[ 200.629234][ T1330] ieee802154 phy0 wpan0: encryption failed: -22
[ 200.629313][ T1330] ieee802154 phy1 wpan1: encryption failed: -22
Warning: Permanently added '10.128.10.3' (ED25519) to the list of known hosts.
[*] Starting reproducer for KASAN slab-out-of-bounds in nfsd...
[*] /proc/fs/nfsd/versions not accessible, attempting to mount nfsd on /proc/fs/nfsd...
[+] Mounted nfsd on /proc/fs/nfsd successfully.
[+] Current nfsd threads: 0
[+] Successfully configured NFS versions: -2 -3 +4
[+] Created AF_INET SOCK_STREAM socket (fd 3).
[+] Bound socket successfully (unconnected, not listening).
[+] Registered socket fd 3 into /proc/fs/nfsd/portlist successfully.
[ 205.354014][ T5934] NFSD: Unable to initialize client recovery tracking! (-110)
[ 205.354042][ T5934] NFSD: Is nfsdcld running? If not, enable CONFIG_NFSD_LEGACY_CLIENT_TRACKING.
[ 205.354055][ T5934] NFSD: starting 90-second grace period (net effffff9)
[ 205.410334][ T5988] ==================================================================
[ 205.410359][ T5988] BUG: KASAN: slab-out-of-bounds in nfsd+0x118/0xbc0
[ 205.410401][ T5988] Read of size 8 at addr ffff88802d423f50 by task nfsd/5988
[ 205.410421][ T5988]
[ 205.410457][ T5988] CPU: 1 UID: 0 PID: 5988 Comm: nfsd Not tainted syzkaller #0 PREEMPT_{RT,(full)}
[ 205.410485][ T5988] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
[ 205.410510][ T5988] Call Trace:
[ 205.410520][ T5988]
[ 205.410532][ T5988] dump_stack_lvl+0xe8/0x150
[ 205.410571][ T5988] print_address_description+0x55/0x1e0
[ 205.410609][ T5988] ? nfsd+0x118/0xbc0
[ 205.410630][ T5988] print_report+0x58/0x70
[ 205.410662][ T5988] kasan_report+0x117/0x150
[ 205.410691][ T5988] ? nfsd+0x118/0xbc0
[ 205.410717][ T5988] nfsd+0x118/0xbc0
[ 205.410748][ T5988] ? __pfx_nfsd+0x10/0x10
[ 205.410768][ T5988] ? __kthread_parkme+0x71/0x1f0
[ 205.410816][ T5988] ? __kthread_parkme+0x199/0x1f0
[ 205.410854][ T5988] kthread+0x38b/0x470
[ 205.410880][ T5988] ? __pfx_nfsd+0x10/0x10
[ 205.410898][ T5988] ? __pfx_kthread+0x10/0x10
[ 205.410923][ T5988] ret_from_fork+0x514/0xb70
[ 205.410953][ T5988] ? __pfx_ret_from_fork+0x10/0x10
[ 205.410976][ T5988] ? __switch_to+0xc89/0x1420
[ 205.411013][ T5988] ? __pfx_kthread+0x10/0x10
[ 205.411043][ T5988] ret_from_fork_asm+0x1a/0x30
[ 205.411075][ T5988]
[ 205.411083][ T5988]
[ 205.411090][ T5988] Allocated by task 5934:
[ 205.411102][ T5988] kasan_save_track+0x3e/0x80
[ 205.411138][ T5988] __kasan_kmalloc+0x93/0xb0
[ 205.411157][ T5988] __kmalloc_cache_noprof+0x3d5/0x680
[ 205.411193][ T5988] __svc_create+0x63/0xa50
[ 205.411216][ T5988] svc_create_pooled+0x8f/0x470
[ 205.411240][ T5988] nfsd_create_serv+0x55f/0x840
[ 205.411261][ T5988] write_ports+0x6a2/0xd20
[ 205.411286][ T5988] nfsctl_transaction_write+0x112/0x160
[ 205.411313][ T5988] vfs_write+0x29f/0xbb0
[ 205.411339][ T5988] ksys_write+0x156/0x270
[ 205.411365][ T5988] do_syscall_64+0x166/0x520
[ 205.411397][ T5988] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 205.411419][ T5988]
[ 205.411424][ T5988] The buggy address belongs to the object at ffff88802d423c00
[ 205.411424][ T5988] which belongs to the cache kmalloc-512 of size 512
[ 205.411444][ T5988] The buggy address is located 376 bytes to the right of
[ 205.411444][ T5988] allocated 472-byte region [ffff88802d423c00, ffff88802d423dd8)
[ 205.411469][ T5988]
[ 205.411476][ T5988] The buggy address belongs to the physical page:
[ 205.411497][ T5988] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802d422c00 pfn:0x2d420
[ 205.411526][ T5988] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 205.411547][ T5988] flags: 0x80000000000240(workingset|head|node=0|zone=1)
[ 205.411580][ T5988] page_type: f5(slab)
[ 205.411602][ T5988] raw: 0080000000000240 ffff88813ffbec80 ffffea0000ffe510 ffffea0000f5cc10
[ 205.411623][ T5988] raw: ffff88802d422c00 0000000000100004 00000000f5000000 0000000000000000
[ 205.411647][ T5988] head: 0080000000000240 ffff88813ffbec80 ffffea0000ffe510 ffffea0000f5cc10
[ 205.411669][ T5988] head: ffff88802d422c00 0000000000100004 00000000f5000000 0000000000000000
[ 205.411691][ T5988] head: 0080000000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff
[ 205.411712][ T5988] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000004
[ 205.411725][ T5988] page dumped because: kasan: bad access detected
[ 205.411743][ T5988] page_owner tracks the page as allocated
[ 205.411752][ T5988] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5628, tgid 5628 (syz-executor), ts 153551232384
[ 205.411802][ T5988] post_alloc_hook+0x1f9/0x250
[ 205.411835][ T5988] get_page_from_freelist+0x2591/0x2600
[ 205.411858][ T5988] __alloc_frozen_pages_noprof+0x230/0x5c0
[ 205.411880][ T5988] allocate_slab+0x7d/0x620
[ 205.411907][ T5988] refill_objects+0x2d8/0x350
[ 205.411934][ T5988] __pcs_replace_empty_main+0x339/0x690
[ 205.411959][ T5988] __kmalloc_noprof+0x54b/0x790
[ 205.411990][ T5988] ops_init+0x7b/0x5d0
[ 205.412017][ T5988] setup_net+0x118/0x350
[ 205.412040][ T5988] copy_net_ns+0x53b/0x780
[ 205.412063][ T5988] create_new_namespaces+0x3f0/0x6b0
[ 205.412093][ T5988] unshare_nsproxy_namespaces+0x149/0x190
[ 205.412124][ T5988] ksys_unshare+0x5d8/0x970
[ 205.412157][ T5988] __x64_sys_unshare+0x38/0x50
[ 205.412190][ T5988] do_syscall_64+0x166/0x520
[ 205.412221][ T5988] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 205.412243][ T5988] page last free pid 5408 tgid 5408 ts 110508801022 stack trace:
[ 205.412261][ T5988] __free_frozen_pages+0xf8e/0x1070
[ 205.412293][ T5988] __slab_free+0x250/0x2a0
[ 205.412312][ T5988] qlist_free_all+0x99/0x100
[ 205.412343][ T5988] kasan_quarantine_reduce+0x148/0x160
[ 205.412377][ T5988] __kasan_slab_alloc+0x22/0x80
[ 205.412397][ T5988] __kmalloc_noprof+0x3b9/0x790
[ 205.412429][ T5988] tomoyo_supervisor+0xc53/0x1560
[ 205.412454][ T5988] tomoyo_env_perm+0x151/0x1f0
[ 205.412485][ T5988] tomoyo_find_next_domain+0x1334/0x1a90
[ 205.412517][ T5988] tomoyo_bprm_check_security+0x11c/0x180
[ 205.412544][ T5988] security_bprm_check+0x85/0x240
[ 205.412569][ T5988] bprm_execve+0x881/0x1590
[ 205.412597][ T5988] do_execveat_common+0x4f4/0x670
[ 205.412629][ T5988] __x64_sys_execve+0x97/0xc0
[ 205.412659][ T5988] do_syscall_64+0x166/0x520
[ 205.412692][ T5988] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 205.412714][ T5988]
[ 205.412720][ T5988] Memory state around the buggy address:
[ 205.412734][ T5988] ffff88802d423e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 205.412750][ T5988] ffff88802d423e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 205.412766][ T5988] >ffff88802d423f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 205.412778][ T5988] ^
[ 205.412802][ T5988] ffff88802d423f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 205.412818][ T5988] ffff88802d424000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 205.412831][ T5988] ==================================================================
[ 205.412878][ T5988] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 206.059901][ T5988] CPU: 1 UID: 0 PID: 5988 Comm: nfsd Not tainted syzkaller #0 PREEMPT_{RT,(full)}
[ 206.070028][ T5988] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
[ 206.080408][ T5988] Call Trace:
[ 206.083754][ T5988]
[ 206.086760][ T5988] vpanic+0x56d/0xa60
[ 206.090812][ T5988] ? rcu_is_watching+0x16/0xb0
[ 206.095729][ T5988] ? __pfx_vpanic+0x10/0x10
[ 206.100442][ T5988] panic+0xc5/0xd0
[ 206.104285][ T5988] ? __pfx_panic+0x10/0x10
[ 206.108772][ T5988] ? preempt_schedule_thunk+0x16/0x40
[ 206.114212][ T5988] ? nfsd+0x118/0xbc0
[ 206.118245][ T5988] ? preempt_schedule_thunk+0x16/0x40
[ 206.123648][ T5988] ? nfsd+0x118/0xbc0
[ 206.127657][ T5988] check_panic_on_warn+0x89/0xb0
[ 206.132764][ T5988] ? nfsd+0x118/0xbc0
[ 206.137009][ T5988] end_report+0x73/0x170
[ 206.141827][ T5988] ? nfsd+0x118/0xbc0
[ 206.145840][ T5988] kasan_report+0x128/0x150
[ 206.150557][ T5988] ? nfsd+0x118/0xbc0
[ 206.154753][ T5988] nfsd+0x118/0xbc0
[ 206.158704][ T5988] ? __pfx_nfsd+0x10/0x10
[ 206.163077][ T5988] ? __kthread_parkme+0x71/0x1f0
[ 206.168057][ T5988] ? __kthread_parkme+0x199/0x1f0
[ 206.173131][ T5988] kthread+0x38b/0x470
[ 206.177371][ T5988] ? __pfx_nfsd+0x10/0x10
[ 206.182003][ T5988] ? __pfx_kthread+0x10/0x10
[ 206.186914][ T5988] ret_from_fork+0x514/0xb70
[ 206.191684][ T5988] ? __pfx_ret_from_fork+0x10/0x10
[ 206.196924][ T5988] ? __switch_to+0xc89/0x1420
[ 206.201792][ T5988] ? __pfx_kthread+0x10/0x10
[ 206.206526][ T5988] ret_from_fork_asm+0x1a/0x30
[ 206.211326][ T5988]
[ 206.215000][ T5988] Kernel Offset: disabled
[ 206.219964][ T5988] Rebooting in 86400 seconds..