Extracting prog: 17m16.673522136s
Minimizing prog: 19m47.005824668s
Simplifying prog options: 0s
Extracting C: 52.387719246s
Simplifying C: 7m15.350088463s


extracting reproducer from 26 programs
testing a last program of every proc
single: executing 5 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write-openat-ioctl-ioctl-ioctl-ioctl-ioctl-ioctl-ioctl-fsync-nanosleep
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x2, 0x0)
ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000500000000080000050000000500000000000000010000000000000001000000050000000500000000000000000000000200000000000100")
ioctl(r1, 0x40140921, &(0x7f0000000400)="0000000001000000000000000000000006000000")
ioctl(r1, 0x40140921, &(0x7f0000000440)="0100000001000000010000000100000006000000")
ioctl(r1, 0x40140921, &(0x7f0000000480)="0200000001000000020000000200000006000000")
ioctl(r1, 0x40140921, &(0x7f00000004c0)="0300000001000000030000000300000006000000")
ioctl(r1, 0x40140921, &(0x7f0000000500)="0400000001000000040000000400000006000000")
ioctl(r1, 0x400c0930, 0x0)
fsync(r1)
nanosleep(&(0x7f0000000900)={0x0, 0x1dcd6500}, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat-ftruncate-close-mkdirat-mount-mkdirat-openat-write-close-mkdirat-openat-write-close-openat-write-close-openat-write-close-mkdirat-openat-write-close-symlinkat-openat$nvme_fabrics-write-nanosleep-mkdirat-openat-read
detailed listing:
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x100000)
close(r0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='1', 0x1)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000400)='./file0\n', 0x8)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f00000004c0)='1\n', 0x2)
close(r4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000600)='loop\n', 0x5)
close(r5)
symlinkat(&(0x7f0000000680)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0)
write(r6, &(0x7f0000000800)='transport=loop,nqn=testsubsys\n', 0x1e)
nanosleep(&(0x7f0000000840)={0x0, 0x1dcd6500}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000880)='./sys\x00', 0x1ff)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/block/nvme0n1/dev\x00', 0x0, 0x0)
read(r7, &(0x7f00000009c0), 0x100)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-syz_usb_connect-nanosleep-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0)
syz_usb_connect(0x3, 0x47, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040670812980001010203010902350001010080fa0904000005ff0000000705810240000007050202400000070583024000000705040240000007058502400000"], 0x0)
nanosleep(&(0x7f0000000500)={0x0, 0x1dcd6500}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dt9812/1-1:1.0\x00', 0x0, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-openat-write-close-openat-write-close
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+3\n', 0x3)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='udp 2049\n', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
close(r2)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-nanosleep
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff00004071041e080001000000010902270001010080320904000003ff000000070581034000010705820200020007050302"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)

program did not crash
single: failed to extract reproducer
bisect: bisecting 26 programs with base timeout 30s
testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 12, 5, 17, 4, 12, 13, 4, 6, 4, 10, 6, 2, 8, 4, 5, 8, 8, 5, 11, 36, 8, 5, 12, 30, 16]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/mapper/control\x00', 0x2, 0x0)
ioctl(r0, 0xc138fd03, &(0x7f0000001000)="04000000000000000000000038010000380100000000000000000000000000000000000000000000000000000000000070")
ioctl(r0, 0xc138fd09, &(0x7f0000002000)="0400000000000000000000009001000038010000010000000000000000000000000000000000000000000000000000007000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000636c6f6e6500000000000000000000006e6f6e6578697374656e74206e6f6e6578697374656e74206e6f6e6578697374656e74203800"/372)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='-3\n', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/pool_threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r3, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10)
write(r3, &(0x7f0000000500)="80000040112233440000000000000002000186a3000000040000000100000000000000000000000000000000000000000000000000000001000000090000000100001000", 0x44)
nanosleep(&(0x7f0000000600)={0x0, 0x5f5e100}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup2_test\x00', 0x1ff)
mount$cgroup2(0x0, &(0x7f0000000080)='./cgroup2_test\x00', &(0x7f00000000c0), 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup2_test\x00', 0x0, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xd, 0x3, &(0x7f0000001800)=@raw=[@call={0x85, 0x0, 0x0, 0x7a}, @generic={0xb7, 0x0, 0x0, 0x0, 0x1}, @exit], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops=0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000500)={@cgroup=r0, r1, 0x3, 0x0, 0x0, @void, @value=0x0}, 0x20)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/threads\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/nfsd.export/channel\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='localhost / 2147483647 74768 0 0 0\n', 0x23)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.fh/channel\x00', 0x1, 0x0)
write(r4, &(0x7f0000000340)='localhost 1 \\x00000000 2147483647 /\n', 0x25)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./mnt\x00', 0x1ff)
mount$nfs4(&(0x7f00000003c0)='127.0.0.1:/\x00', &(0x7f0000000380)='./mnt\x00', &(0x7f0000000400), 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB='addr=127.0.0.1,clientaddr=127.0.0.1\x00'])
setxattr(&(0x7f0000000380)='./mnt\x00', &(0x7f0000000480)=@random={'system.', 'nfs4_acl\x00'}, &(0x7f0000000500)='test\x00', 0x4, 0x0)
executing program 2:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000200)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000300)='./mnt\x00', &(0x7f0000000400)='cifs\x00', 0x0, &(0x7f0000000500)='rdma,vers=3.0,ip=127.0.0.1,port=5445\x00')
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/crypto/af_alg_restrict\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0\x00', 0x1)
close(r0)
r1 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r1, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'pcrypt(rfc4106(gcm(aes)))\x00'}, 0x58)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newsa={0x150, 0x10, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa}, {@in6=@loopback, 0x1234, 0x32}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x80, "0102030405060708090a0b0c0d0e0f1011121314"}}]}, 0x150}}, 0x0)
r3 = socket$inet6(0xa, 0x3, 0x32)
sendto$inet6(r3, &(0x7f0000000200)="000012340000000100000000000000010000000000000000003b00"/42, 0x2a, 0x0, &(0x7f0000000300)={0xa, 0x0, 0x0, @loopback}, 0x1c)
nanosleep(&(0x7f0000000600)={0x0, 0x5f5e100}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./pipefs\x00', 0x1ff)
mount(0x0, &(0x7f0000000840)='./pipefs\x00', &(0x7f0000000880)='rpc_pipefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='-2 -3 +4\n', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='udp 2049\n', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
close(r2)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x0, 0x0)
read(r0, &(0x7f0000000100)=""/1024, 0x400)
executing program 1:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./disk\x00', 0x42, 0x1ff)
write(r0, &(0x7f0000000100)='00', 0x1)
r1 = syz_open_dev$loop(&(0x7f0000000200), 0x0, 0x2)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
close(r1)
mount(&(0x7f0000000300)=@loop={'/dev/loop', 0x0}, &(0x7f0000000400)='.\x00', &(0x7f0000000500)='qnx6\x00', 0x0, &(0x7f0000000600)='mmi_fs\x00')
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/devices/system/memory/memory35/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700)='offline\n', 0x8)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f00000000c0)='-3 +4\n', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000140)='tcp 2049\n', 0x9)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/nfsv4recoverydir\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='/tmp\n', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0)
write(r3, &(0x7f00000001c0)='1\n', 0x2)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/fs/o2cb/logmask/TCP\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)='off\n', 0x4)
write(r0, &(0x7f0000000240)='deny\n', 0x5)
write(r0, &(0x7f0000000280)='allow\n', 0x6)
executing program 2:
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff00004071041e080001000000010902270001010080320904000003ff000000070581034000010705820200020007050302"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/devices/system/memory/memory35/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700)='offline\n', 0x8)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/sys/vm/drop_caches\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='1\n', 0x2)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/rnbd-client/ctl/map_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000600)='sessname=s0 device_path=/dev/ram0 path=ip:127.0.0.1:1234\x00', 0x39)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='2049\n\x00', 0x5)
close(r0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/nfsd.export/channel\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='localhost / 2147483647 74768 0 0 0\n', 0x23)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.fh/channel\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='localhost 1 \\x00\\x00\\x00\\x00 2147483647 /\n', 0x2a)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/mtd/mtd0/writesize\x00', 0x0, 0x0)
read(r0, &(0x7f0000000300)=""/64, 0x40)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/devices/virtual/mtd/mtd0/writesize\x00', 0x0, 0x0)
read(r1, &(0x7f0000000500)=""/64, 0x40)
close(r1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/mapper/control\x00', 0x2, 0x0)
ioctl(r0, 0xc138fd03, &(0x7f0000001000)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000007000"/305)
ioctl(r0, 0xc138fd09, &(0x7f0000002000)="04000000000000000000000060010000380100000100000000000000000000000000000000000000000000000000000070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000636c6f6e6500"/353)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+3\n', 0x3)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='udp 2049\n', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
close(r2)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r5, &(0x7f0000000600)='fc\n', 0x3)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r6, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r6)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r7 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r7, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x89)
nanosleep(&(0x7f0000000900)={0x0, 0x1dcd6500}, 0x0)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r8, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r8)
close(r7)
executing program 1:
r0 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'hsr0\x00', <r1=>0x0})
sendto$packet(r0, &(0x7f0000000100)="0102030405060708090a0b0c0d0e0f10", 0x10, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @local}, 0x14)
r2 = socket$packet(0x11, 0x3, 0x300)
sendto$packet(r2, &(0x7f0000000140)="01154e0001000011221e445508000102030405060708090a0b0c", 0x1a, 0x0, &(0x7f0000000040)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @local}, 0x14)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@dellink={0x20, 0x11, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}}, 0x20}}, 0x0)
nanosleep(&(0x7f0000000400)={0x0, 0x10000000}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0)
syz_usb_connect(0x3, 0x47, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040670812980001010203010902350001010080fa0904000005ff0000000705810240000007050202400000070583024000000705040240000007058502400000"], 0x0)
nanosleep(&(0x7f0000000500)={0x0, 0x1dcd6500}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dt9812/1-1:1.0\x00', 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1/irqmode\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='2\x00', 0x1)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nullb/nullb1/completion_nsec\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='10000000\x00', 0x8)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='1\x00', 0x1)
close(r2)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x100000)
close(r0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='1', 0x1)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000400)='./file0\n', 0x8)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f00000004c0)='1\n', 0x2)
close(r4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000600)='loop\n', 0x5)
close(r5)
symlinkat(&(0x7f0000000680)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0)
write(r6, &(0x7f0000000800)='transport=loop,nqn=testsubsys\n', 0x1e)
nanosleep(&(0x7f0000000840)={0x0, 0x1dcd6500}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000880)='./sys\x00', 0x1ff)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/block/nvme0n1/dev\x00', 0x0, 0x0)
read(r7, &(0x7f00000009c0), 0x100)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x2, 0x0)
ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000500000000080000050000000500000000000000010000000000000001000000050000000500000000000000000000000200000000000100")
ioctl(r1, 0x40140921, &(0x7f0000000400)="0000000001000000000000000000000006000000")
ioctl(r1, 0x40140921, &(0x7f0000000440)="0100000001000000010000000100000006000000")
ioctl(r1, 0x40140921, &(0x7f0000000480)="0200000001000000020000000200000006000000")
ioctl(r1, 0x40140921, &(0x7f00000004c0)="0300000001000000030000000300000006000000")
ioctl(r1, 0x40140921, &(0x7f0000000500)="0400000001000000040000000400000006000000")
ioctl(r1, 0x400c0930, 0x0)
fsync(r1)
nanosleep(&(0x7f0000000900)={0x0, 0x1dcd6500}, 0x0)

program crashed: kernel BUG in svc_destroy
bisect: bisecting 26 programs
bisect: split chunks (needed=false): <26>
bisect: split chunk #0 of len 26 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=34s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 10, 6, 2, 8, 4, 5, 8, 8, 5, 11, 36, 8, 5, 12, 30, 16]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/devices/system/memory/memory35/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700)='offline\n', 0x8)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f00000000c0)='-3 +4\n', 0x6)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000140)='tcp 2049\n', 0x9)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/nfsv4recoverydir\x00', 0x2, 0x0)
write(r2, &(0x7f0000000240)='/tmp\n', 0x5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x2, 0x0)
write(r3, &(0x7f00000001c0)='1\n', 0x2)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/fs/o2cb/logmask/TCP\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)='off\n', 0x4)
write(r0, &(0x7f0000000240)='deny\n', 0x5)
write(r0, &(0x7f0000000280)='allow\n', 0x6)
executing program 2:
syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff00004071041e080001000000010902270001010080320904000003ff000000070581034000010705820200020007050302"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000400)='./sys\x00', &(0x7f0000000500)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/devices/system/memory/memory35/state\x00', 0x2, 0x0)
write(r0, &(0x7f0000000700)='offline\n', 0x8)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/sys/vm/drop_caches\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='1\n', 0x2)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/rnbd-client/ctl/map_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000600)='sessname=s0 device_path=/dev/ram0 path=ip:127.0.0.1:1234\x00', 0x39)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='2049\n\x00', 0x5)
close(r0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/nfsd.export/channel\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='localhost / 2147483647 74768 0 0 0\n', 0x23)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.fh/channel\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='localhost 1 \\x00\\x00\\x00\\x00 2147483647 /\n', 0x2a)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/mtd/mtd0/writesize\x00', 0x0, 0x0)
read(r0, &(0x7f0000000300)=""/64, 0x40)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/devices/virtual/mtd/mtd0/writesize\x00', 0x0, 0x0)
read(r1, &(0x7f0000000500)=""/64, 0x40)
close(r1)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/mapper/control\x00', 0x2, 0x0)
ioctl(r0, 0xc138fd03, &(0x7f0000001000)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000007000"/305)
ioctl(r0, 0xc138fd09, &(0x7f0000002000)="04000000000000000000000060010000380100000100000000000000000000000000000000000000000000000000000070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000636c6f6e6500"/353)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+3\n', 0x3)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='udp 2049\n', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
close(r2)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r5, &(0x7f0000000600)='fc\n', 0x3)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r6, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r6)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r7 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r7, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x89)
nanosleep(&(0x7f0000000900)={0x0, 0x1dcd6500}, 0x0)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r8, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r8)
close(r7)
executing program 1:
r0 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'hsr0\x00', <r1=>0x0})
sendto$packet(r0, &(0x7f0000000100)="0102030405060708090a0b0c0d0e0f10", 0x10, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @local}, 0x14)
r2 = socket$packet(0x11, 0x3, 0x300)
sendto$packet(r2, &(0x7f0000000140)="01154e0001000011221e445508000102030405060708090a0b0c", 0x1a, 0x0, &(0x7f0000000040)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @local}, 0x14)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@dellink={0x20, 0x11, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}}, 0x20}}, 0x0)
nanosleep(&(0x7f0000000400)={0x0, 0x10000000}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0)
syz_usb_connect(0x3, 0x47, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040670812980001010203010902350001010080fa0904000005ff0000000705810240000007050202400000070583024000000705040240000007058502400000"], 0x0)
nanosleep(&(0x7f0000000500)={0x0, 0x1dcd6500}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dt9812/1-1:1.0\x00', 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1/irqmode\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='2\x00', 0x1)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nullb/nullb1/completion_nsec\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='10000000\x00', 0x8)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='1\x00', 0x1)
close(r2)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x100000)
close(r0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='1', 0x1)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000400)='./file0\n', 0x8)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f00000004c0)='1\n', 0x2)
close(r4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000600)='loop\n', 0x5)
close(r5)
symlinkat(&(0x7f0000000680)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0)
write(r6, &(0x7f0000000800)='transport=loop,nqn=testsubsys\n', 0x1e)
nanosleep(&(0x7f0000000840)={0x0, 0x1dcd6500}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000880)='./sys\x00', 0x1ff)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/block/nvme0n1/dev\x00', 0x0, 0x0)
read(r7, &(0x7f00000009c0), 0x100)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x2, 0x0)
ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000500000000080000050000000500000000000000010000000000000001000000050000000500000000000000000000000200000000000100")
ioctl(r1, 0x40140921, &(0x7f0000000400)="0000000001000000000000000000000006000000")
ioctl(r1, 0x40140921, &(0x7f0000000440)="0100000001000000010000000100000006000000")
ioctl(r1, 0x40140921, &(0x7f0000000480)="0200000001000000020000000200000006000000")
ioctl(r1, 0x40140921, &(0x7f00000004c0)="0300000001000000030000000300000006000000")
ioctl(r1, 0x40140921, &(0x7f0000000500)="0400000001000000040000000400000006000000")
ioctl(r1, 0x400c0930, 0x0)
fsync(r1)
nanosleep(&(0x7f0000000900)={0x0, 0x1dcd6500}, 0x0)

program did not crash
bisect: testing without sub-chunk 2/3
testing program (duration=34s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 12, 5, 17, 4, 12, 13, 4, 6, 5, 11, 36, 8, 5, 12, 30, 16]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/mapper/control\x00', 0x2, 0x0)
ioctl(r0, 0xc138fd03, &(0x7f0000001000)="04000000000000000000000038010000380100000000000000000000000000000000000000000000000000000000000070")
ioctl(r0, 0xc138fd09, &(0x7f0000002000)="0400000000000000000000009001000038010000010000000000000000000000000000000000000000000000000000007000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000636c6f6e6500000000000000000000006e6f6e6578697374656e74206e6f6e6578697374656e74206e6f6e6578697374656e74203800"/372)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='-3\n', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/pool_threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r3, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10)
write(r3, &(0x7f0000000500)="80000040112233440000000000000002000186a3000000040000000100000000000000000000000000000000000000000000000000000001000000090000000100001000", 0x44)
nanosleep(&(0x7f0000000600)={0x0, 0x5f5e100}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup2_test\x00', 0x1ff)
mount$cgroup2(0x0, &(0x7f0000000080)='./cgroup2_test\x00', &(0x7f00000000c0), 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup2_test\x00', 0x0, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xd, 0x3, &(0x7f0000001800)=@raw=[@call={0x85, 0x0, 0x0, 0x7a}, @generic={0xb7, 0x0, 0x0, 0x0, 0x1}, @exit], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops=0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000500)={@cgroup=r0, r1, 0x3, 0x0, 0x0, @void, @value=0x0}, 0x20)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/threads\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/nfsd.export/channel\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='localhost / 2147483647 74768 0 0 0\n', 0x23)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.fh/channel\x00', 0x1, 0x0)
write(r4, &(0x7f0000000340)='localhost 1 \\x00000000 2147483647 /\n', 0x25)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./mnt\x00', 0x1ff)
mount$nfs4(&(0x7f00000003c0)='127.0.0.1:/\x00', &(0x7f0000000380)='./mnt\x00', &(0x7f0000000400), 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB='addr=127.0.0.1,clientaddr=127.0.0.1\x00'])
setxattr(&(0x7f0000000380)='./mnt\x00', &(0x7f0000000480)=@random={'system.', 'nfs4_acl\x00'}, &(0x7f0000000500)='test\x00', 0x4, 0x0)
executing program 2:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000200)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000300)='./mnt\x00', &(0x7f0000000400)='cifs\x00', 0x0, &(0x7f0000000500)='rdma,vers=3.0,ip=127.0.0.1,port=5445\x00')
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/crypto/af_alg_restrict\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0\x00', 0x1)
close(r0)
r1 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r1, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'pcrypt(rfc4106(gcm(aes)))\x00'}, 0x58)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newsa={0x150, 0x10, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa}, {@in6=@loopback, 0x1234, 0x32}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x80, "0102030405060708090a0b0c0d0e0f1011121314"}}]}, 0x150}}, 0x0)
r3 = socket$inet6(0xa, 0x3, 0x32)
sendto$inet6(r3, &(0x7f0000000200)="000012340000000100000000000000010000000000000000003b00"/42, 0x2a, 0x0, &(0x7f0000000300)={0xa, 0x0, 0x0, @loopback}, 0x1c)
nanosleep(&(0x7f0000000600)={0x0, 0x5f5e100}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./pipefs\x00', 0x1ff)
mount(0x0, &(0x7f0000000840)='./pipefs\x00', &(0x7f0000000880)='rpc_pipefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='-2 -3 +4\n', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='udp 2049\n', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
close(r2)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x0, 0x0)
read(r0, &(0x7f0000000100)=""/1024, 0x400)
executing program 1:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./disk\x00', 0x42, 0x1ff)
write(r0, &(0x7f0000000100)='00', 0x1)
r1 = syz_open_dev$loop(&(0x7f0000000200), 0x0, 0x2)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
close(r1)
mount(&(0x7f0000000300)=@loop={'/dev/loop', 0x0}, &(0x7f0000000400)='.\x00', &(0x7f0000000500)='qnx6\x00', 0x0, &(0x7f0000000600)='mmi_fs\x00')
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/mapper/control\x00', 0x2, 0x0)
ioctl(r0, 0xc138fd03, &(0x7f0000001000)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000007000"/305)
ioctl(r0, 0xc138fd09, &(0x7f0000002000)="04000000000000000000000060010000380100000100000000000000000000000000000000000000000000000000000070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000636c6f6e6500"/353)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='+3\n', 0x3)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='udp 2049\n', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
close(r2)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/fcloop/ctl/add_target_port\x00', 0x1, 0x0)
write(r0, &(0x7f0000000240)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/class/fcloop/ctl/add_local_port\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='wwnn=0x1000000044001123,wwpn=0x2000000044001123\n', 0x30)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/fcloop/ctl/add_remote_port\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='wwnn=0x1000000044001122,wwpn=0x2000000044001122,lpwwnn=0x1000000044001123,lpwwpn=0x2000000044001123\n', 0x64)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='1\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='fc\n', 0x3)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f00000005c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r5, &(0x7f0000000600)='fc\n', 0x3)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r6, &(0x7f0000000680)='nn-0x1000000044001122:pn-0x2000000044001122\n', 0x2e)
close(r6)
symlinkat(&(0x7f0000000700)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r7 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0)
write(r7, &(0x7f0000000880)='transport=fc,traddr=nn-0x1000000044001122:pn-0x2000000044001122,host_traddr=nn-0x1000000044001123:pn-0x2000000044001123,nqn=testsubsys\n', 0x89)
nanosleep(&(0x7f0000000900)={0x0, 0x1dcd6500}, 0x0)
unlinkat(0xffffffffffffff9c, &(0x7f0000000780)='./config/nvmet/ports/1/subsystems/testsubsys\x00', 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/class/fcloop/ctl/del_remote_port\x00', 0x1, 0x0)
write(r8, &(0x7f0000000980)='wwnn=0x1000000044001122,wwpn=0x2000000044001122\n', 0x30)
close(r8)
close(r7)
executing program 1:
r0 = socket$packet(0x11, 0x2, 0x300)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'hsr0\x00', <r1=>0x0})
sendto$packet(r0, &(0x7f0000000100)="0102030405060708090a0b0c0d0e0f10", 0x10, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @local}, 0x14)
r2 = socket$packet(0x11, 0x3, 0x300)
sendto$packet(r2, &(0x7f0000000140)="01154e0001000011221e445508000102030405060708090a0b0c", 0x1a, 0x0, &(0x7f0000000040)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @local}, 0x14)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@dellink={0x20, 0x11, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r1}}, 0x20}}, 0x0)
nanosleep(&(0x7f0000000400)={0x0, 0x10000000}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0)
syz_usb_connect(0x3, 0x47, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040670812980001010203010902350001010080fa0904000005ff0000000705810240000007050202400000070583024000000705040240000007058502400000"], 0x0)
nanosleep(&(0x7f0000000500)={0x0, 0x1dcd6500}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/dt9812/1-1:1.0\x00', 0x0, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1/irqmode\x00', 0x1, 0x0)
write(r0, &(0x7f0000000140)='2\x00', 0x1)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nullb/nullb1/completion_nsec\x00', 0x1, 0x0)
write(r1, &(0x7f00000001c0)='10000000\x00', 0x8)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='1\x00', 0x1)
close(r2)
executing program 0:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x100000)
close(r0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='1', 0x1)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/buffered_io\x00', 0x1, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000400)='./file0\n', 0x8)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f00000004c0)='1\n', 0x2)
close(r4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1\x00', 0x1ff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000600)='loop\n', 0x5)
close(r5)
symlinkat(&(0x7f0000000680)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000780), 0x2, 0x0)
write(r6, &(0x7f0000000800)='transport=loop,nqn=testsubsys\n', 0x1e)
nanosleep(&(0x7f0000000840)={0x0, 0x1dcd6500}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000880)='./sys\x00', 0x1ff)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./sys/block/nvme0n1/dev\x00', 0x0, 0x0)
read(r7, &(0x7f00000009c0), 0x100)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='md0\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x2, 0x0)
ioctl(r1, 0x40480923, &(0x7f0000000380)="000000000000000000000000000000000500000000080000050000000500000000000000010000000000000001000000050000000500000000000000000000000200000000000100")
ioctl(r1, 0x40140921, &(0x7f0000000400)="0000000001000000000000000000000006000000")
ioctl(r1, 0x40140921, &(0x7f0000000440)="0100000001000000010000000100000006000000")
ioctl(r1, 0x40140921, &(0x7f0000000480)="0200000001000000020000000200000006000000")
ioctl(r1, 0x40140921, &(0x7f00000004c0)="0300000001000000030000000300000006000000")
ioctl(r1, 0x40140921, &(0x7f0000000500)="0400000001000000040000000400000006000000")
ioctl(r1, 0x400c0930, 0x0)
fsync(r1)
nanosleep(&(0x7f0000000900)={0x0, 0x1dcd6500}, 0x0)

program crashed: kernel BUG in svc_destroy
bisect: the chunk can be dropped
bisect: testing without sub-chunk 3/3
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 12, 5, 17, 4, 12, 13, 4, 6]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/mapper/control\x00', 0x2, 0x0)
ioctl(r0, 0xc138fd03, &(0x7f0000001000)="04000000000000000000000038010000380100000000000000000000000000000000000000000000000000000000000070")
ioctl(r0, 0xc138fd09, &(0x7f0000002000)="0400000000000000000000009001000038010000010000000000000000000000000000000000000000000000000000007000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000636c6f6e6500000000000000000000006e6f6e6578697374656e74206e6f6e6578697374656e74206e6f6e6578697374656e74203800"/372)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='-3\n', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/pool_threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r3, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10)
write(r3, &(0x7f0000000500)="80000040112233440000000000000002000186a3000000040000000100000000000000000000000000000000000000000000000000000001000000090000000100001000", 0x44)
nanosleep(&(0x7f0000000600)={0x0, 0x5f5e100}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup2_test\x00', 0x1ff)
mount$cgroup2(0x0, &(0x7f0000000080)='./cgroup2_test\x00', &(0x7f00000000c0), 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup2_test\x00', 0x0, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xd, 0x3, &(0x7f0000001800)=@raw=[@call={0x85, 0x0, 0x0, 0x7a}, @generic={0xb7, 0x0, 0x0, 0x0, 0x1}, @exit], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops=0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000500)={@cgroup=r0, r1, 0x3, 0x0, 0x0, @void, @value=0x0}, 0x20)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/threads\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/nfsd.export/channel\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='localhost / 2147483647 74768 0 0 0\n', 0x23)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.fh/channel\x00', 0x1, 0x0)
write(r4, &(0x7f0000000340)='localhost 1 \\x00000000 2147483647 /\n', 0x25)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./mnt\x00', 0x1ff)
mount$nfs4(&(0x7f00000003c0)='127.0.0.1:/\x00', &(0x7f0000000380)='./mnt\x00', &(0x7f0000000400), 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB='addr=127.0.0.1,clientaddr=127.0.0.1\x00'])
setxattr(&(0x7f0000000380)='./mnt\x00', &(0x7f0000000480)=@random={'system.', 'nfs4_acl\x00'}, &(0x7f0000000500)='test\x00', 0x4, 0x0)
executing program 2:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000200)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000300)='./mnt\x00', &(0x7f0000000400)='cifs\x00', 0x0, &(0x7f0000000500)='rdma,vers=3.0,ip=127.0.0.1,port=5445\x00')
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/crypto/af_alg_restrict\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0\x00', 0x1)
close(r0)
r1 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r1, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'pcrypt(rfc4106(gcm(aes)))\x00'}, 0x58)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newsa={0x150, 0x10, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa}, {@in6=@loopback, 0x1234, 0x32}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x80, "0102030405060708090a0b0c0d0e0f1011121314"}}]}, 0x150}}, 0x0)
r3 = socket$inet6(0xa, 0x3, 0x32)
sendto$inet6(r3, &(0x7f0000000200)="000012340000000100000000000000010000000000000000003b00"/42, 0x2a, 0x0, &(0x7f0000000300)={0xa, 0x0, 0x0, @loopback}, 0x1c)
nanosleep(&(0x7f0000000600)={0x0, 0x5f5e100}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./pipefs\x00', 0x1ff)
mount(0x0, &(0x7f0000000840)='./pipefs\x00', &(0x7f0000000880)='rpc_pipefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='-2 -3 +4\n', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='udp 2049\n', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
close(r2)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x0, 0x0)
read(r0, &(0x7f0000000100)=""/1024, 0x400)
executing program 1:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./disk\x00', 0x42, 0x1ff)
write(r0, &(0x7f0000000100)='00', 0x1)
r1 = syz_open_dev$loop(&(0x7f0000000200), 0x0, 0x2)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
close(r1)
mount(&(0x7f0000000300)=@loop={'/dev/loop', 0x0}, &(0x7f0000000400)='.\x00', &(0x7f0000000500)='qnx6\x00', 0x0, &(0x7f0000000600)='mmi_fs\x00')

program crashed: kernel BUG in svc_destroy
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <9>
bisect: split chunk #0 of len 9 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 13, 4, 6]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/crypto/af_alg_restrict\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='0\x00', 0x1)
close(r0)
r1 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r1, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'pcrypt(rfc4106(gcm(aes)))\x00'}, 0x58)
r2 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newsa={0x150, 0x10, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa}, {@in6=@loopback, 0x1234, 0x32}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x80, "0102030405060708090a0b0c0d0e0f1011121314"}}]}, 0x150}}, 0x0)
r3 = socket$inet6(0xa, 0x3, 0x32)
sendto$inet6(r3, &(0x7f0000000200)="000012340000000100000000000000010000000000000000003b00"/42, 0x2a, 0x0, &(0x7f0000000300)={0xa, 0x0, 0x0, @loopback}, 0x1c)
nanosleep(&(0x7f0000000600)={0x0, 0x5f5e100}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000800)='./pipefs\x00', 0x1ff)
mount(0x0, &(0x7f0000000840)='./pipefs\x00', &(0x7f0000000880)='rpc_pipefs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='-2 -3 +4\n', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='udp 2049\n', 0x9)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
close(r2)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x0, 0x0)
read(r0, &(0x7f0000000100)=""/1024, 0x400)
executing program 1:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./disk\x00', 0x42, 0x1ff)
write(r0, &(0x7f0000000100)='00', 0x1)
r1 = syz_open_dev$loop(&(0x7f0000000200), 0x0, 0x2)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
close(r1)
mount(&(0x7f0000000300)=@loop={'/dev/loop', 0x0}, &(0x7f0000000400)='.\x00', &(0x7f0000000500)='qnx6\x00', 0x0, &(0x7f0000000600)='mmi_fs\x00')

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 12, 5, 17, 4]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/mapper/control\x00', 0x2, 0x0)
ioctl(r0, 0xc138fd03, &(0x7f0000001000)="04000000000000000000000038010000380100000000000000000000000000000000000000000000000000000000000070")
ioctl(r0, 0xc138fd09, &(0x7f0000002000)="0400000000000000000000009001000038010000010000000000000000000000000000000000000000000000000000007000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000636c6f6e6500000000000000000000006e6f6e6578697374656e74206e6f6e6578697374656e74206e6f6e6578697374656e74203800"/372)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='-3\n', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/pool_threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r3, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10)
write(r3, &(0x7f0000000500)="80000040112233440000000000000002000186a3000000040000000100000000000000000000000000000000000000000000000000000001000000090000000100001000", 0x44)
nanosleep(&(0x7f0000000600)={0x0, 0x5f5e100}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup2_test\x00', 0x1ff)
mount$cgroup2(0x0, &(0x7f0000000080)='./cgroup2_test\x00', &(0x7f00000000c0), 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup2_test\x00', 0x0, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xd, 0x3, &(0x7f0000001800)=@raw=[@call={0x85, 0x0, 0x0, 0x7a}, @generic={0xb7, 0x0, 0x0, 0x0, 0x1}, @exit], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops=0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000500)={@cgroup=r0, r1, 0x3, 0x0, 0x0, @void, @value=0x0}, 0x20)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/threads\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/nfsd.export/channel\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='localhost / 2147483647 74768 0 0 0\n', 0x23)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.fh/channel\x00', 0x1, 0x0)
write(r4, &(0x7f0000000340)='localhost 1 \\x00000000 2147483647 /\n', 0x25)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./mnt\x00', 0x1ff)
mount$nfs4(&(0x7f00000003c0)='127.0.0.1:/\x00', &(0x7f0000000380)='./mnt\x00', &(0x7f0000000400), 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB='addr=127.0.0.1,clientaddr=127.0.0.1\x00'])
setxattr(&(0x7f0000000380)='./mnt\x00', &(0x7f0000000480)=@random={'system.', 'nfs4_acl\x00'}, &(0x7f0000000500)='test\x00', 0x4, 0x0)
executing program 2:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000200)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000300)='./mnt\x00', &(0x7f0000000400)='cifs\x00', 0x0, &(0x7f0000000500)='rdma,vers=3.0,ip=127.0.0.1,port=5445\x00')

program crashed: kernel BUG in svc_destroy
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <5>
bisect: split chunk #0 of len 5 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 4]
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f00000000c0)='tcp 2049\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/threads\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='1\n', 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0)
write(r2, &(0x7f0000000240)='nfsd 127.0.0.1 2147483647 localhost\n', 0x24)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/net/rpc/nfsd.export/channel\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='localhost / 2147483647 74768 0 0 0\n', 0x23)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./proc/net/rpc/nfsd.fh/channel\x00', 0x1, 0x0)
write(r4, &(0x7f0000000340)='localhost 1 \\x00000000 2147483647 /\n', 0x25)
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./mnt\x00', 0x1ff)
mount$nfs4(&(0x7f00000003c0)='127.0.0.1:/\x00', &(0x7f0000000380)='./mnt\x00', &(0x7f0000000400), 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB='addr=127.0.0.1,clientaddr=127.0.0.1\x00'])
setxattr(&(0x7f0000000380)='./mnt\x00', &(0x7f0000000480)=@random={'system.', 'nfs4_acl\x00'}, &(0x7f0000000500)='test\x00', 0x4, 0x0)
executing program 2:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000200)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000300)='./mnt\x00', &(0x7f0000000400)='cifs\x00', 0x0, &(0x7f0000000500)='rdma,vers=3.0,ip=127.0.0.1,port=5445\x00')

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 12, 5]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/mapper/control\x00', 0x2, 0x0)
ioctl(r0, 0xc138fd03, &(0x7f0000001000)="04000000000000000000000038010000380100000000000000000000000000000000000000000000000000000000000070")
ioctl(r0, 0xc138fd09, &(0x7f0000002000)="0400000000000000000000009001000038010000010000000000000000000000000000000000000000000000000000007000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000636c6f6e6500000000000000000000006e6f6e6578697374656e74206e6f6e6578697374656e74206e6f6e6578697374656e74203800"/372)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='-3\n', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/pool_threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r3, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10)
write(r3, &(0x7f0000000500)="80000040112233440000000000000002000186a3000000040000000100000000000000000000000000000000000000000000000000000001000000090000000100001000", 0x44)
nanosleep(&(0x7f0000000600)={0x0, 0x5f5e100}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup2_test\x00', 0x1ff)
mount$cgroup2(0x0, &(0x7f0000000080)='./cgroup2_test\x00', &(0x7f00000000c0), 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup2_test\x00', 0x0, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xd, 0x3, &(0x7f0000001800)=@raw=[@call={0x85, 0x0, 0x0, 0x7a}, @generic={0xb7, 0x0, 0x0, 0x0, 0x1}, @exit], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops=0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000500)={@cgroup=r0, r1, 0x3, 0x0, 0x0, @void, @value=0x0}, 0x20)

program crashed: kernel BUG in svc_destroy
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <3>
bisect: split chunk #0 of len 3 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount$cgroup2-openat-bpf$PROG_LOAD-bpf$BPF_PROG_ATTACH
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup2_test\x00', 0x1ff)
mount$cgroup2(0x0, &(0x7f0000000080)='./cgroup2_test\x00', &(0x7f00000000c0), 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup2_test\x00', 0x0, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xd, 0x3, &(0x7f0000001800)=@raw=[@call={0x85, 0x0, 0x0, 0x7a}, @generic={0xb7, 0x0, 0x0, 0x0, 0x1}, @exit], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops=0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000500)={@cgroup=r0, r1, 0x3, 0x0, 0x0, @void, @value=0x0}, 0x20)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 12]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/mapper/control\x00', 0x2, 0x0)
ioctl(r0, 0xc138fd03, &(0x7f0000001000)="04000000000000000000000038010000380100000000000000000000000000000000000000000000000000000000000070")
ioctl(r0, 0xc138fd09, &(0x7f0000002000)="0400000000000000000000009001000038010000010000000000000000000000000000000000000000000000000000007000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000636c6f6e6500000000000000000000006e6f6e6578697374656e74206e6f6e6578697374656e74206e6f6e6578697374656e74203800"/372)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='-3\n', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/pool_threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r3, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10)
write(r3, &(0x7f0000000500)="80000040112233440000000000000002000186a3000000040000000100000000000000000000000000000000000000000000000000000001000000090000000100001000", 0x44)
nanosleep(&(0x7f0000000600)={0x0, 0x5f5e100}, 0x0)

program crashed: kernel BUG in svc_destroy
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <2>
bisect: split chunk #0 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-socket$inet_tcp-connect$inet-write-nanosleep
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='-3\n', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/pool_threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r3, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10)
write(r3, &(0x7f0000000500)="80000040112233440000000000000002000186a3000000040000000100000000000000000000000000000000000000000000000000000001000000090000000100001000", 0x44)
nanosleep(&(0x7f0000000600)={0x0, 0x5f5e100}, 0x0)

program crashed: kernel BUG in svc_destroy
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 1 programs left: 

executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='-3\n', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/pool_threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r3, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10)
write(r3, &(0x7f0000000500)="80000040112233440000000000000002000186a3000000040000000100000000000000000000000000000000000000000000000000000001000000090000000100001000", 0x44)
nanosleep(&(0x7f0000000600)={0x0, 0x5f5e100}, 0x0)


bisect: trying to concatenate
bisect: concatenate 1 entries
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-socket$inet_tcp-connect$inet-write-nanosleep
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='-3\n', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/pool_threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r3, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10)
write(r3, &(0x7f0000000500)="80000040112233440000000000000002000186a3000000040000000100000000000000000000000000000000000000000000000000000001000000090000000100001000", 0x44)
nanosleep(&(0x7f0000000600)={0x0, 0x5f5e100}, 0x0)

program crashed: kernel BUG in svc_destroy
bisect: concatenation succeeded
found reproducer with 12 syscalls
minimizing guilty program
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-socket$inet_tcp-connect$inet-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='-3\n', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/pool_threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r3, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10)
write(r3, &(0x7f0000000500)="80000040112233440000000000000002000186a3000000040000000100000000000000000000000000000000000000000000000000000001000000090000000100001000", 0x44)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-socket$inet_tcp-connect$inet
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='-3\n', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/pool_threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r3, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-socket$inet_tcp
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='-3\n', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/pool_threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)
socket$inet_tcp(0x2, 0x1, 0x0)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='-3\n', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/pool_threads\x00', 0x2, 0x0)
write(r2, &(0x7f0000000340)='1\n', 0x2)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='-3\n', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='tcp 20000\n', 0xa)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/pool_threads\x00', 0x2, 0x0)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='-3\n', 0x3)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000240)='tcp 20000\n', 0xa)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='-3\n', 0x3)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f0000000140)='-3\n', 0x3)
write(0xffffffffffffffff, &(0x7f0000000240)='tcp 20000\n', 0xa)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/versions\x00', 0x2, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write
detailed listing:
executing program 0:
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./nfsd\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, 0x0, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240), 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
simplifying C reproducer
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program did not crash
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program did not crash
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)

program crashed: kernel BUG in svc_destroy
validation run: crashed=true
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)

program crashed: kernel BUG in svc_destroy
validation run: crashed=true
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 20000\n', 0xa)

program crashed: kernel BUG in svc_destroy
validation run: crashed=true
reproducing took 48m4.824552609s
repro crashed as (corrupted=false):
------------[ cut here ]------------
kernel BUG at net/sunrpc/svc.c:605!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 4529 Comm: syz.0.18 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : svc_destroy+0x178/0x184 net/sunrpc/svc.c:605
lr : svc_destroy+0x178/0x184 net/sunrpc/svc.c:605
sp : ffff8000217b7930
x29: ffff8000217b7930 x28: 1fffe0001894372f x27: ffff0000d1a30000
x26: dfff800000000000 x25: ffff7000042f6f2c x24: ffff8000217b7960
x23: ffff0000c3e6f8c0 x22: dfff800000000000 x21: 0000000000000001
x20: ffff0000cdec7068 x19: ffff0000cdec7050 x18: 1fffe00033e66f7e
x17: ffff8000153cd000 x16: ffff8000082dd38c x15: 000000000004ffff
x14: 0000000000000001 x13: 1fffe00033e670f0 x12: 0000000000000000
x11: ff00800010f3ced0 x10: 0000000000000000 x9 : ffff800010f3ced0
x8 : ffff0000d1a30000 x7 : ffff8000083bb394 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000006 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
 svc_destroy+0x178/0x184 net/sunrpc/svc.c:605
 kref_put include/linux/kref.h:65 [inline]
 svc_put include/linux/sunrpc/svc.h:123 [inline]
 __write_ports_addxprt fs/nfsd/nfsctl.c:768 [inline]
 __write_ports fs/nfsd/nfsctl.c:794 [inline]
 write_ports+0x850/0x9f0 fs/nfsd/nfsctl.c:847
 nfsctl_transaction_write+0x114/0x164 fs/nfsd/nfsctl.c:114
 vfs_write+0x2a8/0x7c8 fs/read_write.c:582
 ksys_write+0x12c/0x228 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:646
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x12c arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: 91026260 97c2d8ed 17ffffc8 97c2d884 (d4210000) 
---[ end trace 0000000000000000 ]---

final repro crashed as (corrupted=false):
------------[ cut here ]------------
kernel BUG at net/sunrpc/svc.c:605!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 4529 Comm: syz.0.18 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : svc_destroy+0x178/0x184 net/sunrpc/svc.c:605
lr : svc_destroy+0x178/0x184 net/sunrpc/svc.c:605
sp : ffff8000217b7930
x29: ffff8000217b7930 x28: 1fffe0001894372f x27: ffff0000d1a30000
x26: dfff800000000000 x25: ffff7000042f6f2c x24: ffff8000217b7960
x23: ffff0000c3e6f8c0 x22: dfff800000000000 x21: 0000000000000001
x20: ffff0000cdec7068 x19: ffff0000cdec7050 x18: 1fffe00033e66f7e
x17: ffff8000153cd000 x16: ffff8000082dd38c x15: 000000000004ffff
x14: 0000000000000001 x13: 1fffe00033e670f0 x12: 0000000000000000
x11: ff00800010f3ced0 x10: 0000000000000000 x9 : ffff800010f3ced0
x8 : ffff0000d1a30000 x7 : ffff8000083bb394 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000006 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
 svc_destroy+0x178/0x184 net/sunrpc/svc.c:605
 kref_put include/linux/kref.h:65 [inline]
 svc_put include/linux/sunrpc/svc.h:123 [inline]
 __write_ports_addxprt fs/nfsd/nfsctl.c:768 [inline]
 __write_ports fs/nfsd/nfsctl.c:794 [inline]
 write_ports+0x850/0x9f0 fs/nfsd/nfsctl.c:847
 nfsctl_transaction_write+0x114/0x164 fs/nfsd/nfsctl.c:114
 vfs_write+0x2a8/0x7c8 fs/read_write.c:582
 ksys_write+0x12c/0x228 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:646
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x12c arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: 91026260 97c2d8ed 17ffffc8 97c2d884 (d4210000) 
---[ end trace 0000000000000000 ]---