Extracting prog: 23m17.593313396s
Minimizing prog: 7m53.703502465s
Simplifying prog options: 0s
Extracting C: 1m26.372935614s
Simplifying C: 10m35.420589654s


extracting reproducer from 30 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$ifreq_SIOCGIFINDEX_vcan-bind
detailed listing:
executing program 0:
r0 = socket(0x1d, 0x2, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan1\x00', <r1=>0x0})
bind(r0, &(0x7f00000000c0)=@can={0x1d, r1, 0x1, 0x2}, 0x10)

program did not crash
single: failed to extract reproducer
bisect: bisecting 30 programs with base timeout 30s
testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 10, 7, 9, 20, 3, 5, 5, 12, 2, 5, 10, 8, 2, 7, 9, 20, 3, 2, 6, 5, 24, 9, 6, 10, 9, 28, 4, 3, 7]
detailed listing:
executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), r0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000006c0)={'wlan0\x00', <r3=>0x0})
sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f00000008c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002dbd0600ffdbdb252100000008000300", @ANYRES32=r3, @ANYBLOB="0600eb00000800000400ec000a00060008021100000100000600f70000ff000008009e"], 0x44}}, 0x0)
executing program 4:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$unix(0x1, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', <r3=>0x0})
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x3, 0xc, &(0x7f00000004c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffff000, 0x0, 0x0, 0x0, 0x9}, [@call={0x85, 0x0, 0x0, 0x28}, @printk={@d, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x17}}]}, &(0x7f0000000540)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x0)
write$tun(r0, &(0x7f0000000240)={@val={0x0, 0x86dd}, @val={0x0, 0x0, 0x11, 0x800}, @mpls={[], @llc={@llc={0x0, 0xff, '\x00', "c02d2cd53c1fefe9b933987a9203"}}}}, 0x1f)
executing program 3:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller1\x00', 0x1})
r2 = socket$unix(0x1, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'syzkaller1\x00', <r3=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff3}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000001480)=@newtfilter={0x3c, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xb, 0x7}, {0xfff2, 0xffff}, {0x300}}, [@filter_kind_options=@f_flow={{0x9}, {0xc, 0x2, [@TCA_FLOW_BASECLASS={0x8, 0x3, {0xfff3, 0xb}}]}}]}, 0x3c}}, 0x0)
executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$unix(0x1, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x3, 0xb, &(0x7f00000004c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffff000, 0x0, 0x0, 0x0, 0x9}, [@printk={@d, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x17}}]}, &(0x7f0000000540)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001380)=@newtfilter={0x38, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xb, 0xfff7}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_bpf={{0x8}, {0xc, 0x2, [@TCA_BPF_FD={0x8, 0x6, r3}]}}]}, 0x38}}, 0x0)
write$tun(r0, &(0x7f0000000240)={@val={0x0, 0x86dd}, @val={0x0, 0x0, 0x11, 0x800}, @mpls={[], @llc={@llc={0x0, 0xff, '\x00', "c02d2cd53c1fefe9b933987a9203"}}}}, 0x1f)
executing program 4:
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0e000000040000000800000007"], 0x50)
bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080))
socket$kcm(0x10, 0x2, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket$inet_sctp(0x2, 0x1, 0x84)
socket$nl_generic(0x10, 0x3, 0x10)
close(0x3)
bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x7, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0xfffffff8}, 0x50)
socket$inet6(0xa, 0x1, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140))
socket$kcm(0x1e, 0x4, 0x0)
socket$kcm(0x1e, 0x4, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0xe, 0x4, 0x4, 0x1, 0x0, 0x1, 0xfffffffc}, 0x50)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x6, 0x14, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bca2000000000000a6020000f8ffffffb703000018000000b704000000000000850000003300000095"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{r0}, &(0x7f0000000440), &(0x7f0000000480)=r1}, 0x20)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000004c0)={'syz_tun\x00'})
bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0)
syz_emit_ethernet(0x3e, &(0x7f00000006c0)={@broadcast, @random="8eff80ec0031", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010101, @local}, @source_quench={0x4, 0x0, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x11, 0x0, @broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}}}, 0x0)
executing program 3:
syz_mount_image$vfat(&(0x7f0000000d80), &(0x7f0000000dc0)='./file0\x00', 0x0, &(0x7f0000000e00)=ANY=[@ANYBLOB='rodir,nonumtail=0,uni_xlate=0,iocharset=iso8859-14,gid=', @ANYRESHEX=0x0, @ANYBLOB="2c73686f72746e616d653d77696e3935000000805f786c6174653d302c696f630461727365743d6d6163637972537a844d632c6e6f6e756d7461696c3d302c756e695f786c6174653d312c696f636861727365743d63503835302c756e695f786c6174653d302c6e6f86756d7461696c3d302c04"], 0x81, 0x2be, &(0x7f0000000ec0)="$eJzs3UFrI1UcAPD/NJMmVSE5eBLBAT14Ktv9BFukwmIPosxBLypuF6QJCw0MrIpxT94FT34Hv4MfwIvfwINHwZt7EEeSmSRNMqnbJaTS/f1O/8x7//+89+a1hcK8fPr68PzBo9HDJ1//Ft1uEnv34l48TaIfezHzbQAAt8nTsow/y0rE/pV902l72as/7e1mhADAti3//QcAXgQffvTxe8enpycfZFk3YvhdkScRMUyKvGo/fhhfxCDO4k704u+Icq6KX7l/ehJpls3+GVAcRB4x/OSX+vPxHxHT/KPoRX89/937pydHWSXeGo6LvJgMYFzk7XgpiTguk6rQ3ejFqxFlO+oii/y7y/mT+48j34+33/yxHv8/Z3EYvfj183gUg3gwLbHI/+Yoy94pf/jrq2oGeUQyLvLOtN9C2drZQwEAAAAAAAAAAAAAAAAAAAAA4NY7zOb6l8/PmZ0GeHjY3D49H6jVcD5QfcLP+NL5OneyLJsd41Pk7ajy03gtjfRGJw8AAAAAAAAAAAAAAAAAAAD/E6PHX55/NhicXSwFP5erVxqC+o3+qK+kl5rS5aar6zQE5z9FXD/rWYJo1UMbJGu3mE3omQummzt3rjOwg6Y6sbdpDdNBVIP//r8qd2L1yhvXmuAkKJ9jnWe7a7JJrujcitHjbvMmubQzD+piF6PpAzrYtGmXg7Jh6Vobs/bX67zfeo49tv/ydjftZMbt+WIu9+lOnuSgM9+07S3/pKxItv2rBwAAAAAAAAAAAAAAAAAAWLF46Td+X2t8ciNDAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICdW3z//zyI/uqV1WBcJ581pa8EnYtRw237O54mAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAt9y/AQAA//8/i1GK")
r0 = open(&(0x7f0000000a80)='.\x00', 0x20000, 0x0)
getdents64(r0, &(0x7f0000000ac0)=""/224, 0xe0)
executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), r0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000006c0)={'wlan0\x00', <r3=>0x0})
sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f00000008c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002dbd0600ffdbdb252100000008000300", @ANYRES32=r3, @ANYBLOB="0600eb00000800000400ec000a00060008021100000100000600f70000ff000008009e"], 0x44}}, 0x0)
executing program 4:
r0 = syz_open_dev$usbfs(&(0x7f0000000240), 0x205, 0x8401)
r1 = syz_open_dev$usbmon(&(0x7f0000000280), 0x7, 0x0)
r2 = fcntl$dupfd(r0, 0x0, r0)
ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, &(0x7f00000002c0)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0})
readv(r1, &(0x7f0000000440)=[{&(0x7f00000023c0)=""/4106, 0x30}, {&(0x7f0000000380)=""/133, 0x85}], 0x2)
executing program 0:
write(0xca, &(0x7f0000000060)="040e0c01032000ffffffffffffffff", 0xf)
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000280)='4\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00', 0xc)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f0000000200)=0x5dbd, 0x4)
bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10)
nanosleep(&(0x7f0000000300)={0x0, 0x989680}, 0x0)
getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f00000000c0)=@assoc_value={<r2=>0x0}, &(0x7f0000000140)=0x4)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000003c0)={r2, @in={{0x2, 0x4e21, @local}}, 0x9591, 0x3, 0x40, 0xe3e, 0x96, 0x9, 0x7}, &(0x7f00000005c0)=0x9c)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000180)={r2, 0x3ff, 0x30, 0xe304, 0x1}, &(0x7f0000000380)=0x18)
syz_init_net_socket$bt_hci(0x1f, 0x5, 0x8)
executing program 3:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IEEE802154_START_REQ(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x54, 0x0, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x12}, @IEEE802154_ATTR_SF_ORD={0x5, 0x18, 0x7f}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6}, @IEEE802154_ATTR_BCN_ORD={0x5}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}, @IEEE802154_ATTR_PAN_COORD={0x5, 0x19, 0x4}, @IEEE802154_ATTR_BAT_EXT={0x5, 0x1a, 0x10}, @IEEE802154_ATTR_COORD_REALIGN={0x5, 0x1b, 0x7}]}, 0x54}, 0x1, 0x0, 0x0, 0x18000}, 0x0)
executing program 2:
socket$inet_icmp(0x2, 0x2, 0x1)
socket$nl_generic(0x10, 0x3, 0x10)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x34, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_KEYS={0x8, 0x51, 0x0, 0x1, [{0x4}]}, @NL80211_ATTR_PRIVACY={0x4}]}, 0x34}}, 0x0)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$unix(0x1, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', <r3=>0x0})
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x3, 0xc, &(0x7f00000004c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffff000, 0x0, 0x0, 0x0, 0x9}, [@call={0x85, 0x0, 0x0, 0x28}, @printk={@d, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x17}}]}, &(0x7f0000000540)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x0)
write$tun(r0, &(0x7f0000000240)={@val={0x0, 0x86dd}, @val={0x0, 0x0, 0x11, 0x800}, @mpls={[], @llc={@llc={0x0, 0xff, '\x00', "c02d2cd53c1fefe9b933987a9203"}}}}, 0x1f)
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$unix(0x1, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x3, 0x4, &(0x7f00000004c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffff000, 0x0, 0x0, 0x0, 0x9}, [@call={0x85, 0x0, 0x0, 0x28}]}, &(0x7f0000000540)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x0)
executing program 1:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0)
sendmmsg$inet(r0, &(0x7f0000003440)=[{{&(0x7f00000004c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x23}}, 0x10, &(0x7f0000000680)=[{0x0}, {&(0x7f0000000600)="7573f95f", 0x4}], 0x2}}, {{0x0, 0x0, &(0x7f0000001c40)=[{&(0x7f0000000740)="8af6a269e30488ec5f919575784336489591639b1244d8d8ae45ff47aa31b63c5694764339eb2563e53fc7f0502c6dca2949f91836496c8ed014679d088683da82cbce078caf53de2788a417270d721af0ff732e2cdd170d3bce2a460356dd6b6a7bbbdaaa2caa806dfd36285d5431b05f92a5493af8f087e80215e1017d1097181fff6e6e0371581de2e31d4c20d74e4b978af573f83e0e4345889607dad26c3f2467bfd71c291e06bf2e14daa7cbf40a885a6f3205596d969f58194e94c705c83f86aadada5c17eb", 0xc9}, {&(0x7f0000000840)="68859a97e2d4c639bce3b7334e3d715d29ac2da2def2411ce483eabe89b6e083117c3f88b7ea851083304a021d1f5317fc21d79db5877b871917fa7666f1ed3d1a57e093f4503adde88c7f649b7cd9d69d3460e2b01a63ca381e140da8feb5e05ada0c6b679a1e381d37389a25e08fc7ee95a56c0e9d0e2fa74dac434096fb1b2282fed60c2f826c74642de66ba122eee23dc40f563e51baef53bae64e64d16f430ae276a74f669c59e833faf71449d5494955332b52f3d8e5488671aa57b7a9", 0xc0}, {&(0x7f0000000900)="e36d369f3f71b82d675bfdd9510e438def4711260825da71e57a5470272368a2b85fe2f9f6f9cd99d38926543a15dd63b3688417828ce9ab32dce57e841526f90c04b43eef25b1ad1b82993bd1c7213a3866b601d75f84c07e19fdc64648fcf8a316d75123104190eb5d09b077a3d52e03a877a9e4f62825274589a443f56f24000376b346163634d7ddd9cfa21ee2", 0x8f}, {&(0x7f00000009c0)="e1427bc3d23e543330fd1ae0c27c8944ec26c933cc7f4dbbef1096022543c1b82216d7203c98dff45d283b140003c8f8e158769f8749753dd1dc265b304c88cdaf996670fc508c7701169a32188659a1bad963fec72c682c4dab7ba1f946390a1d93a0887f4c183abe059902b6147f7d246b2a2252d7578611f5bf2fe67012af3c3e2ceec59654f000", 0x89}], 0x4, &(0x7f0000001d40)=[@ip_retopts={{0x10}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @private=0xa010100, @initdev={0xac, 0x1e, 0x1, 0x0}}}}], 0x30}}], 0x2, 0xc0)
executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller1\x00', 0x1})
r2 = socket$unix(0x1, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'syzkaller1\x00', <r3=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff3}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000001480)=@newtfilter={0x3c, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xb, 0x7}, {0xfff2, 0xffff}, {0x300}}, [@filter_kind_options=@f_flow={{0x9}, {0xc, 0x2, [@TCA_FLOW_BASECLASS={0x8, 0x3, {0xfff3, 0xb}}]}}]}, 0x3c}}, 0x0)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', <r2=>0x0})
ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x3, 0xb, &(0x7f00000004c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffff000, 0x0, 0x0, 0x0, 0x9}, [@printk={@d, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x17}}]}, &(0x7f0000000540)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001380)=@newtfilter={0x38, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0xb, 0xfff7}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_bpf={{0x8}, {0xc, 0x2, [@TCA_BPF_FD={0x8, 0x6, r3}]}}]}, 0x38}}, 0x0)
write$tun(r0, &(0x7f0000000240)={@val={0x0, 0x86dd}, @val={0x0, 0x0, 0x11, 0x800}, @mpls={[], @llc={@llc={0x0, 0xff, '\x00', "c02d2cd53c1fefe9b933987a9203"}}}}, 0x1f)
executing program 1:
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0e000000040000000800000007"], 0x50)
bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080))
socket$kcm(0x10, 0x2, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket$inet_sctp(0x2, 0x1, 0x84)
socket$nl_generic(0x10, 0x3, 0x10)
close(0x3)
bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x7, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0xfffffff8}, 0x50)
socket$inet6(0xa, 0x1, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140))
socket$kcm(0x1e, 0x4, 0x0)
socket$kcm(0x1e, 0x4, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0xe, 0x4, 0x4, 0x1, 0x0, 0x1, 0xfffffffc}, 0x50)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x6, 0x14, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bca2000000000000a6020000f8ffffffb703000018000000b704000000000000850000003300000095"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{r0}, &(0x7f0000000440), &(0x7f0000000480)=r1}, 0x20)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000004c0)={'syz_tun\x00', <r3=>0x0})
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000500)={r1, r3, 0x25, 0x2, @void}, 0x10)
syz_emit_ethernet(0x0, 0x0, 0x0)
executing program 2:
r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000010ef17476000000000000109022400010000a00209040005020300840009210000400122180009058103"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0)
executing program 3:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendmsg$inet6(r0, &(0x7f0000000980)={&(0x7f00000009c0)={0xa, 0x4e20, 0x180000, @ipv4={'\x00', '\xff\xff', @broadcast}, 0xfffffffb}, 0x1c, 0x0, 0x0, &(0x7f0000000a00)=[@hopopts={{0x18, 0x29, 0x36, {0x56}}}], 0x18}, 0x8040)
executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000700)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(des3_ede)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000780)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18)
r1 = accept4(r0, 0x0, 0x0, 0x80800)
sendmmsg$alg(r1, &(0x7f00000007c0)=[{0x0, 0x0, &(0x7f0000001140)=[{&(0x7f0000001180)="f78d9ca38fff48", 0x7}, {&(0x7f0000001240)="e870", 0x2}], 0x2}], 0x1, 0x40800)
recvmsg(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000013c0)=[{&(0x7f0000001400)=""/81, 0x51}], 0x1}, 0x0)
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), r0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000006c0)={'wlan0\x00', <r3=>0x0})
sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f00000008c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002dbd0600ffdbdb252100000008000300", @ANYRES32=r3, @ANYBLOB="0600eb00000800000400ec000a00060008021100000100000600f70000ff000008009e"], 0x44}}, 0x0)
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5)
r1 = fcntl$getown(0xffffffffffffffff, 0x9)
sched_setscheduler(r1, 0x1, &(0x7f0000000000))
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r4 = socket(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000000)={0x4800}, 0x10)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFQNL_MSG_CONFIG(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={0x2c, 0x2, 0x3, 0x101, 0x0, 0x0, {0x2}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x2}}, @NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x2}, @NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x2}]}, 0x2c}}, 0x0)
sendmsg$nl_generic(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000003900)={0x24, 0x16, 0xa01, 0x0, 0x0, {0x3}, [@typed={0xfffffffffffffeb6, 0x3ffd}, @typed={0xc, 0xa, 0x0, 0x0, @u64}]}, 0x24}}, 0x8000)
mlockall(0x7)
r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50)
r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xe, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x10, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r6}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r7}, {}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
capset(&(0x7f0000000080)={0x19980330}, &(0x7f0000000040)={0x200000, 0x200000, 0x0, 0x0, 0x9})
unshare(0x6020400)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x3, 0x7)
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
close(r1)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140), r2)
sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c"], 0x38}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000240)={'syzkaller0\x00', @multicast})
writev(r0, &(0x7f0000000280)=[{&(0x7f00000002c0)="89e7ee2c67062f080700000088ca54c2a116121c1e7e9ae9", 0x18}, {&(0x7f0000000300)="f954f8a34b71", 0x6}], 0x2)
executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000001980)={0x2, 0x4e20, @multicast1}, 0x10)
connect$inet(r0, &(0x7f00000019c0)={0x2, 0x4e20, @local}, 0x10)
r1 = socket$kcm(0x29, 0x2, 0x0)
ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f0000003f40)={r0})
sendmmsg$inet(r1, &(0x7f0000003f80)=[{{0x0, 0x0, &(0x7f0000004000)=[{&(0x7f0000004040)=')\x00C', 0x34000}], 0x1}}, {{0x0, 0x0, &(0x7f0000004080)=[{&(0x7f00000040c0)="f5bf5def", 0x4}], 0x1}}], 0x2, 0x0)
executing program 4:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000300)=0x79, 0x4)
bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e23, @multicast1}, 0x10)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000380)={0x1, &(0x7f00000003c0)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10)
sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000400)={0x2, 0x4e23, @local}, 0x10)
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000440)='bbr', 0x3)
sendmmsg$inet(r0, &(0x7f0000000480)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000500)="91f8a984851bdef38491bbc4173c3c6f357d028feff84ab17c417789f9fc9b8572c98172b7319130feaab952ac4703cad04be6890ee50e997fc26e0000ea4feb931647fc5393de25000000000000000000f4922da20bf1f802970c30f03cc271337e892c99bda9475d51361f8b78938a6a68ba85987219000000eb52c9ff439180b413ec4d4fe130b41d113ce7efb5e9838379c5a554eb896f7808d5904cd8da06fd5159085c9275f49e775e92fb106c2f10442d508891e58a3f117fc203f787901de99a6a1b851ff5c85244beacba25d854577d68ca555e88fc249340ab9bdd8680abbbde02b0307ef45cb7ffffffff984c7bbb7bb3c689ef8daa63ca62e496be091cc1c7d4f371acaaec43337aee38542c35292cf3fdbfc45af863017437", 0x11f}, {&(0x7f0000000680)="44900001000056ee66c372f3105eb186dd8062fad2d5b5bfb0ba06f274a8d026bd209da8ffa6a26e3b3f8075704a9d0ef9aff7f1e7db24609f02d34e76992c9df9fe6888c6c9a4825c6223be6ac54536025af1dea54e527c68b0ff250261953f2da79a78104c2d9e7b16ed86b124945aa9ab7581ebd385fb61d442035db81e18c2d2462d0bb25fffe4b81ce90b597992b2a4d541611ce77f58dce7c9500118", 0x9f}], 0x2}}], 0x1, 0x2090)
setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000740)=0xdf8, 0x4)
writev(r0, &(0x7f0000000780)=[{&(0x7f00000007c0)="396cf87d08c5a180ab47bb5bf073f86e645bdcec1582ceaa94028bed754c6a0a9ee51723aba90ee33675431670f9548c745b3da48b83d07d7eccc4eb90a1e0e95fa8b02a190ec6899154b7410e1d84c9", 0x50}], 0x1)
write(r0, &(0x7f00000008c0)="39270725d93c4ab6cb559938ef75d3d7fd5c06a228a59b717b6934bdefb8b8e2dfca955f26b8cab29bdfdce27e4f9cb112fe41e0a6799578f252519cd4a289985be050d209b4c9617cfb94f1bed81696b0c741f6d366efd7ad3dc7cef66647abaf4108076fdffecb7457f5b6b01835a3c79b873f6ebbcb5ee659861a7b4cce43711bbd6b13c941fbb38ef7e1fe0c70fa4aa49b98b43615605d51cc4d742b364a4e7a2f3dee73b86af3fa4ca8f616eaaedcf155820e1767f7d66ecd818ece03f32c3367bbd9ce6656123f394b7f26f1e0420a9ac4cb25638c75fc3c487ba76fd64c26da6d7ce7f1ee8f49d6e9cc95f5c94bf93183ebf8e6be081e0b9f34bd6c2fe5f895dc1cc01e3018cef11ad9e2e1baf35254258efbaf3e8898f561bdb5c4c49f9d3146503df48e194ea3d06396e970ea9fc7c47eb9988477ed1a7e8641dfeea7b57b5a9967c58762574262efde8795f20f2d45e964ede39c7a6502c03f863e6a21a33ba324e6474d4f0495054745f3a80e6554d4d1fd5ddbca11c5e3e6f9087ca1981a14baa3a2956faa8f6b1652e8cf30d7c37a060bc6c836862451c4e76fc9cb221db8d4b449c27aa44564cb33ef144ed0c51bdd66675302692d979297f30e2d9523f85afbbf54c5b5e2261f8b792f83b33cca78c44a5c4e6ff96273979acbb447d49c0502cc9f8991e9bc784a2e978912d8102d867b631d54269936f54bb20ee57e2b4ba4b6c44e767aef24f6c3a8bb5a3b2084d793082e4c5e517694b220e35ac140913e0e55257af03c4dcf376f24773642c14279e2b55906b0b8a4a34fa4d73f37a5feeca1cf93395b998ddcc557d0e2ae112cf1566f7097e7acb6c0bdf9350781341bb83936b355779417839a70c3cbe13e9561b0820df44dbd2a24bd3d6d8b0d9e83983cb7ad8f147f980b06be823e93a93395f5e60b7f31f5aeadc81f02e177446888c15d2845fd675b98360ac2f584a8ab618789499babac77e3311c563fa519a8dbbe49b91a46cc355f8e956c04dfc3b8e218dbe0302ff463fc94eceec7050b7477d9542f6d05d36ee13e664dfc0bb165601e6bd70615f3c299a9c7c7004cc9987a76afc54b3c83e5d23c0790f39593437b2592cf0548f21823f61076340a87dae9d3427acc844357d6bdbba726e7a41eb30a916df698ab241b5e4991f41d34afd2c2b99f259ca582f09c8027c3381e64070aad6ec7f7c7c973d55a33eca3cc4245bf488a497ac966aa13111ec3033172a3512e97700b3b58b621ccb71309d6ccafb05352718a362d14c38501ec45a522fb86563533d1f46e3fc182181ca5583096ec3849fb5db88ba0bcf565ec4665280402275fe98483a6c6b9da4665196aeff9b18c1e4fe3f19f1ff296702a10a27684a6cf0f9c003fd4b20127b080bf82664e51c36a4c4681dd332c6cb068cd11d13dae5f79", 0x3fb)
executing program 4:
syz_emit_ethernet(0x0, 0x0, 0x0)
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000005f40)=[{&(0x7f0000000000)=ANY=[], 0x440}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5, 0x0, 0x0, 0x14000845}, 0x480a4)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r1, &(0x7f0000000200), &(0x7f0000000240)=@tcp6=r0}, 0x20)
ioctl$sock_SIOCINQ(r0, 0x541b, 0x0)
r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8b30, &(0x7f0000000040)={'wlan0\x00'})
executing program 0:
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = dup(0xffffffffffffffff)
prlimit64(0x0, 0xe, &(0x7f0000019280)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f00000192c0)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f0000019300)=0x2)
r1 = getpid()
openat$ptmx(0xffffffffffffff9c, 0x0, 0x6c0000, 0x0)
sched_setscheduler(r1, 0x1, &(0x7f0000019380)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000193c0)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f0000019400)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000019480), 0x318, 0x0)
recvmmsg(r2, &(0x7f00000194c0), 0x10106, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000019500)=0x2)
socket$inet6_tcp(0xa, 0x1, 0x0)
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000019540)='cpuset.effective_cpus\x00', 0x275a, 0x0)
fcntl$lock(r4, 0x26, &(0x7f0000019580)={0x1})
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000004000000080000000a"], 0x48)
r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[], 0x0, 0x5a}, 0x28)
close(0x3)
bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x13, 0x4, 0x4, 0x8001, 0x1104, 0x1, 0xfffffffc}, 0x50)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x6, [@type_tag={0x6, 0x0, 0x0, 0x12, 0x1}]}, {0x0, [0x2e, 0x30, 0x61, 0x5f]}}, 0x0, 0x2a, 0x0, 0x1, 0x3, 0x10000, @value=r0}, 0x28)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={0xffffffffffffffff, 0x0, 0x3, 0x0, &(0x7f0000000280)='\t\x00\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r7 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r7, 0x29, 0x20, &(0x7f0000000300)={@private1, 0x9c940000, 0x0, 0x3, 0x8, 0x1, 0xfffe}, 0x20)
r8 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000340), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_CHANNEL(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x30, r8, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_CHANNEL={0x5, 0x8, 0x4}, @NL802154_ATTR_PAGE={0x5}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000}, 0x4000884)
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x5, 0xb, 0x0, 0x0, 0x1, 0x100000, &(0x7f0000019a00)=""/1048576, 0x0, 0x0, '\x00', 0x0, @fallback, r5, 0x8, &(0x7f0000119a00)={0x0, 0x3}, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
executing program 1:
r0 = socket$pppoe(0x18, 0x1, 0x0)
connect$pppoe(r0, &(0x7f0000000480)={0x18, 0x0, {0x4001, @multicast, 'batadv0\x00'}}, 0x1e)
socket$packet(0x11, 0x2, 0x300)
sendmsg$inet(r0, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x20000010)
executing program 1:
r0 = socket(0x1d, 0x2, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan1\x00', <r1=>0x0})
bind(r0, &(0x7f00000000c0)=@can={0x1d, r1, 0x1, 0x2}, 0x10)
executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001780), 0x40241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000017c0)={'syzkaller1\x00', 0xc201})
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$unix(0x1, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001840)={'syzkaller1\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={0x0}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000001940)={0x0, 0x0, &(0x7f0000001980)={&(0x7f00000019c0)=@newtfilter={0x3c, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xb, 0x5}, {0xfff1, 0xffff}, {0x300, 0x5}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_ENC_IPV4_DST={0x8, 0x1d, @dev={0xac, 0x14, 0x14, 0x43}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x0)

program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
bisect: bisecting 30 programs
bisect: split chunks (needed=false): <29>
bisect: split chunk #0 of len 29 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=35s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 10, 8, 2, 7, 9, 20, 3, 2, 6, 5, 24, 9, 6, 10, 9, 28, 4, 3, 7]
detailed listing:
executing program 2:
socket$inet_icmp(0x2, 0x2, 0x1)
socket$nl_generic(0x10, 0x3, 0x10)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff)
sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x34, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_KEYS={0x8, 0x51, 0x0, 0x1, [{0x4}]}, @NL80211_ATTR_PRIVACY={0x4}]}, 0x34}}, 0x0)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$unix(0x1, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', <r3=>0x0})
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x3, 0xc, &(0x7f00000004c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffff000, 0x0, 0x0, 0x0, 0x9}, [@call={0x85, 0x0, 0x0, 0x28}, @printk={@d, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x17}}]}, &(0x7f0000000540)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x0)
write$tun(r0, &(0x7f0000000240)={@val={0x0, 0x86dd}, @val={0x0, 0x0, 0x11, 0x800}, @mpls={[], @llc={@llc={0x0, 0xff, '\x00', "c02d2cd53c1fefe9b933987a9203"}}}}, 0x1f)
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$unix(0x1, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x3, 0x4, &(0x7f00000004c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffff000, 0x0, 0x0, 0x0, 0x9}, [@call={0x85, 0x0, 0x0, 0x28}]}, &(0x7f0000000540)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x0)
executing program 1:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0)
sendmmsg$inet(r0, &(0x7f0000003440)=[{{&(0x7f00000004c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x23}}, 0x10, &(0x7f0000000680)=[{0x0}, {&(0x7f0000000600)="7573f95f", 0x4}], 0x2}}, {{0x0, 0x0, &(0x7f0000001c40)=[{&(0x7f0000000740)="8af6a269e30488ec5f919575784336489591639b1244d8d8ae45ff47aa31b63c5694764339eb2563e53fc7f0502c6dca2949f91836496c8ed014679d088683da82cbce078caf53de2788a417270d721af0ff732e2cdd170d3bce2a460356dd6b6a7bbbdaaa2caa806dfd36285d5431b05f92a5493af8f087e80215e1017d1097181fff6e6e0371581de2e31d4c20d74e4b978af573f83e0e4345889607dad26c3f2467bfd71c291e06bf2e14daa7cbf40a885a6f3205596d969f58194e94c705c83f86aadada5c17eb", 0xc9}, {&(0x7f0000000840)="68859a97e2d4c639bce3b7334e3d715d29ac2da2def2411ce483eabe89b6e083117c3f88b7ea851083304a021d1f5317fc21d79db5877b871917fa7666f1ed3d1a57e093f4503adde88c7f649b7cd9d69d3460e2b01a63ca381e140da8feb5e05ada0c6b679a1e381d37389a25e08fc7ee95a56c0e9d0e2fa74dac434096fb1b2282fed60c2f826c74642de66ba122eee23dc40f563e51baef53bae64e64d16f430ae276a74f669c59e833faf71449d5494955332b52f3d8e5488671aa57b7a9", 0xc0}, {&(0x7f0000000900)="e36d369f3f71b82d675bfdd9510e438def4711260825da71e57a5470272368a2b85fe2f9f6f9cd99d38926543a15dd63b3688417828ce9ab32dce57e841526f90c04b43eef25b1ad1b82993bd1c7213a3866b601d75f84c07e19fdc64648fcf8a316d75123104190eb5d09b077a3d52e03a877a9e4f62825274589a443f56f24000376b346163634d7ddd9cfa21ee2", 0x8f}, {&(0x7f00000009c0)="e1427bc3d23e543330fd1ae0c27c8944ec26c933cc7f4dbbef1096022543c1b82216d7203c98dff45d283b140003c8f8e158769f8749753dd1dc265b304c88cdaf996670fc508c7701169a32188659a1bad963fec72c682c4dab7ba1f946390a1d93a0887f4c183abe059902b6147f7d246b2a2252d7578611f5bf2fe67012af3c3e2ceec59654f000", 0x89}], 0x4, &(0x7f0000001d40)=[@ip_retopts={{0x10}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @private=0xa010100, @initdev={0xac, 0x1e, 0x1, 0x0}}}}], 0x30}}], 0x2, 0xc0)
executing program 2:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller1\x00', 0x1})
r2 = socket$unix(0x1, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'syzkaller1\x00', <r3=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff3}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000001480)=@newtfilter={0x3c, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xb, 0x7}, {0xfff2, 0xffff}, {0x300}}, [@filter_kind_options=@f_flow={{0x9}, {0xc, 0x2, [@TCA_FLOW_BASECLASS={0x8, 0x3, {0xfff3, 0xb}}]}}]}, 0x3c}}, 0x0)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r1 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', <r2=>0x0})
ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x3, 0xb, &(0x7f00000004c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffff000, 0x0, 0x0, 0x0, 0x9}, [@printk={@d, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x17}}]}, &(0x7f0000000540)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94)
sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001380)=@newtfilter={0x38, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0xb, 0xfff7}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_bpf={{0x8}, {0xc, 0x2, [@TCA_BPF_FD={0x8, 0x6, r3}]}}]}, 0x38}}, 0x0)
write$tun(r0, &(0x7f0000000240)={@val={0x0, 0x86dd}, @val={0x0, 0x0, 0x11, 0x800}, @mpls={[], @llc={@llc={0x0, 0xff, '\x00', "c02d2cd53c1fefe9b933987a9203"}}}}, 0x1f)
executing program 1:
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0e000000040000000800000007"], 0x50)
bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080))
socket$kcm(0x10, 0x2, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
socket$inet_sctp(0x2, 0x1, 0x84)
socket$nl_generic(0x10, 0x3, 0x10)
close(0x3)
bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x7, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0xfffffff8}, 0x50)
socket$inet6(0xa, 0x1, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140))
socket$kcm(0x1e, 0x4, 0x0)
socket$kcm(0x1e, 0x4, 0x0)
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0xe, 0x4, 0x4, 0x1, 0x0, 0x1, 0xfffffffc}, 0x50)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x6, 0x14, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bca2000000000000a6020000f8ffffffb703000018000000b704000000000000850000003300000095"], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{r0}, &(0x7f0000000440), &(0x7f0000000480)=r1}, 0x20)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000004c0)={'syz_tun\x00', <r3=>0x0})
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000500)={r1, r3, 0x25, 0x2, @void}, 0x10)
syz_emit_ethernet(0x0, 0x0, 0x0)
executing program 2:
r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000010ef17476000000000000109022400010000a00209040005020300840009210000400122180009058103"], 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="002218000000050c150825ff0904a1010901a1007508950109308102c0c0"], 0x0}, 0x0)
executing program 3:
r0 = socket$l2tp6(0xa, 0x2, 0x73)
sendmsg$inet6(r0, &(0x7f0000000980)={&(0x7f00000009c0)={0xa, 0x4e20, 0x180000, @ipv4={'\x00', '\xff\xff', @broadcast}, 0xfffffffb}, 0x1c, 0x0, 0x0, &(0x7f0000000a00)=[@hopopts={{0x18, 0x29, 0x36, {0x56}}}], 0x18}, 0x8040)
executing program 0:
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000700)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(des3_ede)\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000780)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18)
r1 = accept4(r0, 0x0, 0x0, 0x80800)
sendmmsg$alg(r1, &(0x7f00000007c0)=[{0x0, 0x0, &(0x7f0000001140)=[{&(0x7f0000001180)="f78d9ca38fff48", 0x7}, {&(0x7f0000001240)="e870", 0x2}], 0x2}], 0x1, 0x40800)
recvmsg(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000013c0)=[{&(0x7f0000001400)=""/81, 0x51}], 0x1}, 0x0)
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), r0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000006c0)={'wlan0\x00', <r3=>0x0})
sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f00000008c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002dbd0600ffdbdb252100000008000300", @ANYRES32=r3, @ANYBLOB="0600eb00000800000400ec000a00060008021100000100000600f70000ff000008009e"], 0x44}}, 0x0)
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5)
r1 = fcntl$getown(0xffffffffffffffff, 0x9)
sched_setscheduler(r1, 0x1, &(0x7f0000000000))
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r4 = socket(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000000)={0x4800}, 0x10)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFQNL_MSG_CONFIG(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={0x2c, 0x2, 0x3, 0x101, 0x0, 0x0, {0x2}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x2}}, @NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x2}, @NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x2}]}, 0x2c}}, 0x0)
sendmsg$nl_generic(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000003900)={0x24, 0x16, 0xa01, 0x0, 0x0, {0x3}, [@typed={0xfffffffffffffeb6, 0x3ffd}, @typed={0xc, 0xa, 0x0, 0x0, @u64}]}, 0x24}}, 0x8000)
mlockall(0x7)
r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50)
r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xe, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x10, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r6}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r7}, {}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
capset(&(0x7f0000000080)={0x19980330}, &(0x7f0000000040)={0x200000, 0x200000, 0x0, 0x0, 0x9})
unshare(0x6020400)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x3, 0x7)
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
close(r1)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140), r2)
sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c"], 0x38}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000240)={'syzkaller0\x00', @multicast})
writev(r0, &(0x7f0000000280)=[{&(0x7f00000002c0)="89e7ee2c67062f080700000088ca54c2a116121c1e7e9ae9", 0x18}, {&(0x7f0000000300)="f954f8a34b71", 0x6}], 0x2)
executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000001980)={0x2, 0x4e20, @multicast1}, 0x10)
connect$inet(r0, &(0x7f00000019c0)={0x2, 0x4e20, @local}, 0x10)
r1 = socket$kcm(0x29, 0x2, 0x0)
ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f0000003f40)={r0})
sendmmsg$inet(r1, &(0x7f0000003f80)=[{{0x0, 0x0, &(0x7f0000004000)=[{&(0x7f0000004040)=')\x00C', 0x34000}], 0x1}}, {{0x0, 0x0, &(0x7f0000004080)=[{&(0x7f00000040c0)="f5bf5def", 0x4}], 0x1}}], 0x2, 0x0)
executing program 4:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000300)=0x79, 0x4)
bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e23, @multicast1}, 0x10)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000380)={0x1, &(0x7f00000003c0)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10)
sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000400)={0x2, 0x4e23, @local}, 0x10)
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000440)='bbr', 0x3)
sendmmsg$inet(r0, &(0x7f0000000480)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000500)="91f8a984851bdef38491bbc4173c3c6f357d028feff84ab17c417789f9fc9b8572c98172b7319130feaab952ac4703cad04be6890ee50e997fc26e0000ea4feb931647fc5393de25000000000000000000f4922da20bf1f802970c30f03cc271337e892c99bda9475d51361f8b78938a6a68ba85987219000000eb52c9ff439180b413ec4d4fe130b41d113ce7efb5e9838379c5a554eb896f7808d5904cd8da06fd5159085c9275f49e775e92fb106c2f10442d508891e58a3f117fc203f787901de99a6a1b851ff5c85244beacba25d854577d68ca555e88fc249340ab9bdd8680abbbde02b0307ef45cb7ffffffff984c7bbb7bb3c689ef8daa63ca62e496be091cc1c7d4f371acaaec43337aee38542c35292cf3fdbfc45af863017437", 0x11f}, {&(0x7f0000000680)="44900001000056ee66c372f3105eb186dd8062fad2d5b5bfb0ba06f274a8d026bd209da8ffa6a26e3b3f8075704a9d0ef9aff7f1e7db24609f02d34e76992c9df9fe6888c6c9a4825c6223be6ac54536025af1dea54e527c68b0ff250261953f2da79a78104c2d9e7b16ed86b124945aa9ab7581ebd385fb61d442035db81e18c2d2462d0bb25fffe4b81ce90b597992b2a4d541611ce77f58dce7c9500118", 0x9f}], 0x2}}], 0x1, 0x2090)
setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000740)=0xdf8, 0x4)
writev(r0, &(0x7f0000000780)=[{&(0x7f00000007c0)="396cf87d08c5a180ab47bb5bf073f86e645bdcec1582ceaa94028bed754c6a0a9ee51723aba90ee33675431670f9548c745b3da48b83d07d7eccc4eb90a1e0e95fa8b02a190ec6899154b7410e1d84c9", 0x50}], 0x1)
write(r0, &(0x7f00000008c0)="39270725d93c4ab6cb559938ef75d3d7fd5c06a228a59b717b6934bdefb8b8e2dfca955f26b8cab29bdfdce27e4f9cb112fe41e0a6799578f252519cd4a289985be050d209b4c9617cfb94f1bed81696b0c741f6d366efd7ad3dc7cef66647abaf4108076fdffecb7457f5b6b01835a3c79b873f6ebbcb5ee659861a7b4cce43711bbd6b13c941fbb38ef7e1fe0c70fa4aa49b98b43615605d51cc4d742b364a4e7a2f3dee73b86af3fa4ca8f616eaaedcf155820e1767f7d66ecd818ece03f32c3367bbd9ce6656123f394b7f26f1e0420a9ac4cb25638c75fc3c487ba76fd64c26da6d7ce7f1ee8f49d6e9cc95f5c94bf93183ebf8e6be081e0b9f34bd6c2fe5f895dc1cc01e3018cef11ad9e2e1baf35254258efbaf3e8898f561bdb5c4c49f9d3146503df48e194ea3d06396e970ea9fc7c47eb9988477ed1a7e8641dfeea7b57b5a9967c58762574262efde8795f20f2d45e964ede39c7a6502c03f863e6a21a33ba324e6474d4f0495054745f3a80e6554d4d1fd5ddbca11c5e3e6f9087ca1981a14baa3a2956faa8f6b1652e8cf30d7c37a060bc6c836862451c4e76fc9cb221db8d4b449c27aa44564cb33ef144ed0c51bdd66675302692d979297f30e2d9523f85afbbf54c5b5e2261f8b792f83b33cca78c44a5c4e6ff96273979acbb447d49c0502cc9f8991e9bc784a2e978912d8102d867b631d54269936f54bb20ee57e2b4ba4b6c44e767aef24f6c3a8bb5a3b2084d793082e4c5e517694b220e35ac140913e0e55257af03c4dcf376f24773642c14279e2b55906b0b8a4a34fa4d73f37a5feeca1cf93395b998ddcc557d0e2ae112cf1566f7097e7acb6c0bdf9350781341bb83936b355779417839a70c3cbe13e9561b0820df44dbd2a24bd3d6d8b0d9e83983cb7ad8f147f980b06be823e93a93395f5e60b7f31f5aeadc81f02e177446888c15d2845fd675b98360ac2f584a8ab618789499babac77e3311c563fa519a8dbbe49b91a46cc355f8e956c04dfc3b8e218dbe0302ff463fc94eceec7050b7477d9542f6d05d36ee13e664dfc0bb165601e6bd70615f3c299a9c7c7004cc9987a76afc54b3c83e5d23c0790f39593437b2592cf0548f21823f61076340a87dae9d3427acc844357d6bdbba726e7a41eb30a916df698ab241b5e4991f41d34afd2c2b99f259ca582f09c8027c3381e64070aad6ec7f7c7c973d55a33eca3cc4245bf488a497ac966aa13111ec3033172a3512e97700b3b58b621ccb71309d6ccafb05352718a362d14c38501ec45a522fb86563533d1f46e3fc182181ca5583096ec3849fb5db88ba0bcf565ec4665280402275fe98483a6c6b9da4665196aeff9b18c1e4fe3f19f1ff296702a10a27684a6cf0f9c003fd4b20127b080bf82664e51c36a4c4681dd332c6cb068cd11d13dae5f79", 0x3fb)
executing program 4:
syz_emit_ethernet(0x0, 0x0, 0x0)
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000005f40)=[{&(0x7f0000000000)=ANY=[], 0x440}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5, 0x0, 0x0, 0x14000845}, 0x480a4)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r1, &(0x7f0000000200), &(0x7f0000000240)=@tcp6=r0}, 0x20)
ioctl$sock_SIOCINQ(r0, 0x541b, 0x0)
r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8b30, &(0x7f0000000040)={'wlan0\x00'})
executing program 0:
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = dup(0xffffffffffffffff)
prlimit64(0x0, 0xe, &(0x7f0000019280)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f00000192c0)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f0000019300)=0x2)
r1 = getpid()
openat$ptmx(0xffffffffffffff9c, 0x0, 0x6c0000, 0x0)
sched_setscheduler(r1, 0x1, &(0x7f0000019380)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000193c0)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f0000019400)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000019480), 0x318, 0x0)
recvmmsg(r2, &(0x7f00000194c0), 0x10106, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000019500)=0x2)
socket$inet6_tcp(0xa, 0x1, 0x0)
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000019540)='cpuset.effective_cpus\x00', 0x275a, 0x0)
fcntl$lock(r4, 0x26, &(0x7f0000019580)={0x1})
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000004000000080000000a"], 0x48)
r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[], 0x0, 0x5a}, 0x28)
close(0x3)
bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x13, 0x4, 0x4, 0x8001, 0x1104, 0x1, 0xfffffffc}, 0x50)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x6, [@type_tag={0x6, 0x0, 0x0, 0x12, 0x1}]}, {0x0, [0x2e, 0x30, 0x61, 0x5f]}}, 0x0, 0x2a, 0x0, 0x1, 0x3, 0x10000, @value=r0}, 0x28)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={0xffffffffffffffff, 0x0, 0x3, 0x0, &(0x7f0000000280)='\t\x00\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r7 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r7, 0x29, 0x20, &(0x7f0000000300)={@private1, 0x9c940000, 0x0, 0x3, 0x8, 0x1, 0xfffe}, 0x20)
r8 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000340), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_CHANNEL(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x30, r8, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_CHANNEL={0x5, 0x8, 0x4}, @NL802154_ATTR_PAGE={0x5}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000}, 0x4000884)
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x5, 0xb, 0x0, 0x0, 0x1, 0x100000, &(0x7f0000019a00)=""/1048576, 0x0, 0x0, '\x00', 0x0, @fallback, r5, 0x8, &(0x7f0000119a00)={0x0, 0x3}, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
executing program 1:
r0 = socket$pppoe(0x18, 0x1, 0x0)
connect$pppoe(r0, &(0x7f0000000480)={0x18, 0x0, {0x4001, @multicast, 'batadv0\x00'}}, 0x1e)
socket$packet(0x11, 0x2, 0x300)
sendmsg$inet(r0, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x20000010)
executing program 1:
r0 = socket(0x1d, 0x2, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan1\x00', <r1=>0x0})
bind(r0, &(0x7f00000000c0)=@can={0x1d, r1, 0x1, 0x2}, 0x10)
executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001780), 0x40241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000017c0)={'syzkaller1\x00', 0xc201})
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$unix(0x1, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001840)={'syzkaller1\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={0x0}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000001940)={0x0, 0x0, &(0x7f0000001980)={&(0x7f00000019c0)=@newtfilter={0x3c, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xb, 0x5}, {0xfff1, 0xffff}, {0x300, 0x5}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_ENC_IPV4_DST={0x8, 0x1d, @dev={0xac, 0x14, 0x14, 0x43}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x0)

program crashed: WARNING: still has locks held in cfg80211_wext_siwgenie
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/3
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 24, 9, 6, 10, 9, 28, 4, 3, 7]
detailed listing:
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), r0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000006c0)={'wlan0\x00', <r3=>0x0})
sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000880)={&(0x7f00000008c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002dbd0600ffdbdb252100000008000300", @ANYRES32=r3, @ANYBLOB="0600eb00000800000400ec000a00060008021100000100000600f70000ff000008009e"], 0x44}}, 0x0)
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5)
r1 = fcntl$getown(0xffffffffffffffff, 0x9)
sched_setscheduler(r1, 0x1, &(0x7f0000000000))
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r4 = socket(0x10, 0x3, 0x0)
setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000000)={0x4800}, 0x10)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFQNL_MSG_CONFIG(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={0x2c, 0x2, 0x3, 0x101, 0x0, 0x0, {0x2}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x2}}, @NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x2}, @NFQA_CFG_FLAGS={0x8, 0x5, 0x1, 0x0, 0x2}]}, 0x2c}}, 0x0)
sendmsg$nl_generic(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000003900)={0x24, 0x16, 0xa01, 0x0, 0x0, {0x3}, [@typed={0xfffffffffffffeb6, 0x3ffd}, @typed={0xc, 0xa, 0x0, 0x0, @u64}]}, 0x24}}, 0x8000)
mlockall(0x7)
r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50)
r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xe, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x10, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r6}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r7}, {}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
capset(&(0x7f0000000080)={0x19980330}, &(0x7f0000000040)={0x200000, 0x200000, 0x0, 0x0, 0x9})
unshare(0x6020400)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x3, 0x7)
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0)
close(r1)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140), r2)
sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c"], 0x38}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000240)={'syzkaller0\x00', @multicast})
writev(r0, &(0x7f0000000280)=[{&(0x7f00000002c0)="89e7ee2c67062f080700000088ca54c2a116121c1e7e9ae9", 0x18}, {&(0x7f0000000300)="f954f8a34b71", 0x6}], 0x2)
executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000001980)={0x2, 0x4e20, @multicast1}, 0x10)
connect$inet(r0, &(0x7f00000019c0)={0x2, 0x4e20, @local}, 0x10)
r1 = socket$kcm(0x29, 0x2, 0x0)
ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f0000003f40)={r0})
sendmmsg$inet(r1, &(0x7f0000003f80)=[{{0x0, 0x0, &(0x7f0000004000)=[{&(0x7f0000004040)=')\x00C', 0x34000}], 0x1}}, {{0x0, 0x0, &(0x7f0000004080)=[{&(0x7f00000040c0)="f5bf5def", 0x4}], 0x1}}], 0x2, 0x0)
executing program 4:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000300)=0x79, 0x4)
bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e23, @multicast1}, 0x10)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000380)={0x1, &(0x7f00000003c0)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10)
sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000400)={0x2, 0x4e23, @local}, 0x10)
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000440)='bbr', 0x3)
sendmmsg$inet(r0, &(0x7f0000000480)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000500)="91f8a984851bdef38491bbc4173c3c6f357d028feff84ab17c417789f9fc9b8572c98172b7319130feaab952ac4703cad04be6890ee50e997fc26e0000ea4feb931647fc5393de25000000000000000000f4922da20bf1f802970c30f03cc271337e892c99bda9475d51361f8b78938a6a68ba85987219000000eb52c9ff439180b413ec4d4fe130b41d113ce7efb5e9838379c5a554eb896f7808d5904cd8da06fd5159085c9275f49e775e92fb106c2f10442d508891e58a3f117fc203f787901de99a6a1b851ff5c85244beacba25d854577d68ca555e88fc249340ab9bdd8680abbbde02b0307ef45cb7ffffffff984c7bbb7bb3c689ef8daa63ca62e496be091cc1c7d4f371acaaec43337aee38542c35292cf3fdbfc45af863017437", 0x11f}, {&(0x7f0000000680)="44900001000056ee66c372f3105eb186dd8062fad2d5b5bfb0ba06f274a8d026bd209da8ffa6a26e3b3f8075704a9d0ef9aff7f1e7db24609f02d34e76992c9df9fe6888c6c9a4825c6223be6ac54536025af1dea54e527c68b0ff250261953f2da79a78104c2d9e7b16ed86b124945aa9ab7581ebd385fb61d442035db81e18c2d2462d0bb25fffe4b81ce90b597992b2a4d541611ce77f58dce7c9500118", 0x9f}], 0x2}}], 0x1, 0x2090)
setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000740)=0xdf8, 0x4)
writev(r0, &(0x7f0000000780)=[{&(0x7f00000007c0)="396cf87d08c5a180ab47bb5bf073f86e645bdcec1582ceaa94028bed754c6a0a9ee51723aba90ee33675431670f9548c745b3da48b83d07d7eccc4eb90a1e0e95fa8b02a190ec6899154b7410e1d84c9", 0x50}], 0x1)
write(r0, &(0x7f00000008c0)="39270725d93c4ab6cb559938ef75d3d7fd5c06a228a59b717b6934bdefb8b8e2dfca955f26b8cab29bdfdce27e4f9cb112fe41e0a6799578f252519cd4a289985be050d209b4c9617cfb94f1bed81696b0c741f6d366efd7ad3dc7cef66647abaf4108076fdffecb7457f5b6b01835a3c79b873f6ebbcb5ee659861a7b4cce43711bbd6b13c941fbb38ef7e1fe0c70fa4aa49b98b43615605d51cc4d742b364a4e7a2f3dee73b86af3fa4ca8f616eaaedcf155820e1767f7d66ecd818ece03f32c3367bbd9ce6656123f394b7f26f1e0420a9ac4cb25638c75fc3c487ba76fd64c26da6d7ce7f1ee8f49d6e9cc95f5c94bf93183ebf8e6be081e0b9f34bd6c2fe5f895dc1cc01e3018cef11ad9e2e1baf35254258efbaf3e8898f561bdb5c4c49f9d3146503df48e194ea3d06396e970ea9fc7c47eb9988477ed1a7e8641dfeea7b57b5a9967c58762574262efde8795f20f2d45e964ede39c7a6502c03f863e6a21a33ba324e6474d4f0495054745f3a80e6554d4d1fd5ddbca11c5e3e6f9087ca1981a14baa3a2956faa8f6b1652e8cf30d7c37a060bc6c836862451c4e76fc9cb221db8d4b449c27aa44564cb33ef144ed0c51bdd66675302692d979297f30e2d9523f85afbbf54c5b5e2261f8b792f83b33cca78c44a5c4e6ff96273979acbb447d49c0502cc9f8991e9bc784a2e978912d8102d867b631d54269936f54bb20ee57e2b4ba4b6c44e767aef24f6c3a8bb5a3b2084d793082e4c5e517694b220e35ac140913e0e55257af03c4dcf376f24773642c14279e2b55906b0b8a4a34fa4d73f37a5feeca1cf93395b998ddcc557d0e2ae112cf1566f7097e7acb6c0bdf9350781341bb83936b355779417839a70c3cbe13e9561b0820df44dbd2a24bd3d6d8b0d9e83983cb7ad8f147f980b06be823e93a93395f5e60b7f31f5aeadc81f02e177446888c15d2845fd675b98360ac2f584a8ab618789499babac77e3311c563fa519a8dbbe49b91a46cc355f8e956c04dfc3b8e218dbe0302ff463fc94eceec7050b7477d9542f6d05d36ee13e664dfc0bb165601e6bd70615f3c299a9c7c7004cc9987a76afc54b3c83e5d23c0790f39593437b2592cf0548f21823f61076340a87dae9d3427acc844357d6bdbba726e7a41eb30a916df698ab241b5e4991f41d34afd2c2b99f259ca582f09c8027c3381e64070aad6ec7f7c7c973d55a33eca3cc4245bf488a497ac966aa13111ec3033172a3512e97700b3b58b621ccb71309d6ccafb05352718a362d14c38501ec45a522fb86563533d1f46e3fc182181ca5583096ec3849fb5db88ba0bcf565ec4665280402275fe98483a6c6b9da4665196aeff9b18c1e4fe3f19f1ff296702a10a27684a6cf0f9c003fd4b20127b080bf82664e51c36a4c4681dd332c6cb068cd11d13dae5f79", 0x3fb)
executing program 4:
syz_emit_ethernet(0x0, 0x0, 0x0)
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000005f40)=[{&(0x7f0000000000)=ANY=[], 0x440}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5, 0x0, 0x0, 0x14000845}, 0x480a4)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r1, &(0x7f0000000200), &(0x7f0000000240)=@tcp6=r0}, 0x20)
ioctl$sock_SIOCINQ(r0, 0x541b, 0x0)
r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8b30, &(0x7f0000000040)={'wlan0\x00'})
executing program 0:
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = dup(0xffffffffffffffff)
prlimit64(0x0, 0xe, &(0x7f0000019280)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f00000192c0)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f0000019300)=0x2)
r1 = getpid()
openat$ptmx(0xffffffffffffff9c, 0x0, 0x6c0000, 0x0)
sched_setscheduler(r1, 0x1, &(0x7f0000019380)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000193c0)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f0000019400)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000019480), 0x318, 0x0)
recvmmsg(r2, &(0x7f00000194c0), 0x10106, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000019500)=0x2)
socket$inet6_tcp(0xa, 0x1, 0x0)
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000019540)='cpuset.effective_cpus\x00', 0x275a, 0x0)
fcntl$lock(r4, 0x26, &(0x7f0000019580)={0x1})
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000004000000080000000a"], 0x48)
r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[], 0x0, 0x5a}, 0x28)
close(0x3)
bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x13, 0x4, 0x4, 0x8001, 0x1104, 0x1, 0xfffffffc}, 0x50)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x6, [@type_tag={0x6, 0x0, 0x0, 0x12, 0x1}]}, {0x0, [0x2e, 0x30, 0x61, 0x5f]}}, 0x0, 0x2a, 0x0, 0x1, 0x3, 0x10000, @value=r0}, 0x28)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={0xffffffffffffffff, 0x0, 0x3, 0x0, &(0x7f0000000280)='\t\x00\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r7 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r7, 0x29, 0x20, &(0x7f0000000300)={@private1, 0x9c940000, 0x0, 0x3, 0x8, 0x1, 0xfffe}, 0x20)
r8 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000340), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_CHANNEL(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x30, r8, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_CHANNEL={0x5, 0x8, 0x4}, @NL802154_ATTR_PAGE={0x5}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000}, 0x4000884)
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x5, 0xb, 0x0, 0x0, 0x1, 0x100000, &(0x7f0000019a00)=""/1048576, 0x0, 0x0, '\x00', 0x0, @fallback, r5, 0x8, &(0x7f0000119a00)={0x0, 0x3}, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
executing program 1:
r0 = socket$pppoe(0x18, 0x1, 0x0)
connect$pppoe(r0, &(0x7f0000000480)={0x18, 0x0, {0x4001, @multicast, 'batadv0\x00'}}, 0x1e)
socket$packet(0x11, 0x2, 0x300)
sendmsg$inet(r0, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x20000010)
executing program 1:
r0 = socket(0x1d, 0x2, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan1\x00', <r1=>0x0})
bind(r0, &(0x7f00000000c0)=@can={0x1d, r1, 0x1, 0x2}, 0x10)
executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001780), 0x40241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000017c0)={'syzkaller1\x00', 0xc201})
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$unix(0x1, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001840)={'syzkaller1\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={0x0}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000001940)={0x0, 0x0, &(0x7f0000001980)={&(0x7f00000019c0)=@newtfilter={0x3c, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xb, 0x5}, {0xfff1, 0xffff}, {0x300, 0x5}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_ENC_IPV4_DST={0x8, 0x1d, @dev={0xac, 0x14, 0x14, 0x43}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x0)

program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
bisect: the chunk can be dropped
bisect: testing without sub-chunk 3/3
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-ioctl$ifreq_SIOCGIFINDEX_vcan-bind
detailed listing:
executing program 1:
r0 = socket(0x1d, 0x2, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan1\x00', <r1=>0x0})
bind(r0, &(0x7f00000000c0)=@can={0x1d, r1, 0x1, 0x2}, 0x10)

program did not crash
bisect: split chunks (needed=true): <9>
bisect: split chunk #0 of len 9 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 28, 4, 3, 7]
detailed listing:
executing program 4:
syz_emit_ethernet(0x0, 0x0, 0x0)
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000005f40)=[{&(0x7f0000000000)=ANY=[], 0x440}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5, 0x0, 0x0, 0x14000845}, 0x480a4)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r1, &(0x7f0000000200), &(0x7f0000000240)=@tcp6=r0}, 0x20)
ioctl$sock_SIOCINQ(r0, 0x541b, 0x0)
r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8b30, &(0x7f0000000040)={'wlan0\x00'})
executing program 0:
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = dup(0xffffffffffffffff)
prlimit64(0x0, 0xe, &(0x7f0000019280)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f00000192c0)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f0000019300)=0x2)
r1 = getpid()
openat$ptmx(0xffffffffffffff9c, 0x0, 0x6c0000, 0x0)
sched_setscheduler(r1, 0x1, &(0x7f0000019380)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000193c0)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f0000019400)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000019480), 0x318, 0x0)
recvmmsg(r2, &(0x7f00000194c0), 0x10106, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000019500)=0x2)
socket$inet6_tcp(0xa, 0x1, 0x0)
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000019540)='cpuset.effective_cpus\x00', 0x275a, 0x0)
fcntl$lock(r4, 0x26, &(0x7f0000019580)={0x1})
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000004000000080000000a"], 0x48)
r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[], 0x0, 0x5a}, 0x28)
close(0x3)
bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x13, 0x4, 0x4, 0x8001, 0x1104, 0x1, 0xfffffffc}, 0x50)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x6, [@type_tag={0x6, 0x0, 0x0, 0x12, 0x1}]}, {0x0, [0x2e, 0x30, 0x61, 0x5f]}}, 0x0, 0x2a, 0x0, 0x1, 0x3, 0x10000, @value=r0}, 0x28)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={0xffffffffffffffff, 0x0, 0x3, 0x0, &(0x7f0000000280)='\t\x00\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r7 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r7, 0x29, 0x20, &(0x7f0000000300)={@private1, 0x9c940000, 0x0, 0x3, 0x8, 0x1, 0xfffe}, 0x20)
r8 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000340), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_CHANNEL(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x30, r8, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_CHANNEL={0x5, 0x8, 0x4}, @NL802154_ATTR_PAGE={0x5}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000}, 0x4000884)
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x5, 0xb, 0x0, 0x0, 0x1, 0x100000, &(0x7f0000019a00)=""/1048576, 0x0, 0x0, '\x00', 0x0, @fallback, r5, 0x8, &(0x7f0000119a00)={0x0, 0x3}, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
executing program 1:
r0 = socket$pppoe(0x18, 0x1, 0x0)
connect$pppoe(r0, &(0x7f0000000480)={0x18, 0x0, {0x4001, @multicast, 'batadv0\x00'}}, 0x1e)
socket$packet(0x11, 0x2, 0x300)
sendmsg$inet(r0, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x20000010)
executing program 1:
r0 = socket(0x1d, 0x2, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan1\x00', <r1=>0x0})
bind(r0, &(0x7f00000000c0)=@can={0x1d, r1, 0x1, 0x2}, 0x10)
executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001780), 0x40241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000017c0)={'syzkaller1\x00', 0xc201})
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$unix(0x1, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001840)={'syzkaller1\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={0x0}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000001940)={0x0, 0x0, &(0x7f0000001980)={&(0x7f00000019c0)=@newtfilter={0x3c, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xb, 0x5}, {0xfff1, 0xffff}, {0x300, 0x5}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_ENC_IPV4_DST={0x8, 0x1d, @dev={0xac, 0x14, 0x14, 0x43}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x0)

program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <4>
bisect: split chunk #0 of len 4 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 3, 7]
detailed listing:
executing program 1:
r0 = socket$pppoe(0x18, 0x1, 0x0)
connect$pppoe(r0, &(0x7f0000000480)={0x18, 0x0, {0x4001, @multicast, 'batadv0\x00'}}, 0x1e)
socket$packet(0x11, 0x2, 0x300)
sendmsg$inet(r0, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x20000010)
executing program 1:
r0 = socket(0x1d, 0x2, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan1\x00', <r1=>0x0})
bind(r0, &(0x7f00000000c0)=@can={0x1d, r1, 0x1, 0x2}, 0x10)
executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001780), 0x40241, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000017c0)={'syzkaller1\x00', 0xc201})
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$unix(0x1, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000001840)={'syzkaller1\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000001880)={0x0, 0x0, &(0x7f00000018c0)={0x0}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000001940)={0x0, 0x0, &(0x7f0000001980)={&(0x7f00000019c0)=@newtfilter={0x3c, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xb, 0x5}, {0xfff1, 0xffff}, {0x300, 0x5}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_ENC_IPV4_DST={0x8, 0x1d, @dev={0xac, 0x14, 0x14, 0x43}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x0)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 28, 3]
detailed listing:
executing program 4:
syz_emit_ethernet(0x0, 0x0, 0x0)
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000005f40)=[{&(0x7f0000000000)=ANY=[], 0x440}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5, 0x0, 0x0, 0x14000845}, 0x480a4)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r1, &(0x7f0000000200), &(0x7f0000000240)=@tcp6=r0}, 0x20)
ioctl$sock_SIOCINQ(r0, 0x541b, 0x0)
r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8b30, &(0x7f0000000040)={'wlan0\x00'})
executing program 0:
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = dup(0xffffffffffffffff)
prlimit64(0x0, 0xe, &(0x7f0000019280)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f00000192c0)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f0000019300)=0x2)
r1 = getpid()
openat$ptmx(0xffffffffffffff9c, 0x0, 0x6c0000, 0x0)
sched_setscheduler(r1, 0x1, &(0x7f0000019380)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000193c0)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f0000019400)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000019480), 0x318, 0x0)
recvmmsg(r2, &(0x7f00000194c0), 0x10106, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000019500)=0x2)
socket$inet6_tcp(0xa, 0x1, 0x0)
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000019540)='cpuset.effective_cpus\x00', 0x275a, 0x0)
fcntl$lock(r4, 0x26, &(0x7f0000019580)={0x1})
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000004000000080000000a"], 0x48)
r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[], 0x0, 0x5a}, 0x28)
close(0x3)
bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x13, 0x4, 0x4, 0x8001, 0x1104, 0x1, 0xfffffffc}, 0x50)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x6, [@type_tag={0x6, 0x0, 0x0, 0x12, 0x1}]}, {0x0, [0x2e, 0x30, 0x61, 0x5f]}}, 0x0, 0x2a, 0x0, 0x1, 0x3, 0x10000, @value=r0}, 0x28)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={0xffffffffffffffff, 0x0, 0x3, 0x0, &(0x7f0000000280)='\t\x00\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r7 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r7, 0x29, 0x20, &(0x7f0000000300)={@private1, 0x9c940000, 0x0, 0x3, 0x8, 0x1, 0xfffe}, 0x20)
r8 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000340), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_CHANNEL(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x30, r8, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_CHANNEL={0x5, 0x8, 0x4}, @NL802154_ATTR_PAGE={0x5}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000}, 0x4000884)
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x5, 0xb, 0x0, 0x0, 0x1, 0x100000, &(0x7f0000019a00)=""/1048576, 0x0, 0x0, '\x00', 0x0, @fallback, r5, 0x8, &(0x7f0000119a00)={0x0, 0x3}, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
executing program 1:
r0 = socket(0x1d, 0x2, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan1\x00', <r1=>0x0})
bind(r0, &(0x7f00000000c0)=@can={0x1d, r1, 0x1, 0x2}, 0x10)

program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <2>
bisect: split chunk #0 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [28, 3]
detailed listing:
executing program 0:
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
r0 = dup(0xffffffffffffffff)
prlimit64(0x0, 0xe, &(0x7f0000019280)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f00000192c0)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f0000019300)=0x2)
r1 = getpid()
openat$ptmx(0xffffffffffffff9c, 0x0, 0x6c0000, 0x0)
sched_setscheduler(r1, 0x1, &(0x7f0000019380)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000193c0)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f0000019400)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000019480), 0x318, 0x0)
recvmmsg(r2, &(0x7f00000194c0), 0x10106, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000019500)=0x2)
socket$inet6_tcp(0xa, 0x1, 0x0)
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000019540)='cpuset.effective_cpus\x00', 0x275a, 0x0)
fcntl$lock(r4, 0x26, &(0x7f0000019580)={0x1})
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000004000000080000000a"], 0x48)
r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[], 0x0, 0x5a}, 0x28)
close(0x3)
bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x13, 0x4, 0x4, 0x8001, 0x1104, 0x1, 0xfffffffc}, 0x50)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x6, [@type_tag={0x6, 0x0, 0x0, 0x12, 0x1}]}, {0x0, [0x2e, 0x30, 0x61, 0x5f]}}, 0x0, 0x2a, 0x0, 0x1, 0x3, 0x10000, @value=r0}, 0x28)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000200)={0xffffffffffffffff, 0x0, 0x3, 0x0, &(0x7f0000000280)='\t\x00\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r7 = socket$inet6(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r7, 0x29, 0x20, &(0x7f0000000300)={@private1, 0x9c940000, 0x0, 0x3, 0x8, 0x1, 0xfffe}, 0x20)
r8 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000340), 0xffffffffffffffff)
sendmsg$NL802154_CMD_SET_CHANNEL(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x30, r8, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_CHANNEL={0x5, 0x8, 0x4}, @NL802154_ATTR_PAGE={0x5}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000}, 0x4000884)
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x5, 0xb, 0x0, 0x0, 0x1, 0x100000, &(0x7f0000019a00)=""/1048576, 0x0, 0x0, '\x00', 0x0, @fallback, r5, 0x8, &(0x7f0000119a00)={0x0, 0x3}, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
executing program 1:
r0 = socket(0x1d, 0x2, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan1\x00', <r1=>0x0})
bind(r0, &(0x7f00000000c0)=@can={0x1d, r1, 0x1, 0x2}, 0x10)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 3]
detailed listing:
executing program 4:
syz_emit_ethernet(0x0, 0x0, 0x0)
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000005f40)=[{&(0x7f0000000000)=ANY=[], 0x440}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5, 0x0, 0x0, 0x14000845}, 0x480a4)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r1, &(0x7f0000000200), &(0x7f0000000240)=@tcp6=r0}, 0x20)
ioctl$sock_SIOCINQ(r0, 0x541b, 0x0)
r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8b30, &(0x7f0000000040)={'wlan0\x00'})
executing program 1:
r0 = socket(0x1d, 0x2, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan1\x00', <r1=>0x0})
bind(r0, &(0x7f00000000c0)=@can={0x1d, r1, 0x1, 0x2}, 0x10)

program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 2 programs left: 

executing program 4:
syz_emit_ethernet(0x0, 0x0, 0x0)
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000005f40)=[{&(0x7f0000000000)=ANY=[], 0x440}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5, 0x0, 0x0, 0x14000845}, 0x480a4)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r1, &(0x7f0000000200), &(0x7f0000000240)=@tcp6=r0}, 0x20)
ioctl$sock_SIOCINQ(r0, 0x541b, 0x0)
r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8b30, &(0x7f0000000040)={'wlan0\x00'})
executing program 1:
r0 = socket(0x1d, 0x2, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan1\x00', <r1=>0x0})
bind(r0, &(0x7f00000000c0)=@can={0x1d, r1, 0x1, 0x2}, 0x10)


bisect: trying to concatenate
bisect: concatenate 2 entries
minimizing program #0 before concatenation
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 3]
detailed listing:
executing program 0:
syz_emit_ethernet(0x0, 0x0, 0x0)
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000005f40)=[{&(0x7f0000000000)=ANY=[], 0x440}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5, 0x0, 0x0, 0x14000845}, 0x480a4)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r1, &(0x7f0000000200), &(0x7f0000000240)=@tcp6=r0}, 0x20)
ioctl$sock_SIOCINQ(r0, 0x541b, 0x0)
syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
executing program 1:
r0 = socket(0x1d, 0x2, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan1\x00', <r1=>0x0})
bind(r0, &(0x7f00000000c0)=@can={0x1d, r1, 0x1, 0x2}, 0x10)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 3]
detailed listing:
executing program 0:
syz_emit_ethernet(0x0, 0x0, 0x0)
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000005f40)=[{&(0x7f0000000000)=ANY=[], 0x440}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5, 0x0, 0x0, 0x14000845}, 0x480a4)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r1, &(0x7f0000000200), &(0x7f0000000240)=@tcp6=r0}, 0x20)
ioctl$sock_SIOCINQ(r0, 0x541b, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b30, &(0x7f0000000040)={'wlan0\x00'})
executing program 1:
r0 = socket(0x1d, 0x2, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan1\x00', <r1=>0x0})
bind(r0, &(0x7f00000000c0)=@can={0x1d, r1, 0x1, 0x2}, 0x10)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 3]
detailed listing:
executing program 0:
syz_emit_ethernet(0x0, 0x0, 0x0)
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000005f40)=[{&(0x7f0000000000)=ANY=[], 0x440}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5, 0x0, 0x0, 0x14000845}, 0x480a4)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r1, &(0x7f0000000200), &(0x7f0000000240)=@tcp6=r0}, 0x20)
r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8b30, &(0x7f0000000040)={'wlan0\x00'})
executing program 1:
r0 = socket(0x1d, 0x2, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan1\x00', <r1=>0x0})
bind(r0, &(0x7f00000000c0)=@can={0x1d, r1, 0x1, 0x2}, 0x10)

program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 3]
detailed listing:
executing program 0:
syz_emit_ethernet(0x0, 0x0, 0x0)
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000005f40)=[{&(0x7f0000000000)=ANY=[], 0x440}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5, 0x0, 0x0, 0x14000845}, 0x480a4)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8b30, &(0x7f0000000040)={'wlan0\x00'})
executing program 1:
r0 = socket(0x1d, 0x2, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan1\x00', <r1=>0x0})
bind(r0, &(0x7f00000000c0)=@can={0x1d, r1, 0x1, 0x2}, 0x10)

program crashed: WARNING: still has locks held in cfg80211_wext_siwgenie
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 3]
detailed listing:
executing program 0:
syz_emit_ethernet(0x0, 0x0, 0x0)
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000005f40)=[{&(0x7f0000000000)=ANY=[], 0x440}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5, 0x0, 0x0, 0x14000845}, 0x480a4)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
listen(r0, 0x0)
r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8b30, &(0x7f0000000040)={'wlan0\x00'})
executing program 1:
r0 = socket(0x1d, 0x2, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan1\x00', <r1=>0x0})
bind(r0, &(0x7f00000000c0)=@can={0x1d, r1, 0x1, 0x2}, 0x10)

program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 3]
detailed listing:
executing program 0:
syz_emit_ethernet(0x0, 0x0, 0x0)
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000005f40)=[{&(0x7f0000000000)=ANY=[], 0x440}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5, 0x0, 0x0, 0x14000845}, 0x480a4)
socket$inet6_tcp(0xa, 0x1, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b30, &(0x7f0000000040)={'wlan0\x00'})
executing program 1:
r0 = socket(0x1d, 0x2, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan1\x00', <r1=>0x0})
bind(r0, &(0x7f00000000c0)=@can={0x1d, r1, 0x1, 0x2}, 0x10)

program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 3]
detailed listing:
executing program 0:
syz_emit_ethernet(0x0, 0x0, 0x0)
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000005f40)=[{&(0x7f0000000000)=ANY=[], 0x440}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5, 0x0, 0x0, 0x14000845}, 0x480a4)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b30, &(0x7f0000000040)={'wlan0\x00'})
executing program 1:
r0 = socket(0x1d, 0x2, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan1\x00', <r1=>0x0})
bind(r0, &(0x7f00000000c0)=@can={0x1d, r1, 0x1, 0x2}, 0x10)

program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 3]
detailed listing:
executing program 0:
syz_emit_ethernet(0x0, 0x0, 0x0)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b30, &(0x7f0000000040)={'wlan0\x00'})
executing program 1:
r0 = socket(0x1d, 0x2, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan1\x00', <r1=>0x0})
bind(r0, &(0x7f00000000c0)=@can={0x1d, r1, 0x1, 0x2}, 0x10)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 3]
detailed listing:
executing program 0:
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000005f40)=[{&(0x7f0000000000)=ANY=[], 0x440}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5, 0x0, 0x0, 0x14000845}, 0x480a4)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b30, &(0x7f0000000040)={'wlan0\x00'})
executing program 1:
r0 = socket(0x1d, 0x2, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan1\x00', <r1=>0x0})
bind(r0, &(0x7f00000000c0)=@can={0x1d, r1, 0x1, 0x2}, 0x10)

program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
minimized 9 calls -> 3 calls
minimizing program #1 before concatenation
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 2]
detailed listing:
executing program 4:
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000005f40)=[{&(0x7f0000000000)=ANY=[], 0x440}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5, 0x0, 0x0, 0x14000845}, 0x480a4)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b30, &(0x7f0000000040)={'wlan0\x00'})
executing program 0:
r0 = socket(0x1d, 0x2, 0x6)
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan1\x00'})

program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 1]
detailed listing:
executing program 4:
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000005f40)=[{&(0x7f0000000000)=ANY=[], 0x440}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5, 0x0, 0x0, 0x14000845}, 0x480a4)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b30, &(0x7f0000000040)={'wlan0\x00'})
executing program 0:
socket(0x1d, 0x2, 0x6)

program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 0]
detailed listing:
executing program 4:
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000005f40)=[{&(0x7f0000000000)=ANY=[], 0x440}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5, 0x0, 0x0, 0x14000845}, 0x480a4)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b30, &(0x7f0000000040)={'wlan0\x00'})
executing program 0:

program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
minimized 3 calls -> 0 calls
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$netlink-syz_init_net_socket$bt_l2cap-ioctl$sock_SIOCGIFINDEX_80211
detailed listing:
executing program 0:
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000005f40)=[{&(0x7f0000000000)=ANY=[], 0x440}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5, 0x0, 0x0, 0x14000845}, 0x480a4)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b30, &(0x7f0000000040)={'wlan0\x00'})

program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
bisect: concatenation succeeded
found reproducer with 3 syscalls
minimizing guilty program
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$netlink-syz_init_net_socket$bt_l2cap
detailed listing:
executing program 0:
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000005f40)=[{&(0x7f0000000000)=ANY=[], 0x440}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5, 0x0, 0x0, 0x14000845}, 0x480a4)
syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$netlink-ioctl$sock_SIOCGIFINDEX_80211
detailed listing:
executing program 0:
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000005f40)=[{&(0x7f0000000000)=ANY=[], 0x440}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5, 0x0, 0x0, 0x14000845}, 0x480a4)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b30, &(0x7f0000000040)={'wlan0\x00'})

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-ioctl$sock_SIOCGIFINDEX_80211
detailed listing:
executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b30, &(0x7f0000000040)={'wlan0\x00'})

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$netlink-syz_init_net_socket$bt_l2cap-ioctl$sock_SIOCGIFINDEX_80211
detailed listing:
executing program 0:
sendmsg$netlink(0xffffffffffffffff, 0x0, 0x480a4)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b30, &(0x7f0000000040)={'wlan0\x00'})

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$netlink-syz_init_net_socket$bt_l2cap-ioctl$sock_SIOCGIFINDEX_80211
detailed listing:
executing program 0:
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14000845}, 0x480a4)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b30, &(0x7f0000000040)={'wlan0\x00'})

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$netlink-syz_init_net_socket$bt_l2cap-ioctl$sock_SIOCGIFINDEX_80211
detailed listing:
executing program 0:
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000005f40), 0x0, 0x0, 0x0, 0x14000845}, 0x480a4)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b30, &(0x7f0000000040)={'wlan0\x00'})

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$netlink-syz_init_net_socket$bt_l2cap-ioctl$sock_SIOCGIFINDEX_80211
detailed listing:
executing program 0:
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000005f40)=[{0x0, 0x440}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5, 0x0, 0x0, 0x14000845}, 0x480a4)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b30, &(0x7f0000000040)={'wlan0\x00'})

program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$netlink-syz_init_net_socket$bt_l2cap-ioctl$sock_SIOCGIFINDEX_80211
detailed listing:
executing program 0:
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000005f40)=[{0x0, 0x440}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5, 0x0, 0x0, 0x14000845}, 0x480a4)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b30, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$netlink-syz_init_net_socket$bt_l2cap-ioctl$sock_SIOCGIFINDEX_80211
program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
simplifying C reproducer
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$netlink-syz_init_net_socket$bt_l2cap-ioctl$sock_SIOCGIFINDEX_80211
program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$netlink-syz_init_net_socket$bt_l2cap-ioctl$sock_SIOCGIFINDEX_80211
program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$netlink-syz_init_net_socket$bt_l2cap-ioctl$sock_SIOCGIFINDEX_80211
program did not crash
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$netlink-syz_init_net_socket$bt_l2cap-ioctl$sock_SIOCGIFINDEX_80211
program crashed: WARNING: lock held when returning to user space!
a never seen crash title: WARNING: lock held when returning to user space!, ignore
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$netlink-syz_init_net_socket$bt_l2cap-ioctl$sock_SIOCGIFINDEX_80211
program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$netlink-syz_init_net_socket$bt_l2cap-ioctl$sock_SIOCGIFINDEX_80211
program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$netlink-syz_init_net_socket$bt_l2cap-ioctl$sock_SIOCGIFINDEX_80211
program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$netlink-syz_init_net_socket$bt_l2cap-ioctl$sock_SIOCGIFINDEX_80211
program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$netlink-syz_init_net_socket$bt_l2cap-ioctl$sock_SIOCGIFINDEX_80211
program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$netlink-syz_init_net_socket$bt_l2cap-ioctl$sock_SIOCGIFINDEX_80211
program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$netlink-syz_init_net_socket$bt_l2cap-ioctl$sock_SIOCGIFINDEX_80211
program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$netlink-syz_init_net_socket$bt_l2cap-ioctl$sock_SIOCGIFINDEX_80211
program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$netlink-syz_init_net_socket$bt_l2cap-ioctl$sock_SIOCGIFINDEX_80211
program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$netlink-syz_init_net_socket$bt_l2cap-ioctl$sock_SIOCGIFINDEX_80211
program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$netlink-syz_init_net_socket$bt_l2cap-ioctl$sock_SIOCGIFINDEX_80211
program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
testing program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$netlink-syz_init_net_socket$bt_l2cap-ioctl$sock_SIOCGIFINDEX_80211
detailed listing:
executing program 0:
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000005f40)=[{0x0, 0x440}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5, 0x0, 0x0, 0x14000845}, 0x480a4)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b30, &(0x7f0000000040)={'wlan0\x00'})

program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
validation run: crashed=true
testing program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$netlink-syz_init_net_socket$bt_l2cap-ioctl$sock_SIOCGIFINDEX_80211
detailed listing:
executing program 0:
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000005f40)=[{0x0, 0x440}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5, 0x0, 0x0, 0x14000845}, 0x480a4)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b30, &(0x7f0000000040)={'wlan0\x00'})

program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
validation run: crashed=true
testing program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$netlink-syz_init_net_socket$bt_l2cap-ioctl$sock_SIOCGIFINDEX_80211
detailed listing:
executing program 0:
sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000005f40)=[{0x0, 0x440}, {0x0}, {0x0}, {0x0}, {0x0}], 0x5, 0x0, 0x0, 0x14000845}, 0x480a4)
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b30, &(0x7f0000000040)={'wlan0\x00'})

program crashed: WARNING: lock held when returning to user space in cfg80211_wext_siwgenie
validation run: crashed=true
reproducing took 45m35.795367845s
repro crashed as (corrupted=false):
================================================
WARNING: lock held when returning to user space!
syzkaller #0 Not tainted
------------------------------------------------
syz.0.17/4462 is leaving the kernel with locks still held!
1 lock held by syz.0.17/4462:
 #0: ffff88802769cd40 (&wdev->mtx){+.+.}-{3:3}, at: wdev_lock net/wireless/core.h:231 [inline]
 #0: ffff88802769cd40 (&wdev->mtx){+.+.}-{3:3}, at: cfg80211_wext_siwgenie+0xd4/0x3f0 net/wireless/wext-sme.c:340

final repro crashed as (corrupted=false):
================================================
WARNING: lock held when returning to user space!
syzkaller #0 Not tainted
------------------------------------------------
syz.0.17/4462 is leaving the kernel with locks still held!
1 lock held by syz.0.17/4462:
 #0: ffff88802769cd40 (&wdev->mtx){+.+.}-{3:3}, at: wdev_lock net/wireless/core.h:231 [inline]
 #0: ffff88802769cd40 (&wdev->mtx){+.+.}-{3:3}, at: cfg80211_wext_siwgenie+0xd4/0x3f0 net/wireless/wext-sme.c:340