------------[ cut here ]------------
WARNING: CPU: 0 PID: 5955 at net/mac80211/tx.c:5040 __ieee80211_beacon_update_cntdwn net/mac80211/tx.c:5040 [inline]
WARNING: CPU: 0 PID: 5955 at net/mac80211/tx.c:5040 __ieee80211_beacon_update_cntdwn net/mac80211/tx.c:5035 [inline]
WARNING: CPU: 0 PID: 5955 at net/mac80211/tx.c:5040 __ieee80211_beacon_get+0x14ac/0x16b0 net/mac80211/tx.c:5469
Modules linked in:
CPU: 0 UID: 0 PID: 5955 Comm: syz-executor237 Not tainted 6.14.0-rc3-syzkaller-00137-g27eddbf34490 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
RIP: 0010:__ieee80211_beacon_update_cntdwn net/mac80211/tx.c:5040 [inline]
RIP: 0010:__ieee80211_beacon_update_cntdwn net/mac80211/tx.c:5035 [inline]
RIP: 0010:__ieee80211_beacon_get+0x14ac/0x16b0 net/mac80211/tx.c:5469
Code: 00 89 df 44 89 e6 e8 33 10 e1 f6 44 38 e3 72 a1 e8 49 16 e1 f6 48 89 ef e8 51 82 39 f7 31 ed e9 9c fe ff ff e8 35 16 e1 f6 90 <0f> 0b 90 e9 86 f6 ff ff 48 89 c6 48 c7 c7 e0 d5 2f 90 48 89 04 24
RSP: 0018:ffffc90000007b70 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8ad8bf32
RDX: ffff88802ff60000 RSI: ffffffff8ad8c8ab RDI: 0000000000000001
RBP: ffffc90000007c20 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000003 R12: ffff888032822800
R13: 0000000000000041 R14: ffff888030ec8d80 R15: ffff888030eca9d0
FS: 000055557810f380(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000400000000140 CR3: 0000000033372000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
ieee80211_beacon_get_tim+0xa7/0x280 net/mac80211/tx.c:5596
ieee80211_beacon_get include/net/mac80211.h:5641 [inline]
mac80211_hwsim_beacon_tx+0x4ea/0xa10 drivers/net/wireless/virtual/mac80211_hwsim.c:2311
__iterate_interfaces+0x2e5/0x640 net/mac80211/util.c:760
ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 net/mac80211/util.c:796
mac80211_hwsim_beacon+0x105/0x200 drivers/net/wireless/virtual/mac80211_hwsim.c:2345
__run_hrtimer kernel/time/hrtimer.c:1801 [inline]
__hrtimer_run_queues+0x20a/0xae0 kernel/time/hrtimer.c:1865
hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1882
handle_softirqs+0x213/0x8f0 kernel/softirq.c:561
__do_softirq kernel/softirq.c:595 [inline]
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:662
irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 kernel/locking/spinlock.c:194
Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 a6 e9 3c f6 48 89 df e8 fe 68 3d f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 85 3f 2e f6 65 8b 05 a6 23 aa 74 85 c0 74 16 5b
RSP: 0018:ffffc900031073d0 EFLAGS: 00000246
RAX: 0000000000000006 RBX: ffff88801b09b098 RCX: 1ffffffff2ddce21
RDX: 0000000000000000 RSI: ffffffff8b6ceca0 RDI: ffffffff8bd35540
RBP: 0000000000000296 R08: 0000000000000001 R09: fffffbfff2dd85a3
R10: ffffffff96ec2d1f R11: 0000000000000003 R12: 000000000000001f
R13: dffffc0000000000 R14: ffff8880b8637cf0 R15: ffff8880b8637df0
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
unlock_page_lruvec_irqrestore include/linux/memcontrol.h:1527 [inline]
folio_batch_move_lru+0x2b5/0x3b0 mm/swap.c:174
__folio_batch_add_and_move+0x35b/0xc60 mm/swap.c:196
shmem_alloc_and_add_folio+0x83e/0xc10 mm/shmem.c:1961
shmem_get_folio_gfp+0x689/0x1530 mm/shmem.c:2522
shmem_fault+0x200/0xae0 mm/shmem.c:2723
__do_fault+0x10a/0x490 mm/memory.c:4988
do_read_fault mm/memory.c:5403 [inline]
do_fault mm/memory.c:5537 [inline]
do_pte_missing+0xecf/0x3e10 mm/memory.c:4058
handle_pte_fault mm/memory.c:5900 [inline]
__handle_mm_fault+0x1166/0x2c60 mm/memory.c:6043
handle_mm_fault+0x3fa/0xaa0 mm/memory.c:6212
faultin_page mm/gup.c:1196 [inline]
__get_user_pages+0x773/0x36f0 mm/gup.c:1491
populate_vma_page_range+0x27f/0x3a0 mm/gup.c:1929
__mm_populate+0x1d6/0x380 mm/gup.c:2032
mm_populate include/linux/mm.h:3386 [inline]
vm_mmap_pgoff+0x2d3/0x3a0 mm/util.c:580
ksys_mmap_pgoff+0x7d/0x5c0 mm/mmap.c:607
__do_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline]
__se_sys_mmap arch/x86/kernel/sys_x86_64.c:82 [inline]
__x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:82
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcac60e39
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 01 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc7414cf98 EFLAGS: 00000206 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00000000000107ef RCX: 00007fadcac60e39
RDX: b635773f06ebbeee RSI: 0000000000b36000 RDI: 0000400000000000
RBP: 0000000000000000 R08: 00000000ffffffff R09: 0000000000000000
R10: 0000000000008031 R11: 0000000000000206 R12: 00007ffc7414cfcc
R13: 00007ffc7414d000 R14: 00007ffc7414cfe0 R15: 0000000000000016
----------------
Code disassembly (best guess):
0: f5 cmc
1: 53 push %rbx
2: 48 8b 74 24 10 mov 0x10(%rsp),%rsi
7: 48 89 fb mov %rdi,%rbx
a: 48 83 c7 18 add $0x18,%rdi
e: e8 a6 e9 3c f6 call 0xf63ce9b9
13: 48 89 df mov %rbx,%rdi
16: e8 fe 68 3d f6 call 0xf63d6919
1b: f7 c5 00 02 00 00 test $0x200,%ebp
21: 75 23 jne 0x46
23: 9c pushf
24: 58 pop %rax
25: f6 c4 02 test $0x2,%ah
28: 75 37 jne 0x61
* 2a: bf 01 00 00 00 mov $0x1,%edi <-- trapping instruction
2f: e8 85 3f 2e f6 call 0xf62e3fb9
34: 65 8b 05 a6 23 aa 74 mov %gs:0x74aa23a6(%rip),%eax # 0x74aa23e1
3b: 85 c0 test %eax,%eax
3d: 74 16 je 0x55
3f: 5b pop %rbx