divide error in mac80211_hwsim_link_info_changed (3)

Status: upstream: reported on 2026/04/27 19:28
Subsystems: wireless
Labels: prio:normal
[Documentation on labels]
Reported-by: syzbot+ca7a2759caaa6cd4e3db@syzkaller.appspotmail.com
First crash: 91d, last: 11d
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision Error
8bb43d09 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ divide error in mac80211_hwsim_link_info_changed (3) 2026/05/31 23:31 2026/05/31 23:31 2026/06/01 00:35 6b4a8443

			
		
05488272 assessment-security 💥 divide error in mac80211_hwsim_link_info_changed (3) 2026/05/15 07:29 2026/05/15 07:29 2026/05/15 07:30 6ccb967e
failed to run ["make" "KERNELVERSION=syzkaller" "KERNELRELEASE=syzkaller" "LOCALVERSION=-syzkaller" "-j" "32" "ARCH=x86_64" "CC=ccache clang" "LD=ld.lld" "O=/app/workdir/cache/build/29b00534402a6e834e...
truncated to first 200 bytes; open job for full error
Discussions (2)
Title Replies (including bot) Last reply
[PATCH wireless] wifi: mac80211: clear beaconing state in ieee80211_do_stop() 3 (3) 2026/07/06 11:50
[syzbot] [wireless?] divide error in mac80211_hwsim_link_info_changed (3) 1 (2) 2026/04/27 20:29
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream divide error in mac80211_hwsim_link_info_changed wireless 2 1 740d 739d 0/29 auto-obsoleted due to no activity on 2024/10/25 21:22
upstream divide error in mac80211_hwsim_link_info_changed (2) wireless 2 12 250d 472d 0/29 auto-obsoleted due to no activity on 2026/02/27 14:54

Sample crash report:
Oops: divide error: 0000 [#1] SMP KASAN NOPTI
CPU: 1 UID: 0 PID: 20372 Comm: kworker/u8:40 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026
Workqueue: events_unbound cfg80211_wiphy_work
RIP: 0010:mac80211_hwsim_link_info_changed+0xca7/0xf00 drivers/net/wireless/virtual/mac80211_hwsim_main.c:2726
Code: 03 80 3c 02 00 0f 85 15 02 00 00 48 8b 44 24 10 31 d2 4c 89 ef 48 8d 04 40 48 c1 e0 05 49 8b b4 07 80 4a 00 00 4c 89 f0 89 f1 <48> f7 f1 b9 05 00 00 00 29 d6 31 d2 48 69 f6 e8 03 00 00 e8 81 32
RSP: 0018:ffffc900060078e0 EFLAGS: 00010246
RAX: 000000005f2d3c86 RBX: 0000000000000200 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88807f957ca8
RBP: ffff88809d23afe8 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff88807f950f40
R13: ffff88807f957ca8 R14: 000000005f2d3c86 R15: ffff88807f953220
FS:  0000000000000000(0000) GS:ffff888123ee8000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200001000000 CR3: 000000004ca52000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 drv_link_info_changed+0x413/0x860 net/mac80211/driver-ops.c:495
 ieee80211_link_info_change_notify+0x24b/0x3c0 net/mac80211/main.c:427
 ieee80211_offchannel_return+0x381/0x580 net/mac80211/offchannel.c:160
 __ieee80211_scan_completed+0x993/0xe30 net/mac80211/scan.c:519
 ieee80211_scan_work+0x472/0x2010 net/mac80211/scan.c:1193
 cfg80211_wiphy_work+0x2b7/0x550 net/wireless/core.c:538
 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
 process_scheduled_works kernel/workqueue.c:3405 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:mac80211_hwsim_link_info_changed+0xca7/0xf00 drivers/net/wireless/virtual/mac80211_hwsim_main.c:2726
Code: 03 80 3c 02 00 0f 85 15 02 00 00 48 8b 44 24 10 31 d2 4c 89 ef 48 8d 04 40 48 c1 e0 05 49 8b b4 07 80 4a 00 00 4c 89 f0 89 f1 <48> f7 f1 b9 05 00 00 00 29 d6 31 d2 48 69 f6 e8 03 00 00 e8 81 32
RSP: 0018:ffffc900060078e0 EFLAGS: 00010246
RAX: 000000005f2d3c86 RBX: 0000000000000200 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88807f957ca8
RBP: ffff88809d23afe8 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff88807f950f40
R13: ffff88807f957ca8 R14: 000000005f2d3c86 R15: ffff88807f953220
FS:  0000000000000000(0000) GS:ffff888123ee8000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200001000000 CR3: 0000000037c4b000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
   0:	03 80 3c 02 00 0f    	add    0xf00023c(%rax),%eax
   6:	85 15 02 00 00 48    	test   %edx,0x48000002(%rip)        # 0x4800000e
   c:	8b 44 24 10          	mov    0x10(%rsp),%eax
  10:	31 d2                	xor    %edx,%edx
  12:	4c 89 ef             	mov    %r13,%rdi
  15:	48 8d 04 40          	lea    (%rax,%rax,2),%rax
  19:	48 c1 e0 05          	shl    $0x5,%rax
  1d:	49 8b b4 07 80 4a 00 	mov    0x4a80(%r15,%rax,1),%rsi
  24:	00
  25:	4c 89 f0             	mov    %r14,%rax
  28:	89 f1                	mov    %esi,%ecx
* 2a:	48 f7 f1             	div    %rcx <-- trapping instruction
  2d:	b9 05 00 00 00       	mov    $0x5,%ecx
  32:	29 d6                	sub    %edx,%esi
  34:	31 d2                	xor    %edx,%edx
  36:	48 69 f6 e8 03 00 00 	imul   $0x3e8,%rsi,%rsi
  3d:	e8                   	.byte 0xe8
  3e:	81                   	.byte 0x81
  3f:	32                   	.byte 0x32

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/07/16 06:26 upstream 58717b2a1365 27a8bd60 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root divide error in mac80211_hwsim_link_info_changed
2026/06/25 18:38 upstream ab9de95c9cf9 432fd51a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 divide error in mac80211_hwsim_link_info_changed
2026/04/27 18:43 upstream 254f49634ee1 0f700595 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 divide error in mac80211_hwsim_link_info_changed
2026/06/30 16:27 net 2a00517db8de 00e8b0fd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce divide error in mac80211_hwsim_link_info_changed
* Struck through repros no longer work on HEAD.