Extracting prog: 3m17.468498283s
Minimizing prog: 1h29m39.36611186s
Simplifying prog options: 0s
Extracting C: 1m4.834174584s
Simplifying C: 20m50.054270082s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-openat-pwrite64-ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS-bpf$MAP_CREATE-read-pselect6-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_DEL-socket$nl_generic-rt_sigqueueinfo-socket$nl_netfilter-openat$audio1-write$dsp-sendmsg$NFT_BATCH-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_S_FMT-sendmsg$NL80211_CMD_JOIN_OCB-socket$inet_sctp-mmap-mbind-mbind-mbind-ioctl$sock_inet_SIOCRTMSG-syz_80211_inject_frame
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x8)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfe, 0x5}, 0x1, 0x1, 0x0, {}, 0xe, 0x7})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0xffff, 0x0, 0x8, 0x800, r0, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x3}, 0x50)
read(r1, &(0x7f0000000540)=""/75, 0x4b)
pselect6(0x99, &(0x7f00000003c0)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r3=>0x0})
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x34, 0x0, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'pimreg\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x34}}, 0x20000004)
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)={0x34, 0x0, 0x1, 0x70bd27, 0x25dfdbff, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'bridge0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x8004)
sendmsg$SMC_PNETID_DEL(r2, &(0x7f00000005c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f0000000740)={0x48, 0x0, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6gretap0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wlan1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x4014850}, 0x800)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
rt_sigqueueinfo(0x0, 0x9, &(0x7f000000df80)={0x0, 0x0, 0xffffffc0})
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
r6 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000140), 0x80000, 0x0)
write$dsp(r6, &(0x7f0000000400)="a2f0b1ba5bdce46d9268ba8cb92ff9c50869f563ae85960b63ce563a485ac82fce633d4894fa10e557bdca91414642965a6dd5bf55e3673c3f8153756f28aa5497b37a0e80588ea6449be67c037c0efbea0fc588e368f8a8811d680138757afe7c2febc697637e1e442f473edf5b4def55f6aebaae5438983083f0e04bf4c2c02cfaacd99ad8ca5011956d3cd20e499d7c9a32d72e66725b6585c1fbacdbbd6d39a3b05f27678b35", 0xa8)
sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @objref={{0xb}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz1\x00'}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0xb}]}}}]}]}], {0x14}}, 0xc8}}, 0x4004)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r7, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
r8 = syz_open_dev$vim2m(&(0x7f0000000000), 0x79, 0x2)
ioctl$vim2m_VIDIOC_S_FMT(r8, 0xc0d05605, &(0x7f0000000040)={0x1, @pix={0x0, 0x0, 0x3132564e}})
sendmsg$NL80211_CMD_JOIN_OCB(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r7, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
r9 = socket$inet_sctp(0x2, 0x5, 0x84)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0)
mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8003, &(0x7f0000000000)=0x9, 0x8, 0x0)
mbind(&(0x7f00005f7000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x4, 0x0)
mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x8000, 0x0, 0x2, 0x2)
ioctl$sock_inet_SIOCRTMSG(r9, 0x890d, 0x0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-openat-pwrite64-ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS-bpf$MAP_CREATE-read-pselect6-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_DEL-socket$nl_generic-rt_sigqueueinfo-socket$nl_netfilter-openat$audio1-write$dsp-sendmsg$NFT_BATCH-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_S_FMT-sendmsg$NL80211_CMD_JOIN_OCB-socket$inet_sctp-mmap-mbind-mbind-mbind-ioctl$sock_inet_SIOCRTMSG-syz_80211_inject_frame
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x8)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfe, 0x5}, 0x1, 0x1, 0x0, {}, 0xe, 0x7})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0xffff, 0x0, 0x8, 0x800, r0, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x3}, 0x50)
read(r1, &(0x7f0000000540)=""/75, 0x4b)
pselect6(0x99, &(0x7f00000003c0)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r3=>0x0})
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x34, 0x0, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'pimreg\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x34}}, 0x20000004)
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)={0x34, 0x0, 0x1, 0x70bd27, 0x25dfdbff, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'bridge0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x8004)
sendmsg$SMC_PNETID_DEL(r2, &(0x7f00000005c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f0000000740)={0x48, 0x0, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6gretap0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wlan1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x4014850}, 0x800)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
rt_sigqueueinfo(0x0, 0x9, &(0x7f000000df80)={0x0, 0x0, 0xffffffc0})
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
r6 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000140), 0x80000, 0x0)
write$dsp(r6, &(0x7f0000000400)="a2f0b1ba5bdce46d9268ba8cb92ff9c50869f563ae85960b63ce563a485ac82fce633d4894fa10e557bdca91414642965a6dd5bf55e3673c3f8153756f28aa5497b37a0e80588ea6449be67c037c0efbea0fc588e368f8a8811d680138757afe7c2febc697637e1e442f473edf5b4def55f6aebaae5438983083f0e04bf4c2c02cfaacd99ad8ca5011956d3cd20e499d7c9a32d72e66725b6585c1fbacdbbd6d39a3b05f27678b35", 0xa8)
sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @objref={{0xb}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz1\x00'}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0xb}]}}}]}]}], {0x14}}, 0xc8}}, 0x4004)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r7, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
r8 = syz_open_dev$vim2m(&(0x7f0000000000), 0x79, 0x2)
ioctl$vim2m_VIDIOC_S_FMT(r8, 0xc0d05605, &(0x7f0000000040)={0x1, @pix={0x0, 0x0, 0x3132564e}})
sendmsg$NL80211_CMD_JOIN_OCB(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r7, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
r9 = socket$inet_sctp(0x2, 0x5, 0x84)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0)
mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8003, &(0x7f0000000000)=0x9, 0x8, 0x0)
mbind(&(0x7f00005f7000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x4, 0x0)
mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x8000, 0x0, 0x2, 0x2)
ioctl$sock_inet_SIOCRTMSG(r9, 0x890d, 0x0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program crashed: WARNING in mac80211_hwsim_sta_rc_update
single: successfully extracted reproducer
found reproducer with 30 syscalls
minimizing guilty program
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-openat-pwrite64-ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS-bpf$MAP_CREATE-read-pselect6-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_DEL-socket$nl_generic-rt_sigqueueinfo-socket$nl_netfilter-openat$audio1-write$dsp-sendmsg$NFT_BATCH-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_S_FMT-sendmsg$NL80211_CMD_JOIN_OCB-socket$inet_sctp-mmap-mbind-mbind-mbind-ioctl$sock_inet_SIOCRTMSG
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x8)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfe, 0x5}, 0x1, 0x1, 0x0, {}, 0xe, 0x7})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0xffff, 0x0, 0x8, 0x800, r0, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x3}, 0x50)
read(r1, &(0x7f0000000540)=""/75, 0x4b)
pselect6(0x99, &(0x7f00000003c0)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r3=>0x0})
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x34, 0x0, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'pimreg\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x34}}, 0x20000004)
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)={0x34, 0x0, 0x1, 0x70bd27, 0x25dfdbff, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'bridge0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x8004)
sendmsg$SMC_PNETID_DEL(r2, &(0x7f00000005c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f0000000740)={0x48, 0x0, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6gretap0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wlan1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x4014850}, 0x800)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
rt_sigqueueinfo(0x0, 0x9, &(0x7f000000df80)={0x0, 0x0, 0xffffffc0})
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
r6 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000140), 0x80000, 0x0)
write$dsp(r6, &(0x7f0000000400)="a2f0b1ba5bdce46d9268ba8cb92ff9c50869f563ae85960b63ce563a485ac82fce633d4894fa10e557bdca91414642965a6dd5bf55e3673c3f8153756f28aa5497b37a0e80588ea6449be67c037c0efbea0fc588e368f8a8811d680138757afe7c2febc697637e1e442f473edf5b4def55f6aebaae5438983083f0e04bf4c2c02cfaacd99ad8ca5011956d3cd20e499d7c9a32d72e66725b6585c1fbacdbbd6d39a3b05f27678b35", 0xa8)
sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @objref={{0xb}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz1\x00'}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0xb}]}}}]}]}], {0x14}}, 0xc8}}, 0x4004)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r7, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
r8 = syz_open_dev$vim2m(&(0x7f0000000000), 0x79, 0x2)
ioctl$vim2m_VIDIOC_S_FMT(r8, 0xc0d05605, &(0x7f0000000040)={0x1, @pix={0x0, 0x0, 0x3132564e}})
sendmsg$NL80211_CMD_JOIN_OCB(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r7, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
r9 = socket$inet_sctp(0x2, 0x5, 0x84)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0)
mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8003, &(0x7f0000000000)=0x9, 0x8, 0x0)
mbind(&(0x7f00005f7000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x4, 0x0)
mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x8000, 0x0, 0x2, 0x2)
ioctl$sock_inet_SIOCRTMSG(r9, 0x890d, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-openat-pwrite64-ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS-bpf$MAP_CREATE-read-pselect6-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_DEL-socket$nl_generic-rt_sigqueueinfo-socket$nl_netfilter-openat$audio1-write$dsp-sendmsg$NFT_BATCH-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_S_FMT-sendmsg$NL80211_CMD_JOIN_OCB-socket$inet_sctp-mmap-mbind-mbind-mbind-syz_80211_inject_frame
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x8)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfe, 0x5}, 0x1, 0x1, 0x0, {}, 0xe, 0x7})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0xffff, 0x0, 0x8, 0x800, r0, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x3}, 0x50)
read(r1, &(0x7f0000000540)=""/75, 0x4b)
pselect6(0x99, &(0x7f00000003c0)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r3=>0x0})
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x34, 0x0, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'pimreg\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x34}}, 0x20000004)
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)={0x34, 0x0, 0x1, 0x70bd27, 0x25dfdbff, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'bridge0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x8004)
sendmsg$SMC_PNETID_DEL(r2, &(0x7f00000005c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f0000000740)={0x48, 0x0, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6gretap0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wlan1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x4014850}, 0x800)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
rt_sigqueueinfo(0x0, 0x9, &(0x7f000000df80)={0x0, 0x0, 0xffffffc0})
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
r6 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000140), 0x80000, 0x0)
write$dsp(r6, &(0x7f0000000400)="a2f0b1ba5bdce46d9268ba8cb92ff9c50869f563ae85960b63ce563a485ac82fce633d4894fa10e557bdca91414642965a6dd5bf55e3673c3f8153756f28aa5497b37a0e80588ea6449be67c037c0efbea0fc588e368f8a8811d680138757afe7c2febc697637e1e442f473edf5b4def55f6aebaae5438983083f0e04bf4c2c02cfaacd99ad8ca5011956d3cd20e499d7c9a32d72e66725b6585c1fbacdbbd6d39a3b05f27678b35", 0xa8)
sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @objref={{0xb}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz1\x00'}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0xb}]}}}]}]}], {0x14}}, 0xc8}}, 0x4004)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r7, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
r8 = syz_open_dev$vim2m(&(0x7f0000000000), 0x79, 0x2)
ioctl$vim2m_VIDIOC_S_FMT(r8, 0xc0d05605, &(0x7f0000000040)={0x1, @pix={0x0, 0x0, 0x3132564e}})
sendmsg$NL80211_CMD_JOIN_OCB(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r7, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
socket$inet_sctp(0x2, 0x5, 0x84)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0)
mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8003, &(0x7f0000000000)=0x9, 0x8, 0x0)
mbind(&(0x7f00005f7000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x4, 0x0)
mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x8000, 0x0, 0x2, 0x2)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-openat-pwrite64-ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS-bpf$MAP_CREATE-read-pselect6-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_DEL-socket$nl_generic-rt_sigqueueinfo-socket$nl_netfilter-openat$audio1-write$dsp-sendmsg$NFT_BATCH-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_S_FMT-sendmsg$NL80211_CMD_JOIN_OCB-socket$inet_sctp-mmap-mbind-mbind-syz_80211_inject_frame
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x8)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfe, 0x5}, 0x1, 0x1, 0x0, {}, 0xe, 0x7})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0xffff, 0x0, 0x8, 0x800, r0, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x3}, 0x50)
read(r1, &(0x7f0000000540)=""/75, 0x4b)
pselect6(0x99, &(0x7f00000003c0)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r3=>0x0})
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x34, 0x0, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'pimreg\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x34}}, 0x20000004)
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)={0x34, 0x0, 0x1, 0x70bd27, 0x25dfdbff, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'bridge0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x8004)
sendmsg$SMC_PNETID_DEL(r2, &(0x7f00000005c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f0000000740)={0x48, 0x0, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6gretap0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wlan1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x4014850}, 0x800)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
rt_sigqueueinfo(0x0, 0x9, &(0x7f000000df80)={0x0, 0x0, 0xffffffc0})
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
r6 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000140), 0x80000, 0x0)
write$dsp(r6, &(0x7f0000000400)="a2f0b1ba5bdce46d9268ba8cb92ff9c50869f563ae85960b63ce563a485ac82fce633d4894fa10e557bdca91414642965a6dd5bf55e3673c3f8153756f28aa5497b37a0e80588ea6449be67c037c0efbea0fc588e368f8a8811d680138757afe7c2febc697637e1e442f473edf5b4def55f6aebaae5438983083f0e04bf4c2c02cfaacd99ad8ca5011956d3cd20e499d7c9a32d72e66725b6585c1fbacdbbd6d39a3b05f27678b35", 0xa8)
sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @objref={{0xb}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz1\x00'}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0xb}]}}}]}]}], {0x14}}, 0xc8}}, 0x4004)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r7, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
r8 = syz_open_dev$vim2m(&(0x7f0000000000), 0x79, 0x2)
ioctl$vim2m_VIDIOC_S_FMT(r8, 0xc0d05605, &(0x7f0000000040)={0x1, @pix={0x0, 0x0, 0x3132564e}})
sendmsg$NL80211_CMD_JOIN_OCB(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r7, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
socket$inet_sctp(0x2, 0x5, 0x84)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0)
mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8003, &(0x7f0000000000)=0x9, 0x8, 0x0)
mbind(&(0x7f00005f7000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x4, 0x0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-openat-pwrite64-ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS-bpf$MAP_CREATE-read-pselect6-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_DEL-socket$nl_generic-rt_sigqueueinfo-socket$nl_netfilter-openat$audio1-write$dsp-sendmsg$NFT_BATCH-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_S_FMT-sendmsg$NL80211_CMD_JOIN_OCB-socket$inet_sctp-mmap-mbind-syz_80211_inject_frame
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x8)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfe, 0x5}, 0x1, 0x1, 0x0, {}, 0xe, 0x7})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0xffff, 0x0, 0x8, 0x800, r0, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x3}, 0x50)
read(r1, &(0x7f0000000540)=""/75, 0x4b)
pselect6(0x99, &(0x7f00000003c0)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r3=>0x0})
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x34, 0x0, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'pimreg\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x34}}, 0x20000004)
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)={0x34, 0x0, 0x1, 0x70bd27, 0x25dfdbff, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'bridge0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x8004)
sendmsg$SMC_PNETID_DEL(r2, &(0x7f00000005c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f0000000740)={0x48, 0x0, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6gretap0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wlan1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x4014850}, 0x800)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
rt_sigqueueinfo(0x0, 0x9, &(0x7f000000df80)={0x0, 0x0, 0xffffffc0})
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
r6 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000140), 0x80000, 0x0)
write$dsp(r6, &(0x7f0000000400)="a2f0b1ba5bdce46d9268ba8cb92ff9c50869f563ae85960b63ce563a485ac82fce633d4894fa10e557bdca91414642965a6dd5bf55e3673c3f8153756f28aa5497b37a0e80588ea6449be67c037c0efbea0fc588e368f8a8811d680138757afe7c2febc697637e1e442f473edf5b4def55f6aebaae5438983083f0e04bf4c2c02cfaacd99ad8ca5011956d3cd20e499d7c9a32d72e66725b6585c1fbacdbbd6d39a3b05f27678b35", 0xa8)
sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @objref={{0xb}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz1\x00'}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0xb}]}}}]}]}], {0x14}}, 0xc8}}, 0x4004)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r7, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
r8 = syz_open_dev$vim2m(&(0x7f0000000000), 0x79, 0x2)
ioctl$vim2m_VIDIOC_S_FMT(r8, 0xc0d05605, &(0x7f0000000040)={0x1, @pix={0x0, 0x0, 0x3132564e}})
sendmsg$NL80211_CMD_JOIN_OCB(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r7, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
socket$inet_sctp(0x2, 0x5, 0x84)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0)
mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8003, &(0x7f0000000000)=0x9, 0x8, 0x0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-openat-pwrite64-ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS-bpf$MAP_CREATE-read-pselect6-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_DEL-socket$nl_generic-rt_sigqueueinfo-socket$nl_netfilter-openat$audio1-write$dsp-sendmsg$NFT_BATCH-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_S_FMT-sendmsg$NL80211_CMD_JOIN_OCB-socket$inet_sctp-mmap-syz_80211_inject_frame
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x8)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfe, 0x5}, 0x1, 0x1, 0x0, {}, 0xe, 0x7})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0xffff, 0x0, 0x8, 0x800, r0, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x3}, 0x50)
read(r1, &(0x7f0000000540)=""/75, 0x4b)
pselect6(0x99, &(0x7f00000003c0)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r3=>0x0})
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x34, 0x0, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'pimreg\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x34}}, 0x20000004)
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)={0x34, 0x0, 0x1, 0x70bd27, 0x25dfdbff, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'bridge0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x8004)
sendmsg$SMC_PNETID_DEL(r2, &(0x7f00000005c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f0000000740)={0x48, 0x0, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6gretap0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wlan1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x4014850}, 0x800)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
rt_sigqueueinfo(0x0, 0x9, &(0x7f000000df80)={0x0, 0x0, 0xffffffc0})
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
r6 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000140), 0x80000, 0x0)
write$dsp(r6, &(0x7f0000000400)="a2f0b1ba5bdce46d9268ba8cb92ff9c50869f563ae85960b63ce563a485ac82fce633d4894fa10e557bdca91414642965a6dd5bf55e3673c3f8153756f28aa5497b37a0e80588ea6449be67c037c0efbea0fc588e368f8a8811d680138757afe7c2febc697637e1e442f473edf5b4def55f6aebaae5438983083f0e04bf4c2c02cfaacd99ad8ca5011956d3cd20e499d7c9a32d72e66725b6585c1fbacdbbd6d39a3b05f27678b35", 0xa8)
sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @objref={{0xb}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz1\x00'}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0xb}]}}}]}]}], {0x14}}, 0xc8}}, 0x4004)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r7, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
r8 = syz_open_dev$vim2m(&(0x7f0000000000), 0x79, 0x2)
ioctl$vim2m_VIDIOC_S_FMT(r8, 0xc0d05605, &(0x7f0000000040)={0x1, @pix={0x0, 0x0, 0x3132564e}})
sendmsg$NL80211_CMD_JOIN_OCB(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r7, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
socket$inet_sctp(0x2, 0x5, 0x84)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-openat-pwrite64-ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS-bpf$MAP_CREATE-read-pselect6-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_DEL-socket$nl_generic-rt_sigqueueinfo-socket$nl_netfilter-openat$audio1-write$dsp-sendmsg$NFT_BATCH-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_S_FMT-sendmsg$NL80211_CMD_JOIN_OCB-socket$inet_sctp-syz_80211_inject_frame
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x8)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfe, 0x5}, 0x1, 0x1, 0x0, {}, 0xe, 0x7})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0xffff, 0x0, 0x8, 0x800, r0, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x3}, 0x50)
read(r1, &(0x7f0000000540)=""/75, 0x4b)
pselect6(0x99, &(0x7f00000003c0)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r3=>0x0})
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x34, 0x0, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'pimreg\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x34}}, 0x20000004)
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)={0x34, 0x0, 0x1, 0x70bd27, 0x25dfdbff, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'bridge0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x8004)
sendmsg$SMC_PNETID_DEL(r2, &(0x7f00000005c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f0000000740)={0x48, 0x0, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6gretap0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wlan1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x4014850}, 0x800)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
rt_sigqueueinfo(0x0, 0x9, &(0x7f000000df80)={0x0, 0x0, 0xffffffc0})
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
r6 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000140), 0x80000, 0x0)
write$dsp(r6, &(0x7f0000000400)="a2f0b1ba5bdce46d9268ba8cb92ff9c50869f563ae85960b63ce563a485ac82fce633d4894fa10e557bdca91414642965a6dd5bf55e3673c3f8153756f28aa5497b37a0e80588ea6449be67c037c0efbea0fc588e368f8a8811d680138757afe7c2febc697637e1e442f473edf5b4def55f6aebaae5438983083f0e04bf4c2c02cfaacd99ad8ca5011956d3cd20e499d7c9a32d72e66725b6585c1fbacdbbd6d39a3b05f27678b35", 0xa8)
sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @objref={{0xb}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz1\x00'}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0xb}]}}}]}]}], {0x14}}, 0xc8}}, 0x4004)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r7, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
r8 = syz_open_dev$vim2m(&(0x7f0000000000), 0x79, 0x2)
ioctl$vim2m_VIDIOC_S_FMT(r8, 0xc0d05605, &(0x7f0000000040)={0x1, @pix={0x0, 0x0, 0x3132564e}})
sendmsg$NL80211_CMD_JOIN_OCB(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r7, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
socket$inet_sctp(0x2, 0x5, 0x84)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-openat-pwrite64-ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS-bpf$MAP_CREATE-read-pselect6-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_DEL-socket$nl_generic-rt_sigqueueinfo-socket$nl_netfilter-openat$audio1-write$dsp-sendmsg$NFT_BATCH-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_S_FMT-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x8)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfe, 0x5}, 0x1, 0x1, 0x0, {}, 0xe, 0x7})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0xffff, 0x0, 0x8, 0x800, r0, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x3}, 0x50)
read(r1, &(0x7f0000000540)=""/75, 0x4b)
pselect6(0x99, &(0x7f00000003c0)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r3=>0x0})
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x34, 0x0, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'pimreg\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x34}}, 0x20000004)
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)={0x34, 0x0, 0x1, 0x70bd27, 0x25dfdbff, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'bridge0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x8004)
sendmsg$SMC_PNETID_DEL(r2, &(0x7f00000005c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f0000000740)={0x48, 0x0, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6gretap0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wlan1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x4014850}, 0x800)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
rt_sigqueueinfo(0x0, 0x9, &(0x7f000000df80)={0x0, 0x0, 0xffffffc0})
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
r6 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000140), 0x80000, 0x0)
write$dsp(r6, &(0x7f0000000400)="a2f0b1ba5bdce46d9268ba8cb92ff9c50869f563ae85960b63ce563a485ac82fce633d4894fa10e557bdca91414642965a6dd5bf55e3673c3f8153756f28aa5497b37a0e80588ea6449be67c037c0efbea0fc588e368f8a8811d680138757afe7c2febc697637e1e442f473edf5b4def55f6aebaae5438983083f0e04bf4c2c02cfaacd99ad8ca5011956d3cd20e499d7c9a32d72e66725b6585c1fbacdbbd6d39a3b05f27678b35", 0xa8)
sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @objref={{0xb}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz1\x00'}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0xb}]}}}]}]}], {0x14}}, 0xc8}}, 0x4004)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r7, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
r8 = syz_open_dev$vim2m(&(0x7f0000000000), 0x79, 0x2)
ioctl$vim2m_VIDIOC_S_FMT(r8, 0xc0d05605, &(0x7f0000000040)={0x1, @pix={0x0, 0x0, 0x3132564e}})
sendmsg$NL80211_CMD_JOIN_OCB(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r7, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-openat-pwrite64-ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS-bpf$MAP_CREATE-read-pselect6-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_DEL-socket$nl_generic-rt_sigqueueinfo-socket$nl_netfilter-openat$audio1-write$dsp-sendmsg$NFT_BATCH-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_S_FMT-syz_80211_inject_frame
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x8)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfe, 0x5}, 0x1, 0x1, 0x0, {}, 0xe, 0x7})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0xffff, 0x0, 0x8, 0x800, r0, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x3}, 0x50)
read(r1, &(0x7f0000000540)=""/75, 0x4b)
pselect6(0x99, &(0x7f00000003c0)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r3=>0x0})
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x34, 0x0, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'pimreg\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x34}}, 0x20000004)
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)={0x34, 0x0, 0x1, 0x70bd27, 0x25dfdbff, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'bridge0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x8004)
sendmsg$SMC_PNETID_DEL(r2, &(0x7f00000005c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f0000000740)={0x48, 0x0, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6gretap0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wlan1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x4014850}, 0x800)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
rt_sigqueueinfo(0x0, 0x9, &(0x7f000000df80)={0x0, 0x0, 0xffffffc0})
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
r6 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000140), 0x80000, 0x0)
write$dsp(r6, &(0x7f0000000400)="a2f0b1ba5bdce46d9268ba8cb92ff9c50869f563ae85960b63ce563a485ac82fce633d4894fa10e557bdca91414642965a6dd5bf55e3673c3f8153756f28aa5497b37a0e80588ea6449be67c037c0efbea0fc588e368f8a8811d680138757afe7c2febc697637e1e442f473edf5b4def55f6aebaae5438983083f0e04bf4c2c02cfaacd99ad8ca5011956d3cd20e499d7c9a32d72e66725b6585c1fbacdbbd6d39a3b05f27678b35", 0xa8)
sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @objref={{0xb}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz1\x00'}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0xb}]}}}]}]}], {0x14}}, 0xc8}}, 0x4004)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r7, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
r8 = syz_open_dev$vim2m(&(0x7f0000000000), 0x79, 0x2)
ioctl$vim2m_VIDIOC_S_FMT(r8, 0xc0d05605, &(0x7f0000000040)={0x1, @pix={0x0, 0x0, 0x3132564e}})
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-openat-pwrite64-ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS-bpf$MAP_CREATE-read-pselect6-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_DEL-socket$nl_generic-rt_sigqueueinfo-socket$nl_netfilter-openat$audio1-write$dsp-sendmsg$NFT_BATCH-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-syz_open_dev$vim2m-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x8)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfe, 0x5}, 0x1, 0x1, 0x0, {}, 0xe, 0x7})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0xffff, 0x0, 0x8, 0x800, r0, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x3}, 0x50)
read(r1, &(0x7f0000000540)=""/75, 0x4b)
pselect6(0x99, &(0x7f00000003c0)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r3=>0x0})
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x34, 0x0, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'pimreg\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x34}}, 0x20000004)
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)={0x34, 0x0, 0x1, 0x70bd27, 0x25dfdbff, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'bridge0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x8004)
sendmsg$SMC_PNETID_DEL(r2, &(0x7f00000005c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f0000000740)={0x48, 0x0, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6gretap0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wlan1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x4014850}, 0x800)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
rt_sigqueueinfo(0x0, 0x9, &(0x7f000000df80)={0x0, 0x0, 0xffffffc0})
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
r6 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000140), 0x80000, 0x0)
write$dsp(r6, &(0x7f0000000400)="a2f0b1ba5bdce46d9268ba8cb92ff9c50869f563ae85960b63ce563a485ac82fce633d4894fa10e557bdca91414642965a6dd5bf55e3673c3f8153756f28aa5497b37a0e80588ea6449be67c037c0efbea0fc588e368f8a8811d680138757afe7c2febc697637e1e442f473edf5b4def55f6aebaae5438983083f0e04bf4c2c02cfaacd99ad8ca5011956d3cd20e499d7c9a32d72e66725b6585c1fbacdbbd6d39a3b05f27678b35", 0xa8)
sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @objref={{0xb}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz1\x00'}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0xb}]}}}]}]}], {0x14}}, 0xc8}}, 0x4004)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r7, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
syz_open_dev$vim2m(&(0x7f0000000000), 0x79, 0x2)
sendmsg$NL80211_CMD_JOIN_OCB(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r7, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-openat-pwrite64-ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS-bpf$MAP_CREATE-read-pselect6-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_DEL-socket$nl_generic-rt_sigqueueinfo-socket$nl_netfilter-openat$audio1-write$dsp-sendmsg$NFT_BATCH-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x8)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfe, 0x5}, 0x1, 0x1, 0x0, {}, 0xe, 0x7})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0xffff, 0x0, 0x8, 0x800, r0, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x3}, 0x50)
read(r1, &(0x7f0000000540)=""/75, 0x4b)
pselect6(0x99, &(0x7f00000003c0)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r3=>0x0})
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x34, 0x0, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'pimreg\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x34}}, 0x20000004)
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)={0x34, 0x0, 0x1, 0x70bd27, 0x25dfdbff, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'bridge0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x8004)
sendmsg$SMC_PNETID_DEL(r2, &(0x7f00000005c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f0000000740)={0x48, 0x0, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6gretap0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wlan1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x4014850}, 0x800)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
rt_sigqueueinfo(0x0, 0x9, &(0x7f000000df80)={0x0, 0x0, 0xffffffc0})
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
r6 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000140), 0x80000, 0x0)
write$dsp(r6, &(0x7f0000000400)="a2f0b1ba5bdce46d9268ba8cb92ff9c50869f563ae85960b63ce563a485ac82fce633d4894fa10e557bdca91414642965a6dd5bf55e3673c3f8153756f28aa5497b37a0e80588ea6449be67c037c0efbea0fc588e368f8a8811d680138757afe7c2febc697637e1e442f473edf5b4def55f6aebaae5438983083f0e04bf4c2c02cfaacd99ad8ca5011956d3cd20e499d7c9a32d72e66725b6585c1fbacdbbd6d39a3b05f27678b35", 0xa8)
sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @objref={{0xb}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz1\x00'}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0xb}]}}}]}]}], {0x14}}, 0xc8}}, 0x4004)
r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r7, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r7, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-openat-pwrite64-ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS-bpf$MAP_CREATE-read-pselect6-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_DEL-socket$nl_generic-rt_sigqueueinfo-socket$nl_netfilter-openat$audio1-write$dsp-sendmsg$NFT_BATCH-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x8)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfe, 0x5}, 0x1, 0x1, 0x0, {}, 0xe, 0x7})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0xffff, 0x0, 0x8, 0x800, r0, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x3}, 0x50)
read(r1, &(0x7f0000000540)=""/75, 0x4b)
pselect6(0x99, &(0x7f00000003c0)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r3=>0x0})
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x34, 0x0, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'pimreg\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x34}}, 0x20000004)
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)={0x34, 0x0, 0x1, 0x70bd27, 0x25dfdbff, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'bridge0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x8004)
sendmsg$SMC_PNETID_DEL(r2, &(0x7f00000005c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f0000000740)={0x48, 0x0, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6gretap0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wlan1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x4014850}, 0x800)
socket$nl_generic(0x10, 0x3, 0x10)
rt_sigqueueinfo(0x0, 0x9, &(0x7f000000df80)={0x0, 0x0, 0xffffffc0})
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
r5 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000140), 0x80000, 0x0)
write$dsp(r5, &(0x7f0000000400)="a2f0b1ba5bdce46d9268ba8cb92ff9c50869f563ae85960b63ce563a485ac82fce633d4894fa10e557bdca91414642965a6dd5bf55e3673c3f8153756f28aa5497b37a0e80588ea6449be67c037c0efbea0fc588e368f8a8811d680138757afe7c2febc697637e1e442f473edf5b4def55f6aebaae5438983083f0e04bf4c2c02cfaacd99ad8ca5011956d3cd20e499d7c9a32d72e66725b6585c1fbacdbbd6d39a3b05f27678b35", 0xa8)
sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @objref={{0xb}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz1\x00'}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0xb}]}}}]}]}], {0x14}}, 0xc8}}, 0x4004)
r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_JOIN_OCB(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r6, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-openat-pwrite64-ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS-bpf$MAP_CREATE-read-pselect6-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_DEL-socket$nl_generic-rt_sigqueueinfo-socket$nl_netfilter-openat$audio1-write$dsp-sendmsg$NFT_BATCH-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x8)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfe, 0x5}, 0x1, 0x1, 0x0, {}, 0xe, 0x7})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0xffff, 0x0, 0x8, 0x800, r0, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x3}, 0x50)
read(r1, &(0x7f0000000540)=""/75, 0x4b)
pselect6(0x99, &(0x7f00000003c0)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r3=>0x0})
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x34, 0x0, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'pimreg\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x34}}, 0x20000004)
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)={0x34, 0x0, 0x1, 0x70bd27, 0x25dfdbff, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'bridge0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x8004)
sendmsg$SMC_PNETID_DEL(r2, &(0x7f00000005c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f0000000740)={0x48, 0x0, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6gretap0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wlan1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x4014850}, 0x800)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
rt_sigqueueinfo(0x0, 0x9, &(0x7f000000df80)={0x0, 0x0, 0xffffffc0})
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
r6 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000140), 0x80000, 0x0)
write$dsp(r6, &(0x7f0000000400)="a2f0b1ba5bdce46d9268ba8cb92ff9c50869f563ae85960b63ce563a485ac82fce633d4894fa10e557bdca91414642965a6dd5bf55e3673c3f8153756f28aa5497b37a0e80588ea6449be67c037c0efbea0fc588e368f8a8811d680138757afe7c2febc697637e1e442f473edf5b4def55f6aebaae5438983083f0e04bf4c2c02cfaacd99ad8ca5011956d3cd20e499d7c9a32d72e66725b6585c1fbacdbbd6d39a3b05f27678b35", 0xa8)
sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @objref={{0xb}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz1\x00'}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0xb}]}}}]}]}], {0x14}}, 0xc8}}, 0x4004)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, 0x0, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, 0x0, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-openat-pwrite64-ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS-bpf$MAP_CREATE-read-pselect6-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_DEL-socket$nl_generic-rt_sigqueueinfo-socket$nl_netfilter-openat$audio1-write$dsp-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x8)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfe, 0x5}, 0x1, 0x1, 0x0, {}, 0xe, 0x7})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0xffff, 0x0, 0x8, 0x800, r0, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x3}, 0x50)
read(r1, &(0x7f0000000540)=""/75, 0x4b)
pselect6(0x99, &(0x7f00000003c0)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r3=>0x0})
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x34, 0x0, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'pimreg\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x34}}, 0x20000004)
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)={0x34, 0x0, 0x1, 0x70bd27, 0x25dfdbff, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'bridge0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x8004)
sendmsg$SMC_PNETID_DEL(r2, &(0x7f00000005c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f0000000740)={0x48, 0x0, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6gretap0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wlan1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x4014850}, 0x800)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
rt_sigqueueinfo(0x0, 0x9, &(0x7f000000df80)={0x0, 0x0, 0xffffffc0})
socket$nl_netfilter(0x10, 0x3, 0xc)
r5 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000140), 0x80000, 0x0)
write$dsp(r5, &(0x7f0000000400)="a2f0b1ba5bdce46d9268ba8cb92ff9c50869f563ae85960b63ce563a485ac82fce633d4894fa10e557bdca91414642965a6dd5bf55e3673c3f8153756f28aa5497b37a0e80588ea6449be67c037c0efbea0fc588e368f8a8811d680138757afe7c2febc697637e1e442f473edf5b4def55f6aebaae5438983083f0e04bf4c2c02cfaacd99ad8ca5011956d3cd20e499d7c9a32d72e66725b6585c1fbacdbbd6d39a3b05f27678b35", 0xa8)
r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r6, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r6, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-openat-pwrite64-ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS-bpf$MAP_CREATE-read-pselect6-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_DEL-socket$nl_generic-rt_sigqueueinfo-socket$nl_netfilter-openat$audio1-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x8)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfe, 0x5}, 0x1, 0x1, 0x0, {}, 0xe, 0x7})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0xffff, 0x0, 0x8, 0x800, r0, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x3}, 0x50)
read(r1, &(0x7f0000000540)=""/75, 0x4b)
pselect6(0x99, &(0x7f00000003c0)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r3=>0x0})
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x34, 0x0, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'pimreg\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x34}}, 0x20000004)
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)={0x34, 0x0, 0x1, 0x70bd27, 0x25dfdbff, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'bridge0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x8004)
sendmsg$SMC_PNETID_DEL(r2, &(0x7f00000005c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f0000000740)={0x48, 0x0, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6gretap0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wlan1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x4014850}, 0x800)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
rt_sigqueueinfo(0x0, 0x9, &(0x7f000000df80)={0x0, 0x0, 0xffffffc0})
socket$nl_netfilter(0x10, 0x3, 0xc)
openat$audio1(0xffffffffffffff9c, &(0x7f0000000140), 0x80000, 0x0)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r5, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r5, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-openat-pwrite64-ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS-bpf$MAP_CREATE-read-pselect6-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_DEL-socket$nl_generic-rt_sigqueueinfo-socket$nl_netfilter-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x8)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfe, 0x5}, 0x1, 0x1, 0x0, {}, 0xe, 0x7})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0xffff, 0x0, 0x8, 0x800, r0, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x3}, 0x50)
read(r1, &(0x7f0000000540)=""/75, 0x4b)
pselect6(0x99, &(0x7f00000003c0)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r3=>0x0})
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x34, 0x0, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'pimreg\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x34}}, 0x20000004)
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)={0x34, 0x0, 0x1, 0x70bd27, 0x25dfdbff, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'bridge0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x8004)
sendmsg$SMC_PNETID_DEL(r2, &(0x7f00000005c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f0000000740)={0x48, 0x0, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6gretap0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wlan1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x4014850}, 0x800)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
rt_sigqueueinfo(0x0, 0x9, &(0x7f000000df80)={0x0, 0x0, 0xffffffc0})
socket$nl_netfilter(0x10, 0x3, 0xc)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r5, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r5, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-openat-pwrite64-ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS-bpf$MAP_CREATE-read-pselect6-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_DEL-socket$nl_generic-rt_sigqueueinfo-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x8)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfe, 0x5}, 0x1, 0x1, 0x0, {}, 0xe, 0x7})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0xffff, 0x0, 0x8, 0x800, r0, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x3}, 0x50)
read(r1, &(0x7f0000000540)=""/75, 0x4b)
pselect6(0x99, &(0x7f00000003c0)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r3=>0x0})
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x34, 0x0, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'pimreg\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x34}}, 0x20000004)
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)={0x34, 0x0, 0x1, 0x70bd27, 0x25dfdbff, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'bridge0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x8004)
sendmsg$SMC_PNETID_DEL(r2, &(0x7f00000005c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f0000000740)={0x48, 0x0, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6gretap0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wlan1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x4014850}, 0x800)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
rt_sigqueueinfo(0x0, 0x9, &(0x7f000000df80)={0x0, 0x0, 0xffffffc0})
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r5, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r5, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-openat-pwrite64-ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS-bpf$MAP_CREATE-read-pselect6-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_DEL-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x8)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfe, 0x5}, 0x1, 0x1, 0x0, {}, 0xe, 0x7})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0xffff, 0x0, 0x8, 0x800, r0, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x3}, 0x50)
read(r1, &(0x7f0000000540)=""/75, 0x4b)
pselect6(0x99, &(0x7f00000003c0)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r3=>0x0})
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x34, 0x0, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'pimreg\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x34}}, 0x20000004)
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)={0x34, 0x0, 0x1, 0x70bd27, 0x25dfdbff, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'bridge0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x8004)
sendmsg$SMC_PNETID_DEL(r2, &(0x7f00000005c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f0000000740)={0x48, 0x0, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6gretap0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wlan1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x4014850}, 0x800)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r5, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r5, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-openat-pwrite64-ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS-bpf$MAP_CREATE-read-pselect6-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_DEL-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x8)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfe, 0x5}, 0x1, 0x1, 0x0, {}, 0xe, 0x7})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0xffff, 0x0, 0x8, 0x800, r0, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x3}, 0x50)
read(r1, &(0x7f0000000540)=""/75, 0x4b)
pselect6(0x99, &(0x7f00000003c0)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r3=>0x0})
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x34, 0x0, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'pimreg\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x34}}, 0x20000004)
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)={0x34, 0x0, 0x1, 0x70bd27, 0x25dfdbff, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'bridge0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x8004)
sendmsg$SMC_PNETID_DEL(r2, &(0x7f00000005c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f0000000740)={0x48, 0x0, 0x1, 0x70bd2a, 0x25dfdbfe, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'ip6gretap0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'wlan1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz0\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x4014850}, 0x800)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r4, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-openat-pwrite64-ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS-bpf$MAP_CREATE-read-pselect6-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$SMC_PNETID_ADD-sendmsg$SMC_PNETID_ADD-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x8)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfe, 0x5}, 0x1, 0x1, 0x0, {}, 0xe, 0x7})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0xffff, 0x0, 0x8, 0x800, r0, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x3}, 0x50)
read(r1, &(0x7f0000000540)=""/75, 0x4b)
pselect6(0x99, &(0x7f00000003c0)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r3=>0x0})
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x34, 0x0, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'pimreg\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x34}}, 0x20000004)
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)={0x34, 0x0, 0x1, 0x70bd27, 0x25dfdbff, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'bridge0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x8004)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r5, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r5, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-openat-pwrite64-ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS-bpf$MAP_CREATE-read-pselect6-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$SMC_PNETID_ADD-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x8)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfe, 0x5}, 0x1, 0x1, 0x0, {}, 0xe, 0x7})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0xffff, 0x0, 0x8, 0x800, r0, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x3}, 0x50)
read(r1, &(0x7f0000000540)=""/75, 0x4b)
pselect6(0x99, &(0x7f00000003c0)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r3=>0x0})
sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x34, 0x0, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'pimreg\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x34}}, 0x20000004)
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r5, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r5, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-openat-pwrite64-ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS-bpf$MAP_CREATE-read-pselect6-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x8)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfe, 0x5}, 0x1, 0x1, 0x0, {}, 0xe, 0x7})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0xffff, 0x0, 0x8, 0x800, r0, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x3}, 0x50)
read(r1, &(0x7f0000000540)=""/75, 0x4b)
pselect6(0x99, &(0x7f00000003c0)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r3=>0x0})
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r5, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r5, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-openat-pwrite64-ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS-bpf$MAP_CREATE-read-pselect6-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x8)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfe, 0x5}, 0x1, 0x1, 0x0, {}, 0xe, 0x7})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0xffff, 0x0, 0x8, 0x800, r0, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x3}, 0x50)
read(r1, &(0x7f0000000540)=""/75, 0x4b)
pselect6(0x99, &(0x7f00000003c0)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r4, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-openat-pwrite64-ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS-bpf$MAP_CREATE-read-pselect6-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x8)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfe, 0x5}, 0x1, 0x1, 0x0, {}, 0xe, 0x7})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0xffff, 0x0, 0x8, 0x800, r0, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x3}, 0x50)
read(r1, &(0x7f0000000540)=""/75, 0x4b)
pselect6(0x99, &(0x7f00000003c0)={0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r2=>0x0})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r4, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-openat-pwrite64-ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS-bpf$MAP_CREATE-read-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x8)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfe, 0x5}, 0x1, 0x1, 0x0, {}, 0xe, 0x7})
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0xffff, 0x0, 0x8, 0x800, r0, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x3}, 0x50)
read(r1, &(0x7f0000000540)=""/75, 0x4b)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r3=>0x0})
r4 = socket$nl_generic(0x10, 0x3, 0x10)
r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r5, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r5, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-openat-pwrite64-ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS-bpf$MAP_CREATE-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x8)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfe, 0x5}, 0x1, 0x1, 0x0, {}, 0xe, 0x7})
bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0xffff, 0x0, 0x8, 0x800, r0, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x3}, 0x50)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r2=>0x0})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r4, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-openat-pwrite64-ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x8)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000180)={{0xfe, 0x5}, 0x1, 0x1, 0x0, {}, 0xe, 0x7})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r2=>0x0})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r4, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-openat-pwrite64-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x8)
pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r2=>0x0})
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r4, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-openat-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', 0x42, 0x8)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r1=>0x0})
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r3, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndseq-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x1016c1)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r1=>0x0})
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r3, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r1=>0x0})
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r3, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r2, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r1=>0x0})
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r3, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r1=>0x0})
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r2, 0x0, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r3, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r1=>0x0})
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r3, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r1=>0x0})
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={0x0}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r3, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r1=>0x0})
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r0, 0x0, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r1=>0x0})
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r1=>0x0})
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r1=>0x0})
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r3, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r1=>0x0})
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r3, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, 0x0, 0x1e)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r1=>0x0})
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r3, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB], 0x1e)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
program crashed: WARNING in mac80211_hwsim_sta_rc_update
simplifying C reproducer
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
program did not crash
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
program did not crash
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
program crashed: WARNING in mac80211_hwsim_sta_rc_update
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r1=>0x0})
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r3, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program crashed: WARNING in mac80211_hwsim_sta_rc_update
validation run: crashed=true
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r1=>0x0})
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r3, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program crashed: WARNING in mac80211_hwsim_sta_rc_update
validation run: crashed=true
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$nl80211-sendmsg$NL80211_CMD_SET_INTERFACE-sendmsg$NL80211_CMD_JOIN_OCB-syz_80211_inject_frame
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00', <r1=>0x0})
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0xb}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c000}, 0x0)
sendmsg$NL80211_CMD_JOIN_OCB(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000800)={0x2c, r3, 0x1, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24004015}, 0x448d0)
syz_80211_inject_frame(&(0x7f0000000280)=@device_b, &(0x7f0000000700)=ANY=[@ANYBLOB="88a80060371200080211000000ffffffffffffffffff"], 0x1e)

program crashed: WARNING in mac80211_hwsim_sta_rc_update
validation run: crashed=true
reproducing took 1h59m0.887942534s
repro crashed as (corrupted=false):
------------[ cut here ]------------
intf 08:02:11:00:00:01 [link=0]: bad STA 00:00:00:ff:ff:ff bandwidth 20 MHz (0) > channel config 10 MHz (7)
WARNING: CPU: 0 PID: 176 at drivers/net/wireless/virtual/mac80211_hwsim.c:2653 mac80211_hwsim_sta_rc_update+0x6f5/0x860 drivers/net/wireless/virtual/mac80211_hwsim.c:2650
Modules linked in:
CPU: 0 UID: 0 PID: 176 Comm: kworker/u4:4 Not tainted 6.16.0-rc4-syzkaller-00123-g4c06e63b9203 #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: events_unbound cfg80211_wiphy_work
RIP: 0010:mac80211_hwsim_sta_rc_update+0x6f5/0x860 drivers/net/wireless/virtual/mac80211_hwsim.c:2650
Code: 71 17 00 00 48 c7 c7 c0 ae 2d 8c 48 8b 74 24 28 89 ea 48 8b 4c 24 10 41 89 d8 45 89 f9 41 56 50 e8 d0 df 8f fa 48 83 c4 10 90 <0f> 0b 90 90 e9 0c ff ff ff e8 2d 37 cc fa 90 0f 0b 90 e9 fe fe ff
RSP: 0018:ffffc90001a07768 EFLAGS: 00010282
RAX: 2b7aa56dabf85f00 RBX: 0000000000000014 RCX: ffff888000b5a440
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: 0000000000000000 R08: ffff88801fc24293 R09: 1ffff11003f84852
R10: dffffc0000000000 R11: ffffed1003f84853 R12: 0000000000000000
R13: dffffc0000000000 R14: 0000000000000007 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88808d21c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffec31d80b8 CR3: 000000001216d000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 mac80211_hwsim_sta_add+0xa3/0x310 drivers/net/wireless/virtual/mac80211_hwsim.c:2670
 drv_sta_add net/mac80211/driver-ops.h:466 [inline]
 drv_sta_state+0x8be/0x1840 net/mac80211/driver-ops.c:155
 sta_info_insert_drv_state net/mac80211/sta_info.c:775 [inline]
 sta_info_insert_finish net/mac80211/sta_info.c:883 [inline]
 sta_info_insert_rcu+0xd32/0x1940 net/mac80211/sta_info.c:960
 ieee80211_ocb_finish_sta net/mac80211/ocb.c:102 [inline]
 ieee80211_ocb_work+0x31f/0x580 net/mac80211/ocb.c:136
 cfg80211_wiphy_work+0x2df/0x460 net/wireless/core.c:435
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3321
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
 kthread+0x70e/0x8a0 kernel/kthread.c:464
 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

final repro crashed as (corrupted=false):
------------[ cut here ]------------
intf 08:02:11:00:00:01 [link=0]: bad STA 00:00:00:ff:ff:ff bandwidth 20 MHz (0) > channel config 10 MHz (7)
WARNING: CPU: 0 PID: 176 at drivers/net/wireless/virtual/mac80211_hwsim.c:2653 mac80211_hwsim_sta_rc_update+0x6f5/0x860 drivers/net/wireless/virtual/mac80211_hwsim.c:2650
Modules linked in:
CPU: 0 UID: 0 PID: 176 Comm: kworker/u4:4 Not tainted 6.16.0-rc4-syzkaller-00123-g4c06e63b9203 #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: events_unbound cfg80211_wiphy_work
RIP: 0010:mac80211_hwsim_sta_rc_update+0x6f5/0x860 drivers/net/wireless/virtual/mac80211_hwsim.c:2650
Code: 71 17 00 00 48 c7 c7 c0 ae 2d 8c 48 8b 74 24 28 89 ea 48 8b 4c 24 10 41 89 d8 45 89 f9 41 56 50 e8 d0 df 8f fa 48 83 c4 10 90 <0f> 0b 90 90 e9 0c ff ff ff e8 2d 37 cc fa 90 0f 0b 90 e9 fe fe ff
RSP: 0018:ffffc90001a07768 EFLAGS: 00010282
RAX: 2b7aa56dabf85f00 RBX: 0000000000000014 RCX: ffff888000b5a440
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: 0000000000000000 R08: ffff88801fc24293 R09: 1ffff11003f84852
R10: dffffc0000000000 R11: ffffed1003f84853 R12: 0000000000000000
R13: dffffc0000000000 R14: 0000000000000007 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88808d21c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffec31d80b8 CR3: 000000001216d000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 mac80211_hwsim_sta_add+0xa3/0x310 drivers/net/wireless/virtual/mac80211_hwsim.c:2670
 drv_sta_add net/mac80211/driver-ops.h:466 [inline]
 drv_sta_state+0x8be/0x1840 net/mac80211/driver-ops.c:155
 sta_info_insert_drv_state net/mac80211/sta_info.c:775 [inline]
 sta_info_insert_finish net/mac80211/sta_info.c:883 [inline]
 sta_info_insert_rcu+0xd32/0x1940 net/mac80211/sta_info.c:960
 ieee80211_ocb_finish_sta net/mac80211/ocb.c:102 [inline]
 ieee80211_ocb_work+0x31f/0x580 net/mac80211/ocb.c:136
 cfg80211_wiphy_work+0x2df/0x460 net/wireless/core.c:435
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3321
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
 kthread+0x70e/0x8a0 kernel/kthread.c:464
 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>