------------[ cut here ]------------
WARNING: CPU: 3 PID: 4160 at kernel/time/hrtimer.c:1047 hrtimer_forward+0x1e3/0x260 kernel/time/hrtimer.c:1047
Modules linked in:
CPU: 3 PID: 4160 Comm: syz-executor.2 Not tainted 5.16.0-rc7-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
RIP: 0010:hrtimer_forward+0x1e3/0x260 kernel/time/hrtimer.c:1047
Code: e5 4d 0f 4e ec e8 ed cc 10 00 4c 89 6b 20 e8 e4 cc 10 00 4c 89 f0 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e 41 5f c3 e8 cd cc 10 00 <0f> 0b 45 31 f6 eb dd e8 c1 cc 10 00 4c 89 e0 48 8b 3c 24 48 99 48
RSP: 0018:ffffc900005b8dd0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8880691cf088 RCX: 0000000000000100
RDX: ffff88801bb48000 RSI: ffffffff8166c563 RDI: 0000000000000003
RBP: 00000000061a8000 R08: 0000000000000000 R09: 0000000000000001
R10: ffffffff8166c418 R11: 0000000000000000 R12: 00000000091df21a
R13: 000000353ab440fd R14: 0000000000000001 R15: ffffffff8542bcc0
FS:  0000000000000000(0000) GS:ffff88802cd00000(0063) knlGS:00000000f588fb40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000033a23000 CR3: 0000000020170000 CR4: 0000000000150ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 hrtimer_forward_now include/linux/hrtimer.h:506 [inline]
 mac80211_hwsim_beacon+0x175/0x1c0 drivers/net/wireless/mac80211_hwsim.c:1870
 __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
 __hrtimer_run_queues+0x609/0xe50 kernel/time/hrtimer.c:1749
 hrtimer_run_softirq+0x17b/0x360 kernel/time/hrtimer.c:1766
 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558
 invoke_softirq kernel/softirq.c:432 [inline]
 __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649
 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:finish_task_switch.isra.0+0x323/0xb80 kernel/sched/core.c:4852
Code: 93 5a f3 07 85 c0 75 02 0f 0b 48 85 db 0f 85 25 01 00 00 4c 89 f7 e8 fc f7 ff ff e8 87 3c 2d 00 fb 65 48 8b 1c 25 40 70 02 00 <48> 8d bb 80 15 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1
RSP: 0018:ffffc900246e7d88 EFLAGS: 00000206
RAX: 00000000000012db RBX: ffff88801bb48000 RCX: 1ffffffff1b22571
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc900246e7dd0 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff817dd258 R11: 0000000000000001 R12: ffff88802cd3a7d8
R13: ffff88801aedba00 R14: ffff88802cd39a80 R15: ffff88802cd3a4b8
 context_switch kernel/sched/core.c:4975 [inline]
 __schedule+0xaa2/0x4900 kernel/sched/core.c:6253
 schedule+0xd2/0x260 kernel/sched/core.c:6326
 exit_to_user_mode_loop kernel/entry/common.c:163 [inline]
 exit_to_user_mode_prepare+0x14a/0x290 kernel/entry/common.c:207
 irqentry_exit_to_user_mode+0x5/0x40 kernel/entry/common.c:313
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0023:0xf6e9554b
Code: c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 5d 5a <59> c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 90 58
RSP: 002b:00000000f588f5c4 EFLAGS: 00000296
RAX: 0000000020ffd000 RBX: 0000000020ffd000 RCX: 00000000f6e95549
RDX: 0000000000000000 RSI: 0000000000000011 RDI: 0000000000000004
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000296 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	93                   	xchg   %eax,%ebx
   1:	5a                   	pop    %rdx
   2:	f3 07                	repz (bad)
   4:	85 c0                	test   %eax,%eax
   6:	75 02                	jne    0xa
   8:	0f 0b                	ud2
   a:	48 85 db             	test   %rbx,%rbx
   d:	0f 85 25 01 00 00    	jne    0x138
  13:	4c 89 f7             	mov    %r14,%rdi
  16:	e8 fc f7 ff ff       	callq  0xfffff817
  1b:	e8 87 3c 2d 00       	callq  0x2d3ca7
  20:	fb                   	sti
  21:	65 48 8b 1c 25 40 70 	mov    %gs:0x27040,%rbx
  28:	02 00
* 2a:	48 8d bb 80 15 00 00 	lea    0x1580(%rbx),%rdi <-- trapping instruction
  31:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  38:	fc ff df
  3b:	48 89 fa             	mov    %rdi,%rdx
  3e:	48                   	rex.W
  3f:	c1                   	.byte 0xc1