------------[ cut here ]------------
WARNING: CPU: 0 PID: 5314 at kernel/kcov.c:871 kcov_remote_start+0x5a2/0x7e0 kernel/kcov.c:871
Modules linked in:
CPU: 0 UID: 0 PID: 5314 Comm: kworker/0:7 Not tainted 6.11.0-rc2-syzkaller-00027-g6a0e38264012 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Workqueue: events nsim_dev_trap_report_work
RIP: 0010:kcov_remote_start+0x5a2/0x7e0 kernel/kcov.c:871
Code: 24 00 00 00 00 9c 8f 04 24 f7 04 24 00 02 00 00 0f 85 a6 01 00 00 41 f7 c6 00 02 00 00 0f 84 93 fa ff ff fb e9 8d fa ff ff 90 <0f> 0b 90 e8 96 d2 19 0a 89 c0 48 c7 c7 c8 d4 02 00 48 03 3c c5 40
RSP: 0018:ffffc90000007090 EFLAGS: 00010002
RAX: 0000000000010104 RBX: ffff888023f81e00 RCX: 0000000000000002
RDX: dffffc0000000000 RSI: ffffffff8beae6e0 RDI: ffffffff8c3f8b40
RBP: 0100000000000004 R08: ffffffff934ee877 R09: 1ffffffff269dd0e
R10: dffffc0000000000 R11: fffffbfff269dd0f R12: ffffffff81937ffe
R13: ffff88802d50b500 R14: 0000000000000006 R15: ffff8880b922d4c8
FS:  0000000000000000(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002009c000 CR3: 0000000067b7e000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 00000000872c9164 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 kcov_remote_start_usb include/linux/kcov.h:55 [inline]
 kcov_remote_start_usb_softirq include/linux/kcov.h:89 [inline]
 __usb_hcd_giveback_urb+0x405/0x6e0 drivers/usb/core/hcd.c:1649
 dummy_timer+0x830/0x45a0 drivers/usb/gadget/udc/dummy_hcd.c:1987
 __run_hrtimer kernel/time/hrtimer.c:1689 [inline]
 __hrtimer_run_queues+0x59b/0xd50 kernel/time/hrtimer.c:1753
 hrtimer_interrupt+0x396/0x990 kernel/time/hrtimer.c:1815
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline]
 __sysvec_apic_timer_interrupt+0x110/0x3f0 arch/x86/kernel/apic/apic.c:1049
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0x52/0xc0 arch/x86/kernel/apic/apic.c:1043
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:native_apic_msr_write+0x18/0x50 arch/x86/include/asm/apic.h:205
Code: 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 81 ff cf 00 00 00 7f 0c 83 ff 20 74 2a 83 ff 30 74 25 eb 10 <81> ff d0 00 00 00 74 1b 81 ff e0 00 00 00 74 13 c1 ef 04 81 c7 00
RSP: 0018:ffffc90000007838 EFLAGS: 00000216
RAX: ffffffff8133fe25 RBX: 0000000000000200 RCX: 0000000000040000
RDX: ffffc900020f1000 RSI: 00000000000000f6 RDI: 00000000000003f0
RBP: 0000000000000000 R08: ffffffff8133fe0e R09: 1ffff92000000ef4
R10: dffffc0000000000 R11: fffff52000000ef5 R12: ffffc90009f8d058
R13: ffffc90009f8d000 R14: 2c1008001f8bfbff R15: 0000000000000020
 __apic_send_IPI_self arch/x86/include/asm/apic.h:460 [inline]
 arch_irq_work_raise+0x6f/0x80 arch/x86/kernel/irq_work.c:31
 irq_work_queue+0xa7/0x150 kernel/irq_work.c:124
 ____bpf_ringbuf_submit kernel/bpf/ringbuf.c:519 [inline]
 bpf_ringbuf_submit+0x111/0x170 kernel/bpf/ringbuf.c:517
 bpf_prog_bdf419da41ba2d36+0x4e/0x52
 bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline]
 __bpf_prog_run include/linux/filter.h:691 [inline]
 bpf_prog_run include/linux/filter.h:698 [inline]
 __bpf_trace_run kernel/trace/bpf_trace.c:2406 [inline]
 bpf_trace_run3+0x33a/0x5a0 kernel/trace/bpf_trace.c:2448
 trace_kmem_cache_free include/trace/events/kmem.h:114 [inline]
 kmem_cache_free+0x2a9/0x350 mm/slub.c:4547
 ieee80211_rx_list+0x2d1a/0x3780
 ieee80211_rx_napi+0x18a/0x3c0 net/mac80211/rx.c:5485
 ieee80211_rx include/net/mac80211.h:5124 [inline]
 ieee80211_handle_queued_frames+0xe7/0x1e0 net/mac80211/main.c:439
 tasklet_action_common+0x321/0x4d0 kernel/softirq.c:785
 handle_softirqs+0x2c4/0x970 kernel/softirq.c:554
 do_softirq+0x11b/0x1e0 kernel/softirq.c:455
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x1bb/0x200 kernel/softirq.c:382
 spin_unlock_bh include/linux/spinlock.h:396 [inline]
 nsim_dev_trap_report drivers/net/netdevsim/dev.c:820 [inline]
 nsim_dev_trap_report_work+0x75d/0xaa0 drivers/net/netdevsim/dev.c:850
 process_one_work kernel/workqueue.c:3231 [inline]
 process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312
 worker_thread+0x86d/0xd40 kernel/workqueue.c:3390
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
----------------
Code disassembly (best guess):
   0:	66 90                	xchg   %ax,%ax
   2:	90                   	nop
   3:	90                   	nop
   4:	90                   	nop
   5:	90                   	nop
   6:	90                   	nop
   7:	90                   	nop
   8:	90                   	nop
   9:	90                   	nop
   a:	90                   	nop
   b:	90                   	nop
   c:	90                   	nop
   d:	90                   	nop
   e:	90                   	nop
   f:	90                   	nop
  10:	90                   	nop
  11:	90                   	nop
  12:	f3 0f 1e fa          	endbr64
  16:	81 ff cf 00 00 00    	cmp    $0xcf,%edi
  1c:	7f 0c                	jg     0x2a
  1e:	83 ff 20             	cmp    $0x20,%edi
  21:	74 2a                	je     0x4d
  23:	83 ff 30             	cmp    $0x30,%edi
  26:	74 25                	je     0x4d
  28:	eb 10                	jmp    0x3a
* 2a:	81 ff d0 00 00 00    	cmp    $0xd0,%edi <-- trapping instruction
  30:	74 1b                	je     0x4d
  32:	81 ff e0 00 00 00    	cmp    $0xe0,%edi
  38:	74 13                	je     0x4d
  3a:	c1 ef 04             	shr    $0x4,%edi
  3d:	81                   	.byte 0x81
  3e:	c7                   	.byte 0xc7