Extracting prog: 2h17m11.467665895s
Minimizing prog: 16m29.468159384s
Simplifying prog options: 0s
Extracting C: 29.690413376s
Simplifying C: 9m21.035116271s


extracting reproducer from 25 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-openat-write-close
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)

program did not crash
single: failed to extract reproducer
bisect: bisecting 25 programs with base timeout 30s
testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 2, 4, 4, 37, 6, 4, 4, 14, 6, 6, 34, 5, 3, 5, 7, 3, 4, 5, 31, 16, 37, 3, 6, 8]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000100)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x2f, 0x5, 0x57e, 0x2009, 0x1, 0x0, "05010905a101852105010901a10075089540150026ff008102c0853005010901a10075089540150026ff008102c0c0"}}, 0x111c)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/hid/devices/0005:057E:2009.0001/input\x00', 0x0, 0x0)
executing program 3:
r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi0\x00', 0x400, 0x0)
ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000100)={'ni_labpc\x00', [0x260]})
executing program 3:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002000000400a1150120001010203010902270001010080320904000003ffffff00070581024000000705820240000007050102400000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000200)={0x84, &(0x7f0000000100)={0x40, 0x81, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000300)=""/1024, 0x400)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/ignore-gfp-wait\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='N', 0x1)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/task-filter\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='Y', 0x1)
close(r1)
r2 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./debug/failslab/verbose\x00', 0x2, 0x0)
write(r3, &(0x7f00000002c0)='0\x00', 0x1)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./debug/failslab/probability\x00', 0x2, 0x0)
write(r4, &(0x7f0000000340)='5\x00', 0x1)
close(r4)
r5 = openat$make_it_fail(0xffffffffffffff9c, &(0x7f0000000380)='/proc/thread-self/make-it-fail\x00', 0x1, 0x0)
write(r5, &(0x7f00000003c0)='1', 0x1)
close(r5)
r6 = syz_open_dev$dvb_demux(&(0x7f0000000400), 0x0, 0x2)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r6, 0x40146f2c, &(0x7f0000000500)={0x2, 0x0, 0x3, 0x14})
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/tpm\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000200), 0x1000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/tpm_tis\x00', 0x0, 0x0)
getdents64(r1, &(0x7f0000001200), 0x1000)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/state\x00', 0x1, 0x0)
write(r0, &(0x7f0000000340)='freeze\n', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040), &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/i915\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/drm/card1/device/driver\x00', 0x0, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff)
mount(&(0x7f0000000800)=@filename='none\x00', &(0x7f0000000000)='./sec\x00', &(0x7f0000000100)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0)
write(r0, &(0x7f0000000300)='address_group grp1 0.0.0.0-255.255.255.255\naddress_group grp1 ::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff\nacl_group 0 network inet stream bind @grp1 0-65535\nacl_group 0 network inet dgram bind @grp1 0-65535\n', 0xda)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sec/tomoyo/domain_policy\x00', 0x2, 0x0)
write(r1, &(0x7f0000000400)='select pid=1\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\nselect pid=2\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\nselect pid=3\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\nselect pid=4\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\nselect pid=5\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\n<kernel>\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\n<kernel> /init\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\n<kernel> /sbin/init\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\n<kernel> /syz-executor\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\n<kernel> /init /syz-executor\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\n<kernel> /root/syz-executor\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\n', 0x3d0)
close(r1)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r2, &(0x7f0000000500)={0x2, 0x4e20, @local}, 0x10)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r3, &(0x7f0000000600)={0xa, 0x4e21, 0x0, @empty}, 0x1c)
r4 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r4, &(0x7f0000000700)={0x2, 0x4e24, @local}, 0x10)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)='panel-edp\n\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x2, 0x0)
write(r1, &(0x7f0000000400)='pcspkr\n\x00', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000050)='./proc/net/afs/rootcell\x00', 0x2, 0x0)
write(r0, &(0x7f0000000070)='syz0\x00', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./file1\x00', 0x1ff)
mount$afs(&(0x7f0000000100)=@cell={0x23, '', 'syz0'}, &(0x7f0000000e00)='./file1\x00', &(0x7f0000000c00), 0x0, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r5, &(0x7f0000000600)='fc\n', 0x3)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r6, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r6)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
nanosleep(&(0x7f0000000900)={0x0, 0x1dcd6500}, 0x0)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r7, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r7)
close(0xffffffffffffffff)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/drivers/i915\x00', 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/acpi-nfit\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/devices/pcspkr\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/nd/drivers/nd_region\x00', 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/crypto/af_alg_restrict\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0\x00', 0x1)
close(r0)
r1 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r1, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106(gcm(aes))\x00'}, 0x58)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/vfio-pci\x00', 0x0, 0x0)
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000480)={'lo\x00', <r2=>0x0})
sendmsg$ETHTOOL_MSG_STATS_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)={0x44, r1, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_STATS_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}]}, @ETHTOOL_A_STATS_SRC={0x8, 0x3, 0x1}, @ETHTOOL_A_STATS_GROUPS={0x1c, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x1}, @ETHTOOL_A_BITSET_VALUE={0x8}, @ETHTOOL_A_BITSET_MASK={0x8}]}]}, 0x44}}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
read(r0, &(0x7f0000000200)=""/100, 0x64)
close(r0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x2000000010000001,wwpn=0x2000000010000002\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, 0x0, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, 0x0, 0x0)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r3, &(0x7f0000000440)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000500)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r5, &(0x7f0000000580)='fc\n', 0x3)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r6, &(0x7f0000000600)='nn-0x2000000010000001:pn-0x2000000010000002\n', 0x2c)
close(r6)
symlinkat(&(0x7f0000000640)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r7 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000700), 0x2, 0x0)
write(r7, &(0x7f0000000740)='transport=fc,traddr=nn-0x2000000010000001:pn-0x2000000010000002,host_traddr=nn-0x1000000010000001:pn-0x1000000010000002,nqn=testsubsys\n', 0x87)
nanosleep(&(0x7f0000000800)={0x0, 0xbebc200}, 0x0)
executing program 2:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind(r0, &(0x7f0000000000)=@hci={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000010)="4a00ffff11003ee0b4fdddd685986a49e00588f1ba6f01", 0x17)
write(0xca, &(0x7f0000000040)="040e0c01031000ffffffdfffffffff", 0xf)
write(0xca, &(0x7f0000000060)="040e0e010410000102ffffffffffffffff", 0x11)
write(0xca, &(0x7f0000000080)="040e0c01032000ffffffffffffffff", 0xf)
write(0xca, &(0x7f00000000a0)="040e0a01602000fb000afb000a", 0xd)
write(r0, &(0x7f00000000c0)="0d000000010001", 0x7)
write(0xca, &(0x7f00000000e0)="040e04016d0c00", 0x7)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r1 = syz_init_net_socket$bt_hci(0x1f, 0x805, 0x8)
setsockopt$sock_timeval(r1, 0x1, 0x15, &(0x7f0000000100)={0x0, 0x3e8}, 0x10)
connect(r1, &(0x7f0000000200)=@un=@file={0x1f, '\x00\x00\x00\x00\x00\x00\x01\x00'}, 0xa)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x805, 0x8)
setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000100)={0x0, 0x3e8}, 0x10)
connect(r2, &(0x7f0000000200)=@un=@file={0x1f, '\x00\x00\x00\x00\x00\x00\x01\x00'}, 0xa)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/ignore-gfp-wait\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='N', 0x1)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/task-filter\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='Y', 0x1)
close(r1)
r2 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./debug/failslab/verbose\x00', 0x2, 0x0)
write(r3, &(0x7f00000002c0)='0\x00', 0x1)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./debug/failslab/probability\x00', 0x2, 0x0)
write(r4, &(0x7f0000000340)='5\x00', 0x1)
close(r4)
r5 = openat$make_it_fail(0xffffffffffffff9c, &(0x7f0000000380)='/proc/thread-self/make-it-fail\x00', 0x1, 0x0)
write(r5, &(0x7f00000003c0)='1\x00', 0x1)
close(r5)
r6 = syz_open_dev$dvb_demux(0x0, 0x0, 0x2)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r6, 0x40146f2c, &(0x7f0000000500)={0x2, 0x0, 0x3, 0x14})
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/sound/card2\x00', 0x0, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000340)='1\n', 0x2)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-openat-write-close
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)

program did not crash
single: failed to extract reproducer
bisect: bisecting 25 programs with base timeout 1m40s
testing program (duration=1m46s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 2, 4, 4, 37, 6, 4, 4, 14, 6, 6, 34, 5, 3, 5, 7, 3, 4, 5, 31, 16, 37, 3, 6, 8]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000100)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x2f, 0x5, 0x57e, 0x2009, 0x1, 0x0, "05010905a101852105010901a10075089540150026ff008102c0853005010901a10075089540150026ff008102c0c0"}}, 0x111c)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/hid/devices/0005:057E:2009.0001/input\x00', 0x0, 0x0)
executing program 3:
r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi0\x00', 0x400, 0x0)
ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000100)={'ni_labpc\x00', [0x260]})
executing program 3:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002000000400a1150120001010203010902270001010080320904000003ffffff00070581024000000705820240000007050102400000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000200)={0x84, &(0x7f0000000100)={0x40, 0x81, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000300)=""/1024, 0x400)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/ignore-gfp-wait\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='N', 0x1)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/task-filter\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='Y', 0x1)
close(r1)
r2 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./debug/failslab/verbose\x00', 0x2, 0x0)
write(r3, &(0x7f00000002c0)='0\x00', 0x1)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./debug/failslab/probability\x00', 0x2, 0x0)
write(r4, &(0x7f0000000340)='5\x00', 0x1)
close(r4)
r5 = openat$make_it_fail(0xffffffffffffff9c, &(0x7f0000000380)='/proc/thread-self/make-it-fail\x00', 0x1, 0x0)
write(r5, &(0x7f00000003c0)='1', 0x1)
close(r5)
r6 = syz_open_dev$dvb_demux(&(0x7f0000000400), 0x0, 0x2)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r6, 0x40146f2c, &(0x7f0000000500)={0x2, 0x0, 0x3, 0x14})
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/tpm\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000200), 0x1000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/tpm_tis\x00', 0x0, 0x0)
getdents64(r1, &(0x7f0000001200), 0x1000)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/state\x00', 0x1, 0x0)
write(r0, &(0x7f0000000340)='freeze\n', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040), &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/i915\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/drm/card1/device/driver\x00', 0x0, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff)
mount(&(0x7f0000000800)=@filename='none\x00', &(0x7f0000000000)='./sec\x00', &(0x7f0000000100)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0)
write(r0, &(0x7f0000000300)='address_group grp1 0.0.0.0-255.255.255.255\naddress_group grp1 ::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff\nacl_group 0 network inet stream bind @grp1 0-65535\nacl_group 0 network inet dgram bind @grp1 0-65535\n', 0xda)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sec/tomoyo/domain_policy\x00', 0x2, 0x0)
write(r1, &(0x7f0000000400)='select pid=1\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\nselect pid=2\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\nselect pid=3\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\nselect pid=4\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\nselect pid=5\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\n<kernel>\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\n<kernel> /init\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\n<kernel> /sbin/init\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\n<kernel> /syz-executor\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\n<kernel> /init /syz-executor\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\n<kernel> /root/syz-executor\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\n', 0x3d0)
close(r1)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r2, &(0x7f0000000500)={0x2, 0x4e20, @local}, 0x10)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r3, &(0x7f0000000600)={0xa, 0x4e21, 0x0, @empty}, 0x1c)
r4 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r4, &(0x7f0000000700)={0x2, 0x4e24, @local}, 0x10)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)='panel-edp\n\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x2, 0x0)
write(r1, &(0x7f0000000400)='pcspkr\n\x00', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000050)='./proc/net/afs/rootcell\x00', 0x2, 0x0)
write(r0, &(0x7f0000000070)='syz0\x00', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./file1\x00', 0x1ff)
mount$afs(&(0x7f0000000100)=@cell={0x23, '', 'syz0'}, &(0x7f0000000e00)='./file1\x00', &(0x7f0000000c00), 0x0, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r5, &(0x7f0000000600)='fc\n', 0x3)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r6, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r6)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
nanosleep(&(0x7f0000000900)={0x0, 0x1dcd6500}, 0x0)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r7, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r7)
close(0xffffffffffffffff)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/drivers/i915\x00', 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/acpi-nfit\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/devices/pcspkr\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/nd/drivers/nd_region\x00', 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/crypto/af_alg_restrict\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0\x00', 0x1)
close(r0)
r1 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r1, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106(gcm(aes))\x00'}, 0x58)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/vfio-pci\x00', 0x0, 0x0)
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000480)={'lo\x00', <r2=>0x0})
sendmsg$ETHTOOL_MSG_STATS_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)={0x44, r1, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_STATS_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}]}, @ETHTOOL_A_STATS_SRC={0x8, 0x3, 0x1}, @ETHTOOL_A_STATS_GROUPS={0x1c, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x1}, @ETHTOOL_A_BITSET_VALUE={0x8}, @ETHTOOL_A_BITSET_MASK={0x8}]}]}, 0x44}}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
read(r0, &(0x7f0000000200)=""/100, 0x64)
close(r0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x2000000010000001,wwpn=0x2000000010000002\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, 0x0, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, 0x0, 0x0)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r3, &(0x7f0000000440)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000500)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r5, &(0x7f0000000580)='fc\n', 0x3)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r6, &(0x7f0000000600)='nn-0x2000000010000001:pn-0x2000000010000002\n', 0x2c)
close(r6)
symlinkat(&(0x7f0000000640)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r7 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000700), 0x2, 0x0)
write(r7, &(0x7f0000000740)='transport=fc,traddr=nn-0x2000000010000001:pn-0x2000000010000002,host_traddr=nn-0x1000000010000001:pn-0x1000000010000002,nqn=testsubsys\n', 0x87)
nanosleep(&(0x7f0000000800)={0x0, 0xbebc200}, 0x0)
executing program 2:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind(r0, &(0x7f0000000000)=@hci={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000010)="4a00ffff11003ee0b4fdddd685986a49e00588f1ba6f01", 0x17)
write(0xca, &(0x7f0000000040)="040e0c01031000ffffffdfffffffff", 0xf)
write(0xca, &(0x7f0000000060)="040e0e010410000102ffffffffffffffff", 0x11)
write(0xca, &(0x7f0000000080)="040e0c01032000ffffffffffffffff", 0xf)
write(0xca, &(0x7f00000000a0)="040e0a01602000fb000afb000a", 0xd)
write(r0, &(0x7f00000000c0)="0d000000010001", 0x7)
write(0xca, &(0x7f00000000e0)="040e04016d0c00", 0x7)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r1 = syz_init_net_socket$bt_hci(0x1f, 0x805, 0x8)
setsockopt$sock_timeval(r1, 0x1, 0x15, &(0x7f0000000100)={0x0, 0x3e8}, 0x10)
connect(r1, &(0x7f0000000200)=@un=@file={0x1f, '\x00\x00\x00\x00\x00\x00\x01\x00'}, 0xa)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x805, 0x8)
setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000100)={0x0, 0x3e8}, 0x10)
connect(r2, &(0x7f0000000200)=@un=@file={0x1f, '\x00\x00\x00\x00\x00\x00\x01\x00'}, 0xa)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/ignore-gfp-wait\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='N', 0x1)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/task-filter\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='Y', 0x1)
close(r1)
r2 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./debug/failslab/verbose\x00', 0x2, 0x0)
write(r3, &(0x7f00000002c0)='0\x00', 0x1)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./debug/failslab/probability\x00', 0x2, 0x0)
write(r4, &(0x7f0000000340)='5\x00', 0x1)
close(r4)
r5 = openat$make_it_fail(0xffffffffffffff9c, &(0x7f0000000380)='/proc/thread-self/make-it-fail\x00', 0x1, 0x0)
write(r5, &(0x7f00000003c0)='1\x00', 0x1)
close(r5)
r6 = syz_open_dev$dvb_demux(0x0, 0x0, 0x2)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r6, 0x40146f2c, &(0x7f0000000500)={0x2, 0x0, 0x3, 0x14})
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/sound/card2\x00', 0x0, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000340)='1\n', 0x2)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-openat-write-close
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)

program did not crash
single: failed to extract reproducer
bisect: bisecting 25 programs with base timeout 6m0s
testing program (duration=6m6s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 2, 4, 4, 37, 6, 4, 4, 14, 6, 6, 34, 5, 3, 5, 7, 3, 4, 5, 31, 16, 37, 3, 6, 8]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000100)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x2f, 0x5, 0x57e, 0x2009, 0x1, 0x0, "05010905a101852105010901a10075089540150026ff008102c0853005010901a10075089540150026ff008102c0c0"}}, 0x111c)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/hid/devices/0005:057E:2009.0001/input\x00', 0x0, 0x0)
executing program 3:
r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi0\x00', 0x400, 0x0)
ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000100)={'ni_labpc\x00', [0x260]})
executing program 3:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002000000400a1150120001010203010902270001010080320904000003ffffff00070581024000000705820240000007050102400000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000200)={0x84, &(0x7f0000000100)={0x40, 0x81, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000300)=""/1024, 0x400)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/ignore-gfp-wait\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='N', 0x1)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/task-filter\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='Y', 0x1)
close(r1)
r2 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./debug/failslab/verbose\x00', 0x2, 0x0)
write(r3, &(0x7f00000002c0)='0\x00', 0x1)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./debug/failslab/probability\x00', 0x2, 0x0)
write(r4, &(0x7f0000000340)='5\x00', 0x1)
close(r4)
r5 = openat$make_it_fail(0xffffffffffffff9c, &(0x7f0000000380)='/proc/thread-self/make-it-fail\x00', 0x1, 0x0)
write(r5, &(0x7f00000003c0)='1', 0x1)
close(r5)
r6 = syz_open_dev$dvb_demux(&(0x7f0000000400), 0x0, 0x2)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r6, 0x40146f2c, &(0x7f0000000500)={0x2, 0x0, 0x3, 0x14})
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/tpm\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000200), 0x1000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/tpm_tis\x00', 0x0, 0x0)
getdents64(r1, &(0x7f0000001200), 0x1000)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/state\x00', 0x1, 0x0)
write(r0, &(0x7f0000000340)='freeze\n', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040), &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/i915\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/drm/card1/device/driver\x00', 0x0, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff)
mount(&(0x7f0000000800)=@filename='none\x00', &(0x7f0000000000)='./sec\x00', &(0x7f0000000100)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0)
write(r0, &(0x7f0000000300)='address_group grp1 0.0.0.0-255.255.255.255\naddress_group grp1 ::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff\nacl_group 0 network inet stream bind @grp1 0-65535\nacl_group 0 network inet dgram bind @grp1 0-65535\n', 0xda)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sec/tomoyo/domain_policy\x00', 0x2, 0x0)
write(r1, &(0x7f0000000400)='select pid=1\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\nselect pid=2\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\nselect pid=3\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\nselect pid=4\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\nselect pid=5\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\n<kernel>\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\n<kernel> /init\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\n<kernel> /sbin/init\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\n<kernel> /syz-executor\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\n<kernel> /init /syz-executor\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\n<kernel> /root/syz-executor\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\n', 0x3d0)
close(r1)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r2, &(0x7f0000000500)={0x2, 0x4e20, @local}, 0x10)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r3, &(0x7f0000000600)={0xa, 0x4e21, 0x0, @empty}, 0x1c)
r4 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r4, &(0x7f0000000700)={0x2, 0x4e24, @local}, 0x10)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)='panel-edp\n\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x2, 0x0)
write(r1, &(0x7f0000000400)='pcspkr\n\x00', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000050)='./proc/net/afs/rootcell\x00', 0x2, 0x0)
write(r0, &(0x7f0000000070)='syz0\x00', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./file1\x00', 0x1ff)
mount$afs(&(0x7f0000000100)=@cell={0x23, '', 'syz0'}, &(0x7f0000000e00)='./file1\x00', &(0x7f0000000c00), 0x0, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r5, &(0x7f0000000600)='fc\n', 0x3)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r6, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r6)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
nanosleep(&(0x7f0000000900)={0x0, 0x1dcd6500}, 0x0)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r7, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r7)
close(0xffffffffffffffff)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/drivers/i915\x00', 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/acpi-nfit\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/devices/pcspkr\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/nd/drivers/nd_region\x00', 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/crypto/af_alg_restrict\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0\x00', 0x1)
close(r0)
r1 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r1, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106(gcm(aes))\x00'}, 0x58)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/vfio-pci\x00', 0x0, 0x0)
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000480)={'lo\x00', <r2=>0x0})
sendmsg$ETHTOOL_MSG_STATS_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)={0x44, r1, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_STATS_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}]}, @ETHTOOL_A_STATS_SRC={0x8, 0x3, 0x1}, @ETHTOOL_A_STATS_GROUPS={0x1c, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x1}, @ETHTOOL_A_BITSET_VALUE={0x8}, @ETHTOOL_A_BITSET_MASK={0x8}]}]}, 0x44}}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
read(r0, &(0x7f0000000200)=""/100, 0x64)
close(r0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x2000000010000001,wwpn=0x2000000010000002\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, 0x0, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, 0x0, 0x0)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r3, &(0x7f0000000440)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000500)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r5, &(0x7f0000000580)='fc\n', 0x3)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r6, &(0x7f0000000600)='nn-0x2000000010000001:pn-0x2000000010000002\n', 0x2c)
close(r6)
symlinkat(&(0x7f0000000640)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r7 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000700), 0x2, 0x0)
write(r7, &(0x7f0000000740)='transport=fc,traddr=nn-0x2000000010000001:pn-0x2000000010000002,host_traddr=nn-0x1000000010000001:pn-0x1000000010000002,nqn=testsubsys\n', 0x87)
nanosleep(&(0x7f0000000800)={0x0, 0xbebc200}, 0x0)
executing program 2:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind(r0, &(0x7f0000000000)=@hci={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000010)="4a00ffff11003ee0b4fdddd685986a49e00588f1ba6f01", 0x17)
write(0xca, &(0x7f0000000040)="040e0c01031000ffffffdfffffffff", 0xf)
write(0xca, &(0x7f0000000060)="040e0e010410000102ffffffffffffffff", 0x11)
write(0xca, &(0x7f0000000080)="040e0c01032000ffffffffffffffff", 0xf)
write(0xca, &(0x7f00000000a0)="040e0a01602000fb000afb000a", 0xd)
write(r0, &(0x7f00000000c0)="0d000000010001", 0x7)
write(0xca, &(0x7f00000000e0)="040e04016d0c00", 0x7)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r1 = syz_init_net_socket$bt_hci(0x1f, 0x805, 0x8)
setsockopt$sock_timeval(r1, 0x1, 0x15, &(0x7f0000000100)={0x0, 0x3e8}, 0x10)
connect(r1, &(0x7f0000000200)=@un=@file={0x1f, '\x00\x00\x00\x00\x00\x00\x01\x00'}, 0xa)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x805, 0x8)
setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000100)={0x0, 0x3e8}, 0x10)
connect(r2, &(0x7f0000000200)=@un=@file={0x1f, '\x00\x00\x00\x00\x00\x00\x01\x00'}, 0xa)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/ignore-gfp-wait\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='N', 0x1)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/task-filter\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='Y', 0x1)
close(r1)
r2 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./debug/failslab/verbose\x00', 0x2, 0x0)
write(r3, &(0x7f00000002c0)='0\x00', 0x1)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./debug/failslab/probability\x00', 0x2, 0x0)
write(r4, &(0x7f0000000340)='5\x00', 0x1)
close(r4)
r5 = openat$make_it_fail(0xffffffffffffff9c, &(0x7f0000000380)='/proc/thread-self/make-it-fail\x00', 0x1, 0x0)
write(r5, &(0x7f00000003c0)='1\x00', 0x1)
close(r5)
r6 = syz_open_dev$dvb_demux(0x0, 0x0, 0x2)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r6, 0x40146f2c, &(0x7f0000000500)={0x2, 0x0, 0x3, 0x14})
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/sound/card2\x00', 0x0, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000340)='1\n', 0x2)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)

program crashed: no output from test machine
bisect: bisecting 25 programs
bisect: split chunks (needed=false): <24>
bisect: split chunk #0 of len 24 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=6m4s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 6, 6, 34, 5, 3, 5, 7, 3, 4, 5, 31, 16, 37, 3, 6, 8]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff)
mount(&(0x7f0000000800)=@filename='none\x00', &(0x7f0000000000)='./sec\x00', &(0x7f0000000100)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0)
write(r0, &(0x7f0000000300)='address_group grp1 0.0.0.0-255.255.255.255\naddress_group grp1 ::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff\nacl_group 0 network inet stream bind @grp1 0-65535\nacl_group 0 network inet dgram bind @grp1 0-65535\n', 0xda)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sec/tomoyo/domain_policy\x00', 0x2, 0x0)
write(r1, &(0x7f0000000400)='select pid=1\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\nselect pid=2\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\nselect pid=3\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\nselect pid=4\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\nselect pid=5\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\n<kernel>\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\n<kernel> /init\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\n<kernel> /sbin/init\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\n<kernel> /syz-executor\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\n<kernel> /init /syz-executor\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\n<kernel> /root/syz-executor\nuse_group 0\nnetwork inet stream bind @grp1 0-65535\nnetwork inet dgram bind @grp1 0-65535\n', 0x3d0)
close(r1)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r2, &(0x7f0000000500)={0x2, 0x4e20, @local}, 0x10)
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r3, &(0x7f0000000600)={0xa, 0x4e21, 0x0, @empty}, 0x1c)
r4 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r4, &(0x7f0000000700)={0x2, 0x4e24, @local}, 0x10)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)='panel-edp\n\x00', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x2, 0x0)
write(r1, &(0x7f0000000400)='pcspkr\n\x00', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000050)='./proc/net/afs/rootcell\x00', 0x2, 0x0)
write(r0, &(0x7f0000000070)='syz0\x00', 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000e00)='./file1\x00', 0x1ff)
mount$afs(&(0x7f0000000100)=@cell={0x23, '', 'syz0'}, &(0x7f0000000e00)='./file1\x00', &(0x7f0000000c00), 0x0, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r5, &(0x7f0000000600)='fc\n', 0x3)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r6, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r6)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
nanosleep(&(0x7f0000000900)={0x0, 0x1dcd6500}, 0x0)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r7, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r7)
close(0xffffffffffffffff)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/drivers\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/drivers/i915\x00', 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/platform/drivers/acpi-nfit\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/devices/pcspkr\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/nd/drivers/nd_region\x00', 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/crypto/af_alg_restrict\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0\x00', 0x1)
close(r0)
r1 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r1, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106(gcm(aes))\x00'}, 0x58)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/vfio-pci\x00', 0x0, 0x0)
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000480)={'lo\x00', <r2=>0x0})
sendmsg$ETHTOOL_MSG_STATS_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)={0x44, r1, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_STATS_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}]}, @ETHTOOL_A_STATS_SRC={0x8, 0x3, 0x1}, @ETHTOOL_A_STATS_GROUPS={0x1c, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x1}, @ETHTOOL_A_BITSET_VALUE={0x8}, @ETHTOOL_A_BITSET_MASK={0x8}]}]}, 0x44}}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
read(r0, &(0x7f0000000200)=""/100, 0x64)
close(r0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x2000000010000001,wwpn=0x2000000010000002\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, 0x0, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, 0x0, 0x0)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r3, &(0x7f0000000440)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000500)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r5, &(0x7f0000000580)='fc\n', 0x3)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r6, &(0x7f0000000600)='nn-0x2000000010000001:pn-0x2000000010000002\n', 0x2c)
close(r6)
symlinkat(&(0x7f0000000640)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r7 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000700), 0x2, 0x0)
write(r7, &(0x7f0000000740)='transport=fc,traddr=nn-0x2000000010000001:pn-0x2000000010000002,host_traddr=nn-0x1000000010000001:pn-0x1000000010000002,nqn=testsubsys\n', 0x87)
nanosleep(&(0x7f0000000800)={0x0, 0xbebc200}, 0x0)
executing program 2:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind(r0, &(0x7f0000000000)=@hci={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000010)="4a00ffff11003ee0b4fdddd685986a49e00588f1ba6f01", 0x17)
write(0xca, &(0x7f0000000040)="040e0c01031000ffffffdfffffffff", 0xf)
write(0xca, &(0x7f0000000060)="040e0e010410000102ffffffffffffffff", 0x11)
write(0xca, &(0x7f0000000080)="040e0c01032000ffffffffffffffff", 0xf)
write(0xca, &(0x7f00000000a0)="040e0a01602000fb000afb000a", 0xd)
write(r0, &(0x7f00000000c0)="0d000000010001", 0x7)
write(0xca, &(0x7f00000000e0)="040e04016d0c00", 0x7)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r1 = syz_init_net_socket$bt_hci(0x1f, 0x805, 0x8)
setsockopt$sock_timeval(r1, 0x1, 0x15, &(0x7f0000000100)={0x0, 0x3e8}, 0x10)
connect(r1, &(0x7f0000000200)=@un=@file={0x1f, '\x00\x00\x00\x00\x00\x00\x01\x00'}, 0xa)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x805, 0x8)
setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000100)={0x0, 0x3e8}, 0x10)
connect(r2, &(0x7f0000000200)=@un=@file={0x1f, '\x00\x00\x00\x00\x00\x00\x01\x00'}, 0xa)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/ignore-gfp-wait\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='N', 0x1)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/task-filter\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='Y', 0x1)
close(r1)
r2 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./debug/failslab/verbose\x00', 0x2, 0x0)
write(r3, &(0x7f00000002c0)='0\x00', 0x1)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./debug/failslab/probability\x00', 0x2, 0x0)
write(r4, &(0x7f0000000340)='5\x00', 0x1)
close(r4)
r5 = openat$make_it_fail(0xffffffffffffff9c, &(0x7f0000000380)='/proc/thread-self/make-it-fail\x00', 0x1, 0x0)
write(r5, &(0x7f00000003c0)='1\x00', 0x1)
close(r5)
r6 = syz_open_dev$dvb_demux(0x0, 0x0, 0x2)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r6, 0x40146f2c, &(0x7f0000000500)={0x2, 0x0, 0x3, 0x14})
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/sound/card2\x00', 0x0, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000340)='1\n', 0x2)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)

program did not crash
bisect: testing without sub-chunk 2/3
testing program (duration=6m4s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 2, 4, 4, 37, 6, 4, 4, 3, 4, 5, 31, 16, 37, 3, 6, 8]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000100)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x2f, 0x5, 0x57e, 0x2009, 0x1, 0x0, "05010905a101852105010901a10075089540150026ff008102c0853005010901a10075089540150026ff008102c0c0"}}, 0x111c)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/hid/devices/0005:057E:2009.0001/input\x00', 0x0, 0x0)
executing program 3:
r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi0\x00', 0x400, 0x0)
ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000100)={'ni_labpc\x00', [0x260]})
executing program 3:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002000000400a1150120001010203010902270001010080320904000003ffffff00070581024000000705820240000007050102400000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000200)={0x84, &(0x7f0000000100)={0x40, 0x81, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000300)=""/1024, 0x400)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/ignore-gfp-wait\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='N', 0x1)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/task-filter\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='Y', 0x1)
close(r1)
r2 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./debug/failslab/verbose\x00', 0x2, 0x0)
write(r3, &(0x7f00000002c0)='0\x00', 0x1)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./debug/failslab/probability\x00', 0x2, 0x0)
write(r4, &(0x7f0000000340)='5\x00', 0x1)
close(r4)
r5 = openat$make_it_fail(0xffffffffffffff9c, &(0x7f0000000380)='/proc/thread-self/make-it-fail\x00', 0x1, 0x0)
write(r5, &(0x7f00000003c0)='1', 0x1)
close(r5)
r6 = syz_open_dev$dvb_demux(&(0x7f0000000400), 0x0, 0x2)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r6, 0x40146f2c, &(0x7f0000000500)={0x2, 0x0, 0x3, 0x14})
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/tpm\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000200), 0x1000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/tpm_tis\x00', 0x0, 0x0)
getdents64(r1, &(0x7f0000001200), 0x1000)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/state\x00', 0x1, 0x0)
write(r0, &(0x7f0000000340)='freeze\n', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040), &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/i915\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/drm/card1/device/driver\x00', 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/vfio-pci\x00', 0x0, 0x0)
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000480)={'lo\x00', <r2=>0x0})
sendmsg$ETHTOOL_MSG_STATS_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)={0x44, r1, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_STATS_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}]}, @ETHTOOL_A_STATS_SRC={0x8, 0x3, 0x1}, @ETHTOOL_A_STATS_GROUPS={0x1c, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x1}, @ETHTOOL_A_BITSET_VALUE={0x8}, @ETHTOOL_A_BITSET_MASK={0x8}]}]}, 0x44}}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
read(r0, &(0x7f0000000200)=""/100, 0x64)
close(r0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x2000000010000001,wwpn=0x2000000010000002\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, 0x0, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, 0x0, 0x0)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r3, &(0x7f0000000440)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000500)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r5, &(0x7f0000000580)='fc\n', 0x3)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r6, &(0x7f0000000600)='nn-0x2000000010000001:pn-0x2000000010000002\n', 0x2c)
close(r6)
symlinkat(&(0x7f0000000640)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r7 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000700), 0x2, 0x0)
write(r7, &(0x7f0000000740)='transport=fc,traddr=nn-0x2000000010000001:pn-0x2000000010000002,host_traddr=nn-0x1000000010000001:pn-0x1000000010000002,nqn=testsubsys\n', 0x87)
nanosleep(&(0x7f0000000800)={0x0, 0xbebc200}, 0x0)
executing program 2:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind(r0, &(0x7f0000000000)=@hci={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000010)="4a00ffff11003ee0b4fdddd685986a49e00588f1ba6f01", 0x17)
write(0xca, &(0x7f0000000040)="040e0c01031000ffffffdfffffffff", 0xf)
write(0xca, &(0x7f0000000060)="040e0e010410000102ffffffffffffffff", 0x11)
write(0xca, &(0x7f0000000080)="040e0c01032000ffffffffffffffff", 0xf)
write(0xca, &(0x7f00000000a0)="040e0a01602000fb000afb000a", 0xd)
write(r0, &(0x7f00000000c0)="0d000000010001", 0x7)
write(0xca, &(0x7f00000000e0)="040e04016d0c00", 0x7)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r1 = syz_init_net_socket$bt_hci(0x1f, 0x805, 0x8)
setsockopt$sock_timeval(r1, 0x1, 0x15, &(0x7f0000000100)={0x0, 0x3e8}, 0x10)
connect(r1, &(0x7f0000000200)=@un=@file={0x1f, '\x00\x00\x00\x00\x00\x00\x01\x00'}, 0xa)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x805, 0x8)
setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000100)={0x0, 0x3e8}, 0x10)
connect(r2, &(0x7f0000000200)=@un=@file={0x1f, '\x00\x00\x00\x00\x00\x00\x01\x00'}, 0xa)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/ignore-gfp-wait\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='N', 0x1)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/task-filter\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='Y', 0x1)
close(r1)
r2 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./debug/failslab/verbose\x00', 0x2, 0x0)
write(r3, &(0x7f00000002c0)='0\x00', 0x1)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./debug/failslab/probability\x00', 0x2, 0x0)
write(r4, &(0x7f0000000340)='5\x00', 0x1)
close(r4)
r5 = openat$make_it_fail(0xffffffffffffff9c, &(0x7f0000000380)='/proc/thread-self/make-it-fail\x00', 0x1, 0x0)
write(r5, &(0x7f00000003c0)='1\x00', 0x1)
close(r5)
r6 = syz_open_dev$dvb_demux(0x0, 0x0, 0x2)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r6, 0x40146f2c, &(0x7f0000000500)={0x2, 0x0, 0x3, 0x14})
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/sound/card2\x00', 0x0, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000340)='1\n', 0x2)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)

program crashed: no output from test machine
bisect: the chunk can be dropped
bisect: testing without sub-chunk 3/3
testing program (duration=6m2s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 2, 4, 4, 37, 6, 4, 4, 8]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000100)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x2f, 0x5, 0x57e, 0x2009, 0x1, 0x0, "05010905a101852105010901a10075089540150026ff008102c0853005010901a10075089540150026ff008102c0c0"}}, 0x111c)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/hid/devices/0005:057E:2009.0001/input\x00', 0x0, 0x0)
executing program 3:
r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi0\x00', 0x400, 0x0)
ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000100)={'ni_labpc\x00', [0x260]})
executing program 3:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002000000400a1150120001010203010902270001010080320904000003ffffff00070581024000000705820240000007050102400000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000200)={0x84, &(0x7f0000000100)={0x40, 0x81, 0x4, '\x00\x00\x00\x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, 0x0)
nanosleep(&(0x7f0000000500)={0x0, 0x5f5e100}, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000300)=""/1024, 0x400)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/ignore-gfp-wait\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='N', 0x1)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/task-filter\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='Y', 0x1)
close(r1)
r2 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./debug/failslab/verbose\x00', 0x2, 0x0)
write(r3, &(0x7f00000002c0)='0\x00', 0x1)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./debug/failslab/probability\x00', 0x2, 0x0)
write(r4, &(0x7f0000000340)='5\x00', 0x1)
close(r4)
r5 = openat$make_it_fail(0xffffffffffffff9c, &(0x7f0000000380)='/proc/thread-self/make-it-fail\x00', 0x1, 0x0)
write(r5, &(0x7f00000003c0)='1', 0x1)
close(r5)
r6 = syz_open_dev$dvb_demux(&(0x7f0000000400), 0x0, 0x2)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r6, 0x40146f2c, &(0x7f0000000500)={0x2, 0x0, 0x3, 0x14})
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/tpm\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000200), 0x1000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/tpm_tis\x00', 0x0, 0x0)
getdents64(r1, &(0x7f0000001200), 0x1000)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/state\x00', 0x1, 0x0)
write(r0, &(0x7f0000000340)='freeze\n', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040), &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/i915\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/drm/card1/device/driver\x00', 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)

program did not crash
bisect: split chunks (needed=true): <8>, <8>
bisect: split chunk #0 of len 8 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m3s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [37, 6, 4, 4, 3, 4, 5, 31, 16, 37, 3, 6, 8]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/ignore-gfp-wait\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='N', 0x1)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/task-filter\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='Y', 0x1)
close(r1)
r2 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./debug/failslab/verbose\x00', 0x2, 0x0)
write(r3, &(0x7f00000002c0)='0\x00', 0x1)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./debug/failslab/probability\x00', 0x2, 0x0)
write(r4, &(0x7f0000000340)='5\x00', 0x1)
close(r4)
r5 = openat$make_it_fail(0xffffffffffffff9c, &(0x7f0000000380)='/proc/thread-self/make-it-fail\x00', 0x1, 0x0)
write(r5, &(0x7f00000003c0)='1', 0x1)
close(r5)
r6 = syz_open_dev$dvb_demux(&(0x7f0000000400), 0x0, 0x2)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r6, 0x40146f2c, &(0x7f0000000500)={0x2, 0x0, 0x3, 0x14})
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/tpm\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000200), 0x1000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/tpm_tis\x00', 0x0, 0x0)
getdents64(r1, &(0x7f0000001200), 0x1000)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/state\x00', 0x1, 0x0)
write(r0, &(0x7f0000000340)='freeze\n', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040), &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/i915\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/drm/card1/device/driver\x00', 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/vfio-pci\x00', 0x0, 0x0)
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000480)={'lo\x00', <r2=>0x0})
sendmsg$ETHTOOL_MSG_STATS_GET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)={0x44, r1, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_STATS_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}]}, @ETHTOOL_A_STATS_SRC={0x8, 0x3, 0x1}, @ETHTOOL_A_STATS_GROUPS={0x1c, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x1}, @ETHTOOL_A_BITSET_VALUE={0x8}, @ETHTOOL_A_BITSET_MASK={0x8}]}]}, 0x44}}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
read(r0, &(0x7f0000000200)=""/100, 0x64)
close(r0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000180)='./config\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x2000000010000001,wwpn=0x2000000010000002\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, 0x0, 0x0)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, 0x0, 0x0)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r3, &(0x7f0000000440)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000500)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r5, &(0x7f0000000580)='fc\n', 0x3)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r6, &(0x7f0000000600)='nn-0x2000000010000001:pn-0x2000000010000002\n', 0x2c)
close(r6)
symlinkat(&(0x7f0000000640)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r7 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000700), 0x2, 0x0)
write(r7, &(0x7f0000000740)='transport=fc,traddr=nn-0x2000000010000001:pn-0x2000000010000002,host_traddr=nn-0x1000000010000001:pn-0x1000000010000002,nqn=testsubsys\n', 0x87)
nanosleep(&(0x7f0000000800)={0x0, 0xbebc200}, 0x0)
executing program 2:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind(r0, &(0x7f0000000000)=@hci={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000010)="4a00ffff11003ee0b4fdddd685986a49e00588f1ba6f01", 0x17)
write(0xca, &(0x7f0000000040)="040e0c01031000ffffffdfffffffff", 0xf)
write(0xca, &(0x7f0000000060)="040e0e010410000102ffffffffffffffff", 0x11)
write(0xca, &(0x7f0000000080)="040e0c01032000ffffffffffffffff", 0xf)
write(0xca, &(0x7f00000000a0)="040e0a01602000fb000afb000a", 0xd)
write(r0, &(0x7f00000000c0)="0d000000010001", 0x7)
write(0xca, &(0x7f00000000e0)="040e04016d0c00", 0x7)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r1 = syz_init_net_socket$bt_hci(0x1f, 0x805, 0x8)
setsockopt$sock_timeval(r1, 0x1, 0x15, &(0x7f0000000100)={0x0, 0x3e8}, 0x10)
connect(r1, &(0x7f0000000200)=@un=@file={0x1f, '\x00\x00\x00\x00\x00\x00\x01\x00'}, 0xa)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x805, 0x8)
setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000100)={0x0, 0x3e8}, 0x10)
connect(r2, &(0x7f0000000200)=@un=@file={0x1f, '\x00\x00\x00\x00\x00\x00\x01\x00'}, 0xa)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/ignore-gfp-wait\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='N', 0x1)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/task-filter\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='Y', 0x1)
close(r1)
r2 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./debug/failslab/verbose\x00', 0x2, 0x0)
write(r3, &(0x7f00000002c0)='0\x00', 0x1)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./debug/failslab/probability\x00', 0x2, 0x0)
write(r4, &(0x7f0000000340)='5\x00', 0x1)
close(r4)
r5 = openat$make_it_fail(0xffffffffffffff9c, &(0x7f0000000380)='/proc/thread-self/make-it-fail\x00', 0x1, 0x0)
write(r5, &(0x7f00000003c0)='1\x00', 0x1)
close(r5)
r6 = syz_open_dev$dvb_demux(0x0, 0x0, 0x2)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r6, 0x40146f2c, &(0x7f0000000500)={0x2, 0x0, 0x3, 0x14})
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/sound/card2\x00', 0x0, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000340)='1\n', 0x2)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)

program crashed: WARNING in __set_task_frozen
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #1 of len 8 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m2s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [37, 6, 4, 4, 16, 37, 3, 6, 8]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/ignore-gfp-wait\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='N', 0x1)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/task-filter\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='Y', 0x1)
close(r1)
r2 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./debug/failslab/verbose\x00', 0x2, 0x0)
write(r3, &(0x7f00000002c0)='0\x00', 0x1)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./debug/failslab/probability\x00', 0x2, 0x0)
write(r4, &(0x7f0000000340)='5\x00', 0x1)
close(r4)
r5 = openat$make_it_fail(0xffffffffffffff9c, &(0x7f0000000380)='/proc/thread-self/make-it-fail\x00', 0x1, 0x0)
write(r5, &(0x7f00000003c0)='1', 0x1)
close(r5)
r6 = syz_open_dev$dvb_demux(&(0x7f0000000400), 0x0, 0x2)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r6, 0x40146f2c, &(0x7f0000000500)={0x2, 0x0, 0x3, 0x14})
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/class/tpm\x00', 0x0, 0x0)
getdents64(r0, &(0x7f0000000200), 0x1000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/platform/drivers/tpm_tis\x00', 0x0, 0x0)
getdents64(r1, &(0x7f0000001200), 0x1000)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/state\x00', 0x1, 0x0)
write(r0, &(0x7f0000000340)='freeze\n', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040), &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/i915\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/drm/card1/device/driver\x00', 0x0, 0x0)
executing program 2:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind(r0, &(0x7f0000000000)=@hci={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000010)="4a00ffff11003ee0b4fdddd685986a49e00588f1ba6f01", 0x17)
write(0xca, &(0x7f0000000040)="040e0c01031000ffffffdfffffffff", 0xf)
write(0xca, &(0x7f0000000060)="040e0e010410000102ffffffffffffffff", 0x11)
write(0xca, &(0x7f0000000080)="040e0c01032000ffffffffffffffff", 0xf)
write(0xca, &(0x7f00000000a0)="040e0a01602000fb000afb000a", 0xd)
write(r0, &(0x7f00000000c0)="0d000000010001", 0x7)
write(0xca, &(0x7f00000000e0)="040e04016d0c00", 0x7)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r1 = syz_init_net_socket$bt_hci(0x1f, 0x805, 0x8)
setsockopt$sock_timeval(r1, 0x1, 0x15, &(0x7f0000000100)={0x0, 0x3e8}, 0x10)
connect(r1, &(0x7f0000000200)=@un=@file={0x1f, '\x00\x00\x00\x00\x00\x00\x01\x00'}, 0xa)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x805, 0x8)
setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000100)={0x0, 0x3e8}, 0x10)
connect(r2, &(0x7f0000000200)=@un=@file={0x1f, '\x00\x00\x00\x00\x00\x00\x01\x00'}, 0xa)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/ignore-gfp-wait\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='N', 0x1)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/task-filter\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='Y', 0x1)
close(r1)
r2 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./debug/failslab/verbose\x00', 0x2, 0x0)
write(r3, &(0x7f00000002c0)='0\x00', 0x1)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./debug/failslab/probability\x00', 0x2, 0x0)
write(r4, &(0x7f0000000340)='5\x00', 0x1)
close(r4)
r5 = openat$make_it_fail(0xffffffffffffff9c, &(0x7f0000000380)='/proc/thread-self/make-it-fail\x00', 0x1, 0x0)
write(r5, &(0x7f00000003c0)='1\x00', 0x1)
close(r5)
r6 = syz_open_dev$dvb_demux(0x0, 0x0, 0x2)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r6, 0x40146f2c, &(0x7f0000000500)={0x2, 0x0, 0x3, 0x14})
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/sound/card2\x00', 0x0, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000340)='1\n', 0x2)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)

program crashed: WARNING in __set_task_frozen
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <4>, <4>
bisect: split chunk #0 of len 4 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 16, 37, 3, 6, 8]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/state\x00', 0x1, 0x0)
write(r0, &(0x7f0000000340)='freeze\n', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040), &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/i915\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/drm/card1/device/driver\x00', 0x0, 0x0)
executing program 2:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind(r0, &(0x7f0000000000)=@hci={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000010)="4a00ffff11003ee0b4fdddd685986a49e00588f1ba6f01", 0x17)
write(0xca, &(0x7f0000000040)="040e0c01031000ffffffdfffffffff", 0xf)
write(0xca, &(0x7f0000000060)="040e0e010410000102ffffffffffffffff", 0x11)
write(0xca, &(0x7f0000000080)="040e0c01032000ffffffffffffffff", 0xf)
write(0xca, &(0x7f00000000a0)="040e0a01602000fb000afb000a", 0xd)
write(r0, &(0x7f00000000c0)="0d000000010001", 0x7)
write(0xca, &(0x7f00000000e0)="040e04016d0c00", 0x7)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r1 = syz_init_net_socket$bt_hci(0x1f, 0x805, 0x8)
setsockopt$sock_timeval(r1, 0x1, 0x15, &(0x7f0000000100)={0x0, 0x3e8}, 0x10)
connect(r1, &(0x7f0000000200)=@un=@file={0x1f, '\x00\x00\x00\x00\x00\x00\x01\x00'}, 0xa)
r2 = syz_init_net_socket$bt_hci(0x1f, 0x805, 0x8)
setsockopt$sock_timeval(r2, 0x1, 0x15, &(0x7f0000000100)={0x0, 0x3e8}, 0x10)
connect(r2, &(0x7f0000000200)=@un=@file={0x1f, '\x00\x00\x00\x00\x00\x00\x01\x00'}, 0xa)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./debug\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./debug/failslab/ignore-gfp-wait\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='N', 0x1)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./debug/failslab/task-filter\x00', 0x2, 0x0)
write(r1, &(0x7f00000001c0)='Y', 0x1)
close(r1)
r2 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./debug/failslab/verbose\x00', 0x2, 0x0)
write(r3, &(0x7f00000002c0)='0\x00', 0x1)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./debug/failslab/probability\x00', 0x2, 0x0)
write(r4, &(0x7f0000000340)='5\x00', 0x1)
close(r4)
r5 = openat$make_it_fail(0xffffffffffffff9c, &(0x7f0000000380)='/proc/thread-self/make-it-fail\x00', 0x1, 0x0)
write(r5, &(0x7f00000003c0)='1\x00', 0x1)
close(r5)
r6 = syz_open_dev$dvb_demux(0x0, 0x0, 0x2)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r6, 0x40146f2c, &(0x7f0000000500)={0x2, 0x0, 0x3, 0x14})
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
ioctl$DVB_DEMUX_DMX_START(r6, 0x6f29)
ioctl$DVB_DEMUX_DMX_STOP(r6, 0x6f2a)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/sound/card2\x00', 0x0, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000340)='1\n', 0x2)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)

program crashed: WARNING in __set_task_frozen
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunk #1 of len 4 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4, 3, 6, 8]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/state\x00', 0x1, 0x0)
write(r0, &(0x7f0000000340)='freeze\n', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040), &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/i915\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/drm/card1/device/driver\x00', 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/sound/card2\x00', 0x0, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000340)='1\n', 0x2)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)

program crashed: WARNING in __set_task_frozen
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <2>, <2>
bisect: split chunk #0 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 3, 6, 8]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040), &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/drivers/i915\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/drm/card1/device/driver\x00', 0x0, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/sound/card2\x00', 0x0, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000340)='1\n', 0x2)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 3, 6, 8]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/state\x00', 0x1, 0x0)
write(r0, &(0x7f0000000340)='freeze\n', 0x7)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/class/sound/card2\x00', 0x0, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000340)='1\n', 0x2)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)

program crashed: WARNING in __set_task_frozen
bisect: the chunk can be dropped
bisect: split chunk #1 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 6, 8]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/state\x00', 0x1, 0x0)
write(r0, &(0x7f0000000340)='freeze\n', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000340)='1\n', 0x2)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)

program crashed: kernel BUG in svc_destroy
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <1>, <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: split chunk #1 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 3 programs left: 

executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/state\x00', 0x1, 0x0)
write(r0, &(0x7f0000000340)='freeze\n', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000340)='1\n', 0x2)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)


bisect: trying to concatenate
bisect: concatenate 3 entries
minimizing program #0 before concatenation
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 6, 8]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/power/state\x00', 0x1, 0x0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000340)='1\n', 0x2)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 6, 8]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340)='freeze\n', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000340)='1\n', 0x2)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)

program crashed: kernel BUG in svc_destroy
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 6, 8]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
write(0xffffffffffffffff, &(0x7f0000000340)='freeze\n', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000340)='1\n', 0x2)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)

program crashed: kernel BUG in svc_destroy
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 6, 8]
detailed listing:
executing program 0:
write(0xffffffffffffffff, &(0x7f0000000340)='freeze\n', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000340)='1\n', 0x2)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)

program crashed: kernel BUG in svc_destroy
minimized 4 calls -> 1 calls
minimizing program #1 before concatenation
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 5, 8]
detailed listing:
executing program 3:
write(0xffffffffffffffff, &(0x7f0000000340)='freeze\n', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)

program crashed: KASAN: use-after-free Write in nfsd_create_serv
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 4, 8]
detailed listing:
executing program 3:
write(0xffffffffffffffff, &(0x7f0000000340)='freeze\n', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)

program crashed: kernel BUG in svc_destroy
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 3, 8]
detailed listing:
executing program 3:
write(0xffffffffffffffff, &(0x7f0000000340)='freeze\n', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 3, 8]
detailed listing:
executing program 3:
write(0xffffffffffffffff, &(0x7f0000000340)='freeze\n', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)='tcp 20000\n', 0xa)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 3, 8]
detailed listing:
executing program 3:
write(0xffffffffffffffff, &(0x7f0000000340)='freeze\n', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)

program did not crash
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 3, 8]
detailed listing:
executing program 3:
write(0xffffffffffffffff, &(0x7f0000000340)='freeze\n', 0x7)
executing program 0:
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)

program did not crash
minimized 6 calls -> 4 calls
minimizing program #2 before concatenation
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 4, 7]
detailed listing:
executing program 3:
write(0xffffffffffffffff, &(0x7f0000000340)='freeze\n', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)

program crashed: KASAN: use-after-free Write in nfsd_create_serv
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 4, 6]
detailed listing:
executing program 3:
write(0xffffffffffffffff, &(0x7f0000000340)='freeze\n', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)

program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 4, 5]
detailed listing:
executing program 3:
write(0xffffffffffffffff, &(0x7f0000000340)='freeze\n', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)
close(r0)

program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 4, 4]
detailed listing:
executing program 3:
write(0xffffffffffffffff, &(0x7f0000000340)='freeze\n', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='2049\n', 0x5)

program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 4, 3]
detailed listing:
executing program 3:
write(0xffffffffffffffff, &(0x7f0000000340)='freeze\n', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)

program crashed: kernel BUG in svc_destroy
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 4, 2]
detailed listing:
executing program 3:
write(0xffffffffffffffff, &(0x7f0000000340)='freeze\n', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000180)='nfsd\x00', 0x0, 0x0)

program crashed: kernel BUG in svc_destroy
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 4, 1]
detailed listing:
executing program 3:
write(0xffffffffffffffff, &(0x7f0000000340)='freeze\n', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)

program crashed: kernel BUG in svc_destroy
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 4, 0]
detailed listing:
executing program 3:
write(0xffffffffffffffff, &(0x7f0000000340)='freeze\n', 0x7)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)
executing program 0:

program crashed: kernel BUG in svc_destroy
minimized 8 calls -> 0 calls
testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mkdirat-mount-openat-write
detailed listing:
executing program 0:
write(0xffffffffffffffff, &(0x7f0000000340)='freeze\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)

program crashed: kernel BUG in svc_destroy
bisect: concatenation succeeded
found reproducer with 5 syscalls
minimizing guilty program
testing program (duration=55.8999957s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mkdirat-mount-openat
detailed listing:
executing program 0:
write(0xffffffffffffffff, &(0x7f0000000340)='freeze\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)

program did not crash
testing program (duration=55.8999957s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mkdirat-mount-write
detailed listing:
executing program 0:
write(0xffffffffffffffff, &(0x7f0000000340)='freeze\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)='tcp 20000\n', 0xa)

program did not crash
testing program (duration=55.8999957s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mkdirat-openat-write
detailed listing:
executing program 0:
write(0xffffffffffffffff, &(0x7f0000000340)='freeze\n', 0x7)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)

program did not crash
testing program (duration=55.8999957s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): write-mount-openat-write
detailed listing:
executing program 0:
write(0xffffffffffffffff, &(0x7f0000000340)='freeze\n', 0x7)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)

program did not crash
testing program (duration=55.8999957s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)

program crashed: kernel BUG in svc_destroy
testing program (duration=55.8999957s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)

program did not crash
testing program (duration=55.8999957s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)

program crashed: kernel BUG in svc_destroy
testing program (duration=55.8999957s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)

program did not crash
testing program (duration=55.8999957s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./nfsd\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)

program did not crash
testing program (duration=55.8999957s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)

program did not crash
testing program (duration=55.8999957s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, 0x0, 0x0)

program did not crash
testing program (duration=55.8999957s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240), 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=55.8999957s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
simplifying C reproducer
testing compiled C program (duration=55.8999957s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=55.8999957s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program did not crash
testing compiled C program (duration=55.8999957s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=55.8999957s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=55.8999957s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=55.8999957s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program did not crash
testing compiled C program (duration=55.8999957s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=55.8999957s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing program (duration=55.8999957s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)

program crashed: kernel BUG in svc_destroy
validation run: crashed=true
testing program (duration=55.8999957s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)

program crashed: kernel BUG in svc_destroy
validation run: crashed=true
testing program (duration=55.8999957s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)

program crashed: kernel BUG in svc_destroy
validation run: crashed=true
reproducing took 2h46m45.591359551s
repro crashed as (corrupted=false):
------------[ cut here ]------------
kernel BUG at net/sunrpc/svc.c:605!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4481 Comm: syz.0.18 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : svc_destroy+0x178/0x184 net/sunrpc/svc.c:605
lr : svc_destroy+0x178/0x184 net/sunrpc/svc.c:605
sp : ffff800020e57930
x29: ffff800020e57930 x28: 1fffe0001b32223f x27: ffff0000e0d33800
x26: dfff800000000000 x25: ffff7000041caf2c x24: ffff800020e57960
x23: ffff0000cb34e280 x22: dfff800000000000 x21: 0000000000000001
x20: ffff0000da061868 x19: ffff0000da061850 x18: 1fffe00033e62d7e
x17: ffff8000153cd000 x16: ffff8000082dd38c x15: 000000000004ffff
x14: 0000000000000001 x13: 1fffe00033e670f0 x12: 0000000000000000
x11: ff00800010f3ced0 x10: 0000000000000000 x9 : ffff800010f3ced0
x8 : ffff0000e0d33800 x7 : ffff8000083bb394 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000006 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
 svc_destroy+0x178/0x184 net/sunrpc/svc.c:605
 kref_put include/linux/kref.h:65 [inline]
 svc_put include/linux/sunrpc/svc.h:123 [inline]
 __write_ports_addxprt fs/nfsd/nfsctl.c:768 [inline]
 __write_ports fs/nfsd/nfsctl.c:794 [inline]
 write_ports+0x850/0x9f0 fs/nfsd/nfsctl.c:847
 nfsctl_transaction_write+0x114/0x164 fs/nfsd/nfsctl.c:114
 vfs_write+0x2a8/0x7c8 fs/read_write.c:582
 ksys_write+0x12c/0x228 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:646
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x12c arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: 91026260 97c2d8ed 17ffffc8 97c2d884 (d4210000) 
---[ end trace 0000000000000000 ]---

final repro crashed as (corrupted=false):
------------[ cut here ]------------
kernel BUG at net/sunrpc/svc.c:605!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4481 Comm: syz.0.18 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : svc_destroy+0x178/0x184 net/sunrpc/svc.c:605
lr : svc_destroy+0x178/0x184 net/sunrpc/svc.c:605
sp : ffff800020e57930
x29: ffff800020e57930 x28: 1fffe0001b32223f x27: ffff0000e0d33800
x26: dfff800000000000 x25: ffff7000041caf2c x24: ffff800020e57960
x23: ffff0000cb34e280 x22: dfff800000000000 x21: 0000000000000001
x20: ffff0000da061868 x19: ffff0000da061850 x18: 1fffe00033e62d7e
x17: ffff8000153cd000 x16: ffff8000082dd38c x15: 000000000004ffff
x14: 0000000000000001 x13: 1fffe00033e670f0 x12: 0000000000000000
x11: ff00800010f3ced0 x10: 0000000000000000 x9 : ffff800010f3ced0
x8 : ffff0000e0d33800 x7 : ffff8000083bb394 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000006 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
 svc_destroy+0x178/0x184 net/sunrpc/svc.c:605
 kref_put include/linux/kref.h:65 [inline]
 svc_put include/linux/sunrpc/svc.h:123 [inline]
 __write_ports_addxprt fs/nfsd/nfsctl.c:768 [inline]
 __write_ports fs/nfsd/nfsctl.c:794 [inline]
 write_ports+0x850/0x9f0 fs/nfsd/nfsctl.c:847
 nfsctl_transaction_write+0x114/0x164 fs/nfsd/nfsctl.c:114
 vfs_write+0x2a8/0x7c8 fs/read_write.c:582
 ksys_write+0x12c/0x228 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:646
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x12c arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: 91026260 97c2d8ed 17ffffc8 97c2d884 (d4210000) 
---[ end trace 0000000000000000 ]---