program: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$unix(0x1, 0x2, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x54, r2, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x60}, @val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x7ff, 0x70}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'syzkaller0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x6}, @mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x8, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}]}]]}, 0x54}, 0x1, 0x0, 0x0, 0x81}, 0x24044884) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) socket$inet_sctp(0x2, 0x1, 0x84) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r7, &(0x7f0000000640)="000a18000600600009eb55000500030100aa34745a1945da1ce815b218b175e62e90d9c5596d", 0x26, 0x4000000, &(0x7f0000000380)={0x11, 0xe56930649afa540, r6, 0x1, 0xd8, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x14) [ 99.227674][ T5284] Bluetooth: hci0: command tx timeout [ 99.333754][ T5321] Oops: divide error: 0000 [#1] SMP KASAN NOPTI [ 99.336251][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 99.340023][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 99.344288][ T5321] RIP: 0010:mac80211_hwsim_write_tsf+0x3a3/0x590 [ 99.347415][ T5321] Code: 81 c4 e8 49 00 00 4c 89 e0 48 c1 e8 03 42 80 3c 30 00 74 08 4c 89 e7 e8 1b bb 22 fb 48 8b 34 24 41 03 34 24 66 b8 20 03 31 d2 <66> f7 f5 0f b7 d8 4d 8d 65 0a 49 83 c5 0d 4c 89 e0 48 c1 e8 03 42 [ 99.356079][ T5321] RSP: 0018:ffffc900037aedf0 EFLAGS: 00010246 [ 99.358773][ T5321] RAX: 1ffff110080a0320 RBX: 000000000000001c RCX: 0000000000100000 [ 99.362080][ T5321] RDX: 0000000000000000 RSI: 0000000005e6b00c RDI: 0000000000000230 [ 99.365806][ T5321] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 [ 99.369592][ T5321] R10: dffffc0000000000 R11: fffff520006f5dac R12: ffff888040547c08 [ 99.373040][ T5321] R13: ffff88803d7fadda R14: dffffc0000000000 R15: 0000000000000020 [ 99.376893][ T5321] FS: 00007f2f6aff66c0(0000) GS:ffff88808c852000(0000) knlGS:0000000000000000 [ 99.381360][ T5321] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 99.384293][ T5321] CR2: 0000200000002280 CR3: 0000000013282000 CR4: 0000000000352ef0 [ 99.387693][ T5321] Call Trace: [ 99.389268][ T5321] [ 99.390677][ T5321] mac80211_hwsim_tx_frame_no_nl+0x16b/0x1760 [ 99.393380][ T5321] ? __pfx___skb_flow_dissect+0x10/0x10 [ 99.395873][ T5321] ? __pfx_mac80211_hwsim_tx_frame_no_nl+0x10/0x10 [ 99.398600][ T5321] ? unwind_next_frame+0x8f/0x2550 [ 99.400705][ T5321] ? rcu_is_watching+0x15/0xb0 [ 99.402701][ T5321] ? unwind_next_frame+0x8f/0x2550 [ 99.405133][ T5321] ? rcu_is_watching+0x15/0xb0 [ 99.407475][ T5321] mac80211_hwsim_tx+0x1784/0x2500 [ 99.409776][ T5321] ? is_bpf_text_address+0x26/0x2b0 [ 99.412030][ T5321] ? do_raw_spin_lock+0x12b/0x2f0 [ 99.414180][ T5321] ? __pfx_mac80211_hwsim_tx+0x10/0x10 [ 99.416637][ T5321] ? rcu_is_watching+0x15/0xb0 [ 99.419044][ T5321] ? rcu_is_watching+0x15/0xb0 [ 99.421328][ T5321] ieee80211_tx_frags+0x3df/0x890 [ 99.423491][ T5321] ? __pfx_ieee80211_tx_frags+0x10/0x10 [ 99.425704][ T5321] __ieee80211_tx+0x267/0x580 [ 99.427698][ T5321] ieee80211_tx+0x312/0x4b0 [ 99.429672][ T5321] ? __pfx_ieee80211_tx+0x10/0x10 [ 99.431883][ T5321] ? ieee80211_xmit+0x2e5/0x3c0 [ 99.434182][ T5321] ieee80211_monitor_start_xmit+0xb33/0x1280 [ 99.437024][ T5321] ? ieee80211_monitor_start_xmit+0x5ea/0x1280 [ 99.439638][ T5321] ? __pfx_ieee80211_monitor_start_xmit+0x10/0x10 [ 99.442293][ T5321] dev_hard_start_xmit+0x2cd/0x830 [ 99.444567][ T5321] __dev_queue_xmit+0x1435/0x37f0 [ 99.447171][ T5321] ? lock_acquire+0x5f/0x350 [ 99.449539][ T5321] ? lock_release+0x4b/0x3c0 [ 99.451942][ T5321] ? __dev_queue_xmit+0x29b/0x37f0 [ 99.454065][ T5321] ? __might_fault+0xcb/0x130 [ 99.456097][ T5321] ? _copy_from_iter+0x21b/0x1660 [ 99.458446][ T5321] ? skb_set_owner_w+0x263/0x3d0 [ 99.461015][ T5321] ? __pfx___dev_queue_xmit+0x10/0x10 [ 99.463913][ T5321] ? __pfx__copy_from_iter+0x10/0x10 [ 99.467026][ T5321] ? packet_parse_headers+0x4c5/0x7a0 [ 99.470568][ T5321] ? packet_parse_headers+0x571/0x7a0 [ 99.473517][ T5321] ? __pfx_packet_parse_headers+0x10/0x10 [ 99.476401][ T5321] ? packet_xmit+0x68/0x330 [ 99.478836][ T5321] ? skb_put+0x112/0x210 [ 99.481312][ T5321] packet_sendmsg+0x3d95/0x5040 [ 99.484489][ T5321] ? futex_unqueue+0x22/0x240 [ 99.487512][ T5321] ? __pfx_aa_label_sk_perm+0x10/0x10 [ 99.490217][ T5321] ? futex_unqueue+0x211/0x240 [ 99.492110][ T5321] ? __pfx___futex_wait+0x10/0x10 [ 99.494112][ T5321] ? __pfx_futex_wake_mark+0x10/0x10 [ 99.496377][ T5321] ? __futex_hash+0x416/0x750 [ 99.498407][ T5321] ? __pfx_packet_sendmsg+0x10/0x10 [ 99.500829][ T5321] ? aa_sk_perm+0x6d5/0x900 [ 99.503058][ T5321] ? lock_acquire+0x5f/0x350 [ 99.505444][ T5321] ? __pfx_aa_sk_perm+0x10/0x10 [ 99.507531][ T5321] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 99.510370][ T5321] ? lock_release+0x4b/0x3c0 [ 99.512817][ T5321] ? __might_fault+0xaf/0x130 [ 99.514628][ T5321] ? aa_sock_msg_perm+0xf1/0x1b0 [ 99.516516][ T5321] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 99.519100][ T5321] ? __pfx_packet_sendmsg+0x10/0x10 [ 99.522113][ T5321] __sys_sendto+0x626/0x6c0 [ 99.524174][ T5321] ? __pfx___sys_sendto+0x10/0x10 [ 99.526391][ T5321] ? rcu_is_watching+0x15/0xb0 [ 99.528374][ T5321] __x64_sys_sendto+0xde/0x100 [ 99.530324][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.532857][ T5321] do_syscall_64+0x174/0x580 [ 99.534882][ T5321] ? trace_irq_disable+0x3b/0x140 [ 99.537254][ T5321] ? clear_bhb_loop+0x40/0x90 [ 99.539481][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.542004][ T5321] RIP: 0033:0x7f2f6a19ce59 [ 99.543691][ T5321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 99.552487][ T5321] RSP: 002b:00007f2f6aff5fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 99.556061][ T5321] RAX: ffffffffffffffda RBX: 00007f2f6a415fa0 RCX: 00007f2f6a19ce59 [ 99.559613][ T5321] RDX: 0000000000000026 RSI: 0000200000000640 RDI: 0000000000000007 [ 99.563427][ T5321] RBP: 00007f2f6a232e6f R08: 0000200000000380 R09: 0000000000000014 [ 99.567095][ T5321] R10: 0000000004000000 R11: 0000000000000246 R12: 0000000000000000 [ 99.570410][ T5321] R13: 00007f2f6a416038 R14: 00007f2f6a415fa0 R15: 00007ffff9cddab8 [ 99.573765][ T5321] [ 99.575252][ T5321] Modules linked in: [ 99.577621][ T5321] ---[ end trace 0000000000000000 ]--- [ 99.580261][ T5321] RIP: 0010:mac80211_hwsim_write_tsf+0x3a3/0x590 [ 99.582900][ T5321] Code: 81 c4 e8 49 00 00 4c 89 e0 48 c1 e8 03 42 80 3c 30 00 74 08 4c 89 e7 e8 1b bb 22 fb 48 8b 34 24 41 03 34 24 66 b8 20 03 31 d2 <66> f7 f5 0f b7 d8 4d 8d 65 0a 49 83 c5 0d 4c 89 e0 48 c1 e8 03 42 [ 99.591874][ T5321] RSP: 0018:ffffc900037aedf0 EFLAGS: 00010246 [ 99.594488][ T5321] RAX: 1ffff110080a0320 RBX: 000000000000001c RCX: 0000000000100000 [ 99.597861][ T5321] RDX: 0000000000000000 RSI: 0000000005e6b00c RDI: 0000000000000230 [ 99.601907][ T5321] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 [ 99.605579][ T5321] R10: dffffc0000000000 R11: fffff520006f5dac R12: ffff888040547c08 [ 99.609035][ T5321] R13: ffff88803d7fadda R14: dffffc0000000000 R15: 0000000000000020 [ 99.612695][ T5321] FS: 00007f2f6aff66c0(0000) GS:ffff88808c852000(0000) knlGS:0000000000000000 [ 99.617465][ T5321] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 99.620686][ T5321] CR2: 0000200000002280 CR3: 0000000013282000 CR4: 0000000000352ef0 [ 99.624029][ T5321] Kernel panic - not syncing: Fatal exception in interrupt [ 99.627502][ T5321] Kernel Offset: disabled [ 99.629473][ T5321] Rebooting in 86400 seconds..