------------[ cut here ]------------
WARNING: CPU: 0 PID: 9 at net/wireless/scan.c:1621 rb_insert_bss net/wireless/scan.c:1621 [inline]
WARNING: CPU: 0 PID: 9 at net/wireless/scan.c:1621 __cfg80211_bss_update+0x1c91/0x20c0 net/wireless/scan.c:1974
Modules linked in:
CPU: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.10.0-rc7-syzkaller-00266-g4d145e3f830b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: events nsim_dev_trap_report_work
RIP: 0010:rb_insert_bss net/wireless/scan.c:1621 [inline]
RIP: 0010:__cfg80211_bss_update+0x1c91/0x20c0 net/wireless/scan.c:1974
Code: 4c 89 ff e8 71 2e 01 00 45 31 ff 4c 89 f8 48 81 c4 d0 00 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d e9 c0 ea da 00 e8 d0 d1 c0 f6 90 <0f> 0b 90 49 be 00 00 00 00 00 fc ff df e9 b2 fc ff ff e8 b8 d1 c0
RSP: 0018:ffffc90000006f78 EFLAGS: 00010246
RAX: ffffffff8ad55650 RBX: ffff88807f7b0000 RCX: ffff888016eb8000
RDX: 0000000080000302 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff8ad5521a R09: ffffffff8ad61045
R10: 0000000000000002 R11: ffff888016eb8000 R12: ffff88805a564820
R13: ffff8880707d01a0 R14: ffff88807f7b0068 R15: ffff88807f7b0000
FS:  0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000200ed030 CR3: 0000000057f08000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 cfg80211_inform_single_bss_data+0xfd6/0x2360 net/wireless/scan.c:2289
 cfg80211_inform_bss_data+0x3dd/0x5a70 net/wireless/scan.c:3117
 cfg80211_inform_bss_frame_data+0x3bc/0x720 net/wireless/scan.c:3207
 ieee80211_bss_info_update+0x8a7/0xbc0 net/mac80211/scan.c:226
 ieee80211_scan_rx+0x526/0x9c0 net/mac80211/scan.c:340
 __ieee80211_rx_handle_packet net/mac80211/rx.c:5222 [inline]
 ieee80211_rx_list+0x2b00/0x3780 net/mac80211/rx.c:5459
 ieee80211_rx_napi+0x18a/0x3c0 net/mac80211/rx.c:5482
 ieee80211_rx include/net/mac80211.h:5093 [inline]
 ieee80211_handle_queued_frames+0xe7/0x1e0 net/mac80211/main.c:438
 tasklet_action_common+0x323/0x4d0 kernel/softirq.c:785
 handle_softirqs+0x2c6/0x970 kernel/softirq.c:554
 __do_softirq kernel/softirq.c:588 [inline]
 invoke_softirq kernel/softirq.c:428 [inline]
 __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:crng_make_state+0x5dc/0xa80 drivers/char/random.c:373
Code: 1a d4 51 06 e9 01 fd ff ff e8 e0 c3 56 fc e8 8b f2 46 06 48 83 7c 24 28 00 74 87 e8 ce c3 56 fc fb 48 c7 44 24 40 0e 36 e0 45 <48> b8 00 00 00 00 00 fc ff df 48 8b 4c 24 38 c7 04 08 00 00 00 00
RSP: 0018:ffffc900000e77c0 EFLAGS: 00000293
RAX: ffffffff853f6452 RBX: 0000000000000000 RCX: ffff888016eb8000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900000e7970 R08: ffffffff853f63c2 R09: 1ffffffff25f5acd
R10: dffffc0000000000 R11: fffffbfff25f5ace R12: 0000000000000027
R13: 1ffff1101728750e R14: 0000000000000046 R15: ffff8880b943a878
 _get_random_bytes+0xd7/0x2c0 drivers/char/random.c:385
 eth_random_addr include/linux/etherdevice.h:238 [inline]
 nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:755 [inline]
 nsim_dev_trap_report drivers/net/netdevsim/dev.c:805 [inline]
 nsim_dev_trap_report_work+0x301/0xaa0 drivers/net/netdevsim/dev.c:850
 process_one_work kernel/workqueue.c:3248 [inline]
 process_scheduled_works+0xa2e/0x1830 kernel/workqueue.c:3329
 worker_thread+0x86d/0xd50 kernel/workqueue.c:3409
 kthread+0x2f2/0x390 kernel/kthread.c:389
 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
----------------
Code disassembly (best guess), 4 bytes skipped:
   0:	e9 01 fd ff ff       	jmp    0xfffffd06
   5:	e8 e0 c3 56 fc       	call   0xfc56c3ea
   a:	e8 8b f2 46 06       	call   0x646f29a
   f:	48 83 7c 24 28 00    	cmpq   $0x0,0x28(%rsp)
  15:	74 87                	je     0xffffff9e
  17:	e8 ce c3 56 fc       	call   0xfc56c3ea
  1c:	fb                   	sti
  1d:	48 c7 44 24 40 0e 36 	movq   $0x45e0360e,0x40(%rsp)
  24:	e0 45
* 26:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax <-- trapping instruction
  2d:	fc ff df
  30:	48 8b 4c 24 38       	mov    0x38(%rsp),%rcx
  35:	c7 04 08 00 00 00 00 	movl   $0x0,(%rax,%rcx,1)