Extracting prog: 8m41.688754406s
Minimizing prog: 18m2.885033964s
Simplifying prog options: 15m19.941124988s
Extracting C: 1m47.812940123s
Simplifying C: 0s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000eafa7240936901b02926f400100109021b000124a800800904000001030000000905", @ANYRES64], 0x0)

program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000eafa7240936901b02926f400100109021b000124a800800904000001030000000905", @ANYRES64], 0x0)

program crashed: INFO: task hung in addrconf_dad_work
single: successfully extracted reproducer
found reproducer with 1 syscalls
minimizing guilty program
testing program (duration=8m50.989376016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, 0x0, 0x0)

program did not crash
testing program (duration=8m50.989376016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB, @ANYRES64], 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=8m50.989376016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
program crashed: WARNING in __cfg80211_ibss_joined
a never seen crash title: WARNING in __cfg80211_ibss_joined, ignore
simplifying guilty program options
testing program (duration=8m50.989376016s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000eafa7240936901b02926f400100109021b000124a800800904000001030000000905", @ANYRES64], 0x0)

program crashed: INFO: task hung in corrupted
a never seen crash title: INFO: task hung in corrupted, ignore
testing program (duration=8m50.989376016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000eafa7240936901b02926f400100109021b000124a800800904000001030000000905", @ANYRES64], 0x0)

program did not crash
testing program (duration=8m50.989376016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000eafa7240936901b02926f400100109021b000124a800800904000001030000000905", @ANYRES64], 0x0)

program crashed: INFO: task hung in corrupted
validation run: crashed=true
testing program (duration=8m50.989376016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000eafa7240936901b02926f400100109021b000124a800800904000001030000000905", @ANYRES64], 0x0)

program did not crash
validation run: crashed=false
testing program (duration=8m50.989376016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000eafa7240936901b02926f400100109021b000124a800800904000001030000000905", @ANYRES64], 0x0)

program crashed: INFO: rcu detected stall in corrupted
validation run: crashed=true
testing program (duration=8m50.989376016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000eafa7240936901b02926f400100109021b000124a800800904000001030000000905", @ANYRES64], 0x0)

program did not crash
validation run: crashed=false
testing program (duration=8m50.989376016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000eafa7240936901b02926f400100109021b000124a800800904000001030000000905", @ANYRES64], 0x0)

program crashed: WARNING in __cfg80211_ibss_joined
validation run: crashed=true
reproducing took 1h18m11.888461515s
repro crashed as (corrupted=false):
WARNING: net/wireless/ibss.c:37 at __cfg80211_ibss_joined+0x3d3/0x440 net/wireless/ibss.c:37, CPU#0: kworker/u8:14/6222
Modules linked in:

CPU: 0 UID: 0 PID: 6222 Comm: kworker/u8:14 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026
Workqueue: cfg80211 cfg80211_event_work

RIP: 0010:__cfg80211_ibss_joined+0x3d3/0x440 net/wireless/ibss.c:37
Code: 44 24 60 75 64 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d e9 0a 36 e8 f5 cc e8 79 66 9e f6 90 0f 0b 90 eb b9 e8 6e 66 9e f6 90 <0f> 0b 90 eb ae e8 63 66 9e f6 90 0f 0b 90 e9 d8 fd ff ff e8 55 66
RSP: 0018:ffffc90003aa7980 EFLAGS: 00010293

RAX: ffffffff8b280b12 RBX: dffffc0000000000 RCX: ffff888032003e00
RDX: 0000000000000000 RSI: ffffffff8e22bfa8 RDI: ffffffff8c4bda80
RBP: ffffc90003aa7a38 R08: ffffffff905786f7 R09: 1ffffffff20af0de
R10: dffffc0000000000 R11: fffffbfff20af0df R12: ffff88806f3d8ed0
R13: ffff88807dc834b8 R14: 1ffff92000754f34 R15: 0000000000000006
FS:  0000000000000000(0000) GS:ffff888124f54000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000559f538b7950 CR3: 0000000072700000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 cfg80211_process_wdev_events+0x39f/0x5b0 net/wireless/util.c:1169
 cfg80211_process_rdev_events+0xa1/0x110 net/wireless/util.c:1204
 cfg80211_event_work+0x2f/0x40 net/wireless/core.c:418
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

final repro crashed as (corrupted=false):
WARNING: net/wireless/ibss.c:37 at __cfg80211_ibss_joined+0x3d3/0x440 net/wireless/ibss.c:37, CPU#0: kworker/u8:14/6222
Modules linked in:

CPU: 0 UID: 0 PID: 6222 Comm: kworker/u8:14 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/10/2026
Workqueue: cfg80211 cfg80211_event_work

RIP: 0010:__cfg80211_ibss_joined+0x3d3/0x440 net/wireless/ibss.c:37
Code: 44 24 60 75 64 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d e9 0a 36 e8 f5 cc e8 79 66 9e f6 90 0f 0b 90 eb b9 e8 6e 66 9e f6 90 <0f> 0b 90 eb ae e8 63 66 9e f6 90 0f 0b 90 e9 d8 fd ff ff e8 55 66
RSP: 0018:ffffc90003aa7980 EFLAGS: 00010293

RAX: ffffffff8b280b12 RBX: dffffc0000000000 RCX: ffff888032003e00
RDX: 0000000000000000 RSI: ffffffff8e22bfa8 RDI: ffffffff8c4bda80
RBP: ffffc90003aa7a38 R08: ffffffff905786f7 R09: 1ffffffff20af0de
R10: dffffc0000000000 R11: fffffbfff20af0df R12: ffff88806f3d8ed0
R13: ffff88807dc834b8 R14: 1ffff92000754f34 R15: 0000000000000006
FS:  0000000000000000(0000) GS:ffff888124f54000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000559f538b7950 CR3: 0000000072700000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 cfg80211_process_wdev_events+0x39f/0x5b0 net/wireless/util.c:1169
 cfg80211_process_rdev_events+0xa1/0x110 net/wireless/util.c:1204
 cfg80211_event_work+0x2f/0x40 net/wireless/core.c:418
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>