program: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r6 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x8914, &(0x7f0000000100)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x24, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x24}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x8914, &(0x7f0000000200)={'wlan0\x00', 0x1}) sendmsg$NL80211_CMD_JOIN_MESH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x28, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}]}, 0x28}}, 0x0) (async) sendmsg$NL80211_CMD_JOIN_MESH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x28, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}]}, 0x28}}, 0x0) sendmsg$NL80211_CMD_NEW_STATION(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x3c, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_AID={0x6, 0x10, 0x1}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0x1}, @NL80211_ATTR_STA_SUPPORTED_RATES={0x4}]}, 0x3c}}, 0x0) sendmsg$NL80211_CMD_NEW_MPATH(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)={0x34, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x34}}, 0x0) socket$packet(0x11, 0x3, 0x300) (async) r7 = socket$packet(0x11, 0x3, 0x300) bind$packet(r7, &(0x7f00000004c0)={0x11, 0x300, r5, 0x1, 0x0, 0x6, @random="080211000001"}, 0x14) write(r7, &(0x7f0000000500)="0802110000010802110000000800", 0xe) (async) write(r7, &(0x7f0000000500)="0802110000010802110000000800", 0xe) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)={0x3c, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}, @mon_options=[@NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa, 0xe8, @broadcast}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}]]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048800}, 0x200000c0) [ 105.591398][ T5306] Bluetooth: hci0: command tx timeout [ 105.734907][ T5357] ------------[ cut here ]------------ [ 105.734920][ T5357] sp->magic != HWSIM_STA_MAGIC [ 105.734927][ T5357] WARNING: drivers/net/wireless/virtual/mac80211_hwsim_main.c:258 at mac80211_hwsim_tx+0x1d04/0x25b0, CPU#0: syz.0.0/5357 [ 105.744877][ T5357] Modules linked in: [ 105.746646][ T5357] CPU: 0 UID: 0 PID: 5357 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 105.750470][ T5357] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 105.754720][ T5357] RIP: 0010:mac80211_hwsim_tx+0x1d04/0x25b0 [ 105.757076][ T5357] Code: e8 03 42 0f b6 04 20 84 c0 0f 85 0b 08 00 00 45 0f b6 8d 71 08 00 00 4c 89 ee 67 48 0f b9 3a e9 c4 f4 ff ff e8 ad 9f 76 fa 90 <0f> 0b 90 e9 27 f5 ff ff e8 9f 9f 76 fa 90 0f 0b 90 48 8b 7c 24 20 [ 105.765158][ T5357] RSP: 0018:ffffc9000f7d6b60 EFLAGS: 00010293 [ 105.767687][ T5357] RAX: ffffffff875280f3 RBX: 0000000000000000 RCX: ffff88801350a580 [ 105.771122][ T5357] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006d537749 [ 105.774447][ T5357] RBP: ffffc9000f7d6cf0 R08: ffff8880450a850f R09: 0000000000000000 [ 105.777857][ T5357] R10: ffff8880450a8500 R11: ffffffff875263f0 R12: dffffc0000000000 [ 105.781167][ T5357] R13: 00000000ffffffff R14: 0000000000000000 R15: 1ffff92001efadb8 [ 105.784485][ T5357] FS: 00007fe3006ca6c0(0000) GS:ffff88808a9fe000(0000) knlGS:0000000000000000 [ 105.788225][ T5357] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 105.791091][ T5357] CR2: 00007fe3006c9fe8 CR3: 0000000013a26000 CR4: 0000000000352ef0 [ 105.794559][ T5357] Call Trace: [ 105.796142][ T5357] [ 105.797422][ T5357] ? __pfx_mac80211_hwsim_tx+0x10/0x10 [ 105.799752][ T5357] ieee80211_tx_frags+0x3df/0x890 [ 105.802046][ T5357] ? __pfx_ieee80211_tx_frags+0x10/0x10 [ 105.804464][ T5357] __ieee80211_xmit_fast+0xabf/0x2160 [ 105.806677][ T5357] ? __flow_hash_from_keys+0x431/0x6c0 [ 105.808988][ T5357] ? cfg80211_classify8021d+0x67e/0x1220 [ 105.811329][ T5357] ? arch_stack_walk+0xfb/0x150 [ 105.813482][ T5357] ? __pfx___ieee80211_xmit_fast+0x10/0x10 [ 105.815989][ T5357] ? ieee80211_downgrade_queue+0x432/0x5b0 [ 105.818378][ T5357] ? ieee80211_mesh_xmit_fast+0x902/0xe20 [ 105.820701][ T5357] ieee80211_mesh_xmit_fast+0xa6d/0xe20 [ 105.823109][ T5357] ? lock_acquire+0x115/0x350 [ 105.825014][ T5357] ? __pfx_ieee80211_mesh_xmit_fast+0x10/0x10 [ 105.827467][ T5357] ? __ieee80211_subif_start_xmit+0x2c5/0x1840 [ 105.830071][ T5357] __ieee80211_subif_start_xmit+0x663/0x1840 [ 105.832650][ T5357] ? __pfx___ieee80211_subif_start_xmit+0x10/0x10 [ 105.835342][ T5357] ? sock_def_readable+0xae/0x550 [ 105.837454][ T5357] ieee80211_subif_start_xmit+0xee/0x560 [ 105.839777][ T5357] ? __pfx_ieee80211_subif_start_xmit+0x10/0x10 [ 105.842386][ T5357] ? dev_queue_xmit_nit+0x2d/0xac0 [ 105.844539][ T5357] ? dev_queue_xmit_nit+0x95c/0xac0 [ 105.846653][ T5357] ? dev_queue_xmit_nit+0x2d/0xac0 [ 105.848805][ T5357] dev_hard_start_xmit+0x2cd/0x830 [ 105.850958][ T5357] __dev_queue_xmit+0x14d1/0x3920 [ 105.853215][ T5357] ? __dev_queue_xmit+0x29b/0x3920 [ 105.855333][ T5357] ? __might_fault+0xaf/0x130 [ 105.857360][ T5357] ? _copy_from_iter+0x21b/0x1680 [ 105.859454][ T5357] ? __pfx___dev_queue_xmit+0x10/0x10 [ 105.861801][ T5357] ? __pfx__copy_from_iter+0x10/0x10 [ 105.863916][ T5357] ? packet_parse_headers+0x551/0x790 [ 105.866923][ T5357] ? __pfx_packet_parse_headers+0x10/0x10 [ 105.869324][ T5357] ? packet_xmit+0x68/0x330 [ 105.871233][ T5357] ? skb_put+0x112/0x210 [ 105.873165][ T5357] packet_sendmsg+0x406f/0x5330 [ 105.875270][ T5357] ? lock_acquire+0x115/0x350 [ 105.877191][ T5357] ? aa_file_perm+0x18b/0x15f0 [ 105.879464][ T5357] ? __pfx_packet_sendmsg+0x10/0x10 [ 105.881631][ T5357] ? aa_sk_perm+0x6ff/0x8f0 [ 105.883604][ T5357] ? __pfx_aa_sk_perm+0x10/0x10 [ 105.885600][ T5357] ? aa_sock_msg_perm+0x144/0x210 [ 105.887721][ T5357] ? apparmor_socket_sendmsg+0x98/0x360 [ 105.889997][ T5357] ? __pfx_packet_sendmsg+0x10/0x10 [ 105.892281][ T5357] sock_sendmsg_nosec+0x14e/0x190 [ 105.894338][ T5357] sock_write_iter+0x2de/0x3e0 [ 105.896424][ T5357] ? __pfx_sock_write_iter+0x10/0x10 [ 105.898643][ T5357] ? bpf_lsm_file_permission+0x9/0x20 [ 105.902458][ T5357] ? security_file_permission+0x75/0x260 [ 105.904803][ T5357] vfs_write+0x612/0xba0 [ 105.906567][ T5357] ? __pfx_vfs_write+0x10/0x10 [ 105.908549][ T5357] ? __fget_files+0x3a2/0x420 [ 105.910576][ T5357] ? __fget_files+0x2a/0x420 [ 105.912621][ T5357] ? fdget+0x1ac/0x250 [ 105.914368][ T5357] ksys_write+0x150/0x270 [ 105.916122][ T5357] ? __pfx_ksys_write+0x10/0x10 [ 105.918239][ T5357] do_syscall_64+0x166/0x520 [ 105.920299][ T5357] ? trace_irq_disable+0x3b/0x140 [ 105.922560][ T5357] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.925187][ T5357] ? clear_bhb_loop+0x70/0xc0 [ 105.927176][ T5357] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 105.929854][ T5357] RIP: 0033:0x7fe2ff79fb19 [ 105.931951][ T5357] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 105.940014][ T5357] RSP: 002b:00007fe3006c9fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 105.943775][ T5357] RAX: ffffffffffffffda RBX: 00007fe2ffa26180 RCX: 00007fe2ff79fb19 [ 105.947164][ T5357] RDX: 000000000000000e RSI: 0000200000000500 RDI: 0000000000000007 [ 105.950676][ T5357] RBP: 00007fe2ff837b70 R08: 0000000000000000 R09: 0000000000000000 [ 105.954209][ T5357] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 105.957601][ T5357] R13: 00007fe2ffa26218 R14: 00007fe2ffa26180 R15: 00007ffdba2e8fe8 [ 105.961130][ T5357] [ 105.962635][ T5357] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 105.965763][ T5357] CPU: 0 UID: 0 PID: 5357 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 105.969543][ T5357] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 105.973912][ T5357] Call Trace: [ 105.975410][ T5357] [ 105.976738][ T5357] vpanic+0x26f/0x710 [ 105.978390][ T5357] panic+0xc5/0xd0 [ 105.980029][ T5357] ? __pfx_panic+0x10/0x10 [ 105.982004][ T5357] __warn+0x315/0x4c0 [ 105.983686][ T5357] ? mac80211_hwsim_tx+0x1d04/0x25b0 [ 105.986096][ T5357] ? mac80211_hwsim_tx+0x1d04/0x25b0 [ 105.988364][ T5357] __report_bug+0x276/0x570 [ 105.991484][ T5357] ? lock_acquire+0x115/0x350 [ 105.993662][ T5357] ? mac80211_hwsim_tx+0x1d04/0x25b0 [ 105.996022][ T5357] ? __pfx___report_bug+0x10/0x10 [ 105.998283][ T5357] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 106.000811][ T5357] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 106.003346][ T5357] ? stack_depot_save_flags+0x404/0x810 [ 106.005741][ T5357] ? ieee80211_encrypt_tx_skb+0x2fc/0x3f0 [ 106.008233][ T5357] ? mac80211_hwsim_tx+0x1d04/0x25b0 [ 106.010486][ T5357] report_bug+0x16b/0x220 [ 106.012343][ T5357] ? mac80211_hwsim_tx+0x1d04/0x25b0 [ 106.014607][ T5357] ? mac80211_hwsim_tx+0x1d06/0x25b0 [ 106.016864][ T5357] handle_bug+0x9c/0x200 [ 106.018784][ T5357] exc_invalid_op+0x1a/0x50 [ 106.020725][ T5357] asm_exc_invalid_op+0x1a/0x20 [ 106.022862][ T5357] RIP: 0010:mac80211_hwsim_tx+0x1d04/0x25b0 [ 106.025161][ T5357] Code: e8 03 42 0f b6 04 20 84 c0 0f 85 0b 08 00 00 45 0f b6 8d 71 08 00 00 4c 89 ee 67 48 0f b9 3a e9 c4 f4 ff ff e8 ad 9f 76 fa 90 <0f> 0b 90 e9 27 f5 ff ff e8 9f 9f 76 fa 90 0f 0b 90 48 8b 7c 24 20 [ 106.033532][ T5357] RSP: 0018:ffffc9000f7d6b60 EFLAGS: 00010293 [ 106.036177][ T5357] RAX: ffffffff875280f3 RBX: 0000000000000000 RCX: ffff88801350a580 [ 106.039619][ T5357] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006d537749 [ 106.043195][ T5357] RBP: ffffc9000f7d6cf0 R08: ffff8880450a850f R09: 0000000000000000 [ 106.046654][ T5357] R10: ffff8880450a8500 R11: ffffffff875263f0 R12: dffffc0000000000 [ 106.050127][ T5357] R13: 00000000ffffffff R14: 0000000000000000 R15: 1ffff92001efadb8 [ 106.053621][ T5357] ? __pfx_mac80211_hwsim_tx+0x10/0x10 [ 106.056060][ T5357] ? mac80211_hwsim_tx+0x1d03/0x25b0 [ 106.058357][ T5357] ? __pfx_mac80211_hwsim_tx+0x10/0x10 [ 106.060713][ T5357] ieee80211_tx_frags+0x3df/0x890 [ 106.062877][ T5357] ? __pfx_ieee80211_tx_frags+0x10/0x10 [ 106.065274][ T5357] __ieee80211_xmit_fast+0xabf/0x2160 [ 106.067596][ T5357] ? __flow_hash_from_keys+0x431/0x6c0 [ 106.069944][ T5357] ? cfg80211_classify8021d+0x67e/0x1220 [ 106.072342][ T5357] ? arch_stack_walk+0xfb/0x150 [ 106.074514][ T5357] ? __pfx___ieee80211_xmit_fast+0x10/0x10 [ 106.076970][ T5357] ? ieee80211_downgrade_queue+0x432/0x5b0 [ 106.079564][ T5357] ? ieee80211_mesh_xmit_fast+0x902/0xe20 [ 106.081987][ T5357] ieee80211_mesh_xmit_fast+0xa6d/0xe20 [ 106.084408][ T5357] ? lock_acquire+0x115/0x350 [ 106.086406][ T5357] ? __pfx_ieee80211_mesh_xmit_fast+0x10/0x10 [ 106.088994][ T5357] ? __ieee80211_subif_start_xmit+0x2c5/0x1840 [ 106.091698][ T5357] __ieee80211_subif_start_xmit+0x663/0x1840 [ 106.094275][ T5357] ? __pfx___ieee80211_subif_start_xmit+0x10/0x10 [ 106.097107][ T5357] ? sock_def_readable+0xae/0x550 [ 106.099240][ T5357] ieee80211_subif_start_xmit+0xee/0x560 [ 106.101773][ T5357] ? __pfx_ieee80211_subif_start_xmit+0x10/0x10 [ 106.104567][ T5357] ? dev_queue_xmit_nit+0x2d/0xac0 [ 106.106754][ T5357] ? dev_queue_xmit_nit+0x95c/0xac0 [ 106.108966][ T5357] ? dev_queue_xmit_nit+0x2d/0xac0 [ 106.111151][ T5357] dev_hard_start_xmit+0x2cd/0x830 [ 106.113431][ T5357] __dev_queue_xmit+0x14d1/0x3920 [ 106.115564][ T5357] ? __dev_queue_xmit+0x29b/0x3920 [ 106.117782][ T5357] ? __might_fault+0xaf/0x130 [ 106.119793][ T5357] ? _copy_from_iter+0x21b/0x1680 [ 106.121980][ T5357] ? __pfx___dev_queue_xmit+0x10/0x10 [ 106.124330][ T5357] ? __pfx__copy_from_iter+0x10/0x10 [ 106.126591][ T5357] ? packet_parse_headers+0x551/0x790 [ 106.128834][ T5357] ? __pfx_packet_parse_headers+0x10/0x10 [ 106.131279][ T5357] ? packet_xmit+0x68/0x330 [ 106.133265][ T5357] ? skb_put+0x112/0x210 [ 106.135125][ T5357] packet_sendmsg+0x406f/0x5330 [ 106.137217][ T5357] ? lock_acquire+0x115/0x350 [ 106.139257][ T5357] ? aa_file_perm+0x18b/0x15f0 [ 106.141428][ T5357] ? __pfx_packet_sendmsg+0x10/0x10 [ 106.143699][ T5357] ? aa_sk_perm+0x6ff/0x8f0 [ 106.145659][ T5357] ? __pfx_aa_sk_perm+0x10/0x10 [ 106.147732][ T5357] ? aa_sock_msg_perm+0x144/0x210 [ 106.149868][ T5357] ? apparmor_socket_sendmsg+0x98/0x360 [ 106.152278][ T5357] ? __pfx_packet_sendmsg+0x10/0x10 [ 106.154494][ T5357] sock_sendmsg_nosec+0x14e/0x190 [ 106.156649][ T5357] sock_write_iter+0x2de/0x3e0 [ 106.158704][ T5357] ? __pfx_sock_write_iter+0x10/0x10 [ 106.161002][ T5357] ? bpf_lsm_file_permission+0x9/0x20 [ 106.163339][ T5357] ? security_file_permission+0x75/0x260 [ 106.165668][ T5357] vfs_write+0x612/0xba0 [ 106.167449][ T5357] ? __pfx_vfs_write+0x10/0x10 [ 106.169402][ T5357] ? __fget_files+0x3a2/0x420 [ 106.171461][ T5357] ? __fget_files+0x2a/0x420 [ 106.173429][ T5357] ? fdget+0x1ac/0x250 [ 106.175171][ T5357] ksys_write+0x150/0x270 [ 106.176992][ T5357] ? __pfx_ksys_write+0x10/0x10 [ 106.179094][ T5357] do_syscall_64+0x166/0x520 [ 106.181055][ T5357] ? trace_irq_disable+0x3b/0x140 [ 106.183288][ T5357] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.185850][ T5357] ? clear_bhb_loop+0x70/0xc0 [ 106.187907][ T5357] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 106.190551][ T5357] RIP: 0033:0x7fe2ff79fb19 [ 106.192595][ T5357] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 106.200487][ T5357] RSP: 002b:00007fe3006c9fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 106.204020][ T5357] RAX: ffffffffffffffda RBX: 00007fe2ffa26180 RCX: 00007fe2ff79fb19 [ 106.207302][ T5357] RDX: 000000000000000e RSI: 0000200000000500 RDI: 0000000000000007 [ 106.210698][ T5357] RBP: 00007fe2ff837b70 R08: 0000000000000000 R09: 0000000000000000 [ 106.214114][ T5357] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 106.217341][ T5357] R13: 00007fe2ffa26218 R14: 00007fe2ffa26180 R15: 00007ffdba2e8fe8 [ 106.220695][ T5357] [ 106.222679][ T5357] Kernel Offset: disabled [ 106.224582][ T5357] Rebooting in 86400 seconds..