syzbot

------------[ cut here ]------------
WARNING: CPU: 0 PID: 13623 at net/mac80211/rx.c:5396 ieee80211_rx_list+0x2bd5/0x38f0 net/mac80211/rx.c:5396
Modules linked in:
CPU: 0 UID: 0 PID: 13623 Comm: syz.1.1644 Not tainted 6.14.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:ieee80211_rx_list+0x2bd5/0x38f0 net/mac80211/rx.c:5396
Code: 90 e9 48 d8 ff ff e8 4a d1 44 f6 e9 3e d8 ff ff e8 40 d1 44 f6 e9 34 d8 ff ff e8 36 d1 44 f6 e9 2a d8 ff ff e8 2c d1 44 f6 90 <0f> 0b 90 e9 1c d8 ff ff e8 1e d1 44 f6 31 c0 48 89 44 24 70 e9 b0
RSP: 0018:ffffc90000007980 EFLAGS: 00010246
RAX: ffffffff8b7cecd4 RBX: 0000000000000000 RCX: ffff8880278d8000
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000007bb0 R08: ffffffff8b7cc333 R09: 1ffffffff28a9308
R10: dffffc0000000000 R11: fffffbfff28a9309 R12: ffff888022b20a00
R13: dffffc0000000000 R14: ffff8880439db0c8 R15: ffff8880439d8e40
FS:  00007fd2a3d626c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd2a3d40f98 CR3: 0000000066182000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 ieee80211_rx_napi+0x18a/0x3c0 net/mac80211/rx.c:5506
 ieee80211_rx include/net/mac80211.h:5172 [inline]
 ieee80211_handle_queued_frames+0xe7/0x1e0 net/mac80211/main.c:441
 tasklet_action_common+0x428/0x620 kernel/softirq.c:811
 handle_softirqs+0x2d6/0x9b0 kernel/softirq.c:561
 __do_softirq kernel/softirq.c:595 [inline]
 invoke_softirq kernel/softirq.c:435 [inline]
 __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:kasan_check_range+0xc/0x290 mm/kasan/generic.c:188
Code: 0f 0b 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 55 41 57 41 56 41 54 53 <b0> 01 48 85 f6 0f 84 a0 01 00 00 4c 8d 04 37 49 39 f8 0f 82 56 02
RSP: 0018:ffffc9000583f1b0 EFLAGS: 00000246
RAX: ffffffff81fa9ddd RBX: 0000000000000001 RCX: ffffffff81fa9dee
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffea0000e88cf4
RBP: ffffc9000583f3f8 R08: ffffffff81fa9d5f R09: 1ffffffff28a9308
R10: dffffc0000000000 R11: fffffbfff28a9309 R12: dffffc0000000000
R13: dffffc0000000000 R14: ffffffff81fa9d2e R15: ffffea0000e88cf4
 instrument_atomic_read include/linux/instrumented.h:68 [inline]
 atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
 page_ref_count include/linux/page_ref.h:67 [inline]
 page_ref_add_unless include/linux/page_ref.h:237 [inline]
 folio_ref_add_unless include/linux/page_ref.h:248 [inline]
 folio_try_get+0xde/0x350 include/linux/page_ref.h:264
 next_uptodate_folio+0xd3/0x5f0 mm/filemap.c:3638
 filemap_map_pages+0x12d0/0x1900 mm/filemap.c:3821
 do_fault_around mm/memory.c:5361 [inline]
 do_read_fault mm/memory.c:5394 [inline]
 do_fault mm/memory.c:5537 [inline]
 do_pte_missing mm/memory.c:4058 [inline]
 handle_pte_fault mm/memory.c:5900 [inline]
 __handle_mm_fault+0x4acd/0x70f0 mm/memory.c:6043
 handle_mm_fault+0x3e5/0x8d0 mm/memory.c:6212
 faultin_page mm/gup.c:1196 [inline]
 __get_user_pages+0x1a92/0x4140 mm/gup.c:1491
 populate_vma_page_range+0x264/0x330 mm/gup.c:1929
 __mm_populate+0x27a/0x460 mm/gup.c:2032
 mm_populate include/linux/mm.h:3386 [inline]
 vm_mmap_pgoff+0x303/0x430 mm/util.c:580
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd2a2f8d169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd2a3d62038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007fd2a31a5fa0 RCX: 00007fd2a2f8d169
RDX: b635773f06ebbeee RSI: 0000000000b36000 RDI: 0000400000000000
RBP: 00007fd2a300e2a0 R08: ffffffffffffffff R09: 0000000000000000
R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fd2a31a5fa0 R15: 00007ffca65b6478
 </TASK>
----------------
Code disassembly (best guess):
   0:	0f 0b                	ud2
   2:	66 2e 0f 1f 84 00 00 	cs nopw 0x0(%rax,%rax,1)
   9:	00 00 00
   c:	66 90                	xchg   %ax,%ax
   e:	90                   	nop
   f:	90                   	nop
  10:	90                   	nop
  11:	90                   	nop
  12:	90                   	nop
  13:	90                   	nop
  14:	90                   	nop
  15:	90                   	nop
  16:	90                   	nop
  17:	90                   	nop
  18:	90                   	nop
  19:	90                   	nop
  1a:	90                   	nop
  1b:	90                   	nop
  1c:	90                   	nop
  1d:	90                   	nop
  1e:	66 0f 1f 00          	nopw   (%rax)
  22:	55                   	push   %rbp
  23:	41 57                	push   %r15
  25:	41 56                	push   %r14
  27:	41 54                	push   %r12
  29:	53                   	push   %rbx
* 2a:	b0 01                	mov    $0x1,%al <-- trapping instruction
  2c:	48 85 f6             	test   %rsi,%rsi
  2f:	0f 84 a0 01 00 00    	je     0x1d5
  35:	4c 8d 04 37          	lea    (%rdi,%rsi,1),%r8
  39:	49 39 f8             	cmp    %rdi,%r8
  3c:	0f                   	.byte 0xf
  3d:	82                   	(bad)
  3e:	56                   	push   %rsi
  3f:	02                   	.byte 0x2