------------[ cut here ]------------
WARNING: CPU: 0 PID: 13728 at net/mac80211/rx.c:4946 ieee80211_rx_list+0x18ef/0x2760 net/mac80211/rx.c:4946
Modules linked in:
CPU: 0 PID: 13728 Comm: kworker/0:0 Not tainted 5.18.0-syzkaller-12136-g02f4afebf8a5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events nsim_dev_trap_report_work
RIP: 0010:ieee80211_rx_list+0x18ef/0x2760 net/mac80211/rx.c:4946
Code: 00 00 31 ff 89 ee e8 30 0e b1 f8 85 ed 0f 85 19 02 00 00 e8 e3 11 b1 f8 4c 89 e7 e8 9b 70 83 fe e9 af eb ff ff e8 d1 11 b1 f8 <0f> 0b e9 46 ec ff ff e8 c5 11 b1 f8 4c 89 ea 48 b8 00 00 00 00 00
RSP: 0018:ffffc90000007c90 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888058993368 RCX: 0000000000000100
RDX: ffff888025240000 RSI: ffffffff88c9727f RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffff8880266e83c0
R13: 0000000000000000 R14: 0000000000000000 R15: ffff888058990de0
FS:  0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f869bf089e2 CR3: 0000000054b30000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 ieee80211_rx_napi+0xdb/0x3d0 net/mac80211/rx.c:5044
 ieee80211_rx include/net/mac80211.h:4679 [inline]
 ieee80211_tasklet_handler+0xd4/0x130 net/mac80211/main.c:235
 tasklet_action_common.constprop.0+0x201/0x2e0 kernel/softirq.c:797
 __do_softirq+0x29b/0x9c2 kernel/softirq.c:571
 invoke_softirq kernel/softirq.c:445 [inline]
 __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1106
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:__schedule+0xa08/0x4b30 kernel/sched/core.c:6310
Code: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 60 39 00 00 4c 89 ff 4d 89 65 10 4c 89 e6 e8 d0 44 88 f7 48 89 c7 e8 b8 64 da f7 <48> 8b b5 00 ff ff ff 48 b8 00 00 00 00 00 fc ff df 48 c7 04 06 00
RSP: 0018:ffffc9000ae97a90 EFLAGS: 00000206
RAX: 00000000002dedf3 RBX: 0000000000000001 RCX: 1ffffffff20dba4e
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc9000ae97bc0 R08: 0000000000000001 R09: ffffffff906829b7
R10: 0000000000000001 R11: ffff8880b9a3aa98 R12: ffff8880b9a3a980
R13: ffff8880b9a39ec0 R14: 0000000000000000 R15: ffff888025240000
 preempt_schedule_common+0x45/0xc0 kernel/sched/core.c:6596
 preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:35
 __raw_spin_unlock include/linux/spinlock_api_smp.h:143 [inline]
 _raw_spin_unlock+0x36/0x40 kernel/locking/spinlock.c:186
 spin_unlock include/linux/spinlock.h:389 [inline]
 nsim_dev_trap_report drivers/net/netdevsim/dev.c:817 [inline]
 nsim_dev_trap_report_work+0x88b/0xba0 drivers/net/netdevsim/dev.c:840
 process_one_work+0x996/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
 </TASK>
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	df 48 89             	fisttps -0x77(%rax)
   3:	fa                   	cli
   4:	48 c1 ea 03          	shr    $0x3,%rdx
   8:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
   c:	0f 85 60 39 00 00    	jne    0x3972
  12:	4c 89 ff             	mov    %r15,%rdi
  15:	4d 89 65 10          	mov    %r12,0x10(%r13)
  19:	4c 89 e6             	mov    %r12,%rsi
  1c:	e8 d0 44 88 f7       	callq  0xf78844f1
  21:	48 89 c7             	mov    %rax,%rdi
  24:	e8 b8 64 da f7       	callq  0xf7da64e1
* 29:	48 8b b5 00 ff ff ff 	mov    -0x100(%rbp),%rsi <-- trapping instruction
  30:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  37:	fc ff df
  3a:	48                   	rex.W
  3b:	c7                   	.byte 0xc7
  3c:	04 06                	add    $0x6,%al