------------[ cut here ]------------
WARNING: CPU: 1 PID: 5173 at net/mac80211/tx.c:5039 __ieee80211_beacon_update_cntdwn net/mac80211/tx.c:5039 [inline]
WARNING: CPU: 1 PID: 5173 at net/mac80211/tx.c:5039 __ieee80211_beacon_get+0x1200/0x15c0 net/mac80211/tx.c:5466
Modules linked in:
CPU: 1 PID: 5173 Comm: syz-executor156 Not tainted 6.9.0-rc4-next-20240418-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
RIP: 0010:__ieee80211_beacon_update_cntdwn net/mac80211/tx.c:5039 [inline]
RIP: 0010:__ieee80211_beacon_get+0x1200/0x15c0 net/mac80211/tx.c:5466
Code: e8 45 f5 94 f6 eb 0d e8 3e f5 94 f6 4c 8b bc 24 98 00 00 00 4c 89 ef e8 2e ac ee f6 45 31 ed e9 4e fe ff ff e8 21 f5 94 f6 90 <0f> 0b 90 e9 02 f7 ff ff e8 13 f5 94 f6 90 0f 0b 90 e9 ea f8 ff ff
RSP: 0018:ffffc90000a18a00 EFLAGS: 00010246
RAX: ffffffff8b01686f RBX: 0000000000000000 RCX: ffff88802b5b5a00
RDX: 0000000080000101 RSI: 0000000000000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffffff8b015f6d R09: ffffffff8b015970
R10: 0000000000000003 R11: ffff88802b5b5a00 R12: ffff888023efe2d0
R13: ffff8880208a6c00 R14: ffff888023efe750 R15: ffff888023efcca0
FS: 00005555818ec380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020e4a000 CR3: 000000007b20e000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
ieee80211_beacon_get_tim+0xb4/0x320 net/mac80211/tx.c:5593
ieee80211_beacon_get include/net/mac80211.h:5562 [inline]
mac80211_hwsim_beacon_tx+0x398/0x7e0 drivers/net/wireless/virtual/mac80211_hwsim.c:2302
__iterate_interfaces+0x223/0x4c0 net/mac80211/util.c:772
ieee80211_iterate_active_interfaces_atomic+0xd8/0x170 net/mac80211/util.c:808
mac80211_hwsim_beacon+0xd4/0x1f0 drivers/net/wireless/virtual/mac80211_hwsim.c:2332
__run_hrtimer kernel/time/hrtimer.c:1692 [inline]
__hrtimer_run_queues+0x5a5/0xd50 kernel/time/hrtimer.c:1756
hrtimer_run_softirq+0x19a/0x2c0 kernel/time/hrtimer.c:1773
__do_softirq+0x2c6/0x980 kernel/softirq.c:554
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633
irq_exit_rcu+0x9/0x30 kernel/softirq.c:645
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:check_kcov_mode kernel/kcov.c:184 [inline]
RIP: 0010:write_comp_data kernel/kcov.c:236 [inline]
RIP: 0010:__sanitizer_cov_trace_const_cmp8+0x35/0x90 kernel/kcov.c:311
Code: 0c 25 00 d5 03 00 65 8b 05 80 72 6d 7e a9 00 01 ff 00 74 10 a9 00 01 00 00 74 57 83 b9 1c 16 00 00 00 74 4e 8b 81 f8 15 00 00 <83> f8 03 75 43 48 8b 91 00 16 00 00 44 8b 89 fc 15 00 00 49 c1 e1
RSP: 0018:ffffc900034e6660 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffffc900034e6788 RCX: ffff88802b5b5a00
RDX: ffffc900034e6775 RSI: ffffffff81e44260 RDI: 0000000000000000
RBP: ffffffff81e44261 R08: ffffffff8140e1cc R09: ffffc900034e6830
R10: 0000000000000003 R11: ffffffff81822da0 R12: ffffc900034e6740
R13: ffffc900034e6790 R14: dffffc0000000000 R15: ffffffff81e44261
orc_find arch/x86/kernel/unwind_orc.c:202 [inline]
unwind_next_frame+0x1ac/0x2a00 arch/x86/kernel/unwind_orc.c:494
arch_stack_walk+0x151/0x1b0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x118/0x1d0 kernel/stacktrace.c:122
save_stack+0xfb/0x1f0 mm/page_owner.c:156
__set_page_owner+0x8d/0x810 mm/page_owner.c:325
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1476
prep_new_page mm/page_alloc.c:1484 [inline]
get_page_from_freelist+0x2ce2/0x2d90 mm/page_alloc.c:3446
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4704
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
vma_alloc_folio_noprof+0xf3/0x1f0 mm/mempolicy.c:2304
folio_prealloc+0x31/0x170
wp_page_copy mm/memory.c:3269 [inline]
do_wp_page+0x11cc/0x5230 mm/memory.c:3661
handle_pte_fault+0x1186/0x6dc0 mm/memory.c:5375
__handle_mm_fault mm/memory.c:5500 [inline]
handle_mm_fault+0x10e7/0x1bb0 mm/memory.c:5665
do_user_addr_fault arch/x86/mm/fault.c:1420 [inline]
handle_page_fault arch/x86/mm/fault.c:1512 [inline]
exc_page_fault+0x2b9/0x900 arch/x86/mm/fault.c:1570
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0010:rep_movs_alternative+0x4a/0x70 arch/x86/lib/copy_user_64.S:71
Code: 75 f1 c3 cc cc cc cc 66 0f 1f 84 00 00 00 00 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 73 e8 eb c9 a4 c3 cc cc cc cc 48 89 c8 48 c1 e9 03 83 e0 07 f3 48 a5 89 c1
RSP: 0018:ffffc900034e7958 EFLAGS: 00050206
RAX: ffff88801294b001 RBX: 0000000020e4ae80 RCX: 0000000000000e80
RDX: 0000000000000000 RSI: ffff88801294b180 RDI: 0000000020e4a000
RBP: ffffc900034e7ad8 R08: ffff88801294bfff R09: 1ffff110025297ff
R10: dffffc0000000000 R11: ffffed1002529800 R12: dffffc0000000000
R13: 1ffff9200069cf40 R14: 0000000000001000 R15: ffff88801294b000
copy_user_generic arch/x86/include/asm/uaccess_64.h:110 [inline]
raw_copy_to_user arch/x86/include/asm/uaccess_64.h:131 [inline]
copy_to_user_iter lib/iov_iter.c:25 [inline]
iterate_iovec include/linux/iov_iter.h:51 [inline]
iterate_and_advance2 include/linux/iov_iter.h:247 [inline]
iterate_and_advance include/linux/iov_iter.h:271 [inline]
_copy_to_iter+0x4c0/0x1960 lib/iov_iter.c:185
copy_page_to_iter+0xb1/0x160 lib/iov_iter.c:362
process_vm_rw_pages mm/process_vm_access.c:45 [inline]
process_vm_rw_single_vec mm/process_vm_access.c:118 [inline]
process_vm_rw_core mm/process_vm_access.c:216 [inline]
process_vm_rw+0x871/0xcf0 mm/process_vm_access.c:284
__do_sys_process_vm_readv mm/process_vm_access.c:296 [inline]
__se_sys_process_vm_readv mm/process_vm_access.c:292 [inline]
__x64_sys_process_vm_readv+0xe0/0x100 mm/process_vm_access.c:292
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f37adaa5459
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 d1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe5564e878 EFLAGS: 00000246 ORIG_RAX: 0000000000000136
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f37adaa5459
RDX: 0000000000000002 RSI: 0000000020008400 RDI: 000000000000000f
RBP: 00000000000f4240 R08: 0000000000000286 R09: 0000000000000000
R10: 0000000020008640 R11: 0000000000000246 R12: 0000000000014826
R13: 00007ffe5564e8ac R14: 00007ffe5564e8f0 R15: 00007ffe5564e8e0
----------------
Code disassembly (best guess):
0: 0c 25 or $0x25,%al
2: 00 d5 add %dl,%ch
4: 03 00 add (%rax),%eax
6: 65 8b 05 80 72 6d 7e mov %gs:0x7e6d7280(%rip),%eax # 0x7e6d728d
d: a9 00 01 ff 00 test $0xff0100,%eax
12: 74 10 je 0x24
14: a9 00 01 00 00 test $0x100,%eax
19: 74 57 je 0x72
1b: 83 b9 1c 16 00 00 00 cmpl $0x0,0x161c(%rcx)
22: 74 4e je 0x72
24: 8b 81 f8 15 00 00 mov 0x15f8(%rcx),%eax
* 2a: 83 f8 03 cmp $0x3,%eax <-- trapping instruction
2d: 75 43 jne 0x72
2f: 48 8b 91 00 16 00 00 mov 0x1600(%rcx),%rdx
36: 44 8b 89 fc 15 00 00 mov 0x15fc(%rcx),%r9d
3d: 49 rex.WB
3e: c1 .byte 0xc1
3f: e1 .byte 0xe1