------------[ cut here ]------------
WARNING: CPU: 1 PID: 21 at net/mac80211/tx.c:4859 __ieee80211_beacon_update_cntdwn net/mac80211/tx.c:4859 [inline]
WARNING: CPU: 1 PID: 21 at net/mac80211/tx.c:4859 __ieee80211_beacon_get+0x172c/0x1f80 net/mac80211/tx.c:5083
Modules linked in:
CPU: 1 PID: 21 Comm: kworker/1:0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Workqueue: events nsim_dev_trap_report_work
RIP: 0010:__ieee80211_beacon_update_cntdwn net/mac80211/tx.c:4859 [inline]
RIP: 0010:__ieee80211_beacon_get+0x172c/0x1f80 net/mac80211/tx.c:5083
Code: f8 0f 0b e9 f1 fa ff ff e8 51 b6 3a f8 0f 0b 4c 8b 74 24 08 e9 36 fe ff ff e8 40 b6 3a f8 0f 0b e9 3c ef ff ff e8 34 b6 3a f8 <0f> 0b e9 b8 f2 ff ff e8 48 d9 6b 00 44 89 e1 80 e1 07 80 c1 03 38
RSP: 0018:ffffc90000dd08c0 EFLAGS: 00010246
RAX: ffffffff893d147c RBX: ffff88805fa08c80 RCX: ffff88813fe79dc0
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000dd0ae8 R08: ffff88813fe79dc0 R09: 0000000000000003
R10: 0000000000000007 R11: 0000000000000100 R12: ffff888023691a00
R13: dffffc0000000000 R14: 0000000000000000 R15: 1ffff920001ba128
FS:  0000000000000000(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f23ebc58000 CR3: 0000000057660000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 ieee80211_beacon_get_tim+0x48/0x840 net/mac80211/tx.c:5202
 ieee80211_beacon_get include/net/mac80211.h:4983 [inline]
 mac80211_hwsim_beacon_tx+0xf4/0x920 drivers/net/wireless/mac80211_hwsim.c:1812
 __iterate_interfaces+0x243/0x500 net/mac80211/util.c:793
 ieee80211_iterate_active_interfaces_atomic+0xb3/0x140 net/mac80211/util.c:829
 mac80211_hwsim_beacon+0x9b/0x180 drivers/net/wireless/mac80211_hwsim.c:1865
 __run_hrtimer kernel/time/hrtimer.c:1690 [inline]
 __hrtimer_run_queues+0x53d/0xc40 kernel/time/hrtimer.c:1754
 hrtimer_run_softirq+0x176/0x240 kernel/time/hrtimer.c:1771
 handle_softirqs+0x328/0x820 kernel/softirq.c:576
 __do_softirq kernel/softirq.c:610 [inline]
 invoke_softirq kernel/softirq.c:450 [inline]
 __irq_exit_rcu+0x12f/0x220 kernel/softirq.c:659
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:preempt_count_add+0x2/0x190 kernel/sched/core.c:5499
Code: e1 07 80 c1 03 38 c1 7c 97 48 8b 3c 24 e8 b6 c0 6a 00 eb 8c e9 f5 fe ff ff 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 41 57 <41> 56 53 49 bf 00 00 00 00 00 fc ff df 48 c7 c0 80 1f 0c 96 48 c1
RSP: 0018:ffffc90000db7628 EFLAGS: 00000202
RAX: 0000000080000001 RBX: ffff888076159000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000001
RBP: 00000000001d2a20 R08: dffffc0000000000 R09: ffffed100ec2b000
R10: fffff940003b0ac7 R11: 1ffffd40003b0ac6 R12: 0000000000000007
R13: 1ffff11027fcf6a9 R14: ffff88813fe7b548 R15: dffffc0000000000
 kmap_atomic include/linux/highmem-internal.h:196 [inline]
 clear_highpage include/linux/highmem.h:180 [inline]
 kernel_init_free_pages+0x51/0xf0 mm/page_alloc.c:1278
 post_alloc_hook+0x106/0x220 mm/page_alloc.c:2416
 prep_new_page mm/page_alloc.c:2426 [inline]
 get_page_from_freelist+0x1b77/0x1c60 mm/page_alloc.c:4192
 __alloc_pages+0x1e1/0x470 mm/page_alloc.c:5487
 alloc_slab_page mm/slub.c:1775 [inline]
 allocate_slab mm/slub.c:1912 [inline]
 new_slab+0xc0/0x4b0 mm/slub.c:1975
 ___slab_alloc+0x81e/0xdf0 mm/slub.c:3008
 __slab_alloc mm/slub.c:3095 [inline]
 slab_alloc_node mm/slub.c:3186 [inline]
 __kmalloc_node_track_caller+0x1fc/0x3a0 mm/slub.c:4958
 kmalloc_reserve net/core/skbuff.c:356 [inline]
 __alloc_skb+0x22c/0x750 net/core/skbuff.c:427
 alloc_skb include/linux/skbuff.h:1162 [inline]
 nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:664 [inline]
 nsim_dev_trap_report drivers/net/netdevsim/dev.c:721 [inline]
 nsim_dev_trap_report_work+0x2a1/0xb40 drivers/net/netdevsim/dev.c:762
 process_one_work+0x863/0x1000 kernel/workqueue.c:2310
 worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
 kthread+0x436/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
----------------
Code disassembly (best guess):
   0:	e1 07                	loope  0x9
   2:	80 c1 03             	add    $0x3,%cl
   5:	38 c1                	cmp    %al,%cl
   7:	7c 97                	jl     0xffffffa0
   9:	48 8b 3c 24          	mov    (%rsp),%rdi
   d:	e8 b6 c0 6a 00       	call   0x6ac0c8
  12:	eb 8c                	jmp    0xffffffa0
  14:	e9 f5 fe ff ff       	jmp    0xffffff0e
  19:	66 2e 0f 1f 84 00 00 	cs nopw 0x0(%rax,%rax,1)
  20:	00 00 00
  23:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  28:	41 57                	push   %r15
* 2a:	41 56                	push   %r14 <-- trapping instruction
  2c:	53                   	push   %rbx
  2d:	49 bf 00 00 00 00 00 	movabs $0xdffffc0000000000,%r15
  34:	fc ff df
  37:	48 c7 c0 80 1f 0c 96 	mov    $0xffffffff960c1f80,%rax
  3e:	48                   	rex.W
  3f:	c1                   	.byte 0xc1