------------[ cut here ]------------
WARNING: CPU: 0 PID: 8 at net/core/gen_stats.c:157 gnet_stats_add_basic+0x4d/0x2a0 net/core/gen_stats.c:157
Modules linked in:
CPU: 0 PID: 8 Comm: kworker/u4:0 Not tainted 5.15.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: phy12 ieee80211_iface_work
RIP: 0010:gnet_stats_add_basic+0x4d/0x2a0 net/core/gen_stats.c:157
Code: 0f 84 69 01 00 00 e8 52 a1 59 fa 31 ff 65 8b 2d b9 ab e4 78 81 e5 00 01 ff 00 89 ee e8 7c a8 59 fa 85 ed 74 10 e8 33 a1 59 fa <0f> 0b 4d 85 f6 0f 84 70 01 00 00 49 c7 c7 e4 ae 6e 8d bd ff ff ff
RSP: 0018:ffffc90000007b98 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff88802a0b0320 RCX: 0000000000000100
RDX: ffff888010e45580 RSI: ffffffff871d445d RDI: 0000000000000003
RBP: 0000000000000100 R08: 0000000000000000 R09: 0000000000000001
R10: ffffffff871d45d0 R11: 0000000000000000 R12: ffff88804955d208
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5a7fb2a004 CR3: 0000000040990000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 est_fetch_counters+0xc3/0x160 net/core/gen_estimator.c:69
 est_timer+0x92/0x730 net/core/gen_estimator.c:83
 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421
 expire_timers kernel/time/timer.c:1466 [inline]
 __run_timers.part.0+0x675/0xa20 kernel/time/timer.c:1734
 __run_timers kernel/time/timer.c:1715 [inline]
 run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1747
 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558
 invoke_softirq kernel/softirq.c:432 [inline]
 __irq_exit_rcu+0x123/0x180 kernel/softirq.c:636
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:648
 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097
 </IRQ>
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:is_kfence_address include/linux/kfence.h:58 [inline]
RIP: 0010:kasan_unpoison+0x7/0x70 mm/kasan/shadow.c:131
Code: 00 00 00 48 89 f0 83 e0 07 74 14 48 ba 00 00 00 00 00 fc ff df 48 01 f7 48 c1 ef 03 88 04 17 c3 0f 1f 00 48 8b 05 19 83 75 09 <48> 89 fa 55 48 89 f5 53 48 89 fb 48 29 c2 48 81 fa ff ff 1f 00 77
RSP: 0018:ffffc90000cd7328 EFLAGS: 00000296
RAX: ffff88823bc00000 RBX: ffff8880782f1480 RCX: 0000000000000001
RDX: 0000000000000001 RSI: 0000000000000040 RDI: ffff8880782f1480
RBP: 0000000000000001 R08: 0000000000000001 R09: ffffc90000cd7688
R10: fffff5200019af12 R11: 0000000000000000 R12: ffff888010c41640
R13: 0000000000000a20 R14: 0000000000000028 R15: 0000000000000a20
 __kasan_slab_alloc+0x4a/0xb0 mm/kasan/common.c:463
 kasan_slab_alloc include/linux/kasan.h:254 [inline]
 slab_post_alloc_hook mm/slab.h:519 [inline]
 slab_alloc_node mm/slub.c:3206 [inline]
 slab_alloc mm/slub.c:3214 [inline]
 __kmalloc+0x1e7/0x320 mm/slub.c:4387
 kmalloc include/linux/slab.h:596 [inline]
 ieee802_11_parse_elems_crc+0x121/0xfe0 net/mac80211/util.c:1477
 ieee802_11_parse_elems net/mac80211/ieee80211_i.h:2207 [inline]
 ieee80211_rx_mgmt_probe_beacon+0x187/0x17c0 net/mac80211/ibss.c:1605
 ieee80211_ibss_rx_queued_mgmt+0xd37/0x1610 net/mac80211/ibss.c:1635
 ieee80211_iface_process_skb net/mac80211/iface.c:1439 [inline]
 ieee80211_iface_work+0xa65/0xd00 net/mac80211/iface.c:1493
 process_one_work+0x9bf/0x16b0 kernel/workqueue.c:2297
 worker_thread+0x658/0x11f0 kernel/workqueue.c:2444
 kthread+0x3e5/0x4d0 kernel/kthread.c:319
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
----------------
Code disassembly (best guess):
   0:	00 00                	add    %al,(%rax)
   2:	00 48 89             	add    %cl,-0x77(%rax)
   5:	f0 83 e0 07          	lock and $0x7,%eax
   9:	74 14                	je     0x1f
   b:	48 ba 00 00 00 00 00 	movabs $0xdffffc0000000000,%rdx
  12:	fc ff df
  15:	48 01 f7             	add    %rsi,%rdi
  18:	48 c1 ef 03          	shr    $0x3,%rdi
  1c:	88 04 17             	mov    %al,(%rdi,%rdx,1)
  1f:	c3                   	retq
  20:	0f 1f 00             	nopl   (%rax)
  23:	48 8b 05 19 83 75 09 	mov    0x9758319(%rip),%rax        # 0x9758343
* 2a:	48 89 fa             	mov    %rdi,%rdx <-- trapping instruction
  2d:	55                   	push   %rbp
  2e:	48 89 f5             	mov    %rsi,%rbp
  31:	53                   	push   %rbx
  32:	48 89 fb             	mov    %rdi,%rbx
  35:	48 29 c2             	sub    %rax,%rdx
  38:	48 81 fa ff ff 1f 00 	cmp    $0x1fffff,%rdx
  3f:	77                   	.byte 0x77