icmp: detected local route for 172.20.20.170 during ICMP sending, src 172.20.20.40
------------[ cut here ]------------
WARNING: CPU: 0 PID: 20972 at net/mac80211/tx.c:4944 __ieee80211_beacon_update_cntdwn net/mac80211/tx.c:4944 [inline]
WARNING: CPU: 0 PID: 20972 at net/mac80211/tx.c:4944 __ieee80211_beacon_get+0x1233/0x1600 net/mac80211/tx.c:5345
Modules linked in:
CPU: 0 PID: 20972 Comm: kworker/u4:14 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Workqueue: bat_events batadv_nc_worker
RIP: 0010:__ieee80211_beacon_update_cntdwn net/mac80211/tx.c:4944 [inline]
RIP: 0010:__ieee80211_beacon_get+0x1233/0x1600 net/mac80211/tx.c:5345
Code: 24 4c 89 e7 e8 8e f7 09 f8 45 31 f6 4c 8b bc 24 a0 00 00 00 e9 7a fe ff ff e8 89 57 d1 f7 0f 0b e9 f6 f7 ff ff e8 7d 57 d1 f7 <0f> 0b e9 48 fb ff ff e8 71 57 d1 f7 48 c7 c7 90 ef fa 8d 4c 89 e6
RSP: 0018:ffffc90000007a30 EFLAGS: 00010246
RAX: ffffffff89b11dd3 RBX: ffffffff89b10bd6 RCX: ffff888026f31dc0
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffff888026f31dc0 R09: 0000000000000003
R10: 0000000000000007 R11: 0000000000000100 R12: ffff88807c6a6228
R13: dffffc0000000000 R14: ffff88807c6a6760 R15: ffff88802747f024
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00002000002fd030 CR3: 00000000297fc000 CR4: 00000000003506f0
Call Trace:
ieee80211_beacon_get_tim+0x63/0x4e0 net/mac80211/tx.c:5472
ieee80211_beacon_get include/net/mac80211.h:5335 [inline]
mac80211_hwsim_beacon_tx+0x21c/0xae0 drivers/net/wireless/mac80211_hwsim.c:2091
__iterate_interfaces+0x243/0x500 net/mac80211/util.c:788
ieee80211_iterate_active_interfaces_atomic+0xd7/0x170 net/mac80211/util.c:824
mac80211_hwsim_beacon+0xb7/0x1b0 drivers/net/wireless/mac80211_hwsim.c:2147
__run_hrtimer kernel/time/hrtimer.c:1747 [inline]
__hrtimer_run_queues+0x54a/0xd50 kernel/time/hrtimer.c:1811
hrtimer_run_softirq+0x183/0x2a0 kernel/time/hrtimer.c:1828
handle_softirqs+0x2a1/0x930 kernel/softirq.c:596
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:409 [inline]
RIP: 0010:batadv_nc_worker+0x183/0x600 net/batman-adv/network-coding.c:719
Code: 19 03 00 00 48 c7 c2 00 02 ae 8b e8 07 cb 6d f7 48 89 e8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 ef e8 51 5e dc f7 48 8b 6d 00 <48> 85 ed 0f 94 c0 48 81 c5 38 fe ff ff 0f 94 c1 08 c1 74 07 e8 f4
RSP: 0018:ffffc900127d7be0 EFLAGS: 00000246
RAX: 1ffff11009035858 RBX: 0000000000000001 RCX: ffff888026f31dc0
RDX: 0000000000000000 RSI: ffffffff8adf1180 RDI: ffffffff8adf1140
RBP: 0000000000000000 R08: dffffc0000000000 R09: 1ffffffff215f248
R10: dffffc0000000000 R11: fffffbfff215f249 R12: dffffc0000000000
R13: ffffffff89f7228e R14: ffff8880553d0c80 R15: 0000000000000058
process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292
worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
----------------
Code disassembly (best guess):
0: 19 03 sbb %eax,(%rbx)
2: 00 00 add %al,(%rax)
4: 48 c7 c2 00 02 ae 8b mov $0xffffffff8bae0200,%rdx
b: e8 07 cb 6d f7 call 0xf76dcb17
10: 48 89 e8 mov %rbp,%rax
13: 48 c1 e8 03 shr $0x3,%rax
17: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1)
1c: 74 08 je 0x26
1e: 48 89 ef mov %rbp,%rdi
21: e8 51 5e dc f7 call 0xf7dc5e77
26: 48 8b 6d 00 mov 0x0(%rbp),%rbp
* 2a: 48 85 ed test %rbp,%rbp <-- trapping instruction
2d: 0f 94 c0 sete %al
30: 48 81 c5 38 fe ff ff add $0xfffffffffffffe38,%rbp
37: 0f 94 c1 sete %cl
3a: 08 c1 or %al,%cl
3c: 74 07 je 0x45
3e: e8 .byte 0xe8
3f: f4 hlt