------------[ cut here ]------------
WARNING: CPU: 1 PID: 12770 at net/mac80211/tx.c:5031 __ieee80211_beacon_update_cntdwn net/mac80211/tx.c:5031 [inline]
WARNING: CPU: 1 PID: 12770 at net/mac80211/tx.c:5031 __ieee80211_beacon_get+0x1233/0x1600 net/mac80211/tx.c:5442
Modules linked in:
CPU: 1 PID: 12770 Comm: syz.5.1618 Not tainted 6.6.102-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:__ieee80211_beacon_update_cntdwn net/mac80211/tx.c:5031 [inline]
RIP: 0010:__ieee80211_beacon_get+0x1233/0x1600 net/mac80211/tx.c:5442
Code: 24 4c 89 e7 e8 fe 37 d5 f7 45 31 f6 4c 8b bc 24 a0 00 00 00 e9 7a fe ff ff e8 89 12 98 f7 0f 0b e9 f6 f7 ff ff e8 7d 12 98 f7 <0f> 0b e9 48 fb ff ff e8 71 12 98 f7 48 c7 c7 c0 00 24 8e 4c 89 e6
RSP: 0018:ffffc900001f0a18 EFLAGS: 00010246
RAX: ffffffff89ed78a3 RBX: ffffffff89ed66a6 RCX: ffff88801877bc00
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffff88801877bc00 R09: 0000000000000003
R10: 0000000000000007 R11: 0000000000000100 R12: ffff888068ef63c0
R13: dffffc0000000000 R14: ffff888068ef68b0 R15: ffff88805f75e824
FS:  00007faf55e046c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000e41030 CR3: 000000002d53a000 CR4: 00000000003506e0
Call Trace:
 <IRQ>
 ieee80211_beacon_get_tim+0xb8/0x560 net/mac80211/tx.c:5569
 ieee80211_beacon_get include/net/mac80211.h:5438 [inline]
 mac80211_hwsim_beacon_tx+0x3c7/0x780 drivers/net/wireless/virtual/mac80211_hwsim.c:2265
 __iterate_interfaces+0x243/0x500 net/mac80211/util.c:766
 ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 net/mac80211/util.c:802
 mac80211_hwsim_beacon+0xbb/0x1b0 drivers/net/wireless/virtual/mac80211_hwsim.c:2295
 __run_hrtimer kernel/time/hrtimer.c:1755 [inline]
 __hrtimer_run_queues+0x51e/0xc40 kernel/time/hrtimer.c:1819
 hrtimer_run_softirq+0x187/0x2b0 kernel/time/hrtimer.c:1836
 handle_softirqs+0x280/0x820 kernel/softirq.c:578
 __do_softirq kernel/softirq.c:612 [inline]
 invoke_softirq kernel/softirq.c:452 [inline]
 __irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:__unix_dgram_recvmsg+0x108/0xd60 net/unix/af_unix.c:-1
Code: e8 6d d0 62 f8 44 89 f8 83 e0 01 75 50 48 89 5c 24 78 44 89 fe 83 e6 40 31 ff e8 53 d0 62 f8 44 89 f8 83 e0 40 4c 89 74 24 28 <4c> 89 6c 24 38 44 89 7c 24 34 75 31 e8 87 cc 62 f8 49 8d 9e 50 04
RSP: 0018:ffffc9000e8bf700 EFLAGS: 00000246

RAX: 0000000000000000 RBX: ffff888078ad6600 RCX: 0000000000000002
RDX: ffff88801877bc00 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc9000e8bf898 R08: ffffc9000e8bf9ff R09: 0000000000000000
R10: ffffc9000e8bf980 R11: fffff52001d17f40 R12: dffffc0000000000
R13: 1ffff92001d17ef0 R14: ffff888024d38800 R15: 0000000000000002
 sock_recvmsg_nosec+0x82/0xd0 net/socket.c:1046
 ____sys_recvmsg+0x49b/0x5b0 net/socket.c:2812
 ___sys_recvmsg+0x1b6/0x510 net/socket.c:2856
 do_recvmmsg+0x360/0x7d0 net/socket.c:2950
 __sys_recvmmsg net/socket.c:3029 [inline]
 __do_sys_recvmmsg net/socket.c:3052 [inline]
 __se_sys_recvmmsg net/socket.c:3045 [inline]
 __x64_sys_recvmmsg+0x191/0x240 net/socket.c:3045
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7faf54f8ebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007faf55e04038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: ffffffffffffffda RBX: 00007faf551b6090 RCX: 00007faf54f8ebe9
RDX: 03fffffffffffeda RSI: 00002000000000c0 RDI: 0000000000000004
RBP: 00007faf55011e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 00007faf551b6128 R14: 00007faf551b6090 R15: 00007ffdf7e2bce8
 </TASK>
----------------
Code disassembly (best guess):
   0:	e8 6d d0 62 f8       	call   0xf862d072
   5:	44 89 f8             	mov    %r15d,%eax
   8:	83 e0 01             	and    $0x1,%eax
   b:	75 50                	jne    0x5d
   d:	48 89 5c 24 78       	mov    %rbx,0x78(%rsp)
  12:	44 89 fe             	mov    %r15d,%esi
  15:	83 e6 40             	and    $0x40,%esi
  18:	31 ff                	xor    %edi,%edi
  1a:	e8 53 d0 62 f8       	call   0xf862d072
  1f:	44 89 f8             	mov    %r15d,%eax
  22:	83 e0 40             	and    $0x40,%eax
  25:	4c 89 74 24 28       	mov    %r14,0x28(%rsp)
* 2a:	4c 89 6c 24 38       	mov    %r13,0x38(%rsp) <-- trapping instruction
  2f:	44 89 7c 24 34       	mov    %r15d,0x34(%rsp)
  34:	75 31                	jne    0x67
  36:	e8 87 cc 62 f8       	call   0xf862ccc2
  3b:	49                   	rex.WB
  3c:	8d                   	.byte 0x8d
  3d:	9e                   	sahf
  3e:	50                   	push   %rax
  3f:	04                   	.byte 0x4