7b18a616c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00004000002a6030 CR3: 00000000316ca000 CR4: 0000000000350ef0
Call Trace:
ieee80211_beacon_get_tim+0xa7/0x280 net/mac80211/tx.c:5596
ieee80211_beacon_get include/net/mac80211.h:5641 [inline]
mac80211_hwsim_beacon_tx+0x4ea/0xa10 drivers/net/wireless/virtual/mac80211_hwsim.c:2311
__iterate_interfaces+0x2e8/0x640 net/mac80211/util.c:760
ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 net/mac80211/util.c:796
mac80211_hwsim_beacon+0x105/0x200 drivers/net/wireless/virtual/mac80211_hwsim.c:2345
__run_hrtimer kernel/time/hrtimer.c:1801 [inline]
__hrtimer_run_queues+0x20d/0xae0 kernel/time/hrtimer.c:1865
hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1882
handle_softirqs+0x216/0x8f0 kernel/softirq.c:561
__do_softirq kernel/softirq.c:595 [inline]
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:662
irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:should_fail_alloc_page+0xc6/0x130 mm/fail_page_alloc.c:44
Code: ff 41 81 e4 00 20 00 00 31 ff 31 ed 44 89 e6 e8 40 32 9d ff 45 85 e4 89 de bf 1f 00 00 00 40 0f 95 c5 e8 2d 32 9d ff 83 fb 1f <77> 5e e8 23 37 9d ff 89 d9 be 01 00 00 00 89 ea d3 e6 48 c7 c7 a0
RSP: 0018:ffffc90004e1f150 EFLAGS: 00000297
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff821ca9f3
RDX: ffff888025c8bc00 RSI: 000000000000001f RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000005 R09: 000000000000001f
R10: 0000000000000000 R11: 0000000000000002 R12: 0000000000000000
R13: ffffc90004e1f2f4 R14: ffffc90004e1f2e0 R15: 0000000000000008
prepare_alloc_pages.constprop.0+0x16f/0x560 mm/page_alloc.c:4514
__alloc_frozen_pages_noprof+0x18e/0x2470 mm/page_alloc.c:4728
alloc_pages_mpol+0x1fc/0x540 mm/mempolicy.c:2270
folio_alloc_mpol_noprof+0x36/0x2f0 mm/mempolicy.c:2289
vma_alloc_folio_noprof+0xee/0x1b0 mm/mempolicy.c:2324
folio_prealloc mm/memory.c:1061 [inline]
wp_page_copy mm/memory.c:3446 [inline]
do_wp_page+0x105a/0x4670 mm/memory.c:3838
handle_pte_fault mm/memory.c:5916 [inline]
__handle_mm_fault+0x1c7c/0x2c60 mm/memory.c:6043
handle_mm_fault+0x3fa/0xaa0 mm/memory.c:6212
do_user_addr_fault+0x7a3/0x13f0 arch/x86/mm/fault.c:1388
handle_page_fault arch/x86/mm/fault.c:1480 [inline]
exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1538
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0010:__put_user_nocheck_4+0x7/0x20 arch/x86/lib/putuser.S:97
Code: d9 0f 01 cb 89 01 31 c9 0f 01 ca e9 0e 79 bb f5 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 01 cb <89> 01 31 c9 0f 01 ca e9 e8 78 bb f5 66 66 2e 0f 1f 84 00 00 00 00
RSP: 0018:ffffc90004e1f9f8 EFLAGS: 00050293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00004000002a6030
RDX: ffff888025c8bc00 RSI: ffffffff89260ad4 RDI: 0000000000000005
RBP: ffffc90004e1fd98 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000000 R12: 0000000000000000
R13: 00004000002a6000 R14: ffffc90004e1fddc R15: 0000000000000002
____sys_recvmsg+0x2ef/0x6b0 net/socket.c:2806
___sys_recvmsg+0x115/0x1a0 net/socket.c:2835
do_recvmmsg+0x2f8/0x740 net/socket.c:2930
__sys_recvmmsg net/socket.c:3004 [inline]
__do_sys_recvmmsg net/socket.c:3027 [inline]
__se_sys_recvmmsg net/socket.c:3020 [inline]
__x64_sys_recvmmsg+0x239/0x290 net/socket.c:3020
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7b17b8d169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7b18a61038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: ffffffffffffffda RBX: 00007f7b17da6080 RCX: 00007f7b17b8d169
RDX: 0000000000010106 RSI: 00004000000000c0 RDI: 0000000000000003
RBP: 00007f7b17c0e2a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 00007f7b17da6080 R15: 00007ffd57823b78
----------------
Code disassembly (best guess):
0: ff 41 81 incl -0x7f(%rcx)
3: e4 00 in $0x0,%al
5: 20 00 and %al,(%rax)
7: 00 31 add %dh,(%rcx)
9: ff 31 push (%rcx)
b: ed in (%dx),%eax
c: 44 89 e6 mov %r12d,%esi
f: e8 40 32 9d ff call 0xff9d3254
14: 45 85 e4 test %r12d,%r12d
17: 89 de mov %ebx,%esi
19: bf 1f 00 00 00 mov $0x1f,%edi
1e: 40 0f 95 c5 setne %bpl
22: e8 2d 32 9d ff call 0xff9d3254
27: 83 fb 1f cmp $0x1f,%ebx
* 2a: 77 5e ja 0x8a <-- trapping instruction
2c: e8 23 37 9d ff call 0xff9d3754
31: 89 d9 mov %ebx,%ecx
33: be 01 00 00 00 mov $0x1,%esi
38: 89 ea mov %ebp,%edx
3a: d3 e6 shl %cl,%esi
3c: 48 rex.W
3d: c7 .byte 0xc7
3e: c7 (bad)
3f: a0 .byte 0xa0