Extracting prog: 1h32m55.805527844s
Minimizing prog: 18m37.918209487s
Simplifying prog options: 0s
Extracting C: 1m24.047063061s
Simplifying C: 14m46.445632253s


extracting reproducer from 30 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-openat-write-close-openat-write-close-openat-write-close-mkdirat-mount-openat-write-close-openat-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program did not crash
single: failed to extract reproducer
bisect: bisecting 30 programs with base timeout 30s
testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 23, 11, 14, 28, 3, 2, 5, 10, 2, 11, 4, 22, 14, 30, 9, 9, 2, 8, 3, 19, 10, 1, 14, 14, 10, 8, 22, 8, 30]
detailed listing:
executing program 0:
r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi0\x00', 0x0, 0x0)
ioctl(r0, 0x40946400, &(0x7f0000000100)="6461732d31383031737400000000000000000000000300"/152)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
write(r5, &(0x7f0000000480)='udp 2049\n', 0x9)
r6 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r6, &(0x7f0000000500)='1\n', 0x2)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
r1 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x2)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x42, 0x1b6)
ftruncate(r2, 0x1000000)
ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/mapper/control\x00', 0x2, 0x0)
ioctl(r3, 0xc138fd0a, &(0x7f0000000300)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006364657600")
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sec\x00', &(0x7f00000000c0)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)='path_group G1 /bin/true\n', 0x18)
write(r0, &(0x7f0000000300)='delete path_group G1 /bin/true\n', 0x1f)
close(r0)
nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0)
write(r1, &(0x7f0000000200)='path_group G2 /bin/false\n', 0x19)
write(r1, &(0x7f0000000300)='delete path_group G2 /bin/false\n', 0x20)
close(r1)
nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0)
write(r2, &(0x7f0000000300)='delete path_group G3 /bin/sh\n', 0x1d)
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000459bb2405804035000000000000109021b000111000000090400000195699b000905", @ANYRES32], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(&(0x7f0000000200)=@filename='sysfs\x00', &(0x7f0000000100)='./sys\x00', &(0x7f0000000280)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/bus/usb/drivers/aiptek/1-1:17.0/ytilt\x00', 0x0, 0x0)
read(r0, &(0x7f0000000500)=""/128, 0x80)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/usb/devices/1-1:17.0/ytilt\x00', 0x0, 0x0)
read(r1, &(0x7f0000000700)=""/128, 0x80)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/bus/usb/drivers/aiptek/1-1:1.0/ytilt\x00', 0x0, 0x0)
read(r2, &(0x7f0000000900)=""/128, 0x80)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/bus/usb/devices/1-1:1.0/ytilt\x00', 0x0, 0x0)
read(r3, &(0x7f0000000b00)=""/128, 0x80)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./sys/bus/usb/drivers/aiptek/2-1:17.0/ytilt\x00', 0x0, 0x0)
read(r4, &(0x7f0000000d00)=""/128, 0x80)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000e00)='./sys/bus/usb/devices/2-1:17.0/ytilt\x00', 0x0, 0x0)
read(r5, &(0x7f0000000f00)=""/128, 0x80)
r6 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./sys/bus/usb/drivers/aiptek/2-1:1.0/ytilt\x00', 0x0, 0x0)
read(r6, &(0x7f0000001100)=""/128, 0x80)
r7 = openat(0xffffffffffffff9c, &(0x7f0000001200)='./sys/bus/usb/devices/2-1:1.0/ytilt\x00', 0x0, 0x0)
read(r7, &(0x7f0000001300)=""/128, 0x80)
r8 = openat(0xffffffffffffff9c, &(0x7f0000001400)='./sys/bus/usb/drivers/aiptek/3-1:17.0/ytilt\x00', 0x0, 0x0)
read(r8, &(0x7f0000001500)=""/128, 0x80)
r9 = openat(0xffffffffffffff9c, &(0x7f0000001600)='./sys/bus/usb/devices/3-1:17.0/ytilt\x00', 0x0, 0x0)
read(r9, &(0x7f0000001700)=""/128, 0x80)
r10 = openat(0xffffffffffffff9c, &(0x7f0000001800)='./sys/bus/usb/drivers/aiptek/3-1:1.0/ytilt\x00', 0x0, 0x0)
read(r10, &(0x7f0000001900)=""/128, 0x80)
r11 = openat(0xffffffffffffff9c, &(0x7f0000001a00)='./sys/bus/usb/devices/3-1:1.0/ytilt\x00', 0x0, 0x0)
read(r11, &(0x7f0000001b00)=""/128, 0x80)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt\x00', 0x1ff)
mount$nfs4(&(0x7f0000000540)='127.0.0.1:/\x00', &(0x7f0000000500)='./mnt\x00', 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB='addr=127.0.0.1,port=2049,proto=tcp,vers=4.0,noresvport\x00'])
executing program 3:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302000200"], 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000700)={0x1c, &(0x7f0000000640)={0x20, 0xa, 0x2, ' \x00'}, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
syz_usb_ep_write(r0, 0x81, 0xa, &(0x7f0000000100)="0a000100010000000001")
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
r1 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x2)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x42, 0x1b6)
ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/mapper/control\x00', 0x2, 0x0)
ioctl(r2, 0xc138fd0a, &(0x7f0000000300)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006364657600")
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt\x00', 0x1ff)
mount$nfs4(&(0x7f0000000540)='127.0.0.1:/\x00', &(0x7f0000000500)='./mnt\x00', &(0x7f0000000580), 0x0, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r2, &(0x7f0000000440)='localhost /tmp 2147483647 9218 65534 65534 0\n', 0x2d)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f00000001c0)='127.0.0.1 2049\n', 0xf)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)
executing program 4:
mkdir(&(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./backing_file\x00', 0x42, 0x1ff)
ftruncate(r0, 0x200000)
r1 = syz_open_dev$loop(&(0x7f00000000c0), 0x0, 0x2)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
dup2(r1, 0x3)
mkdir(&(0x7f0000000100)='./config/cluster/ocfs2\x00', 0x1ff)
mkdir(&(0x7f0000000140)='./config/cluster/ocfs2/node/node0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/cluster/ocfs2/node/node0/ipv4_address\x00', 0x1, 0x0)
write(r2, &(0x7f00000001c0)='127.', 0x4)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/cluster/ocfs2/node/node0/ipv4_port\x00', 0x1, 0x0)
write(r3, &(0x7f0000000240)='7777\n', 0x5)
executing program 4:
mkdir(&(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./backing_file\x00', 0x42, 0x1ff)
ftruncate(r0, 0x200000)
r1 = syz_open_dev$loop(&(0x7f00000000c0), 0x0, 0x2)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
dup2(r1, 0x3)
mkdir(&(0x7f0000000100)='./config/cluster/ocfs2\x00', 0x1ff)
mkdir(&(0x7f0000000140)='./config/cluster/ocfs2/node/node0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/cluster/ocfs2/node/node0/ipv4_address\x00', 0x1, 0x0)
write(r2, &(0x7f00000001c0)='127.0.0.1\n', 0xa)
close(r2)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/cluster/ocfs2/node/node0/ipv4_port\x00', 0x1, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/cluster/ocfs2/node/node0/num\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='0\n', 0x2)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/cluster/ocfs2/node/node0/local\x00', 0x1, 0x0)
write(r4, &(0x7f0000000340)='1\n', 0x2)
mkdir(&(0x7f0000000380)='./config/cluster/ocfs2/heartbeat/hb0\x00', 0x1ff)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/cluster/ocfs2/heartbeat/hb0/start_block\x00', 0x1, 0x0)
write(r5, &(0x7f0000000480)='1\n', 0x2)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/cluster/ocfs2/heartbeat/hb0/blocks\x00', 0x1, 0x0)
write(r6, &(0x7f0000000500)='2\n', 0x2)
close(r6)
openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/cluster/ocfs2/heartbeat/hb0/dev\x00', 0x1, 0x0)
mkdir(&(0x7f00000005c0)='./dlmfs\x00', 0x1ff)
mount(0x0, &(0x7f00000005c0)='./dlmfs\x00', &(0x7f0000000600)='ocfs2_dlmfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000640)='./dlmfs/domain0\x00', 0x1ff)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
r1 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x2)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/mapper/control\x00', 0x2, 0x0)
ioctl(r2, 0xc138fd0a, &(0x7f0000000300)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006364657600")
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
r1 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x2)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/mapper/control\x00', 0x2, 0x0)
ioctl(r2, 0xc138fd03, &(0x7f0000000300)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006364657600")
ioctl(r2, 0xc138fd09, &(0x7f0000000300)="0400000000000000000000007c01000038010000010000000000000000000000000000000000000000000000000000006364657600")
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt\x00', 0x1ff)
mount$nfs4(&(0x7f0000000540)='127.0.0.1:/\x00', &(0x7f0000000500)='./mnt\x00', &(0x7f0000000580), 0x0, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/hid\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/hid/drivers\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/hid/drivers/kone\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/hid/drivers/roccat\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/kone\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/class/roccat\x00', 0x0, 0x0)
executing program 1:
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sec\x00', &(0x7f00000000c0)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)='path_group G1 /bin/true\n', 0x18)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(&(0x7f0000000500), &(0x7f0000000400)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1770, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0xd0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0xff, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0x81, 0x7, 0xe}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0900a11e0901a1006d08950109309102c0c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/leds/0003:1770:FF00.0001::back/brightness\x00', 0x2, 0x0)
write(r1, &(0x7f0000000780)='1\n\x00', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/class/leds/0003:1770:FF00.0001::back/gt683r/mode\x00', 0x2, 0x0)
write(r2, &(0x7f0000000880)='1\n\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/leds/0003:1770:FF00.0002::back/brightness\x00', 0x2, 0x0)
write(r3, &(0x7f0000000980)='1\n\x00', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/class/leds/0003:1770:FF00.0002::back/gt683r/mode\x00', 0x2, 0x0)
write(r4, &(0x7f0000000a80)='1\n\x00', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/class/leds/0003:1770:FF00.0003::back/brightness\x00', 0x2, 0x0)
write(r5, &(0x7f0000000b80)='1\n\x00', 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./sys/class/leds/0003:1770:FF00.0003::back/gt683r/mode\x00', 0x2, 0x0)
write(r6, &(0x7f0000000c80)='1\n\x00', 0x2)
write(0xffffffffffffffff, &(0x7f0000000e80)='1\n\x00', 0x2)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r1, &(0x7f0000000440)='localhost /tmp 2147483647 9218 65534 65534 0\n', 0x2d)
executing program 0:
nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0)
executing program 1:
mkdir(&(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./backing_file\x00', 0x42, 0x1ff)
ftruncate(r0, 0x200000)
r1 = syz_open_dev$loop(&(0x7f00000000c0), 0x0, 0x2)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
dup2(r1, 0x3)
mkdir(&(0x7f0000000100)='./config/cluster/ocfs2\x00', 0x1ff)
mkdir(&(0x7f0000000140)='./config/cluster/ocfs2/node/node0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/cluster/ocfs2/node/node0/ipv4_address\x00', 0x1, 0x0)
write(r2, &(0x7f00000001c0)='127.', 0x4)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/cluster/ocfs2/node/node0/ipv4_port\x00', 0x1, 0x0)
write(r3, &(0x7f0000000240)='7777\n', 0x5)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sec\x00', &(0x7f00000000c0)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)='path_group G1 /bin/true\n', 0x18)
write(r0, &(0x7f0000000300)='delete path_group G1 /bin/true\n', 0x1f)
close(r0)
nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0)
write(r1, &(0x7f0000000200)='path_group G2 /bin/false\n', 0x19)
write(r1, &(0x7f0000000300)='delete path_group G2 /bin/false\n', 0x20)
close(r1)
nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000200)='path_group G3 /bin/sh\n', 0x16)
write(0xffffffffffffffff, &(0x7f0000000300)='delete path_group G3 /bin/sh\n', 0x1d)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:01.0\x00', 0x0, 0x0)
r1 = openat(r0, &(0x7f0000000200)='driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='0000:00:01.0\x00', 0xd)
r2 = openat(r0, &(0x7f0000000400)='driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000500)='e1000\x00', 0x6)
r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/pci/drivers/e1000\x00', 0x0, 0x0)
r4 = openat(r3, &(0x7f0000000700)='bind\x00', 0x1, 0x0)
write(r4, &(0x7f0000000800)='0000:00:01.0\x00', 0xd)
executing program 4:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010001ffffff40460801100001010203010902270001010080fa0904000003ffffff00070581020002000705020200020007058303"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000080)={0x84, &(0x7f0000000100)={0x40, 0x0, 0x12, "12000000112233445500000000dc05000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000080))
syz_usb_control_io(r0, 0x0, &(0x7f0000000080))
syz_usb_control_io(r0, 0x0, &(0x7f0000000080))
syz_usb_control_io(r0, 0x0, &(0x7f0000000080))
nanosleep(&(0x7f0000000200)={0x0, 0x5f5e100}, 0x0)
syz_usb_disconnect(r0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x2)
ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/mapper/control\x00', 0x2, 0x0)
ioctl(r1, 0xc138fd0a, &(0x7f0000000300)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006364657600")
executing program 0:
mkdir(&(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./backing_file\x00', 0x42, 0x1ff)
ftruncate(r0, 0x200000)
r1 = syz_open_dev$loop(&(0x7f00000000c0), 0x0, 0x2)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
dup2(r1, 0x3)
mkdir(&(0x7f0000000100)='./config/cluster/ocfs2\x00', 0x1ff)
mkdir(&(0x7f0000000140)='./config/cluster/ocfs2/node/node0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/cluster/ocfs2/node/node0/ipv4_address\x00', 0x1, 0x0)
write(r2, &(0x7f00000001c0)='127.0.0.1\n', 0xa)
close(r2)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/cluster/ocfs2/node/node0/ipv4_port\x00', 0x1, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/cluster/ocfs2/node/node0/num\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='0\n', 0x2)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/cluster/ocfs2/node/node0/local\x00', 0x1, 0x0)
write(r4, &(0x7f0000000340)='1\n', 0x2)
mkdir(&(0x7f0000000380)='./config/cluster/ocfs2/heartbeat/hb0\x00', 0x1ff)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/cluster/ocfs2/heartbeat/hb0/start_block\x00', 0x1, 0x0)
write(r5, &(0x7f0000000480)='1\n', 0x2)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/cluster/ocfs2/heartbeat/hb0/blocks\x00', 0x1, 0x0)
write(r6, &(0x7f0000000500)='2\n', 0x2)
close(r6)
openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/cluster/ocfs2/heartbeat/hb0/dev\x00', 0x1, 0x0)
mkdir(&(0x7f00000005c0)='./dlmfs\x00', 0x1ff)
mount(0x0, &(0x7f00000005c0)='./dlmfs\x00', &(0x7f0000000600)='ocfs2_dlmfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000640)='./dlmfs/domain0\x00', 0x1ff)

program crashed: kernel BUG in svc_destroy
bisect: bisecting 30 programs
bisect: split chunks (needed=false): <29>
bisect: split chunk #0 of len 29 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=35s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 4, 22, 14, 30, 9, 9, 2, 8, 3, 19, 10, 1, 14, 14, 10, 8, 22, 8, 30]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r2, &(0x7f0000000440)='localhost /tmp 2147483647 9218 65534 65534 0\n', 0x2d)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f00000001c0)='127.0.0.1 2049\n', 0xf)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)
executing program 4:
mkdir(&(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./backing_file\x00', 0x42, 0x1ff)
ftruncate(r0, 0x200000)
r1 = syz_open_dev$loop(&(0x7f00000000c0), 0x0, 0x2)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
dup2(r1, 0x3)
mkdir(&(0x7f0000000100)='./config/cluster/ocfs2\x00', 0x1ff)
mkdir(&(0x7f0000000140)='./config/cluster/ocfs2/node/node0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/cluster/ocfs2/node/node0/ipv4_address\x00', 0x1, 0x0)
write(r2, &(0x7f00000001c0)='127.', 0x4)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/cluster/ocfs2/node/node0/ipv4_port\x00', 0x1, 0x0)
write(r3, &(0x7f0000000240)='7777\n', 0x5)
executing program 4:
mkdir(&(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./backing_file\x00', 0x42, 0x1ff)
ftruncate(r0, 0x200000)
r1 = syz_open_dev$loop(&(0x7f00000000c0), 0x0, 0x2)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
dup2(r1, 0x3)
mkdir(&(0x7f0000000100)='./config/cluster/ocfs2\x00', 0x1ff)
mkdir(&(0x7f0000000140)='./config/cluster/ocfs2/node/node0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/cluster/ocfs2/node/node0/ipv4_address\x00', 0x1, 0x0)
write(r2, &(0x7f00000001c0)='127.0.0.1\n', 0xa)
close(r2)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/cluster/ocfs2/node/node0/ipv4_port\x00', 0x1, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/cluster/ocfs2/node/node0/num\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='0\n', 0x2)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/cluster/ocfs2/node/node0/local\x00', 0x1, 0x0)
write(r4, &(0x7f0000000340)='1\n', 0x2)
mkdir(&(0x7f0000000380)='./config/cluster/ocfs2/heartbeat/hb0\x00', 0x1ff)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/cluster/ocfs2/heartbeat/hb0/start_block\x00', 0x1, 0x0)
write(r5, &(0x7f0000000480)='1\n', 0x2)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/cluster/ocfs2/heartbeat/hb0/blocks\x00', 0x1, 0x0)
write(r6, &(0x7f0000000500)='2\n', 0x2)
close(r6)
openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/cluster/ocfs2/heartbeat/hb0/dev\x00', 0x1, 0x0)
mkdir(&(0x7f00000005c0)='./dlmfs\x00', 0x1ff)
mount(0x0, &(0x7f00000005c0)='./dlmfs\x00', &(0x7f0000000600)='ocfs2_dlmfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000640)='./dlmfs/domain0\x00', 0x1ff)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
r1 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x2)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/mapper/control\x00', 0x2, 0x0)
ioctl(r2, 0xc138fd0a, &(0x7f0000000300)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006364657600")
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
r1 = syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x2)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/mapper/control\x00', 0x2, 0x0)
ioctl(r2, 0xc138fd03, &(0x7f0000000300)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006364657600")
ioctl(r2, 0xc138fd09, &(0x7f0000000300)="0400000000000000000000007c01000038010000010000000000000000000000000000000000000000000000000000006364657600")
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./mnt\x00', 0x1ff)
mount$nfs4(&(0x7f0000000540)='127.0.0.1:/\x00', &(0x7f0000000500)='./mnt\x00', &(0x7f0000000580), 0x0, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/hid\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/hid/drivers\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/hid/drivers/kone\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys/bus/hid/drivers/roccat\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/class/kone\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/class/roccat\x00', 0x0, 0x0)
executing program 1:
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sec\x00', &(0x7f00000000c0)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)='path_group G1 /bin/true\n', 0x18)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(&(0x7f0000000500), &(0x7f0000000400)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1770, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0xd0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0xff, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0x81, 0x7, 0xe}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0900a11e0901a1006d08950109309102c0c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/leds/0003:1770:FF00.0001::back/brightness\x00', 0x2, 0x0)
write(r1, &(0x7f0000000780)='1\n\x00', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/class/leds/0003:1770:FF00.0001::back/gt683r/mode\x00', 0x2, 0x0)
write(r2, &(0x7f0000000880)='1\n\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/leds/0003:1770:FF00.0002::back/brightness\x00', 0x2, 0x0)
write(r3, &(0x7f0000000980)='1\n\x00', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/class/leds/0003:1770:FF00.0002::back/gt683r/mode\x00', 0x2, 0x0)
write(r4, &(0x7f0000000a80)='1\n\x00', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/class/leds/0003:1770:FF00.0003::back/brightness\x00', 0x2, 0x0)
write(r5, &(0x7f0000000b80)='1\n\x00', 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./sys/class/leds/0003:1770:FF00.0003::back/gt683r/mode\x00', 0x2, 0x0)
write(r6, &(0x7f0000000c80)='1\n\x00', 0x2)
write(0xffffffffffffffff, &(0x7f0000000e80)='1\n\x00', 0x2)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r1, &(0x7f0000000440)='localhost /tmp 2147483647 9218 65534 65534 0\n', 0x2d)
executing program 0:
nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0)
executing program 1:
mkdir(&(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./backing_file\x00', 0x42, 0x1ff)
ftruncate(r0, 0x200000)
r1 = syz_open_dev$loop(&(0x7f00000000c0), 0x0, 0x2)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
dup2(r1, 0x3)
mkdir(&(0x7f0000000100)='./config/cluster/ocfs2\x00', 0x1ff)
mkdir(&(0x7f0000000140)='./config/cluster/ocfs2/node/node0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/cluster/ocfs2/node/node0/ipv4_address\x00', 0x1, 0x0)
write(r2, &(0x7f00000001c0)='127.', 0x4)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/cluster/ocfs2/node/node0/ipv4_port\x00', 0x1, 0x0)
write(r3, &(0x7f0000000240)='7777\n', 0x5)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sec\x00', &(0x7f00000000c0)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)='path_group G1 /bin/true\n', 0x18)
write(r0, &(0x7f0000000300)='delete path_group G1 /bin/true\n', 0x1f)
close(r0)
nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0)
write(r1, &(0x7f0000000200)='path_group G2 /bin/false\n', 0x19)
write(r1, &(0x7f0000000300)='delete path_group G2 /bin/false\n', 0x20)
close(r1)
nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000200)='path_group G3 /bin/sh\n', 0x16)
write(0xffffffffffffffff, &(0x7f0000000300)='delete path_group G3 /bin/sh\n', 0x1d)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:01.0\x00', 0x0, 0x0)
r1 = openat(r0, &(0x7f0000000200)='driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='0000:00:01.0\x00', 0xd)
r2 = openat(r0, &(0x7f0000000400)='driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000500)='e1000\x00', 0x6)
r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/pci/drivers/e1000\x00', 0x0, 0x0)
r4 = openat(r3, &(0x7f0000000700)='bind\x00', 0x1, 0x0)
write(r4, &(0x7f0000000800)='0000:00:01.0\x00', 0xd)
executing program 4:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010001ffffff40460801100001010203010902270001010080fa0904000003ffffff00070581020002000705020200020007058303"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000080)={0x84, &(0x7f0000000100)={0x40, 0x0, 0x12, "12000000112233445500000000dc05000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000080))
syz_usb_control_io(r0, 0x0, &(0x7f0000000080))
syz_usb_control_io(r0, 0x0, &(0x7f0000000080))
syz_usb_control_io(r0, 0x0, &(0x7f0000000080))
nanosleep(&(0x7f0000000200)={0x0, 0x5f5e100}, 0x0)
syz_usb_disconnect(r0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x2)
ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/mapper/control\x00', 0x2, 0x0)
ioctl(r1, 0xc138fd0a, &(0x7f0000000300)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006364657600")
executing program 0:
mkdir(&(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./backing_file\x00', 0x42, 0x1ff)
ftruncate(r0, 0x200000)
r1 = syz_open_dev$loop(&(0x7f00000000c0), 0x0, 0x2)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
dup2(r1, 0x3)
mkdir(&(0x7f0000000100)='./config/cluster/ocfs2\x00', 0x1ff)
mkdir(&(0x7f0000000140)='./config/cluster/ocfs2/node/node0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/cluster/ocfs2/node/node0/ipv4_address\x00', 0x1, 0x0)
write(r2, &(0x7f00000001c0)='127.0.0.1\n', 0xa)
close(r2)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/cluster/ocfs2/node/node0/ipv4_port\x00', 0x1, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/cluster/ocfs2/node/node0/num\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='0\n', 0x2)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/cluster/ocfs2/node/node0/local\x00', 0x1, 0x0)
write(r4, &(0x7f0000000340)='1\n', 0x2)
mkdir(&(0x7f0000000380)='./config/cluster/ocfs2/heartbeat/hb0\x00', 0x1ff)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/cluster/ocfs2/heartbeat/hb0/start_block\x00', 0x1, 0x0)
write(r5, &(0x7f0000000480)='1\n', 0x2)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/cluster/ocfs2/heartbeat/hb0/blocks\x00', 0x1, 0x0)
write(r6, &(0x7f0000000500)='2\n', 0x2)
close(r6)
openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/cluster/ocfs2/heartbeat/hb0/dev\x00', 0x1, 0x0)
mkdir(&(0x7f00000005c0)='./dlmfs\x00', 0x1ff)
mount(0x0, &(0x7f00000005c0)='./dlmfs\x00', &(0x7f0000000600)='ocfs2_dlmfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000640)='./dlmfs/domain0\x00', 0x1ff)

program crashed: KASAN: use-after-free Read in nfsd_svc
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/3
testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 10, 1, 14, 14, 10, 8, 22, 8, 30]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(&(0x7f0000000500), &(0x7f0000000400)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1770, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0xd0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0xff, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0x81, 0x7, 0xe}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0900a11e0901a1006d08950109309102c0c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/leds/0003:1770:FF00.0001::back/brightness\x00', 0x2, 0x0)
write(r1, &(0x7f0000000780)='1\n\x00', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/class/leds/0003:1770:FF00.0001::back/gt683r/mode\x00', 0x2, 0x0)
write(r2, &(0x7f0000000880)='1\n\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/leds/0003:1770:FF00.0002::back/brightness\x00', 0x2, 0x0)
write(r3, &(0x7f0000000980)='1\n\x00', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/class/leds/0003:1770:FF00.0002::back/gt683r/mode\x00', 0x2, 0x0)
write(r4, &(0x7f0000000a80)='1\n\x00', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/class/leds/0003:1770:FF00.0003::back/brightness\x00', 0x2, 0x0)
write(r5, &(0x7f0000000b80)='1\n\x00', 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./sys/class/leds/0003:1770:FF00.0003::back/gt683r/mode\x00', 0x2, 0x0)
write(r6, &(0x7f0000000c80)='1\n\x00', 0x2)
write(0xffffffffffffffff, &(0x7f0000000e80)='1\n\x00', 0x2)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r1, &(0x7f0000000440)='localhost /tmp 2147483647 9218 65534 65534 0\n', 0x2d)
executing program 0:
nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0)
executing program 1:
mkdir(&(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./backing_file\x00', 0x42, 0x1ff)
ftruncate(r0, 0x200000)
r1 = syz_open_dev$loop(&(0x7f00000000c0), 0x0, 0x2)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
dup2(r1, 0x3)
mkdir(&(0x7f0000000100)='./config/cluster/ocfs2\x00', 0x1ff)
mkdir(&(0x7f0000000140)='./config/cluster/ocfs2/node/node0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/cluster/ocfs2/node/node0/ipv4_address\x00', 0x1, 0x0)
write(r2, &(0x7f00000001c0)='127.', 0x4)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/cluster/ocfs2/node/node0/ipv4_port\x00', 0x1, 0x0)
write(r3, &(0x7f0000000240)='7777\n', 0x5)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sec\x00', &(0x7f00000000c0)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)='path_group G1 /bin/true\n', 0x18)
write(r0, &(0x7f0000000300)='delete path_group G1 /bin/true\n', 0x1f)
close(r0)
nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0)
write(r1, &(0x7f0000000200)='path_group G2 /bin/false\n', 0x19)
write(r1, &(0x7f0000000300)='delete path_group G2 /bin/false\n', 0x20)
close(r1)
nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000200)='path_group G3 /bin/sh\n', 0x16)
write(0xffffffffffffffff, &(0x7f0000000300)='delete path_group G3 /bin/sh\n', 0x1d)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:01.0\x00', 0x0, 0x0)
r1 = openat(r0, &(0x7f0000000200)='driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='0000:00:01.0\x00', 0xd)
r2 = openat(r0, &(0x7f0000000400)='driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000500)='e1000\x00', 0x6)
r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/pci/drivers/e1000\x00', 0x0, 0x0)
r4 = openat(r3, &(0x7f0000000700)='bind\x00', 0x1, 0x0)
write(r4, &(0x7f0000000800)='0000:00:01.0\x00', 0xd)
executing program 4:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010001ffffff40460801100001010203010902270001010080fa0904000003ffffff00070581020002000705020200020007058303"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000080)={0x84, &(0x7f0000000100)={0x40, 0x0, 0x12, "12000000112233445500000000dc05000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000080))
syz_usb_control_io(r0, 0x0, &(0x7f0000000080))
syz_usb_control_io(r0, 0x0, &(0x7f0000000080))
syz_usb_control_io(r0, 0x0, &(0x7f0000000080))
nanosleep(&(0x7f0000000200)={0x0, 0x5f5e100}, 0x0)
syz_usb_disconnect(r0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x2)
ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/mapper/control\x00', 0x2, 0x0)
ioctl(r1, 0xc138fd0a, &(0x7f0000000300)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006364657600")
executing program 0:
mkdir(&(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./backing_file\x00', 0x42, 0x1ff)
ftruncate(r0, 0x200000)
r1 = syz_open_dev$loop(&(0x7f00000000c0), 0x0, 0x2)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
dup2(r1, 0x3)
mkdir(&(0x7f0000000100)='./config/cluster/ocfs2\x00', 0x1ff)
mkdir(&(0x7f0000000140)='./config/cluster/ocfs2/node/node0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/cluster/ocfs2/node/node0/ipv4_address\x00', 0x1, 0x0)
write(r2, &(0x7f00000001c0)='127.0.0.1\n', 0xa)
close(r2)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/cluster/ocfs2/node/node0/ipv4_port\x00', 0x1, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/cluster/ocfs2/node/node0/num\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='0\n', 0x2)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/cluster/ocfs2/node/node0/local\x00', 0x1, 0x0)
write(r4, &(0x7f0000000340)='1\n', 0x2)
mkdir(&(0x7f0000000380)='./config/cluster/ocfs2/heartbeat/hb0\x00', 0x1ff)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/cluster/ocfs2/heartbeat/hb0/start_block\x00', 0x1, 0x0)
write(r5, &(0x7f0000000480)='1\n', 0x2)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/cluster/ocfs2/heartbeat/hb0/blocks\x00', 0x1, 0x0)
write(r6, &(0x7f0000000500)='2\n', 0x2)
close(r6)
openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/cluster/ocfs2/heartbeat/hb0/dev\x00', 0x1, 0x0)
mkdir(&(0x7f00000005c0)='./dlmfs\x00', 0x1ff)
mount(0x0, &(0x7f00000005c0)='./dlmfs\x00', &(0x7f0000000600)='ocfs2_dlmfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000640)='./dlmfs/domain0\x00', 0x1ff)

program crashed: kernel BUG in svc_destroy
bisect: the chunk can be dropped
bisect: testing without sub-chunk 3/3
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-openat-write-close-openat-write-close-openat-write-close-mkdirat-mount-openat-write-close-openat-openat-write
detailed listing:
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program did not crash
bisect: split chunks (needed=true): <9>
bisect: split chunk #0 of len 9 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 8, 22, 8, 30]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:01.0\x00', 0x0, 0x0)
r1 = openat(r0, &(0x7f0000000200)='driver/unbind\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='0000:00:01.0\x00', 0xd)
r2 = openat(r0, &(0x7f0000000400)='driver_override\x00', 0x1, 0x0)
write(r2, &(0x7f0000000500)='e1000\x00', 0x6)
r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000600)='./sys/bus/pci/drivers/e1000\x00', 0x0, 0x0)
r4 = openat(r3, &(0x7f0000000700)='bind\x00', 0x1, 0x0)
write(r4, &(0x7f0000000800)='0000:00:01.0\x00', 0xd)
executing program 4:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010001ffffff40460801100001010203010902270001010080fa0904000003ffffff00070581020002000705020200020007058303"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000080)={0x84, &(0x7f0000000100)={0x40, 0x0, 0x12, "12000000112233445500000000dc05000000"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000080))
syz_usb_control_io(r0, 0x0, &(0x7f0000000080))
syz_usb_control_io(r0, 0x0, &(0x7f0000000080))
syz_usb_control_io(r0, 0x0, &(0x7f0000000080))
nanosleep(&(0x7f0000000200)={0x0, 0x5f5e100}, 0x0)
syz_usb_disconnect(r0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x42, 0x1b6)
ftruncate(r0, 0x1000000)
syz_open_dev$loop(&(0x7f0000000140), 0x0, 0x2)
ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./dev/mapper/control\x00', 0x2, 0x0)
ioctl(r1, 0xc138fd0a, &(0x7f0000000300)="0400000000000000000000003801000038010000000000000000000000000000000000000000000000000000000000006364657600")
executing program 0:
mkdir(&(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./backing_file\x00', 0x42, 0x1ff)
ftruncate(r0, 0x200000)
r1 = syz_open_dev$loop(&(0x7f00000000c0), 0x0, 0x2)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
dup2(r1, 0x3)
mkdir(&(0x7f0000000100)='./config/cluster/ocfs2\x00', 0x1ff)
mkdir(&(0x7f0000000140)='./config/cluster/ocfs2/node/node0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/cluster/ocfs2/node/node0/ipv4_address\x00', 0x1, 0x0)
write(r2, &(0x7f00000001c0)='127.0.0.1\n', 0xa)
close(r2)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/cluster/ocfs2/node/node0/ipv4_port\x00', 0x1, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/cluster/ocfs2/node/node0/num\x00', 0x1, 0x0)
write(r3, &(0x7f00000002c0)='0\n', 0x2)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/cluster/ocfs2/node/node0/local\x00', 0x1, 0x0)
write(r4, &(0x7f0000000340)='1\n', 0x2)
mkdir(&(0x7f0000000380)='./config/cluster/ocfs2/heartbeat/hb0\x00', 0x1ff)
close(0xffffffffffffffff)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/cluster/ocfs2/heartbeat/hb0/start_block\x00', 0x1, 0x0)
write(r5, &(0x7f0000000480)='1\n', 0x2)
close(r5)
r6 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/cluster/ocfs2/heartbeat/hb0/blocks\x00', 0x1, 0x0)
write(r6, &(0x7f0000000500)='2\n', 0x2)
close(r6)
openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/cluster/ocfs2/heartbeat/hb0/dev\x00', 0x1, 0x0)
mkdir(&(0x7f00000005c0)='./dlmfs\x00', 0x1ff)
mount(0x0, &(0x7f00000005c0)='./dlmfs\x00', &(0x7f0000000600)='ocfs2_dlmfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000640)='./dlmfs/domain0\x00', 0x1ff)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 10, 1, 14, 14, 22]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(&(0x7f0000000500), &(0x7f0000000400)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1770, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0xd0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0xff, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0x81, 0x7, 0xe}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0900a11e0901a1006d08950109309102c0c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/leds/0003:1770:FF00.0001::back/brightness\x00', 0x2, 0x0)
write(r1, &(0x7f0000000780)='1\n\x00', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/class/leds/0003:1770:FF00.0001::back/gt683r/mode\x00', 0x2, 0x0)
write(r2, &(0x7f0000000880)='1\n\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/leds/0003:1770:FF00.0002::back/brightness\x00', 0x2, 0x0)
write(r3, &(0x7f0000000980)='1\n\x00', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/class/leds/0003:1770:FF00.0002::back/gt683r/mode\x00', 0x2, 0x0)
write(r4, &(0x7f0000000a80)='1\n\x00', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/class/leds/0003:1770:FF00.0003::back/brightness\x00', 0x2, 0x0)
write(r5, &(0x7f0000000b80)='1\n\x00', 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./sys/class/leds/0003:1770:FF00.0003::back/gt683r/mode\x00', 0x2, 0x0)
write(r6, &(0x7f0000000c80)='1\n\x00', 0x2)
write(0xffffffffffffffff, &(0x7f0000000e80)='1\n\x00', 0x2)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r1, &(0x7f0000000440)='localhost /tmp 2147483647 9218 65534 65534 0\n', 0x2d)
executing program 0:
nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0)
executing program 1:
mkdir(&(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./backing_file\x00', 0x42, 0x1ff)
ftruncate(r0, 0x200000)
r1 = syz_open_dev$loop(&(0x7f00000000c0), 0x0, 0x2)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
dup2(r1, 0x3)
mkdir(&(0x7f0000000100)='./config/cluster/ocfs2\x00', 0x1ff)
mkdir(&(0x7f0000000140)='./config/cluster/ocfs2/node/node0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/cluster/ocfs2/node/node0/ipv4_address\x00', 0x1, 0x0)
write(r2, &(0x7f00000001c0)='127.', 0x4)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/cluster/ocfs2/node/node0/ipv4_port\x00', 0x1, 0x0)
write(r3, &(0x7f0000000240)='7777\n', 0x5)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sec\x00', &(0x7f00000000c0)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)='path_group G1 /bin/true\n', 0x18)
write(r0, &(0x7f0000000300)='delete path_group G1 /bin/true\n', 0x1f)
close(r0)
nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0)
write(r1, &(0x7f0000000200)='path_group G2 /bin/false\n', 0x19)
write(r1, &(0x7f0000000300)='delete path_group G2 /bin/false\n', 0x20)
close(r1)
nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000200)='path_group G3 /bin/sh\n', 0x16)
write(0xffffffffffffffff, &(0x7f0000000300)='delete path_group G3 /bin/sh\n', 0x1d)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program crashed: KASAN: use-after-free Read in nfsd_svc
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <5>
bisect: split chunk #0 of len 5 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 14, 22]
detailed listing:
executing program 1:
mkdir(&(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./backing_file\x00', 0x42, 0x1ff)
ftruncate(r0, 0x200000)
r1 = syz_open_dev$loop(&(0x7f00000000c0), 0x0, 0x2)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
dup2(r1, 0x3)
mkdir(&(0x7f0000000100)='./config/cluster/ocfs2\x00', 0x1ff)
mkdir(&(0x7f0000000140)='./config/cluster/ocfs2/node/node0\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/cluster/ocfs2/node/node0/ipv4_address\x00', 0x1, 0x0)
write(r2, &(0x7f00000001c0)='127.', 0x4)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/cluster/ocfs2/node/node0/ipv4_port\x00', 0x1, 0x0)
write(r3, &(0x7f0000000240)='7777\n', 0x5)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sec\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000080)='./sec\x00', &(0x7f00000000c0)='securityfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0)
write(r0, &(0x7f0000000200)='path_group G1 /bin/true\n', 0x18)
write(r0, &(0x7f0000000300)='delete path_group G1 /bin/true\n', 0x1f)
close(r0)
nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sec/tomoyo/exception_policy\x00', 0x2, 0x0)
write(r1, &(0x7f0000000200)='path_group G2 /bin/false\n', 0x19)
write(r1, &(0x7f0000000300)='delete path_group G2 /bin/false\n', 0x20)
close(r1)
nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0)
write(0xffffffffffffffff, &(0x7f0000000200)='path_group G3 /bin/sh\n', 0x16)
write(0xffffffffffffffff, &(0x7f0000000300)='delete path_group G3 /bin/sh\n', 0x1d)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 10, 1, 22]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(&(0x7f0000000500), &(0x7f0000000400)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1770, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0xd0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0xff, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0x81, 0x7, 0xe}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0900a11e0901a1006d08950109309102c0c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/leds/0003:1770:FF00.0001::back/brightness\x00', 0x2, 0x0)
write(r1, &(0x7f0000000780)='1\n\x00', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/class/leds/0003:1770:FF00.0001::back/gt683r/mode\x00', 0x2, 0x0)
write(r2, &(0x7f0000000880)='1\n\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/leds/0003:1770:FF00.0002::back/brightness\x00', 0x2, 0x0)
write(r3, &(0x7f0000000980)='1\n\x00', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/class/leds/0003:1770:FF00.0002::back/gt683r/mode\x00', 0x2, 0x0)
write(r4, &(0x7f0000000a80)='1\n\x00', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/class/leds/0003:1770:FF00.0003::back/brightness\x00', 0x2, 0x0)
write(r5, &(0x7f0000000b80)='1\n\x00', 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./sys/class/leds/0003:1770:FF00.0003::back/gt683r/mode\x00', 0x2, 0x0)
write(r6, &(0x7f0000000c80)='1\n\x00', 0x2)
write(0xffffffffffffffff, &(0x7f0000000e80)='1\n\x00', 0x2)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r1, &(0x7f0000000440)='localhost /tmp 2147483647 9218 65534 65534 0\n', 0x2d)
executing program 0:
nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program crashed: KASAN: use-after-free Read in nfsd_svc
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <3>
bisect: split chunk #0 of len 3 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 22]
detailed listing:
executing program 0:
nanosleep(&(0x7f0000000800)={0x0, 0x5f5e100}, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 10, 22]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(&(0x7f0000000500), &(0x7f0000000400)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1770, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0xd0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0xff, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0x81, 0x7, 0xe}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0900a11e0901a1006d08950109309102c0c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/leds/0003:1770:FF00.0001::back/brightness\x00', 0x2, 0x0)
write(r1, &(0x7f0000000780)='1\n\x00', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/class/leds/0003:1770:FF00.0001::back/gt683r/mode\x00', 0x2, 0x0)
write(r2, &(0x7f0000000880)='1\n\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/leds/0003:1770:FF00.0002::back/brightness\x00', 0x2, 0x0)
write(r3, &(0x7f0000000980)='1\n\x00', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/class/leds/0003:1770:FF00.0002::back/gt683r/mode\x00', 0x2, 0x0)
write(r4, &(0x7f0000000a80)='1\n\x00', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/class/leds/0003:1770:FF00.0003::back/brightness\x00', 0x2, 0x0)
write(r5, &(0x7f0000000b80)='1\n\x00', 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./sys/class/leds/0003:1770:FF00.0003::back/gt683r/mode\x00', 0x2, 0x0)
write(r6, &(0x7f0000000c80)='1\n\x00', 0x2)
write(0xffffffffffffffff, &(0x7f0000000e80)='1\n\x00', 0x2)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r1, &(0x7f0000000440)='localhost /tmp 2147483647 9218 65534 65534 0\n', 0x2d)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program crashed: KASAN: use-after-free Read in nfsd_svc
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <2>
bisect: split chunk #0 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 22]
detailed listing:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r1, &(0x7f0000000440)='localhost /tmp 2147483647 9218 65534 65534 0\n', 0x2d)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 22]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(&(0x7f0000000500), &(0x7f0000000400)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1770, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0xd0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0xff, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0x81, 0x7, 0xe}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0900a11e0901a1006d08950109309102c0c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/leds/0003:1770:FF00.0001::back/brightness\x00', 0x2, 0x0)
write(r1, &(0x7f0000000780)='1\n\x00', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/class/leds/0003:1770:FF00.0001::back/gt683r/mode\x00', 0x2, 0x0)
write(r2, &(0x7f0000000880)='1\n\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/leds/0003:1770:FF00.0002::back/brightness\x00', 0x2, 0x0)
write(r3, &(0x7f0000000980)='1\n\x00', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/class/leds/0003:1770:FF00.0002::back/gt683r/mode\x00', 0x2, 0x0)
write(r4, &(0x7f0000000a80)='1\n\x00', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/class/leds/0003:1770:FF00.0003::back/brightness\x00', 0x2, 0x0)
write(r5, &(0x7f0000000b80)='1\n\x00', 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./sys/class/leds/0003:1770:FF00.0003::back/gt683r/mode\x00', 0x2, 0x0)
write(r6, &(0x7f0000000c80)='1\n\x00', 0x2)
write(0xffffffffffffffff, &(0x7f0000000e80)='1\n\x00', 0x2)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program did not crash
bisect: split chunks (needed=true): <1>, <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: split chunk #1 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 3 programs left: 

executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(&(0x7f0000000500), &(0x7f0000000400)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1770, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0xd0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0xff, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0x81, 0x7, 0xe}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0900a11e0901a1006d08950109309102c0c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/leds/0003:1770:FF00.0001::back/brightness\x00', 0x2, 0x0)
write(r1, &(0x7f0000000780)='1\n\x00', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/class/leds/0003:1770:FF00.0001::back/gt683r/mode\x00', 0x2, 0x0)
write(r2, &(0x7f0000000880)='1\n\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/leds/0003:1770:FF00.0002::back/brightness\x00', 0x2, 0x0)
write(r3, &(0x7f0000000980)='1\n\x00', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/class/leds/0003:1770:FF00.0002::back/gt683r/mode\x00', 0x2, 0x0)
write(r4, &(0x7f0000000a80)='1\n\x00', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/class/leds/0003:1770:FF00.0003::back/brightness\x00', 0x2, 0x0)
write(r5, &(0x7f0000000b80)='1\n\x00', 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./sys/class/leds/0003:1770:FF00.0003::back/gt683r/mode\x00', 0x2, 0x0)
write(r6, &(0x7f0000000c80)='1\n\x00', 0x2)
write(0xffffffffffffffff, &(0x7f0000000e80)='1\n\x00', 0x2)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r1, &(0x7f0000000440)='localhost /tmp 2147483647 9218 65534 65534 0\n', 0x2d)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)


bisect: trying to concatenate
bisect: concatenate 3 entries
minimizing program #0 before concatenation
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 10, 22]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(&(0x7f0000000500), &(0x7f0000000400)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1770, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0xd0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0xff, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0x81, 0x7, 0xe}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0900a11e0901a1006d08950109309102c0c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/leds/0003:1770:FF00.0001::back/brightness\x00', 0x2, 0x0)
write(r1, &(0x7f0000000780)='1\n\x00', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/class/leds/0003:1770:FF00.0001::back/gt683r/mode\x00', 0x2, 0x0)
write(r2, &(0x7f0000000880)='1\n\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/leds/0003:1770:FF00.0002::back/brightness\x00', 0x2, 0x0)
write(r3, &(0x7f0000000980)='1\n\x00', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/class/leds/0003:1770:FF00.0002::back/gt683r/mode\x00', 0x2, 0x0)
write(r4, &(0x7f0000000a80)='1\n\x00', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/class/leds/0003:1770:FF00.0003::back/brightness\x00', 0x2, 0x0)
write(r5, &(0x7f0000000b80)='1\n\x00', 0x2)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./sys/class/leds/0003:1770:FF00.0003::back/gt683r/mode\x00', 0x2, 0x0)
write(r6, &(0x7f0000000c80)='1\n\x00', 0x2)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r1, &(0x7f0000000440)='localhost /tmp 2147483647 9218 65534 65534 0\n', 0x2d)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program crashed: KASAN: use-after-free Read in nfsd_svc
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 10, 22]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(&(0x7f0000000500), &(0x7f0000000400)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1770, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0xd0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0xff, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0x81, 0x7, 0xe}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0900a11e0901a1006d08950109309102c0c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/leds/0003:1770:FF00.0001::back/brightness\x00', 0x2, 0x0)
write(r1, &(0x7f0000000780)='1\n\x00', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/class/leds/0003:1770:FF00.0001::back/gt683r/mode\x00', 0x2, 0x0)
write(r2, &(0x7f0000000880)='1\n\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/leds/0003:1770:FF00.0002::back/brightness\x00', 0x2, 0x0)
write(r3, &(0x7f0000000980)='1\n\x00', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/class/leds/0003:1770:FF00.0002::back/gt683r/mode\x00', 0x2, 0x0)
write(r4, &(0x7f0000000a80)='1\n\x00', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/class/leds/0003:1770:FF00.0003::back/brightness\x00', 0x2, 0x0)
write(r5, &(0x7f0000000b80)='1\n\x00', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000c00)='./sys/class/leds/0003:1770:FF00.0003::back/gt683r/mode\x00', 0x2, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r1, &(0x7f0000000440)='localhost /tmp 2147483647 9218 65534 65534 0\n', 0x2d)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 10, 22]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(&(0x7f0000000500), &(0x7f0000000400)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1770, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0xd0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0xff, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0x81, 0x7, 0xe}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0900a11e0901a1006d08950109309102c0c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/leds/0003:1770:FF00.0001::back/brightness\x00', 0x2, 0x0)
write(r1, &(0x7f0000000780)='1\n\x00', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/class/leds/0003:1770:FF00.0001::back/gt683r/mode\x00', 0x2, 0x0)
write(r2, &(0x7f0000000880)='1\n\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/leds/0003:1770:FF00.0002::back/brightness\x00', 0x2, 0x0)
write(r3, &(0x7f0000000980)='1\n\x00', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/class/leds/0003:1770:FF00.0002::back/gt683r/mode\x00', 0x2, 0x0)
write(r4, &(0x7f0000000a80)='1\n\x00', 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/class/leds/0003:1770:FF00.0003::back/brightness\x00', 0x2, 0x0)
write(r5, &(0x7f0000000b80)='1\n\x00', 0x2)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r1, &(0x7f0000000440)='localhost /tmp 2147483647 9218 65534 65534 0\n', 0x2d)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program crashed: KASAN: use-after-free Read in nfsd_svc
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 10, 22]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(&(0x7f0000000500), &(0x7f0000000400)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1770, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0xd0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0xff, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0x81, 0x7, 0xe}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0900a11e0901a1006d08950109309102c0c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/leds/0003:1770:FF00.0001::back/brightness\x00', 0x2, 0x0)
write(r1, &(0x7f0000000780)='1\n\x00', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/class/leds/0003:1770:FF00.0001::back/gt683r/mode\x00', 0x2, 0x0)
write(r2, &(0x7f0000000880)='1\n\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/leds/0003:1770:FF00.0002::back/brightness\x00', 0x2, 0x0)
write(r3, &(0x7f0000000980)='1\n\x00', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/class/leds/0003:1770:FF00.0002::back/gt683r/mode\x00', 0x2, 0x0)
write(r4, &(0x7f0000000a80)='1\n\x00', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000b00)='./sys/class/leds/0003:1770:FF00.0003::back/brightness\x00', 0x2, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r1, &(0x7f0000000440)='localhost /tmp 2147483647 9218 65534 65534 0\n', 0x2d)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program crashed: KASAN: use-after-free Read in nfsd_svc
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 10, 22]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(&(0x7f0000000500), &(0x7f0000000400)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1770, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0xd0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0xff, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0x81, 0x7, 0xe}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0900a11e0901a1006d08950109309102c0c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/leds/0003:1770:FF00.0001::back/brightness\x00', 0x2, 0x0)
write(r1, &(0x7f0000000780)='1\n\x00', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/class/leds/0003:1770:FF00.0001::back/gt683r/mode\x00', 0x2, 0x0)
write(r2, &(0x7f0000000880)='1\n\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/leds/0003:1770:FF00.0002::back/brightness\x00', 0x2, 0x0)
write(r3, &(0x7f0000000980)='1\n\x00', 0x2)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/class/leds/0003:1770:FF00.0002::back/gt683r/mode\x00', 0x2, 0x0)
write(r4, &(0x7f0000000a80)='1\n\x00', 0x2)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r1, &(0x7f0000000440)='localhost /tmp 2147483647 9218 65534 65534 0\n', 0x2d)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program crashed: KASAN: use-after-free Read in nfsd_svc
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 10, 22]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(&(0x7f0000000500), &(0x7f0000000400)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1770, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0xd0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0xff, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0x81, 0x7, 0xe}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0900a11e0901a1006d08950109309102c0c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/leds/0003:1770:FF00.0001::back/brightness\x00', 0x2, 0x0)
write(r1, &(0x7f0000000780)='1\n\x00', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/class/leds/0003:1770:FF00.0001::back/gt683r/mode\x00', 0x2, 0x0)
write(r2, &(0x7f0000000880)='1\n\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/leds/0003:1770:FF00.0002::back/brightness\x00', 0x2, 0x0)
write(r3, &(0x7f0000000980)='1\n\x00', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/class/leds/0003:1770:FF00.0002::back/gt683r/mode\x00', 0x2, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r1, &(0x7f0000000440)='localhost /tmp 2147483647 9218 65534 65534 0\n', 0x2d)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program crashed: KASAN: use-after-free Read in nfsd_svc
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 10, 22]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(&(0x7f0000000500), &(0x7f0000000400)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1770, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0xd0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0xff, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0x81, 0x7, 0xe}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0900a11e0901a1006d08950109309102c0c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/leds/0003:1770:FF00.0001::back/brightness\x00', 0x2, 0x0)
write(r1, &(0x7f0000000780)='1\n\x00', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/class/leds/0003:1770:FF00.0001::back/gt683r/mode\x00', 0x2, 0x0)
write(r2, &(0x7f0000000880)='1\n\x00', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/leds/0003:1770:FF00.0002::back/brightness\x00', 0x2, 0x0)
write(r3, &(0x7f0000000980)='1\n\x00', 0x2)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r1, &(0x7f0000000440)='localhost /tmp 2147483647 9218 65534 65534 0\n', 0x2d)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program crashed: KASAN: use-after-free Read in nfsd_svc
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 10, 22]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(&(0x7f0000000500), &(0x7f0000000400)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1770, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0xd0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0xff, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0x81, 0x7, 0xe}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0900a11e0901a1006d08950109309102c0c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/leds/0003:1770:FF00.0001::back/brightness\x00', 0x2, 0x0)
write(r1, &(0x7f0000000780)='1\n\x00', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/class/leds/0003:1770:FF00.0001::back/gt683r/mode\x00', 0x2, 0x0)
write(r2, &(0x7f0000000880)='1\n\x00', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/leds/0003:1770:FF00.0002::back/brightness\x00', 0x2, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r1, &(0x7f0000000440)='localhost /tmp 2147483647 9218 65534 65534 0\n', 0x2d)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program crashed: KASAN: use-after-free Read in nfsd_svc
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 10, 22]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(&(0x7f0000000500), &(0x7f0000000400)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1770, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0xd0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0xff, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0x81, 0x7, 0xe}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0900a11e0901a1006d08950109309102c0c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/leds/0003:1770:FF00.0001::back/brightness\x00', 0x2, 0x0)
write(r1, &(0x7f0000000780)='1\n\x00', 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/class/leds/0003:1770:FF00.0001::back/gt683r/mode\x00', 0x2, 0x0)
write(r2, &(0x7f0000000880)='1\n\x00', 0x2)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r1, &(0x7f0000000440)='localhost /tmp 2147483647 9218 65534 65534 0\n', 0x2d)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program crashed: KASAN: use-after-free Read in nfsd_svc
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 10, 22]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(&(0x7f0000000500), &(0x7f0000000400)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1770, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0xd0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0xff, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0x81, 0x7, 0xe}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0900a11e0901a1006d08950109309102c0c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/leds/0003:1770:FF00.0001::back/brightness\x00', 0x2, 0x0)
write(r1, &(0x7f0000000780)='1\n\x00', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/class/leds/0003:1770:FF00.0001::back/gt683r/mode\x00', 0x2, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r1, &(0x7f0000000440)='localhost /tmp 2147483647 9218 65534 65534 0\n', 0x2d)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program crashed: KASAN: use-after-free Read in nfsd_svc
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 10, 22]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(&(0x7f0000000500), &(0x7f0000000400)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1770, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0xd0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0xff, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0x81, 0x7, 0xe}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0900a11e0901a1006d08950109309102c0c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/leds/0003:1770:FF00.0001::back/brightness\x00', 0x2, 0x0)
write(r1, &(0x7f0000000780)='1\n\x00', 0x2)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r1, &(0x7f0000000440)='localhost /tmp 2147483647 9218 65534 65534 0\n', 0x2d)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program crashed: KASAN: use-after-free Read in nfsd_svc
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 10, 22]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(&(0x7f0000000500), &(0x7f0000000400)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1770, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0xd0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0xff, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0x81, 0x7, 0xe}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0900a11e0901a1006d08950109309102c0c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/class/leds/0003:1770:FF00.0001::back/brightness\x00', 0x2, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r1, &(0x7f0000000440)='localhost /tmp 2147483647 9218 65534 65534 0\n', 0x2d)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program crashed: KASAN: use-after-free Read in nfsd_svc
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 10, 22]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(&(0x7f0000000500), &(0x7f0000000400)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1770, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0xd0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0xff, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0x81, 0x7, 0xe}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0900a11e0901a1006d08950109309102c0c0"], 0x0}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r1, &(0x7f0000000440)='localhost /tmp 2147483647 9218 65534 65534 0\n', 0x2d)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program crashed: KASAN: use-after-free Read in nfsd_svc
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 10, 22]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(&(0x7f0000000500), &(0x7f0000000400)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1770, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0xd0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0xff, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0x81, 0x7, 0xe}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022180000000501150025ff0900a11e0901a1006d08950109309102c0c0"], 0x0}, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r1, &(0x7f0000000440)='localhost /tmp 2147483647 9218 65534 65534 0\n', 0x2d)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 10, 22]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(&(0x7f0000000500), &(0x7f0000000400)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0)
r0 = syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1770, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0xd0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0xff, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0x81, 0x7, 0xe}}]}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r1, &(0x7f0000000440)='localhost /tmp 2147483647 9218 65534 65534 0\n', 0x2d)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 10, 22]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(&(0x7f0000000500), &(0x7f0000000400)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0)
syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1770, 0xff00, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0xd0, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0xff, 0x1, {0x22, 0x18}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0x81, 0x7, 0xe}}]}}}]}}]}}, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r1, &(0x7f0000000440)='localhost /tmp 2147483647 9218 65534 65534 0\n', 0x2d)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program crashed: KASAN: use-after-free Read in nfsd_svc
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 10, 22]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
mount(&(0x7f0000000500), &(0x7f0000000400)='./sys\x00', &(0x7f0000000600)='sysfs\x00', 0x0, 0x0)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r1, &(0x7f0000000440)='localhost /tmp 2147483647 9218 65534 65534 0\n', 0x2d)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program crashed: KASAN: use-after-free Read in nfsd_svc
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 10, 22]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./sys\x00', 0x1ff)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r1, &(0x7f0000000440)='localhost /tmp 2147483647 9218 65534 65534 0\n', 0x2d)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program crashed: KASAN: use-after-free Read in nfsd_svc
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 10, 22]
detailed listing:
executing program 0:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
write(r1, &(0x7f0000000440)='localhost /tmp 2147483647 9218 65534 65534 0\n', 0x2d)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program crashed: KASAN: use-after-free Read in nfsd_svc
minimized 19 calls -> 0 calls
minimizing program #1 before concatenation
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 9, 22]
detailed listing:
executing program 2:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000400)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program crashed: KASAN: use-after-free Read in nfsd_svc
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 8, 22]
detailed listing:
executing program 2:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/threads\x00', 0x2, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program crashed: KASAN: use-after-free Read in nfsd_svc
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 7, 22]
detailed listing:
executing program 2:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
close(r0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program crashed: KASAN: use-after-free Read in nfsd_svc
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 6, 22]
detailed listing:
executing program 2:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program crashed: KASAN: use-after-free Read in nfsd_svc
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 22]
detailed listing:
executing program 2:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 22]
detailed listing:
executing program 2:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)='tcp 2049\n', 0x9)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 22]
detailed listing:
executing program 2:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program crashed: KASAN: use-after-free Read in nfsd_svc
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 22]
detailed listing:
executing program 2:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program crashed: KASAN: use-after-free Read in nfsd_svc
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 3, 22]
detailed listing:
executing program 2:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 3, 22]
detailed listing:
executing program 2:
executing program 0:
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)
write(r5, &(0x7f0000000500)='1\n', 0x2)

program did not crash
minimized 10 calls -> 4 calls
minimizing program #2 before concatenation
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 21]
detailed listing:
executing program 2:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000004c0)='./nfsd/threads\x00', 0x2, 0x0)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 20]
detailed listing:
executing program 2:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)
openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/portlist\x00', 0x2, 0x0)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 19]
detailed listing:
executing program 2:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)
close(r4)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 18]
detailed listing:
executing program 2:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)
write(r4, &(0x7f0000000400)='1\n', 0x2)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 17]
detailed listing:
executing program 2:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/nfsv4gracetime\x00', 0x2, 0x0)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 16]
detailed listing:
executing program 2:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000380)='nfsd\x00', 0x0, 0x0)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 15]
detailed listing:
executing program 2:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd\x00', 0x1ff)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 14]
detailed listing:
executing program 2:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)
close(r3)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 13]
detailed listing:
executing program 2:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)
write(r3, &(0x7f0000000280)='3\n', 0x2)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 12]
detailed listing:
executing program 2:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/sys/fs/nfs/nlm_timeout\x00', 0x2, 0x0)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 11]
detailed listing:
executing program 2:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
close(r2)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 10]
detailed listing:
executing program 2:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 9]
detailed listing:
executing program 2:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)
openat(0xffffffffffffff9c, &(0x7f00000001c0)='./proc/sys/fs/nfs/nlm_grace_period\x00', 0x2, 0x0)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 8]
detailed listing:
executing program 2:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)
close(r1)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 7]
detailed listing:
executing program 2:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)
write(r1, &(0x7f0000000180)='20000\n', 0x6)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 6]
detailed listing:
executing program 2:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)
openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/sys/fs/nfs/nlm_tcpport\x00', 0x2, 0x0)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 5]
detailed listing:
executing program 2:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)
close(r0)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 4]
detailed listing:
executing program 2:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)
write(r0, &(0x7f0000000100)='20000\n', 0x6)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 3]
detailed listing:
executing program 2:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc/sys/fs/nfs/nlm_udpport\x00', 0x2, 0x0)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 2]
detailed listing:
executing program 2:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(&(0x7f0000000040)=@filename='none\x00', &(0x7f0000000000)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 1]
detailed listing:
executing program 2:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)

program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 0]
detailed listing:
executing program 2:
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)
executing program 0:

program crashed: kernel BUG in svc_destroy
minimized 22 calls -> 0 calls
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)

program crashed: kernel BUG in svc_destroy
bisect: concatenation succeeded
found reproducer with 4 syscalls
minimizing guilty program
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000240)='tcp 2049\n', 0x9)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)

program crashed: lost connection to test machine
suppressed program crash: lost connection to test machine
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, 0x0, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240), 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
simplifying C reproducer
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program did not crash
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program did not crash
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)

program crashed: kernel BUG in svc_destroy
validation run: crashed=true
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)

program crashed: kernel BUG in svc_destroy
validation run: crashed=true
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000240)='tcp 2049\n', 0x9)

program crashed: kernel BUG in svc_destroy
validation run: crashed=true
reproducing took 2h12m25.652046342s
repro crashed as (corrupted=false):
------------[ cut here ]------------
kernel BUG at net/sunrpc/svc.c:605!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 4426 Comm: syz.0.18 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:svc_destroy+0x184/0x190 net/sunrpc/svc.c:605
Code: 5f 5d e9 bf b1 62 f8 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 24 ff ff ff 4c 89 ff e8 66 3f 7b f8 e9 17 ff ff ff e8 ac fa 29 f8 <0f> 0b e8 a5 fa 29 f8 0f 0b 0f 1f 00 55 41 57 41 56 41 55 41 54 53
RSP: 0018:ffffc90004327b10 EFLAGS: 00010293
RAX: ffffffff89583834 RBX: ffff888026e34c50 RCX: ffff888030215a00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90004327cb8 R08: ffffffff90b0f357 R09: 1ffffffff2161e6a
R10: dffffc0000000000 R11: fffffbfff2161e6b R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff888026e34c68 R15: 0000000000000001
FS:  000055556318f500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f49bb75da08 CR3: 000000002eaf8000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 kref_put include/linux/kref.h:65 [inline]
 svc_put include/linux/sunrpc/svc.h:123 [inline]
 __write_ports_addxprt fs/nfsd/nfsctl.c:768 [inline]
 __write_ports fs/nfsd/nfsctl.c:794 [inline]
 write_ports+0xa26/0xb80 fs/nfsd/nfsctl.c:847
 nfsctl_transaction_write+0x105/0x150 fs/nfsd/nfsctl.c:114
 vfs_write+0x2dc/0x9a0 fs/read_write.c:582
 ksys_write+0x14d/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f49ba99e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe5aee6f98 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f49bac25fa0 RCX: 00007f49ba99e159
RDX: 0000000000000009 RSI: 0000200000000240 RDI: 0000000000000003
RBP: 00007f49baa3503b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f49bac25fac R14: 00007f49bac25fa0 R15: 00007f49bac25fa0
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:svc_destroy+0x184/0x190 net/sunrpc/svc.c:605
Code: 5f 5d e9 bf b1 62 f8 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 24 ff ff ff 4c 89 ff e8 66 3f 7b f8 e9 17 ff ff ff e8 ac fa 29 f8 <0f> 0b e8 a5 fa 29 f8 0f 0b 0f 1f 00 55 41 57 41 56 41 55 41 54 53
RSP: 0018:ffffc90004327b10 EFLAGS: 00010293
RAX: ffffffff89583834 RBX: ffff888026e34c50 RCX: ffff888030215a00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90004327cb8 R08: ffffffff90b0f357 R09: 1ffffffff2161e6a
R10: dffffc0000000000 R11: fffffbfff2161e6b R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff888026e34c68 R15: 0000000000000001
FS:  000055556318f500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f49ba870050 CR3: 000000002eaf8000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

final repro crashed as (corrupted=false):
------------[ cut here ]------------
kernel BUG at net/sunrpc/svc.c:605!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 4426 Comm: syz.0.18 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:svc_destroy+0x184/0x190 net/sunrpc/svc.c:605
Code: 5f 5d e9 bf b1 62 f8 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 24 ff ff ff 4c 89 ff e8 66 3f 7b f8 e9 17 ff ff ff e8 ac fa 29 f8 <0f> 0b e8 a5 fa 29 f8 0f 0b 0f 1f 00 55 41 57 41 56 41 55 41 54 53
RSP: 0018:ffffc90004327b10 EFLAGS: 00010293
RAX: ffffffff89583834 RBX: ffff888026e34c50 RCX: ffff888030215a00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90004327cb8 R08: ffffffff90b0f357 R09: 1ffffffff2161e6a
R10: dffffc0000000000 R11: fffffbfff2161e6b R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff888026e34c68 R15: 0000000000000001
FS:  000055556318f500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f49bb75da08 CR3: 000000002eaf8000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 kref_put include/linux/kref.h:65 [inline]
 svc_put include/linux/sunrpc/svc.h:123 [inline]
 __write_ports_addxprt fs/nfsd/nfsctl.c:768 [inline]
 __write_ports fs/nfsd/nfsctl.c:794 [inline]
 write_ports+0xa26/0xb80 fs/nfsd/nfsctl.c:847
 nfsctl_transaction_write+0x105/0x150 fs/nfsd/nfsctl.c:114
 vfs_write+0x2dc/0x9a0 fs/read_write.c:582
 ksys_write+0x14d/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f49ba99e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe5aee6f98 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f49bac25fa0 RCX: 00007f49ba99e159
RDX: 0000000000000009 RSI: 0000200000000240 RDI: 0000000000000003
RBP: 00007f49baa3503b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f49bac25fac R14: 00007f49bac25fa0 R15: 00007f49bac25fa0
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:svc_destroy+0x184/0x190 net/sunrpc/svc.c:605
Code: 5f 5d e9 bf b1 62 f8 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 24 ff ff ff 4c 89 ff e8 66 3f 7b f8 e9 17 ff ff ff e8 ac fa 29 f8 <0f> 0b e8 a5 fa 29 f8 0f 0b 0f 1f 00 55 41 57 41 56 41 55 41 54 53
RSP: 0018:ffffc90004327b10 EFLAGS: 00010293
RAX: ffffffff89583834 RBX: ffff888026e34c50 RCX: ffff888030215a00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90004327cb8 R08: ffffffff90b0f357 R09: 1ffffffff2161e6a
R10: dffffc0000000000 R11: fffffbfff2161e6b R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff888026e34c68 R15: 0000000000000001
FS:  000055556318f500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f49ba870050 CR3: 000000002eaf8000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400