------------[ cut here ]------------
WARNING: CPU: 2 PID: 6077 at net/mac80211/tx.c:5041 __ieee80211_beacon_update_cntdwn net/mac80211/tx.c:5041 [inline]
WARNING: CPU: 2 PID: 6077 at net/mac80211/tx.c:5041 __ieee80211_beacon_update_cntdwn net/mac80211/tx.c:5036 [inline]
WARNING: CPU: 2 PID: 6077 at net/mac80211/tx.c:5041 __ieee80211_beacon_get+0x14f4/0x1720 net/mac80211/tx.c:5470
Modules linked in:
CPU: 2 UID: 0 PID: 6077 Comm: syz-executor138 Not tainted 6.15.0-rc5-syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:__ieee80211_beacon_update_cntdwn net/mac80211/tx.c:5041 [inline]
RIP: 0010:__ieee80211_beacon_update_cntdwn net/mac80211/tx.c:5036 [inline]
RIP: 0010:__ieee80211_beacon_get+0x14f4/0x1720 net/mac80211/tx.c:5470
Code: 24 89 df 89 ee e8 1c da ce f6 40 38 eb 72 a2 e8 f2 df ce f6 4c 89 e7 e8 7a 97 29 f7 45 31 e4 e9 9b fe ff ff e8 dd df ce f6 90 <0f> 0b 90 e9 3e f6 ff ff 48 89 c6 48 c7 c7 40 18 52 90 48 89 44 24
RSP: 0018:ffffc90000648b70 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888034e9a9d0 RCX: ffffffff8aec4951
RDX: ffff888032430000 RSI: ffffffff8aec5313 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffc90000648c28
R13: ffff888030f96c00 R14: 0000000000000041 R15: ffff888034e9a500
FS:  0000555573a4f380(0000) GS:ffff8880d6bdf000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f60fa1960f0 CR3: 0000000031f3a000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 ieee80211_beacon_get_tim+0xa6/0x280 net/mac80211/tx.c:5597
 ieee80211_beacon_get include/net/mac80211.h:5648 [inline]
 mac80211_hwsim_beacon_tx+0x4dc/0xa40 drivers/net/wireless/virtual/mac80211_hwsim.c:2313
 __iterate_interfaces+0x2e2/0x650 net/mac80211/util.c:761
 ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 net/mac80211/util.c:797
 mac80211_hwsim_beacon+0x105/0x200 drivers/net/wireless/virtual/mac80211_hwsim.c:2347
 __run_hrtimer kernel/time/hrtimer.c:1761 [inline]
 __hrtimer_run_queues+0x1ff/0xad0 kernel/time/hrtimer.c:1825
 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1842
 handle_softirqs+0x216/0x8e0 kernel/softirq.c:579
 __do_softirq kernel/softirq.c:613 [inline]
 invoke_softirq kernel/softirq.c:453 [inline]
 __irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_acquire+0x62/0x350 kernel/locking/lockdep.c:5870
Code: fe 0b 12 83 f8 07 0f 87 bc 02 00 00 89 c0 48 0f a3 05 42 f3 ec 0e 0f 82 74 02 00 00 8b 35 da 22 ed 0e 85 f6 0f 85 8d 00 00 00 <48> 8b 44 24 30 65 48 2b 05 19 fe 0b 12 0f 85 c7 02 00 00 48 83 c4
RSP: 0018:ffffc9000170ec28 EFLAGS: 00000206
RAX: 0000000000000046 RBX: ffffffff8e3bf5c0 RCX: 000000002563e4d0
RDX: 0000000000000000 RSI: ffffffff8dbbbc2f RDI: ffffffff8bf48260
RBP: 0000000000000002 R08: c08a65e865887a0a R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 rcu_read_lock include/linux/rcupdate.h:841 [inline]
 class_rcu_constructor include/linux/rcupdate.h:1155 [inline]
 unwind_next_frame+0xd1/0x20a0 arch/x86/kernel/unwind_orc.c:479
 arch_stack_walk+0x94/0x100 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 save_stack+0x160/0x1f0 mm/page_owner.c:156
 __set_page_owner+0x91/0x550 mm/page_owner.c:329
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x181/0x1b0 mm/page_alloc.c:1718
 prep_new_page mm/page_alloc.c:1726 [inline]
 get_page_from_freelist+0x135c/0x3920 mm/page_alloc.c:3688
 __alloc_frozen_pages_noprof+0x263/0x23a0 mm/page_alloc.c:4970
 alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2301
 folio_alloc_mpol_noprof+0x36/0x2f0 mm/mempolicy.c:2320
 shmem_alloc_folio+0x135/0x160 mm/shmem.c:1854
 shmem_alloc_and_add_folio+0x499/0xc20 mm/shmem.c:1893
 shmem_get_folio_gfp+0x687/0x1530 mm/shmem.c:2533
 shmem_fault+0x1fe/0xa30 mm/shmem.c:2734
 __do_fault+0x10a/0x490 mm/memory.c:5098
 do_read_fault mm/memory.c:5518 [inline]
 do_fault mm/memory.c:5652 [inline]
 do_pte_missing+0x1031/0x3fb0 mm/memory.c:4160
 handle_pte_fault mm/memory.c:5997 [inline]
 __handle_mm_fault+0x103d/0x2a40 mm/memory.c:6140
 handle_mm_fault+0x3fe/0xad0 mm/memory.c:6309
 faultin_page mm/gup.c:1193 [inline]
 __get_user_pages+0x771/0x36f0 mm/gup.c:1491
 populate_vma_page_range+0x278/0x3a0 mm/gup.c:1929
 __mm_populate+0x1d8/0x380 mm/gup.c:2032
 mm_populate include/linux/mm.h:3487 [inline]
 vm_mmap_pgoff+0x362/0x450 mm/util.c:584
 ksys_mmap_pgoff+0x7d/0x5c0 mm/mmap.c:607
 __do_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline]
 __se_sys_mmap arch/x86/kernel/sys_x86_64.c:82 [inline]
 __x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:82
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f60fa119e39
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 01 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcb7b42648 EFLAGS: 00000206 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f60fa119e39
RDX: b635773f06ebbeee RSI: 0000000000b36000 RDI: 0000200000000000
RBP: 0000000000000000 R08: ffffffffffffffff R09: 0000000000000000
R10: 0000000000008031 R11: 0000000000000206 R12: 00007ffcb7b4267c
R13: 00007ffcb7b426b0 R14: 00007ffcb7b42690 R15: 0000000000000020
 </TASK>
----------------
Code disassembly (best guess):
   0:	fe 0b                	decb   (%rbx)
   2:	12 83 f8 07 0f 87    	adc    -0x78f0f808(%rbx),%al
   8:	bc 02 00 00 89       	mov    $0x89000002,%esp
   d:	c0 48 0f a3          	rorb   $0xa3,0xf(%rax)
  11:	05 42 f3 ec 0e       	add    $0xeecf342,%eax
  16:	0f 82 74 02 00 00    	jb     0x290
  1c:	8b 35 da 22 ed 0e    	mov    0xeed22da(%rip),%esi        # 0xeed22fc
  22:	85 f6                	test   %esi,%esi
  24:	0f 85 8d 00 00 00    	jne    0xb7
* 2a:	48 8b 44 24 30       	mov    0x30(%rsp),%rax <-- trapping instruction
  2f:	65 48 2b 05 19 fe 0b 	sub    %gs:0x120bfe19(%rip),%rax        # 0x120bfe50
  36:	12
  37:	0f 85 c7 02 00 00    	jne    0x304
  3d:	48                   	rex.W
  3e:	83                   	.byte 0x83
  3f:	c4                   	.byte 0xc4