program: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0xf0, &(0x7f0000000100)={&(0x7f0000000280)=@newlink={0x20, 0x10, 0x401, 0x0, 0x0, {0x0, 0x48, 0x0, r1, 0x21eae}}, 0x20}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$unix(0x1, 0x2, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010028bd7000fddbdf250700000008000300", @ANYRES32=r5, @ANYBLOB="0c009900ff070000070000001400040073797a6b616c6c6572300000000000000800050006"], 0x44}, 0x1, 0x0, 0x0, 0x81}, 0x24044884) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket$inet_sctp(0x2, 0x1, 0x84) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r9 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r9, &(0x7f0000000640)="000a18000600600000eb5500000b000100aa34745a1945da08e815b218b175e62e90d9c5596d3ef4ddaae57cdcf90884", 0x30, 0x4000000, &(0x7f0000000380)={0x11, 0xe56930649afa540, r8, 0x1, 0xd8, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x14) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = socket$unix(0x1, 0x2, 0x0) r12 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r11, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r10, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="3f00045c87569564f204658306492de811ecf6df256a442c19220756cecc23ec33db9f4f9a423b544361624d11261be4d2936ccabc67bb1df4e46347e190b6961f2a6b16efc8fc0e524f357f45a9ec2f81561d21fdd6098774edf804402452535b77ecf2e599c761b80ec6da82a054f750256317d6b4b40535844444de7af251460da4d492392ae1ed5f4652770ffe88c2668190af01ad87b588d382190b67da3d05094138550abd3f7cae92", @ANYRES16=r12, @ANYBLOB="010028bd7000fddbdf250700000008000300", @ANYRES32=r13, @ANYBLOB="0c009900ff070000700000001400040073797a6b616c6c65723000000000000008000500070000000a0018000303030303030000"], 0x50}, 0x1, 0x0, 0x0, 0x91}, 0x24044884) r14 = socket$unix(0x1, 0x1, 0x0) r15 = socket$kcm(0x11, 0x3, 0x0) write$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1, @le_start_enc={{0x2019, 0x1c}, {0xe8d31eecaf61f67, 0x1, 0x7ff, "5dbe29a9dec03414005534d262617bf2"}}}, 0x20) r16 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r16) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r16, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r14, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r15, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x8e88, r17, 0x3e}, 0x80, &(0x7f00000002c0)=[{&(0x7f0000000080)='\'', 0x14}], 0x1}, 0x4) [ 103.265039][ T5290] Bluetooth: hci0: command tx timeout [ 103.381364][ T5326] mac80211_hwsim hwsim3 wlan1: entered allmulticast mode [ 103.431634][ T5326] ------------[ cut here ]------------ [ 103.434482][ T5326] hwsim_get_chanwidth(bw) > hwsim_get_chanwidth(confbw) [ 103.434500][ T5326] WARNING: drivers/net/wireless/virtual/mac80211_hwsim_main.c:2248 at mac80211_hwsim_tx+0x1ab4/0x2500, CPU#0: syz.0.0/5326 [ 103.444336][ T5326] Modules linked in: [ 103.446956][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.451061][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.456736][ T5326] RIP: 0010:mac80211_hwsim_tx+0x1ab4/0x2500 [ 103.459338][ T5326] Code: c6 05 da 65 07 09 01 48 c7 c7 e0 74 7a 8c be 6b 08 00 00 48 c7 c2 20 76 7a 8c e8 a7 d6 8c fa e9 ff ee ff ff e8 7d eb b0 fa 90 <0f> 0b 90 49 bc 00 00 00 00 00 fc ff df e9 dd fe ff ff e8 65 eb b0 [ 103.467777][ T5326] RSP: 0018:ffffc9000f31efe0 EFLAGS: 00010287 [ 103.470725][ T5326] RAX: ffffffff87158693 RBX: 0000000000000000 RCX: 0000000000100000 [ 103.475735][ T5326] RDX: ffffc90020001000 RSI: 0000000000000226 RDI: 0000000000000227 [ 103.479007][ T5326] RBP: ffffc9000f31f170 R08: ffff88803eb70000 R09: 000000000000000e [ 103.482442][ T5326] R10: 000000000000000d R11: 0000000000000002 R12: 0000000000000014 [ 103.485973][ T5326] R13: ffff8880449dcb70 R14: 00000000000000a0 R15: 0000000000000030 [ 103.489507][ T5326] FS: 00007f1e497ed6c0(0000) GS:ffff88808c815000(0000) knlGS:0000000000000000 [ 103.493899][ T5326] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 103.497340][ T5326] CR2: 0000200000002280 CR3: 00000000438e1000 CR4: 0000000000352ef0 [ 103.501027][ T5326] Call Trace: [ 103.502537][ T5326] [ 103.504042][ T5326] ? do_raw_spin_lock+0x12b/0x2f0 [ 103.506381][ T5326] ? __pfx_mac80211_hwsim_tx+0x10/0x10 [ 103.508729][ T5326] ieee80211_tx_frags+0x3df/0x890 [ 103.511032][ T5326] ? __pfx_ieee80211_tx_frags+0x10/0x10 [ 103.513894][ T5326] __ieee80211_tx+0x267/0x580 [ 103.516924][ T5326] ieee80211_tx+0x312/0x4b0 [ 103.519496][ T5326] ? __pfx_ieee80211_tx+0x10/0x10 [ 103.521673][ T5326] ? ieee80211_xmit+0x2e5/0x3c0 [ 103.523845][ T5326] ieee80211_monitor_start_xmit+0xb33/0x1280 [ 103.526499][ T5326] ? ieee80211_monitor_start_xmit+0x5ea/0x1280 [ 103.529055][ T5326] ? __pfx_ieee80211_monitor_start_xmit+0x10/0x10 [ 103.531821][ T5326] dev_hard_start_xmit+0x2cd/0x830 [ 103.534045][ T5326] __dev_queue_xmit+0x1435/0x37f0 [ 103.536487][ T5326] ? __dev_queue_xmit+0x29b/0x37f0 [ 103.538905][ T5326] ? _copy_from_iter+0x21b/0x1660 [ 103.541517][ T5326] ? skb_set_owner_w+0x263/0x3d0 [ 103.543891][ T5326] ? __pfx___dev_queue_xmit+0x10/0x10 [ 103.546409][ T5326] ? __pfx__copy_from_iter+0x10/0x10 [ 103.549009][ T5326] ? packet_parse_headers+0x4c5/0x7a0 [ 103.551560][ T5326] ? packet_parse_headers+0x571/0x7a0 [ 103.554316][ T5326] ? __pfx_packet_parse_headers+0x10/0x10 [ 103.557583][ T5326] ? packet_xmit+0x68/0x330 [ 103.559984][ T5326] ? skb_put+0x112/0x210 [ 103.561935][ T5326] packet_sendmsg+0x3d95/0x5040 [ 103.564283][ T5326] ? __resched_curr+0x23e/0x530 [ 103.566732][ T5326] ? __lock_acquire+0x683/0x2cf0 [ 103.568950][ T5326] ? __pfx_packet_sendmsg+0x10/0x10 [ 103.571263][ T5326] ? __might_fault+0xaf/0x130 [ 103.574035][ T5326] ? __pfx_aa_sk_perm+0x10/0x10 [ 103.576933][ T5326] ? aa_sock_msg_perm+0xf1/0x1b0 [ 103.579096][ T5326] ? __pfx_packet_sendmsg+0x10/0x10 [ 103.581211][ T5326] sock_sendmsg_nosec+0x13a/0x180 [ 103.583417][ T5326] __sys_sendto+0x408/0x5a0 [ 103.585596][ T5326] ? __pfx___sys_sendto+0x10/0x10 [ 103.587743][ T5326] ? rcu_is_watching+0x15/0xb0 [ 103.589770][ T5326] __x64_sys_sendto+0xde/0x100 [ 103.592071][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.595295][ T5326] do_syscall_64+0x174/0x580 [ 103.597714][ T5326] ? trace_irq_disable+0x3b/0x140 [ 103.599882][ T5326] ? clear_bhb_loop+0x40/0x90 [ 103.601966][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.604609][ T5326] RIP: 0033:0x7f1e4d39ce59 [ 103.606705][ T5326] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.616400][ T5326] RSP: 002b:00007f1e497ecfe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 103.619784][ T5326] RAX: ffffffffffffffda RBX: 00007f1e4d615fa0 RCX: 00007f1e4d39ce59 [ 103.623306][ T5326] RDX: 0000000000000030 RSI: 0000200000000640 RDI: 0000000000000008 [ 103.626860][ T5326] RBP: 00007f1e4d432e6f R08: 0000200000000380 R09: 0000000000000014 [ 103.630345][ T5326] R10: 0000000004000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.634689][ T5326] R13: 00007f1e4d616038 R14: 00007f1e4d615fa0 R15: 00007ffe28fdc068 [ 103.639232][ T5326] [ 103.640744][ T5326] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 103.644006][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 103.647914][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 103.652492][ T5326] Call Trace: [ 103.654050][ T5326] [ 103.655414][ T5326] vpanic+0x56c/0xa60 [ 103.657209][ T5326] ? __pfx__printk+0x10/0x10 [ 103.659205][ T5326] ? __pfx_vpanic+0x10/0x10 [ 103.661149][ T5326] ? is_bpf_text_address+0x292/0x2b0 [ 103.663755][ T5326] ? is_bpf_text_address+0x26/0x2b0 [ 103.666620][ T5326] panic+0xc5/0xd0 [ 103.668611][ T5326] ? __pfx_panic+0x10/0x10 [ 103.671021][ T5326] __warn+0x315/0x4c0 [ 103.672818][ T5326] ? mac80211_hwsim_tx+0x1ab4/0x2500 [ 103.674890][ T5326] ? mac80211_hwsim_tx+0x1ab4/0x2500 [ 103.677033][ T5326] __report_bug+0x331/0x530 [ 103.678825][ T5326] ? mac80211_hwsim_tx+0x1ab4/0x2500 [ 103.680979][ T5326] ? __pfx___report_bug+0x10/0x10 [ 103.683129][ T5326] ? ieee80211_encrypt_tx_skb+0x2fc/0x3f0 [ 103.685934][ T5326] ? __pfx___skb_flow_dissect+0x10/0x10 [ 103.688908][ T5326] ? mac80211_hwsim_tx+0x1ab4/0x2500 [ 103.691202][ T5326] report_bug+0x16a/0x220 [ 103.693138][ T5326] ? mac80211_hwsim_tx+0x1ab4/0x2500 [ 103.695313][ T5326] ? mac80211_hwsim_tx+0x1ab6/0x2500 [ 103.697578][ T5326] handle_bug+0x9c/0x200 [ 103.699422][ T5326] exc_invalid_op+0x1a/0x50 [ 103.701465][ T5326] asm_exc_invalid_op+0x1a/0x20 [ 103.703589][ T5326] RIP: 0010:mac80211_hwsim_tx+0x1ab4/0x2500 [ 103.706449][ T5326] Code: c6 05 da 65 07 09 01 48 c7 c7 e0 74 7a 8c be 6b 08 00 00 48 c7 c2 20 76 7a 8c e8 a7 d6 8c fa e9 ff ee ff ff e8 7d eb b0 fa 90 <0f> 0b 90 49 bc 00 00 00 00 00 fc ff df e9 dd fe ff ff e8 65 eb b0 [ 103.715452][ T5326] RSP: 0018:ffffc9000f31efe0 EFLAGS: 00010287 [ 103.718084][ T5326] RAX: ffffffff87158693 RBX: 0000000000000000 RCX: 0000000000100000 [ 103.721475][ T5326] RDX: ffffc90020001000 RSI: 0000000000000226 RDI: 0000000000000227 [ 103.724807][ T5326] RBP: ffffc9000f31f170 R08: ffff88803eb70000 R09: 000000000000000e [ 103.728817][ T5326] R10: 000000000000000d R11: 0000000000000002 R12: 0000000000000014 [ 103.733193][ T5326] R13: ffff8880449dcb70 R14: 00000000000000a0 R15: 0000000000000030 [ 103.736772][ T5326] ? mac80211_hwsim_tx+0x1ab3/0x2500 [ 103.739016][ T5326] ? do_raw_spin_lock+0x12b/0x2f0 [ 103.741127][ T5326] ? __pfx_mac80211_hwsim_tx+0x10/0x10 [ 103.743490][ T5326] ieee80211_tx_frags+0x3df/0x890 [ 103.745756][ T5326] ? __pfx_ieee80211_tx_frags+0x10/0x10 [ 103.748391][ T5326] __ieee80211_tx+0x267/0x580 [ 103.750700][ T5326] ieee80211_tx+0x312/0x4b0 [ 103.752883][ T5326] ? __pfx_ieee80211_tx+0x10/0x10 [ 103.755061][ T5326] ? ieee80211_xmit+0x2e5/0x3c0 [ 103.757068][ T5326] ieee80211_monitor_start_xmit+0xb33/0x1280 [ 103.759431][ T5326] ? ieee80211_monitor_start_xmit+0x5ea/0x1280 [ 103.762021][ T5326] ? __pfx_ieee80211_monitor_start_xmit+0x10/0x10 [ 103.765365][ T5326] dev_hard_start_xmit+0x2cd/0x830 [ 103.768118][ T5326] __dev_queue_xmit+0x1435/0x37f0 [ 103.770168][ T5326] ? __dev_queue_xmit+0x29b/0x37f0 [ 103.772279][ T5326] ? _copy_from_iter+0x21b/0x1660 [ 103.774352][ T5326] ? skb_set_owner_w+0x263/0x3d0 [ 103.776488][ T5326] ? __pfx___dev_queue_xmit+0x10/0x10 [ 103.778676][ T5326] ? __pfx__copy_from_iter+0x10/0x10 [ 103.780823][ T5326] ? packet_parse_headers+0x4c5/0x7a0 [ 103.783028][ T5326] ? packet_parse_headers+0x571/0x7a0 [ 103.785557][ T5326] ? __pfx_packet_parse_headers+0x10/0x10 [ 103.789156][ T5326] ? packet_xmit+0x68/0x330 [ 103.791657][ T5326] ? skb_put+0x112/0x210 [ 103.793449][ T5326] packet_sendmsg+0x3d95/0x5040 [ 103.795536][ T5326] ? __resched_curr+0x23e/0x530 [ 103.797590][ T5326] ? __lock_acquire+0x683/0x2cf0 [ 103.799710][ T5326] ? __pfx_packet_sendmsg+0x10/0x10 [ 103.801912][ T5326] ? __might_fault+0xaf/0x130 [ 103.803929][ T5326] ? __pfx_aa_sk_perm+0x10/0x10 [ 103.806047][ T5326] ? aa_sock_msg_perm+0xf1/0x1b0 [ 103.808311][ T5326] ? __pfx_packet_sendmsg+0x10/0x10 [ 103.810646][ T5326] sock_sendmsg_nosec+0x13a/0x180 [ 103.813059][ T5326] __sys_sendto+0x408/0x5a0 [ 103.815005][ T5326] ? __pfx___sys_sendto+0x10/0x10 [ 103.817023][ T5326] ? rcu_is_watching+0x15/0xb0 [ 103.818942][ T5326] __x64_sys_sendto+0xde/0x100 [ 103.821078][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.824437][ T5326] do_syscall_64+0x174/0x580 [ 103.826684][ T5326] ? trace_irq_disable+0x3b/0x140 [ 103.828724][ T5326] ? clear_bhb_loop+0x40/0x90 [ 103.830743][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 103.833164][ T5326] RIP: 0033:0x7f1e4d39ce59 [ 103.835065][ T5326] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.844007][ T5326] RSP: 002b:00007f1e497ecfe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 103.847377][ T5326] RAX: ffffffffffffffda RBX: 00007f1e4d615fa0 RCX: 00007f1e4d39ce59 [ 103.850552][ T5326] RDX: 0000000000000030 RSI: 0000200000000640 RDI: 0000000000000008 [ 103.854337][ T5326] RBP: 00007f1e4d432e6f R08: 0000200000000380 R09: 0000000000000014 [ 103.858746][ T5326] R10: 0000000004000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.862182][ T5326] R13: 00007f1e4d616038 R14: 00007f1e4d615fa0 R15: 00007ffe28fdc068 [ 103.865534][ T5326] [ 103.867284][ T5326] Kernel Offset: disabled [ 103.869101][ T5326] Rebooting in 86400 seconds..