Extracting prog: 3m42.706223978s Minimizing prog: 42m28.869097909s Simplifying prog options: 0s Extracting C: 1m38.597280546s Simplifying C: 28m46.994557941s extracting reproducer from 30 programs testing a last program of every proc single: executing 5 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-prlimit64-getpid-sched_setscheduler-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setscheduler-ptrace-read$FUSE-getsockopt$inet_IP_XFRM_POLICY-socket$nl_route-sendmsg$nl_route_sched-syz_mount_image$bfs-rt_tgsigqueueinfo-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-sendmsg$NFT_MSG_GETSETELEM detailed listing: executing program 0: syz_mount_image$vfat(&(0x7f0000000240), &(0x7f0000000280)='./file0\x00', 0x8000, &(0x7f0000000740)=ANY=[@ANYBLOB="636865636b3d7374726963742c757466383d312c757466383d312c6e66732c6572726f72733d72656d6f756e742d726f2c73686f72746e616d653d77696e6e742c00043518f9aad8a4f2c1cdb3e993cf0444d9d2d40bb509d4da042c2c85e3650de97db42c38cafa7a9d7503c3c985486cf7fc80515e9bef7e9e56fb346de370b3eb3ecbc59d343c36bf04efc3d68033308b0014b0c677eef7536f8115edae5ef2932cc05f566112668fa4f6844dcf823618a2993da771384e8fc12467a56b33e3b00030dbfd82ea2f8ddbeb1d04bac86815ebe0b9d084d60edf56b15e74589892dce86962f611a4313120b738dddfd38d20b443570197dc795020ecf541601ef9a5618869febf769dd50261849a47e170ba166b97e76a0261d0dc1fb3e2646595f1c8b49057d94f10f7b5e35ead0a38", @ANYBLOB="5490f41e89db5c6987bb89944e3ce8a9d74aa557beeb12bf7bf4a19bec956b719f048f1e043475577b7adb3114dbb00a614a03808dfe14f5f5c2dd1b71c4d5a6a09435057b932b0b", @ANYRESHEX], 0x3, 0x240, &(0x7f0000000500)="$eJzs2s9rHGUYB/Bn0tbGlHQj/qIF8UUP6mVocvbQIC2IAUW7QhWkUzPRZcfdsLMsrIjJqV79EzyLR2+C9OglF/8CD14klxx7EEe6u5pG4iGI3ZJ+Ppd94N0vzzPMy8t7mP3Xv/6su1XnW8UwFrIsFq7GbtzLYiUW4i+78dorN3964b2bH7y1vrFx7d2Urq/fWF1LKV188ccPv/jupbvDC+9/f/GH87G38tH+wdqve8/tXdr/48annTp16tTrD1ORbvf7w+J2VabNTt3NU3qnKou6TJ1eXQ6OrG9V/e3tcSp6m8tL24OyrlPRG6duOU7DfhoOxqn4pOj0Up7naXkp+C/a395rmjhozt2Kpmme/CYu3I3lX6IV2VMpe/pq9uyt7Pnd7NJB07TmPSr/C+//8fbAob4YUX01ao/a09/p+vpWdKKKMq5EK36P+9tkZlpff3Pj2pU0sRJ3qp1ZfmfUPnM0vxqtWDk+vzrNp7hT/fbEtO3OqH0+liLORczya9GKZ47Prx3mJ/3PTPovxqsvP9A/j1b8/HH0o4rNuJ89zH+5mtIbb2+ko/NfnvwPAOC0ydPfjr2/5fm/rU/zJ7gf/uN+dTYun53vsxNRjz/vFlVVDhRVOVh8NMY4DUVENtlg2WyjzXsexQmLuR5LPCSHL33ekwAAAAAAAAAAAHASD+Nzwnk/IwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8Gj7MwAA//+3Ycw+") r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@ipv6_newaddr={0x34, 0x14, 0x119, 0x70bd26, 0x25dfdbf4, {0xa, 0x40, 0x19, 0xfe, r1}, [@IFA_ADDRESS={0x14, 0x1, @loopback}, @IFA_FLAGS={0x8, 0x8, 0x121}]}, 0x34}, 0x1, 0x0, 0x0, 0x4c051}, 0x8004) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ptrace(0x10, 0x1) read$FUSE(0xffffffffffffffff, &(0x7f0000000480)={0x2020}, 0x2020) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000024c0)={{{@in=@dev, @in=@remote}}, {{@in=@initdev}, 0x0, @in=@dev}}, &(0x7f0000002940)=0xe8) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=@gettaction={0x3c, 0x32, 0x301, 0x0, 0x0, {}, [@action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8}, @action_gd=@TCA_ACT_TAB={0x3, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}]}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc}]}, 0x3c}}, 0x0) syz_mount_image$bfs(&(0x7f0000000140), &(0x7f0000000180)='./export\x00', 0x0, &(0x7f00000001c0), 0x0, 0x8a, &(0x7f0000000740)="$eJzszqENAkEUBNDhDKhrAEEH1wOlECQ4FISEimiFEugAgcUcYsGsxCy5vJf8n0zGzO11XaZPxksyVg7H026zLz9MUpdknmSRZNWX/FiXbvbp78/z9nut9wIAAL/rMtR5aDYGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4A+9AwAA///rYCNS") rt_tgsigqueueinfo(0x0, 0x0, 0x1e, &(0x7f0000000300)={0x35, 0x7f, 0x101}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x40008d0}, 0x40) sendmsg$NFT_MSG_GETSETELEM(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001040)=ANY=[@ANYBLOB="440000000d0a010800000000000000000a0000010900020073797a31000000000900010073797a3100000000180003801400f67f080003400000000208000a8004000100"], 0x44}, 0x1, 0x0, 0x0, 0x4004815}, 0x8000) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$vimc0-ioctl$BTRFS_IOC_START_SYNC-ioctl$BTRFS_IOC_START_SYNC-socket$kcm-prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setscheduler-sendmsg$kcm-socket$packet-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL-syz_pidfd_open-socket$inet-ioctl$OCFS2_IOC_GROUP_ADD-ioctl$sock_SIOCGIFINDEX-sendmsg$FOU_CMD_ADD-socket-bind$netlink-sendmsg$nl_route_sched-getsockname$packet-openat$mice-writev-sendmsg$nl_route detailed listing: executing program 0: r0 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f00000001c0)=0x0) ioctl$BTRFS_IOC_START_SYNC(0xffffffffffffffff, 0x80089418, &(0x7f0000000340)=0x0) r3 = socket$kcm(0x21, 0x2, 0xa) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$kcm(r3, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x0, 0x4, @mcast1, 0x8000000}}, 0x80, 0x0, 0x0, &(0x7f0000001300)=[{0x18, 0x110, 0x1, '\x00'}, {0x10, 0x110, 0xb}], 0x28}, 0xfc40) socket$packet(0x11, 0x2, 0x300) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f0000000380)={"d6b40bea0b2e3c4332c59500f246e73a", r1, r2, {0x8000000000000001, 0x401}, {0xffff, 0xe2}, 0x101, [0xffffffff, 0x80, 0x8, 0x1, 0x6, 0x8, 0xc, 0x9fa, 0x3, 0x0, 0x2, 0x1, 0x8000, 0xfffffffffffff000, 0xfff, 0x2]}) syz_pidfd_open(0x0, 0x0) r7 = socket$inet(0x10, 0x3, 0x0) ioctl$OCFS2_IOC_GROUP_ADD(r7, 0x40186f02, &(0x7f00000000c0)={0x800, 0x2, 0xd2}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, 0x0, 0x0) r9 = socket(0x10, 0x803, 0x0) bind$netlink(r9, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000c80)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000c40)={&(0x7f0000000780)=@newtfilter={0x4b8, 0x2c, 0x10, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, r8, {0x10, 0xfff3}, {0xfff3, 0xffe0}, {0x15, 0xfff3}}, [@filter_kind_options=@f_fw={{0x7}, {0x47c, 0x2, [@TCA_FW_CLASSID={0x8, 0x1, {0x3c0b6f1f2b34134, 0xfff1}}, @TCA_FW_INDEV={0x14, 0x3, 'ip6gretap0\x00'}, @TCA_FW_POLICE={0x45c, 0x2, [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x100}, @TCA_POLICE_TBF={0x3c, 0x1, {0x1aa80000, 0x0, 0x3, 0x4, 0x7, {0x6, 0x1, 0x6, 0x8, 0x9, 0x3}, {0x2, 0x1, 0xfe01, 0x1, 0x5, 0x3}, 0x1, 0x7, 0x1}}, @TCA_POLICE_RATE64={0xc, 0x8, 0xffff}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3ff, 0x1, 0xaa3, 0x7, 0x44, 0x45, 0xcb, 0x80000001, 0x1, 0x1000, 0x4, 0x4, 0x80000001, 0xfffffff7, 0xfff, 0x6, 0x0, 0x80, 0x9, 0x0, 0x6, 0xef, 0x400, 0x4, 0xffbf, 0x11ca18bb, 0x2, 0x7, 0x0, 0x16, 0x8, 0x4, 0xe, 0x5, 0x7, 0x61, 0x10001, 0x6, 0xbdd, 0x81, 0x2, 0x1, 0x4, 0x1, 0x7, 0xc12, 0x9, 0x0, 0x200, 0x2, 0x6eb, 0x5, 0x9, 0x3, 0x40, 0x4, 0x799, 0x0, 0xa1, 0xc22, 0x5, 0x7, 0x5, 0x0, 0x960, 0xfffffffd, 0x1ff, 0x5, 0x9, 0x6, 0xb74, 0x9, 0x1f1f40dc, 0x9, 0x9, 0x3ff, 0x80, 0xd000000, 0x5, 0x1, 0x5, 0x9, 0x0, 0xfff, 0xfffffffa, 0x405, 0xa, 0x6, 0x9, 0x6, 0x2, 0x2, 0x88, 0x30, 0xfff, 0x9, 0x80000001, 0x1, 0x3, 0x9, 0x8, 0x1, 0x4, 0x7, 0x9, 0x3ff, 0x6, 0x8, 0x9, 0x5, 0x2, 0x7, 0x3, 0x9, 0xffff, 0x0, 0x8452, 0x7, 0x4, 0x8001, 0x0, 0xe42, 0x7fffffff, 0x7, 0x7, 0x635, 0x8, 0x5, 0x0, 0x6, 0x5, 0x2, 0x5, 0xd7, 0x5, 0xd, 0xf1, 0x80, 0x7, 0x2, 0x0, 0x759, 0x2, 0x40, 0x39e, 0xe, 0x7, 0x9, 0x9, 0x100, 0x6, 0x2, 0x80000001, 0x8, 0x7, 0x2, 0x13c19eef, 0x1, 0x5, 0x3, 0xfffffffd, 0xffffff01, 0x0, 0x401, 0x5, 0x7fff, 0x8, 0x6, 0x3, 0x9, 0x1, 0x3, 0x3a5d, 0x90, 0x0, 0x3, 0x9, 0x8, 0xb8000000, 0xc5b, 0x2, 0x1, 0x0, 0x400, 0x4, 0x0, 0x7ff, 0x4, 0x6, 0x400, 0x6, 0x0, 0xa36e, 0x200, 0x728c, 0x3, 0x0, 0x10, 0xfffffff8, 0x2, 0xffffff00, 0xff, 0x7, 0x2, 0x8, 0x5, 0x3, 0x6c, 0x0, 0x1, 0x7ff, 0x6, 0x400, 0x7, 0x3e, 0x80000000, 0xfffffffb, 0x7ff, 0x80, 0x10, 0xffffffff, 0x5, 0x2, 0x200, 0x3e394994, 0x1, 0x0, 0x7, 0x3, 0x7313, 0x100, 0xb, 0x4, 0x9, 0x6, 0xfffffffa, 0x8, 0xc, 0x0, 0x7fff, 0x7fff, 0x1a8, 0x0, 0x0, 0x2, 0x4, 0x4, 0x200, 0xd, 0x7, 0x77, 0x3, 0x2, 0x5366799e, 0x7ff, 0xff]}]}]}}, @TCA_RATE={0x6, 0x5, {0x4, 0x9}}, @TCA_RATE={0x6, 0x5, {0x9, 0x2}}]}, 0x4b8}, 0x1, 0x0, 0x0, 0x20000004}, 0x4008001) getsockname$packet(r9, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) r11 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x80082) writev(r11, &(0x7f0000000740)=[{&(0x7f0000000200)='n', 0x1}, {0x0, 0x57}], 0x2) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r10, 0x1}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x4}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40040}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$loop-fcntl$setstatus-openat$sysfs-ioctl$LOOP_CONFIGURE-socket$nl_netfilter-pwritev-fsopen-fsconfig$FSCONFIG_SET_STRING-fsconfig$FSCONFIG_CMD_CREATE-mkdirat-mount-openat-write-openat-socket$packet-unshare-setsockopt$packet_fanout-setsockopt$packet_fanout_data-write-setxattr detailed listing: executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x160862) fcntl$setstatus(r0, 0x4, 0x10000) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x1000, {0x0, 0x0, 0x0, 0x8, 0x4000000000000bfd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce8, 0xe]}}) socket$nl_netfilter(0x10, 0x3, 0xc) pwritev(r0, &(0x7f0000000a80)=[{&(0x7f0000000500)='\r', 0x1}], 0x1, 0x1, 0x9) r2 = fsopen(&(0x7f0000000280)='pvfs2\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f00000001c0)='3\n\x00', 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) unshare(0x22020600) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r5, 0x107, 0x16, 0x0, 0x0) write(r4, &(0x7f0000000240)='1\n\x00', 0x2) setxattr(&(0x7f00000002c0)='./nfsd/portlist\x00', &(0x7f0000000300)=@random={'osx.', '\x00'}, &(0x7f0000000340)='\xd0\x00', 0x2, 0x1) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads single: successfully extracted reproducer found reproducer with 20 syscalls minimizing guilty program testing program (duration=46.983103173s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$loop-fcntl$setstatus-openat$sysfs-ioctl$LOOP_CONFIGURE-socket$nl_netfilter-pwritev-fsopen-fsconfig$FSCONFIG_SET_STRING-fsconfig$FSCONFIG_CMD_CREATE-mkdirat-mount-openat-write-openat-socket$packet-unshare-setsockopt$packet_fanout-setsockopt$packet_fanout_data-write detailed listing: executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x160862) fcntl$setstatus(r0, 0x4, 0x10000) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x1000, {0x0, 0x0, 0x0, 0x8, 0x4000000000000bfd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce8, 0xe]}}) socket$nl_netfilter(0x10, 0x3, 0xc) pwritev(r0, &(0x7f0000000a80)=[{&(0x7f0000000500)='\r', 0x1}], 0x1, 0x1, 0x9) r2 = fsopen(&(0x7f0000000280)='pvfs2\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f00000001c0)='3\n\x00', 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) unshare(0x22020600) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r5, 0x107, 0x16, 0x0, 0x0) write(r4, &(0x7f0000000240)='1\n\x00', 0x2) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing program (duration=46.983103173s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$loop-fcntl$setstatus-openat$sysfs-ioctl$LOOP_CONFIGURE-socket$nl_netfilter-pwritev-fsopen-fsconfig$FSCONFIG_SET_STRING-fsconfig$FSCONFIG_CMD_CREATE-mkdirat-mount-openat-write-openat-socket$packet-unshare-setsockopt$packet_fanout-setsockopt$packet_fanout_data detailed listing: executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x160862) fcntl$setstatus(r0, 0x4, 0x10000) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x1000, {0x0, 0x0, 0x0, 0x8, 0x4000000000000bfd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce8, 0xe]}}) socket$nl_netfilter(0x10, 0x3, 0xc) pwritev(r0, &(0x7f0000000a80)=[{&(0x7f0000000500)='\r', 0x1}], 0x1, 0x1, 0x9) r2 = fsopen(&(0x7f0000000280)='pvfs2\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f00000001c0)='3\n\x00', 0x2) openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) unshare(0x22020600) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r4, 0x107, 0x16, 0x0, 0x0) program did not crash testing program (duration=46.983103173s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$loop-fcntl$setstatus-openat$sysfs-ioctl$LOOP_CONFIGURE-socket$nl_netfilter-pwritev-fsopen-fsconfig$FSCONFIG_SET_STRING-fsconfig$FSCONFIG_CMD_CREATE-mkdirat-mount-openat-write-openat-socket$packet-unshare-setsockopt$packet_fanout-write detailed listing: executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x160862) fcntl$setstatus(r0, 0x4, 0x10000) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x1000, {0x0, 0x0, 0x0, 0x8, 0x4000000000000bfd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce8, 0xe]}}) socket$nl_netfilter(0x10, 0x3, 0xc) pwritev(r0, &(0x7f0000000a80)=[{&(0x7f0000000500)='\r', 0x1}], 0x1, 0x1, 0x9) r2 = fsopen(&(0x7f0000000280)='pvfs2\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f00000001c0)='3\n\x00', 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) unshare(0x22020600) setsockopt$packet_fanout(r5, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) write(r4, &(0x7f0000000240)='1\n\x00', 0x2) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing program (duration=46.983103173s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$loop-fcntl$setstatus-openat$sysfs-ioctl$LOOP_CONFIGURE-socket$nl_netfilter-pwritev-fsopen-fsconfig$FSCONFIG_SET_STRING-fsconfig$FSCONFIG_CMD_CREATE-mkdirat-mount-openat-write-openat-socket$packet-unshare-write detailed listing: executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x160862) fcntl$setstatus(r0, 0x4, 0x10000) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x1000, {0x0, 0x0, 0x0, 0x8, 0x4000000000000bfd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce8, 0xe]}}) socket$nl_netfilter(0x10, 0x3, 0xc) pwritev(r0, &(0x7f0000000a80)=[{&(0x7f0000000500)='\r', 0x1}], 0x1, 0x1, 0x9) r2 = fsopen(&(0x7f0000000280)='pvfs2\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f00000001c0)='3\n\x00', 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) unshare(0x22020600) write(r4, &(0x7f0000000240)='1\n\x00', 0x2) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing program (duration=46.983103173s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$loop-fcntl$setstatus-openat$sysfs-ioctl$LOOP_CONFIGURE-socket$nl_netfilter-pwritev-fsopen-fsconfig$FSCONFIG_SET_STRING-fsconfig$FSCONFIG_CMD_CREATE-mkdirat-mount-openat-write-openat-socket$packet-write detailed listing: executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x160862) fcntl$setstatus(r0, 0x4, 0x10000) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x1000, {0x0, 0x0, 0x0, 0x8, 0x4000000000000bfd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce8, 0xe]}}) socket$nl_netfilter(0x10, 0x3, 0xc) pwritev(r0, &(0x7f0000000a80)=[{&(0x7f0000000500)='\r', 0x1}], 0x1, 0x1, 0x9) r2 = fsopen(&(0x7f0000000280)='pvfs2\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f00000001c0)='3\n\x00', 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) write(r4, &(0x7f0000000240)='1\n\x00', 0x2) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing program (duration=46.983103173s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$loop-fcntl$setstatus-openat$sysfs-ioctl$LOOP_CONFIGURE-socket$nl_netfilter-pwritev-fsopen-fsconfig$FSCONFIG_SET_STRING-fsconfig$FSCONFIG_CMD_CREATE-mkdirat-mount-openat-write-openat-write detailed listing: executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x160862) fcntl$setstatus(r0, 0x4, 0x10000) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x1000, {0x0, 0x0, 0x0, 0x8, 0x4000000000000bfd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce8, 0xe]}}) socket$nl_netfilter(0x10, 0x3, 0xc) pwritev(r0, &(0x7f0000000a80)=[{&(0x7f0000000500)='\r', 0x1}], 0x1, 0x1, 0x9) r2 = fsopen(&(0x7f0000000280)='pvfs2\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f00000001c0)='3\n\x00', 0x2) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r4, &(0x7f0000000240)='1\n\x00', 0x2) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing program (duration=46.983103173s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$loop-fcntl$setstatus-openat$sysfs-ioctl$LOOP_CONFIGURE-socket$nl_netfilter-pwritev-fsopen-fsconfig$FSCONFIG_SET_STRING-fsconfig$FSCONFIG_CMD_CREATE-mkdirat-mount-openat-write-write detailed listing: executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x160862) fcntl$setstatus(r0, 0x4, 0x10000) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x1000, {0x0, 0x0, 0x0, 0x8, 0x4000000000000bfd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce8, 0xe]}}) socket$nl_netfilter(0x10, 0x3, 0xc) pwritev(r0, &(0x7f0000000a80)=[{&(0x7f0000000500)='\r', 0x1}], 0x1, 0x1, 0x9) r2 = fsopen(&(0x7f0000000280)='pvfs2\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x2, 0x0) write(r3, &(0x7f00000001c0)='3\n\x00', 0x2) write(0xffffffffffffffff, &(0x7f0000000240)='1\n\x00', 0x2) program did not crash testing program (duration=46.983103173s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$loop-fcntl$setstatus-openat$sysfs-ioctl$LOOP_CONFIGURE-socket$nl_netfilter-pwritev-fsopen-fsconfig$FSCONFIG_SET_STRING-fsconfig$FSCONFIG_CMD_CREATE-mkdirat-mount-openat-openat-write detailed listing: executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x160862) fcntl$setstatus(r0, 0x4, 0x10000) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x1000, {0x0, 0x0, 0x0, 0x8, 0x4000000000000bfd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce8, 0xe]}}) socket$nl_netfilter(0x10, 0x3, 0xc) pwritev(r0, &(0x7f0000000a80)=[{&(0x7f0000000500)='\r', 0x1}], 0x1, 0x1, 0x9) r2 = fsopen(&(0x7f0000000280)='pvfs2\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r3, &(0x7f0000000240)='1\n\x00', 0x2) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing program (duration=46.983103173s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$loop-fcntl$setstatus-openat$sysfs-ioctl$LOOP_CONFIGURE-socket$nl_netfilter-pwritev-fsopen-fsconfig$FSCONFIG_SET_STRING-fsconfig$FSCONFIG_CMD_CREATE-mkdirat-mount-openat-write detailed listing: executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x160862) fcntl$setstatus(r0, 0x4, 0x10000) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x1000, {0x0, 0x0, 0x0, 0x8, 0x4000000000000bfd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce8, 0xe]}}) socket$nl_netfilter(0x10, 0x3, 0xc) pwritev(r0, &(0x7f0000000a80)=[{&(0x7f0000000500)='\r', 0x1}], 0x1, 0x1, 0x9) r2 = fsopen(&(0x7f0000000280)='pvfs2\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r3, &(0x7f0000000240)='1\n\x00', 0x2) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing program (duration=46.983103173s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$loop-fcntl$setstatus-openat$sysfs-ioctl$LOOP_CONFIGURE-socket$nl_netfilter-pwritev-fsopen-fsconfig$FSCONFIG_SET_STRING-fsconfig$FSCONFIG_CMD_CREATE-mkdirat-openat-write detailed listing: executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x160862) fcntl$setstatus(r0, 0x4, 0x10000) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x1000, {0x0, 0x0, 0x0, 0x8, 0x4000000000000bfd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce8, 0xe]}}) socket$nl_netfilter(0x10, 0x3, 0xc) pwritev(r0, &(0x7f0000000a80)=[{&(0x7f0000000500)='\r', 0x1}], 0x1, 0x1, 0x9) r2 = fsopen(&(0x7f0000000280)='pvfs2\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r3, &(0x7f0000000240)='1\n\x00', 0x2) program did not crash testing program (duration=46.983103173s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$loop-fcntl$setstatus-openat$sysfs-ioctl$LOOP_CONFIGURE-socket$nl_netfilter-pwritev-fsopen-fsconfig$FSCONFIG_SET_STRING-fsconfig$FSCONFIG_CMD_CREATE-mount-openat-write detailed listing: executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x160862) fcntl$setstatus(r0, 0x4, 0x10000) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x1000, {0x0, 0x0, 0x0, 0x8, 0x4000000000000bfd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce8, 0xe]}}) socket$nl_netfilter(0x10, 0x3, 0xc) pwritev(r0, &(0x7f0000000a80)=[{&(0x7f0000000500)='\r', 0x1}], 0x1, 0x1, 0x9) r2 = fsopen(&(0x7f0000000280)='pvfs2\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r3, &(0x7f0000000240)='1\n\x00', 0x2) program did not crash testing program (duration=46.983103173s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$loop-fcntl$setstatus-openat$sysfs-ioctl$LOOP_CONFIGURE-socket$nl_netfilter-pwritev-fsopen-fsconfig$FSCONFIG_SET_STRING-mkdirat-mount-openat-write detailed listing: executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x160862) fcntl$setstatus(r0, 0x4, 0x10000) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x1000, {0x0, 0x0, 0x0, 0x8, 0x4000000000000bfd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce8, 0xe]}}) socket$nl_netfilter(0x10, 0x3, 0xc) pwritev(r0, &(0x7f0000000a80)=[{&(0x7f0000000500)='\r', 0x1}], 0x1, 0x1, 0x9) r2 = fsopen(&(0x7f0000000280)='pvfs2\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r3, &(0x7f0000000240)='1\n\x00', 0x2) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing program (duration=46.983103173s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$loop-fcntl$setstatus-openat$sysfs-ioctl$LOOP_CONFIGURE-socket$nl_netfilter-pwritev-fsopen-mkdirat-mount-openat-write detailed listing: executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x160862) fcntl$setstatus(r0, 0x4, 0x10000) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x1000, {0x0, 0x0, 0x0, 0x8, 0x4000000000000bfd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce8, 0xe]}}) socket$nl_netfilter(0x10, 0x3, 0xc) pwritev(r0, &(0x7f0000000a80)=[{&(0x7f0000000500)='\r', 0x1}], 0x1, 0x1, 0x9) fsopen(&(0x7f0000000280)='pvfs2\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f0000000240)='1\n\x00', 0x2) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing program (duration=46.983103173s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$loop-fcntl$setstatus-openat$sysfs-ioctl$LOOP_CONFIGURE-socket$nl_netfilter-pwritev-mkdirat-mount-openat-write detailed listing: executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x160862) fcntl$setstatus(r0, 0x4, 0x10000) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x1000, {0x0, 0x0, 0x0, 0x8, 0x4000000000000bfd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce8, 0xe]}}) socket$nl_netfilter(0x10, 0x3, 0xc) pwritev(r0, &(0x7f0000000a80)=[{&(0x7f0000000500)='\r', 0x1}], 0x1, 0x1, 0x9) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f0000000240)='1\n\x00', 0x2) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing program (duration=46.983103173s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$loop-fcntl$setstatus-openat$sysfs-ioctl$LOOP_CONFIGURE-socket$nl_netfilter-mkdirat-mount-openat-write detailed listing: executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x160862) fcntl$setstatus(r0, 0x4, 0x10000) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x1000, {0x0, 0x0, 0x0, 0x8, 0x4000000000000bfd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce8, 0xe]}}) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f0000000240)='1\n\x00', 0x2) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing program (duration=46.983103173s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$loop-fcntl$setstatus-openat$sysfs-ioctl$LOOP_CONFIGURE-mkdirat-mount-openat-write detailed listing: executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x160862) fcntl$setstatus(r0, 0x4, 0x10000) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x1000, {0x0, 0x0, 0x0, 0x8, 0x4000000000000bfd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce8, 0xe]}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f0000000240)='1\n\x00', 0x2) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing program (duration=46.983103173s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$loop-fcntl$setstatus-openat$sysfs-mkdirat-mount-openat-write detailed listing: executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x160862) fcntl$setstatus(r0, 0x4, 0x10000) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r1, &(0x7f0000000240)='1\n\x00', 0x2) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing program (duration=46.983103173s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$loop-fcntl$setstatus-mkdirat-mount-openat-write detailed listing: executing program 0: r0 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x160862) fcntl$setstatus(r0, 0x4, 0x10000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r1, &(0x7f0000000240)='1\n\x00', 0x2) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing program (duration=46.983103173s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$loop-mkdirat-mount-openat-write detailed listing: executing program 0: syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x160862) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f0000000240)='1\n\x00', 0x2) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing program (duration=46.983103173s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f0000000240)='1\n\x00', 0x2) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing program (duration=46.983103173s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f0000000240)='1\n\x00', 0x2) program did not crash testing program (duration=46.983103173s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, 0x0, &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f0000000240)='1\n\x00', 0x2) program did not crash testing program (duration=46.983103173s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f0000000240)='1\n\x00', 0x2) program did not crash testing program (duration=46.983103173s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f0000000240)='1\n\x00', 0x2) program did not crash testing program (duration=46.983103173s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r0, 0x0, 0x0) program did not crash testing program (duration=46.983103173s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f0000000240), 0x0) program did not crash extracting C reproducer testing compiled C program (duration=46.983103173s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads simplifying C reproducer testing compiled C program (duration=46.983103173s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing compiled C program (duration=46.983103173s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing compiled C program (duration=46.983103173s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program did not crash testing compiled C program (duration=46.983103173s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing compiled C program (duration=46.983103173s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing compiled C program (duration=46.983103173s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing compiled C program (duration=46.983103173s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write testing compiled C program (duration=46.983103173s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing compiled C program (duration=46.983103173s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing compiled C program (duration=46.983103173s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing compiled C program (duration=46.983103173s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing compiled C program (duration=46.983103173s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing compiled C program (duration=46.983103173s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing compiled C program (duration=46.983103173s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing compiled C program (duration=46.983103173s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing compiled C program (duration=46.983103173s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads testing program (duration=46.983103173s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f0000000240)='1\n\x00', 0x2) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads validation run: crashed=true testing program (duration=46.983103173s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f0000000240)='1\n\x00', 0x2) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads validation run: crashed=true testing program (duration=46.983103173s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/threads\x00', 0x2, 0x0) write(r0, &(0x7f0000000240)='1\n\x00', 0x2) program crashed: KASAN: use-after-free Write in nfsd_shutdown_threads validation run: crashed=true reproducing took 1h21m40.370710101s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: use-after-free in atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:111 [inline] BUG: KASAN: use-after-free in __refcount_add include/linux/refcount.h:193 [inline] BUG: KASAN: use-after-free in __refcount_inc include/linux/refcount.h:250 [inline] BUG: KASAN: use-after-free in refcount_inc include/linux/refcount.h:267 [inline] BUG: KASAN: use-after-free in kref_get include/linux/kref.h:45 [inline] BUG: KASAN: use-after-free in svc_get include/linux/sunrpc/svc.h:108 [inline] BUG: KASAN: use-after-free in nfsd_shutdown_threads+0x89/0x1a0 fs/nfsd/nfssvc.c:641 Write of size 4 at addr ffff888024ea4450 by task syz-executor/4300 CPU: 1 PID: 4300 Comm: syz-executor Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 print_address_description+0x60/0x2d0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report+0xdf/0x130 mm/kasan/report.c:451 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x235/0x290 mm/kasan/generic.c:189 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:111 [inline] __refcount_add include/linux/refcount.h:193 [inline] __refcount_inc include/linux/refcount.h:250 [inline] refcount_inc include/linux/refcount.h:267 [inline] kref_get include/linux/kref.h:45 [inline] svc_get include/linux/sunrpc/svc.h:108 [inline] nfsd_shutdown_threads+0x89/0x1a0 fs/nfsd/nfssvc.c:641 nfsd_umount+0x3e/0xc0 fs/nfsd/nfsctl.c:1411 deactivate_locked_super+0x93/0xf0 fs/super.c:335 cleanup_mnt+0x426/0x4d0 fs/namespace.c:1148 task_work_run+0x125/0x1a0 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:181 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fbfa8f47317 Code: a2 c7 05 dc 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffe41338618 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 00007fbfa8fdc474 RCX: 00007fbfa8f47317 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe413386d0 RBP: 00007ffe413386d0 R08: 00007ffe413396d0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe41339760 R13: 00007fbfa8fdc474 R14: 00000000000126f8 R15: 00007ffe413397a0 Allocated by task 4317: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] ____kasan_kmalloc mm/kasan/common.c:513 [inline] __kasan_kmalloc+0xaf/0xe0 mm/kasan/common.c:522 kmalloc include/linux/slab.h:607 [inline] kzalloc include/linux/slab.h:738 [inline] __svc_create+0x60/0x9d0 net/sunrpc/svc.c:458 svc_create_pooled+0x62f/0x810 net/sunrpc/svc.c:546 nfsd_create_serv+0x2f9/0x700 fs/nfsd/nfssvc.c:668 nfsd_svc+0x132/0x9e0 fs/nfsd/nfssvc.c:798 write_threads+0x2ea/0x350 fs/nfsd/nfsctl.c:426 nfsctl_transaction_write+0x105/0x150 fs/nfsd/nfsctl.c:114 vfs_write+0x304/0xd70 fs/read_write.c:592 ksys_write+0x153/0x260 fs/read_write.c:647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 Freed by task 4317: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:46 kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360 ____kasan_slab_free+0xd5/0x110 mm/kasan/common.c:366 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:1710 [inline] slab_free_freelist_hook+0xec/0x170 mm/slub.c:1736 slab_free mm/slub.c:3504 [inline] kfree+0xef/0x2a0 mm/slub.c:4564 kref_put include/linux/kref.h:65 [inline] svc_put include/linux/sunrpc/svc.h:123 [inline] nfsd_svc+0x7cf/0x9e0 fs/nfsd/nfssvc.c:821 write_threads+0x2ea/0x350 fs/nfsd/nfsctl.c:426 nfsctl_transaction_write+0x105/0x150 fs/nfsd/nfsctl.c:114 vfs_write+0x304/0xd70 fs/read_write.c:592 ksys_write+0x153/0x260 fs/read_write.c:647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 The buggy address belongs to the object at ffff888024ea4400 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 80 bytes inside of 512-byte region [ffff888024ea4400, ffff888024ea4600) The buggy address belongs to the page: page:ffffea000093a900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x24ea4 head:ffffea000093a900 order:2 compound_mapcount:0 compound_pincount:0 flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888016c41c80 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, ts 11870806429, free_ts 0 prep_new_page mm/page_alloc.c:2426 [inline] get_page_from_freelist+0x24f6/0x2670 mm/page_alloc.c:4192 __alloc_pages+0x1ee/0x480 mm/page_alloc.c:5501 alloc_page_interleave+0x24/0x1e0 mm/mempolicy.c:2031 alloc_slab_page mm/slub.c:1780 [inline] allocate_slab mm/slub.c:1917 [inline] new_slab+0xc0/0x4b0 mm/slub.c:1980 ___slab_alloc+0x807/0xdd0 mm/slub.c:3013 __slab_alloc mm/slub.c:3100 [inline] slab_alloc_node mm/slub.c:3191 [inline] slab_alloc mm/slub.c:3233 [inline] kmem_cache_alloc_trace+0xf9/0x290 mm/slub.c:3250 kmalloc include/linux/slab.h:607 [inline] kzalloc include/linux/slab.h:738 [inline] device_private_init drivers/base/core.c:3256 [inline] device_add+0xb2/0x1050 drivers/base/core.c:3306 platform_device_add+0x4bf/0x830 drivers/base/platform.c:712 init+0xc26/0x1170 drivers/usb/gadget/udc/dummy_hcd.c:2878 do_one_initcall+0x272/0x730 init/main.c:1315 do_initcall_level+0x13d/0x1f0 init/main.c:1388 do_initcalls+0x4b/0x90 init/main.c:1404 kernel_init_freeable+0x3d5/0x560 init/main.c:1628 kernel_init+0x19/0x1b0 init/main.c:1519 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 page_owner free stack trace missing Memory state around the buggy address: ffff888024ea4300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888024ea4380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888024ea4400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888024ea4480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888024ea4500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: use-after-free in atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:111 [inline] BUG: KASAN: use-after-free in __refcount_add include/linux/refcount.h:193 [inline] BUG: KASAN: use-after-free in __refcount_inc include/linux/refcount.h:250 [inline] BUG: KASAN: use-after-free in refcount_inc include/linux/refcount.h:267 [inline] BUG: KASAN: use-after-free in kref_get include/linux/kref.h:45 [inline] BUG: KASAN: use-after-free in svc_get include/linux/sunrpc/svc.h:108 [inline] BUG: KASAN: use-after-free in nfsd_shutdown_threads+0x89/0x1a0 fs/nfsd/nfssvc.c:641 Write of size 4 at addr ffff888024ea4450 by task syz-executor/4300 CPU: 1 PID: 4300 Comm: syz-executor Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 print_address_description+0x60/0x2d0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report+0xdf/0x130 mm/kasan/report.c:451 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x235/0x290 mm/kasan/generic.c:189 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:111 [inline] __refcount_add include/linux/refcount.h:193 [inline] __refcount_inc include/linux/refcount.h:250 [inline] refcount_inc include/linux/refcount.h:267 [inline] kref_get include/linux/kref.h:45 [inline] svc_get include/linux/sunrpc/svc.h:108 [inline] nfsd_shutdown_threads+0x89/0x1a0 fs/nfsd/nfssvc.c:641 nfsd_umount+0x3e/0xc0 fs/nfsd/nfsctl.c:1411 deactivate_locked_super+0x93/0xf0 fs/super.c:335 cleanup_mnt+0x426/0x4d0 fs/namespace.c:1148 task_work_run+0x125/0x1a0 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:181 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fbfa8f47317 Code: a2 c7 05 dc 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007ffe41338618 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 00007fbfa8fdc474 RCX: 00007fbfa8f47317 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe413386d0 RBP: 00007ffe413386d0 R08: 00007ffe413396d0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe41339760 R13: 00007fbfa8fdc474 R14: 00000000000126f8 R15: 00007ffe413397a0 Allocated by task 4317: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] ____kasan_kmalloc mm/kasan/common.c:513 [inline] __kasan_kmalloc+0xaf/0xe0 mm/kasan/common.c:522 kmalloc include/linux/slab.h:607 [inline] kzalloc include/linux/slab.h:738 [inline] __svc_create+0x60/0x9d0 net/sunrpc/svc.c:458 svc_create_pooled+0x62f/0x810 net/sunrpc/svc.c:546 nfsd_create_serv+0x2f9/0x700 fs/nfsd/nfssvc.c:668 nfsd_svc+0x132/0x9e0 fs/nfsd/nfssvc.c:798 write_threads+0x2ea/0x350 fs/nfsd/nfsctl.c:426 nfsctl_transaction_write+0x105/0x150 fs/nfsd/nfsctl.c:114 vfs_write+0x304/0xd70 fs/read_write.c:592 ksys_write+0x153/0x260 fs/read_write.c:647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 Freed by task 4317: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:46 kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360 ____kasan_slab_free+0xd5/0x110 mm/kasan/common.c:366 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:1710 [inline] slab_free_freelist_hook+0xec/0x170 mm/slub.c:1736 slab_free mm/slub.c:3504 [inline] kfree+0xef/0x2a0 mm/slub.c:4564 kref_put include/linux/kref.h:65 [inline] svc_put include/linux/sunrpc/svc.h:123 [inline] nfsd_svc+0x7cf/0x9e0 fs/nfsd/nfssvc.c:821 write_threads+0x2ea/0x350 fs/nfsd/nfsctl.c:426 nfsctl_transaction_write+0x105/0x150 fs/nfsd/nfsctl.c:114 vfs_write+0x304/0xd70 fs/read_write.c:592 ksys_write+0x153/0x260 fs/read_write.c:647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 The buggy address belongs to the object at ffff888024ea4400 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 80 bytes inside of 512-byte region [ffff888024ea4400, ffff888024ea4600) The buggy address belongs to the page: page:ffffea000093a900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x24ea4 head:ffffea000093a900 order:2 compound_mapcount:0 compound_pincount:0 flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888016c41c80 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, ts 11870806429, free_ts 0 prep_new_page mm/page_alloc.c:2426 [inline] get_page_from_freelist+0x24f6/0x2670 mm/page_alloc.c:4192 __alloc_pages+0x1ee/0x480 mm/page_alloc.c:5501 alloc_page_interleave+0x24/0x1e0 mm/mempolicy.c:2031 alloc_slab_page mm/slub.c:1780 [inline] allocate_slab mm/slub.c:1917 [inline] new_slab+0xc0/0x4b0 mm/slub.c:1980 ___slab_alloc+0x807/0xdd0 mm/slub.c:3013 __slab_alloc mm/slub.c:3100 [inline] slab_alloc_node mm/slub.c:3191 [inline] slab_alloc mm/slub.c:3233 [inline] kmem_cache_alloc_trace+0xf9/0x290 mm/slub.c:3250 kmalloc include/linux/slab.h:607 [inline] kzalloc include/linux/slab.h:738 [inline] device_private_init drivers/base/core.c:3256 [inline] device_add+0xb2/0x1050 drivers/base/core.c:3306 platform_device_add+0x4bf/0x830 drivers/base/platform.c:712 init+0xc26/0x1170 drivers/usb/gadget/udc/dummy_hcd.c:2878 do_one_initcall+0x272/0x730 init/main.c:1315 do_initcall_level+0x13d/0x1f0 init/main.c:1388 do_initcalls+0x4b/0x90 init/main.c:1404 kernel_init_freeable+0x3d5/0x560 init/main.c:1628 kernel_init+0x19/0x1b0 init/main.c:1519 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 page_owner free stack trace missing Memory state around the buggy address: ffff888024ea4300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888024ea4380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888024ea4400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888024ea4480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888024ea4500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================