Extracting prog: 28m41.471772978s
Minimizing prog: 1h4m41.985462253s
Simplifying prog options: 0s
Extracting C: 32.022610058s
Simplifying C: 10m59.358144882s


extracting reproducer from 73 programs
testing a last program of every proc
single: executing 23 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): semget-prlimit64-sched_setscheduler-getpid-sched_setscheduler-bpf$BPF_PROG_DETACH-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setscheduler-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-syz_open_dev$video-ioctl$VIDIOC_S_EXT_CTRLS
detailed listing:
executing program 0:
semget(0x3, 0x2, 0x800)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000480)={@fallback, 0xffffffffffffffff, 0x37, 0x10}, 0x20)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="05000000010000000400000004"], 0x50)
r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000009c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000006007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000208500000001000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000001c0)={r4}, 0xc)
r5 = syz_open_dev$video(&(0x7f0000000080), 0x80000000010001, 0x0)
ioctl$VIDIOC_S_EXT_CTRLS(r5, 0xc0205648, &(0x7f00000000c0)={0x4, 0x8, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x98f90d, 0x9c, '\x00', @p_u8=&(0x7f0000000100)=0x6}})

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-openat$sequencer2-add_key$fscrypt_v1-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-syz_open_dev$sndmidi-writev-socket$nl_route-sendmsg$nl_route-setsockopt$MRT6_ADD_MIF-openat$dir-open$dir-syz_open_dev$swradio-ioctl$VIDIOC_QUERYBUF-syz_mount_image$udf-syz_mount_image$exfat-bpf$MAP_CREATE-bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM-ioctl$TUNGETFILTER-setrlimit
detailed listing:
executing program 0:
r0 = socket(0xa, 0x3, 0x3a)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
add_key$fscrypt_v1(0x0, &(0x7f0000000200)={'fscrypt:', @auto=[0x61, 0x35, 0x62, 0x64, 0x39, 0x63, 0x62, 0x34, 0x64, 0x62, 0x35, 0x37, 0x64, 0x65, 0x39, 0x65]}, &(0x7f0000000300)={0x0, "470f70bd989b74fc1963471df7d1ba26479918a5138a6a93e2abce7f2f9cdb7931450c6679c369b428e4403b24f03148bdf1f9558d12deadab63b858c64b24d9", 0x29}, 0x48, 0xfffffffffffffffc)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7)
r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102)
writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0}}, 0x0)
setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, 0x0, 0x0)
openat$dir(0xffffffffffffff9c, 0x0, 0x175a978679bbbe1d, 0x80a0a1240160183d)
open$dir(0x0, 0x40000, 0x4)
r3 = syz_open_dev$swradio(&(0x7f00000005c0), 0x1, 0x2)
ioctl$VIDIOC_QUERYBUF(r3, 0xc0585609, &(0x7f0000000680)=@mmap={0x8, 0xb, 0x4, 0x4, 0x8000, {}, {0x5, 0x0, 0xc, 0x2, 0xf1, 0x7, "8f22a717"}, 0x5, 0x1, {}, 0x1})
syz_mount_image$udf(&(0x7f0000000040), &(0x7f0000000f80)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='mode=00000000000000000000202,umask=00000000000000000000002,dmode=00000000000000000100002,gid=forget,longad,shortad,novrs,iocharset=cp437,uid=forget,umask=00000000000000000000006,dmode=00000000000000000000010,gid=', @ANYRESDEC=0x0, @ANYRES16], 0x1, 0xc68, &(0x7f0000000fc0)="$eJzs3UFsHNd9B+D/G+2KSxmtmDhRndQuNm2RyorlypJiKlbhrGqabQBZFkIxtwBciZS6NUUSJNXIRtoyvfTQQ4Ci6CEnAq1RIEUDowmCHpnWBZKLD0WAAj0RLWwERQ9sESAng8XMvqVWNGnREilR1vfZ5G935r2Z92bWMzTBNy8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgIjfffnciefSg24FAHA/XRj76omT7v8A8Ei55P//AQAAAAAAAAAAAABgv0tRxOORYu7CWpqo3nc1znfqN26Oj4xuXW0wVTUPVOXLr8ZzJ0+d/uLzw2d6eb4z8yH1d9tn49WxS+eaL81en5ufWliYmmyOz3SuzE5O7XgL91p/s2PVAWhef+3G5NWrC82Tz566bfXNofcGHjsydHb46eNP9cqOj4yOjt0q0ugvX7vrhnRtN8LjYBRxPFI8872fpXZEFHHvx6Jxf8/9ZoNVJ45VnRgfGa06Mt1pzyyWKy/2DkQR0eyr1Oodo63PRdTq97UP22tFLJXNLxt8rOze2Fx7vn15eqp5sT2/2FnszM5cTN3Wlv1pRhFnUsRyRKwOfHBz9SiiFim+c3gtXY6IA73j8IVqYPD27Sj2sI87ULazWY9YLh6Cc7aPDUQRr0SKn799NK7k60x1rfl8xCtl/jDizTJfjEjlB+N0xLtbfI54ONWiiL8oz//ZtTRZXQ9615XzX2t+ZebqbF/Z3nXlI94fPnCleED3h8FNeX/s82tTI4poV1f8tXT3P+wAAAAAAAAAAAAAAAAAsNsGo4jPRIqX/+2PqnHFUY1LP3x2+PeGfql/zPgTd9hOWfbZiFgqdjYm92AeGHgxXUzpAY8lfpQ1oog/zuP/vvWgGwMAAAAAAAAAAAAAAAAAAPBIK+KnkeKFd46m5eifU7wzc615qX15ujsrbG/u396c6evr6+vN1M1WzomcSzmXc67kXO1mNe6/ql/k+jknci7lXM65knM1ZxzI9XO2ck7kXMq5nHMl52rOqOX6OVs5J3Iu5VzOuZJzNWfsk7l7AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+Tooo4v1I8e1vrKVIEdGKmIhurgw86NYBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKWBVMT3I0Xz91sby2oRkap/u46W305H62CZn4zWcJkvRutcznaVtda3HkD7uTf1VMRPIsVA462NE57Pf737buNjEG9+89a7z9a6eaC3cui9gceOHD47PPprT2z3Om3VgGPnOzM3bjbHR0ZHx/oW1/LeP9m3bCjvt9idrhMRC6+/8Vp7enpq/u5flB+BbVatr6//abmXe93FPnmRatv29JF8UZ7afdCMPexgbUeF67u604P746g+6CsT90N5/383Uvz2O//Ru+FX9//aRomNO3z84k9u3f9f2LyhHd7/a5vr5ft/eU/f6v7/eN+yF/JPI/VaRGPx+lz9SERj4fU3jneut69NXZuaOX3ixJeGh7906kT9YETjamd6qu/VvR8rAAAAAAAAAAAAAAAAgPsqFfHlSNH+yVpqRsTNarzW0Nnhp48/dSAOVOOtbhu3/erYpXPNl2avz81PLSxMTTbHZzpXZiendrq7RjXca3xkdE86c0eDe9z+wcZLs3Ovz3eu/cHilusPNc5dXlicb1/ZenUMRhHR6l9yrGrw+Mho1ejpTnumqnpxy8H0H109FfGfkeLK6Wb6XF6Wx/9vHuF/2/j/pc0b2qPx/5/oW1buM6UifhEpfusvn4jPVe08FB84Zrnc30aKY2eezOXiYFmu14bucwW6IwPLsv8bKf7x/SeX+sv2xkM+fqvsczs+sA+J8vwfjhTf//Pvxq/nZbc//2Hr839o84b26Px/qm/ZodueV3DPXSef/+OR4sXH34rfyMs+7PkfvWdvHM2FN57PsUfn/9N9y4byfn9zd7oOAAAAAAAAAADwUKunIv4uUvxotJaez8t28vd/k5s3tEd///Urfcsmd2e+oju+2NzvbY/dHUsAAAAAwINVT0X8NFJcW3xrYwz17eO/+8Z//s6t8Z8jadPa6vd8v1w9N2A3f//Xbyjvd+Leuw0AAAAAAAAAAAAAAAAAAAD7SkpFPJ/nU5+oxvNPbjuf+kqkePm/n8nl0pGyXG8e+KHqe+PC7Mzxc9PTs1fai+3L01PNsbn2lamy7qcixdrfPJnrFtX86r355rtzvDdqEVHNxT4fKUb/vle2Oxd7b27y7nzg3bnYy7KfiBT/9Q+3l+3NY/3pW2VPlmX/OlJ8/Z+2LnvkVtlTZdnvRooff73ZK3uoLNt7Pmr3maSNP4yIZ6/MFntwVgAAAAAAAAAAAAAAAAAAAHjU1FMRfxYp/uf68sZY/jz/f73vbeXNb/bN97/JzWqe/6Fq/v/tXt/N/P/VcwWWttsrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB8PKUo4o1IMXdhLa0MlO+7Guc7Mzdujo+Mbl1tMFU1D1Tly6/GcydPnf7i88Nnevnh9XfbZ+LVsUvnmi/NXp+bn1pYmJpsjs90rsxOTu14C9vXb9xVi45VB6B5/bUbk1evLjRPPnvqttU3h94beOzI0Nnhp48/1Ss7PjI6OtZXpla/qz1vKW2z/GAU8VeR4pnv/Sz9aCCiiA89Fjtyh8/OXhusOnGs6sT4yGjVkelOe2axXHmxdyCKiGZfpVbvGN2Hc3FPWhEDZfPLBh8ruzc2155vX56eal5szy92FjuzMxdTt7Vlf5pRxJkUsRwRqwMf3Fw9ingtUnzn8Fr654GIA73j8IULY189cXL7dhR72McdKNvZrEcsFw/BOdvHBqKIH0SKn799NP5lIKIW3a/4fMQrZf4w4s3onu9UfjBOR7y7xeeIh1Mtivi/8vyfXUtvD5TXg9515fzXml+ZuTrbV7Z3XdlX94cf/PtHrTG4G7vd5Mvb/pCwz69NjSjix9UVfy39q/+uAQAAAAAAAAAAAAAAAPaRIn41UrzwztFUjQ/eGFPcmbnWvNS+PN0d1tcb+9cbM72+vr7eTN1s5ZzIuZRzOedKztWcUeT6OVtlNtbXJ/L7pZzLOVdyruaMA7l+zlbOiZxLOZdzruRczRm1XD9nK+dEzqWcyzlXcq7mjH0ydg8AAAAAAAAAAAAAAAAAAPh4Kap/Unz7G2tpfaA7v/REdHPFfKAfe/8fAAD//xKm8uQ=")
syz_mount_image$exfat(0x0, &(0x7f0000000100)='./bus\x00', 0x20020c0, 0x0, 0x1, 0x0, &(0x7f0000001a00))
r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x8, 0x1}, 0x50)
bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000400)={r4, &(0x7f0000000100), 0x0}, 0x20)
ioctl$TUNGETFILTER(0xffffffffffffffff, 0x801054db, &(0x7f0000000500)=""/185)
setrlimit(0x1, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff})

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-signalfd4-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-openat$sequencer-syz_open_dev$sndmidi-writev-syz_init_net_socket$nl_rdma-socket$inet_udp-connect$unix-socket$key-sendmsg$key-syz_open_procfs-pread64-openat$nci-creat-syz_genetlink_get_family_id$nfc-write$nci-bind$inet-syz_open_dev$midi-ioctl$SNDRV_RAWMIDI_IOCTL_INFO-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-mremap-mremap-setsockopt$inet_IP_XFRM_POLICY-mq_timedreceive
detailed listing:
executing program 0:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
connect$unix(0xffffffffffffffff, 0x0, 0x0)
r2 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r2, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0)
r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00')
pread64(r3, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200)
r4 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
syz_genetlink_get_family_id$nfc(&(0x7f0000000480), 0xffffffffffffffff)
write$nci(r4, &(0x7f00000004c0)=ANY=[], 0x102)
bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16)
r5 = syz_open_dev$midi(&(0x7f00000012c0), 0x2, 0x2)
ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r5, 0x810c5701, &(0x7f0000000080))
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94)
mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil)
mremap(&(0x7f0000a94000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000259000/0x4000)=nil)
setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast2, @in=@private=0xa010100, 0x4e20, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xee01}, {0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x0, 0x0, 0xfffffffffffffffc, 0xff}}, {{@in6=@private2, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e, 0x4}}, 0xe4)
mq_timedreceive(0xffffffffffffffff, 0x0, 0x0, 0x200000200009, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-signalfd4-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-openat$sequencer-syz_open_dev$sndmidi-writev-syz_init_net_socket$nl_rdma-socket$inet_udp-connect$unix-socket$key-sendmsg$key-syz_open_procfs-pread64-openat$nci-creat-syz_genetlink_get_family_id$nfc-write$nci-bind$inet-syz_open_dev$midi-ioctl$SNDRV_RAWMIDI_IOCTL_INFO-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-mremap-mremap-setsockopt$inet_IP_XFRM_POLICY-mq_timedreceive
detailed listing:
executing program 0:
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, 0x0, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
connect$unix(0xffffffffffffffff, 0x0, 0x0)
r2 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r2, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0)
r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00')
pread64(r3, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200)
r4 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
creat(&(0x7f0000000000)='./file0\x00', 0x0)
syz_genetlink_get_family_id$nfc(&(0x7f0000000480), 0xffffffffffffffff)
write$nci(r4, &(0x7f00000004c0)=ANY=[], 0x102)
bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16)
r5 = syz_open_dev$midi(&(0x7f00000012c0), 0x2, 0x2)
ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r5, 0x810c5701, &(0x7f0000000080))
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94)
mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil)
mremap(&(0x7f0000a94000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000259000/0x4000)=nil)
setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast2, @in=@private=0xa010100, 0x4e20, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xee01}, {0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x0, 0x0, 0xfffffffffffffffc, 0xff}}, {{@in6=@private2, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e, 0x4}}, 0xe4)
mq_timedreceive(0xffffffffffffffff, 0x0, 0x0, 0x200000200009, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x4a)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='udp 2', 0x5)

program crashed: WARNING in svc_destroy
single: successfully extracted reproducer
found reproducer with 4 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x4a)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x1, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x4a)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000500)='udp 2', 0x5)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x4a)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='udp 2', 0x5)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='udp 2', 0x5)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x4a)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='udp 2', 0x5)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x4a)
mount(0x0, 0x0, &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='udp 2', 0x5)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x4a)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='udp 2', 0x5)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x4a)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000500)='udp 2', 0x5)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x4a)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x4a)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500), 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: WARNING in svc_destroy
simplifying C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: WARNING in svc_destroy
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: WARNING in svc_destroy
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: WARNING in svc_destroy
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: WARNING in svc_destroy
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: WARNING in svc_destroy
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: WARNING in svc_destroy
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x4a)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='udp 2', 0x5)

program crashed: WARNING in svc_destroy
validation run: crashed=true
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x4a)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='udp 2', 0x5)

program crashed: WARNING in svc_destroy
validation run: crashed=true
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x4a)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000500)='udp 2', 0x5)

program crashed: WARNING in svc_destroy
validation run: crashed=true
reproducing took 1h48m22.880650931s
repro crashed as (corrupted=false):
------------[ cut here ]------------
SVC: permsocks remain for nfsd
WARNING: CPU: 0 PID: 5948 at net/sunrpc/svc.c:583 svc_destroy+0x2ed/0x390 net/sunrpc/svc.c:582
Modules linked in:
CPU: 0 PID: 5948 Comm: syz.0.18 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:svc_destroy+0x2ed/0x390 net/sunrpc/svc.c:582
Code: 24 49 83 c7 20 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 12 40 33 f8 49 8b 37 48 c7 c7 20 4d d9 8b e8 d3 93 a4 f7 <0f> 0b e9 78 fd ff ff e8 07 c7 da f7 c6 05 42 5b ca 04 01 4c 89 e0
RSP: 0018:ffffc900036c7ae0 EFLAGS: 00010246
RAX: 08c96310237c1100 RBX: ffff888027213c50 RCX: ffff88802bc08000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: ffffc900036c7cb8 R08: ffffc900036c76e7 R09: 1ffff920006d8edc
R10: dffffc0000000000 R11: fffff520006d8edd R12: ffff888027213c00
R13: dffffc0000000000 R14: ffff888027213c50 R15: ffffffff8d3e1840
FS:  0000555581aaf500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3f48470000 CR3: 0000000076c44000 CR4: 00000000003506f0
Call Trace:
 <TASK>
 kref_put include/linux/kref.h:65 [inline]
 svc_put include/linux/sunrpc/svc.h:124 [inline]
 __write_ports_addxprt fs/nfsd/nfsctl.c:765 [inline]
 __write_ports fs/nfsd/nfsctl.c:791 [inline]
 write_ports+0xb99/0xfa0 fs/nfsd/nfsctl.c:844
 nfsctl_transaction_write+0x10c/0x150 fs/nfsd/nfsctl.c:113
 vfs_write+0x299/0x9a0 fs/read_write.c:582
 ksys_write+0x151/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f3f4859e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd12e7a278 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f3f48825fa0 RCX: 00007f3f4859e0d9
RDX: 0000000000000005 RSI: 0000200000000500 RDI: 0000000000000003
RBP: 00007f3f48635024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3f48825fac R14: 00007f3f48825fa0 R15: 00007f3f48825fa0
 </TASK>

final repro crashed as (corrupted=false):
------------[ cut here ]------------
SVC: permsocks remain for nfsd
WARNING: CPU: 0 PID: 5948 at net/sunrpc/svc.c:583 svc_destroy+0x2ed/0x390 net/sunrpc/svc.c:582
Modules linked in:
CPU: 0 PID: 5948 Comm: syz.0.18 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:svc_destroy+0x2ed/0x390 net/sunrpc/svc.c:582
Code: 24 49 83 c7 20 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 12 40 33 f8 49 8b 37 48 c7 c7 20 4d d9 8b e8 d3 93 a4 f7 <0f> 0b e9 78 fd ff ff e8 07 c7 da f7 c6 05 42 5b ca 04 01 4c 89 e0
RSP: 0018:ffffc900036c7ae0 EFLAGS: 00010246
RAX: 08c96310237c1100 RBX: ffff888027213c50 RCX: ffff88802bc08000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: ffffc900036c7cb8 R08: ffffc900036c76e7 R09: 1ffff920006d8edc
R10: dffffc0000000000 R11: fffff520006d8edd R12: ffff888027213c00
R13: dffffc0000000000 R14: ffff888027213c50 R15: ffffffff8d3e1840
FS:  0000555581aaf500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3f48470000 CR3: 0000000076c44000 CR4: 00000000003506f0
Call Trace:
 <TASK>
 kref_put include/linux/kref.h:65 [inline]
 svc_put include/linux/sunrpc/svc.h:124 [inline]
 __write_ports_addxprt fs/nfsd/nfsctl.c:765 [inline]
 __write_ports fs/nfsd/nfsctl.c:791 [inline]
 write_ports+0xb99/0xfa0 fs/nfsd/nfsctl.c:844
 nfsctl_transaction_write+0x10c/0x150 fs/nfsd/nfsctl.c:113
 vfs_write+0x299/0x9a0 fs/read_write.c:582
 ksys_write+0x151/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f3f4859e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffd12e7a278 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f3f48825fa0 RCX: 00007f3f4859e0d9
RDX: 0000000000000005 RSI: 0000200000000500 RDI: 0000000000000003
RBP: 00007f3f48635024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3f48825fac R14: 00007f3f48825fa0 R15: 00007f3f48825fa0
 </TASK>