Extracting prog: 1h15m50.07937524s
Minimizing prog: 16m3.639852797s
Simplifying prog options: 0s
Extracting C: 49.937667353s
Simplifying C: 9m40.041344322s


extracting reproducer from 60 programs
testing a last program of every proc
single: executing 15 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$rds-socket$rds-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-setsockopt$RDS_CANCEL_SENT_TO-openat$sequencer-syz_open_dev$radio-syz_open_dev$sndmidi-writev-socket$nl_sock_diag-bpf$PROG_LOAD-openat-creat-fanotify_init-fanotify_mark
detailed listing:
executing program 0:
r0 = socket$rds(0x15, 0x5, 0x0)
socket$rds(0x15, 0x5, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x5)
setsockopt$RDS_CANCEL_SENT_TO(r0, 0x114, 0x1, &(0x7f0000000740)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080), 0x80200, 0x0)
syz_open_dev$radio(0x0, 0x2, 0x2)
r1 = syz_open_dev$sndmidi(&(0x7f00000000c0), 0x2, 0x141102)
writev(r1, &(0x7f0000000100)=[{&(0x7f0000000140)="94", 0xf000}, {0x0}], 0x2)
socket$nl_sock_diag(0x10, 0x3, 0x4)
bpf$PROG_LOAD(0x5, &(0x7f0000001ac0)={0x1, 0x4, &(0x7f0000001c00)=ANY=[@ANYBLOB="1800000003000000000000008100000085200000ad4403009500000000000000ff423d835f24fa00488a08e63d69863c3612c5af3030bd0b0ae3973cba5a4042dea6838502f7b7c890b7c702a2c89b9840b6552602e6"], &(0x7f0000001bc0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xcae3c2511b326ebe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x42, 0x0)
r2 = creat(&(0x7f0000000240)='./file1\x00', 0x108)
r3 = fanotify_init(0xf00, 0x1)
fanotify_mark(r3, 0x105, 0x40009975, r2, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-fsetxattr-getpgrp-sched_setaffinity-prctl$PR_SCHED_CORE-getpid-sched_setscheduler-mmap-syz_clone-prctl$PR_SCHED_CORE-syz_open_dev$MSR-ioctl$XFS_IOC_RTGROUP_GEOMETRY-read$msr-socketpair$unix-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-socket$inet6-writev
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x8)
fsetxattr(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f00000001c0)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x1b5cb000)
r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0)
r3 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0)
ioctl$XFS_IOC_RTGROUP_GEOMETRY(0xffffffffffffffff, 0xc0805841, &(0x7f0000000240)={0x2, 0xfffff6dd, 0x0, 0x100, 0x1})
read$msr(r3, &(0x7f0000000a00)=""/102392, 0x18ff8)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040))
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000040c00028008000140fffff2"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40)
r5 = socket$inet6(0xa, 0x3, 0x3c)
writev(r5, &(0x7f0000000700)=[{&(0x7f0000000740)=',', 0xffdf}], 0x1)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-fsetxattr-prctl$PR_SCHED_CORE-getpid-sched_setscheduler-mmap-syz_clone-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-socket$inet6-connect$inet6-writev
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f00000000c0)=0x8)
fsetxattr(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f00000001c0)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x1b5cb000)
r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0)
r2 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0)
read$msr(r2, &(0x7f0000000a00)=""/102392, 0x18ff8)
r3 = socket$inet6(0xa, 0x3, 0x3c)
connect$inet6(r3, &(0x7f00000006c0)={0xa, 0x5000, 0x6, @loopback, 0x7}, 0x1c)
writev(r3, &(0x7f0000000700)=[{0x0}], 0x1)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$inet6_sctp-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socketpair$unix-sendmmsg$unix-recvmmsg-sched_setscheduler-openat$procfs-lseek
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x36, 0x0, 0x0)
socket$inet6_sctp(0xa, 0x5, 0x84)
prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000280)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f00000002c0)=0x7)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
sendmmsg$unix(r2, &(0x7f00000003c0), 0x651, 0x0)
recvmmsg(r1, &(0x7f0000000400), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000440)=0x6)
r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000480)='/proc/asound/seq/clients\x00', 0x0, 0x0)
lseek(r3, 0x9, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mprotect-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-openat$sequencer-syz_open_dev$sndmidi-writev-mkdirat-openat-write-ioctl$PTP_ENABLE_PPS-mount-openat-read-getrlimit-write$tun-ioctl$UFFDIO_COPY-sendmsg$NBD_CMD_CONNECT-socket-ioctl$ifreq_SIOCGIFINDEX_team-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$BLKTRACESETUP-socket$nl_route-socket-sendmsg$nl_route_sched-sendmsg$nl_route
detailed listing:
executing program 0:
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x3000003)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080), 0x80200, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000000c0), 0x2, 0x141102)
writev(r0, &(0x7f0000000100)=[{&(0x7f0000000140)="94", 0xf000}, {0x0}], 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./sys_sec\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='10', 0x2)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
mount(0x0, &(0x7f0000000200)='./sys_sec\x00', &(0x7f0000000240)='securityfs\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys_sec/tomoyo/domain_policy\x00', 0x2, 0x0)
read(r2, &(0x7f00000002c0)=""/9, 0xfffffd87)
getrlimit(0x9, &(0x7f0000000300))
write$tun(r2, &(0x7f00000001c0)=ANY=[@ANYRES8=r1], 0xffe)
ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, 0x0)
sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="0100fdffffff0000000001000000100007800c00018008000100", @ANYRES32, @ANYBLOB="08000100000040000c000200ff7f000000000000"], 0x38}}, 0x20000000)
socket(0x40000000015, 0x5, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000640))
r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="10000000040000000800000005"], 0x48)
r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x6, 0xc, &(0x7f0000000b80)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000b703000000000000850000003300000095"], &(0x7f0000000c00)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c40)={r4, 0x2000000, 0xe, 0x0, &(0x7f0000000cc0)="0000000002000000000000000000", 0x0, 0x3000002, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000d00)={'\x00', 0x1, 0x2, 0x1, 0xd2, 0x9, 0xffffffffffffffff})
r5 = socket$nl_route(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route_sched(r6, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={0x0, 0x24}}, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES32, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mprotect-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-openat$sequencer-syz_open_dev$sndmidi-writev-mkdirat-openat-write-ioctl$PTP_ENABLE_PPS-mount-openat-read-getrlimit-write$tun-ioctl$UFFDIO_COPY-sendmsg$NBD_CMD_CONNECT-socket-ioctl$ifreq_SIOCGIFINDEX_team-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$BLKTRACESETUP-socket$nl_route-socket-sendmsg$nl_route_sched-sendmsg$nl_route
detailed listing:
executing program 0:
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x3000003)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080), 0x80200, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000000c0), 0x2, 0x141102)
writev(r0, &(0x7f0000000100)=[{&(0x7f0000000140)="94", 0xf000}, {0x0}], 0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./sys_sec\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(r1, &(0x7f0000000480)='10', 0x2)
ioctl$PTP_ENABLE_PPS(r1, 0x40043d04, 0x1)
mount(0x0, &(0x7f0000000200)='./sys_sec\x00', &(0x7f0000000240)='securityfs\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys_sec/tomoyo/domain_policy\x00', 0x2, 0x0)
read(r2, &(0x7f00000002c0)=""/9, 0xfffffd87)
getrlimit(0x9, &(0x7f0000000300))
write$tun(r2, &(0x7f00000001c0)=ANY=[@ANYRES8=r1], 0xffe)
ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, 0x0)
sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="0100fdffffff0000000001000000100007800c00018008000100", @ANYRES32, @ANYBLOB="08000100000040000c000200ff7f000000000000"], 0x38}}, 0x20000000)
socket(0x40000000015, 0x5, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000640))
r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="10000000040000000800000005"], 0x48)
r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x6, 0xc, &(0x7f0000000b80)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000b703000000000000850000003300000095"], &(0x7f0000000c00)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c40)={r4, 0x2000000, 0xe, 0x0, &(0x7f0000000cc0)="0000000002000000000000000000", 0x0, 0x3000002, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000d00)={'\x00', 0x1, 0x2, 0x1, 0xd2, 0x9, 0xffffffffffffffff})
r5 = socket$nl_route(0x10, 0x3, 0x0)
r6 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route_sched(r6, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={0x0, 0x24}}, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES32, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): preadv-prlimit64-sched_setscheduler-sched_setaffinity-prctl$PR_SCHED_CORE-getpid-sched_setscheduler-mmap-syz_clone-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-timer_create-setrlimit-socket$packet-setsockopt$packet_fanout-syz_emit_ethernet-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-socket$inet_udp-close-mount$9p_fd-socket$nl_netfilter-mkdirat-mount-openat-write
detailed listing:
executing program 0:
preadv(0xffffffffffffffff, 0x0, 0x0, 0x8000000000000001, 0x0)
prlimit64(0x0, 0xe, 0x0, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7)
sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x8031, 0xffffffffffffffff, 0xb2e45000)
r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0)
r2 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0)
read$msr(r2, &(0x7f0000000200)=""/102368, 0x18fe0)
timer_create(0x0, 0x0, &(0x7f0000019240))
setrlimit(0xd, 0x0)
r3 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000140)={0x0, 0xfd01}, 0x4)
syz_emit_ethernet(0x1d, 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000019340)={0x11, 0x8, &(0x7f0000019400)=ANY=[@ANYBLOB], 0x0, 0x3, 0x0, 0x0, 0x7376c40bedd761a3, 0xa}, 0x94)
r4 = socket$inet_udp(0x2, 0x2, 0x0)
close(r4)
mount$9p_fd(0x0, 0x0, 0x0, 0x801, &(0x7f0000019740)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@fscache}]}})
socket$nl_netfilter(0x10, 0x3, 0xc)
mkdirat(0xffffffffffffff9c, &(0x7f00000197c0)='./sys\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000019840)='sysfs\x00', 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r5, &(0x7f00000198c0)='n', 0x1)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): preadv-prlimit64-sched_setscheduler-sched_setaffinity-prctl$PR_SCHED_CORE-getpid-sched_setscheduler-mmap-syz_clone-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-timer_create-setrlimit-socket$packet-setsockopt$packet_fanout-syz_emit_ethernet-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-socket$inet_udp-close-mount$9p_fd-socket$nl_netfilter-mkdirat-mount-openat-write
detailed listing:
executing program 0:
preadv(0xffffffffffffffff, 0x0, 0x0, 0x8000000000000001, 0x0)
prlimit64(0x0, 0xe, 0x0, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7)
sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x8031, 0xffffffffffffffff, 0xb2e45000)
r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0)
r2 = syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x0)
read$msr(r2, &(0x7f0000000200)=""/102368, 0x18fe0)
timer_create(0x0, 0x0, &(0x7f0000019240))
setrlimit(0xd, 0x0)
r3 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000140)={0x0, 0xfd01}, 0x4)
syz_emit_ethernet(0x1d, 0x0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000019340)={0x11, 0x8, &(0x7f0000019400)=ANY=[@ANYBLOB], 0x0, 0x3, 0x0, 0x0, 0x7376c40bedd761a3, 0xa}, 0x94)
r4 = socket$inet_udp(0x2, 0x2, 0x0)
close(r4)
mount$9p_fd(0x0, 0x0, 0x0, 0x801, &(0x7f0000019740)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@fscache}]}})
socket$nl_netfilter(0x10, 0x3, 0xc)
mkdirat(0xffffffffffffff9c, &(0x7f00000197c0)='./sys\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000019840)='sysfs\x00', 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r5, &(0x7f00000198c0)='n', 0x1)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-mkdirat-mount-write-openat-write-openat-write-syz_usb_connect$hid
detailed listing:
executing program 0:
setns(0xc9, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd)
mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f00000008c0)='-2 -3 ', 0x6)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000940)='tcp 2', 0x5)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000009c0)='1', 0x1)
syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-mkdirat-mount-write-openat-write-openat-write-syz_usb_connect$hid
detailed listing:
executing program 0:
setns(0xc9, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd)
mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f00000008c0)='-2 -3 ', 0x6)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000940)='tcp 2', 0x5)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./nfsd/threads\x00', 0x2, 0x0)
write(r1, &(0x7f00000009c0)='1', 0x1)
syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-getpgrp-sched_setaffinity-prctl$PR_SCHED_CORE-sched_setscheduler-mmap-syz_clone-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-socket$kcm-sendmsg$kcm-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x400000000005)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0)
r2 = syz_open_dev$MSR(&(0x7f0000000140), 0x0, 0x0)
read$msr(r2, &(0x7f0000000980)=""/102392, 0x18ff8)
r3 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$kcm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)="48000000150081fb7059ae08060c04000aff0f11000000040011018701546fabca1b4e7d06a6bd7c493872f750375ed08a562af5745e17b8c119418f0f000000d6e74703c48f93b8", 0x48}], 0x1}, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x1a, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x18}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x34435}]}, &(0x7f0000000940)='GPL\x00', 0xa, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, 0x3d}, 0x94)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-getpgrp-sched_setaffinity-prctl$PR_SCHED_CORE-sched_setscheduler-mmap-syz_clone-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-socket$kcm-sendmsg$kcm-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpgrp(0x0)
sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x400000000005)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000)
r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0)
r2 = syz_open_dev$MSR(&(0x7f0000000140), 0x0, 0x0)
read$msr(r2, &(0x7f0000000980)=""/102392, 0x18ff8)
r3 = socket$kcm(0x10, 0x2, 0x4)
sendmsg$kcm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)="48000000150081fb7059ae08060c04000aff0f11000000040011018701546fabca1b4e7d06a6bd7c493872f750375ed08a562af5745e17b8c119418f0f000000d6e74703c48f93b8", 0x48}], 0x1}, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x1a, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x18}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x34435}]}, &(0x7f0000000940)='GPL\x00', 0xa, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, 0x3d}, 0x94)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd)
mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000940)='tcp 2', 0xff7)

program crashed: kernel BUG in svc_destroy
single: successfully extracted reproducer
found reproducer with 4 syscalls
minimizing guilty program
testing program (duration=1m10.659764186s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd)
mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0)

program did not crash
testing program (duration=1m10.659764186s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd)
mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000940)='tcp 2', 0xff7)

program did not crash
testing program (duration=1m10.659764186s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000940)='tcp 2', 0xff7)

program did not crash
testing program (duration=1m10.659764186s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000940)='tcp 2', 0xff7)

program did not crash
testing program (duration=1m10.659764186s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x1cd)
mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000940)='tcp 2', 0xff7)

program did not crash
testing program (duration=1m10.659764186s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd)
mount(0x0, 0x0, &(0x7f0000000840)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000940)='tcp 2', 0xff7)

program did not crash
testing program (duration=1m10.659764186s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd)
mount(0x0, &(0x7f0000000700)='./nfsd\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000940)='tcp 2', 0xff7)

program did not crash
testing program (duration=1m10.659764186s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd)
mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
write(r0, &(0x7f0000000940)='tcp 2', 0xff7)

program did not crash
testing program (duration=1m10.659764186s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd)
mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, 0x0, 0x0)

program did not crash
testing program (duration=1m10.659764186s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd)
mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000940), 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m10.659764186s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
simplifying C reproducer
testing compiled C program (duration=1m10.659764186s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=1m10.659764186s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=1m10.659764186s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=1m10.659764186s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=1m10.659764186s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program did not crash
testing compiled C program (duration=1m10.659764186s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=1m10.659764186s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing program (duration=1m10.659764186s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd)
mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000940)='tcp 2', 0xff7)

program crashed: kernel BUG in svc_destroy
validation run: crashed=true
testing program (duration=1m10.659764186s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd)
mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000940)='tcp 2', 0xff7)

program crashed: kernel BUG in svc_destroy
validation run: crashed=true
testing program (duration=1m10.659764186s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd\x00', 0x1cd)
mount(0x0, &(0x7f0000000700)='./nfsd\x00', &(0x7f0000000840)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000940)='tcp 2', 0xff7)

program crashed: kernel BUG in svc_destroy
validation run: crashed=true
reproducing took 1h46m9.756302412s
repro crashed as (corrupted=false):
------------[ cut here ]------------
kernel BUG at net/sunrpc/svc.c:605!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4470 Comm: syz.0.18 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
RIP: 0010:svc_destroy+0x184/0x190 net/sunrpc/svc.c:605
Code: 5f 5d e9 7f dd 5e f8 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 24 ff ff ff 4c 89 ff e8 66 74 77 f8 e9 17 ff ff ff e8 9c 10 26 f8 <0f> 0b e8 95 10 26 f8 0f 0b 0f 1f 00 55 41 57 41 56 41 55 41 54 53
RSP: 0018:ffffc90003497b10 EFLAGS: 00010293
RAX: ffffffff895c5804 RBX: ffff88802a1ff050 RCX: ffff88802b030000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90003497cb8 R08: ffffffff91b6235f R09: 1ffffffff236c46b
R10: dffffc0000000000 R11: fffffbfff236c46c R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff88802a1ff068 R15: 0000000000000001
FS:  000055556fcf7500(0000) GS:ffff8880b8d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000001bf02147000 CR3: 0000000078a42000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 kref_put include/linux/kref.h:65 [inline]
 svc_put include/linux/sunrpc/svc.h:123 [inline]
 __write_ports_addxprt fs/nfsd/nfsctl.c:768 [inline]
 __write_ports fs/nfsd/nfsctl.c:794 [inline]
 write_ports+0xa26/0xb80 fs/nfsd/nfsctl.c:847
 nfsctl_transaction_write+0x105/0x150 fs/nfsd/nfsctl.c:114
 vfs_write+0x2dc/0x9a0 fs/read_write.c:582
 ksys_write+0x14d/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fef1db9fb19
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffefef9e328 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fef1de25fa0 RCX: 00007fef1db9fb19
RDX: 0000000000000ff7 RSI: 0000200000000940 RDI: 0000000000000003
RBP: 00007fef1dc37b70 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fef1de25fac R14: 00007fef1de25fa0 R15: 00007fef1de25fa0
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:svc_destroy+0x184/0x190 net/sunrpc/svc.c:605
Code: 5f 5d e9 7f dd 5e f8 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 24 ff ff ff 4c 89 ff e8 66 74 77 f8 e9 17 ff ff ff e8 9c 10 26 f8 <0f> 0b e8 95 10 26 f8 0f 0b 0f 1f 00 55 41 57 41 56 41 55 41 54 53
RSP: 0018:ffffc90003497b10 EFLAGS: 00010293
RAX: ffffffff895c5804 RBX: ffff88802a1ff050 RCX: ffff88802b030000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90003497cb8 R08: ffffffff91b6235f R09: 1ffffffff236c46b
R10: dffffc0000000000 R11: fffffbfff236c46c R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff88802a1ff068 R15: 0000000000000001
FS:  000055556fcf7500(0000) GS:ffff8880b8d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000001bf02147000 CR3: 0000000078a42000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

final repro crashed as (corrupted=false):
------------[ cut here ]------------
kernel BUG at net/sunrpc/svc.c:605!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4470 Comm: syz.0.18 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
RIP: 0010:svc_destroy+0x184/0x190 net/sunrpc/svc.c:605
Code: 5f 5d e9 7f dd 5e f8 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 24 ff ff ff 4c 89 ff e8 66 74 77 f8 e9 17 ff ff ff e8 9c 10 26 f8 <0f> 0b e8 95 10 26 f8 0f 0b 0f 1f 00 55 41 57 41 56 41 55 41 54 53
RSP: 0018:ffffc90003497b10 EFLAGS: 00010293
RAX: ffffffff895c5804 RBX: ffff88802a1ff050 RCX: ffff88802b030000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90003497cb8 R08: ffffffff91b6235f R09: 1ffffffff236c46b
R10: dffffc0000000000 R11: fffffbfff236c46c R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff88802a1ff068 R15: 0000000000000001
FS:  000055556fcf7500(0000) GS:ffff8880b8d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000001bf02147000 CR3: 0000000078a42000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 kref_put include/linux/kref.h:65 [inline]
 svc_put include/linux/sunrpc/svc.h:123 [inline]
 __write_ports_addxprt fs/nfsd/nfsctl.c:768 [inline]
 __write_ports fs/nfsd/nfsctl.c:794 [inline]
 write_ports+0xa26/0xb80 fs/nfsd/nfsctl.c:847
 nfsctl_transaction_write+0x105/0x150 fs/nfsd/nfsctl.c:114
 vfs_write+0x2dc/0x9a0 fs/read_write.c:582
 ksys_write+0x14d/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fef1db9fb19
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffefef9e328 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fef1de25fa0 RCX: 00007fef1db9fb19
RDX: 0000000000000ff7 RSI: 0000200000000940 RDI: 0000000000000003
RBP: 00007fef1dc37b70 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fef1de25fac R14: 00007fef1de25fa0 R15: 00007fef1de25fa0
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:svc_destroy+0x184/0x190 net/sunrpc/svc.c:605
Code: 5f 5d e9 7f dd 5e f8 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 24 ff ff ff 4c 89 ff e8 66 74 77 f8 e9 17 ff ff ff e8 9c 10 26 f8 <0f> 0b e8 95 10 26 f8 0f 0b 0f 1f 00 55 41 57 41 56 41 55 41 54 53
RSP: 0018:ffffc90003497b10 EFLAGS: 00010293
RAX: ffffffff895c5804 RBX: ffff88802a1ff050 RCX: ffff88802b030000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90003497cb8 R08: ffffffff91b6235f R09: 1ffffffff236c46b
R10: dffffc0000000000 R11: fffffbfff236c46c R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff88802a1ff068 R15: 0000000000000001
FS:  000055556fcf7500(0000) GS:ffff8880b8d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000001bf02147000 CR3: 0000000078a42000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400