------------[ cut here ]------------
intf 08:02:11:00:00:00 [link=0]: bad STA 08:02:11:00:00:01 bandwidth 20 MHz (0) > channel config 1 MHz (8)
WARNING: drivers/net/wireless/virtual/mac80211_hwsim.c:2693 at mac80211_hwsim_sta_rc_update+0x5db/0x840 drivers/net/wireless/virtual/mac80211_hwsim.c:2693, CPU#3: syz.2.753/9446
Modules linked in:
CPU: 3 UID: 0 PID: 9446 Comm: syz.2.753 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:mac80211_hwsim_sta_rc_update+0x5fd/0x840 drivers/net/wireless/virtual/mac80211_hwsim.c:2693
Code: 00 48 8d 3d 05 51 c4 09 48 8b 4c 24 10 48 8b 44 24 20 89 da 44 8b 89 c0 01 00 00 55 48 8d b0 72 05 00 00 41 57 44 8b 44 24 14 <67> 48 0f b9 3a 58 5a e9 3c fc ff ff e8 42 4e e6 fa e8 cd d5 69 04
RSP: 0018:ffffc9000daa7110 EFLAGS: 00010246
RAX: ffff888051c5ea90 RBX: 0000000000000000 RCX: ffff88806ff54ec0
RDX: 0000000000000000 RSI: ffff888051c5f002 RDI: ffffffff90e5fa70
RBP: 0000000000000008 R08: 0000000000000014 R09: 0000000000000000
R10: 0000000000000008 R11: 0000000000000000 R12: dffffc0000000000
R13: ffff88806ff55090 R14: ffff88806ba43100 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff88809745a000(0063) knlGS:00000000f53edb40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000080001080 CR3: 0000000029791000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 mac80211_hwsim_sta_add+0xc9/0x290 drivers/net/wireless/virtual/mac80211_hwsim.c:2713
 drv_sta_add net/mac80211/driver-ops.h:470 [inline]
 drv_sta_state+0x887/0x1960 net/mac80211/driver-ops.c:155
 sta_info_insert_drv_state net/mac80211/sta_info.c:836 [inline]
 sta_info_insert_finish net/mac80211/sta_info.c:944 [inline]
 sta_info_insert_rcu+0x170b/0x2fa0 net/mac80211/sta_info.c:1021
 sta_info_insert+0x16/0xd0 net/mac80211/sta_info.c:1026
 ieee80211_add_station+0x471/0x6d0 net/mac80211/cfg.c:2435
 rdev_add_station net/wireless/rdev-ops.h:201 [inline]
 nl80211_new_station+0x145b/0x1dd0 net/wireless/nl80211.c:8905
 genl_family_rcv_msg_doit+0x214/0x300 net/netlink/genetlink.c:1115
 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
 genl_rcv_msg+0x560/0x800 net/netlink/genetlink.c:1210
 netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2550
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x5aa/0x870 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x8b0/0xda0 net/netlink/af_netlink.c:1894
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg net/socket.c:742 [inline]
 ____sys_sendmsg+0xa54/0xc30 net/socket.c:2592
 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2646
 __sys_sendmsg+0x170/0x220 net/socket.c:2678
 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
 __do_fast_syscall_32+0xe3/0x8c0 arch/x86/entry/syscall_32.c:307
 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:332
 entry_SYSENTER_compat_after_hwframe+0x84/0x8e
RIP: 0023:0xf6ffef6c
Code: d2 74 05 c1 e8 0c 89 02 8b 5d fc 31 c0 c9 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 58 b8 77 00 00 00 cd 80 0f 0b 8d b6 00 00 00 00 b8 ad
RSP: 002b:00000000f53ed50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172
RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 0000000080001080
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
----------------
Code disassembly (best guess):
   0:	00 48 8d             	add    %cl,-0x73(%rax)
   3:	3d 05 51 c4 09       	cmp    $0x9c45105,%eax
   8:	48 8b 4c 24 10       	mov    0x10(%rsp),%rcx
   d:	48 8b 44 24 20       	mov    0x20(%rsp),%rax
  12:	89 da                	mov    %ebx,%edx
  14:	44 8b 89 c0 01 00 00 	mov    0x1c0(%rcx),%r9d
  1b:	55                   	push   %rbp
  1c:	48 8d b0 72 05 00 00 	lea    0x572(%rax),%rsi
  23:	41 57                	push   %r15
  25:	44 8b 44 24 14       	mov    0x14(%rsp),%r8d
* 2a:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2f:	58                   	pop    %rax
  30:	5a                   	pop    %rdx
  31:	e9 3c fc ff ff       	jmp    0xfffffc72
  36:	e8 42 4e e6 fa       	call   0xfae64e7d
  3b:	e8 cd d5 69 04       	call   0x469d60d