------------[ cut here ]------------
WARNING: CPU: 1 PID: 126 at net/mac80211/tx.c:4944 __ieee80211_beacon_update_cntdwn net/mac80211/tx.c:4944 [inline]
WARNING: CPU: 1 PID: 126 at net/mac80211/tx.c:4944 __ieee80211_beacon_get+0x1952/0x1f50 net/mac80211/tx.c:5265
Modules linked in:
CPU: 1 PID: 126 Comm: kworker/1:2 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: usb_hub_wq hub_event
RIP: 0010:__ieee80211_beacon_update_cntdwn net/mac80211/tx.c:4944 [inline]
RIP: 0010:__ieee80211_beacon_get+0x1952/0x1f50 net/mac80211/tx.c:5265
Code: ff ff ff e8 40 d3 e3 f7 0f 0b 48 8b 7c 24 20 e8 04 90 7f fe e9 dd e9 ff ff e8 2a d3 e3 f7 0f 0b e9 f1 ee ff ff e8 1e d3 e3 f7 <0f> 0b e9 61 f2 ff ff e8 12 d3 e3 f7 48 c7 c7 f0 73 fa 8d 4c 89 f6
RSP: 0018:ffffc900001e08a0 EFLAGS: 00010246
RAX: ffffffff899d0342 RBX: 0000000000000000 RCX: ffff88801d359dc0
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900001e0aa8 R08: ffff88801d359dc0 R09: 0000000000000003
R10: 0000000000000007 R11: 0000000000000100 R12: 1ffff9200003c12c
R13: dffffc0000000000 R14: ffff88807a526258 R15: ffff888079bce800
FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2f61fff8 CR3: 000000001fb74000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
ieee80211_beacon_get_tim+0x5b/0x4d0 net/mac80211/tx.c:5352
ieee80211_beacon_get include/net/mac80211.h:5264 [inline]
mac80211_hwsim_beacon_tx+0x21c/0xae0 drivers/net/wireless/mac80211_hwsim.c:2091
__iterate_interfaces+0x243/0x500 net/mac80211/util.c:788
ieee80211_iterate_active_interfaces_atomic+0xd7/0x170 net/mac80211/util.c:824
mac80211_hwsim_beacon+0xb7/0x1b0 drivers/net/wireless/mac80211_hwsim.c:2147
__run_hrtimer kernel/time/hrtimer.c:1747 [inline]
__hrtimer_run_queues+0x554/0xd60 kernel/time/hrtimer.c:1811
hrtimer_run_softirq+0x183/0x2a0 kernel/time/hrtimer.c:1828
handle_softirqs+0x2a1/0x920 kernel/softirq.c:596
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x12f/0x220 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:console_emit_next_record+0xab0/0xc90 kernel/printk/printk.c:2786
Code: 86 5e 1a 00 4d 85 ff 75 16 e8 7c 5e 1a 00 eb 15 e8 75 5e 1a 00 e8 10 5a b1 08 4d 85 ff 74 ea e8 66 5e 1a 00 fb 48 8b 5c 24 48 <48> c7 84 24 80 00 00 00 0e 36 e0 45 4a c7 04 2b 00 00 00 00 4a c7
RSP: 0018:ffffc90002de6e60 EFLAGS: 00000283
RAX: ffffffff816677fa RBX: 1ffff920005bcddc RCX: 0000000000100000
RDX: ffffc9001a280000 RSI: 000000000000a3e8 RDI: 000000000000a3e9
RBP: ffffc90002de70a0 R08: dffffc0000000000 R09: fffffbfff215c449
R10: fffffbfff215c449 R11: 1ffffffff215c448 R12: ffffffff8166757d
R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000200
console_flush_all kernel/printk/printk.c:-1 [inline]
console_unlock+0x223/0x630 kernel/printk/printk.c:2906
vprintk_emit+0x489/0x680 kernel/printk/printk.c:2303
dev_vprintk_emit+0x32d/0x3d3 drivers/base/core.c:4933
dev_printk_emit+0xdd/0x11d drivers/base/core.c:4944
_dev_notice+0x107/0x15c drivers/base/core.c:5001
usb_parse_configuration drivers/usb/core/config.c:679 [inline]
usb_get_configuration+0x47a1/0x4ce0 drivers/usb/core/config.c:962
usb_enumerate_device drivers/usb/core/hub.c:2491 [inline]
usb_new_device+0x146/0x1620 drivers/usb/core/hub.c:2629
hub_port_connect drivers/usb/core/hub.c:5517 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5657 [inline]
port_event drivers/usb/core/hub.c:5817 [inline]
hub_event+0x2d5e/0x54e0 drivers/usb/core/hub.c:5899
process_one_work+0x898/0x1160 kernel/workqueue.c:2292
worker_thread+0xaa2/0x1250 kernel/workqueue.c:2439
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
----------------
Code disassembly (best guess):
0: 86 5e 1a xchg %bl,0x1a(%rsi)
3: 00 4d 85 add %cl,-0x7b(%rbp)
6: ff 75 16 push 0x16(%rbp)
9: e8 7c 5e 1a 00 call 0x1a5e8a
e: eb 15 jmp 0x25
10: e8 75 5e 1a 00 call 0x1a5e8a
15: e8 10 5a b1 08 call 0x8b15a2a
1a: 4d 85 ff test %r15,%r15
1d: 74 ea je 0x9
1f: e8 66 5e 1a 00 call 0x1a5e8a
24: fb sti
25: 48 8b 5c 24 48 mov 0x48(%rsp),%rbx
* 2a: 48 c7 84 24 80 00 00 movq $0x45e0360e,0x80(%rsp) <-- trapping instruction
31: 00 0e 36 e0 45
36: 4a c7 04 2b 00 00 00 movq $0x0,(%rbx,%r13,1)
3d: 00
3e: 4a rex.WX
3f: c7 .byte 0xc7