WARNING: CPU: 1 PID: 20180 at net/mac80211/tx.c:4154 __ieee80211_csa_update_counter net/mac80211/tx.c:4154 [inline] WARNING: CPU: 1 PID: 20180 at net/mac80211/tx.c:4154 __ieee80211_csa_update_counter net/mac80211/tx.c:4149 [inline] WARNING: CPU: 1 PID: 20180 at net/mac80211/tx.c:4154 __ieee80211_beacon_get+0x1678/0x1a30 net/mac80211/tx.c:4347 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 20180 Comm: syz-executor.2 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 panic+0x26a/0x50e kernel/panic.c:186 __warn.cold+0x20/0x5a kernel/panic.c:541 report_bug+0x262/0x2b0 lib/bug.c:183 fixup_bug arch/x86/kernel/traps.c:178 [inline] fixup_bug arch/x86/kernel/traps.c:173 [inline] do_error_trap+0x1d7/0x310 arch/x86/kernel/traps.c:296 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1038 RIP: 0010:__ieee80211_csa_update_counter net/mac80211/tx.c:4154 [inline] RIP: 0010:__ieee80211_csa_update_counter net/mac80211/tx.c:4149 [inline] RIP: 0010:__ieee80211_beacon_get+0x1678/0x1a30 net/mac80211/tx.c:4347 Code: 85 70 03 00 00 41 0f b6 45 24 31 ff 44 8d 60 ff 45 88 65 24 44 89 e6 e8 e6 9f bf f9 45 84 e4 0f 85 4f f5 ff ff e8 a8 9e bf f9 <0f> 0b e9 43 f5 ff ff e8 9c 9e bf f9 e8 c7 c6 ad f9 31 ff 41 89 c4 RSP: 0018:ffff8880ba107c18 EFLAGS: 00010206 RAX: ffff888035784240 RBX: ffff88803416dcb8 RCX: ffffffff87a2e6ba RDX: 0000000000000100 RSI: ffffffff87a2e6c8 RDI: 0000000000000001 RBP: ffff88809729b1c0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: ffff8880b254d540 R14: 0000000000000000 R15: ffff8880ba107d60 ieee80211_beacon_get_tim+0x88/0x890 net/mac80211/tx.c:4463 ieee80211_beacon_get include/net/mac80211.h:4484 [inline] mac80211_hwsim_beacon_tx+0xff/0x680 drivers/net/wireless/mac80211_hwsim.c:1577 __iterate_interfaces+0x2e1/0x4a0 net/mac80211/util.c:614 ieee80211_iterate_active_interfaces_atomic+0x8d/0x170 net/mac80211/util.c:650 mac80211_hwsim_beacon+0xc9/0x190 drivers/net/wireless/mac80211_hwsim.c:1615 __tasklet_hrtimer_trampoline+0x29/0xa0 kernel/softirq.c:601 tasklet_action_common.constprop.0+0x265/0x360 kernel/softirq.c:522 __do_softirq+0x265/0x980 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:372 [inline] irq_exit+0x215/0x260 kernel/softirq.c:412 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894 RIP: 0010:__read_once_size include/linux/compiler.h:263 [inline] RIP: 0010:compound_head include/linux/page-flags.h:142 [inline] RIP: 0010:PageSwapCache include/linux/page-flags.h:338 [inline] RIP: 0010:free_swap_cache mm/swap_state.c:291 [inline] RIP: 0010:free_pages_and_swap_cache+0x259/0x3a0 mm/swap_state.c:319 Code: 95 d0 ff 4c 89 e8 48 c1 e8 03 80 3c 18 00 0f 85 04 01 00 00 4d 8b 65 00 49 8d 44 24 08 48 89 44 24 08 48 c1 e8 03 80 3c 18 00 <0f> 85 ff 00 00 00 49 8b 44 24 08 31 ff 4c 89 e5 48 89 44 24 10 83 RSP: 0018:ffff8880155ff718 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 RAX: 1ffffd40004ee9a9 RBX: dffffc0000000000 RCX: ffffffff8191f044 RDX: 0000000000000000 RSI: ffffffff8191f052 RDI: 0000000000000004 RBP: ffffea0002d3d0c0 R08: 0000000000000001 R09: 00000000000001fe R10: 0000000000000004 R11: 0000000000000000 R12: ffffea0002774d40 R13: ffff8880b39d7b50 R14: 0000000000000168 R15: 00000000000001fe tlb_flush_mmu_free mm/memory.c:261 [inline] zap_pte_range mm/memory.c:1417 [inline] zap_pmd_range mm/memory.c:1463 [inline] zap_pud_range mm/memory.c:1492 [inline] zap_p4d_range mm/memory.c:1513 [inline] unmap_page_range+0x221f/0x2c50 mm/memory.c:1534 unmap_single_vma+0x198/0x300 mm/memory.c:1579 unmap_vmas+0xa9/0x180 mm/memory.c:1609 exit_mmap+0x2b9/0x530 mm/mmap.c:3093 __mmput kernel/fork.c:1016 [inline] mmput+0x14e/0x4a0 kernel/fork.c:1037 exit_mm kernel/exit.c:549 [inline] do_exit+0xaec/0x2be0 kernel/exit.c:857 do_group_exit+0x125/0x310 kernel/exit.c:967 get_signal+0x3f2/0x1f70 kernel/signal.c:2589 do_signal+0x8f/0x1670 arch/x86/kernel/signal.c:799 exit_to_usermode_loop+0x204/0x2a0 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7fc21753f0a9 Code: Bad RIP value. RSP: 002b:00007fc215ab1168 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: 0000000000000009 RBX: 00007fc21765ef80 RCX: 00007fc21753f0a9 RDX: 0000000000100002 RSI: 0000000020000100 RDI: ffffffffffffff9c RBP: 00007fc21759aae9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe284c906f R14: 00007fc215ab1300 R15: 0000000000022000 Kernel Offset: disabled Rebooting in 86400 seconds.. ---------------- Code disassembly (best guess): 0: 95 xchg %eax,%ebp 1: d0 ff sar %bh 3: 4c 89 e8 mov %r13,%rax 6: 48 c1 e8 03 shr $0x3,%rax a: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1) e: 0f 85 04 01 00 00 jne 0x118 14: 4d 8b 65 00 mov 0x0(%r13),%r12 18: 49 8d 44 24 08 lea 0x8(%r12),%rax 1d: 48 89 44 24 08 mov %rax,0x8(%rsp) 22: 48 c1 e8 03 shr $0x3,%rax 26: 80 3c 18 00 cmpb $0x0,(%rax,%rbx,1) * 2a: 0f 85 ff 00 00 00 jne 0x12f <-- trapping instruction 30: 49 8b 44 24 08 mov 0x8(%r12),%rax 35: 31 ff xor %edi,%edi 37: 4c 89 e5 mov %r12,%rbp 3a: 48 89 44 24 10 mov %rax,0x10(%rsp) 3f: 83 .byte 0x83