------------[ cut here ]------------
WARNING: CPU: 0 PID: 5945 at net/mac80211/tx.c:5040 __ieee80211_beacon_update_cntdwn net/mac80211/tx.c:5040 [inline]
WARNING: CPU: 0 PID: 5945 at net/mac80211/tx.c:5040 __ieee80211_beacon_update_cntdwn net/mac80211/tx.c:5035 [inline]
WARNING: CPU: 0 PID: 5945 at net/mac80211/tx.c:5040 __ieee80211_beacon_get+0x14ac/0x16b0 net/mac80211/tx.c:5469
Modules linked in:
CPU: 0 UID: 0 PID: 5945 Comm: kworker/0:3 Not tainted 6.12.0-syzkaller-09567-g7eef7e306d3c #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: events_power_efficient wg_ratelimiter_gc_entries
RIP: 0010:__ieee80211_beacon_update_cntdwn net/mac80211/tx.c:5040 [inline]
RIP: 0010:__ieee80211_beacon_update_cntdwn net/mac80211/tx.c:5035 [inline]
RIP: 0010:__ieee80211_beacon_get+0x14ac/0x16b0 net/mac80211/tx.c:5469
Code: 00 89 df 44 89 e6 e8 03 20 e9 f6 44 38 e3 72 a1 e8 d9 1e e9 f6 48 89 ef e8 f1 22 41 f7 31 ed e9 9c fe ff ff e8 c5 1e e9 f6 90 <0f> 0b 90 e9 86 f6 ff ff 48 89 c6 48 c7 c7 20 7a 2e 90 48 89 04 24
RSP: 0018:ffffc90000007b70 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8aa5a462
RDX: ffff88807934c880 RSI: ffffffff8aa5addb RDI: 0000000000000001
RBP: ffffc90000007c20 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000004 R12: ffff88802134b800
R13: 0000000000000041 R14: ffff888075858d80 R15: ffff88807585a9d8
FS:  0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000203aa030 CR3: 0000000033fbe000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 ieee80211_beacon_get_tim+0xa7/0x280 net/mac80211/tx.c:5596
 ieee80211_beacon_get include/net/mac80211.h:5632 [inline]
 mac80211_hwsim_beacon_tx+0x4ea/0xa00 drivers/net/wireless/virtual/mac80211_hwsim.c:2311
 __iterate_interfaces+0x2e5/0x640 net/mac80211/util.c:775
 ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 net/mac80211/util.c:811
 mac80211_hwsim_beacon+0x105/0x200 drivers/net/wireless/virtual/mac80211_hwsim.c:2345
 __run_hrtimer kernel/time/hrtimer.c:1739 [inline]
 __hrtimer_run_queues+0x20a/0xae0 kernel/time/hrtimer.c:1803
 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1820
 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554
 __do_softirq kernel/softirq.c:588 [inline]
 invoke_softirq kernel/softirq.c:428 [inline]
 __irq_exit_rcu+0x109/0x170 kernel/softirq.c:655
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:671
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:23 [inline]
RIP: 0010:raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline]
RIP: 0010:rcu_is_watching_curr_cpu include/linux/context_tracking.h:128 [inline]
RIP: 0010:rcu_is_watching+0x69/0xc0 kernel/rcu/tree.c:737
Code: 02 00 75 5c 48 03 1c ed a0 2b a8 8d 48 b8 00 00 00 00 00 fc ff df 48 89 da 48 c1 ea 03 0f b6 14 02 48 89 d8 83 e0 07 83 c0 03 <38> d0 7c 04 84 d2 75 24 8b 03 c1 e8 02 83 e0 01 65 ff 0d 88 8b 8f
RSP: 0018:ffffc9000456fb80 EFLAGS: 00000206
RAX: 0000000000000003 RBX: ffff8880b8637f68 RCX: ffffffff816b6969
RDX: 0000000000000000 RSI: ffffffff8bd1d580 RDI: ffffffff8da82ba0
RBP: 0000000000000000 R08: 0000000000000000 R09: fffffbfff20c11c2
R10: ffffffff90608e17 R11: 0000000000000002 R12: ffffffff8f27d438
R13: ffffffff8f27d280 R14: 0000006fa3dd73c3 R15: 00000000000000f4
 trace_lock_release include/trace/events/lock.h:69 [inline]
 lock_release+0x4e2/0x6f0 kernel/locking/lockdep.c:5860
 __raw_spin_unlock include/linux/spinlock_api_smp.h:141 [inline]
 _raw_spin_unlock+0x16/0x50 kernel/locking/spinlock.c:186
 spin_unlock include/linux/spinlock.h:391 [inline]
 wg_ratelimiter_gc_entries+0x2b0/0x520 drivers/net/wireguard/ratelimiter.c:76
 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3229
 process_scheduled_works kernel/workqueue.c:3310 [inline]
 worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
----------------
Code disassembly (best guess):
   0:	02 00                	add    (%rax),%al
   2:	75 5c                	jne    0x60
   4:	48 03 1c ed a0 2b a8 	add    -0x7257d460(,%rbp,8),%rbx
   b:	8d
   c:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  13:	fc ff df
  16:	48 89 da             	mov    %rbx,%rdx
  19:	48 c1 ea 03          	shr    $0x3,%rdx
  1d:	0f b6 14 02          	movzbl (%rdx,%rax,1),%edx
  21:	48 89 d8             	mov    %rbx,%rax
  24:	83 e0 07             	and    $0x7,%eax
  27:	83 c0 03             	add    $0x3,%eax
* 2a:	38 d0                	cmp    %dl,%al <-- trapping instruction
  2c:	7c 04                	jl     0x32
  2e:	84 d2                	test   %dl,%dl
  30:	75 24                	jne    0x56
  32:	8b 03                	mov    (%rbx),%eax
  34:	c1 e8 02             	shr    $0x2,%eax
  37:	83 e0 01             	and    $0x1,%eax
  3a:	65                   	gs
  3b:	ff                   	.byte 0xff
  3c:	0d                   	.byte 0xd
  3d:	88                   	.byte 0x88
  3e:	8b                   	.byte 0x8b
  3f:	8f                   	.byte 0x8f