------------[ cut here ]------------
no supported rates for sta (null) (0xffffffff, band 0) in rate_mask 0x0 with flags 0x0
WARNING: CPU: 2 PID: 17476 at net/mac80211/rate.c:401 __rate_control_send_low+0x667/0x780 net/mac80211/rate.c:401
Modules linked in:
CPU: 2 UID: 0 PID: 17476 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:__rate_control_send_low+0x667/0x780 net/mac80211/rate.c:401
Code: a4 a0 d4 00 00 00 e8 88 e4 e3 f6 44 8b 44 24 24 45 89 e9 89 d9 48 8b 74 24 08 44 89 e2 48 c7 c7 e0 51 e4 8c e8 ca 68 a2 f6 90 <0f> 0b 90 90 e9 20 fd ff ff 48 8b 3c 24 e8 e7 75 4b f7 e9 f5 fc ff
RSP: 0018:ffffc90000538930 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817b2e58
RDX: ffff888023dd8000 RSI: ffffffff817b2e65 RDI: 0000000000000001
RBP: ffff8880452588e8 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 00000000ffffffff
R13: 0000000000000000 R14: 000000000000000c R15: ffff8880452588f0
FS: 0000000000000000(0000) GS:ffff8880979e1000(0063) knlGS:0000000056e7e440
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00000000fff37d80 CR3: 0000000066ad9000 CR4: 0000000000352ef0
Call Trace:
rate_control_send_low+0x52a/0x810 net/mac80211/rate.c:429
rate_control_get_rate+0x1be/0x5e0 net/mac80211/rate.c:943
ieee80211_beacon_get_finish+0x467/0x670 net/mac80211/tx.c:5360
__ieee80211_beacon_get+0xc56/0x1e40 net/mac80211/tx.c:5663
ieee80211_beacon_get_tim+0xa6/0x280 net/mac80211/tx.c:5774
ieee80211_beacon_get include/net/mac80211.h:5667 [inline]
mac80211_hwsim_beacon_tx+0x4dc/0xa40 drivers/net/wireless/virtual/mac80211_hwsim.c:2355
__iterate_interfaces+0x2e5/0x650 net/mac80211/util.c:761
ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 net/mac80211/util.c:797
mac80211_hwsim_beacon+0x105/0x1b0 drivers/net/wireless/virtual/mac80211_hwsim.c:2389
__run_hrtimer kernel/time/hrtimer.c:1777 [inline]
__hrtimer_run_queues+0x202/0xad0 kernel/time/hrtimer.c:1841
hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1858
handle_softirqs+0x219/0x8e0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1052
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 kernel/locking/spinlock.c:194
Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 26 f1 32 f6 48 89 df e8 0e 45 33 f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 c5 4f 23 f6 65 8b 05 7e 45 3e 08 85 c0 74 16 5b
RSP: 0018:ffffc9000322fb90 EFLAGS: 00000246
RAX: 0000000000000006 RBX: ffff88807ffd7180 RCX: 0000000000000006
RDX: 0000000000000000 RSI: ffffffff8db0011e RDI: ffffffff8bf1e7c0
RBP: 0000000000000293 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff908363d7 R11: ffff88807ffd6d18 R12: ffff88807ffd6b80
R13: 0000000000000009 R14: ffff88807ffd7178 R15: 000000000000003f
free_frozen_page_commit+0x7d8/0x1320 mm/page_alloc.c:2868
__free_frozen_pages+0x7fd/0x1160 mm/page_alloc.c:2934
discard_slab mm/slub.c:3310 [inline]
__put_partials+0x130/0x170 mm/slub.c:3857
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4d/0x120 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x195/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:352
kasan_slab_alloc include/linux/kasan.h:252 [inline]
slab_post_alloc_hook mm/slub.c:4955 [inline]
slab_alloc_node mm/slub.c:5265 [inline]
kmem_cache_alloc_noprof+0x250/0x6e0 mm/slub.c:5272
getname_flags.part.0+0x4c/0x550 fs/namei.c:146
getname_flags+0x93/0xf0 include/linux/audit.h:345
user_path_at+0x24/0x60 fs/namei.c:3214
ksys_umount fs/namespace.c:2061 [inline]
__do_sys_umount fs/namespace.c:2069 [inline]
__se_sys_umount fs/namespace.c:2067 [inline]
__ia32_sys_umount+0x109/0x190 fs/namespace.c:2067
do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
__do_fast_syscall_32+0x7c/0x300 arch/x86/entry/syscall_32.c:306
do_fast_syscall_32+0x32/0x80 arch/x86/entry/syscall_32.c:331
entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf704d579
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000fff37658 EFLAGS: 00000292 ORIG_RAX: 0000000000000034
RAX: ffffffffffffffda RBX: 00000000fff38794 RCX: 0000000000000009
RDX: 00000000f73e5ff4 RSI: 00000000f7236ae8 RDI: 00000000fff38794
RBP: 00000000000001dd R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
----------------
Code disassembly (best guess):
0: f5 cmc
1: 53 push %rbx
2: 48 8b 74 24 10 mov 0x10(%rsp),%rsi
7: 48 89 fb mov %rdi,%rbx
a: 48 83 c7 18 add $0x18,%rdi
e: e8 26 f1 32 f6 call 0xf632f139
13: 48 89 df mov %rbx,%rdi
16: e8 0e 45 33 f6 call 0xf6334529
1b: f7 c5 00 02 00 00 test $0x200,%ebp
21: 75 23 jne 0x46
23: 9c pushf
24: 58 pop %rax
25: f6 c4 02 test $0x2,%ah
28: 75 37 jne 0x61
* 2a: bf 01 00 00 00 mov $0x1,%edi <-- trapping instruction
2f: e8 c5 4f 23 f6 call 0xf6234ff9
34: 65 8b 05 7e 45 3e 08 mov %gs:0x83e457e(%rip),%eax # 0x83e45b9
3b: 85 c0 test %eax,%eax
3d: 74 16 je 0x55
3f: 5b pop %rbx