last executing test programs: 3.758319899s ago: executing program 1 (id=2): r0 = socket$inet_sctp(0x2, 0x1, 0x84) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) r1 = socket$inet_sctp(0x2, 0x1, 0x84) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @loopback}, 0x10) listen(r1, 0x5) connect$inet(r0, &(0x7f0000000100)={0x2, 0x4e21, @loopback}, 0x10) r2 = accept4(r1, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000300)={0x0, 0x1, 0x1, [0x0]}, 0xa) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000500)={0x0, 0x1, 0x1, [0x0]}, 0xa) sendto$inet(r0, &(0x7f0000000700)='hello', 0x5, 0x0, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000800)='world', 0x5, 0x0, 0x0, 0x0) shutdown(r0, 0x0) shutdown(r2, 0x0) 3.598560923s ago: executing program 2 (id=6): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), r0) sendmsg$SMC_PNETID_ADD(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x34, r1, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'lo\x00'}]}, 0x34}}, 0x0) syz_genetlink_get_family_id$smc(&(0x7f0000000400), r0) sendmsg(r0, &(0x7f0000000040), 0x0) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000a00)={0x38, 0x1401, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) r3 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r3, &(0x7f0000000b00)={0x2, 0x4e20, @loopback}, 0x10) listen(r3, 0x5) r4 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r4, &(0x7f0000000c00)={0x2, 0x4e20, @loopback}, 0x10) accept(r3, 0x0, 0x0) 3.426282557s ago: executing program 0 (id=7): socket(0x2, 0x1, 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='nfsd\x00', &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/portlist\x00', 0x2, 0x0) write(r0, &(0x7f0000000300)='3\n', 0x2) write(r0, &(0x7f0000000300)='4\n', 0x2) write(r0, &(0x7f0000000300)='5\n', 0x2) 3.277181811s ago: executing program 2 (id=8): r0 = fsopen(&(0x7f0000000000)='nfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='source\x00', &(0x7f0000000080)='127.0.0.1:/export\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000000c0)='addr\x00', &(0x7f0000000100)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000140)='vers\x00', &(0x7f0000000180)='3\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000001c0)='proto\x00', &(0x7f0000000200)='tcp\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000240)='mountproto\x00', &(0x7f0000000280)='tcp\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000002c0)='port\x00', &(0x7f0000000300)='2049\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000340)='mountport\x00', &(0x7f0000000380)='2049\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000003c0)='nconnect\x00', &(0x7f0000000400)='2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) nanosleep(&(0x7f0000000440)={0x2}, 0x0) 3.025067367s ago: executing program 0 (id=10): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000780)={'netdevsim0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000001300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newtfilter={0x4c, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0xffffffff, {}, {0x1}, {0x300, 0x1}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6}]}}, @TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x1}]}}]}, 0x4c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}]}, 0x38}}, 0x0) 2.90182695s ago: executing program 0 (id=11): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='proc\x00', &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000140)=@filename='nfsd\x00', &(0x7f0000000180)='./nfsd\x00', &(0x7f00000001c0)='nfsd\x00', 0x0, 0x0) r0 = socket(0x2, 0x1, 0x6) setsockopt(r0, 0x1, 0x2, &(0x7f0000000180)="01000000", 0x4) bind(r0, &(0x7f0000000200)=@in={0x2, 0x108, @loopback}, 0x10) listen(r0, 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x1, 0x0) write(r1, &(0x7f00000002c0)='3\n', 0x2) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x1, 0x0) write(r2, &(0x7f0000000340)='1\n', 0x2) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/auth.rpcsec.context/channel\x00', 0x1, 0x0) write(r3, &(0x7f00000003c0)='\\x01000000 2000000000 0 0 0 krb5 \\x01000000ffffff7f000000000000000011000000000102030405060708090a0b0c0d0e0f\n', 0x85) close(r3) r4 = socket(0x2, 0x1, 0x6) connect(r4, &(0x7f0000000500)=@in={0x2, 0x108, @loopback}, 0x10) write(r4, &(0x7f0000000600)="80000070123456780000000000000002000186a300000003000000000000000600000024000000010000000100000001000000020000000401000000000000060000000800000001000000000000000100000020040405ff00000000000000000000000100"/116, 0x74) read(r4, &(0x7f0000000800)=""/100, 0x100) close(r4) close(r0) 2.768579803s ago: executing program 1 (id=12): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(&(0x7f0000000000)=@filename='none\x00', &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/sctp/auth_enable\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='1\x00', 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/sys/net/sctp/addip_noauth\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='1\x00', 0x1) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000200)=[@in={0x2, 0x4e21, @local}], 0x10) listen(r2, 0x5) r3 = socket$inet_sctp(0x2, 0x1, 0x84) connect$inet(r3, &(0x7f0000000300)={0x2, 0x4e21, @local}, 0x10) 2.455597301s ago: executing program 1 (id=14): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/versions\x00', 0x2, 0x0) write(r0, &(0x7f0000000300)='-2 -3 -4\n\x00', 0x9) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0) write(r1, &(0x7f0000000500)='udp 2049\n\x00', 0x9) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./nfsd/threads\x00', 0x2, 0x0) write(r2, &(0x7f0000000700)='1\n\x00', 0x2) r3 = socket(0x2, 0x2, 0x0) sendto(r3, &(0x7f0000000800)='12345678901234567890\x00', 0x14, 0x0, &(0x7f0000000900)=@in={0x2, 0x801, @loopback}, 0x10) 2.296357045s ago: executing program 2 (id=15): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@setlink={0x20, 0x13, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, 0x1, 0x1}}, 0x20}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@ipv6_newaddr={0x2c, 0x14, 0x605, 0x0, 0x0, {0xa, 0x40, 0x0, 0x0, 0x1}, [@IFA_ADDRESS={0x14, 0x1, @local}]}, 0x2c}}, 0x0) r1 = socket$inet6(0xa, 0x3, 0x3a) sendto$inet6(r1, &(0x7f0000000200)="8700000000000000fe800000000000000000000000000001", 0x1c, 0x0, &(0x7f0000000300)={0xa, 0x0, 0x0, @mcast2, 0x1}, 0x1c) nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0) 2.172426658s ago: executing program 0 (id=16): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="4000000010000100000000000000000000000000000000001c0012800b00010076657468300000000c000280140001000b0001007665746831000000"], 0x40}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="20000000100001000000000000000000000000000100000001000000100003800b0001007665746830000000"], 0x20}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[@ANYBLOB="20000000100001000000000000000000000000000100000001000000100003800b0001007665746831000000"], 0x20}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r1) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)={0x28, r2, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xe, 0x1, @l2={'eth', 0x3a, 'veth0\x00'}}]}]}, 0x28}}, 0x0) r3 = socket$packet(0x11, 0x3, 0x8b88) bind$packet(r3, &(0x7f0000000100)={0x11, 0x8b88, 0x3, 0x1, 0x0, 0x6, @broadcast}, 0x14) sendto$packet(r3, &(0x7f0000000200)="ffffffffffff02000000000188ca1000"/66, 0x40, 0x0, &(0x7f0000000100)={0x11, 0x8b88, 0x3, 0x1, 0x0, 0x6, @broadcast}, 0x14) r4 = socket$packet(0x11, 0x3, 0x8b88) recvfrom(r4, &(0x7f0000000300), 0x200, 0x1, 0x0, 0x0) 1.991931562s ago: executing program 2 (id=17): r0 = fsopen(&(0x7f0000000100)='nfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000140)='source\x00', &(0x7f0000000180)='127.0.0.1:/export\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000001c0)='addr\x00', &(0x7f0000000200)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000240)='vers\x00', &(0x7f0000000280)='4.2\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000002c0)='xprtsec\x00', &(0x7f0000000300)='mtls\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x34, 0x10, 0x0, 0x0, 0x0, {0x2, 0x1}, [@generic="0800010001000000"]}, 0x34}}, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={0x34, 0x11, 0x0, 0x0, 0x0, {0x2, 0x1}, [@generic="0800010001000000"]}, 0x34}}, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)={0x34, 0x12, 0x0, 0x0, 0x0, {0x2, 0x1}, [@generic="0800010001000000"]}, 0x34}}, 0x0) sendmsg$nl_generic(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)={0x34, 0x13, 0x0, 0x0, 0x0, {0x2, 0x1}, [@generic="0800010001000000"]}, 0x34}}, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000600)={0x34, 0x14, 0x0, 0x0, 0x0, {0x2, 0x1}, [@generic="0800010001000000"]}, 0x34}}, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)={0x34, 0x15, 0x0, 0x0, 0x0, {0x2, 0x1}, [@generic="0800010001000000"]}, 0x34}}, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000780)={0x34, 0x16, 0x0, 0x0, 0x0, {0x2, 0x1}, [@generic="0800010001000000"]}, 0x34}}, 0x0) sendmsg$nl_generic(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000840)={0x34, 0x17, 0x0, 0x0, 0x0, {0x2, 0x1}, [@generic="0800010001000000"]}, 0x34}}, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000900)={0x34, 0x18, 0x0, 0x0, 0x0, {0x2, 0x1}, [@generic="0800010001000000"]}, 0x34}}, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000980)={&(0x7f00000009c0)={0x34, 0x19, 0x0, 0x0, 0x0, {0x2, 0x1}, [@generic="0800010001000000"]}, 0x34}}, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000a80)={0x34, 0x1a, 0x0, 0x0, 0x0, {0x2, 0x1}, [@generic="0800010001000000"]}, 0x34}}, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000b40)={0x34, 0x1b, 0x0, 0x0, 0x0, {0x2, 0x1}, [@generic="0800010001000000"]}, 0x34}}, 0x0) 1.900338474s ago: executing program 1 (id=18): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)={0x38, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x11d8}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1234567890abcdef}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xfedcba0987654321}]}]}, 0x38}}, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)={0x54, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x40, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x1127, @empty}}, {0x14, 0x2, @in={0x2, 0x1127, @empty}}}}]}]}, 0x54}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={0x54, r1, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NODE={0x40, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "0102030405060708090a0b0c0d0e0f1011121314"}}]}]}, 0x54}}, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000200)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000300)="0102030405060708090a0b0c0d0e0f10", 0x10) setsockopt$ALG_SET_AEAD_AUTHSIZE(r2, 0x117, 0x5, 0x0, 0x10) r3 = accept$alg(r2, 0x0, 0x0) sendmsg$alg(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000480)="010001000000000000000000000000010000000000000000400e001c0000001c00"/56, 0x34}], 0x1, &(0x7f0000000500)=[@iv={0x20, 0x117, 0x2, 0xc, "111213140000000000000001"}, @op={0x18, 0x117, 0x3, 0x1}, @assoc={0x18, 0x117, 0x4, 0x18}], 0x50}, 0x0) read$alg(r3, &(0x7f0000000600), 0x44) syz_emit_ethernet(0x6e, &(0x7f00000005d8)=ANY=[@ANYBLOB="ffffffffffff00112233446608004500006000000000401121baac140001ac1400aa04d21127004c0000"], 0x0) 1.827839876s ago: executing program 0 (id=19): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={&(0x7f0000000200), 0xc, &(0x7f0000000100)=[{&(0x7f0000000300)=ANY=[@ANYBLOB="4c000000100001060000000000000000000000000000000000000000000000000b00030064756d6d7930000008001f0004000000180012000a00010064756d6d79000000"], 0x4c}], 0x1}, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'dummy0\x00'}) sendmsg$netlink(r0, &(0x7f0000000100)={&(0x7f0000000200), 0xc, &(0x7f0000000300)=[{&(0x7f0000000400)=ANY=[@ANYBLOB="30000000240005050000000000000000000000000300000000000100ffffffff000000000c00010063616b655f6d7100"], 0x30}], 0x1}, 0x0) 1.641977541s ago: executing program 2 (id=20): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='none\x00', &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/nfsv4gracetime\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='1\n\x00', 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/nfsv4leasetime\x00', 0x1, 0x0) write(r1, &(0x7f0000000200)='1\n\x00', 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./nfsd/versions\x00', 0x1, 0x0) write(r2, &(0x7f0000000280)='-3\n+4\n+4.2\n\x00', 0xb) r3 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./nfsd/portlist\x00', 0x1, 0x0) write(r3, &(0x7f0000000300)='tcp 2049\n\x00', 0x9) r4 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./nfsd/threads\x00', 0x1, 0x0) write(r4, &(0x7f0000000380)='1\n\x00', 0x2) (async) r5 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./nfsd/v4_end_grace\x00', 0x1, 0x0) write(r5, &(0x7f0000000400)='1\n\x00', 0x2) 1.308682368s ago: executing program 0 (id=22): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='none\x00', &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, &(0x7f0000000180)) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x801, @loopback}, 0x10) listen(r0, 0x5) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/versions\x00', 0x1, 0x0) write(r1, &(0x7f0000000240)='-2 -3\n', 0x6) r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./nfsd/portlist\x00', 0x1, 0x0) write(r2, &(0x7f00000002c0)='3\n', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./nfsd/threads\x00', 0x1, 0x0) write(r3, &(0x7f0000000340)='1\n', 0x2) r4 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r4, &(0x7f0000000380)={0x2, 0x801, @loopback}, 0x10) write(r4, &(0x7f00000003c0)="80000040000000010000000000000002000186a30000000400000001000000010000001400000001000000000000000000000000000000000000000000000000000000000000000100000018", 0x44) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./proc\x00', 0x1ff) mount(&(0x7f0000000480)=@filename='none\x00', &(0x7f00000004c0)='./proc\x00', &(0x7f0000000500)='proc\x00', 0x0, &(0x7f0000000540)) r5 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x1, 0x0) write(r5, &(0x7f00000005c0)='nfsd 127.0.0.1 999999999 anonymous\n', 0x23) r6 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./proc/net/rpc/nfsd.export/channel\x00', 0x1, 0x0) write(r6, &(0x7f0000000640)='127.0.0.1 / 999999999 0 0 0 0\n', 0x1e) 1.25800256s ago: executing program 1 (id=24): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./nfsd\x00', &(0x7f0000000080)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./nfsd/versions\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='-4\n\x00', 0x3) close(r0) r1 = socket$inet_tcp(0x2, 0x1, 0x6) bind$inet(r1, &(0x7f0000000200)={0x2, 0x800, @empty}, 0x10) listen(r1, 0x80) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0) write(r2, &(0x7f0000000180)='3\x00', 0x1) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='8\n\x00', 0x2) close(r3) r4 = socket$inet_tcp(0x2, 0x1, 0x6) connect$inet(r4, &(0x7f0000000200)={0x2, 0x800, @loopback}, 0x10) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) 1.086086934s ago: executing program 3 (id=25): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newlink={0x30, 0x10, 0x605, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'dummy0\x00'}]}, 0x30}}, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'dummy0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="2c00000018000506000000000000000023000000fe00000100000000050001000400000008000400", @ANYRES32=r2], 0x2c}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000500)=@dellink={0x20, 0x11, 0x5, 0x0, 0x0, {0x0, 0x0, 0x0, r2}}, 0x20}}, 0x0) 894.585268ms ago: executing program 3 (id=26): r0 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r0, 0x5) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x12, 0x4, 0x4, 0x10, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000200)={r1, &(0x7f0000000000)="01000000", &(0x7f0000000040)=@tcp=r0}, 0x20) close(r1) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x12, 0x4, 0x4, 0x10, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000200)={r2, &(0x7f0000000000)="01000000", &(0x7f0000000040)=@tcp=r0}, 0x20) close(r2) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x12, 0x4, 0x4, 0x10, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000200)={r3, &(0x7f0000000000)="01000000", &(0x7f0000000040)=@tcp=r0}, 0x20) close(r3) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) close(r0) 266.135854ms ago: executing program 3 (id=27): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x0, 0x4, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0x4, &(0x7f0000000400), {[{{@uncond, 0x0, 0x0, 0x0, 0x0, {}, [@common=@ah]}}, {{@uncond}}, {{@uncond}}], {{}, {0x0, '\x00', 0x0, 0x0}}}}, 0x200) sendto$inet6(r0, &(0x7f0000000100)='\x00', 0x1, 0x0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) 241.131035ms ago: executing program 3 (id=28): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x0, 0x2, 'syz0\x00'}, {0x0, 0x41, 'rxe\x00'}, {0x0, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x0, 0x2, 'syz1\x00'}, {0x0, 0x41, 'siw\x00'}, {0x0, 0x33, 'veth0\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x0, 0x2, 'syz2\x00'}, {0x0, 0x41, 'rxe\x00'}, {0x0, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x0, 0x2, 'syz0\x00'}, {0x0, 0x41, 'siw\x00'}, {0x0, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) r2 = socket$inet_smc(0x2b, 0x1, 0x0) bind(r1, &(0x7f0000000100)=@in={0x2, 0x2389, @loopback}, 0x10) listen(r1, 0x5) connect(r2, &(0x7f0000000100)=@in={0x2, 0x2389, @loopback}, 0x10) r3 = accept(r1, 0x0, 0x0) sendto(r2, &(0x7f0000000200)='hello', 0x5, 0x0, 0x0, 0x0) recvmsg(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000400)=""/100, 0x64}], 0x1}, 0x0) 124.735977ms ago: executing program 3 (id=29): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0xe, 0x4, 0x2b8, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x0, 0xffffffff, 0x4, 0x0, {[{{@ip={@private=0xa010102, @local, 0x0, 0x0, 'lo\x00', 'lo\x00'}, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'lo\x00', {0x20, 0x2710, 0x2710, 0x64, 0x64, 0x64, 0x64, 0x8, 0x8}}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x400) syz_emit_ethernet(0x2a, &(0x7f0000000140)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @dev, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x65, 0x0, 0x0, 0x1, 0x0, @private, @broadcast}, @echo_reply={0x0, 0x0, 0x0, 0x64, 0x1, '\x00'}}}}}, 0x0) 988.14µs ago: executing program 3 (id=30): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(&(0x7f0000000040)=@filename='nfsd\x00', &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x1, 0x0) write(r0, &(0x7f0000000140)='udp 2049\x00', 0x9) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/threads\x00', 0x1, 0x0) write(r1, &(0x7f00000001c0)='2\x00', 0x2) r2 = socket$inet_udp(0x2, 0x2, 0x0) sendto$inet(r2, &(0x7f0000000200)="0000000100000000", 0x8, 0x0, &(0x7f0000000240)={0x2, 0x801, @loopback}, 0x10) sendto$inet(r2, &(0x7f0000000200)="000000010000000000000001000186a30000000300000000", 0x18, 0x0, &(0x7f0000000240)={0x2, 0x801, @loopback}, 0x10) sendto$inet(r2, &(0x7f0000000200)="000000010000000000000002000186a30000000300000000ffffffff00"/40, 0x24, 0x0, &(0x7f0000000240)={0x2, 0x801, @loopback}, 0x10) nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0) 0s ago: executing program 2 (id=31): r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000000000)=@abs={0x1, 0x0, 0x4e20}, 0x18) listen(r0, 0x5) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='none\x00', &(0x7f0000000100)='./nfsd\x00', &(0x7f0000000140)='nfsd\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd\x00', 0x0, 0x0) mkdirat(r1, &(0x7f0000000200)='threads\x00', 0x0) r2 = openat(r1, &(0x7f0000000200)='threads\x00', 0x2, 0x0) write(r2, &(0x7f0000000300)='1\x00', 0x2) r3 = accept4$unix(r0, 0x0, 0x0, 0x0) write(r3, &(0x7f0000000400)="8000001c000000010000000100"/32, 0x20) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.130' (ED25519) to the list of known hosts. [ 78.686507][ T5762] cgroup: Unknown subsys name 'net' [ 78.820075][ T5762] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 80.478964][ T5762] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 82.129519][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 82.156988][ T5785] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 82.164473][ T51] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 82.168592][ T5785] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 82.179701][ T5785] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 82.187861][ T5785] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 82.196391][ T5785] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 82.203669][ T51] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 82.205720][ T5785] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 82.219322][ T5785] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 82.227468][ T5785] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 82.227813][ T51] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 82.244242][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 82.255642][ T5786] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 82.264171][ T5786] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 82.272574][ T5786] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 82.283633][ T51] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 82.291688][ T51] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 82.292224][ T5786] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 82.301020][ T51] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 82.313009][ T5786] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 82.314854][ T51] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 82.322850][ T5786] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 82.329007][ T51] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 82.774940][ T5777] chnl_net:caif_netlink_parms(): no params data found [ 82.889480][ T5778] chnl_net:caif_netlink_parms(): no params data found [ 82.960103][ T5777] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.968053][ T5777] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.975860][ T5777] bridge_slave_0: entered allmulticast mode [ 82.983864][ T5777] bridge_slave_0: entered promiscuous mode [ 82.998459][ T5777] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.005748][ T5777] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.013997][ T5777] bridge_slave_1: entered allmulticast mode [ 83.021252][ T5777] bridge_slave_1: entered promiscuous mode [ 83.046608][ T5781] chnl_net:caif_netlink_parms(): no params data found [ 83.128331][ T5777] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.159099][ T5774] chnl_net:caif_netlink_parms(): no params data found [ 83.172640][ T5777] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.256528][ T5778] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.264225][ T5778] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.271555][ T5778] bridge_slave_0: entered allmulticast mode [ 83.278683][ T5778] bridge_slave_0: entered promiscuous mode [ 83.332596][ T5778] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.339872][ T5778] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.347528][ T5778] bridge_slave_1: entered allmulticast mode [ 83.355113][ T5778] bridge_slave_1: entered promiscuous mode [ 83.375324][ T5777] team0: Port device team_slave_0 added [ 83.421343][ T5777] team0: Port device team_slave_1 added [ 83.427528][ T5781] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.434948][ T5781] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.442538][ T5781] bridge_slave_0: entered allmulticast mode [ 83.450000][ T5781] bridge_slave_0: entered promiscuous mode [ 83.473273][ T5778] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.494411][ T5781] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.505361][ T5781] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.512730][ T5781] bridge_slave_1: entered allmulticast mode [ 83.519870][ T5781] bridge_slave_1: entered promiscuous mode [ 83.561583][ T5778] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.587733][ T5781] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.600857][ T5774] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.608136][ T5774] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.615630][ T5774] bridge_slave_0: entered allmulticast mode [ 83.623127][ T5774] bridge_slave_0: entered promiscuous mode [ 83.642434][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.649622][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.676466][ T5777] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 83.692845][ T5781] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.714104][ T5774] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.724265][ T5774] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.732166][ T5774] bridge_slave_1: entered allmulticast mode [ 83.739270][ T5774] bridge_slave_1: entered promiscuous mode [ 83.758756][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 83.766063][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 83.792617][ T5777] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 83.834906][ T5781] team0: Port device team_slave_0 added [ 83.846068][ T5778] team0: Port device team_slave_0 added [ 83.860573][ T5778] team0: Port device team_slave_1 added [ 83.890051][ T5781] team0: Port device team_slave_1 added [ 83.945949][ T5774] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.962004][ T5774] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 83.972356][ T5781] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 83.979361][ T5781] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.005730][ T5781] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.018925][ T5781] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.026052][ T5781] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.052201][ T5781] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.066845][ T5778] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.074124][ T5778] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.100564][ T5778] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.157659][ T5777] hsr_slave_0: entered promiscuous mode [ 84.164602][ T5777] hsr_slave_1: entered promiscuous mode [ 84.173478][ T5778] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.180484][ T5778] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.207012][ T5778] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.240330][ T5774] team0: Port device team_slave_0 added [ 84.251367][ T5774] team0: Port device team_slave_1 added [ 84.271914][ T5779] Bluetooth: hci1: command tx timeout [ 84.330395][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.337782][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.363957][ T5779] Bluetooth: hci2: command tx timeout [ 84.369747][ T5774] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.380447][ T5779] Bluetooth: hci3: command tx timeout [ 84.386541][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.394344][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.421479][ T5774] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.431944][ T5779] Bluetooth: hci0: command tx timeout [ 84.480832][ T5781] hsr_slave_0: entered promiscuous mode [ 84.488217][ T5781] hsr_slave_1: entered promiscuous mode [ 84.494860][ T5781] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 84.504742][ T5781] Cannot create hsr debugfs directory [ 84.545604][ T5778] hsr_slave_0: entered promiscuous mode [ 84.552945][ T5778] hsr_slave_1: entered promiscuous mode [ 84.559325][ T5778] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 84.567307][ T5778] Cannot create hsr debugfs directory [ 84.727830][ T5774] hsr_slave_0: entered promiscuous mode [ 84.734622][ T5774] hsr_slave_1: entered promiscuous mode [ 84.741577][ T5774] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 84.749205][ T5774] Cannot create hsr debugfs directory [ 85.013089][ T5777] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 85.063672][ T5777] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 85.075807][ T5777] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 85.118844][ T5777] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 85.185489][ T5778] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 85.197067][ T5778] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 85.215254][ T5778] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 85.226281][ T5778] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 85.308817][ T5781] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 85.330361][ T5781] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 85.345729][ T5781] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 85.357397][ T5781] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 85.492007][ T5774] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 85.503429][ T5774] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 85.515844][ T5774] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 85.528513][ T5774] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 85.585416][ T5777] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.657186][ T5778] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.675694][ T5777] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.708912][ T3448] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.716396][ T3448] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.740324][ T5778] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.758983][ T3448] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.766239][ T3448] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.789555][ T5781] 8021q: adding VLAN 0 to HW filter on device bond0 [ 85.809952][ T3448] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.817240][ T3448] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.850575][ T3448] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.857823][ T3448] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.873012][ T5781] 8021q: adding VLAN 0 to HW filter on device team0 [ 85.948729][ T2939] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.956000][ T2939] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.018059][ T3448] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.025328][ T3448] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.088629][ T5774] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.166811][ T5774] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.235578][ T2916] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.242878][ T2916] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.274842][ T2916] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.282114][ T2916] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.353477][ T5779] Bluetooth: hci1: command tx timeout [ 86.432482][ T5779] Bluetooth: hci3: command tx timeout [ 86.437977][ T5779] Bluetooth: hci2: command tx timeout [ 86.511207][ T5786] Bluetooth: hci0: command tx timeout [ 86.616979][ T5777] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.769652][ T5777] veth0_vlan: entered promiscuous mode [ 86.815823][ T5778] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.836434][ T5781] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.856515][ T5777] veth1_vlan: entered promiscuous mode [ 86.888128][ T5774] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 86.979781][ T5777] veth0_macvtap: entered promiscuous mode [ 87.007346][ T5778] veth0_vlan: entered promiscuous mode [ 87.034167][ T5777] veth1_macvtap: entered promiscuous mode [ 87.074038][ T5778] veth1_vlan: entered promiscuous mode [ 87.088944][ T5781] veth0_vlan: entered promiscuous mode [ 87.106619][ T5774] veth0_vlan: entered promiscuous mode [ 87.127508][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.142794][ T5774] veth1_vlan: entered promiscuous mode [ 87.169825][ T5781] veth1_vlan: entered promiscuous mode [ 87.190221][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.293025][ T5778] veth0_macvtap: entered promiscuous mode [ 87.307521][ T5777] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.319113][ T5777] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.334469][ T5777] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.344650][ T5777] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.379261][ T5774] veth0_macvtap: entered promiscuous mode [ 87.396248][ T5778] veth1_macvtap: entered promiscuous mode [ 87.420611][ T5774] veth1_macvtap: entered promiscuous mode [ 87.509930][ T5781] veth0_macvtap: entered promiscuous mode [ 87.586050][ T5781] veth1_macvtap: entered promiscuous mode [ 87.609794][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 87.629188][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.642992][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.654086][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 87.666923][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.678513][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 87.693645][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.706855][ T5778] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.753294][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 87.765170][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.777207][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.788252][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 87.800419][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.810426][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 87.821995][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.838321][ T5778] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.861422][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 87.878288][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.889159][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 87.900171][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.910463][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 87.921852][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 87.933962][ T5781] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.969569][ T5778] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.979121][ T5778] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.989762][ T5778] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.999088][ T5778] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.013854][ T5774] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.023201][ T5774] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.034969][ T5774] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.044226][ T5774] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.056209][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 88.067977][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.078436][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 88.089412][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.099629][ T5781] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 88.110569][ T5781] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.123576][ T5781] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.155896][ T42] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.182875][ T5781] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.194308][ T5781] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.203701][ T5781] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.213175][ T5781] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.221981][ T42] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.312219][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.328654][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.420082][ T2911] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.432041][ T5786] Bluetooth: hci1: command tx timeout [ 88.450762][ T2911] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.514562][ T5786] Bluetooth: hci3: command tx timeout [ 88.515778][ T5779] Bluetooth: hci2: command tx timeout [ 88.544678][ T2939] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.564701][ T2939] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.601796][ T5779] Bluetooth: hci0: command tx timeout [ 88.687261][ T2911] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.695477][ T2911] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.725170][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.751333][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.759274][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.769132][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.891635][ T2911] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.900124][ T2911] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.272260][ T5849] smc: net device lo applied user defined pnetid SYZ0 [ 89.304697][ T5849] Zero length message leads to an empty skb [ 89.343420][ T5852] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4'. [ 89.372850][ T5852] netlink: 220 bytes leftover after parsing attributes in process `syz.3.4'. [ 89.420412][ T5852] netlink: 220 bytes leftover after parsing attributes in process `syz.3.4'. [ 89.575327][ T5855] svc: failed to register nfsdv3 RPC service (errno 111). [ 89.597963][ T5855] svc: failed to register nfsaclv3 RPC service (errno 111). [ 89.708898][ T5861] tipc: Started in network mode [ 89.722002][ T5861] tipc: Node identity 2abe85b79c48, cluster identity 4711 [ 89.733260][ T5861] tipc: Enabled bearer , priority 10 [ 89.864433][ T5860] tipc: Resetting bearer [ 89.903569][ T5860] tipc: Disabling bearer [ 90.007159][ T5865] svc: failed to register nfsdv3 RPC service (errno 111). [ 90.047299][ T5865] svc: failed to register nfsaclv3 RPC service (errno 111). [ 90.252002][ T5866] svc: failed to register nfsdv3 RPC service (errno 111). [ 90.270435][ T5866] svc: failed to register nfsaclv3 RPC service (errno 111). [ 90.415942][ T5872] svc: failed to register nfsdv3 RPC service (errno 111). [ 90.454646][ T5872] svc: failed to register nfsaclv3 RPC service (errno 111). [ 90.511853][ T5779] Bluetooth: hci1: command tx timeout [ 90.562399][ T5873] svc: failed to register nfsdv3 RPC service (errno 111). [ 90.573541][ T5873] svc: failed to register nfsaclv3 RPC service (errno 111). [ 90.591332][ T5779] Bluetooth: hci2: command tx timeout [ 90.600973][ T5779] Bluetooth: hci3: command tx timeout [ 90.672921][ T5779] Bluetooth: hci0: command tx timeout [ 90.782581][ T5884] netlink: 32 bytes leftover after parsing attributes in process `syz.0.16'. [ 90.802308][ T5884] tipc: Started in network mode [ 90.807381][ T5884] tipc: Node identity aaaaaaaaaa18, cluster identity 4711 [ 90.821446][ T5884] tipc: Enabled bearer , priority 10 [ 90.996112][ T5890] tipc: Started in network mode [ 91.005040][ T5890] tipc: Node identity efcdab90785634122143658709badcfe, cluster identity 4568 [ 91.016449][ T5892] netlink: 8 bytes leftover after parsing attributes in process `syz.0.19'. [ 91.028004][ T5890] tipc: Enabling of bearer rejected, failed to enable media [ 91.326592][ T5903] netlink: 16 bytes leftover after parsing attributes in process `syz.3.21'. [ 91.340381][ T5903] netlink: 24 bytes leftover after parsing attributes in process `syz.3.21'. [ 91.705840][ T5919] netlink: 16 bytes leftover after parsing attributes in process `syz.3.25'. [ 91.932302][ T23] tipc: Node number set to 11709098 [ 92.278110][ T969] cfg80211: failed to load regulatory.db [ 92.519468][ T5928] netlink: 40 bytes leftover after parsing attributes in process `syz.3.28'. [ 92.532917][ T5928] netlink: 40 bytes leftover after parsing attributes in process `syz.3.28'. [ 92.533200][ T5900] NFSD: attempt to initialize umh client tracking in a container ignored. [ 92.552228][ T5900] NFSD: attempt to initialize legacy client tracking in a container ignored. [ 92.565021][ T5900] NFSD: Unable to initialize client recovery tracking! (-22) [ 92.572811][ T5900] NFSD: starting 90-second grace period (net f00003d4) [ 93.974921][ T5914] NFSD: attempt to initialize umh client tracking in a container ignored. [ 93.985308][ T5914] NFSD: attempt to initialize legacy client tracking in a container ignored. [ 93.994375][ T5914] NFSD: Unable to initialize client recovery tracking! (-22) [ 94.004900][ T5914] NFSD: starting 90-second grace period (net f000041d) [ 94.129609][ T5917] ================================================================== [ 94.137766][ T5917] BUG: KASAN: slab-use-after-free in nfsd_create_serv+0x116/0x5c0 [ 94.145647][ T5917] Write of size 4 at addr ffff88801c39d850 by task syz.1.24/5917 [ 94.153624][ T5917] [ 94.156012][ T5917] CPU: 1 PID: 5917 Comm: syz.1.24 Not tainted syzkaller #0 [ 94.163250][ T5917] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 94.173340][ T5917] Call Trace: [ 94.176643][ T5917] [ 94.179614][ T5917] dump_stack_lvl+0x18c/0x250 [ 94.184329][ T5917] ? __lock_acquire+0x7d80/0x7d80 [ 94.189436][ T5917] ? show_regs_print_info+0x20/0x20 [ 94.194693][ T5917] ? load_image+0x420/0x420 [ 94.199252][ T5917] ? _raw_spin_lock_irqsave+0xc0/0x100 [ 94.204759][ T5917] ? __virt_addr_valid+0x10c/0x380 [ 94.209895][ T5917] ? __virt_addr_valid+0x10c/0x380 [ 94.215027][ T5917] ? __virt_addr_valid+0x10c/0x380 [ 94.220173][ T5917] ? __virt_addr_valid+0x10c/0x380 [ 94.225356][ T5917] print_report+0xa8/0x210 [ 94.229822][ T5917] ? nfsd_create_serv+0x116/0x5c0 [ 94.234898][ T5917] kasan_report+0x117/0x150 [ 94.239445][ T5917] ? nfsd_create_serv+0x116/0x5c0 [ 94.244500][ T5917] kasan_check_range+0x241/0x290 [ 94.249467][ T5917] nfsd_create_serv+0x116/0x5c0 [ 94.254387][ T5917] ? __mutex_lock+0x4d2/0xc80 [ 94.259104][ T5917] ? nfsd+0x270/0x270 [ 94.263115][ T5917] ? nfsd_svc+0x65/0xab0 [ 94.267412][ T5917] ? mutex_lock_nested+0x20/0x20 [ 94.272380][ T5917] ? net_generic+0x1e/0x240 [ 94.276945][ T5917] ? net_generic+0x1e/0x240 [ 94.281488][ T5917] nfsd_svc+0x183/0xab0 [ 94.285674][ T5917] ? qword_get+0x5a9/0x640 [ 94.290259][ T5917] write_threads+0x393/0x510 [ 94.294890][ T5917] ? write_unlock_fs+0x450/0x450 [ 94.299861][ T5917] ? __might_fault+0xaa/0x120 [ 94.304568][ T5917] ? __might_fault+0xaa/0x120 [ 94.309298][ T5917] ? simple_transaction_get+0x11d/0x140 [ 94.314908][ T5917] nfsctl_transaction_write+0x10c/0x150 [ 94.320490][ T5917] ? nfsctl_transaction_read+0x1b0/0x1b0 [ 94.326177][ T5917] vfs_write+0x299/0x9a0 [ 94.330730][ T5917] ? file_end_write+0x250/0x250 [ 94.335637][ T5917] ? __fget_files+0x28/0x460 [ 94.340265][ T5917] ? __fget_files+0x3fc/0x460 [ 94.344985][ T5917] ? __fdget_pos+0x2a3/0x330 [ 94.349637][ T5917] ? ksys_write+0x74/0x260 [ 94.354095][ T5917] ksys_write+0x151/0x260 [ 94.358637][ T5917] ? __ia32_sys_read+0x90/0x90 [ 94.363439][ T5917] ? lockdep_hardirqs_on+0x98/0x150 [ 94.368760][ T5917] do_syscall_64+0x55/0xb0 [ 94.373209][ T5917] ? clear_bhb_loop+0x40/0x90 [ 94.377919][ T5917] ? clear_bhb_loop+0x40/0x90 [ 94.382662][ T5917] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 94.388611][ T5917] RIP: 0033:0x7f9e4ef9de99 [ 94.393061][ T5917] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.412820][ T5917] RSP: 002b:00007f9e4fe50028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 94.421264][ T5917] RAX: ffffffffffffffda RBX: 00007f9e4f226180 RCX: 00007f9e4ef9de99 [ 94.429303][ T5917] RDX: 0000000000000002 RSI: 0000200000000240 RDI: 0000000000000004 [ 94.437314][ T5917] RBP: 00007f9e4f033eaf R08: 0000000000000000 R09: 0000000000000000 [ 94.445331][ T5917] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.453336][ T5917] R13: 00007f9e4f226218 R14: 00007f9e4f226180 R15: 00007ffd7ac37928 [ 94.461359][ T5917] [ 94.464401][ T5917] [ 94.466743][ T5917] Allocated by task 5915: [ 94.471094][ T5917] kasan_set_track+0x4e/0x70 [ 94.475755][ T5917] __kasan_kmalloc+0x8f/0xa0 [ 94.480373][ T5917] __svc_create+0x60/0xa20 [ 94.484816][ T5917] svc_create_pooled+0x66a/0x7e0 [ 94.489775][ T5917] nfsd_create_serv+0x29f/0x5c0 [ 94.494654][ T5917] write_ports+0x698/0xfa0 [ 94.499103][ T5917] nfsctl_transaction_write+0x10c/0x150 [ 94.504707][ T5917] vfs_write+0x299/0x9a0 [ 94.508978][ T5917] ksys_write+0x151/0x260 [ 94.513339][ T5917] do_syscall_64+0x55/0xb0 [ 94.517783][ T5917] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 94.523706][ T5917] [ 94.526052][ T5917] Freed by task 5915: [ 94.530061][ T5917] kasan_set_track+0x4e/0x70 [ 94.534686][ T5917] kasan_save_free_info+0x28/0x40 [ 94.539747][ T5917] ____kasan_slab_free+0x126/0x1f0 [ 94.544889][ T5917] slab_free_freelist_hook+0x130/0x1a0 [ 94.550466][ T5917] __kmem_cache_free+0xba/0x1f0 [ 94.555357][ T5917] write_ports+0xb1a/0xfa0 [ 94.559807][ T5917] nfsctl_transaction_write+0x10c/0x150 [ 94.565384][ T5917] vfs_write+0x299/0x9a0 [ 94.569656][ T5917] ksys_write+0x151/0x260 [ 94.574019][ T5917] do_syscall_64+0x55/0xb0 [ 94.578466][ T5917] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 94.584390][ T5917] [ 94.586739][ T5917] The buggy address belongs to the object at ffff88801c39d800 [ 94.586739][ T5917] which belongs to the cache kmalloc-512 of size 512 [ 94.600821][ T5917] The buggy address is located 80 bytes inside of [ 94.600821][ T5917] freed 512-byte region [ffff88801c39d800, ffff88801c39da00) [ 94.614655][ T5917] [ 94.617002][ T5917] The buggy address belongs to the physical page: [ 94.623451][ T5917] page:ffffea000070e700 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1c39c [ 94.633644][ T5917] head:ffffea000070e700 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 94.642626][ T5917] anon flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 94.651086][ T5917] page_type: 0xffffffff() [ 94.655485][ T5917] raw: 00fff00000000840 ffff888017c41c80 0000000000000000 dead000000000001 [ 94.664197][ T5917] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 94.672811][ T5917] page dumped because: kasan: bad access detected [ 94.679345][ T5917] page_owner tracks the page as allocated [ 94.685089][ T5917] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 7985870575, free_ts 0 [ 94.704760][ T5917] post_alloc_hook+0x1c1/0x200 [ 94.709577][ T5917] get_page_from_freelist+0x2181/0x22a0 [ 94.715159][ T5917] __alloc_pages+0x1f0/0x460 [ 94.719781][ T5917] alloc_page_interleave+0x24/0x1e0 [ 94.725006][ T5917] alloc_slab_page+0x5d/0x180 [ 94.729731][ T5917] new_slab+0x87/0x2d0 [ 94.733830][ T5917] ___slab_alloc+0xc5c/0x12f0 [ 94.738540][ T5917] __kmem_cache_alloc_node+0x11f/0x250 [ 94.744077][ T5917] kmalloc_trace+0x2a/0xe0 [ 94.748536][ T5917] device_add+0xb6/0xc40 [ 94.752806][ T5917] tty_register_device_attr+0x425/0x950 [ 94.758391][ T5917] tty_register_driver+0x598/0xb30 [ 94.763560][ T5917] legacy_pty_init+0x3a6/0x600 [ 94.768378][ T5917] pty_init+0xe/0x20 [ 94.772298][ T5917] do_one_initcall+0x242/0x790 [ 94.777094][ T5917] do_initcall_level+0x13d/0x1f0 [ 94.782071][ T5917] page_owner free stack trace missing [ 94.787459][ T5917] [ 94.789802][ T5917] Memory state around the buggy address: [ 94.795462][ T5917] ffff88801c39d700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 94.803548][ T5917] ffff88801c39d780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 94.811635][ T5917] >ffff88801c39d800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.819717][ T5917] ^ [ 94.826427][ T5917] ffff88801c39d880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.834536][ T5917] ffff88801c39d900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.842633][ T5917] ================================================================== [ 94.868604][ T5917] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 94.875885][ T5917] CPU: 1 PID: 5917 Comm: syz.1.24 Not tainted syzkaller #0 [ 94.883141][ T5917] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 94.893254][ T5917] Call Trace: [ 94.896586][ T5917] [ 94.899575][ T5917] dump_stack_lvl+0x18c/0x250 [ 94.904341][ T5917] ? show_regs_print_info+0x20/0x20 [ 94.909586][ T5917] ? load_image+0x420/0x420 [ 94.914138][ T5917] panic+0x2ca/0x720 [ 94.918097][ T5917] ? bpf_jit_dump+0xd0/0xd0 [ 94.922679][ T5917] ? _raw_spin_unlock_irqrestore+0x111/0x120 [ 94.928735][ T5917] ? _raw_spin_unlock+0x40/0x40 [ 94.933660][ T5917] ? print_memory_metadata+0x314/0x400 [ 94.939185][ T5917] ? nfsd_create_serv+0x116/0x5c0 [ 94.944274][ T5917] check_panic_on_warn+0x84/0xa0 [ 94.949275][ T5917] ? nfsd_create_serv+0x116/0x5c0 [ 94.954647][ T5917] end_report+0x6f/0x130 [ 94.958957][ T5917] kasan_report+0x128/0x150 [ 94.963520][ T5917] ? nfsd_create_serv+0x116/0x5c0 [ 94.968611][ T5917] kasan_check_range+0x241/0x290 [ 94.973611][ T5917] nfsd_create_serv+0x116/0x5c0 [ 94.978522][ T5917] ? __mutex_lock+0x4d2/0xc80 [ 94.983284][ T5917] ? nfsd+0x270/0x270 [ 94.987321][ T5917] ? nfsd_svc+0x65/0xab0 [ 94.991620][ T5917] ? mutex_lock_nested+0x20/0x20 [ 94.996625][ T5917] ? net_generic+0x1e/0x240 [ 95.001185][ T5917] ? net_generic+0x1e/0x240 [ 95.005749][ T5917] nfsd_svc+0x183/0xab0 [ 95.009954][ T5917] ? qword_get+0x5a9/0x640 [ 95.014474][ T5917] write_threads+0x393/0x510 [ 95.019156][ T5917] ? write_unlock_fs+0x450/0x450 [ 95.024159][ T5917] ? __might_fault+0xaa/0x120 [ 95.028888][ T5917] ? __might_fault+0xaa/0x120 [ 95.033652][ T5917] ? simple_transaction_get+0x11d/0x140 [ 95.039331][ T5917] nfsctl_transaction_write+0x10c/0x150 [ 95.044955][ T5917] ? nfsctl_transaction_read+0x1b0/0x1b0 [ 95.050636][ T5917] vfs_write+0x299/0x9a0 [ 95.054934][ T5917] ? file_end_write+0x250/0x250 [ 95.059809][ T5917] ? __fget_files+0x28/0x460 [ 95.064426][ T5917] ? __fget_files+0x3fc/0x460 [ 95.069283][ T5917] ? __fdget_pos+0x2a3/0x330 [ 95.073913][ T5917] ? ksys_write+0x74/0x260 [ 95.078392][ T5917] ksys_write+0x151/0x260 [ 95.082787][ T5917] ? __ia32_sys_read+0x90/0x90 [ 95.087598][ T5917] ? lockdep_hardirqs_on+0x98/0x150 [ 95.092862][ T5917] do_syscall_64+0x55/0xb0 [ 95.097305][ T5917] ? clear_bhb_loop+0x40/0x90 [ 95.102023][ T5917] ? clear_bhb_loop+0x40/0x90 [ 95.106797][ T5917] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 95.112731][ T5917] RIP: 0033:0x7f9e4ef9de99 [ 95.118294][ T5917] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.137936][ T5917] RSP: 002b:00007f9e4fe50028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 95.146407][ T5917] RAX: ffffffffffffffda RBX: 00007f9e4f226180 RCX: 00007f9e4ef9de99 [ 95.154420][ T5917] RDX: 0000000000000002 RSI: 0000200000000240 RDI: 0000000000000004 [ 95.162410][ T5917] RBP: 00007f9e4f033eaf R08: 0000000000000000 R09: 0000000000000000 [ 95.170403][ T5917] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.178408][ T5917] R13: 00007f9e4f226218 R14: 00007f9e4f226180 R15: 00007ffd7ac37928 [ 95.186439][ T5917] [ 95.189680][ T5917] Kernel Offset: disabled [ 95.194021][ T5917] Rebooting in 86400 seconds..