------------[ cut here ]------------
intf 08:02:11:00:00:01 [link=0]: bad STA 00:00:00:ff:ff:ff bandwidth 20 MHz (0) > channel config 10 MHz (7)
WARNING: drivers/net/wireless/virtual/mac80211_hwsim.c:2693 at mac80211_hwsim_sta_rc_update+0x5db/0x840 drivers/net/wireless/virtual/mac80211_hwsim.c:2693, CPU#2: kworker/u32:6/484
Modules linked in:
CPU: 2 UID: 0 PID: 484 Comm: kworker/u32:6 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: events_unbound cfg80211_wiphy_work
RIP: 0010:mac80211_hwsim_sta_rc_update+0x5fd/0x840 drivers/net/wireless/virtual/mac80211_hwsim.c:2693
Code: 00 48 8d 3d b5 73 bf 09 48 8b 4c 24 10 48 8b 44 24 20 89 da 44 8b 89 c0 01 00 00 55 48 8d b0 72 05 00 00 41 57 44 8b 44 24 14 <67> 48 0f b9 3a 58 5a e9 3c fc ff ff e8 52 0a e2 fa e8 5d 62 6a 04
RSP: 0018:ffffc9000358f8f0 EFLAGS: 00010246
RAX: ffff888028132ad0 RBX: 0000000000000000 RCX: ffff888021494ec0
RDX: 0000000000000000 RSI: ffff888028133042 RDI: ffffffff90e66090
RBP: 0000000000000007 R08: 0000000000000014 R09: 0000000000000000
R10: 0000000000000007 R11: 0000000000000000 R12: dffffc0000000000
R13: ffff888021495090 R14: ffff888036053140 R15: 000000000000000a
FS:  0000000000000000(0000) GS:ffff8880d6538000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb5061860c0 CR3: 000000002e3b8000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 mac80211_hwsim_sta_add+0xc9/0x290 drivers/net/wireless/virtual/mac80211_hwsim.c:2713
 drv_sta_add net/mac80211/driver-ops.h:470 [inline]
 drv_sta_state+0x887/0x1960 net/mac80211/driver-ops.c:155
 sta_info_insert_drv_state net/mac80211/sta_info.c:836 [inline]
 sta_info_insert_finish net/mac80211/sta_info.c:944 [inline]
 sta_info_insert_rcu+0x170b/0x2fa0 net/mac80211/sta_info.c:1021
 ieee80211_ocb_finish_sta net/mac80211/ocb.c:105 [inline]
 ieee80211_ocb_work+0x34d/0x650 net/mac80211/ocb.c:139
 ieee80211_iface_work+0x431/0x13d0 net/mac80211/iface.c:1832
 cfg80211_wiphy_work+0x446/0x5c0 net/wireless/core.c:440
 process_one_work+0xa23/0x19a0 kernel/workqueue.c:3276
 process_scheduled_works kernel/workqueue.c:3359 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3440
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
----------------
Code disassembly (best guess):
   0:	00 48 8d             	add    %cl,-0x73(%rax)
   3:	3d b5 73 bf 09       	cmp    $0x9bf73b5,%eax
   8:	48 8b 4c 24 10       	mov    0x10(%rsp),%rcx
   d:	48 8b 44 24 20       	mov    0x20(%rsp),%rax
  12:	89 da                	mov    %ebx,%edx
  14:	44 8b 89 c0 01 00 00 	mov    0x1c0(%rcx),%r9d
  1b:	55                   	push   %rbp
  1c:	48 8d b0 72 05 00 00 	lea    0x572(%rax),%rsi
  23:	41 57                	push   %r15
  25:	44 8b 44 24 14       	mov    0x14(%rsp),%r8d
* 2a:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2f:	58                   	pop    %rax
  30:	5a                   	pop    %rdx
  31:	e9 3c fc ff ff       	jmp    0xfffffc72
  36:	e8 52 0a e2 fa       	call   0xfae20a8d
  3b:	e8 5d 62 6a 04       	call   0x46a629d