------------[ cut here ]------------
!local->started
WARNING: net/mac80211/rx.c:5462 at ieee80211_rx_list+0x2918/0x3710 net/mac80211/rx.c:5462, CPU#0: syz.6.6102/25245
Modules linked in:
CPU: 0 UID: 0 PID: 25245 Comm: syz.6.6102 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:ieee80211_rx_list+0x2918/0x3710 net/mac80211/rx.c:5462
Code: 90 e9 70 df ff ff e8 77 22 90 f6 e9 66 df ff ff e8 6d 22 90 f6 e9 5c df ff ff e8 63 22 90 f6 e9 52 df ff ff e8 59 22 90 f6 90 <0f> 0b 90 e9 44 df ff ff e8 4b 22 90 f6 48 c7 44 24 68 00 00 00 00
RSP: 0000:ffffc90000007b20 EFLAGS: 00010246
RAX: ffffffff8b36d0c7 RBX: ffff88803df81665 RCX: ffff888028c98000
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000005
RBP: ffffc90000007d90 R08: ffffffff8b36dfa3 R09: ffffffff8eb5d6e0
R10: 0000000000000002 R11: 0000000000000100 R12: ffff88802b8548c0
R13: dffffc0000000000 R14: ffff88803df83148 R15: ffffffff8b36dfa3
FS:  00007efdfb3ee6c0(0000) GS:ffff888124de1000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffe70 CR3: 0000000023730000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 ieee80211_rx_napi+0x1b1/0x3e0 net/mac80211/rx.c:5602
 ieee80211_rx include/net/mac80211.h:5271 [inline]
 ieee80211_handle_queued_frames+0xe8/0x1e0 net/mac80211/main.c:452
 tasklet_action_common+0x2da/0x4b0 kernel/softirq.c:942
 handle_softirqs+0x22a/0x870 kernel/softirq.c:626
 __do_softirq kernel/softirq.c:660 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xca/0x220 kernel/softirq.c:739
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:756
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1061
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:resched_offsets_ok kernel/sched/core.c:8891 [inline]
RIP: 0010:__might_resched+0xfb/0x4d0 kernel/sched/core.c:8906
Code: ff ff 7f 65 4c 8b 35 6c 38 cd 11 4d 8d a6 c4 04 00 00 4d 89 e7 49 c1 ef 03 41 0f b6 04 2f 84 c0 0f 85 9b 02 00 00 41 8b 04 24 <c1> e0 08 44 01 e8 39 d8 75 48 9c 58 a9 00 02 00 00 74 3f 4d 8d 6e
RSP: 0000:ffffc90003dfe928 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000046
RDX: 0000000000000000 RSI: ffffffff8e4d2edc RDI: ffffffff8c4a8700
RBP: dffffc0000000000 R08: ffffea00015a52f7 R09: 1ffffd40002b4a5e
R10: dffffc0000000000 R11: fffff940002b4a5f R12: ffff888028c984c4
R13: 0000000000000000 R14: ffff888028c98000 R15: 1ffff11005193098
 generic_perform_write+0x652/0x8f0 mm/filemap.c:4353
 shmem_file_write_iter+0xf8/0x120 mm/shmem.c:3466
 __kernel_write_iter+0x41e/0x880 fs/read_write.c:621
 dump_emit_page fs/coredump.c:1299 [inline]
 dump_user_range+0xc19/0x12c0 fs/coredump.c:1373
 elf_core_dump+0x34c2/0x3ad0 fs/binfmt_elf.c:2110
 coredump_write+0x1216/0x1910 fs/coredump.c:1050
 do_coredump fs/coredump.c:1127 [inline]
 vfs_coredump+0x36a9/0x4280 fs/coredump.c:1201
 get_signal+0x1107/0x1330 kernel/signal.c:3021
 arch_do_signal_or_restart+0xbc/0x830 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:98 [inline]
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
 irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:283 [inline]
 irqentry_exit_to_user_mode include/linux/irq-entry-common.h:352 [inline]
 irqentry_exit+0x188/0x700 kernel/entry/common.c:219
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0033:0x7efdfd19c7a1
Code: 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 <c3> 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f
RSP: 002b:fffffffffffffe70 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007efdfd415fa0 RCX: 00007efdfd19c799
RDX: 0000000000000000 RSI: fffffffffffffe70 RDI: 0000000000008000
RBP: 00007efdfd232c99 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 00007efdfd416038 R14: 00007efdfd415fa0 R15: 00007ffc88153908
 </TASK>
----------------
Code disassembly (best guess), 2 bytes skipped:
   0:	7f 65                	jg     0x67
   2:	4c 8b 35 6c 38 cd 11 	mov    0x11cd386c(%rip),%r14        # 0x11cd3875
   9:	4d 8d a6 c4 04 00 00 	lea    0x4c4(%r14),%r12
  10:	4d 89 e7             	mov    %r12,%r15
  13:	49 c1 ef 03          	shr    $0x3,%r15
  17:	41 0f b6 04 2f       	movzbl (%r15,%rbp,1),%eax
  1c:	84 c0                	test   %al,%al
  1e:	0f 85 9b 02 00 00    	jne    0x2bf
  24:	41 8b 04 24          	mov    (%r12),%eax
* 28:	c1 e0 08             	shl    $0x8,%eax <-- trapping instruction
  2b:	44 01 e8             	add    %r13d,%eax
  2e:	39 d8                	cmp    %ebx,%eax
  30:	75 48                	jne    0x7a
  32:	9c                   	pushf
  33:	58                   	pop    %rax
  34:	a9 00 02 00 00       	test   $0x200,%eax
  39:	74 3f                	je     0x7a
  3b:	4d                   	rex.WRB
  3c:	8d                   	.byte 0x8d
  3d:	6e                   	outsb  %ds:(%rsi),(%dx)