------------[ cut here ]------------
WARNING: CPU: 0 PID: 11646 at net/mac80211/tx.c:4859 __ieee80211_beacon_update_cntdwn net/mac80211/tx.c:4859 [inline]
WARNING: CPU: 0 PID: 11646 at net/mac80211/tx.c:4859 __ieee80211_beacon_get+0x172c/0x1f80 net/mac80211/tx.c:5083
Modules linked in:
CPU: 0 PID: 11646 Comm: syz.4.2085 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:__ieee80211_beacon_update_cntdwn net/mac80211/tx.c:4859 [inline]
RIP: 0010:__ieee80211_beacon_get+0x172c/0x1f80 net/mac80211/tx.c:5083
Code: f8 0f 0b e9 f1 fa ff ff e8 51 6c 3a f8 0f 0b 4c 8b 74 24 08 e9 36 fe ff ff e8 40 6c 3a f8 0f 0b e9 3c ef ff ff e8 34 6c 3a f8 <0f> 0b e9 b8 f2 ff ff e8 68 ef 6b 00 44 89 e1 80 e1 07 80 c1 03 38
RSP: 0018:ffffc900000078c0 EFLAGS: 00010246
RAX: ffffffff893d5e5c RBX: ffff88807eda4c80 RCX: ffff88807a19bb80
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000007ae8 R08: ffff88807a19bb80 R09: 0000000000000003
R10: 0000000000000007 R11: 0000000000000100 R12: ffff888022c19c00
R13: dffffc0000000000 R14: 0000000000000000 R15: 1ffff92000000f28
FS: 0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200001000000 CR3: 000000000be8e000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
ieee80211_beacon_get_tim+0x48/0x840 net/mac80211/tx.c:5202
ieee80211_beacon_get include/net/mac80211.h:4983 [inline]
mac80211_hwsim_beacon_tx+0xf4/0x920 drivers/net/wireless/mac80211_hwsim.c:1812
__iterate_interfaces+0x243/0x500 net/mac80211/util.c:793
ieee80211_iterate_active_interfaces_atomic+0xb3/0x140 net/mac80211/util.c:829
mac80211_hwsim_beacon+0x9b/0x180 drivers/net/wireless/mac80211_hwsim.c:1865
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x53d/0xc40 kernel/time/hrtimer.c:1749
hrtimer_run_softirq+0x176/0x240 kernel/time/hrtimer.c:1766
handle_softirqs+0x328/0x820 kernel/softirq.c:576
__do_softirq kernel/softirq.c:610 [inline]
invoke_softirq kernel/softirq.c:450 [inline]
__irq_exit_rcu+0x12f/0x220 kernel/softirq.c:659
irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:__preempt_count_add arch/x86/include/asm/preempt.h:80 [inline]
RIP: 0010:preempt_count_add+0x37/0x190 kernel/sched/core.c:5507
Code: ff df 48 c7 c0 80 3f 0c 96 48 c1 e8 03 42 0f b6 04 38 84 c0 0f 85 eb 00 00 00 83 3d b2 ce ba 14 00 75 07 65 8b 05 f1 fe b0 7e <65> 01 3d ea fe b0 7e 48 c7 c0 80 3f 0c 96 48 c1 e8 03 42 0f b6 04
RSP: 0018:ffffc9000348ed28 EFLAGS: 00000246
RAX: 0000000080000000 RBX: ffffc9000348ee68 RCX: ffffffff960c3f03
RDX: ffffc9000348eef8 RSI: dffffc0000000000 RDI: 0000000000000001
RBP: ffffc9000348eeb0 R08: dffffc0000000001 R09: ffffc9000348ee68
R10: fffff52000691dd9 R11: 1ffff92000691dcd R12: ffffffff8134983e
R13: ffffc9000348ee08 R14: dffffc0000000000 R15: dffffc0000000000
unwind_next_frame+0xac/0x1d90 arch/x86/kernel/unwind_orc.c:433
__unwind_start+0x5bb/0x740 arch/x86/kernel/unwind_orc.c:704
unwind_start arch/x86/include/asm/unwind.h:60 [inline]
arch_stack_walk+0xda/0x140 arch/x86/kernel/stacktrace.c:24
stack_trace_save+0x98/0xe0 kernel/stacktrace.c:122
save_stack+0xf3/0x1e0 mm/page_owner.c:119
__reset_page_owner+0x51/0x180 mm/page_owner.c:140
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1340 [inline]
free_pcp_prepare mm/page_alloc.c:1391 [inline]
free_unref_page_prepare+0x637/0x6c0 mm/page_alloc.c:3317
free_unref_page_list+0x122/0x7e0 mm/page_alloc.c:3433
release_pages+0x184b/0x1bb0 mm/swap.c:963
__pagevec_release+0x6d/0xe0 mm/swap.c:983
pagevec_release include/linux/pagevec.h:81 [inline]
shmem_undo_range+0x5cb/0x1880 mm/shmem.c:964
shmem_truncate_range mm/shmem.c:1063 [inline]
shmem_evict_inode+0x20d/0xa00 mm/shmem.c:1145
evict+0x485/0x870 fs/inode.c:647
__dentry_kill+0x431/0x650 fs/dcache.c:586
dentry_kill+0xb8/0x290 fs/dcache.c:-1
dput+0xd8/0x1a0 fs/dcache.c:893
__fput+0x5ee/0x930 fs/file_table.c:319
task_work_run+0x125/0x1a0 kernel/task_work.c:188
exit_task_work include/linux/task_work.h:33 [inline]
do_exit+0x61e/0x20a0 kernel/exit.c:883
do_group_exit+0x12e/0x300 kernel/exit.c:997
get_signal+0x6ca/0x12c0 kernel/signal.c:2900
arch_do_signal_or_restart+0xc1/0x1300 arch/x86/kernel/signal.c:867
handle_signal_work kernel/entry/common.c:154 [inline]
exit_to_user_mode_loop+0x9e/0x130 kernel/entry/common.c:178
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:214
__syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f276fad4fc9
Code: Unable to access opcode bytes at RIP 0x7f276fad4f9f.
RSP: 002b:00007f276dd1b038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: 000000000003fffd RBX: 00007f276fd2c090 RCX: 00007f276fad4fc9
RDX: 03fffffffffffeda RSI: 00002000000000c0 RDI: 0000000000000003
RBP: 00007f276fb57f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f276fd2c128 R14: 00007f276fd2c090 R15: 00007ffebe1eccf8
----------------
Code disassembly (best guess), 1 bytes skipped:
0: df 48 c7 fisttps -0x39(%rax)
3: c0 80 3f 0c 96 48 c1 rolb $0xc1,0x48960c3f(%rax)
a: e8 03 42 0f b6 call 0xb60f4212
f: 04 38 add $0x38,%al
11: 84 c0 test %al,%al
13: 0f 85 eb 00 00 00 jne 0x104
19: 83 3d b2 ce ba 14 00 cmpl $0x0,0x14baceb2(%rip) # 0x14baced2
20: 75 07 jne 0x29
22: 65 8b 05 f1 fe b0 7e mov %gs:0x7eb0fef1(%rip),%eax # 0x7eb0ff1a
* 29: 65 01 3d ea fe b0 7e add %edi,%gs:0x7eb0feea(%rip) # 0x7eb0ff1a <-- trapping instruction
30: 48 c7 c0 80 3f 0c 96 mov $0xffffffff960c3f80,%rax
37: 48 c1 e8 03 shr $0x3,%rax
3b: 42 rex.X
3c: 0f .byte 0xf
3d: b6 04 mov $0x4,%dh