Extracting prog: 41m54.791455566s
Minimizing prog: 16m50.4557771s
Simplifying prog options: 0s
Extracting C: 1m22.128643325s
Simplifying C: 10m31.687243732s


extracting reproducer from 24 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-openat-write-close-openat-write-close
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000100)='3\x00', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000180)='1\x00', 0x2)
close(r2)

program did not crash
single: failed to extract reproducer
bisect: bisecting 24 programs with base timeout 30s
testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5, 10, 5, 11, 8, 4, 8, 12, 17, 5, 5, 8, 5, 7, 4, 5, 18, 13, 4, 10, 18, 5, 11]
detailed listing:
executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x1})
ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f)
write$tun(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="000008050010010b101200"], 0xb)
write$tun(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="0000080500100117"], 0x8)
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000700)=@newsa={0x150, 0x10, 0x401, 0x0, 0x0, {{@in=@local, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x2}, {@in=@local, 0x4d2, 0x32}, @in=@remote, {0x7fffffffffffffff, 0x7fffffffffffffff, 0x7fffffffffffffff, 0x7fffffffffffffff}, {}, {}, 0x0, 0x0, 0x2, 0x5}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @sa_dir={0x5, 0x21, 0x1}, @iptfs_drop_time={0x8, 0x24, 0x2710}, @iptfs_reorder_window={0x6, 0x25, 0x3}]}, 0x150}}, 0x0)
syz_emit_ethernet(0x56, &(0x7f0000000000)={@local, @empty, @void, {@ipv4={0x800, @esp={{0x5, 0x4, 0x0, 0x0, 0x26, 0x0, 0x0, 0x40, 0x32, 0x0, @remote, @local}, {0x4d2, 0x1, @basic={0x0, 0x0, 0x0, [@runt="00112233"]}}}}}}, 0x0)
syz_emit_ethernet(0x56, &(0x7f0000000200)={@local, @empty, @void, {@ipv4={0x800, @esp={{0x5, 0x4, 0x0, 0x0, 0x26, 0x0, 0x0, 0x40, 0x32, 0x0, @remote, @local}, {0x4d2, 0x3, @basic={0x0, 0x0, 0x0, [@runt="00112233"]}}}}}}, 0x0)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\x00', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='1\x00', 0x2)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt\x00', 0x1ff)
mount$nfs(&(0x7f0000000200)='127.0.0.1:/\x00', &(0x7f00000001c0)='./mnt\x00', &(0x7f0000000240), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='vers=4.1,proto=tcp,addr=127.0.0.1,port=2049,clientaddr=127.0.0.1\x00'])
executing program 2:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x1})
ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f)
write$tun(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="000008050010010b101200"], 0xb)
write$tun(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="0000080500100117"], 0x8)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='-2 -3 +4.0\n\x00', 0xb)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='tcp 2049\n\x00', 0x9)
close(r1)
r2 = socket$inet(0x2, 0x1, 0x0)
connect$inet(r2, &(0x7f0000000300)={0x2, 0x801}, 0x10)
close(r2)
executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r0)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000400)={'batadv0\x00', <r2=>0x0})
sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000440)={0x2c, r1, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0x1}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x14}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x0)
r3 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'veth0_to_batadv\x00', <r4=>0x0})
sendto$packet(r3, &(0x7f0000000200)="ffffffffffff0011223344554305000f32000000000100112233445500112233445500ff000c010100080000271000002710", 0x32, 0x0, &(0x7f0000000180)={0x11, 0x4305, r4, 0x1, 0x0, 0x6, @multicast}, 0x14)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000040)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./proc/net/can/stats\x00', 0x0, 0x0)
read(r0, &(0x7f0000000100)=""/4096, 0x1000)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='-4\n', 0x3)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xfff2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x80, 0x1000000, 0x8, 0x1}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0x0, 0x4}, {0x0, 0xb}, {0x7, 0xffe0}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0x8, 0x2, 0x81}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20008881}, 0x20002010)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r4 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', <r5=>0x0})
sendto$packet(r4, &(0x7f00000002c0)="05", 0x1, 0x20000005, &(0x7f0000000140)={0x11, 0x7, r5, 0x1, 0x0, 0x6, @multicast}, 0x14)
executing program 4:
setns(0xc9, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/net/x25/x25_forward\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='1\n\x00', 0x2)
close(r0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x1})
ioctl$TUNSETLINK(r1, 0x400454cd, 0x10f)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x1})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x10f)
r3 = socket(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', 0x1})
ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', 0x1})
r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl$sock_x25_SIOCADDRT(r4, 0x890b, &(0x7f0000000300)={@null, 0x0, 'syzkaller1\x00'})
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0)
sendmsg$TIPC_CMD_SET_NODE_ADDR(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r1, 0x201, 0x400000, 0x0, {{}, {}, {0x8, 0x11, 0x1001001}}}, 0x24}}, 0x0)
sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010006000d0000000000010000000000000001410000001c001700000000000000006574683a73797a5f74756e"], 0x38}}, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000002b00)=ANY=[@ANYBLOB="ffffffffffffaabbccddeeff88ca5b5000282d000000000000000000aaaa000012670000f5010000aabbccddeeff"], 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='280', 0x3)
unshare(0x40000000)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x0, 0x0)
read(r1, &(0x7f0000000100)=""/100, 0x64)
close(r1)
executing program 1:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x1})
ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f)
write$tun(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="000008050010010b101200"], 0xb)
write$tun(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="0000080500100117"], 0x8)
executing program 4:
r0 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$6lowpan_enable(r0, &(0x7f0000000040)='1', 0x1)
syz_emit_vhci(&(0x7f0000000100)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x0, 0x12}, @l2cap_cid_le_signaling={{0xe}, @l2cap_le_conn_req={{0x14, 0x1, 0xa}, {0x23, 0x40, 0x500, 0x100, 0xa}}}}, 0x17)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
r1 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
write$6lowpan_control(r1, &(0x7f0000000300)='connect aa:aa:aa:aa:aa:11 1', 0x1b)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/kmsg\x00', 0x800, 0x0)
read(r0, &(0x7f0000000180)=""/1000, 0x3e8)
executing program 3:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
bind$inet(r0, &(0x7f0000000240)={0x2, 0x4e21, @loopback}, 0x10)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in={0x2, 0x4e21, @rand_addr=0x7f000002}], 0x10)
connect$inet(r0, &(0x7f00000002c0)={0x2, 0x4e20, @loopback}, 0x10)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r0, 0x84, 0x65, &(0x7f0000000300)=[@in={0x2, 0x4e21, @rand_addr=0x7f000002}], 0x10)
executing program 1:
setns(0xc9, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/net/x25/x25_forward\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='1\n\x00', 0x2)
close(r0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x1})
ioctl$TUNSETLINK(r1, 0x400454cd, 0x10f)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x1})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x10f)
r3 = socket(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', 0x1})
ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', 0x1})
r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl$sock_x25_SIOCADDRT(r4, 0x890b, &(0x7f0000000300)={@null, 0x0, 'syzkaller1\x00'})
write$tun(r1, &(0x7f0000000400)=ANY=[@ANYBLOB="000008050010010b101200"], 0xb)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/net/sctp/addip_enable\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='1\n', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/net/sctp/addip_noauth_enable\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='1\n', 0x2)
r2 = socket$inet_sctp(0x2, 0x1, 0x84)
bind$inet(r2, &(0x7f0000000200)={0x2, 0x4e20, @loopback}, 0x10)
listen(r2, 0x5)
r3 = socket$inet_sctp(0x2, 0x1, 0x84)
bind$inet(r3, &(0x7f0000000240)={0x2, 0x4e21, @loopback}, 0x10)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000280)=[@in={0x2, 0x4e21, @rand_addr=0x7f000002}], 0x10)
connect$inet(r3, &(0x7f00000002c0)={0x2, 0x4e20, @loopback}, 0x10)
executing program 2:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x4c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TYPE={0xa, 0x7, 'route\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x32}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x94}}, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
sendto$inet(r1, &(0x7f0000000100)='\x00\x00', 0x4, 0x0, &(0x7f0000000200)={0x2, 0x3039, @loopback}, 0x10)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\x00', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='1\x00', 0x2)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt\x00', 0x1ff)
mount$nfs(&(0x7f0000000200)='127.0.0.1:/\x00', &(0x7f00000001c0)='./mnt\x00', &(0x7f0000000240), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='vers=4.1,proto=tcp,addr=127.0.0.1,port=2049,clientaddr=127.0.0.1\x00'])
executing program 2:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000795d6c08450c3a616dc4010203010902120001000000000904"], 0x0)
r1 = syz_usb_connect$printer(0x2, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0xff, 0x3f0, 0x4, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x2, 0x40, 0xff, "", [{{0x9, 0x4, 0x0, 0x1, 0x1, 0x7, 0x1, 0x1, 0x5, "", {{{0x9, 0x5, 0x1, 0x2, 0x400, 0xa, 0x7, 0x1}}, [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x9, 0x8, 0x9b}}]}}}]}}]}}, &(0x7f0000000880)={0xa, &(0x7f0000000440)={0xa, 0x6, 0x300, 0xdf, 0x4, 0x4, 0x10, 0xe0}, 0x44, &(0x7f0000000480)={0x5, 0xf, 0x44, 0x5, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x2, 0x9, 0x50, 0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x2, "e1993ec923673c0e7c55a7a0a9192d5e"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0xa, 0x7, 0x81, 0x4}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x21, "011f47be2e9c7fece9c1b46e8d879d5d"}]}, 0x6, [{0x4, &(0x7f0000000600)=@lang_id={0x4, 0x3, 0x4001}}, {0x4, &(0x7f0000000640)=@lang_id={0x4, 0x3, 0x80a}}, {0x8b, &(0x7f00000006c0)=@string={0x8b, 0x3, "305ece7917465f78ee20b542580282849bef5c23e5263a0d30be676f411957df05fd17ba2f513fa27425f047ce8fb6d4d6d0ece065718a635a3624f2f6d9195c1ec542998b52ba74565690f4a3d58d2966315c6fdf7e44d05c0f8b4fab2fae7c4136c81abaadd9478bc97b94e4887bee0a3a7e964761e9b4d44f907cf0825e5816233f4663906c6c92"}}, {0x76, &(0x7f0000000780)=@string={0x76, 0x3, "0f615b9394a7acaee65014bb15e4b95018bf8e0670686557ed92d57d1de7eaa7efd117011beebb7e9faeca38e5c1a02af459a0ad03201f02a0b9cb2c9436d9c8126fd2f08a0599d1d18e81d56c01f45a5300bc3356d5930fc718133c236dbf3b9ba816f92fccfcafa6ca5fc8fcffb85631cc27b5"}}, {0x4, &(0x7f0000000800)=@lang_id={0x4, 0x3, 0x458}}, {0x4, &(0x7f0000000840)=@lang_id={0x4, 0x3, 0x4001}}]})
syz_usb_control_io(r1, 0x0, 0x0)
r2 = syz_open_dev$video(&(0x7f00000003c0), 0xa7, 0x0)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05605, &(0x7f00000002c0)={0x1, @pix_mp={0x6dc, 0xdaf1, 0x59555956, 0x2, 0x1, [{0x1, 0x1}, {0x3, 0xa}, {0x10001, 0x200}, {0xc061, 0x5}, {0xfffffff8, 0x7}, {0x1, 0xc00}, {0x4, 0x8}, {0x3, 0x400}], 0x0, 0x9b, 0x0, 0x0, 0x5}})
r3 = socket$inet6(0xa, 0x5, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f00000000c0)=[@in6={0xa, 0x4e23, 0x20002, @empty, 0x80}, @in6={0xa, 0x0, 0xffffffff, @empty}], 0x38)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000400)={0x2c, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0})
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r4, &(0x7f0000000280)={0xa, 0x4e22, 0x9, @loopback, 0x6}, 0x1c)
connect$inet6(r4, &(0x7f0000000140)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="5801000010000500010000000000000000000000000000000000000000000001fc02000000000000000000000000000000000000000000000a00808000000000", @ANYRES32=0x0, @ANYRES32=0x80, @ANYBLOB="0000000000000000000000000000000100001234330000000000000000000000000007ba92bd0001ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000fdffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000800000000000000048000100686d6163287368613129000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004a65790d959b70aa000000002000170001000000000000000000000000000000000000002000000000000000"], 0x158}, 0x1, 0x0, 0x0, 0x20040004}, 0x0)
syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2)
r6 = open_tree(0xffffffffffffffff, &(0x7f00000001c0)='\x00', 0x8801)
ioctl$SNDRV_TIMER_IOCTL_START(r6, 0x54a0)
sendmsg$nl_xfrm(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=@newpolicy={0xfc, 0x13, 0x5, 0x1, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x80}, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x1}, {0x0, 0x400000}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@loopback, 0x1234, 0x33}, 0xa, @in6=@mcast1}]}]}, 0xfc}}, 0x20004048)
sendmmsg$inet6(r4, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000680)='A', 0x1}], 0x1}}], 0x1, 0x4000801)
executing program 1:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x1})
ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f)
write$tun(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="000008050010010b101200"], 0xb)
write$tun(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="0000080500100117"], 0x8)
executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000100)='3\x00', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000180)='1\x00', 0x2)
close(r2)

program crashed: kernel BUG in svc_destroy
bisect: bisecting 24 programs
bisect: split chunks (needed=false): <23>
bisect: split chunk #0 of len 23 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=34s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 17, 5, 5, 8, 5, 7, 4, 5, 18, 13, 4, 10, 18, 5, 11]
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xfff2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x80, 0x1000000, 0x8, 0x1}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0x0, 0x4}, {0x0, 0xb}, {0x7, 0xffe0}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0x8, 0x2, 0x81}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20008881}, 0x20002010)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r4 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', <r5=>0x0})
sendto$packet(r4, &(0x7f00000002c0)="05", 0x1, 0x20000005, &(0x7f0000000140)={0x11, 0x7, r5, 0x1, 0x0, 0x6, @multicast}, 0x14)
executing program 4:
setns(0xc9, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/net/x25/x25_forward\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='1\n\x00', 0x2)
close(r0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x1})
ioctl$TUNSETLINK(r1, 0x400454cd, 0x10f)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x1})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x10f)
r3 = socket(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', 0x1})
ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', 0x1})
r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl$sock_x25_SIOCADDRT(r4, 0x890b, &(0x7f0000000300)={@null, 0x0, 'syzkaller1\x00'})
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0)
sendmsg$TIPC_CMD_SET_NODE_ADDR(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r1, 0x201, 0x400000, 0x0, {{}, {}, {0x8, 0x11, 0x1001001}}}, 0x24}}, 0x0)
sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010006000d0000000000010000000000000001410000001c001700000000000000006574683a73797a5f74756e"], 0x38}}, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000002b00)=ANY=[@ANYBLOB="ffffffffffffaabbccddeeff88ca5b5000282d000000000000000000aaaa000012670000f5010000aabbccddeeff"], 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='280', 0x3)
unshare(0x40000000)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x0, 0x0)
read(r1, &(0x7f0000000100)=""/100, 0x64)
close(r1)
executing program 1:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x1})
ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f)
write$tun(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="000008050010010b101200"], 0xb)
write$tun(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="0000080500100117"], 0x8)
executing program 4:
r0 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$6lowpan_enable(r0, &(0x7f0000000040)='1', 0x1)
syz_emit_vhci(&(0x7f0000000100)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x0, 0x12}, @l2cap_cid_le_signaling={{0xe}, @l2cap_le_conn_req={{0x14, 0x1, 0xa}, {0x23, 0x40, 0x500, 0x100, 0xa}}}}, 0x17)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
r1 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
write$6lowpan_control(r1, &(0x7f0000000300)='connect aa:aa:aa:aa:aa:11 1', 0x1b)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/kmsg\x00', 0x800, 0x0)
read(r0, &(0x7f0000000180)=""/1000, 0x3e8)
executing program 3:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
bind$inet(r0, &(0x7f0000000240)={0x2, 0x4e21, @loopback}, 0x10)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in={0x2, 0x4e21, @rand_addr=0x7f000002}], 0x10)
connect$inet(r0, &(0x7f00000002c0)={0x2, 0x4e20, @loopback}, 0x10)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r0, 0x84, 0x65, &(0x7f0000000300)=[@in={0x2, 0x4e21, @rand_addr=0x7f000002}], 0x10)
executing program 1:
setns(0xc9, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/net/x25/x25_forward\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='1\n\x00', 0x2)
close(r0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x1})
ioctl$TUNSETLINK(r1, 0x400454cd, 0x10f)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x1})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x10f)
r3 = socket(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', 0x1})
ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', 0x1})
r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl$sock_x25_SIOCADDRT(r4, 0x890b, &(0x7f0000000300)={@null, 0x0, 'syzkaller1\x00'})
write$tun(r1, &(0x7f0000000400)=ANY=[@ANYBLOB="000008050010010b101200"], 0xb)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/net/sctp/addip_enable\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='1\n', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/net/sctp/addip_noauth_enable\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='1\n', 0x2)
r2 = socket$inet_sctp(0x2, 0x1, 0x84)
bind$inet(r2, &(0x7f0000000200)={0x2, 0x4e20, @loopback}, 0x10)
listen(r2, 0x5)
r3 = socket$inet_sctp(0x2, 0x1, 0x84)
bind$inet(r3, &(0x7f0000000240)={0x2, 0x4e21, @loopback}, 0x10)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000280)=[@in={0x2, 0x4e21, @rand_addr=0x7f000002}], 0x10)
connect$inet(r3, &(0x7f00000002c0)={0x2, 0x4e20, @loopback}, 0x10)
executing program 2:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x4c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TYPE={0xa, 0x7, 'route\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x32}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x94}}, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
sendto$inet(r1, &(0x7f0000000100)='\x00\x00', 0x4, 0x0, &(0x7f0000000200)={0x2, 0x3039, @loopback}, 0x10)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\x00', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='1\x00', 0x2)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt\x00', 0x1ff)
mount$nfs(&(0x7f0000000200)='127.0.0.1:/\x00', &(0x7f00000001c0)='./mnt\x00', &(0x7f0000000240), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='vers=4.1,proto=tcp,addr=127.0.0.1,port=2049,clientaddr=127.0.0.1\x00'])
executing program 2:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000795d6c08450c3a616dc4010203010902120001000000000904"], 0x0)
r1 = syz_usb_connect$printer(0x2, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0xff, 0x3f0, 0x4, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x2, 0x40, 0xff, "", [{{0x9, 0x4, 0x0, 0x1, 0x1, 0x7, 0x1, 0x1, 0x5, "", {{{0x9, 0x5, 0x1, 0x2, 0x400, 0xa, 0x7, 0x1}}, [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x9, 0x8, 0x9b}}]}}}]}}]}}, &(0x7f0000000880)={0xa, &(0x7f0000000440)={0xa, 0x6, 0x300, 0xdf, 0x4, 0x4, 0x10, 0xe0}, 0x44, &(0x7f0000000480)={0x5, 0xf, 0x44, 0x5, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x2, 0x9, 0x50, 0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x2, "e1993ec923673c0e7c55a7a0a9192d5e"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0xa, 0x7, 0x81, 0x4}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x21, "011f47be2e9c7fece9c1b46e8d879d5d"}]}, 0x6, [{0x4, &(0x7f0000000600)=@lang_id={0x4, 0x3, 0x4001}}, {0x4, &(0x7f0000000640)=@lang_id={0x4, 0x3, 0x80a}}, {0x8b, &(0x7f00000006c0)=@string={0x8b, 0x3, "305ece7917465f78ee20b542580282849bef5c23e5263a0d30be676f411957df05fd17ba2f513fa27425f047ce8fb6d4d6d0ece065718a635a3624f2f6d9195c1ec542998b52ba74565690f4a3d58d2966315c6fdf7e44d05c0f8b4fab2fae7c4136c81abaadd9478bc97b94e4887bee0a3a7e964761e9b4d44f907cf0825e5816233f4663906c6c92"}}, {0x76, &(0x7f0000000780)=@string={0x76, 0x3, "0f615b9394a7acaee65014bb15e4b95018bf8e0670686557ed92d57d1de7eaa7efd117011beebb7e9faeca38e5c1a02af459a0ad03201f02a0b9cb2c9436d9c8126fd2f08a0599d1d18e81d56c01f45a5300bc3356d5930fc718133c236dbf3b9ba816f92fccfcafa6ca5fc8fcffb85631cc27b5"}}, {0x4, &(0x7f0000000800)=@lang_id={0x4, 0x3, 0x458}}, {0x4, &(0x7f0000000840)=@lang_id={0x4, 0x3, 0x4001}}]})
syz_usb_control_io(r1, 0x0, 0x0)
r2 = syz_open_dev$video(&(0x7f00000003c0), 0xa7, 0x0)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05605, &(0x7f00000002c0)={0x1, @pix_mp={0x6dc, 0xdaf1, 0x59555956, 0x2, 0x1, [{0x1, 0x1}, {0x3, 0xa}, {0x10001, 0x200}, {0xc061, 0x5}, {0xfffffff8, 0x7}, {0x1, 0xc00}, {0x4, 0x8}, {0x3, 0x400}], 0x0, 0x9b, 0x0, 0x0, 0x5}})
r3 = socket$inet6(0xa, 0x5, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f00000000c0)=[@in6={0xa, 0x4e23, 0x20002, @empty, 0x80}, @in6={0xa, 0x0, 0xffffffff, @empty}], 0x38)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000400)={0x2c, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0})
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r4, &(0x7f0000000280)={0xa, 0x4e22, 0x9, @loopback, 0x6}, 0x1c)
connect$inet6(r4, &(0x7f0000000140)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="5801000010000500010000000000000000000000000000000000000000000001fc02000000000000000000000000000000000000000000000a00808000000000", @ANYRES32=0x0, @ANYRES32=0x80, @ANYBLOB="0000000000000000000000000000000100001234330000000000000000000000000007ba92bd0001ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000fdffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000800000000000000048000100686d6163287368613129000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004a65790d959b70aa000000002000170001000000000000000000000000000000000000002000000000000000"], 0x158}, 0x1, 0x0, 0x0, 0x20040004}, 0x0)
syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2)
r6 = open_tree(0xffffffffffffffff, &(0x7f00000001c0)='\x00', 0x8801)
ioctl$SNDRV_TIMER_IOCTL_START(r6, 0x54a0)
sendmsg$nl_xfrm(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=@newpolicy={0xfc, 0x13, 0x5, 0x1, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x80}, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x1}, {0x0, 0x400000}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@loopback, 0x1234, 0x33}, 0xa, @in6=@mcast1}]}]}, 0xfc}}, 0x20004048)
sendmmsg$inet6(r4, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000680)='A', 0x1}], 0x1}}], 0x1, 0x4000801)
executing program 1:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x1})
ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f)
write$tun(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="000008050010010b101200"], 0xb)
write$tun(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="0000080500100117"], 0x8)
executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000100)='3\x00', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000180)='1\x00', 0x2)
close(r2)

program crashed: kernel BUG in svc_destroy
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/3
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 18, 13, 4, 10, 18, 5, 11]
detailed listing:
executing program 3:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
bind$inet(r0, &(0x7f0000000240)={0x2, 0x4e21, @loopback}, 0x10)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in={0x2, 0x4e21, @rand_addr=0x7f000002}], 0x10)
connect$inet(r0, &(0x7f00000002c0)={0x2, 0x4e20, @loopback}, 0x10)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_REM(r0, 0x84, 0x65, &(0x7f0000000300)=[@in={0x2, 0x4e21, @rand_addr=0x7f000002}], 0x10)
executing program 1:
setns(0xc9, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/net/x25/x25_forward\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='1\n\x00', 0x2)
close(r0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x1})
ioctl$TUNSETLINK(r1, 0x400454cd, 0x10f)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x1})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x10f)
r3 = socket(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', 0x1})
ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', 0x1})
r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl$sock_x25_SIOCADDRT(r4, 0x890b, &(0x7f0000000300)={@null, 0x0, 'syzkaller1\x00'})
write$tun(r1, &(0x7f0000000400)=ANY=[@ANYBLOB="000008050010010b101200"], 0xb)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/net/sctp/addip_enable\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='1\n', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/net/sctp/addip_noauth_enable\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='1\n', 0x2)
r2 = socket$inet_sctp(0x2, 0x1, 0x84)
bind$inet(r2, &(0x7f0000000200)={0x2, 0x4e20, @loopback}, 0x10)
listen(r2, 0x5)
r3 = socket$inet_sctp(0x2, 0x1, 0x84)
bind$inet(r3, &(0x7f0000000240)={0x2, 0x4e21, @loopback}, 0x10)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000280)=[@in={0x2, 0x4e21, @rand_addr=0x7f000002}], 0x10)
connect$inet(r3, &(0x7f00000002c0)={0x2, 0x4e20, @loopback}, 0x10)
executing program 2:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x4c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TYPE={0xa, 0x7, 'route\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x32}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x94}}, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
sendto$inet(r1, &(0x7f0000000100)='\x00\x00', 0x4, 0x0, &(0x7f0000000200)={0x2, 0x3039, @loopback}, 0x10)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\x00', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='1\x00', 0x2)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt\x00', 0x1ff)
mount$nfs(&(0x7f0000000200)='127.0.0.1:/\x00', &(0x7f00000001c0)='./mnt\x00', &(0x7f0000000240), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='vers=4.1,proto=tcp,addr=127.0.0.1,port=2049,clientaddr=127.0.0.1\x00'])
executing program 2:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000795d6c08450c3a616dc4010203010902120001000000000904"], 0x0)
r1 = syz_usb_connect$printer(0x2, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0xff, 0x3f0, 0x4, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x2, 0x40, 0xff, "", [{{0x9, 0x4, 0x0, 0x1, 0x1, 0x7, 0x1, 0x1, 0x5, "", {{{0x9, 0x5, 0x1, 0x2, 0x400, 0xa, 0x7, 0x1}}, [{{0x9, 0x5, 0x82, 0x2, 0x20, 0x9, 0x8, 0x9b}}]}}}]}}]}}, &(0x7f0000000880)={0xa, &(0x7f0000000440)={0xa, 0x6, 0x300, 0xdf, 0x4, 0x4, 0x10, 0xe0}, 0x44, &(0x7f0000000480)={0x5, 0xf, 0x44, 0x5, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x2, 0x9, 0x50, 0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x2, "e1993ec923673c0e7c55a7a0a9192d5e"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0xa, 0x7, 0x81, 0x4}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x21, "011f47be2e9c7fece9c1b46e8d879d5d"}]}, 0x6, [{0x4, &(0x7f0000000600)=@lang_id={0x4, 0x3, 0x4001}}, {0x4, &(0x7f0000000640)=@lang_id={0x4, 0x3, 0x80a}}, {0x8b, &(0x7f00000006c0)=@string={0x8b, 0x3, "305ece7917465f78ee20b542580282849bef5c23e5263a0d30be676f411957df05fd17ba2f513fa27425f047ce8fb6d4d6d0ece065718a635a3624f2f6d9195c1ec542998b52ba74565690f4a3d58d2966315c6fdf7e44d05c0f8b4fab2fae7c4136c81abaadd9478bc97b94e4887bee0a3a7e964761e9b4d44f907cf0825e5816233f4663906c6c92"}}, {0x76, &(0x7f0000000780)=@string={0x76, 0x3, "0f615b9394a7acaee65014bb15e4b95018bf8e0670686557ed92d57d1de7eaa7efd117011beebb7e9faeca38e5c1a02af459a0ad03201f02a0b9cb2c9436d9c8126fd2f08a0599d1d18e81d56c01f45a5300bc3356d5930fc718133c236dbf3b9ba816f92fccfcafa6ca5fc8fcffb85631cc27b5"}}, {0x4, &(0x7f0000000800)=@lang_id={0x4, 0x3, 0x458}}, {0x4, &(0x7f0000000840)=@lang_id={0x4, 0x3, 0x4001}}]})
syz_usb_control_io(r1, 0x0, 0x0)
r2 = syz_open_dev$video(&(0x7f00000003c0), 0xa7, 0x0)
ioctl$VIDIOC_S_FMT(r2, 0xc0d05605, &(0x7f00000002c0)={0x1, @pix_mp={0x6dc, 0xdaf1, 0x59555956, 0x2, 0x1, [{0x1, 0x1}, {0x3, 0xa}, {0x10001, 0x200}, {0xc061, 0x5}, {0xfffffff8, 0x7}, {0x1, 0xc00}, {0x4, 0x8}, {0x3, 0x400}], 0x0, 0x9b, 0x0, 0x0, 0x5}})
r3 = socket$inet6(0xa, 0x5, 0x0)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f00000000c0)=[@in6={0xa, 0x4e23, 0x20002, @empty, 0x80}, @in6={0xa, 0x0, 0xffffffff, @empty}], 0x38)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000400)={0x2c, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0})
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r4, &(0x7f0000000280)={0xa, 0x4e22, 0x9, @loopback, 0x6}, 0x1c)
connect$inet6(r4, &(0x7f0000000140)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c)
r5 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="5801000010000500010000000000000000000000000000000000000000000001fc02000000000000000000000000000000000000000000000a00808000000000", @ANYRES32=0x0, @ANYRES32=0x80, @ANYBLOB="0000000000000000000000000000000100001234330000000000000000000000000007ba92bd0001ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff00000000000000000000000000000000fdffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000800000000000000048000100686d6163287368613129000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004a65790d959b70aa000000002000170001000000000000000000000000000000000000002000000000000000"], 0x158}, 0x1, 0x0, 0x0, 0x20040004}, 0x0)
syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2)
r6 = open_tree(0xffffffffffffffff, &(0x7f00000001c0)='\x00', 0x8801)
ioctl$SNDRV_TIMER_IOCTL_START(r6, 0x54a0)
sendmsg$nl_xfrm(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=@newpolicy={0xfc, 0x13, 0x5, 0x1, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x80}, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x1}, {0x0, 0x400000}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@loopback, 0x1234, 0x33}, 0xa, @in6=@mcast1}]}]}, 0xfc}}, 0x20004048)
sendmmsg$inet6(r4, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000680)='A', 0x1}], 0x1}}], 0x1, 0x4000801)
executing program 1:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x1})
ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f)
write$tun(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="000008050010010b101200"], 0xb)
write$tun(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="0000080500100117"], 0x8)
executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000100)='3\x00', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000180)='1\x00', 0x2)
close(r2)

program did not crash
bisect: testing without sub-chunk 3/3
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 17, 5, 5, 8, 5, 7, 4, 11]
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xfff2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x80, 0x1000000, 0x8, 0x1}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0x0, 0x4}, {0x0, 0xb}, {0x7, 0xffe0}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0x8, 0x2, 0x81}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20008881}, 0x20002010)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r4 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', <r5=>0x0})
sendto$packet(r4, &(0x7f00000002c0)="05", 0x1, 0x20000005, &(0x7f0000000140)={0x11, 0x7, r5, 0x1, 0x0, 0x6, @multicast}, 0x14)
executing program 4:
setns(0xc9, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/net/x25/x25_forward\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='1\n\x00', 0x2)
close(r0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x1})
ioctl$TUNSETLINK(r1, 0x400454cd, 0x10f)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0x1})
ioctl$TUNSETLINK(r2, 0x400454cd, 0x10f)
r3 = socket(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', 0x1})
ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000240)={'syzkaller1\x00', 0x1})
r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl$sock_x25_SIOCADDRT(r4, 0x890b, &(0x7f0000000300)={@null, 0x0, 'syzkaller1\x00'})
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0)
sendmsg$TIPC_CMD_SET_NODE_ADDR(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r1, 0x201, 0x400000, 0x0, {{}, {}, {0x8, 0x11, 0x1001001}}}, 0x24}}, 0x0)
sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010006000d0000000000010000000000000001410000001c001700000000000000006574683a73797a5f74756e"], 0x38}}, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000002b00)=ANY=[@ANYBLOB="ffffffffffffaabbccddeeff88ca5b5000282d000000000000000000aaaa000012670000f5010000aabbccddeeff"], 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r0, &(0x7f0000000000)='280', 0x3)
unshare(0x40000000)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x0, 0x0)
read(r1, &(0x7f0000000100)=""/100, 0x64)
close(r1)
executing program 1:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x1})
ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f)
write$tun(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="000008050010010b101200"], 0xb)
write$tun(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="0000080500100117"], 0x8)
executing program 4:
r0 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$6lowpan_enable(r0, &(0x7f0000000040)='1', 0x1)
syz_emit_vhci(&(0x7f0000000100)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x0, 0x12}, @l2cap_cid_le_signaling={{0xe}, @l2cap_le_conn_req={{0x14, 0x1, 0xa}, {0x23, 0x40, 0x500, 0x100, 0xa}}}}, 0x17)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
r1 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
write$6lowpan_control(r1, &(0x7f0000000300)='connect aa:aa:aa:aa:aa:11 1', 0x1b)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/kmsg\x00', 0x800, 0x0)
read(r0, &(0x7f0000000180)=""/1000, 0x3e8)
executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000100)='3\x00', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000180)='1\x00', 0x2)
close(r2)

program crashed: KASAN: use-after-free Write in nfsd_create_serv
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <8>
bisect: split chunk #0 of len 8 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 5, 7, 4, 11]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x0, 0x0)
read(r1, &(0x7f0000000100)=""/100, 0x64)
close(r1)
executing program 1:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x1})
ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f)
write$tun(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="000008050010010b101200"], 0xb)
write$tun(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="0000080500100117"], 0x8)
executing program 4:
r0 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$6lowpan_enable(r0, &(0x7f0000000040)='1', 0x1)
syz_emit_vhci(&(0x7f0000000100)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x0, 0x12}, @l2cap_cid_le_signaling={{0xe}, @l2cap_le_conn_req={{0x14, 0x1, 0xa}, {0x23, 0x40, 0x500, 0x100, 0xa}}}}, 0x17)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
r1 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
write$6lowpan_control(r1, &(0x7f0000000300)='connect aa:aa:aa:aa:aa:11 1', 0x1b)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/kmsg\x00', 0x800, 0x0)
read(r0, &(0x7f0000000180)=""/1000, 0x3e8)
executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000100)='3\x00', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000180)='1\x00', 0x2)
close(r2)

program crashed: kernel BUG in svc_destroy
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <4>
bisect: split chunk #0 of len 4 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 4, 11]
detailed listing:
executing program 4:
r0 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$6lowpan_enable(r0, &(0x7f0000000040)='1', 0x1)
syz_emit_vhci(&(0x7f0000000100)=@HCI_ACLDATA_PKT={0x2, {0xc9, 0x0, 0x0, 0x12}, @l2cap_cid_le_signaling={{0xe}, @l2cap_le_conn_req={{0x14, 0x1, 0xa}, {0x23, 0x40, 0x500, 0x100, 0xa}}}}, 0x17)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
r1 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
write$6lowpan_control(r1, &(0x7f0000000300)='connect aa:aa:aa:aa:aa:11 1', 0x1b)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/kmsg\x00', 0x800, 0x0)
read(r0, &(0x7f0000000180)=""/1000, 0x3e8)
executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000100)='3\x00', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000180)='1\x00', 0x2)
close(r2)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 5, 11]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x0, 0x0)
read(r1, &(0x7f0000000100)=""/100, 0x64)
close(r1)
executing program 1:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x1})
ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f)
write$tun(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="000008050010010b101200"], 0xb)
write$tun(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="0000080500100117"], 0x8)
executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000100)='3\x00', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000180)='1\x00', 0x2)
close(r2)

program crashed: KASAN: use-after-free Write in nfsd_create_serv
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <2>
bisect: split chunk #0 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 11]
detailed listing:
executing program 1:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'syzkaller0\x00', 0x1})
ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f)
write$tun(r0, &(0x7f0000000400)=ANY=[@ANYBLOB="000008050010010b101200"], 0xb)
write$tun(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="0000080500100117"], 0x8)
executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000100)='3\x00', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000180)='1\x00', 0x2)
close(r2)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 11]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x0, 0x0)
read(r1, &(0x7f0000000100)=""/100, 0x64)
close(r1)
executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000100)='3\x00', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000180)='1\x00', 0x2)
close(r2)

program crashed: KASAN: use-after-free Write in nfsd_create_serv
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 2 programs left: 

executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x0, 0x0)
read(r1, &(0x7f0000000100)=""/100, 0x64)
close(r1)
executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000100)='3\x00', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000180)='1\x00', 0x2)
close(r2)


bisect: trying to concatenate
bisect: concatenate 2 entries
minimizing program #0 before concatenation
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x0, 0x0)
read(r1, &(0x7f0000000100)=""/100, 0x64)
executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000100)='3\x00', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000180)='1\x00', 0x2)
close(r2)

program crashed: KASAN: use-after-free Write in nfsd_create_serv
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x0, 0x0)
executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000100)='3\x00', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000180)='1\x00', 0x2)
close(r2)

program crashed: KASAN: use-after-free Write in nfsd_create_serv
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)
close(r0)
executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000100)='3\x00', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000180)='1\x00', 0x2)
close(r2)

program crashed: KASAN: use-after-free Write in nfsd_create_serv
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)
executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000100)='3\x00', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000180)='1\x00', 0x2)
close(r2)

program crashed: KASAN: use-after-free Write in nfsd_create_serv
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000100)='3\x00', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000180)='1\x00', 0x2)
close(r2)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)
executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000100)='3\x00', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000180)='1\x00', 0x2)
close(r2)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 11]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)
executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000100)='3\x00', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000180)='1\x00', 0x2)
close(r2)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 11]
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)
executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000100)='3\x00', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000180)='1\x00', 0x2)
close(r2)

program did not crash
minimized 8 calls -> 4 calls
minimizing program #1 before concatenation
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 10]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000100)='3\x00', 0x2)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000180)='1\x00', 0x2)

program crashed: KASAN: use-after-free Write in nfsd_create_serv
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 9]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000100)='3\x00', 0x2)
close(r1)
openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/threads\x00', 0x2, 0x0)

program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 8]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000100)='3\x00', 0x2)
close(r1)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 7]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000100)='3\x00', 0x2)

program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 6]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x2, 0x0)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 5]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 3]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10)
listen(r0, 0x5)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 2]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000400)={0x2, 0x801, @loopback}, 0x10)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 1]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)
executing program 0:
socket$inet_tcp(0x2, 0x1, 0x0)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 0]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)
executing program 0:

program crashed: kernel BUG in svc_destroy
minimized 11 calls -> 0 calls
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)

program crashed: kernel BUG in svc_destroy
bisect: concatenation succeeded
found reproducer with 4 syscalls
minimizing guilty program
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100), 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
simplifying C reproducer
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program did not crash
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program did not crash
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)

program crashed: kernel BUG in svc_destroy
validation run: crashed=true
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)

program crashed: kernel BUG in svc_destroy
validation run: crashed=true
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='tcp 2049\n\x00', 0x9)

program crashed: kernel BUG in svc_destroy
validation run: crashed=true
reproducing took 1h14m48.830815836s
repro crashed as (corrupted=false):
------------[ cut here ]------------
kernel BUG at net/sunrpc/svc.c:605!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 4497 Comm: syz.0.18 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : svc_destroy+0x178/0x184 net/sunrpc/svc.c:605
lr : svc_destroy+0x178/0x184 net/sunrpc/svc.c:605
sp : ffff800021707930
x29: ffff800021707930 x28: 1fffe0001b90723f x27: ffff0000de9f9c00
x26: dfff800000000000 x25: ffff7000042e0f2c x24: ffff800021707960
x23: ffff0000cc7b5640 x22: dfff800000000000 x21: 0000000000000001
x20: ffff0000da32e868 x19: ffff0000da32e850 x18: 1fffe00033e6db7e
x17: ffff8000153bd000 x16: ffff8000082dd284 x15: 000000000004ffff
x14: 0000000000000001 x13: 1fffe00033e6dcf0 x12: 0000000000000000
x11: ff00800010f2e424 x10: 0000000000000000 x9 : ffff800010f2e424
x8 : ffff0000de9f9c00 x7 : ffff8000083b96c4 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000006 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
 svc_destroy+0x178/0x184 net/sunrpc/svc.c:605
 kref_put include/linux/kref.h:65 [inline]
 svc_put include/linux/sunrpc/svc.h:123 [inline]
 __write_ports_addxprt fs/nfsd/nfsctl.c:768 [inline]
 __write_ports fs/nfsd/nfsctl.c:794 [inline]
 write_ports+0x850/0x9f0 fs/nfsd/nfsctl.c:847
 nfsctl_transaction_write+0x114/0x164 fs/nfsd/nfsctl.c:114
 vfs_write+0x2a8/0x7c8 fs/read_write.c:582
 ksys_write+0x12c/0x228 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:646
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: 91026260 97c31b68 17ffffc8 97c31afe (d4210000) 
---[ end trace 0000000000000000 ]---

final repro crashed as (corrupted=false):
------------[ cut here ]------------
kernel BUG at net/sunrpc/svc.c:605!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 4497 Comm: syz.0.18 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : svc_destroy+0x178/0x184 net/sunrpc/svc.c:605
lr : svc_destroy+0x178/0x184 net/sunrpc/svc.c:605
sp : ffff800021707930
x29: ffff800021707930 x28: 1fffe0001b90723f x27: ffff0000de9f9c00
x26: dfff800000000000 x25: ffff7000042e0f2c x24: ffff800021707960
x23: ffff0000cc7b5640 x22: dfff800000000000 x21: 0000000000000001
x20: ffff0000da32e868 x19: ffff0000da32e850 x18: 1fffe00033e6db7e
x17: ffff8000153bd000 x16: ffff8000082dd284 x15: 000000000004ffff
x14: 0000000000000001 x13: 1fffe00033e6dcf0 x12: 0000000000000000
x11: ff00800010f2e424 x10: 0000000000000000 x9 : ffff800010f2e424
x8 : ffff0000de9f9c00 x7 : ffff8000083b96c4 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000006 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
 svc_destroy+0x178/0x184 net/sunrpc/svc.c:605
 kref_put include/linux/kref.h:65 [inline]
 svc_put include/linux/sunrpc/svc.h:123 [inline]
 __write_ports_addxprt fs/nfsd/nfsctl.c:768 [inline]
 __write_ports fs/nfsd/nfsctl.c:794 [inline]
 write_ports+0x850/0x9f0 fs/nfsd/nfsctl.c:847
 nfsctl_transaction_write+0x114/0x164 fs/nfsd/nfsctl.c:114
 vfs_write+0x2a8/0x7c8 fs/read_write.c:582
 ksys_write+0x12c/0x228 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:646
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: 91026260 97c31b68 17ffffc8 97c31afe (d4210000) 
---[ end trace 0000000000000000 ]---