Extracting prog: 6m55.094248523s
Minimizing prog: 13m40.147990921s
Simplifying prog options: 0s
Extracting C: 48.131612518s
Simplifying C: 9m50.687280376s


extracting reproducer from 30 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={0x1c, 0x2e, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0x4, 0x1d, 0x0, 0x0, @binary}, @typed={0x4, 0x1e}]}, 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x0)

program did not crash
single: failed to extract reproducer
bisect: bisecting 30 programs with base timeout 30s
testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2]
detailed listing:
executing program 2:
r0 = socket(0x2, 0x3, 0xff)
sendmmsg$inet(r0, &(0x7f0000004cc0)=[{{&(0x7f0000000000)={0x2, 0x4e21, @multicast1}, 0x10, &(0x7f0000001480)=[{&(0x7f0000000300)="f5a7933a000b00"/20, 0x14}], 0x1, &(0x7f0000001500)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @local}}}], 0x20}}, {{&(0x7f00000000c0)={0x2, 0x4e23, @rand_addr=0x64010102}, 0x10, 0x0, 0x0, &(0x7f0000000340)=[@ip_retopts={{0x10}}], 0x10}}], 0x2, 0x20044000)
executing program 2:
r0 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="2c000000680001002cbd7000fddbdb250200000000000000080001000200000008000500", @ANYRES32=0x0, @ANYBLOB="040006"], 0x2c}, 0x1, 0x0, 0x0, 0x4402}, 0x100000000000000)
executing program 2:
r0 = socket$inet6_icmp(0xa, 0x2, 0x3a)
sendmsg$inet6(r0, &(0x7f0000000240)={&(0x7f0000000180)={0xa, 0x4e23, 0x1, @local, 0x38a}, 0x1c, &(0x7f0000000b00)=[{&(0x7f0000000400)="80004b77efe55463", 0x8}], 0x1, &(0x7f00000002c0)=ANY=[], 0x1}, 0x4)
executing program 2:
r0 = socket$packet(0x11, 0x3, 0x300)
bind$packet(r0, &(0x7f0000000080)={0x11, 0x2, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x14)
executing program 1:
r0 = socket(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f000000a280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b00)=@newtaction={0x14, 0x5a, 0x301, 0x0, 0x0, {0x2}}, 0x14}}, 0x0)
executing program 1:
r0 = socket(0x10, 0x3, 0x0)
sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000940)={0x184, 0x19, 0x1, 0x70bd28, 0x25dfdbfb, {0x1d, 0xd601, 0x9}, [@nested={0x50, 0x12, 0x0, 0x1, [@nested={0x4c, 0xd5, 0x0, 0x1, [@nested={0x45, 0xcd, 0x0, 0x1, [@generic="4b2f4058ee43e9c8ed94431e2f1d57e3ad39148a610738f2f8f2ad25690e8fcf14fa110708387d9119de25eadf839f7130586836f1e818d079d089f8b19dc3a718"]}]}]}, @nested={0x120, 0x6, 0x0, 0x1, [@nested={0x11c, 0xa9, 0x0, 0x1, [@nested={0x118, 0x13e, 0x0, 0x1, [@nested={0x114, 0xa0, 0x0, 0x1, [@nested={0x110, 0x61, 0x0, 0x1, [@nested={0x10c, 0x6d, 0x0, 0x1, [@nested={0x108, 0xd1, 0x0, 0x1, [@nested={0x104, 0x112, 0x0, 0x1, [@nested={0x100, 0xcd, 0x0, 0x1, [@typed={0x8, 0x6e, 0x0, 0x0, @u32=0x200}, @nested={0xf1, 0x28, 0x0, 0x1, [@generic="d207939c67b25bffc41d4d695c82836b5ea29b00e57810da8d14b51231b5426968d9ee3a680b7c1fadd2de690670e6c281b5dcb762405af75922551d9a5d3a5640d65eb339f42e9fa7f4fc3ad41f650fbdb96174ab879d5e1be96370dae3a416c72e30d0b7eaf339b617096f8597f3126cf741b8f2219c85711bf6a22b89e110d916625846d10c31e8e749bdcdfae751921f5156b1d5560bbbca13eb020f9080163775eebc5592056d1787e943411144eb6440d9", @generic="0051906ea3f768578c3e11d39e0b7695038d441951d6ecda508cb547cc22996d3b4355409b", @nested={0x4, 0x41}, @nested={0x10, 0xc6, 0x0, 0x1, [@nested={0xc, 0xcb, 0x0, 0x1, [@typed={0x8, 0x13e, 0x0, 0x0, @pid}]}]}]}]}]}]}]}]}]}]}]}]}]}, 0x184}, 0x1, 0x0, 0x0, 0x5}, 0xc0)
executing program 3:
r0 = socket(0x2d, 0x2, 0x0)
getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x11d, 0x1b, 0x0, &(0x7f00000021c0))
executing program 2:
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000001f00)=ANY=[@ANYBLOB="200000005e00250e13000000000000000c000080eeb67c8e670527ab04000180"], 0x20}], 0x1}, 0x0)
executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000840)=ANY=[@ANYBLOB="340000001100010026bd7000ffdbdf0500000000", @ANYRES32=0x0, @ANYBLOB="2bda00000000040014003d"], 0x34}, 0x1, 0x200000000000000, 0x0, 0x10}, 0x0)
executing program 3:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x5c, 0x2, 0x6, 0x3, 0x0, 0x0, {0x0, 0x0, 0x7}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8, 0x13, 0x0}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4004000}, 0x20004000)
executing program 1:
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$sock_int(r0, 0x29, 0x33, 0x0, 0x0)
executing program 2:
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
recvmmsg(r0, &(0x7f0000005c80), 0x400030f, 0x0, 0x0)
executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)=@newtaction={0x44, 0x30, 0xffff, 0x0, 0x0, {}, [{0x30, 0x1, [@m_ife={0x2c, 0x1, 0x0, 0x0, {{0x8, 0xf5}, {0x4}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0xd94ac76b42879f9f}, 0x0)
executing program 0:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_STAT_GET(r0, &(0x7f0000000200)={0x0, 0xfffffffffffffd3f, &(0x7f00000001c0)={&(0x7f0000000140)={0x20, 0x1411, 0x1, 0x70bd2a, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_STAT_RES={0x8, 0x4b, 0x28}, @RDMA_NLDEV_ATTR_STAT_COUNTER_ID={0x0, 0x4f, 0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0x24008855}, 0x40000c0)
executing program 1:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r0, 0x29, 0x16, 0x0, 0x0)
executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
setsockopt$netlink_NETLINK_RX_RING(r0, 0x10e, 0x6, &(0x7f00000007c0)={0x8, 0xffffffff, 0x2, 0xfffffffc}, 0x10)
executing program 3:
r0 = socket$inet(0x2, 0x2, 0x1)
bind$unix(r0, &(0x7f0000000640)=@abs={0x0, 0x0, 0x4e22}, 0x6e)
executing program 0:
r0 = socket(0x10, 0x3, 0x0)
sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x52, 0x1, 0x0, 0x0, {0x1c}, [@typed={0xe, 0x1, 0x0, 0x0, @str='\\,$!*(,,&\x00'}]}, 0x24}}, 0x0)
executing program 3:
r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000040)={'dummy0\x00', &(0x7f0000000080)=@ethtool_pauseparam={0x26, 0x8000, 0x81, 0x8}})
executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_ACTIVE_SLAVE={0x8}, @IFLA_BOND_MODE={0x5, 0x1, 0x6}]}}}]}, 0x44}}, 0x0)
executing program 0:
r0 = socket(0x2a, 0x2, 0x0)
ioctl$sock_SIOCETHTOOL(r0, 0x89b0, &(0x7f0000000180)={'veth0_virt_wifi\x00', &(0x7f00000001c0)=@ethtool_cmd={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [0x100000]}})
executing program 4:
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
setsockopt$inet6_tcp_int(r0, 0x6, 0x2, &(0x7f00000001c0)=0x3, 0x4)
executing program 0:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000100)={0x101, 0x7, 0x8008, 0x2, 0x4, 0x1, 0x9, 0x6bf639bc}, 0x20)
executing program 3:
r0 = socket$nl_crypto(0x10, 0x3, 0x15)
sendmsg$netlink(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000080)={0xe0, 0x10, 0x509, 0x0, 0x0, "", [@generic="6f6d8864d22a3f2ffaa46c88bc", @typed={0xa9, 0x0, 0x0, 0x0, @binary="2b0e13e735a3184f123d6da2f1acfac0ee2dd2b184b27db1f302de337c0004060000000000bf852c8986626691b01b2d44e4ce28715f28bdda0a9423debbb86f9dba4a2dba4dbe076c28282900c446a567de243ab0d67683f7bb11c9cab3b3eed8a8bef4ff1631aa78acefca03c1a66db4424a8ba100022db228bb7b5eb5100e434db5dd5e995aa0912086d9f4606d2e4cc898739222c5d3a83cb6b707f3336336ebb7d681"}, @nested={0x14, 0x0, 0x0, 0x1, [@typed={0xd, 0x0, 0x0, 0x0, @binary="cfe7336f91087ba18b"}]}]}, 0xe0}], 0x1}, 0x0)
executing program 4:
r0 = socket$inet6(0xa, 0x5, 0x0)
ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000006c0)={'wlan0\x00', &(0x7f0000000000)=@ethtool_stats={0x11, 0x3, [0x1, 0x200, 0x4]}})
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x8000000004)
writev(r0, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f020004000000000000000058000b4824ca945f64009400ff0325010ebc000b00000000008000f0fffeffe809005300fff5dd000000100001d80cf42098da03870000000000", 0x58}], 0x1)
executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newlink={0x50, 0x10, 0xf11, 0x70bd26, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4002}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x20, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MACADDR_DATA={0x10, 0x5, 0x0, 0x1, [{0xa}]}, @IFLA_MACVLAN_MACADDR={0xa, 0x4, @local}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x44001}, 0x0)
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={0x1c, 0x2e, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0x4, 0x1d, 0x0, 0x0, @binary}, @typed={0x4, 0x1e}]}, 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x0)
executing program 3:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="780000000706010100000000000000000a00000005000400020000000900020073797a32000000002c00078008000640000000da08001340000007ff0800134000001000050015000c00000008001240000000050500050002000000050001"], 0x78}, 0x1, 0x0, 0x0, 0x80820}, 0x80)
executing program 4:
r0 = socket$unix(0x1, 0x2, 0x0)
ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000100)=@ethtool_ringparam={0xa, 0x0, 0x300}})

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={0x1c, 0x2e, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0x4, 0x1d, 0x0, 0x0, @binary}, @typed={0x4, 0x1e}]}, 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x0)

program crashed: WARNING in wiphy_register
single: successfully extracted reproducer
found reproducer with 2 syscalls
minimizing guilty program
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic
detailed listing:
executing program 0:
socket$nl_generic(0x10, 0x3, 0x10)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$nl_generic
detailed listing:
executing program 0:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={0x1c, 0x2e, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0x4, 0x1d, 0x0, 0x0, @binary}, @typed={0x4, 0x1e}]}, 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, 0x0, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x42804}, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x42804}, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
program crashed: WARNING in wiphy_register
simplifying C reproducer
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
program crashed: WARNING in wiphy_register
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
program crashed: WARNING in wiphy_register
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
program crashed: WARNING in wiphy_register
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
program crashed: WARNING in wiphy_register
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
program crashed: WARNING in wiphy_register
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
program crashed: WARNING in wiphy_register
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
program crashed: WARNING in wiphy_register
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={0x1c, 0x2e, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0x4, 0x1d, 0x0, 0x0, @binary}, @typed={0x4, 0x1e}]}, 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x0)

program crashed: WARNING in wiphy_register
validation run: crashed=true
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={0x1c, 0x2e, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0x4, 0x1d, 0x0, 0x0, @binary}, @typed={0x4, 0x1e}]}, 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x0)

program crashed: WARNING in wiphy_register
validation run: crashed=true
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={0x1c, 0x2e, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0x4, 0x1d, 0x0, 0x0, @binary}, @typed={0x4, 0x1e}]}, 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x0)

program crashed: WARNING in wiphy_register
validation run: crashed=true
reproducing took 36m23.267106464s
repro crashed as (corrupted=false):
------------[ cut here ]------------
(wiphy->interface_modes & BIT(NL80211_IFTYPE_NAN_DATA)) && (!wiphy->nan_capa.phy.ht.ht_supported || wiphy->n_radio > 1)
WARNING: net/wireless/core.c:885 at wiphy_register+0x58a/0x2fe0 net/wireless/core.c:884, CPU#0: syz.0.17/5819
Modules linked in:
CPU: 0 UID: 0 PID: 5819 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:wiphy_register+0x58a/0x2fe0 net/wireless/core.c:884
Code: 00 00 e8 49 8f d4 f6 90 0f 0b 90 e9 67 0a 00 00 e8 3b 8f d4 f6 e9 59 0a 00 00 e8 31 8f d4 f6 e9 eb 00 00 00 e8 27 8f d4 f6 90 <0f> 0b 90 e9 45 0a 00 00 44 89 f8 24 06 0f b6 d8 31 ff 89 de e8 0d
RSP: 0018:ffffc90003406860 EFLAGS: 00010293
RAX: ffffffff8af13fe2 RBX: 0000000000000004 RCX: ffff888027e68000
RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001
RBP: ffffc900034069f0 R08: ffff88807db90faf R09: 1ffff1100fb721f5
R10: dffffc0000000000 R11: ffffed100fb721f6 R12: ffff88807db90740
R13: dffffc0000000000 R14: ffffffff8d002990 R15: ffff88807db90804
FS:  000055555f850500(0000) GS:ffff888125289000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fdadd072700 CR3: 0000000075c8e000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 ieee80211_register_hw+0x3c53/0x4910 net/mac80211/main.c:1627
 mac80211_hwsim_new_radio+0x3327/0x57e0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:6047
 hwsim_new_radio_nl+0xe20/0x26e0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:6832
 genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1114
 genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline]
 genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1209
 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2551
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x75c/0x8e0 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1895
 sock_sendmsg_nosec net/socket.c:787 [inline]
 __sock_sendmsg net/socket.c:802 [inline]
 ____sys_sendmsg+0x972/0x9f0 net/socket.c:2698
 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2752
 __sys_sendmsg net/socket.c:2784 [inline]
 __do_sys_sendmsg net/socket.c:2789 [inline]
 __se_sys_sendmsg net/socket.c:2787 [inline]
 __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2787
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fdadd19cdd9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd03fe8018 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fdadd415fa0 RCX: 00007fdadd19cdd9
RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003
RBP: 00007fdadd232d69 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fdadd415fac R14: 00007fdadd415fa0 R15: 00007fdadd415fa0
 </TASK>

final repro crashed as (corrupted=false):
------------[ cut here ]------------
(wiphy->interface_modes & BIT(NL80211_IFTYPE_NAN_DATA)) && (!wiphy->nan_capa.phy.ht.ht_supported || wiphy->n_radio > 1)
WARNING: net/wireless/core.c:885 at wiphy_register+0x58a/0x2fe0 net/wireless/core.c:884, CPU#0: syz.0.17/5819
Modules linked in:
CPU: 0 UID: 0 PID: 5819 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:wiphy_register+0x58a/0x2fe0 net/wireless/core.c:884
Code: 00 00 e8 49 8f d4 f6 90 0f 0b 90 e9 67 0a 00 00 e8 3b 8f d4 f6 e9 59 0a 00 00 e8 31 8f d4 f6 e9 eb 00 00 00 e8 27 8f d4 f6 90 <0f> 0b 90 e9 45 0a 00 00 44 89 f8 24 06 0f b6 d8 31 ff 89 de e8 0d
RSP: 0018:ffffc90003406860 EFLAGS: 00010293
RAX: ffffffff8af13fe2 RBX: 0000000000000004 RCX: ffff888027e68000
RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001
RBP: ffffc900034069f0 R08: ffff88807db90faf R09: 1ffff1100fb721f5
R10: dffffc0000000000 R11: ffffed100fb721f6 R12: ffff88807db90740
R13: dffffc0000000000 R14: ffffffff8d002990 R15: ffff88807db90804
FS:  000055555f850500(0000) GS:ffff888125289000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fdadd072700 CR3: 0000000075c8e000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 ieee80211_register_hw+0x3c53/0x4910 net/mac80211/main.c:1627
 mac80211_hwsim_new_radio+0x3327/0x57e0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:6047
 hwsim_new_radio_nl+0xe20/0x26e0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:6832
 genl_family_rcv_msg_doit+0x22a/0x330 net/netlink/genetlink.c:1114
 genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline]
 genl_rcv_msg+0x61c/0x7a0 net/netlink/genetlink.c:1209
 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2551
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x75c/0x8e0 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1895
 sock_sendmsg_nosec net/socket.c:787 [inline]
 __sock_sendmsg net/socket.c:802 [inline]
 ____sys_sendmsg+0x972/0x9f0 net/socket.c:2698
 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2752
 __sys_sendmsg net/socket.c:2784 [inline]
 __do_sys_sendmsg net/socket.c:2789 [inline]
 __se_sys_sendmsg net/socket.c:2787 [inline]
 __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2787
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fdadd19cdd9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd03fe8018 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fdadd415fa0 RCX: 00007fdadd19cdd9
RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003
RBP: 00007fdadd232d69 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fdadd415fac R14: 00007fdadd415fa0 R15: 00007fdadd415fa0
 </TASK>