------------[ cut here ]------------ WARNING: drivers/net/wireless/virtual/mac80211_hwsim_main.c:258 at hwsim_check_sta_magic drivers/net/wireless/virtual/mac80211_hwsim_main.c:258 [inline], CPU#1: syz.1.220/5883 WARNING: drivers/net/wireless/virtual/mac80211_hwsim_main.c:258 at mac80211_hwsim_tx+0x100c/0x1b10 drivers/net/wireless/virtual/mac80211_hwsim_main.c:2241, CPU#1: syz.1.220/5883 Modules linked in: CPU: 1 UID: 0 PID: 5883 Comm: syz.1.220 Tainted: G L syzkaller #0 PREEMPT Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : hwsim_check_sta_magic drivers/net/wireless/virtual/mac80211_hwsim_main.c:258 [inline] pc : mac80211_hwsim_tx+0x100c/0x1b10 drivers/net/wireless/virtual/mac80211_hwsim_main.c:2241 lr : hwsim_check_sta_magic drivers/net/wireless/virtual/mac80211_hwsim_main.c:258 [inline] lr : mac80211_hwsim_tx+0x100c/0x1b10 drivers/net/wireless/virtual/mac80211_hwsim_main.c:2241 sp : ffff800095c869e0 x29: ffff800095c86b40 x28: dfff800000000000 x27: 0000000000000000 x26: 0000000000000000 x25: ffff0000f4c13538 x24: ffff0000f4c17b00 x23: ffff0000f4be2c70 x22: 000000006d537749 x21: 1ffff00012b90d80 x20: dfff800000000000 x19: ffff0000d8a0d280 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 00000000007703aa x13: 0000000000000002 x12: 0000000000000000 x11: 0000000000000000 x10: ffff0000f4c132a0 x9 : 0000000000000200 x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000000 x3 : ffff800082eda7d0 x2 : 0000000000000000 x1 : ffff0000db415880 x0 : 0000000000000000 Call trace: hwsim_check_sta_magic drivers/net/wireless/virtual/mac80211_hwsim_main.c:258 [inline] (P) mac80211_hwsim_tx+0x100c/0x1b10 drivers/net/wireless/virtual/mac80211_hwsim_main.c:2241 (P) drv_tx net/mac80211/driver-ops.h:38 [inline] ieee80211_tx_frags+0x2f4/0x6d8 net/mac80211/tx.c:1755 __ieee80211_xmit_fast+0x7ac/0x17bc net/mac80211/tx.c:3853 ieee80211_mesh_xmit_fast+0x8e0/0xc84 net/mac80211/mesh.c:823 __ieee80211_subif_start_xmit+0x468/0xfac net/mac80211/tx.c:4422 ieee80211_subif_start_xmit+0xe8/0x45c net/mac80211/tx.c:4665 __netdev_start_xmit include/linux/netdevice.h:5432 [inline] netdev_start_xmit include/linux/netdevice.h:5441 [inline] xmit_one net/core/dev.c:3953 [inline] dev_hard_start_xmit+0x1dc/0x794 net/core/dev.c:3969 __dev_queue_xmit+0xed4/0x2a68 net/core/dev.c:4958 dev_queue_xmit include/linux/netdevice.h:3464 [inline] packet_xmit+0x6c/0x314 net/packet/af_packet.c:277 packet_snd net/packet/af_packet.c:3149 [inline] packet_sendmsg+0x3148/0x40bc net/packet/af_packet.c:3181 sock_sendmsg_nosec net/socket.c:800 [inline] __sock_sendmsg+0xc8/0x17c net/socket.c:815 sock_write_iter+0x220/0x310 net/socket.c:1266 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x51c/0xa0c fs/read_write.c:687 ksys_write+0x12c/0x228 fs/read_write.c:739 __do_sys_write fs/read_write.c:750 [inline] __se_sys_write fs/read_write.c:747 [inline] __arm64_sys_write+0x84/0x98 fs/read_write.c:747 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:796 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:815 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606 irq event stamp: 2043 hardirqs last enabled at (2042): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline] hardirqs last enabled at (2042): [] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:221 hardirqs last disabled at (2043): [] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:483 softirqs last enabled at (2038): [] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:698 softirqs last disabled at (2040): [] local_bh_disable include/linux/bottom_half.h:20 [inline] softirqs last disabled at (2040): [] rcu_read_lock_bh include/linux/rcupdate.h:902 [inline] softirqs last disabled at (2040): [] __dev_queue_xmit+0x1fc/0x2a68 net/core/dev.c:4872 ---[ end trace 0000000000000000 ]--- EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.