Extracting prog: 56m59.865542589s
Minimizing prog: 23m4.870359863s
Simplifying prog options: 0s
Extracting C: 29.113958954s
Simplifying C: 6m28.126738335s


extracting reproducer from 64 programs
testing a last program of every proc
single: executing 15 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sched_setaffinity-sched_setscheduler-mmap-connect$unix-sendmmsg$unix-mkdirat-openat$fuse-mount$fuse-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-getpid-lremovexattr-syz_pidfd_open-close_range
detailed listing:
executing program 0:
sched_setaffinity(0x0, 0x0, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0)
connect$unix(0xffffffffffffffff, &(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e)
sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000240), 0x400000000000041, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x1c1)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f0000000380), 0x80, &(0x7f00000003c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}})
r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000440)={0x1, &(0x7f0000000480)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]})
r2 = getpid()
lremovexattr(&(0x7f0000000500)='./file0\x00', &(0x7f0000000540)=@known='system.posix_acl_access\x00')
syz_pidfd_open(r2, 0x0)
close_range(r1, 0xffffffffffffffff, 0x200000000000000)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-getpid-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setscheduler-setsockopt$packet_tx_ring-setsockopt$packet_tx_ring-mkdirat-mount$afs
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x101}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x0, 0x0, 0xffffffff}, 0x10)
setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0)
mount$afs(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="64796e2c00c4bc028f592e8a95ba6d714e5521b2eb"])

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): timer_create-mmap$IORING_OFF_SQ_RING-prlimit64-sched_setscheduler-getpid-mmap-pipe-mkdir-fsopen-fsconfig$FSCONFIG_SET_BINARY-fsmount-openat$cgroup_subtree-write$cgroup_subtree-rmdir
detailed listing:
executing program 0:
timer_create(0x2, 0x0, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x1, 0x401d031, 0xffffffffffffffff, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
getpid()
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x1000008, 0x3032, 0xffffffffffffffff, 0xd27e4000)
pipe(&(0x7f00000002c0))
mkdir(&(0x7f0000000340)='./cgroup/../file0\x00', 0x0)
r0 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_SET_BINARY(r0, 0x6, 0x0, 0x0, 0x0)
r1 = fsmount(r0, 0x0, 0x0)
r2 = openat$cgroup_subtree(r1, &(0x7f0000000440), 0x2, 0x0)
write$cgroup_subtree(r2, &(0x7f0000000640)=ANY=[@ANYBLOB='-cpu '], 0xb)
rmdir(&(0x7f0000000680)='./cgroup/../file0\x00')

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-prctl$PR_SCHED_CORE-mmap$IORING_OFF_SQ_RING-madvise-mremap-mlock-mbind-mbind-sched_setattr-userfaultfd-syz_open_dev$usbfs-socket-ioctl$sock_SIOCGIFINDEX-mremap
detailed listing:
executing program 0:
openat$nullb(0xffffffffffffff9c, 0x0, 0x1c3902, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe)
mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)
mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2)
mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1, 0x0, 0x1, 0x2)
sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0)
userfaultfd(0x801)
syz_open_dev$usbfs(0x0, 0x204, 0x452600)
socket(0x29, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0)
mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x2000, 0x3, &(0x7f000027f000/0x2000)=nil)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-mmap-prlimit64-sched_setscheduler-getpid-sched_setscheduler-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setscheduler-add_key$keyring-keyctl$KEYCTL_RESTRICT_KEYRING-syz_mount_image$ext4
detailed listing:
executing program 0:
socket$inet6_tcp(0xa, 0x1, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, 0xffffffffffffffff, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000080)=0x7)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f00000001c0)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000280), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000002c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000300)=0x6)
r3 = add_key$keyring(&(0x7f0000000340), &(0x7f0000000380)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe)
keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f00000003c0)='asymmetric\x00', &(0x7f0000000400)=@keyring)
syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000240)='./file1\x00', 0x3000010, &(0x7f0000000140)={[{@errors_remount}, {@noquota}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x20}}, {@nodelalloc}, {@init_itable_val={'init_itable', 0x3d, 0x48}}]}, 0xfe, 0x51a, &(0x7f0000000d80)="$eJzs3c9vI1cdAPDvTOI0u5tiFxAqlSgVLcpWsHbS0DZCCMoFTpWAcl9C4kRR7DiKnbKJKkjFf4CQQOLEiQsSfwBS1QN/AKpUCS6IAwIEQrCFAxLQQbbH3axjJ9GuY2eTz0d68Xsz4/m+N5af58fLTABX1jMR8UpETEXE8xFRzKeneYrDbmov997dN1bbKYkse+3vSST5tN662uXpiLiRv202Ir7x1YhvJ8fjNvcPtlZqtepuXq606juV5v7Brc36ykZ1o7q9tLT40vLLyy8uL2S5h2pnqZf52Ve++NZnv/OH23+9+d12tb7wsShEXztGqdv0Qmdb9LS30e55BJuAqbw9hUlXBACAM2nv4384Ij7V2f8vxlRnb67P1CRqBgAAAIxK9qUk/ptEZAAAAMCllUbEXCRpOR8LMBdpOpOfG/hoXE9rjWbrM+uNve219ryIUhTS9c1adSEfK1yKQtIuL+ZjbHvlF/rKSxHxRET8sHitUy6vNmprEz73AQAAAFfFjb7j/38V007+dAP+TwAAAAC4uEpDCwAAAMBl4ZAfAAAALr/+4/+3JlQPAAAA4Fx87dVX2ynrPf967fX9va3G67fWqs2tcn1vtbza2N0pbzQaG5179tVPW1+t0dj5XGzv3am0qs1Wpbl/cLve2Ntu3d687xHYAAAAwBg98cm3f5tExOHnr3VS5PcBBLjvPp9/mmQ9gFGbmnQFgIl58Lt4F0ZaD2D8fIuB5JT5Bu8AAMCjb/7jx6//957/79wAXG7G+gDA1XOm6/8e9Q2XUsEIQLjS0oj4UDf72LBlhl7///VZo2RZxDvFo1OcXwQAgPGa66QkLefHAXORpuVyxOMRaSkKyfpmrbqQHx/8plh4rF1e7LwzOXXMMAAAAAAAAAAAAAAAAAAAAAAAAADQlWVJZAAAAMClFpH+JenczT9ivvjcXP/5gZnk38X4c174yWs/urPSau0utqf/o/Msr5mIaP04n/7C0MeHAQAAAKOWHA6d1T1Oz18Xx1orAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAK6A9+6+sdpL44z7ty9HRGlQ/OmY7bzORiEirv8ziekj70siYmoE8Q/fjIgnB8VP4v0sy0p5LfrjpxFx7ZzjlzqbZnj8GyOID1fZ2+3+55VB3780num8Dv7+TefpYQ3v/9I88pOdfm5Q//f4sbXVB8Z46t1fVIbGfzPiqenB/U+v/02GxH/22Nr+k2XZ8Rjf+ubBwbD42U8j5gf+/iT3xaq06juV5v7Brc36ykZ1o7q9tLT40vLLyy8uL1TWN2vV/O/AGD/4xC/fP6n91wfE//3vuv3vSe1/bthK+/zv3Tt3P9LNFgbFv/nswN/f2RgSP81/+z6d59vz53v5w27+qKd//s7TJ7V/bcj2P+3zv3nG9j//9e//8YyLAgBj0Nw/2Fqp1aq7J2Rmz7DMo5j51ex4g86MZD3Z97qf3MXYhg+eae+t3pvSa9UFqNiRTDa2WFNxQZr8QWai3RIAAHAO7u30T7omAAAAAAAAAAAAAAAAAAAAcHWN43Zi/TEPJ9NUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAT/T8AAP//xKDftA==")

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-socket$igmp-getsockopt$inet_opts-ioctl$sock_SIOCGIFINDEX-socket$nl_netfilter-add_key-add_key-sendmsg$IPSET_CMD_CREATE-socket$nl_netfilter-sendmsg$IPSET_CMD_ADD-setsockopt$sock_attach_bpf
detailed listing:
executing program 0:
r0 = socket$kcm(0x21, 0x2, 0x2)
r1 = socket$igmp(0x2, 0x3, 0x2)
getsockopt$inet_opts(0xffffffffffffffff, 0x0, 0xd, 0x0, &(0x7f00000000c0))
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
add_key(&(0x7f0000000180)='encrypted\x00', &(0x7f00000001c0), &(0x7f0000000200), 0xca, 0xfffffffffffffffe)
add_key(&(0x7f0000000280)='encrypted\x00', &(0x7f00000002c0), &(0x7f0000000300), 0xca, 0xfffffffffffffffe)
sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB="50000000020605000000000000000000000000000c00078008000640400000000500010006000000050005000200000005000400000000000900020073797a31000000000c000300686173683a6970"], 0x50}}, 0x0)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)={0x40, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x18, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty=0xfffffffe}}, @IPSET_ATTR_CIDR={0x5, 0x3, 0x8}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084)
setsockopt$sock_attach_bpf(r0, 0x110, 0x4, 0x0, 0x4)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-socket$igmp-getsockopt$inet_opts-ioctl$sock_SIOCGIFINDEX-socket$nl_netfilter-add_key-add_key-sendmsg$IPSET_CMD_CREATE-socket$nl_netfilter-sendmsg$IPSET_CMD_ADD-setsockopt$sock_attach_bpf
detailed listing:
executing program 0:
r0 = socket$kcm(0x21, 0x2, 0x2)
r1 = socket$igmp(0x2, 0x3, 0x2)
getsockopt$inet_opts(0xffffffffffffffff, 0x0, 0xd, 0x0, &(0x7f00000000c0))
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
add_key(&(0x7f0000000180)='encrypted\x00', &(0x7f00000001c0), &(0x7f0000000200), 0xca, 0xfffffffffffffffe)
add_key(&(0x7f0000000280)='encrypted\x00', &(0x7f00000002c0), &(0x7f0000000300), 0xca, 0xfffffffffffffffe)
sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=ANY=[@ANYBLOB="50000000020605000000000000000000000000000c00078008000640400000000500010006000000050005000200000005000400000000000900020073797a31000000000c000300686173683a6970"], 0x50}}, 0x0)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)={0x40, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x18, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty=0xfffffffe}}, @IPSET_ATTR_CIDR={0x5, 0x3, 0x8}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084)
setsockopt$sock_attach_bpf(r0, 0x110, 0x4, 0x0, 0x4)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-setsockopt$inet_tcp_int-bind$inet-setsockopt$SO_ATTACH_FILTER-mmap$IORING_OFF_SQ_RING-sendto$inet-setsockopt$inet_tcp_TCP_CONGESTION-sendmmsg$inet-setsockopt$sock_int-syz_genetlink_get_family_id$nl80211-sendto$inet
detailed listing:
executing program 0:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000000)=0x79, 0x4)
bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e23, @multicast1}, 0x10)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000100)={0x1, &(0x7f0000000140)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10)
mmap$IORING_OFF_SQ_RING(0x0, 0xc00001, 0x3000007, 0x401d031, 0xffffffffffffffff, 0x0)
sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000180)={0x2, 0x4e23, @local}, 0x10)
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000001c0)='bbr', 0x3)
sendmmsg$inet(r0, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000340)="91f8a9848519def38491bbc4173c3c6f357d0272b7319130feaab952ac4703cad04be6890ee50e997fc26e0000ea4feb931647fc5393de25000000000000000000f4922da20bf1f802970c30f03cc271337e892c99bda9475d51361f8b788f8a6a68ba85987219000000eb52c9ff439180b413ec4d4fe130b41d113ce7efb5e9838379c5a554eb896f7808d5904cd8da06fd5159085c9275f49e775e92fb106c2f10442d500891e58a3f851ff5c85244beacba25d854577d68ca555e88fc249340ab9bdd905a984c7bbb7bb3c689ef8daa63ca62e496be091cc1c7d4f371acaaec43527aee38", 0xe6}, {&(0x7f0000000440)="44900001000056ee66c372f3105eb186dd8062fad2d5b5bfb0ba06f274a8d026bd209da8ffa6a26e3b3f8075704a9d0ef9aff7f1e7db24609f02d34e76992c9df9fe6888c6c9a4825c6223be6ac54536025af1dea54e527c68b0ff250261953f2da79a78104c2d9e7b16ed86b124945aa9ab7581ebd385fb61d442035db81e18c2d2462d0bb25fff9d3b1ce90b597992b2a4d541611ce77f58dce7c9500118229e7cdf4ca7f6adca92c73d97ce54164c1942b2568635bec8e020b41fb2f8009900"/206, 0xce}], 0x2}}, {{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000580)="31fdffffffffffffff74098b2e5e55a1828636f60fbfcfdac56c75f1687f0c562874230300d69f117e766bdbad0c2171ad6227e1173afcb1c420a51a0917861009000000f049c606ccab7cda1f0e3490fbb9de494c9721d9bf80f2f75c3b4bea78e385ea382294882839a22674037b89108a1420e33eb9be6d10cfb24eb7cccdf1528ef33b34ab07cdb0909a9ba999d89d0c5d889c8c569334e9547e1e343b451d9025c4e153612d4674b9411fb4de29559900bcb388d291aa839ab0954e6a8dfc19c3c153", 0xc5}], 0x1}}], 0x2, 0x2090)
setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000680)=0xdf8, 0x4)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
sendto$inet(r0, &(0x7f00000006c0)="17", 0x59a, 0x10008095, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-setsockopt$inet_tcp_int-bind$inet-setsockopt$SO_ATTACH_FILTER-mmap$IORING_OFF_SQ_RING-sendto$inet-setsockopt$inet_tcp_TCP_CONGESTION-sendmmsg$inet-setsockopt$sock_int-syz_genetlink_get_family_id$nl80211-sendto$inet
detailed listing:
executing program 0:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000000)=0x79, 0x4)
bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e23, @multicast1}, 0x10)
setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000100)={0x1, &(0x7f0000000140)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10)
mmap$IORING_OFF_SQ_RING(0x0, 0xc00001, 0x3000007, 0x401d031, 0xffffffffffffffff, 0x0)
sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000000180)={0x2, 0x4e23, @local}, 0x10)
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000001c0)='bbr', 0x3)
sendmmsg$inet(r0, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000340)="91f8a9848519def38491bbc4173c3c6f357d0272b7319130feaab952ac4703cad04be6890ee50e997fc26e0000ea4feb931647fc5393de25000000000000000000f4922da20bf1f802970c30f03cc271337e892c99bda9475d51361f8b788f8a6a68ba85987219000000eb52c9ff439180b413ec4d4fe130b41d113ce7efb5e9838379c5a554eb896f7808d5904cd8da06fd5159085c9275f49e775e92fb106c2f10442d500891e58a3f851ff5c85244beacba25d854577d68ca555e88fc249340ab9bdd905a984c7bbb7bb3c689ef8daa63ca62e496be091cc1c7d4f371acaaec43527aee38", 0xe6}, {&(0x7f0000000440)="44900001000056ee66c372f3105eb186dd8062fad2d5b5bfb0ba06f274a8d026bd209da8ffa6a26e3b3f8075704a9d0ef9aff7f1e7db24609f02d34e76992c9df9fe6888c6c9a4825c6223be6ac54536025af1dea54e527c68b0ff250261953f2da79a78104c2d9e7b16ed86b124945aa9ab7581ebd385fb61d442035db81e18c2d2462d0bb25fff9d3b1ce90b597992b2a4d541611ce77f58dce7c9500118229e7cdf4ca7f6adca92c73d97ce54164c1942b2568635bec8e020b41fb2f8009900"/206, 0xce}], 0x2}}, {{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000580)="31fdffffffffffffff74098b2e5e55a1828636f60fbfcfdac56c75f1687f0c562874230300d69f117e766bdbad0c2171ad6227e1173afcb1c420a51a0917861009000000f049c606ccab7cda1f0e3490fbb9de494c9721d9bf80f2f75c3b4bea78e385ea382294882839a22674037b89108a1420e33eb9be6d10cfb24eb7cccdf1528ef33b34ab07cdb0909a9ba999d89d0c5d889c8c569334e9547e1e343b451d9025c4e153612d4674b9411fb4de29559900bcb388d291aa839ab0954e6a8dfc19c3c153", 0xc5}], 0x1}}], 0x2, 0x2090)
setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000680)=0xdf8, 0x4)
syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff)
sendto$inet(r0, &(0x7f00000006c0)="17", 0x59a, 0x10008095, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write-syz_usb_connect$hid
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1cd)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f00000002c0)='-2 -3 +4\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000340)='tcp 2', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f00000003c0)='1', 0x1)
syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0)

program crashed: kernel BUG in svc_destroy
single: successfully extracted reproducer
found reproducer with 9 syscalls
minimizing guilty program
testing program (duration=1m29.594637926s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1cd)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f00000002c0)='-2 -3 +4\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000340)='tcp 2', 0x5)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./nfsd/threads\x00', 0x2, 0x0)
write(r2, &(0x7f00000003c0)='1', 0x1)

program crashed: kernel BUG in svc_destroy
testing program (duration=1m29.594637926s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1cd)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f00000002c0)='-2 -3 +4\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000340)='tcp 2', 0x5)
openat(0xffffffffffffff9c, &(0x7f0000000380)='./nfsd/threads\x00', 0x2, 0x0)

program crashed: kernel BUG in svc_destroy
testing program (duration=1m29.594637926s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1cd)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f00000002c0)='-2 -3 +4\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000340)='tcp 2', 0x5)

program crashed: kernel BUG in svc_destroy
testing program (duration=1m29.594637926s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1cd)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f00000002c0)='-2 -3 +4\n', 0x9)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/portlist\x00', 0x2, 0x0)

program did not crash
testing program (duration=1m29.594637926s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1cd)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f00000002c0)='-2 -3 +4\n', 0x9)
write(0xffffffffffffffff, &(0x7f0000000340)='tcp 2', 0x5)

program did not crash
testing program (duration=1m29.594637926s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1cd)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/versions\x00', 0x2, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='tcp 2', 0x5)

program crashed: kernel BUG in svc_destroy
testing program (duration=1m29.594637926s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1cd)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='tcp 2', 0x5)

program crashed: kernel BUG in svc_destroy
testing program (duration=1m29.594637926s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1cd)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='tcp 2', 0x5)

program did not crash
testing program (duration=1m29.594637926s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write
detailed listing:
executing program 0:
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='tcp 2', 0x5)

program did not crash
testing program (duration=1m29.594637926s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x1cd)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='tcp 2', 0x5)

program did not crash
testing program (duration=1m29.594637926s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1cd)
mount(0x0, 0x0, &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='tcp 2', 0x5)

program did not crash
testing program (duration=1m29.594637926s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1cd)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='tcp 2', 0x5)

program did not crash
testing program (duration=1m29.594637926s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1cd)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
write(r0, &(0x7f0000000340)='tcp 2', 0x5)

program did not crash
testing program (duration=1m29.594637926s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1cd)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, 0x0, 0x0)

program did not crash
testing program (duration=1m29.594637926s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1cd)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340), 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m29.594637926s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
simplifying C reproducer
testing compiled C program (duration=1m29.594637926s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=1m29.594637926s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=1m29.594637926s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=1m29.594637926s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=1m29.594637926s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program did not crash
testing compiled C program (duration=1m29.594637926s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=1m29.594637926s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing program (duration=1m29.594637926s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1cd)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='tcp 2', 0x5)

program crashed: kernel BUG in svc_destroy
validation run: crashed=true
testing program (duration=1m29.594637926s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1cd)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='tcp 2', 0x5)

program crashed: kernel BUG in svc_destroy
validation run: crashed=true
testing program (duration=1m29.594637926s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1cd)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000340)='tcp 2', 0x5)

program crashed: kernel BUG in svc_destroy
validation run: crashed=true
reproducing took 1h30m0.8626119s
repro crashed as (corrupted=false):
------------[ cut here ]------------
kernel BUG at net/sunrpc/svc.c:599!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4368 Comm: syz.0.18 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
RIP: 0010:svc_destroy+0x184/0x190 net/sunrpc/svc.c:599
Code: 5f 5d e9 8f 26 bb f8 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 24 ff ff ff 4c 89 ff e8 f6 ba bb f8 e9 17 ff ff ff e8 cc 72 76 f8 <0f> 0b e8 c5 72 76 f8 0f 0b 0f 1f 00 55 41 57 41 56 41 55 41 54 53
RSP: 0018:ffffc9000318fad0 EFLAGS: 00010293
RAX: ffffffff8902bac4 RBX: ffff88802476d050 RCX: ffff8880281ad940
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc9000318fc78 R08: ffffffff910471ef R09: 1ffffffff2208e3d
R10: dffffc0000000000 R11: fffffbfff2208e3e R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff88802476d068 R15: 0000000000000001
FS:  000055556cb77500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffcc0da6108 CR3: 0000000020968000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 kref_put include/linux/kref.h:65 [inline]
 svc_put include/linux/sunrpc/svc.h:123 [inline]
 __write_ports_addxprt fs/nfsd/nfsctl.c:770 [inline]
 __write_ports fs/nfsd/nfsctl.c:796 [inline]
 write_ports+0xa26/0xb80 fs/nfsd/nfsctl.c:849
 nfsctl_transaction_write+0x105/0x150 fs/nfsd/nfsctl.c:114
 vfs_write+0x304/0xd70 fs/read_write.c:592
 ksys_write+0x153/0x260 fs/read_write.c:647
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f96c63d5559
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcc0da5e48 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f96c665bfa0 RCX: 00007f96c63d5559
RDX: 0000000000000005 RSI: 0000200000000340 RDI: 0000000000000003
RBP: 00007f96c646cb50 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f96c665bfac R14: 00007f96c665bfa0 R15: 00007f96c665bfa0
 </TASK>
Modules linked in:
---[ end trace 9e86003a02ca7bbf ]---
RIP: 0010:svc_destroy+0x184/0x190 net/sunrpc/svc.c:599
Code: 5f 5d e9 8f 26 bb f8 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 24 ff ff ff 4c 89 ff e8 f6 ba bb f8 e9 17 ff ff ff e8 cc 72 76 f8 <0f> 0b e8 c5 72 76 f8 0f 0b 0f 1f 00 55 41 57 41 56 41 55 41 54 53
RSP: 0018:ffffc9000318fad0 EFLAGS: 00010293
RAX: ffffffff8902bac4 RBX: ffff88802476d050 RCX: ffff8880281ad940
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc9000318fc78 R08: ffffffff910471ef R09: 1ffffffff2208e3d
R10: dffffc0000000000 R11: fffffbfff2208e3e R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff88802476d068 R15: 0000000000000001
FS:  000055556cb77500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffcc0da6108 CR3: 0000000020968000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

final repro crashed as (corrupted=false):
------------[ cut here ]------------
kernel BUG at net/sunrpc/svc.c:599!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4368 Comm: syz.0.18 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
RIP: 0010:svc_destroy+0x184/0x190 net/sunrpc/svc.c:599
Code: 5f 5d e9 8f 26 bb f8 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 24 ff ff ff 4c 89 ff e8 f6 ba bb f8 e9 17 ff ff ff e8 cc 72 76 f8 <0f> 0b e8 c5 72 76 f8 0f 0b 0f 1f 00 55 41 57 41 56 41 55 41 54 53
RSP: 0018:ffffc9000318fad0 EFLAGS: 00010293
RAX: ffffffff8902bac4 RBX: ffff88802476d050 RCX: ffff8880281ad940
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc9000318fc78 R08: ffffffff910471ef R09: 1ffffffff2208e3d
R10: dffffc0000000000 R11: fffffbfff2208e3e R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff88802476d068 R15: 0000000000000001
FS:  000055556cb77500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffcc0da6108 CR3: 0000000020968000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 kref_put include/linux/kref.h:65 [inline]
 svc_put include/linux/sunrpc/svc.h:123 [inline]
 __write_ports_addxprt fs/nfsd/nfsctl.c:770 [inline]
 __write_ports fs/nfsd/nfsctl.c:796 [inline]
 write_ports+0xa26/0xb80 fs/nfsd/nfsctl.c:849
 nfsctl_transaction_write+0x105/0x150 fs/nfsd/nfsctl.c:114
 vfs_write+0x304/0xd70 fs/read_write.c:592
 ksys_write+0x153/0x260 fs/read_write.c:647
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f96c63d5559
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcc0da5e48 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f96c665bfa0 RCX: 00007f96c63d5559
RDX: 0000000000000005 RSI: 0000200000000340 RDI: 0000000000000003
RBP: 00007f96c646cb50 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f96c665bfac R14: 00007f96c665bfa0 R15: 00007f96c665bfa0
 </TASK>
Modules linked in:
---[ end trace 9e86003a02ca7bbf ]---
RIP: 0010:svc_destroy+0x184/0x190 net/sunrpc/svc.c:599
Code: 5f 5d e9 8f 26 bb f8 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 24 ff ff ff 4c 89 ff e8 f6 ba bb f8 e9 17 ff ff ff e8 cc 72 76 f8 <0f> 0b e8 c5 72 76 f8 0f 0b 0f 1f 00 55 41 57 41 56 41 55 41 54 53
RSP: 0018:ffffc9000318fad0 EFLAGS: 00010293
RAX: ffffffff8902bac4 RBX: ffff88802476d050 RCX: ffff8880281ad940
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc9000318fc78 R08: ffffffff910471ef R09: 1ffffffff2208e3d
R10: dffffc0000000000 R11: fffffbfff2208e3e R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff88802476d068 R15: 0000000000000001
FS:  000055556cb77500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffcc0da6108 CR3: 0000000020968000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400