Oops: divide error: 0000 [#1] SMP KASAN NOPTI CPU: 3 UID: 0 PID: 16794 Comm: kworker/u32:3 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Workqueue: events_unbound cfg80211_wiphy_work RIP: 0010:mac80211_hwsim_link_info_changed+0xa1e/0xdc0 drivers/net/wireless/virtual/mac80211_hwsim.c:2556 Code: 80 3c 11 00 0f 85 60 03 00 00 48 8b 4c 24 10 4c 89 ef 48 8d 14 89 48 8b 0c 24 48 c1 e2 04 48 8b b4 11 a0 3f 00 00 31 d2 89 f1 <48> f7 f1 b9 05 00 00 00 29 d6 31 d2 48 69 f6 e8 03 00 00 e8 9a 96 RSP: 0018:ffffc900044cf8e8 EFLAGS: 00010246 RAX: 00063df1e4f073a4 RBX: 0000000000000200 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88806c2e7048 RBP: ffff88805fe3ea28 R08: 0000000000000004 R09: 0000000000029060 R10: 0000000000029060 R11: 0000000000000000 R12: ffff88806c2e0e40 R13: ffff88806c2e7048 R14: 1ffff92000899f22 R15: ffff88806c2e7040 FS: 0000000000000000(0000) GS:ffff8880977c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000f5bb8824 CR3: 00000000503c1000 CR4: 0000000000352ef0 Call Trace: drv_link_info_changed+0x3fc/0x870 net/mac80211/driver-ops.c:491 ieee80211_link_info_change_notify+0x202/0x3f0 net/mac80211/main.c:428 ieee80211_offchannel_return+0x380/0x570 net/mac80211/offchannel.c:160 __ieee80211_scan_completed+0x9ab/0xe40 net/mac80211/scan.c:510 ieee80211_scan_work+0x3f1/0x2030 net/mac80211/scan.c:1184 cfg80211_wiphy_work+0x2c4/0x580 net/wireless/core.c:435 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3236 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x5d7/0x6f0 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:mac80211_hwsim_link_info_changed+0xa1e/0xdc0 drivers/net/wireless/virtual/mac80211_hwsim.c:2556 Code: 80 3c 11 00 0f 85 60 03 00 00 48 8b 4c 24 10 4c 89 ef 48 8d 14 89 48 8b 0c 24 48 c1 e2 04 48 8b b4 11 a0 3f 00 00 31 d2 89 f1 <48> f7 f1 b9 05 00 00 00 29 d6 31 d2 48 69 f6 e8 03 00 00 e8 9a 96 RSP: 0018:ffffc900044cf8e8 EFLAGS: 00010246 RAX: 00063df1e4f073a4 RBX: 0000000000000200 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88806c2e7048 RBP: ffff88805fe3ea28 R08: 0000000000000004 R09: 0000000000029060 R10: 0000000000029060 R11: 0000000000000000 R12: ffff88806c2e0e40 R13: ffff88806c2e7048 R14: 1ffff92000899f22 R15: ffff88806c2e7040 FS: 0000000000000000(0000) GS:ffff8880977c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000f5bb8824 CR3: 00000000503c1000 CR4: 0000000000352ef0 ---------------- Code disassembly (best guess): 0: 80 3c 11 00 cmpb $0x0,(%rcx,%rdx,1) 4: 0f 85 60 03 00 00 jne 0x36a a: 48 8b 4c 24 10 mov 0x10(%rsp),%rcx f: 4c 89 ef mov %r13,%rdi 12: 48 8d 14 89 lea (%rcx,%rcx,4),%rdx 16: 48 8b 0c 24 mov (%rsp),%rcx 1a: 48 c1 e2 04 shl $0x4,%rdx 1e: 48 8b b4 11 a0 3f 00 mov 0x3fa0(%rcx,%rdx,1),%rsi 25: 00 26: 31 d2 xor %edx,%edx 28: 89 f1 mov %esi,%ecx * 2a: 48 f7 f1 div %rcx <-- trapping instruction 2d: b9 05 00 00 00 mov $0x5,%ecx 32: 29 d6 sub %edx,%esi 34: 31 d2 xor %edx,%edx 36: 48 69 f6 e8 03 00 00 imul $0x3e8,%rsi,%rsi 3d: e8 .byte 0xe8 3e: 9a (bad) 3f: 96 xchg %eax,%esi