GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
------------[ cut here ]------------
WARNING: CPU: 1 PID: 19904 at net/mac80211/tx.c:5135 __ieee80211_beacon_update_cntdwn net/mac80211/tx.c:5135 [inline]
WARNING: CPU: 1 PID: 19904 at net/mac80211/tx.c:5135 __ieee80211_beacon_get+0x1141/0x1520 net/mac80211/tx.c:5546
Modules linked in:
CPU: 1 PID: 19904 Comm: syz.9.3819 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
RIP: 0010:__ieee80211_beacon_update_cntdwn net/mac80211/tx.c:5135 [inline]
RIP: 0010:__ieee80211_beacon_get+0x1141/0x1520 net/mac80211/tx.c:5546
Code: f7 4c 89 ef e8 90 08 b1 f7 45 31 ed 4c 8b bc 24 a0 00 00 00 e9 7f fe ff ff e8 5b aa 72 f7 0f 0b e9 61 f8 ff ff e8 4f aa 72 f7 <0f> 0b e9 85 fb ff ff e8 43 aa 72 f7 48 c7 c7 a0 f3 66 8f 4c 89 e6
RSP: 0018:ffffc900001f0a18 EFLAGS: 00010246
RAX: ffffffff8a153451 RBX: dffffc0000000000 RCX: ffff88802fbcda00
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffff88802fbcda00 R09: 0000000000000003
R10: 0000000000000007 R11: 0000000000000100 R12: ffff88805df72420
R13: ffff888027e4f824 R14: ffff88805df72910 R15: ffff888027e4f800
FS: 00007f64ee3586c0(0000) GS:ffff8880b8d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00002000001ae030 CR3: 0000000028409000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
ieee80211_beacon_get_tim+0xbf/0x580 net/mac80211/tx.c:5673
ieee80211_beacon_get include/net/mac80211.h:5447 [inline]
mac80211_hwsim_beacon_tx+0x3bd/0x770 drivers/net/wireless/virtual/mac80211_hwsim.c:2271
__iterate_interfaces+0x225/0x4c0 net/mac80211/util.c:766
ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 net/mac80211/util.c:802
mac80211_hwsim_beacon+0xbb/0x1b0 drivers/net/wireless/virtual/mac80211_hwsim.c:2301
__run_hrtimer kernel/time/hrtimer.c:1754 [inline]
__hrtimer_run_queues+0x525/0xc10 kernel/time/hrtimer.c:1818
hrtimer_run_softirq+0x177/0x290 kernel/time/hrtimer.c:1835
handle_softirqs+0x27d/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:85 [inline]
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:102 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:127 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:159 [inline]
RIP: 0010:check_region_inline mm/kasan/generic.c:178 [inline]
RIP: 0010:kasan_check_range+0x85/0x290 mm/kasan/generic.c:187
Code: 01 00 00 00 00 fc ff df 4d 8d 34 19 4d 89 f4 4d 29 dc 49 83 fc 10 7f 29 4d 85 e4 0f 84 3d 01 00 00 4c 89 cb 48 f7 d3 4c 01 fb <41> 80 3b 00 0f 85 8d 01 00 00 49 ff c3 48 ff c3 75 ee e9 1d 01 00
RSP: 0018:ffffc900053a75c8 EFLAGS: 00000286
RAX: 0000000000000001 RBX: ffffffffffffffff RCX: ffffffff8168de57
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8f8dda68
RBP: ffffc900053a7718 R08: ffffffff8f8dda6f R09: 1ffffffff1f1bb4d
R10: dffffc0000000000 R11: fffffbfff1f1bb4d R12: 0000000000000001
R13: ffff88806a02ae80 R14: fffffbfff1f1bb4e R15: 1ffffffff1f1bb4d
instrument_atomic_read include/linux/instrumented.h:68 [inline]
_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
cpumask_test_cpu include/linux/cpumask.h:504 [inline]
cpu_online include/linux/cpumask.h:1082 [inline]
trace_lock_acquire include/trace/events/lock.h:24 [inline]
lock_acquire+0xb7/0x420 kernel/locking/lockdep.c:5761
__raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
unix_dgram_sendmsg+0x96b/0x16e0 net/unix/af_unix.c:2054
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
____sys_sendmsg+0x61b/0x980 net/socket.c:2595
___sys_sendmsg+0x2a6/0x360 net/socket.c:2649
__sys_sendmmsg+0x2ca/0x510 net/socket.c:2735
__do_sys_sendmmsg net/socket.c:2764 [inline]
__se_sys_sendmmsg net/socket.c:2761 [inline]
__x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2761
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f64ed3a8fd9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f64ee358028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00007f64ed625fa0 RCX: 00007f64ed3a8fd9
RDX: 0400000000000041 RSI: 0000200000000380 RDI: 0000000000000007
RBP: 00007f64ed437fed R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f64ed626038 R14: 00007f64ed625fa0 R15: 00007ffc27b6f008
----------------
Code disassembly (best guess):
0: 01 00 add %eax,(%rax)
2: 00 00 add %al,(%rax)
4: 00 fc add %bh,%ah
6: ff lcall (bad)
7: df 4d 8d fisttps -0x73(%rbp)
a: 34 19 xor $0x19,%al
c: 4d 89 f4 mov %r14,%r12
f: 4d 29 dc sub %r11,%r12
12: 49 83 fc 10 cmp $0x10,%r12
16: 7f 29 jg 0x41
18: 4d 85 e4 test %r12,%r12
1b: 0f 84 3d 01 00 00 je 0x15e
21: 4c 89 cb mov %r9,%rbx
24: 48 f7 d3 not %rbx
27: 4c 01 fb add %r15,%rbx
* 2a: 41 80 3b 00 cmpb $0x0,(%r11) <-- trapping instruction
2e: 0f 85 8d 01 00 00 jne 0x1c1
34: 49 ff c3 inc %r11
37: 48 ff c3 inc %rbx
3a: 75 ee jne 0x2a
3c: e9 .byte 0xe9
3d: 1d .byte 0x1d
3e: 01 00 add %eax,(%rax)