------------[ cut here ]------------
!local->started
WARNING: net/mac80211/rx.c:5601 at ieee80211_rx_list+0x2bd9/0x3b00 net/mac80211/rx.c:5601, CPU#0: syz.6.9983/5754
Modules linked in:
CPU: 0 UID: 0 PID: 5754 Comm: syz.6.9983 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
RIP: 0010:ieee80211_rx_list+0x2bd9/0x3b00 net/mac80211/rx.c:5601
Code: 90 e9 84 e9 ff ff e8 f6 de 68 f6 e9 7a e9 ff ff e8 ec de 68 f6 e9 70 e9 ff ff e8 e2 de 68 f6 e9 66 e9 ff ff e8 d8 de 68 f6 90 <0f> 0b 90 e9 58 e9 ff ff e8 ca de 68 f6 48 c7 44 24 50 00 00 00 00
RSP: 0018:ffffc90000007b40 EFLAGS: 00010246
RAX: ffffffff8b5f3068 RBX: ffff88805ecb175d RCX: ffff8880805a5dc0
RDX: 8000000000000100 RSI: 0000000000000100 RDI: 0000000000000005
RBP: ffffc90000007db0 R08: 0000000000000100 R09: 0000000000000000
R10: 0000000000000002 R11: 8000000000000100 R12: dffffc0000000000
R13: ffff88807bee1a00 R14: ffff88805ecb32a8 R15: ffff88805ecb0fa0
FS:  00007faaa58a86c0(0000) GS:ffff888123abf000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007faaa58a7ff8 CR3: 0000000059ff4000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 ieee80211_rx_napi+0x1ad/0x3d0 net/mac80211/rx.c:5749
 ieee80211_rx include/net/mac80211.h:5449 [inline]
 ieee80211_handle_queued_frames+0xe4/0x1d0 net/mac80211/main.c:452
 tasklet_action_common+0x2d7/0x490 kernel/softirq.c:961
 handle_softirqs+0x226/0x860 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:xas_invalid include/linux/xarray.h:1462 [inline]
RIP: 0010:xas_valid include/linux/xarray.h:1473 [inline]
RIP: 0010:xas_start+0x3d/0x770 lib/xarray.c:186
Code: 00 fc ff df e8 e4 dd e1 f5 4d 8d 6e 18 4d 89 ef 49 c1 ef 03 41 80 3c 2f 00 74 08 4c 89 ef e8 0a be 52 f6 4d 8b 65 00 4c 89 e6 <48> 83 e6 03 31 ff e8 78 e3 e1 f5 4c 89 e3 48 83 e3 03 74 4d bf 02
RSP: 0018:ffffc90004dcfaf8 EFLAGS: 00000246
RAX: ffffffff8be6315c RBX: dffffc0000000000 RCX: ffff8880805a5dc0
RDX: 0000000000000000 RSI: 0000000000000003 RDI: ffffc90004dcfba0
RBP: dffffc0000000000 R08: ffffffff8be6e120 R09: 0000000000000000
R10: ffffc90004dcfbc0 R11: fffff520009b9f7b R12: 0000000000000003
R13: ffffc90004dcfbb8 R14: ffffc90004dcfba0 R15: 1ffff920009b9f77
 xas_load+0x2c/0x5a0 lib/xarray.c:239
 xa_load+0x118/0x210 lib/xarray.c:1622
 memcg_list_lru_allocated mm/list_lru.c:571 [inline]
 memcg_list_lru_alloc+0x75/0xf0 mm/list_lru.c:626
 __memcg_slab_post_alloc_hook+0x3c3/0xd90 mm/memcontrol.c:3632
 memcg_slab_post_alloc_hook mm/slub.c:2517 [inline]
 slab_post_alloc_hook mm/slub.c:4702 [inline]
 slab_alloc_node mm/slub.c:4996 [inline]
 kmem_cache_alloc_lru_noprof+0x351/0x5f0 mm/slub.c:5029
 sock_alloc_inode+0x2c/0x1a0 net/socket.c:330
 alloc_inode+0x6a/0x1b0 fs/inode.c:338
 new_inode_pseudo include/linux/fs.h:3044 [inline]
 sock_alloc net/socket.c:710 [inline]
 __sock_create+0x12d/0x9d0 net/socket.c:1640
 sock_create net/socket.c:1734 [inline]
 __sys_socket_create net/socket.c:1771 [inline]
 __sys_socket+0xd6/0x1b0 net/socket.c:1818
 __do_sys_socket net/socket.c:1832 [inline]
 __se_sys_socket net/socket.c:1830 [inline]
 __x64_sys_socket+0x7a/0x90 net/socket.c:1830
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7faaa499e559
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007faaa58a8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029
RAX: ffffffffffffffda RBX: 00007faaa4c25fa0 RCX: 00007faaa499e559
RDX: 0000000000000010 RSI: 0000000000000003 RDI: 0000000000000010
RBP: 00007faaa4a358b0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007faaa4c26038 R14: 00007faaa4c25fa0 R15: 00007fffe4723eb8
 </TASK>
----------------
Code disassembly (best guess):
   0:	00 fc                	add    %bh,%ah
   2:	ff                   	lcall  (bad)
   3:	df e8                	fucomip %st(0),%st
   5:	e4 dd                	in     $0xdd,%al
   7:	e1 f5                	loope  0xfffffffe
   9:	4d 8d 6e 18          	lea    0x18(%r14),%r13
   d:	4d 89 ef             	mov    %r13,%r15
  10:	49 c1 ef 03          	shr    $0x3,%r15
  14:	41 80 3c 2f 00       	cmpb   $0x0,(%r15,%rbp,1)
  19:	74 08                	je     0x23
  1b:	4c 89 ef             	mov    %r13,%rdi
  1e:	e8 0a be 52 f6       	call   0xf652be2d
  23:	4d 8b 65 00          	mov    0x0(%r13),%r12
  27:	4c 89 e6             	mov    %r12,%rsi
* 2a:	48 83 e6 03          	and    $0x3,%rsi <-- trapping instruction
  2e:	31 ff                	xor    %edi,%edi
  30:	e8 78 e3 e1 f5       	call   0xf5e1e3ad
  35:	4c 89 e3             	mov    %r12,%rbx
  38:	48 83 e3 03          	and    $0x3,%rbx
  3c:	74 4d                	je     0x8b
  3e:	bf                   	.byte 0xbf
  3f:	02                   	.byte 0x2