crash log on mt76

<6>[77516.589964] TCP: request_sock_TCP: Possible SYN flooding on port 53. Sending cookies.  Check SNMP counters.
<6>[435601.789126] TCP: request_sock_TCP: Possible SYN flooding on port 5000. Sending cookies.  Check SNMP counters.
<6>[515791.155397] wlan1: Ignoring VHT IE from 18:1d:ea:24:2d:18 due to invalid rx_mcs_map
<6>[585519.774988] ralink_soc_eth 1e100000.ethernet eth0: port 4 link down
<6>[585524.470291] ralink_soc_eth 1e100000.ethernet eth0: port 4 link up
<6>[588088.155055] ralink_soc_eth 1e100000.ethernet eth0: port 4 link down
<6>[588098.065554] ralink_soc_eth 1e100000.ethernet eth0: port 4 link up
<4>[595972.888265] ------------[ cut here ]------------
<4>[595972.893085] WARNING: CPU: 0 PID: 2644 at target-mipsel_24kc_musl/linux-ramips_mt7621/mt76-2020-11-22-20201122/mt7603/mac.c:206 mt7603_filter_tx+0x16c/0x174 [mt7603e]
<4>[595972.907988] Modules linked in: ksmbd qcserial pppoe ppp_async option cdc_mbim usb_wwan sierra_net sierra rndis_host qmi_wwan pptp pppox ppp_mppe ppp_generic mt76x2e mt76x2_common mt76x02_lib mt7603e mt76 mac80211 ipt_REJECT huawei_cdc_ncm cfg80211 cdc_ncm cdc_ether xt_time xt_tcpudp xt_tcpmss xt_statistic xt_state xt_socket xt_recent xt_quota xt_pkttype xt_physdev xt_owner xt_nat xt_multiport xt_mark xt_mac xt_limit xt_length xt_iprange xt_ipp2p xt_iface xt_hl xt_helper xt_hashlimit xt_esp xt_ecn xt_dscp xt_conntrack xt_connmark xt_connlimit xt_connbytes xt_comment xt_addrtype xt_TPROXY xt_TCPMSS xt_REDIRECT xt_NETMAP xt_MASQUERADE xt_LOG xt_IPMARK xt_HL xt_DSCP xt_CT xt_CLASSIFY wireguard usbserial usbnet usblp ts_fsm ts_bm slhc sch_cake r8152 nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject_bridge nft_reject nft_redir nft_quota nft_objref nft_numgen nft_meta_bridge nft_log nft_limit nft_hash nft_fwd_netdev nft_dup_netdev nft_ct nft_counter nf_tproxy_ipv6 nf_tproxy_ipv4
<4>[595972.908299]  nf_tables_set nf_tables nf_socket_ipv6 nf_socket_ipv4 nf_reject_ipv4 nf_nat_tftp nf_nat_snmp_basic nf_nat_sip nf_nat_rtsp nf_nat_pptp nf_nat_irc nf_nat_h323 nf_nat_ftp nf_nat_amanda nf_log_ipv4 nf_dup_netdev nf_conntrack_tftp nf_conntrack_snmp nf_conntrack_sip nf_conntrack_rtsp nf_conntrack_rtcache nf_conntrack_pptp nf_conntrack_netlink nf_conntrack_irc nf_conntrack_h323 nf_conntrack_ftp nf_conntrack_broadcast ts_kmp nf_conntrack_amanda nf_conncount macvlan iptable_raw iptable_nat iptable_mangle iptable_filter ipt_ah ipt_ECN ipheth ip_tables crc_ccitt compat_xtables compat cdc_wdm br_netfilter asn1_decoder natflow natcap fuse tcp_bbr sch_tbf sch_ingress sch_htb sch_hfsc em_u32 cls_u32 cls_tcindex cls_route cls_matchall cls_fw cls_flow cls_basic act_skbedit act_mirred ledtrig_usbport ledtrig_heartbeat xt_set ip_set_list_set ip_set_hash_netportnet ip_set_hash_netport ip_set_hash_netnet ip_set_hash_netiface ip_set_hash_net ip_set_hash_mac ip_set_hash_ipportnet
<4>[595972.995253]  ip_set_hash_ipportip ip_set_hash_ipport ip_set_hash_ipmark ip_set_hash_ip ip_set_bitmap_port ip_set_bitmap_ipmac ip_set_bitmap_ip ip_set nfnetlink ip6table_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip6t_NPT ip6t_rt ip6t_mh ip6t_ipv6header ip6t_hbh ip6t_frag ip6t_eui64 ip6t_ah nf_log_ipv6 nf_log_common ip6table_mangle ip6table_filter ip6_tables ip6t_REJECT x_tables nf_reject_ipv6 msdos ip6_gre ip_gre gre ifb ip6_udp_tunnel udp_tunnel sit ip6_tunnel tunnel6 tunnel4 ip_tunnel tun vfat fat autofs4 nls_utf8 nls_iso8859_1 nls_cp437 sha512_generic sha256_generic libsha256 sha1_generic seqiv jitterentropy_rng drbg md5 md4 hmac ghash_generic gf128mul gcm ecb des_generic libdes ctr cmac ccm arc4 uas usb_storage leds_gpio xhci_plat_hcd xhci_pci xhci_mtk xhci_hcd ohci_platform ohci_hcd softdog fsl_mph_dr_of ehci_platform ehci_fsl sd_mod scsi_mod ehci_hcd gpio_button_hotplug ext4 mbcache jbd2 exfat usbcore nls_base usb_common mii crc32c_generic
<4>[595973.165887] CPU: 0 PID: 2644 Comm: hostapd Not tainted 5.4.80 #0
<4>[595973.171970] Stack : 00000001 80072e18 80660000 8065c998 806c0000 8065c960 8065bac4 8dc799cc
<4>[595973.180388]         80810000 8ff60e54 806a4c23 805f0c84 00000000 00000001 8dc79970 653ab3f9
<4>[595973.188794]         00000000 00000000 80850000 00000000 30232030 00000170 35206465 382e342e
<4>[595973.197199]         00000000 000073d4 00000000 68203a6d 80000000 806c0000 00000000 8e05453c
<4>[595973.205607]         00000009 00000005 00000005 8e060000 00000000 80302cc0 00000000 80810000
<4>[595973.214015]         ...
<4>[595973.216534] Call Trace:
<4>[595973.219085] [<8000b6fc>] show_stack+0x30/0x100
<4>[595973.223605] [<8053a214>] dump_stack+0xa4/0xdc
<4>[595973.228044] [<8002bcfc>] __warn+0xc0/0x10c
<4>[595973.232208] [<8002bda4>] warn_slowpath_fmt+0x5c/0xac
<4>[595973.237264] [<8e05453c>] mt7603_filter_tx+0x16c/0x174 [mt7603e]
<4>[595973.243250] [<8e0519dc>] mt7603_sta_remove+0x94/0xfc [mt7603e]
<4>[595973.249163] [<8e1929c0>] __mt76_sta_remove+0x78/0xec [mt76]
<4>[595973.254804] [<8e192b0c>] mt76_sta_state+0xd8/0x1e4 [mt76]
<4>[595973.260410] [<8e109bb0>] sta_set_sinfo+0xf5c/0xfdc [mac80211]
<4>[595973.266478] ---[ end trace 6abfa81079a03cab ]---
<1>[607348.334962] BUG: Bad page state in process kworker/u9:3  pfn:0e2a8
<4>[607348.341263] page:80a12500 refcount:-1 mapcount:0 mapping:00000000 index:0x0
<4>[607348.348326] flags: 0x0()
<4>[607348.350957] raw: 00000000 00000100 00000122 00000000 00000000 00000000 ffffffff ffffffff
<4>[607348.359090] page dumped because: nonzero _refcount
<4>[607348.363938] Modules linked in: ksmbd qcserial pppoe ppp_async option cdc_mbim usb_wwan sierra_net sierra rndis_host qmi_wwan pptp pppox ppp_mppe ppp_generic mt76x2e mt76x2_common mt76x02_lib mt7603e mt76 mac80211 ipt_REJECT huawei_cdc_ncm cfg80211 cdc_ncm cdc_ether xt_time xt_tcpudp xt_tcpmss xt_statistic xt_state xt_socket xt_recent xt_quota xt_pkttype xt_physdev xt_owner xt_nat xt_multiport xt_mark xt_mac xt_limit xt_length xt_iprange xt_ipp2p xt_iface xt_hl xt_helper xt_hashlimit xt_esp xt_ecn xt_dscp xt_conntrack xt_connmark xt_connlimit xt_connbytes xt_comment xt_addrtype xt_TPROXY xt_TCPMSS xt_REDIRECT xt_NETMAP xt_MASQUERADE xt_LOG xt_IPMARK xt_HL xt_DSCP xt_CT xt_CLASSIFY wireguard usbserial usbnet usblp ts_fsm ts_bm slhc sch_cake r8152 nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject_bridge nft_reject nft_redir nft_quota nft_objref nft_numgen nft_meta_bridge nft_log nft_limit nft_hash nft_fwd_netdev nft_dup_netdev nft_ct nft_counter nf_tproxy_ipv6 nf_tproxy_ipv4
<4>[607348.364136]  nf_tables_set nf_tables nf_socket_ipv6 nf_socket_ipv4 nf_reject_ipv4 nf_nat_tftp nf_nat_snmp_basic nf_nat_sip nf_nat_rtsp nf_nat_pptp nf_nat_irc nf_nat_h323 nf_nat_ftp nf_nat_amanda nf_log_ipv4 nf_dup_netdev nf_conntrack_tftp nf_conntrack_snmp nf_conntrack_sip nf_conntrack_rtsp nf_conntrack_rtcache nf_conntrack_pptp nf_conntrack_netlink nf_conntrack_irc nf_conntrack_h323 nf_conntrack_ftp nf_conntrack_broadcast ts_kmp nf_conntrack_amanda nf_conncount macvlan iptable_raw iptable_nat iptable_mangle iptable_filter ipt_ah ipt_ECN ipheth ip_tables crc_ccitt compat_xtables compat cdc_wdm br_netfilter asn1_decoder natflow natcap fuse tcp_bbr sch_tbf sch_ingress sch_htb sch_hfsc em_u32 cls_u32 cls_tcindex cls_route cls_matchall cls_fw cls_flow cls_basic act_skbedit act_mirred ledtrig_usbport ledtrig_heartbeat xt_set ip_set_list_set ip_set_hash_netportnet ip_set_hash_netport ip_set_hash_netnet ip_set_hash_netiface ip_set_hash_net ip_set_hash_mac ip_set_hash_ipportnet
<4>[607348.450800]  ip_set_hash_ipportip ip_set_hash_ipport ip_set_hash_ipmark ip_set_hash_ip ip_set_bitmap_port ip_set_bitmap_ipmac ip_set_bitmap_ip ip_set nfnetlink ip6table_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip6t_NPT ip6t_rt ip6t_mh ip6t_ipv6header ip6t_hbh ip6t_frag ip6t_eui64 ip6t_ah nf_log_ipv6 nf_log_common ip6table_mangle ip6table_filter ip6_tables ip6t_REJECT x_tables nf_reject_ipv6 msdos ip6_gre ip_gre gre ifb ip6_udp_tunnel udp_tunnel sit ip6_tunnel tunnel6 tunnel4 ip_tunnel tun vfat fat autofs4 nls_utf8 nls_iso8859_1 nls_cp437 sha512_generic sha256_generic libsha256 sha1_generic seqiv jitterentropy_rng drbg md5 md4 hmac ghash_generic gf128mul gcm ecb des_generic libdes ctr cmac ccm arc4 uas usb_storage leds_gpio xhci_plat_hcd xhci_pci xhci_mtk xhci_hcd ohci_platform ohci_hcd softdog fsl_mph_dr_of ehci_platform ehci_fsl sd_mod scsi_mod ehci_hcd gpio_button_hotplug ext4 mbcache jbd2 exfat usbcore nls_base usb_common mii crc32c_generic
<4>[607348.620908] CPU: 3 PID: 26212 Comm: kworker/u9:3 Tainted: G        W         5.4.80 #0
<4>[607348.628902] Workqueue: napi_workq napi_workfn
<4>[607348.633322] Stack : 805dffbc 8d5e7b44 80660000 806a0000 8d316780 805f0c84 80840000 805f5e88
<4>[607348.641729]         806a0000 806c78c0 00000008 80072fe4 00000003 00000001 8d5e7b00 653ab3f9
<4>[607348.650134]         00000000 00000000 00000000 00000000 0000006e 0000018b 6e203a65 5f697061
<4>[607348.658538]         00000000 0000760a 00000000 616e2071 00000000 806c0000 00000000 80840000
<4>[607348.666943]         805f5e88 806a0000 806c78c0 00000008 00000001 80302cc0 0000000c 8081000c
<4>[607348.675349]         ...
<4>[607348.677871] Call Trace:
<4>[607348.680412] [<8000b6fc>] show_stack+0x30/0x100
<4>[607348.684929] [<8053a214>] dump_stack+0xa4/0xdc
<4>[607348.689375] [<80124398>] bad_page+0x120/0x154
<4>[607348.693801] [<80127450>] get_page_from_freelist+0x52c/0xcb4
<4>[607348.699434] [<801282c8>] __alloc_pages_nodemask+0xf0/0xd00
<4>[607348.704981] [<80129078>] page_frag_alloc+0xb0/0x1a8
<4>[607348.709953] [<8e191190>] mt76_dma_cleanup+0x290/0x1240 [mt76]
<4>[607348.715762] Disabling lock debugging due to kernel taint
<4>[607354.572181] Unhandled kernel unaligned access[#1]:
<4>[607354.577108] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G    B   W         5.4.80 #0
<4>[607354.584484] $ 0   : 00000000 00000001 8e35b160 8fd05000
<4>[607354.589789] $ 4   : 8fd050a4 00000001 da440000 3efce484
<4>[607354.595086] $ 8   : 794bfc3f 96276d22 9a560000 00000000
<4>[607354.600383] $12   : 23fdf918 e3248f1d da36329c 5e0a0000
<4>[607354.605681] $16   : 8e35b160 8fc2a000 8fc2a480 00000f37
<4>[607354.610978] $20   : 8e228c00 8ffead48 8fd02000 8d6f6900
<4>[607354.616274] $24   : 5a400000 25200000                  
<4>[607354.621572] $28   : 80692000 8fc0d9f0 8e228c00 8e138800
<4>[607354.626870] Hi    : 000009d9
<4>[607354.629821] Lo    : ee655000
<4>[607354.632961] epc   : 8e138880 __ieee80211_subif_start_xmit+0x2f8/0xbf0 [mac80211]
<4>[607354.640458] ra    : 8e138800 __ieee80211_subif_start_xmit+0x278/0xbf0 [mac80211]
<4>[607354.647903] Status: 11008403	KERNEL EXL IE 
<4>[607354.652161] Cause : 40800010 (ExcCode 04)
<4>[607354.656235] BadVA : 00000005
<4>[607354.659189] PrId  : 0001992f (MIPS 1004Kc)
<4>[607354.663350] Modules linked in: ksmbd qcserial pppoe ppp_async option cdc_mbim usb_wwan sierra_net sierra rndis_host qmi_wwan pptp pppox ppp_mppe ppp_generic mt76x2e mt76x2_common mt76x02_lib mt7603e mt76 mac80211 ipt_REJECT huawei_cdc_ncm cfg80211 cdc_ncm cdc_ether xt_time xt_tcpudp xt_tcpmss xt_statistic xt_state xt_socket xt_recent xt_quota xt_pkttype xt_physdev xt_owner xt_nat xt_multiport xt_mark xt_mac xt_limit xt_length xt_iprange xt_ipp2p xt_iface xt_hl xt_helper xt_hashlimit xt_esp xt_ecn xt_dscp xt_conntrack xt_connmark xt_connlimit xt_connbytes xt_comment xt_addrtype xt_TPROXY xt_TCPMSS xt_REDIRECT xt_NETMAP xt_MASQUERADE xt_LOG xt_IPMARK xt_HL xt_DSCP xt_CT xt_CLASSIFY wireguard usbserial usbnet usblp ts_fsm ts_bm slhc sch_cake r8152 nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject_bridge nft_reject nft_redir nft_quota nft_objref nft_numgen nft_meta_bridge nft_log nft_limit nft_hash nft_fwd_netdev nft_dup_netdev nft_ct nft_counter nf_tproxy_ipv6 nf_tproxy_ipv4
<4>[607354.663653]  nf_tables_set nf_tables nf_socket_ipv6 nf_socket_ipv4 nf_reject_ipv4 nf_nat_tftp nf_nat_snmp_basic nf_nat_sip nf_nat_rtsp nf_nat_pptp nf_nat_irc nf_nat_h323 nf_nat_ftp nf_nat_amanda nf_log_ipv4 nf_dup_netdev nf_conntrack_tftp nf_conntrack_snmp nf_conntrack_sip nf_conntrack_rtsp nf_conntrack_rtcache nf_conntrack_pptp nf_conntrack_netlink nf_conntrack_irc nf_conntrack_h323 nf_conntrack_ftp nf_conntrack_broadcast ts_kmp nf_conntrack_amanda nf_conncount macvlan iptable_raw iptable_nat iptable_mangle iptable_filter ipt_ah ipt_ECN ipheth ip_tables crc_ccitt compat_xtables compat cdc_wdm br_netfilter asn1_decoder natflow natcap fuse tcp_bbr sch_tbf sch_ingress sch_htb sch_hfsc em_u32 cls_u32 cls_tcindex cls_route cls_matchall cls_fw cls_flow cls_basic act_skbedit act_mirred ledtrig_usbport ledtrig_heartbeat xt_set ip_set_list_set ip_set_hash_netportnet ip_set_hash_netport ip_set_hash_netnet ip_set_hash_netiface ip_set_hash_net ip_set_hash_mac ip_set_hash_ipportnet
<4>[607354.750403]  ip_set_hash_ipportip ip_set_hash_ipport ip_set_hash_ipmark ip_set_hash_ip ip_set_bitmap_port ip_set_bitmap_ipmac ip_set_bitmap_ip ip_set nfnetlink ip6table_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip6t_NPT ip6t_rt ip6t_mh ip6t_ipv6header ip6t_hbh ip6t_frag ip6t_eui64 ip6t_ah nf_log_ipv6 nf_log_common ip6table_mangle ip6table_filter ip6_tables ip6t_REJECT x_tables nf_reject_ipv6 msdos ip6_gre ip_gre gre ifb ip6_udp_tunnel udp_tunnel sit ip6_tunnel tunnel6 tunnel4 ip_tunnel tun vfat fat autofs4 nls_utf8 nls_iso8859_1 nls_cp437 sha512_generic sha256_generic libsha256 sha1_generic seqiv jitterentropy_rng drbg md5 md4 hmac ghash_generic gf128mul gcm ecb des_generic libdes ctr cmac ccm arc4 uas usb_storage leds_gpio xhci_plat_hcd xhci_pci xhci_mtk xhci_hcd ohci_platform ohci_hcd softdog fsl_mph_dr_of ehci_platform ehci_fsl sd_mod scsi_mod ehci_hcd gpio_button_hotplug ext4 mbcache jbd2 exfat usbcore nls_base usb_common mii crc32c_generic
<4>[607354.920629] Process swapper/0 (pid: 0, threadinfo=d0668483, task=d9661f35, tls=00000000)
<4>[607354.928767] Stack : 8e229f0c 00000000 00000002 00000001 00000000 802a5094 00000002 00000020
<4>[607354.937185]         8cb4f800 8e228cac 00000000 8fd050a4 8e35b14c 000009d9 000005ea 00000000
<4>[607354.945603]         00000010 8c6c1068 000005ea 000005ea 8fd02000 0166a2dc 7620e743 2de44193
<4>[607354.954021]         00000000 0000e405 8fc0da58 8fc0da58 00000000 80693dd0 8e228c00 8fc2a480
<4>[607354.962438]         8fd02000 8ddcd400 00600308 00000002 8e35b160 8e35b160 8c6c02e2 8fc2a000
<4>[607354.970857]         ...
<4>[607354.973389] Call Trace:
<4>[607354.976015] [<8e138880>] __ieee80211_subif_start_xmit+0x2f8/0xbf0 [mac80211]
<4>[607354.983215] [<8e1391d4>] ieee80211_subif_start_xmit+0x5c/0x368 [mac80211]
<4>[607354.990129] [<803d9ee8>] dev_hard_start_xmit+0xbc/0x1ac
<4>[607354.995425] [<803da8d0>] __dev_queue_xmit+0x7ec/0x99c
<4>[607355.000624] [<8e4e46cc>] natflow_session_learn+0x2538/0x3f70 [natflow]
<4>[607355.007244] [<8006a174>] __update_load_avg_se+0x1dc/0x498
<4>[607355.012733] [<8005a60c>] enqueue_task_fair+0x22c/0x63c
<4>[607355.017935] Code: 12a0022d  00000000  8ea5009c <94a20004> 14400229  00000000  8ea20054  00401825  afa20048 
<4>[607355.027748] 
<4>[607355.030098] ---[ end trace 6abfa81079a03cac ]---

Start with mt7603/mac.c:206 at mt7603_filter_tx, then follow the mt7603_sta_remove and mt76_dma_cleanup traces in the crash log. Compare these paths with the later __ieee80211_subif_start_xmit unaligned access and determine the triggering sequence. Done means reproducing the failure and preventing the warning, bad page state, and kernel crash.