Extracting prog: 5m26.719877143s
Minimizing prog: 32m41.863328963s
Simplifying prog options: 10m19.270323674s
Extracting C: 3m15.083847486s
Simplifying C: 0s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL
detailed listing:
executing program 0:
r0 = socket$unix(0x1, 0x5, 0x0)
ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000000)={'bridge0\x00', &(0x7f0000000040)=@ethtool_regs={0x4, 0x0, 0x1c, "f42a97b96d02d717af4211c1b78a09759fdf27b29df18979fe4d32e6"}})

program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL
detailed listing:
executing program 0:
r0 = socket$unix(0x1, 0x5, 0x0)
ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000000)={'bridge0\x00', &(0x7f0000000040)=@ethtool_regs={0x4, 0x0, 0x1c, "f42a97b96d02d717af4211c1b78a09759fdf27b29df18979fe4d32e6"}})

program crashed: INFO: rcu detected stall in worker_thread
single: successfully extracted reproducer
found reproducer with 2 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix
detailed listing:
executing program 0:
socket$unix(0x1, 0x5, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCETHTOOL
detailed listing:
executing program 0:
ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f0, &(0x7f0000000000)={'bridge0\x00', &(0x7f0000000040)=@ethtool_regs={0x4, 0x0, 0x1c, "f42a97b96d02d717af4211c1b78a09759fdf27b29df18979fe4d32e6"}})

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL
detailed listing:
executing program 0:
r0 = socket$unix(0x1, 0x5, 0x0)
ioctl$sock_SIOCETHTOOL(r0, 0x89f0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL
detailed listing:
executing program 0:
r0 = socket$unix(0x1, 0x5, 0x0)
ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000000)={'bridge0\x00', 0x0})

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL
detailed listing:
executing program 0:
r0 = socket$unix(0x1, 0x5, 0x0)
ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000000)={'bridge0\x00', &(0x7f0000000040)=@ethtool_regs})

program did not crash
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL
program crashed: INFO: task hung in corrupted
a never seen crash title: INFO: task hung in corrupted, ignore
simplifying guilty program options
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL
detailed listing:
executing program 0:
r0 = socket$unix(0x1, 0x5, 0x0)
ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000000)={'bridge0\x00', &(0x7f0000000040)=@ethtool_regs={0x4, 0x0, 0x1c, "f42a97b96d02d717af4211c1b78a09759fdf27b29df18979fe4d32e6"}})

program crashed: INFO: task hung in corrupted
a never seen crash title: INFO: task hung in corrupted, ignore
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL
detailed listing:
executing program 0:
r0 = socket$unix(0x1, 0x5, 0x0)
ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000000)={'bridge0\x00', &(0x7f0000000040)=@ethtool_regs={0x4, 0x0, 0x1c, "f42a97b96d02d717af4211c1b78a09759fdf27b29df18979fe4d32e6"}})

program crashed: INFO: task hung in corrupted
a never seen crash title: INFO: task hung in corrupted, ignore
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL
detailed listing:
executing program 0:
r0 = socket$unix(0x1, 0x5, 0x0)
ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000000)={'bridge0\x00', &(0x7f0000000040)=@ethtool_regs={0x4, 0x0, 0x1c, "f42a97b96d02d717af4211c1b78a09759fdf27b29df18979fe4d32e6"}})

program crashed: INFO: task hung in corrupted
validation run: crashed=true
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL
detailed listing:
executing program 0:
r0 = socket$unix(0x1, 0x5, 0x0)
ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000000)={'bridge0\x00', &(0x7f0000000040)=@ethtool_regs={0x4, 0x0, 0x1c, "f42a97b96d02d717af4211c1b78a09759fdf27b29df18979fe4d32e6"}})

program crashed: INFO: task hung in corrupted
validation run: crashed=true
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL
detailed listing:
executing program 0:
r0 = socket$unix(0x1, 0x5, 0x0)
ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000000)={'bridge0\x00', &(0x7f0000000040)=@ethtool_regs={0x4, 0x0, 0x1c, "f42a97b96d02d717af4211c1b78a09759fdf27b29df18979fe4d32e6"}})

program crashed: WARNING in __cfg80211_ibss_joined
validation run: crashed=true
reproducing took 1h1m50.119771026s
repro crashed as (corrupted=false):
------------[ cut here ]------------
!bss
WARNING: net/wireless/ibss.c:37 at __cfg80211_ibss_joined+0x3da/0x450 net/wireless/ibss.c:37, CPU#0: kworker/R-cfg80/57
Modules linked in:
CPU: 0 UID: 0 PID: 57 Comm: kworker/R-cfg80 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: cfg80211 cfg80211_event_work
RIP: 0010:__cfg80211_ibss_joined+0x3da/0x450 net/wireless/ibss.c:37
Code: 00 00 00 75 69 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 92 e6 bd f6 90 0f 0b 90 eb b5 e8 87 e6 bd f6 90 <0f> 0b 90 4c 8b 6c 24 18 eb a5 e8 77 e6 bd f6 90 0f 0b 90 e9 d6 fd
RSP: 0018:ffffc900015e7900 EFLAGS: 00010293
RAX: ffffffff8b07ba79 RBX: dffffc0000000000 RCX: ffff88801bb09e80
RDX: 0000000000000000 RSI: ffffffff8def8008 RDI: ffffffff8c27c200
RBP: ffffc900015e79d0 R08: ffffffff9011a4b7 R09: 1ffffffff2023496
R10: dffffc0000000000 R11: fffffbfff2023497 R12: ffff888033730dd0
R13: 1ffff920002bcf28 R14: ffff88807a203398 R15: 0000000000000006
FS:  0000000000000000(0000) GS:ffff88812545c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9f74feb4b8 CR3: 0000000075f62000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 cfg80211_process_wdev_events+0x387/0x520 net/wireless/util.c:1143
 cfg80211_process_rdev_events+0xa1/0x110 net/wireless/util.c:1171
 cfg80211_event_work+0x31/0x70 net/wireless/core.c:336
 process_one_work kernel/workqueue.c:3276 [inline]
 process_scheduled_works+0xb6e/0x18c0 kernel/workqueue.c:3359
 rescuer_thread+0x827/0x1130 kernel/workqueue.c:3583
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

final repro crashed as (corrupted=false):
------------[ cut here ]------------
!bss
WARNING: net/wireless/ibss.c:37 at __cfg80211_ibss_joined+0x3da/0x450 net/wireless/ibss.c:37, CPU#0: kworker/R-cfg80/57
Modules linked in:
CPU: 0 UID: 0 PID: 57 Comm: kworker/R-cfg80 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: cfg80211 cfg80211_event_work
RIP: 0010:__cfg80211_ibss_joined+0x3da/0x450 net/wireless/ibss.c:37
Code: 00 00 00 75 69 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 92 e6 bd f6 90 0f 0b 90 eb b5 e8 87 e6 bd f6 90 <0f> 0b 90 4c 8b 6c 24 18 eb a5 e8 77 e6 bd f6 90 0f 0b 90 e9 d6 fd
RSP: 0018:ffffc900015e7900 EFLAGS: 00010293
RAX: ffffffff8b07ba79 RBX: dffffc0000000000 RCX: ffff88801bb09e80
RDX: 0000000000000000 RSI: ffffffff8def8008 RDI: ffffffff8c27c200
RBP: ffffc900015e79d0 R08: ffffffff9011a4b7 R09: 1ffffffff2023496
R10: dffffc0000000000 R11: fffffbfff2023497 R12: ffff888033730dd0
R13: 1ffff920002bcf28 R14: ffff88807a203398 R15: 0000000000000006
FS:  0000000000000000(0000) GS:ffff88812545c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9f74feb4b8 CR3: 0000000075f62000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 cfg80211_process_wdev_events+0x387/0x520 net/wireless/util.c:1143
 cfg80211_process_rdev_events+0xa1/0x110 net/wireless/util.c:1171
 cfg80211_event_work+0x31/0x70 net/wireless/core.c:336
 process_one_work kernel/workqueue.c:3276 [inline]
 process_scheduled_works+0xb6e/0x18c0 kernel/workqueue.c:3359
 rescuer_thread+0x827/0x1130 kernel/workqueue.c:3583
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>