Extracting prog: 1m26.872293257s
Minimizing prog: 4m44.279972655s
Simplifying prog options: 0s
Extracting C: 34.1747442s
Simplifying C: 4m20.609543963s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket$nl_generic-sendmsg$nl_generic
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)={0x1c, 0x27, 0x9, 0x70bd2c, 0x25dfdbf9, {0x11}, [@typed={0x8, 0x1, 0x0, 0x0, @u32=0xffff8000}]}, 0x1c}}, 0x4000080)

program crashed: INFO: trying to register non-static key in nfsd4_cancel_copy_by_sb
single: successfully extracted reproducer
found reproducer with 3 syscalls
minimizing guilty program
testing program (duration=36.716270383s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-socket$nl_generic
detailed listing:
executing program 0:
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)

program did not crash
testing program (duration=36.716270383s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)={0x1c, 0x27, 0x9, 0x70bd2c, 0x25dfdbf9, {0x11}, [@typed={0x8, 0x1, 0x0, 0x0, @u32=0xffff8000}]}, 0x1c}}, 0x4000080)

program crashed: INFO: trying to register non-static key in nfsd4_cancel_copy_by_sb
testing program (duration=36.716270383s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$nl_generic
detailed listing:
executing program 0:
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)={0x1c, 0x27, 0x9, 0x70bd2c, 0x25dfdbf9, {0x11}, [@typed={0x8, 0x1, 0x0, 0x0, @u32=0xffff8000}]}, 0x1c}}, 0x4000080)

program did not crash
testing program (duration=36.716270383s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, 0x0, 0x4000080)

program did not crash
testing program (duration=36.716270383s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x4000080)

program did not crash
testing program (duration=36.716270383s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4000080)

program did not crash
extracting C reproducer
testing compiled C program (duration=36.716270383s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
program crashed: INFO: trying to register non-static key in nfsd4_cancel_copy_by_sb
simplifying C reproducer
testing compiled C program (duration=36.716270383s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
program crashed: INFO: trying to register non-static key in nfsd4_cancel_copy_by_sb
testing compiled C program (duration=36.716270383s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
program crashed: INFO: trying to register non-static key in nfsd4_cancel_copy_by_sb
testing compiled C program (duration=36.716270383s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
program crashed: INFO: trying to register non-static key in nfsd4_cancel_copy_by_sb
testing compiled C program (duration=36.716270383s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
program crashed: INFO: trying to register non-static key in nfsd4_cancel_copy_by_sb
testing compiled C program (duration=36.716270383s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
program crashed: INFO: trying to register non-static key in nfsd4_cancel_copy_by_sb
testing compiled C program (duration=36.716270383s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
program crashed: INFO: trying to register non-static key in nfsd4_cancel_copy_by_sb
testing compiled C program (duration=36.716270383s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
program crashed: INFO: trying to register non-static key in nfsd4_cancel_copy_by_sb
testing program (duration=36.716270383s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)={0x1c, 0x27, 0x9, 0x70bd2c, 0x25dfdbf9, {0x11}, [@typed={0x8, 0x1, 0x0, 0x0, @u32=0xffff8000}]}, 0x1c}}, 0x4000080)

program crashed: INFO: trying to register non-static key in nfsd4_cancel_copy_by_sb
validation run: crashed=true
testing program (duration=36.716270383s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)={0x1c, 0x27, 0x9, 0x70bd2c, 0x25dfdbf9, {0x11}, [@typed={0x8, 0x1, 0x0, 0x0, @u32=0xffff8000}]}, 0x1c}}, 0x4000080)

program crashed: INFO: trying to register non-static key in nfsd4_cancel_copy_by_sb
validation run: crashed=true
testing program (duration=36.716270383s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$nl_generic
detailed listing:
executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)={0x1c, 0x27, 0x9, 0x70bd2c, 0x25dfdbf9, {0x11}, [@typed={0x8, 0x1, 0x0, 0x0, @u32=0xffff8000}]}, 0x1c}}, 0x4000080)

program crashed: INFO: trying to register non-static key in nfsd4_cancel_copy_by_sb
validation run: crashed=true
reproducing took 13m25.171827775s
repro crashed as (corrupted=false):
INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 3 UID: 0 PID: 5924 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 assign_lock_key kernel/locking/lockdep.c:984 [inline]
 register_lock_class+0x549/0x560 kernel/locking/lockdep.c:1299
 __lock_acquire+0x3d7/0x1a40 kernel/locking/lockdep.c:5112
 lock_acquire kernel/locking/lockdep.c:5868 [inline]
 lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5825
 __raw_spin_lock include/linux/spinlock_api_smp.h:158 [inline]
 _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:158
 spin_lock include/linux/spinlock.h:342 [inline]
 nfsd4_cancel_copy_by_sb+0xdd/0x9e0 fs/nfsd/nfs4proc.c:1574
 nfsd_nl_unlock_filesystem_doit+0x1f1/0x3f0 fs/nfsd/nfsctl.c:2343
 genl_family_rcv_msg_doit+0x214/0x300 net/netlink/genetlink.c:1114
 genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline]
 genl_rcv_msg+0x560/0x800 net/netlink/genetlink.c:1209
 netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2556
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x585/0x850 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x8b0/0xda0 net/netlink/af_netlink.c:1900
 sock_sendmsg_nosec net/socket.c:775 [inline]
 __sock_sendmsg net/socket.c:790 [inline]
 ____sys_sendmsg+0xa4d/0xbe0 net/socket.c:2684
 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2738
 __sys_sendmsg+0x160/0x210 net/socket.c:2770
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f80bff9de59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd50d62358 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f80c0225fa0 RCX: 00007f80bff9de59
RDX: 0000000004000080 RSI: 00002000000000c0 RDI: 0000000000000003
RBP: 00007f80c0033e6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f80c0225fac R14: 00007f80c0225fa0 R15: 00007f80c0225fa0
 </TASK>
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 3 UID: 0 PID: 5924 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:nfsd4_cancel_copy_by_sb+0x136/0x9e0 fs/nfsd/nfs4proc.c:1578
Code: e8 ff ef d5 fe 48 8b 44 24 40 80 38 00 0f 85 28 08 00 00 48 8b 44 24 38 4c 89 f5 48 c1 e5 04 48 03 68 68 48 89 e8 48 c1 e8 03 <80> 3c 18 00 0f 85 16 08 00 00 4c 8b 65 00 4c 39 e5 0f 84 4e 04 00
RSP: 0018:ffffc90003aa7408 EFLAGS: 00010246
RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffffffff81e5b2e8
RDX: ffff888027804a80 RSI: ffffffff8333e041 RDI: ffffc90003aa7398
RBP: 0000000000000000 R08: 0000000000000001 R09: fffff52000754e73
R10: 0000000000000003 R11: ffff88802c4441e0 R12: ffff88802c4441c8
R13: 0000000000000000 R14: 0000000000000000 R15: ffff88803dc05a14
FS:  000055555d7b9500(0000) GS:ffff8880d60ea000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f80bfe73780 CR3: 0000000033247000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 nfsd_nl_unlock_filesystem_doit+0x1f1/0x3f0 fs/nfsd/nfsctl.c:2343
 genl_family_rcv_msg_doit+0x214/0x300 net/netlink/genetlink.c:1114
 genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline]
 genl_rcv_msg+0x560/0x800 net/netlink/genetlink.c:1209
 netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2556
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x585/0x850 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x8b0/0xda0 net/netlink/af_netlink.c:1900
 sock_sendmsg_nosec net/socket.c:775 [inline]
 __sock_sendmsg net/socket.c:790 [inline]
 ____sys_sendmsg+0xa4d/0xbe0 net/socket.c:2684
 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2738
 __sys_sendmsg+0x160/0x210 net/socket.c:2770
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f80bff9de59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd50d62358 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f80c0225fa0 RCX: 00007f80bff9de59
RDX: 0000000004000080 RSI: 00002000000000c0 RDI: 0000000000000003
RBP: 00007f80c0033e6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f80c0225fac R14: 00007f80c0225fa0 R15: 00007f80c0225fa0
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:nfsd4_cancel_copy_by_sb+0x136/0x9e0 fs/nfsd/nfs4proc.c:1578
Code: e8 ff ef d5 fe 48 8b 44 24 40 80 38 00 0f 85 28 08 00 00 48 8b 44 24 38 4c 89 f5 48 c1 e5 04 48 03 68 68 48 89 e8 48 c1 e8 03 <80> 3c 18 00 0f 85 16 08 00 00 4c 8b 65 00 4c 39 e5 0f 84 4e 04 00
RSP: 0018:ffffc90003aa7408 EFLAGS: 00010246
RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffffffff81e5b2e8
RDX: ffff888027804a80 RSI: ffffffff8333e041 RDI: ffffc90003aa7398
RBP: 0000000000000000 R08: 0000000000000001 R09: fffff52000754e73
R10: 0000000000000003 R11: ffff88802c4441e0 R12: ffff88802c4441c8
R13: 0000000000000000 R14: 0000000000000000 R15: ffff88803dc05a14
FS:  000055555d7b9500(0000) GS:ffff8880d60ea000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f80bfe73780 CR3: 0000000033247000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	e8 ff ef d5 fe       	call   0xfed5f004
   5:	48 8b 44 24 40       	mov    0x40(%rsp),%rax
   a:	80 38 00             	cmpb   $0x0,(%rax)
   d:	0f 85 28 08 00 00    	jne    0x83b
  13:	48 8b 44 24 38       	mov    0x38(%rsp),%rax
  18:	4c 89 f5             	mov    %r14,%rbp
  1b:	48 c1 e5 04          	shl    $0x4,%rbp
  1f:	48 03 68 68          	add    0x68(%rax),%rbp
  23:	48 89 e8             	mov    %rbp,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	80 3c 18 00          	cmpb   $0x0,(%rax,%rbx,1) <-- trapping instruction
  2e:	0f 85 16 08 00 00    	jne    0x84a
  34:	4c 8b 65 00          	mov    0x0(%rbp),%r12
  38:	4c 39 e5             	cmp    %r12,%rbp
  3b:	0f                   	.byte 0xf
  3c:	84 4e 04             	test   %cl,0x4(%rsi)

final repro crashed as (corrupted=false):
INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 3 UID: 0 PID: 5924 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 assign_lock_key kernel/locking/lockdep.c:984 [inline]
 register_lock_class+0x549/0x560 kernel/locking/lockdep.c:1299
 __lock_acquire+0x3d7/0x1a40 kernel/locking/lockdep.c:5112
 lock_acquire kernel/locking/lockdep.c:5868 [inline]
 lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5825
 __raw_spin_lock include/linux/spinlock_api_smp.h:158 [inline]
 _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:158
 spin_lock include/linux/spinlock.h:342 [inline]
 nfsd4_cancel_copy_by_sb+0xdd/0x9e0 fs/nfsd/nfs4proc.c:1574
 nfsd_nl_unlock_filesystem_doit+0x1f1/0x3f0 fs/nfsd/nfsctl.c:2343
 genl_family_rcv_msg_doit+0x214/0x300 net/netlink/genetlink.c:1114
 genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline]
 genl_rcv_msg+0x560/0x800 net/netlink/genetlink.c:1209
 netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2556
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x585/0x850 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x8b0/0xda0 net/netlink/af_netlink.c:1900
 sock_sendmsg_nosec net/socket.c:775 [inline]
 __sock_sendmsg net/socket.c:790 [inline]
 ____sys_sendmsg+0xa4d/0xbe0 net/socket.c:2684
 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2738
 __sys_sendmsg+0x160/0x210 net/socket.c:2770
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f80bff9de59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd50d62358 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f80c0225fa0 RCX: 00007f80bff9de59
RDX: 0000000004000080 RSI: 00002000000000c0 RDI: 0000000000000003
RBP: 00007f80c0033e6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f80c0225fac R14: 00007f80c0225fa0 R15: 00007f80c0225fa0
 </TASK>
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 3 UID: 0 PID: 5924 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:nfsd4_cancel_copy_by_sb+0x136/0x9e0 fs/nfsd/nfs4proc.c:1578
Code: e8 ff ef d5 fe 48 8b 44 24 40 80 38 00 0f 85 28 08 00 00 48 8b 44 24 38 4c 89 f5 48 c1 e5 04 48 03 68 68 48 89 e8 48 c1 e8 03 <80> 3c 18 00 0f 85 16 08 00 00 4c 8b 65 00 4c 39 e5 0f 84 4e 04 00
RSP: 0018:ffffc90003aa7408 EFLAGS: 00010246
RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffffffff81e5b2e8
RDX: ffff888027804a80 RSI: ffffffff8333e041 RDI: ffffc90003aa7398
RBP: 0000000000000000 R08: 0000000000000001 R09: fffff52000754e73
R10: 0000000000000003 R11: ffff88802c4441e0 R12: ffff88802c4441c8
R13: 0000000000000000 R14: 0000000000000000 R15: ffff88803dc05a14
FS:  000055555d7b9500(0000) GS:ffff8880d60ea000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f80bfe73780 CR3: 0000000033247000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 nfsd_nl_unlock_filesystem_doit+0x1f1/0x3f0 fs/nfsd/nfsctl.c:2343
 genl_family_rcv_msg_doit+0x214/0x300 net/netlink/genetlink.c:1114
 genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline]
 genl_rcv_msg+0x560/0x800 net/netlink/genetlink.c:1209
 netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2556
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x585/0x850 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x8b0/0xda0 net/netlink/af_netlink.c:1900
 sock_sendmsg_nosec net/socket.c:775 [inline]
 __sock_sendmsg net/socket.c:790 [inline]
 ____sys_sendmsg+0xa4d/0xbe0 net/socket.c:2684
 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2738
 __sys_sendmsg+0x160/0x210 net/socket.c:2770
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f80bff9de59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd50d62358 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f80c0225fa0 RCX: 00007f80bff9de59
RDX: 0000000004000080 RSI: 00002000000000c0 RDI: 0000000000000003
RBP: 00007f80c0033e6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f80c0225fac R14: 00007f80c0225fa0 R15: 00007f80c0225fa0
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:nfsd4_cancel_copy_by_sb+0x136/0x9e0 fs/nfsd/nfs4proc.c:1578
Code: e8 ff ef d5 fe 48 8b 44 24 40 80 38 00 0f 85 28 08 00 00 48 8b 44 24 38 4c 89 f5 48 c1 e5 04 48 03 68 68 48 89 e8 48 c1 e8 03 <80> 3c 18 00 0f 85 16 08 00 00 4c 8b 65 00 4c 39 e5 0f 84 4e 04 00
RSP: 0018:ffffc90003aa7408 EFLAGS: 00010246
RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffffffff81e5b2e8
RDX: ffff888027804a80 RSI: ffffffff8333e041 RDI: ffffc90003aa7398
RBP: 0000000000000000 R08: 0000000000000001 R09: fffff52000754e73
R10: 0000000000000003 R11: ffff88802c4441e0 R12: ffff88802c4441c8
R13: 0000000000000000 R14: 0000000000000000 R15: ffff88803dc05a14
FS:  000055555d7b9500(0000) GS:ffff8880d60ea000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f80bfe73780 CR3: 0000000033247000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	e8 ff ef d5 fe       	call   0xfed5f004
   5:	48 8b 44 24 40       	mov    0x40(%rsp),%rax
   a:	80 38 00             	cmpb   $0x0,(%rax)
   d:	0f 85 28 08 00 00    	jne    0x83b
  13:	48 8b 44 24 38       	mov    0x38(%rsp),%rax
  18:	4c 89 f5             	mov    %r14,%rbp
  1b:	48 c1 e5 04          	shl    $0x4,%rbp
  1f:	48 03 68 68          	add    0x68(%rax),%rbp
  23:	48 89 e8             	mov    %rbp,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	80 3c 18 00          	cmpb   $0x0,(%rax,%rbx,1) <-- trapping instruction
  2e:	0f 85 16 08 00 00    	jne    0x84a
  34:	4c 8b 65 00          	mov    0x0(%rbp),%r12
  38:	4c 39 e5             	cmp    %r12,%rbp
  3b:	0f                   	.byte 0xf
  3c:	84 4e 04             	test   %cl,0x4(%rsi)