------------[ cut here ]------------
WARNING: CPU: 0 PID: 10 at net/core/gen_stats.c:157 gnet_stats_add_basic+0x4d/0x2a0 net/core/gen_stats.c:157
Modules linked in:
CPU: 0 PID: 10 Comm: kworker/u4:1 Not tainted 5.15.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: bat_events batadv_nc_worker
RIP: 0010:gnet_stats_add_basic+0x4d/0x2a0 net/core/gen_stats.c:157
Code: 0f 84 69 01 00 00 e8 52 a1 59 fa 31 ff 65 8b 2d b9 ab e4 78 81 e5 00 01 ff 00 89 ee e8 7c a8 59 fa 85 ed 74 10 e8 33 a1 59 fa <0f> 0b 4d 85 f6 0f 84 70 01 00 00 49 c7 c7 e4 ae 6e 8d bd ff ff ff
RSP: 0018:ffffc90000007b98 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff88801ba51c50 RCX: 0000000000000100
RDX: ffff888011ef1c80 RSI: ffffffff871d445d RDI: 0000000000000003
RBP: 0000000000000100 R08: 0000000000000000 R09: 0000000000000003
R10: ffffffff871d4454 R11: 1ffffffff1e9c9dc R12: ffff888019d19008
R13: ffff88801ba51c90 R14: 0000607f460918d0 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd74b0ebf25 CR3: 0000000048d72000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 est_fetch_counters+0xc3/0x160 net/core/gen_estimator.c:69
 est_timer+0x92/0x730 net/core/gen_estimator.c:83
 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421
 expire_timers kernel/time/timer.c:1466 [inline]
 __run_timers.part.0+0x675/0xa20 kernel/time/timer.c:1734
 __run_timers kernel/time/timer.c:1715 [inline]
 run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1747
 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558
 invoke_softirq kernel/softirq.c:432 [inline]
 __irq_exit_rcu+0x123/0x180 kernel/softirq.c:636
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:648
 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097
 </IRQ>
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:__local_bh_enable_ip+0xa8/0x120 kernel/softirq.c:390
Code: 1d 8d 8d bb 7e 65 8b 05 86 8d bb 7e a9 00 ff ff 00 74 45 bf 01 00 00 00 e8 75 36 09 00 e8 90 ac 36 00 fb 65 8b 05 68 8d bb 7e <85> c0 74 58 5b 5d c3 65 8b 05 b6 94 bb 7e 85 c0 75 a2 0f 0b eb 9e
RSP: 0018:ffffc90000cf7c08 EFLAGS: 00000202
RAX: 0000000080000000 RBX: 00000000fffffe00 RCX: 1ffffffff1fabb22
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffffff88d54155 R08: 0000000000000001 R09: ffffffff8fd0cab7
R10: 0000000000000001 R11: 0000000000000000 R12: ffff888013fc17a8
R13: ffff888013fc0c80 R14: dffffc0000000000 R15: ffffffff88d543b0
 spin_unlock_bh include/linux/spinlock.h:408 [inline]
 batadv_nc_purge_paths+0x2a5/0x3a0 net/batman-adv/network-coding.c:473
 batadv_nc_worker+0x930/0xfa0 net/batman-adv/network-coding.c:724
 process_one_work+0x9bf/0x16b0 kernel/workqueue.c:2297
 worker_thread+0x658/0x11f0 kernel/workqueue.c:2444
 kthread+0x3e5/0x4d0 kernel/kthread.c:319
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
----------------
Code disassembly (best guess):
   0:	1d 8d 8d bb 7e       	sbb    $0x7ebb8d8d,%eax
   5:	65 8b 05 86 8d bb 7e 	mov    %gs:0x7ebb8d86(%rip),%eax        # 0x7ebb8d92
   c:	a9 00 ff ff 00       	test   $0xffff00,%eax
  11:	74 45                	je     0x58
  13:	bf 01 00 00 00       	mov    $0x1,%edi
  18:	e8 75 36 09 00       	callq  0x93692
  1d:	e8 90 ac 36 00       	callq  0x36acb2
  22:	fb                   	sti
  23:	65 8b 05 68 8d bb 7e 	mov    %gs:0x7ebb8d68(%rip),%eax        # 0x7ebb8d92
* 2a:	85 c0                	test   %eax,%eax <-- trapping instruction
  2c:	74 58                	je     0x86
  2e:	5b                   	pop    %rbx
  2f:	5d                   	pop    %rbp
  30:	c3                   	retq
  31:	65 8b 05 b6 94 bb 7e 	mov    %gs:0x7ebb94b6(%rip),%eax        # 0x7ebb94ee
  38:	85 c0                	test   %eax,%eax
  3a:	75 a2                	jne    0xffffffde
  3c:	0f 0b                	ud2
  3e:	eb 9e                	jmp    0xffffffde