log-in to see details

map[KernelSrc:/app/workdir/cache/src/2c647d04ba64204b0de04a5458fe5db9d3049774]

map[KernelObj:/app/workdir/cache/build/9890265554d96e5de5c53ec258faf2227c041898]

map[Index:codesearch-index]

best-expensive

You are a security researcher with deep Linux kernel background.
Your goal is to analyze a Linux kernel bug description and propose a strategy to reproduce it
with a minimal, standalone C program for the strictly defensive purpose of verifying a bugfix.

=== TOOL SELECTION GUIDELINES ===
- When looking up C function or struct definitions, prefer codesearch-definition-source
  and codesearch-struct-layout first.
- Fall back to read-file or grepper only if symbol lookup fails or when inspecting macros,
  headers, or non-C files.

=== CRITICAL PROHIBITIONS ===
- Do NOT propose an exploit. Focus solely on minimal technical reproduction of the bug state.
- Do NOT write long explanations. Keep your analysis and strategy proposal concise.
- Do NOT assume that the target bug has already been fixed just because a git commit title
  or description mentions a similar bug or fix. Commit messages often reference related issues
  or partial fixes. Proceed with proposing a reproduction strategy regardless of historical fix commits.
Prefer calling several tools at the same time to save round-trips.

Bug Description: BUG: unable to handle kernel paging request in percpu_counter_add_batch

BUG: unable to handle page fault for address: ffff88808c54a000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 1acd5067 P4D 1acd5067 PUD 0 
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5311 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:percpu_counter_add_batch+0x50/0x1d0 lib/percpu_counter.c:98
Code: f6 48 b7 fc 48 89 5c 24 10 48 83 c3 58 49 89 de 49 c1 ee 03 43 80 3c 3e 00 74 08 48 89 df e8 07 7d 26 fd 48 89 1c 24 48 8b 03 <65> 8b 28 41 89 ef 41 c1 ff 1f 49 c1 e7 20 4c 89 6c 24 08 4d 01 ef
RSP: 0018:ffffc9000dc47810 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888036dc4930 RCX: ffff888012f0ca80
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888036dc48d8
RBP: ffffc9000dc47908 R08: ffff888012c3e03f R09: 1ffff11002587c07
R10: dffffc0000000000 R11: ffffed1002587c08 R12: 0000000000000020
R13: 0000000000000001 R14: 1ffff11006db8926 R15: dffffc0000000000
FS:  00007f711d27e6c0(0000) GS:ffff88808c54a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88808c54a000 CR3: 000000001fde5000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 percpu_counter_add include/linux/percpu_counter.h:71 [inline]
 percpu_counter_inc include/linux/percpu_counter.h:267 [inline]
 svc_xprt_enqueue+0x2ee/0x8b0 net/sunrpc/svc_xprt.c:524
 svc_xprt_received+0x10f/0x150 net/sunrpc/svc_xprt.c:248
 svc_add_new_perm_xprt net/sunrpc/svc_xprt.c:260 [inline]
 _svc_xprt_create+0x3d8/0x600 net/sunrpc/svc_xprt.c:290
 svc_xprt_create_from_sa net/sunrpc/svc_xprt.c:332 [inline]
 svc_xprt_create+0x1aa/0x280 net/sunrpc/svc_xprt.c:387
 __write_ports_addxprt fs/nfsd/nfsctl.c:774 [inline]
 __write_ports fs/nfsd/nfsctl.c:808 [inline]
 write_ports+0x71a/0xd10 fs/nfsd/nfsctl.c:861
 nfsctl_transaction_write+0x10f/0x160 fs/nfsd/nfsctl.c:112
 vfs_write+0x296/0xba0 fs/read_write.c:685
 ksys_write+0x150/0x270 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f711c39e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f711d27dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f711c625fa0 RCX: 00007f711c39e0d9
RDX: 0000000000000005 RSI: 0000200000000300 RDI: 0000000000000004
RBP: 00007f711c435024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f711c626038 R14: 00007f711c625fa0 R15: 00007ffc740e4ce8
 </TASK>
Modules linked in:
CR2: ffff88808c54a000
---[ end trace 0000000000000000 ]---
RIP: 0010:percpu_counter_add_batch+0x50/0x1d0 lib/percpu_counter.c:98
Code: f6 48 b7 fc 48 89 5c 24 10 48 83 c3 58 49 89 de 49 c1 ee 03 43 80 3c 3e 00 74 08 48 89 df e8 07 7d 26 fd 48 89 1c 24 48 8b 03 <65> 8b 28 41 89 ef 41 c1 ff 1f 49 c1 e7 20 4c 89 6c 24 08 4d 01 ef
RSP: 0018:ffffc9000dc47810 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888036dc4930 RCX: ffff888012f0ca80
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888036dc48d8
RBP: ffffc9000dc47908 R08: ffff888012c3e03f R09: 1ffff11002587c07
R10: dffffc0000000000 R11: ffffed1002587c08 R12: 0000000000000020
R13: 0000000000000001 R14: 1ffff11006db8926 R15: dffffc0000000000
FS:  00007f711d27e6c0(0000) GS:ffff88808c54a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88808c54a000 CR3: 000000001fde5000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	f6 48 b7 fc          	testb  $0xfc,-0x49(%rax)
   4:	48 89 5c 24 10       	mov    %rbx,0x10(%rsp)
   9:	48 83 c3 58          	add    $0x58,%rbx
   d:	49 89 de             	mov    %rbx,%r14
  10:	49 c1 ee 03          	shr    $0x3,%r14
  14:	43 80 3c 3e 00       	cmpb   $0x0,(%r14,%r15,1)
  19:	74 08                	je     0x23
  1b:	48 89 df             	mov    %rbx,%rdi
  1e:	e8 07 7d 26 fd       	call   0xfd267d2a
  23:	48 89 1c 24          	mov    %rbx,(%rsp)
  27:	48 8b 03             	mov    (%rbx),%rax
* 2a:	65 8b 28             	mov    %gs:(%rax),%ebp <-- trapping instruction
  2d:	41 89 ef             	mov    %ebp,%r15d
  30:	41 c1 ff 1f          	sar    $0x1f,%r15d
  34:	49 c1 e7 20          	shl    $0x20,%r15
  38:	4c 89 6c 24 08       	mov    %r13,0x8(%rsp)
  3d:	4d 01 ef             	add    %r13,%r15

### Root Cause Analysis

The crash is a classic NULL pointer dereference in percpu space, caused by a missing error check during initialization. 

When a new NFS service is created, `__svc_create()` initializes several percpu counters for the service pools:
```c
		percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL);
		percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL);
		percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL);
```
However, `percpu_counter_init()` can fail (e.g., due to memory allocation failure), in which case it returns an error code and leaves the internal `counters` pointer as `NULL`. Because `__svc_create()` ignores the return value, the kernel proceeds as if the initialization succeeded.

Later, when a transport is added, `svc_xprt_enqueue()` is called, which attempts to increment the counter:
```c
		percpu_counter_inc(&pool->sp_sockets_queued);
```
This attempts to dereference the `NULL` percpu pointer (offset by the CPU's `gs` base), resulting in the observed page fault at address `ffff88808c54a000`.

### Reproduction Strategy

To reproduce this bug reliably, we must simulate a memory allocation failure specifically during the `percpu_counter_init()` call. We can achieve this using the kernel's fault injection framework (`CONFIG_FAULT_INJECTION` and `CONFIG_FAILSLAB`).

1. **Enable Fault Injection**: Configure `failslab` to fail allocations for the current task.
2. **Trigger Service Creation**: Write a valid transport string (e.g., `"tcp 2049"`) to the `nfsd` `portlist` file. This invokes `__write_ports_addxprt()`, which calls `nfsd_create_serv()` -> `svc_create_pooled()` -> `__svc_create()`.
3. **Loop with Low Probability**: Because we want to fail the `percpu_counter_init()` allocation but allow preceding critical allocations (like `kzalloc_objs` for the pool itself) to succeed, we set a low failure probability (e.g., 5%) and run the trigger in a loop.
4. **Namespace Isolation**: To ensure `nfsd_create_serv()` attempts to create a new service on every iteration, we execute each attempt in a new network namespace (`CLONE_NEWNET`).

### Minimal Reproduction Program

```c
#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/wait.h>

void write_file(const char *path, const char *val) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        write(fd, val, strlen(val));
        close(fd);
    }
}

int main() {
    // 1. Setup fault injection for the current task
    write_file("/sys/kernel/debug/failslab/probability", "5"); // 5% probability
    write_file("/sys/kernel/debug/failslab/times", "-1");
    write_file("/sys/kernel/debug/failslab/task-filter", "Y");
    write_file("/proc/self/make-it-fail", "1");

    mkdir("/tmp/nfsd", 0777);

    // 2. Loop to hit the exact allocation race
    for (int i = 0; i < 1000; i++) {
        pid_t pid = fork();
        if (pid == 0) {
            // Isolate network and mount namespaces for a fresh nfsd state
            if (unshare(CLONE_NEWNET | CLONE_NEWNS) == 0) {
                if (mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL) == 0) {
                    
                    // Trigger __write_ports_addxprt -> nfsd_create_serv -> __svc_create
                    int fd = open("/tmp/nfsd/portlist", O_WRONLY);
                    if (fd >= 0) {
                        write(fd, "tcp 2049", 8);
                        close(fd);
                    }
                }
            }
            exit(0);
        }
        waitpid(pid, NULL, 0);
    }
    
    return 0;
}
```

gemini-3.1-pro-preview

							input: 5534
							output: 43
							thoughts: 612
						

**The Kernel Paging Request Bug in percpu_counter_add_batch: My Initial Investigation**

Alright, so I've received a bug report indicating an issue with handling kernel paging requests, specifically pointing to a crash within `percpu_counter_add_batch`. The traceback confirms the failure point is in `lib/percpu_counter.c`, at or around line 98.

The call stack provides a crucial trail: it originates from `svc_xprt_enqueue`, which itself is called by `svc_xprt_received`. This suggests the problem arises during the processing of received RPC transport data. Further up the chain, we see `svc_add_new_perm_xprt` and `_svc_xprt_create`, leading to `svc_xprt_create` and ultimately `svc_xprt_create_from_sa`. The path then goes through `__write_ports_addxprt` and `__write_ports` within `fs/nfsd/nfsctl.c`, culminating in `write_ports`, `nfsctl_transaction_write`, `vfs_write`, and `ksys_write`. This paints a picture of the NFS daemon (`nfsd`) attempting to manage RPC transport endpoints, likely in response to some user-space `nfsctl` operation.

The core of the problem, as indicated by the page fault on `gs:(%rax)` within `percpu_counter_add_batch`, is a classic symptom of a per-CPU variable being accessed after it's been uninitialized or, more likely, after it's been freed. My immediate suspicion is that this per-CPU counter is associated with one of the RPC server structures: `struct svc_xprt` (the transport itself), `struct svc_pool` (which manages transports), or `struct svc_serv` (the overarching RPC server).

My next step is to dive into `net/sunrpc/svc_xprt.c`, specifically focusing on the vicinity of `svc_xprt_enqueue` (around line 524) and `svc_xprt_create` to understand how these per-CPU counters are managed and how they might become invalid during the transport creation or enqueueing process. I need to see where this counter is declared, initialized, and where its lifetime might be prematurely ended.

map[ContextFile:net/sunrpc/svc_xprt.c Name:svc_xprt_enqueue]

map[SourceCode: 502:	/**
 503:	 * svc_xprt_enqueue - Queue a transport on an idle nfsd thread
 504:	 * @xprt: transport with data pending
 505:	 *
 506:	 */
 507:	void svc_xprt_enqueue(struct svc_xprt *xprt)
 508:	{
 509:		struct svc_pool *pool;
 510:	
 511:		if (!svc_xprt_ready(xprt))
 512:			return;
 513:	
 514:		/* Mark transport as busy. It will remain in this state until
 515:		 * the provider calls svc_xprt_received. We update XPT_BUSY
 516:		 * atomically because it also guards against trying to enqueue
 517:		 * the transport twice.
 518:		 */
 519:		if (test_and_set_bit(XPT_BUSY, &xprt->xpt_flags))
 520:			return;
 521:	
 522:		pool = svc_pool_for_cpu(xprt->xpt_server);
 523:	
 524:		percpu_counter_inc(&pool->sp_sockets_queued);
 525:		xprt->xpt_qtime = ktime_get();
 526:		lwq_enqueue(&xprt->xpt_ready, &pool->sp_xprts);
 527:	
 528:		svc_pool_wake_idle_thread(pool);
 529:	}
 SourceFile:net/sunrpc/svc_xprt.c]

gemini-3.1-pro-preview

							input: 6637
							output: 43
							thoughts: 82
						

**My Diagnostic Journey: Unraveling the `percpu_counter_inc` Crash**

My investigation into this perplexing crash, specifically at the `percpu_counter_inc(&pool->sp_sockets_queued)` call, immediately points to a critical issue: the `pool->sp_sockets_queued` counter is either uninitialized, or more troublingly, the `pool` pointer itself is invalid. This is a red flag, indicating a potential memory corruption or a logic error in how the `pool` is being managed.

My next step, naturally, is to trace the origin of this `pool` pointer. I see that it's derived from `svc_pool_for_cpu(xprt->xpt_server)`. This tells me that the `pool` is determined based on the server's transport (`xprt->xpt_server`) and the current CPU. This is a crucial piece of information. The logic here suggests a per-CPU pool management strategy, which, while efficient, can also introduce complexities if not handled with absolute precision.

Therefore, my immediate focus shifts to scrutinizing the `svc_pool_for_cpu` function. I need to understand exactly how it determines which pool to return, what conditions might lead it to return an invalid or uninitialized `pool`, and how it interacts with the `xprt->xpt_server` argument. I'll be looking for any edge cases, race conditions, or incorrect assumptions within `svc_pool_for_cpu` that could lead to the state observed at the crash site. My hypothesis is that the problem lies upstream, in how this `pool` is allocated, initialized, or deallocated, and `svc_pool_for_cpu` is simply the point where the symptom becomes manifest.

map[ContextFile:net/sunrpc/svc_xprt.c Name:svc_pool_for_cpu]

map[SourceCode: 389:	/**
 390:	 * svc_pool_for_cpu - Select pool to run a thread on this cpu
 391:	 * @serv: An RPC service
 392:	 *
 393:	 * Use the active CPU and the svc_pool_map's mode setting to
 394:	 * select the svc thread pool to use. Once initialized, the
 395:	 * svc_pool_map does not change.
 396:	 *
 397:	 * Return value:
 398:	 *   A pointer to an svc_pool
 399:	 */
 400:	struct svc_pool *svc_pool_for_cpu(struct svc_serv *serv)
 401:	{
 402:		struct svc_pool_map *m = &svc_pool_map;
 403:		int cpu = raw_smp_processor_id();
 404:		unsigned int pidx = 0;
 405:	
 406:		if (serv->sv_nrpools <= 1)
 407:			return serv->sv_pools;
 408:	
 409:		switch (m->mode) {
 410:		case SVC_POOL_PERCPU:
 411:			pidx = m->to_pool[cpu];
 412:			break;
 413:		case SVC_POOL_PERNODE:
 414:			pidx = m->to_pool[cpu_to_node(cpu)];
 415:			break;
 416:		}
 417:	
 418:		return &serv->sv_pools[pidx % serv->sv_nrpools];
 419:	}
 SourceFile:net/sunrpc/svc.c]

gemini-3.1-pro-preview

							input: 7223
							output: 50
							thoughts: 86
						

**My Thought Process Regarding `pool` Initialization and `percpu_counter` Integrity**

My current line of inquiry centers on the `pool` variable. I understand it can be accessed either directly as `serv->sv_pools` or, more dynamically, through an index calculation: `&serv->sv_pools[pidx % serv->sv_nrpools]`. This suggests a mechanism for distributing or managing pools based on some index, `pidx`, and a total number of pools, `serv->sv_nrpools`.

The immediate concern arises from a potential crash during an increment operation: `percpu_counter_inc(&pool->sp_sockets_queued)`. My experience tells me that such a crash, particularly at this stage, strongly indicates that the `sp_sockets_queued` member within the `pool` structure is not properly initialized. It's a classic symptom of dereferencing an uninitialized or invalid pointer, or operating on memory that hasn't been set up to hold the `percpu_counter` data.

Therefore, my next logical step, and the immediate focus of my investigation, is to trace the initialization path of `sp_sockets_queued`. I need to understand precisely where and how this specific member of the `pool` structure is intended to be set up before it's subjected to operations like `percpu_counter_inc`. This will involve scrutinizing the code that allocates and configures `pool` structures and their constituent members, particularly `sp_sockets_queued`.

log-in to see details

map[ContextFile:net/sunrpc/svc.c IncludeSnippetLines:2 Name:sp_sockets_queued SourceTreePrefix:]

map[References:<nil> TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 7358
							output: 40
							thoughts: 19
						

**My Thought Process on `sp_sockets_queued` within `svc_pool`**

Alright, my immediate instinct here is to delve into the specifics of how asynchronous operations, particularly those involving socket I/O, are managed within our service pool architecture. When I see a term like `sp_sockets_queued`, my mind immediately goes to the underlying mechanics of our RPC (Remote Procedure Call) or network service framework.

My initial thought is: "What exactly does `sp_sockets_queued` represent within the `svc_pool` structure?" I'm hypothesizing it's a counter, a flag, or perhaps even a pointer to a queue data structure itself, specifically tracking the number of incoming socket connections or pending read/write operations that are waiting to be processed by the threads within this particular service pool.

I'd be looking to understand the *scope* of this variable. Is it global to the entire service pool, or is it per-worker thread within the pool? Given its placement within `struct svc_pool`, it strongly suggests it's a pool-level metric, reflecting the aggregate state of queued socket operations for all workers associated with that pool.

My next line of inquiry would be about its *purpose*. Why is this specific metric being tracked?
*   **Load Balancing/Throttling:** Is it used to gauge the current workload and potentially slow down the acceptance of new connections or requests if the queue is too large? This could be a crucial mechanism for preventing overload.
*   **Performance Monitoring:** Is it primarily for diagnostic purposes, allowing us to see if certain pools are becoming bottlenecks? Knowing the queue length is vital for understanding latency and throughput.
*   **Resource Management:** Does it influence how resources are allocated or how threads are scheduled within the pool? Perhaps a longer queue triggers the creation of more worker threads or re-prioritizes certain operations.
*   **State Management:** Could it be part of a larger state machine that dictates how the pool transitions between different operational states (e.g., busy, idle, overloaded)?

I'd also be considering the *data type* and *synchronization mechanisms*. If it's a simple counter, how is it protected? Is it an atomic operation, or are there locks involved? The potential for multiple threads to be incrementing or decrementing this count simultaneously makes synchronization a critical consideration to avoid race conditions and ensure data integrity.

Finally, I'd be thinking about its *interplay with other elements* within `svc_pool` and the broader service infrastructure. How does `sp_sockets_queued` relate to things like thread pools, event loops, or specific I/O completion mechanisms? Understanding these relationships is key to grasping the overall system behavior. Essentially, I'm looking for the "why" and the "how" behind this specific piece of data, and how it contributes to the efficient and robust operation of our service.

map[ContextFile:net/sunrpc/svc.c FieldOffset:<nil> Name:svc_pool]

map[Fields:[map[Name:sp_id OffsetBits:0 SizeBits:32] map[Name:sp_nrthreads OffsetBits:32 SizeBits:32] map[Name:sp_nrthrmin OffsetBits:64 SizeBits:32] map[Name:sp_nrthrmax OffsetBits:96 SizeBits:32] map[Name:sp_xprts OffsetBits:128 SizeBits:640] map[Name:sp_all_threads OffsetBits:768 SizeBits:128] map[Name:sp_idle_threads OffsetBits:896 SizeBits:64] map[Name:sp_messages_arrived OffsetBits:960 SizeBits:768] map[Name:sp_sockets_queued OffsetBits:1728 SizeBits:768] map[Name:sp_threads_woken OffsetBits:2496 SizeBits:768] map[Name:sp_flags OffsetBits:3264 SizeBits:64]]]

gemini-3.1-pro-preview

							input: 7582
							output: 36
							thoughts: 59
						

**A Deep Dive into `sp_sockets_queued` Initialization**

My initial thought process here is one of focused investigation, driven by a specific observation and the need to understand its origins. I've just encountered the `sp_sockets_queued` metric and, importantly, recognized its nature as a `percpu_counter`. This immediately flags it as a data structure designed for efficient per-CPU aggregation, and I'm curious about its underlying implementation details. The fact that it's a `percpu_counter` implies a particular initialization pattern, and my next logical step is to trace back where and how it's brought into existence. My immediate hypothesis is that it's initialized using the standard `percpu_counter_init` function, which is the idiomatic way to set up these types of counters. Therefore, I need to find the specific code location where `sp_sockets_queued` is declared and then identify the call to `percpu_counter_init` that sets its initial state. This isn't just a casual curiosity; understanding the initialization context is crucial for comprehending how the counter will behave, what its baseline value will be, and how it's intended to be used and updated within the system. This detailed examination of its origin is the foundation for any subsequent analysis or debugging related to `sp_sockets_queued`.

map[Expression:percpu_counter_init.*sp_sockets_queued PathPrefix:net/sunrpc]

map[Output:net/sunrpc/svc.c=483=__svc_create(struct svc_program *prog, int nprogs, struct svc_stat *stats,
--
net/sunrpc/svc.c-543-		percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL);
net/sunrpc/svc.c:544:		percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL);
net/sunrpc/svc.c-545-		percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL);
]

gemini-3.1-pro-preview

							input: 7826
							output: 44
							thoughts: 341
						

**My Thought Process Regarding NFSd Transport Initialization**

Alright, so my immediate focus is on understanding *where* this transport is being initialized. My current hypothesis, based on the call trace, is that it's happening within the `__svc_create` function.

Looking at the provided call trace, I can see a clear path leading to the creation of a new transport:

*   It starts with `svc_xprt_enqueue`, which is likely responsible for queuing up newly established connections or transports.
*   This leads to `svc_xprt_received`, suggesting some form of acknowledgment or processing of incoming transport requests.
*   `svc_add_new_perm_xprt` is an inlined function within `svc_xprt_received`, and its name strongly implies it's the direct action of adding a persistent transport.
*   The core creation logic seems to reside in `_svc_xprt_create`.
*   `svc_xprt_create_from_sa` is another inlined function, likely handling the specifics of creating a transport from a socket address.
*   `svc_xprt_create` then orchestrates this, and finally, the broader operation is initiated by `write_ports` in `fs/nfsd/nfsctl.c`.

Given this sequence, my next step is to dive into the `__write_ports_addxprt` function within `fs/nfsd/nfsctl.c`. This appears to be the most proximal point in the user-space interface that triggers the underlying RPC transport setup, and I suspect the initialization logic I'm looking for will be defined or invoked from there.

map[ContextFile:fs/nfsd/nfsctl.c Name:__write_ports_addxprt]

map[SourceCode: 750:	/*
 751:	 * A transport listener is added by writing its transport name and
 752:	 * a port number.
 753:	 */
 754:	static ssize_t __write_ports_addxprt(char *buf, struct net *net, const struct cred *cred)
 755:	{
 756:		char transport[16];
 757:		struct svc_xprt *xprt;
 758:		int port, err;
 759:		struct nfsd_net *nn = net_generic(net, nfsd_net_id);
 760:		struct svc_serv *serv;
 761:	
 762:		if (sscanf(buf, "%15s %5u", transport, &port) != 2)
 763:			return -EINVAL;
 764:	
 765:		if (port < 1 || port > USHRT_MAX)
 766:			return -EINVAL;
 767:		trace_nfsd_ctl_ports_addxprt(net, transport, port);
 768:	
 769:		err = nfsd_create_serv(net);
 770:		if (err != 0)
 771:			return err;
 772:	
 773:		serv = nn->nfsd_serv;
 774:		err = svc_xprt_create(serv, transport, net,
 775:				      PF_INET, port, SVC_SOCK_ANONYMOUS, cred);
 776:		if (err < 0)
 777:			goto out_err;
 778:	
 779:		err = svc_xprt_create(serv, transport, net,
 780:				      PF_INET6, port, SVC_SOCK_ANONYMOUS, cred);
 781:		if (err < 0 && err != -EAFNOSUPPORT)
 782:			goto out_close;
 783:	
 784:		return 0;
 785:	out_close:
 786:		xprt = svc_find_xprt(serv, transport, net, PF_INET, port);
 787:		if (xprt != NULL) {
 788:			svc_xprt_close(xprt);
 789:			svc_xprt_put(xprt);
 790:		}
 791:	out_err:
 792:		if (!serv->sv_nrthreads && list_empty(&nn->nfsd_serv->sv_permsocks))
 793:			nfsd_destroy_serv(net);
 794:	
 795:		return err;
 796:	}
 SourceFile:fs/nfsd/nfsctl.c]

gemini-3.1-pro-preview

							input: 8970
							output: 42
							thoughts: 85
						

**My Thought Process on `write_ports_addxprt` Execution**

Alright, so I'm looking at the `write_ports_addxprt` function, and the first thing that jumps out is its call to `nfsd_create_serv(net)`. My immediate mental model is that this call is responsible for initializing the NFS server's core structure, specifically creating the `nn->nfsd_serv` object. This object, I anticipate, will be the central representation of our NFS server instance within the network context provided by `net`.

Following that, the very next step is `svc_xprt_create(serv, transport, net, PF_INET, port, SVC_SOCK_ANONYMOUS, cred)`. This tells me that after the server structure is in place, the system needs to establish the actual communication endpoint – the transport. The parameters here are quite descriptive: `serv` refers to the NFS server structure just created, `transport` likely dictates the underlying protocol, `net` confirms the network context, `PF_INET` indicates we're dealing with IPv4, `port` is the specific listening port, `SVC_SOCK_ANONYMOUS` suggests a standard anonymous socket creation, and `cred` hints at credentials being involved in this setup.

Given this sequence, my immediate impulse is to delve deeper into `nfsd_create_serv`. I need to understand precisely what goes into initializing that `nfsd_serv` structure. What are its default settings? What critical components are allocated or configured at this stage? Is it just a placeholder, or does it already contain significant NFS server-specific logic? This initial setup phase seems crucial for understanding the subsequent operations of `svc_xprt_create` and the overall NFS server initialization process.

map[ContextFile:fs/nfsd/nfsctl.c Name:nfsd_create_serv]

map[SourceCode: 596:	int nfsd_create_serv(struct net *net)
 597:	{
 598:		int error;
 599:		struct nfsd_net *nn = net_generic(net, nfsd_net_id);
 600:		struct svc_serv *serv;
 601:	
 602:		WARN_ON(!mutex_is_locked(&nfsd_mutex));
 603:		if (nn->nfsd_serv)
 604:			return 0;
 605:	
 606:		error = percpu_ref_init(&nn->nfsd_net_ref, nfsd_net_free,
 607:					0, GFP_KERNEL);
 608:		if (error)
 609:			return error;
 610:		init_completion(&nn->nfsd_net_free_done);
 611:		init_completion(&nn->nfsd_net_confirm_done);
 612:	
 613:		if (nfsd_max_blksize == 0)
 614:			nfsd_max_blksize = nfsd_get_default_max_blksize();
 615:		nfsd_reset_versions(nn);
 616:		serv = svc_create_pooled(nfsd_programs, ARRAY_SIZE(nfsd_programs),
 617:					 &nn->nfsd_svcstats,
 618:					 nfsd_max_blksize, nfsd);
 619:		if (serv == NULL) {
 620:			percpu_ref_exit(&nn->nfsd_net_ref);
 621:			return -ENOMEM;
 622:		}
 623:	
 624:		error = svc_bind(serv, net);
 625:		if (error < 0) {
 626:			svc_destroy(&serv);
 627:			percpu_ref_exit(&nn->nfsd_net_ref);
 628:			return error;
 629:		}
 630:		spin_lock(&nfsd_notifier_lock);
 631:		nn->nfsd_serv = serv;
 632:		spin_unlock(&nfsd_notifier_lock);
 633:	
 634:		/* check if the notifier is already set */
 635:		if (atomic_inc_return(&nfsd_notifier_refcount) == 1) {
 636:			register_inetaddr_notifier(&nfsd_inetaddr_notifier);
 637:	#if IS_ENABLED(CONFIG_IPV6)
 638:			register_inet6addr_notifier(&nfsd_inet6addr_notifier);
 639:	#endif
 640:		}
 641:		nfsd_reset_write_verifier(nn);
 642:		return 0;
 643:	}
 SourceFile:fs/nfsd/nfssvc.c]

gemini-3.1-pro-preview

							input: 9896
							output: 40
							thoughts: 28
						

**My Thought Process for Investigating `nfsd_create_serv`**

As an expert deeply familiar with the inner workings of our system, my immediate instinct upon encountering `nfsd_create_serv` is to understand its fundamental purpose and its dependencies. My mental model of the NFS server architecture immediately flags `nfsd_create_serv` as a crucial component for establishing the server's listening sockets and thread pools.

Therefore, my next logical step, as is my habit when dissecting complex operations, is to trace its execution flow. I know that `nfsd_create_serv` itself doesn't perform the heavy lifting of socket creation and thread management; it's more of a high-level orchestrator. This leads me directly to consider what functions it delegates these tasks to.

My internal knowledge base quickly points to `svc_create_pooled` as the primary candidate for this delegation. I'm confident that `svc_create_pooled` is where the actual, low-level setup of the NFS service, including the instantiation of the worker thread pool and the binding to network interfaces, takes place. It's the engine that makes the NFS server operational. My curiosity is piqued to understand *how* `svc_create_pooled` achieves this, specifically regarding the parameters it receives from `nfsd_create_serv` and the specific mechanisms it uses for thread pool creation and socket management. This understanding is critical for diagnosing performance issues, ensuring correct resource allocation, and ultimately, for the robust and efficient operation of our NFS infrastructure.

map[ContextFile:fs/nfsd/nfssvc.c Name:svc_create_pooled]

map[SourceCode: 566:	/**
 567:	 * svc_create_pooled - Create an RPC service with pooled threads
 568:	 * @prog:  Array of RPC programs the new service will handle
 569:	 * @nprogs: Number of programs in the array
 570:	 * @stats: the stats struct if desired
 571:	 * @bufsize: maximum message size for @prog
 572:	 * @threadfn: a function to service RPC requests for @prog
 573:	 *
 574:	 * Returns an instantiated struct svc_serv object or NULL.
 575:	 */
 576:	struct svc_serv *svc_create_pooled(struct svc_program *prog,
 577:					   unsigned int nprogs,
 578:					   struct svc_stat *stats,
 579:					   unsigned int bufsize,
 580:					   int (*threadfn)(void *data))
 581:	{
 582:		struct svc_serv *serv;
 583:		unsigned int npools = svc_pool_map_get();
 584:	
 585:		serv = __svc_create(prog, nprogs, stats, bufsize, npools, threadfn);
 586:		if (!serv)
 587:			goto out_err;
 588:		serv->sv_is_pooled = true;
 589:		return serv;
 590:	out_err:
 591:		svc_pool_map_put();
 592:		return NULL;
 593:	}
 SourceFile:net/sunrpc/svc.c]

gemini-3.1-pro-preview

							input: 10392
							output: 36
							thoughts: 24
						

**My Thought Process Regarding `svc_create_pooled` and `__svc_create`**

My current line of inquiry is focused on the `svc_create_pooled` function. My initial understanding, based on its name and typical design patterns, suggests it's likely an optimized or resource-managed variant of a more fundamental service creation mechanism. Therefore, my immediate next step is to delve into the implementation of `svc_create_pooled` itself.

Specifically, I need to identify what internal functions or routines it orchestrates to achieve its purpose. The naming convention strongly implies that `svc_create_pooled` acts as a higher-level abstraction, delegating the core service creation logic to another function. Given this, I am hypothesizing that it will, in turn, call a more primitive function responsible for the actual instantiation of the service.

My current thought is that `svc_create_pooled` is indeed a wrapper or a utility that leverages a foundational service creation function. My immediate focus is to confirm this by examining the code for `svc_create_pooled` to see precisely which function it invokes to perform the core service creation task. The name `__svc_create` is a very strong candidate for this underlying function. It suggests a private or internal implementation, which aligns perfectly with the idea of `svc_create_pooled` being a public-facing, optimized interface. Therefore, my immediate next action is to inspect the implementation details of `__svc_create` to understand the fundamental mechanics of service creation that `svc_create_pooled` is building upon.

map[ContextFile:net/sunrpc/svc.c Name:__svc_create]

map[SourceCode: 479:	/*
 480:	 * Create an RPC service
 481:	 */
 482:	static struct svc_serv *
 483:	__svc_create(struct svc_program *prog, int nprogs, struct svc_stat *stats,
 484:		     unsigned int bufsize, int npools, int (*threadfn)(void *data))
 485:	{
 486:		struct svc_serv	*serv;
 487:		unsigned int vers;
 488:		unsigned int xdrsize;
 489:		unsigned int i;
 490:	
 491:		if (!(serv = kzalloc_obj(*serv)))
 492:			return NULL;
 493:		serv->sv_name      = prog->pg_name;
 494:		serv->sv_programs  = prog;
 495:		serv->sv_nprogs    = nprogs;
 496:		serv->sv_stats     = stats;
 497:		if (bufsize > RPCSVC_MAXPAYLOAD)
 498:			bufsize = RPCSVC_MAXPAYLOAD;
 499:		serv->sv_max_payload = bufsize? bufsize : 4096;
 500:		serv->sv_max_mesg  = roundup(serv->sv_max_payload + PAGE_SIZE, PAGE_SIZE);
 501:		serv->sv_threadfn = threadfn;
 502:		xdrsize = 0;
 503:		for (i = 0; i < nprogs; i++) {
 504:			struct svc_program *progp = &prog[i];
 505:	
 506:			progp->pg_lovers = progp->pg_nvers-1;
 507:			for (vers = 0; vers < progp->pg_nvers ; vers++)
 508:				if (progp->pg_vers[vers]) {
 509:					progp->pg_hivers = vers;
 510:					if (progp->pg_lovers > vers)
 511:						progp->pg_lovers = vers;
 512:					if (progp->pg_vers[vers]->vs_xdrsize > xdrsize)
 513:						xdrsize = progp->pg_vers[vers]->vs_xdrsize;
 514:				}
 515:		}
 516:		serv->sv_xdrsize   = xdrsize;
 517:		INIT_LIST_HEAD(&serv->sv_tempsocks);
 518:		INIT_LIST_HEAD(&serv->sv_permsocks);
 519:		timer_setup(&serv->sv_temptimer, NULL, 0);
 520:		spin_lock_init(&serv->sv_lock);
 521:	
 522:		__svc_init_bc(serv);
 523:	
 524:		serv->sv_nrpools = npools;
 525:		serv->sv_pools =
 526:			kzalloc_objs(struct svc_pool, serv->sv_nrpools);
 527:		if (!serv->sv_pools) {
 528:			kfree(serv);
 529:			return NULL;
 530:		}
 531:	
 532:		for (i = 0; i < serv->sv_nrpools; i++) {
 533:			struct svc_pool *pool = &serv->sv_pools[i];
 534:	
 535:			dprintk("svc: initialising pool %u for %s\n",
 536:					i, serv->sv_name);
 537:	
 538:			pool->sp_id = i;
 539:			lwq_init(&pool->sp_xprts);
 540:			INIT_LIST_HEAD(&pool->sp_all_threads);
 541:			init_llist_head(&pool->sp_idle_threads);
 542:	
 543:			percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL);
 544:			percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL);
 545:			percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL);
 546:		}
 547:	
 548:		return serv;
 549:	}
 SourceFile:net/sunrpc/svc.c]

gemini-3.1-pro-preview

							input: 11645
							output: 38
							thoughts: 201
						

**The Peril of Ignored Return Values**

I've just had a rather concerning realization about the `__svc_create` function. It seems there's a potential bug stemming from how `percpu_counter_init` is being called. My immediate thought was, "Wait a minute, `percpu_counter_init` can actually fail!" I know it returns an integer, where `0` signifies success and any negative value indicates an error. This is a critical piece of information.

My next thought, and where the concern really solidified, was to look at how `percpu_counter_init` is actually used within `__svc_create`. I noticed that in the `__svc_create` function, the return value from `percpu_counter_init` is *completely ignored*. The code snippet I'm looking at shows:

```c
		percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL);
		percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL);
		percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL);
```

This is where the alarm bells are ringing. If `percpu_counter_init` fails – and failure can absolutely happen, most commonly due to `GFP_KERNEL` failing to allocate memory for the per-CPU data structures – then those `percpu_counter` objects (`sp_messages_arrived`, `sp_sockets_queued`, `sp_threads_woken`) will be left in an uninitialized state. Or, more precisely, they might have their `count` field initialized but no actual per-CPU memory allocated to hold the counts. This means any subsequent operations attempting to use these counters could lead to crashes or unpredictable behavior, all because the potential failure of an initialization function was overlooked. I need to dig into the exact definition of `percpu_counter_init` to understand the implications more deeply.

log-in to see details

map[ContextFile:net/sunrpc/svc.c Name:percpu_counter_init]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 11889
							output: 37
							thoughts: 25
						

**My Thought Process on Analyzing `percpu_counter` Functionality**

Alright, so when I encountered this particular piece of code, my immediate inclination was to figure out if it was operating at a macro level or as an inline function. My first port of call, as is often the case when dealing with kernel-level data structures and operations like this, would be to dive into the relevant header file. Specifically, I'd be looking for the definition of `percpu_counter` within `include/linux/percpu_counter.h`. This is where the core logic, the exact implementation, and any associated macros or inline function declarations would reside. My goal is to dissect its underlying mechanism and understand its performance characteristics.

map[Expression:define percpu_counter_init PathPrefix:include/linux/percpu_counter.h]

map[Output:include/linux/percpu_counter.h=33=int __percpu_counter_init_many(struct percpu_counter *fbc, s64 amount,
--
include/linux/percpu_counter.h-36-
include/linux/percpu_counter.h:37:#define percpu_counter_init_many(fbc, value, gfp, nr_counters)		\
include/linux/percpu_counter.h-38-	({								\
--
include/linux/percpu_counter.h-45-
include/linux/percpu_counter.h:46:#define percpu_counter_init(fbc, value, gfp)				\
include/linux/percpu_counter.h-47-	percpu_counter_init_many(fbc, value, gfp, 1)
]

gemini-3.1-pro-preview

							input: 12148
							output: 40
							thoughts: 251
						

**My Thought Process Regarding `percpu_counter` Initialization and Potential Pitfalls**

I've been examining the initialization and usage of `percpu_counter` structures, specifically focusing on potential failure scenarios and their downstream impacts. My primary concern revolves around how the `percpu_counter_init` function's return value affects the integrity of the per-CPU memory allocated for counters.

My understanding is that `percpu_counter_init` is essentially a wrapper around `__percpu_counter_init_many`. Crucially, it returns an `int`. If this initialization fails for any reason, the consequence is that the per-CPU memory required for the `percpu_counter` will *not* be allocated. This is the key point that has been bothering me.

Now, I've traced the execution flow to `percpu_counter_add_batch`. This is where the real problem emerges. When `percpu_counter_add_batch` is invoked, it attempts to access this per-CPU memory. The code snippet I'm looking at clearly shows:

```c
	s32 __percpu *pcount;
...
	pcount = per_cpu_ptr(fbc->counters, cpu);
```

The critical piece here is `fbc->counters`. If `percpu_counter_init` failed, as I hypothesized, then `fbc->counters` will be `NULL` or, at the very least, uninitialized. Consequently, the `per_cpu_ptr` function, when called with a `NULL` `fbc->counters`, will return an invalid address. This, of course, is a recipe for disaster, leading directly to a page fault when that invalid address is dereferenced.

I briefly considered the `__svc_create` function and its use of `kzalloc_objs` for `serv->sv_pools`, which ensures `pool->sp_sockets_queued` is zeroed. This is a good safety mechanism in its own right, but it seems to be operating on a different data structure (`sv_pools`) and doesn't directly mitigate the `percpu_counter` initialization failure I'm focused on. The `percpu_counter`'s memory allocation is the distinct issue here.

Therefore, my line of reasoning is:
1. `percpu_counter_init` *must* succeed.
2. If it fails, `fbc->counters` will be `NULL`.
3. Subsequently, any call to `percpu_counter_add_batch` will attempt to access `fbc->counters` via `per_cpu_ptr`.
4. This access with a `NULL` `fbc->counters` will result in `per_cpu_ptr` returning an invalid address.
5. Dereferencing this invalid address will trigger a page fault.

I need to delve deeper into `lib/percpu_counter.c` to fully understand the failure conditions of `percpu_counter_init` and how to robustly handle them to prevent these page faults.

map[ContextFile:lib/percpu_counter.c Name:percpu_counter_add_batch]

map[SourceCode:  88:	/*
  89:	 * Safety against interrupts is achieved in 2 ways:
  90:	 * 1. the fast path uses local cmpxchg (note: no lock prefix)
  91:	 * 2. the slow path operates with interrupts disabled
  92:	 */
  93:	void percpu_counter_add_batch(struct percpu_counter *fbc, s64 amount, s32 batch)
  94:	{
  95:		s64 count;
  96:		unsigned long flags;
  97:	
  98:		count = this_cpu_read(*fbc->counters);
  99:		do {
 100:			if (unlikely(abs(count + amount) >= batch)) {
 101:				raw_spin_lock_irqsave(&fbc->lock, flags);
 102:				/*
 103:				 * Note: by now we might have migrated to another CPU
 104:				 * or the value might have changed.
 105:				 */
 106:				count = __this_cpu_read(*fbc->counters);
 107:				fbc->count += count + amount;
 108:				__this_cpu_sub(*fbc->counters, count);
 109:				raw_spin_unlock_irqrestore(&fbc->lock, flags);
 110:				return;
 111:			}
 112:		} while (!this_cpu_try_cmpxchg(*fbc->counters, &count, count + amount));
 113:	}
 SourceFile:lib/percpu_counter.c]

gemini-3.1-pro-preview

							input: 12856
							output: 57
							thoughts: 651
						

**My Thought Process on the NFS Daemon Bug**

Here's my breakdown of what's happening with this NFS daemon bug:

The crash, specifically the "unable to handle page fault for address: ffff88808c54a000" at line 98, immediately signals a NULL pointer dereference within per-CPU data. The faulting address points to what's very likely the per-CPU offset for CPU 0, and given the context of `this_cpu_read(*fbc->counters)`, it's overwhelmingly clear that `fbc->counters` itself is NULL.

The critical question then becomes: *why* is `fbc->counters` NULL? My immediate suspicion, especially given this is a syzkaller bug report, is fault injection. Syzkaller is designed to test kernel robustness by simulating various failure scenarios, and `CONFIG_FAULT_INJECTION` with flags like `failslab` is its go-to for mimicking allocation failures. If `percpu_counter_init` fails (due to simulated memory pressure or a targeted fault), the `__svc_create` function, in its current implementation, *ignores* this error and proceeds, returning the `serv` pointer. This is where the problem truly festers. Later, `svc_xprt_create` will eventually call `svc_xprt_enqueue`, which then attempts to increment the per-CPU counter using `percpu_counter_inc`. Because `fbc->counters` is NULL, this increment operation dereferences a NULL pointer, leading directly to the page fault.

Now, let's consider the reproduction steps. The core of the problem traces back to `__write_ports_addxprt`. This function, through a chain of calls (`nfsd_create_serv` -> `svc_create_pooled` -> `__svc_create`), sets up the necessary structures. The crucial part is that `__svc_create` is where the per-CPU counters are supposed to be initialized. If this initialization (`percpu_counter_init`) fails, and the error is ignored, the subsequent call to `svc_xprt_enqueue` will indeed crash.

The prompt, however, asks about reproducing this with a minimal, standalone C program for bugfix verification. While fault injection is the *syzkaller* way, we need a more direct approach for a C program. If we have root privileges, we can leverage fault injection within the C program itself. Alternatively, and perhaps more straightforwardly for a standalone test, we can directly interact with the NFS control interface. Writing to `/proc/fs/nfsd/portlist` is the user-space mechanism that ultimately triggers `__write_ports_addxprt`. So, a strategy would be to write a C program that performs this operation, and then run it under conditions that mimic allocation failures. This could involve running the system under severe memory pressure or, as mentioned, using kernel fault injection mechanisms that can be triggered from user space if the necessary privileges are available. The key is to engineer a scenario where `percpu_counter_init` fails within `__svc_create` *without* the error being properly handled, leading to the NULL pointer dereference later.

map[ContextFile:fs/nfsd/nfsctl.c IncludeSnippetLines:2 Name:__write_ports_addxprt SourceTreePrefix:]

map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:__write_ports SourceFile:fs/nfsd/nfsctl.c SourceLine:808 SourceSnippet: 806:	
 807:		if (isalpha(buf[0]))
 808:			return __write_ports_addxprt(buf, net, file->f_cred);
 809:	
 810:		return -EINVAL;
]] TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 13667
							output: 51
							thoughts: 14
						

**My Thought Process**

Okay, so I'm tracing the execution flow here. I see a function called `write_ports` being invoked, and within its scope, it's making a call to another function, `__write_ports`. This tells me that `__write_ports` is likely a more internal or perhaps a "private" implementation detail that `write_ports` uses to perform its core task. It's a common pattern to have a public-facing function that handles setup, validation, or other higher-level concerns, and then delegates the actual work to a more specific, lower-level function like `__write_ports`. My current focus is on understanding what `__write_ports` actually *does* once it's called by `write_ports`.

map[ContextFile:fs/nfsd/nfsctl.c IncludeSnippetLines:2 Name:write_ports SourceTreePrefix:]

map[References:[map[ReferenceKind:takes-address-of ReferencingEntityKind:global_variable ReferencingEntityName:write_op SourceFile:fs/nfsd/nfsctl.c SourceLine:87 SourceSnippet:  85:		[NFSD_Pool_Threads] = write_pool_threads,
  86:		[NFSD_Versions] = write_versions,
  87:		[NFSD_Ports] = write_ports,
  88:		[NFSD_MaxBlkSize] = write_maxblksize,
  89:	#ifdef CONFIG_NFSD_V4
]] TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 13862
							output: 41
							thoughts: 398
						

**My Thought Process on Reproducing the NFSd Portlist Bug**

Okay, so I'm looking at this `NFSD_Ports` thing, and I realize it's directly tied to the `portlist` file. This means any write operation to `/proc/fs/nfsd/portlist` (or wherever that `nfsd` filesystem is mounted) is going to trigger something. The format for entries in that file is pretty straightforward: a string for the protocol and a 5-digit unsigned integer for the port, like `"tcp 2049"`.

Now, the core of the bug, as I understand it, is in `__svc_create`. The problem is that it completely *ignores* the return value from `percpu_counter_init`. This is a critical oversight, and I need to confirm if this is still an active issue in the kernel. The instructions are clear: I shouldn't assume it's been fixed, and I need to devise a reproduction strategy as if it hasn't.

So, here's how I'd go about reproducing this:

1.  First, I need to make sure the `nfsd` filesystem is mounted. That's a prerequisite.
2.  Next, I need to set up fault injection. The goal is to cause allocations to fail. Ideally, I'd want to target `percpu_counter_init` specifically, but if that's not directly supported, I'll use the standard `failslab` mechanism to inject faults into slab allocations. This should cover the scenario.
3.  With fault injection enabled, I'll then write a string formatted correctly to `/proc/fs/nfsd/portlist`, something like `"tcp 2049"`.
4.  When the kernel processes this write, it'll attempt to create the service. At that point, the `percpu_counter_init` call will fail due to my injected fault. Because `__svc_create` ignores this error, the kernel will proceed, but it will then likely crash when it tries to enqueue the transport, as the underlying infrastructure won't be properly initialized.

Let me quickly double-check the fault injection setup. Syzkaller typically uses `/sys/kernel/debug/failslab/` or similar interfaces for this. So, the question is, can I trigger the fault *just* by using `failslab`? Yes, `percpu_counter_init` actually calls `percpu_counter_init_many`, which in turn calls `__percpu_counter_init_many`. This latter function is where the memory allocation happens, using `alloc_percpu_gfp(s32, gfp)`.

Ah, wait a minute. I need to be careful here. `alloc_percpu_gfp` allocates memory from the *percpu allocator*, not the slab allocator! This changes things slightly. My initial assumption about `failslab` might be too broad if the allocation is purely percpu. I need to re-examine `__percpu_counter_init_many` and how it interacts with fault injection mechanisms for percpu memory. This requires a deeper dive into the percpu allocation path and its fault injection capabilities.

map[ContextFile:lib/percpu_counter.c Name:__percpu_counter_init_many]

map[SourceCode: 188:	int __percpu_counter_init_many(struct percpu_counter *fbc, s64 amount,
 189:				       gfp_t gfp, u32 nr_counters,
 190:				       struct lock_class_key *key)
 191:	{
 192:		unsigned long flags __maybe_unused;
 193:		size_t counter_size;
 194:		s32 __percpu *counters;
 195:		u32 i;
 196:	
 197:		counter_size = ALIGN(sizeof(*counters), __alignof__(*counters));
 198:		counters = __alloc_percpu_gfp(nr_counters * counter_size,
 199:					      __alignof__(*counters), gfp);
 200:		if (!counters) {
 201:			fbc[0].counters = NULL;
 202:			return -ENOMEM;
 203:		}
 204:	
 205:		for (i = 0; i < nr_counters; i++) {
 206:			raw_spin_lock_init(&fbc[i].lock);
 207:			lockdep_set_class(&fbc[i].lock, key);
 208:	#ifdef CONFIG_HOTPLUG_CPU
 209:			INIT_LIST_HEAD(&fbc[i].list);
 210:	#endif
 211:			fbc[i].count = amount;
 212:			fbc[i].counters = (void __percpu *)counters + i * counter_size;
 213:	
 214:			debug_percpu_counter_activate(&fbc[i]);
 215:		}
 216:	
 217:	#ifdef CONFIG_HOTPLUG_CPU
 218:		spin_lock_irqsave(&percpu_counters_lock, flags);
 219:		for (i = 0; i < nr_counters; i++)
 220:			list_add(&fbc[i].list, &percpu_counters);
 221:		spin_unlock_irqrestore(&percpu_counters_lock, flags);
 222:	#endif
 223:		return 0;
 224:	}
 SourceFile:lib/percpu_counter.c]

gemini-3.1-pro-preview

							input: 14918
							output: 38
							thoughts: 42
						

**My Thought Process Regarding Per-CPU Allocation Fault Injection**

As an expert in this domain, my immediate reaction to encountering `__alloc_percpu_gfp` was to question its compatibility with fault injection mechanisms. My primary concern revolves around whether the underlying implementation of `__alloc_percpu_gfp` is structured in a way that allows for deliberate injection of faults during its execution.

Therefore, my next logical step, and the core of my thought process here, is to **verify directly whether `__alloc_percpu_gfp` actually leverages or supports fault injection**. This isn't a mere curiosity; it's a critical step in understanding the robustness and testability of the per-CPU allocation subsystem. I need to ascertain if the mechanisms designed to simulate memory failures can be effectively applied to this specific allocation function.

log-in to see details

map[ContextFile:mm/percpu.c Name:__alloc_percpu_gfp]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 15003
							output: 34
							thoughts: 21
						

**My Thought Process for Locating the Per-CPU Allocation Function**

Okay, so I'm trying to figure out how per-CPU memory is managed within the kernel. My initial hypothesis is that the core allocation mechanism likely resides in `mm/percpu.c`, given the naming convention and the focus of that file. Therefore, my first investigative step is to dive into that specific source file and look for a function that clearly signals an allocation operation related to per-CPU data structures. I'm expecting to find something along the lines of `pcpu_alloc` or a similar, descriptive identifier that would indicate the purpose of creating a new per-CPU data instance. This is where I'd expect the kernel's sophisticated machinery for managing memory that's unique to each processor to be implemented.

log-in to see details

map[Expression:__alloc_percpu_gfp PathPrefix:mm/percpu.c]

map[Output:]

gemini-3.1-pro-preview

							input: 15056
							output: 36
							thoughts: 48
						

**My Thought Process on Locating `__alloc_percpu_gfp`**

Right, so the first thing that comes to mind when I see a function like `__alloc_percpu_gfp` is its likely location within the kernel's memory management subsystem. My intuition points towards `mm/percpu.c` as the most probable home for this kind of per-CPU allocation logic. However, I'm not going to just assume that. I know that sometimes, particularly with core infrastructure, these functions can be defined as macros, or they might not be directly exported for external use. To get a definitive answer and understand the scope and definition, my next step is to consult the primary header file for per-CPU operations, which is `include/linux/percpu.h`. This is where I expect to find the actual declaration, and potentially the definition if it's a simple macro, or at the very least, the function prototype if it resides in a `.c` file.

map[Expression:__alloc_percpu_gfp PathPrefix:include/linux/percpu.h]

map[Output:include/linux/percpu.h=137=extern void __percpu *pcpu_alloc_noprof(size_t size, size_t align, bool reserved,
--
include/linux/percpu.h-139-
include/linux/percpu.h:140:#define __alloc_percpu_gfp(_size, _align, _gfp)				\
include/linux/percpu.h-141-	alloc_hooks(pcpu_alloc_noprof(_size, _align, false, _gfp))
--
include/linux/percpu.h-147-#define alloc_percpu_gfp(type, gfp)					\
include/linux/percpu.h:148:	(typeof(type) __percpu *)__alloc_percpu_gfp(sizeof(type),	\
include/linux/percpu.h-149-						__alignof__(type), gfp)
]

gemini-3.1-pro-preview

							input: 15363
							output: 38
							thoughts: 54
						

**My Thought Process Regarding Per-CPU Allocation and Fault Injection**

Right, so my initial thought upon encountering this particular call site is that it's invoking the `pcpu_alloc_noprof` function, or its more general counterpart, `pcpu_alloc`. This immediately triggers a question in my mind: does this specific per-CPU allocation mechanism, `pcpu_alloc`, have any built-in support for fault injection? Given the critical nature of memory allocation and the desire to test resilience under adverse conditions, understanding its fault injection capabilities is paramount. To answer this, I'd naturally proceed to examine the implementation of `pcpu_alloc` itself, which I'd expect to find within the `mm/percpu.c` source file. This dive into the source code would be my next logical step to ascertain whether or not fault injection is a feature I can leverage with this allocator.

map[ContextFile:mm/percpu.c Name:pcpu_alloc_noprof]

map[SourceCode:1721:	/**
1722:	 * pcpu_alloc - the percpu allocator
1723:	 * @size: size of area to allocate in bytes
1724:	 * @align: alignment of area (max PAGE_SIZE)
1725:	 * @reserved: allocate from the reserved chunk if available
1726:	 * @gfp: allocation flags
1727:	 *
1728:	 * Allocate percpu area of @size bytes aligned at @align.  If @gfp doesn't
1729:	 * contain %GFP_KERNEL, the allocation is atomic. If @gfp has __GFP_NOWARN
1730:	 * then no warning will be triggered on invalid or failed allocation
1731:	 * requests.
1732:	 *
1733:	 * RETURNS:
1734:	 * Percpu pointer to the allocated area on success, NULL on failure.
1735:	 */
1736:	void __percpu *pcpu_alloc_noprof(size_t size, size_t align, bool reserved,
1737:					 gfp_t gfp)
1738:	{
1739:		gfp_t pcpu_gfp;
1740:		bool is_atomic;
1741:		bool do_warn;
1742:		struct obj_cgroup *objcg = NULL;
1743:		static atomic_t warn_limit = ATOMIC_INIT(10);
1744:		struct pcpu_chunk *chunk, *next;
1745:		const char *err;
1746:		int slot, off, cpu, ret;
1747:		unsigned long flags;
1748:		void __percpu *ptr;
1749:		size_t bits, bit_align;
1750:	
1751:		gfp = current_gfp_context(gfp);
1752:		/* whitelisted flags that can be passed to the backing allocators */
1753:		pcpu_gfp = gfp & (GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN);
1754:		is_atomic = !gfpflags_allow_blocking(gfp);
1755:		do_warn = !(gfp & __GFP_NOWARN);
1756:	
1757:		/*
1758:		 * There is now a minimum allocation size of PCPU_MIN_ALLOC_SIZE,
1759:		 * therefore alignment must be a minimum of that many bytes.
1760:		 * An allocation may have internal fragmentation from rounding up
1761:		 * of up to PCPU_MIN_ALLOC_SIZE - 1 bytes.
1762:		 */
1763:		if (unlikely(align < PCPU_MIN_ALLOC_SIZE))
1764:			align = PCPU_MIN_ALLOC_SIZE;
1765:	
1766:		size = ALIGN(size, PCPU_MIN_ALLOC_SIZE);
1767:		bits = size >> PCPU_MIN_ALLOC_SHIFT;
1768:		bit_align = align >> PCPU_MIN_ALLOC_SHIFT;
1769:	
1770:		if (unlikely(!size || size > PCPU_MIN_UNIT_SIZE || align > PAGE_SIZE ||
1771:			     !is_power_of_2(align))) {
1772:			WARN(do_warn, "illegal size (%zu) or align (%zu) for percpu allocation\n",
1773:			     size, align);
1774:			return NULL;
1775:		}
1776:	
1777:		if (unlikely(!pcpu_memcg_pre_alloc_hook(size, gfp, &objcg)))
1778:			return NULL;
1779:	
1780:		if (!is_atomic) {
1781:			/*
1782:			 * pcpu_balance_workfn() allocates memory under this mutex,
1783:			 * and it may wait for memory reclaim. Allow current task
1784:			 * to become OOM victim, in case of memory pressure.
1785:			 */
1786:			if (gfp & __GFP_NOFAIL) {
1787:				mutex_lock(&pcpu_alloc_mutex);
1788:			} else if (mutex_lock_killable(&pcpu_alloc_mutex)) {
1789:				pcpu_memcg_post_alloc_hook(objcg, NULL, 0, size);
1790:				return NULL;
1791:			}
1792:		}
1793:	
1794:		spin_lock_irqsave(&pcpu_lock, flags);
1795:	
1796:		/* serve reserved allocations from the reserved chunk if available */
1797:		if (reserved && pcpu_reserved_chunk) {
1798:			chunk = pcpu_reserved_chunk;
1799:	
1800:			off = pcpu_find_block_fit(chunk, bits, bit_align, is_atomic);
1801:			if (off < 0) {
1802:				err = "alloc from reserved chunk failed";
1803:				goto fail_unlock;
1804:			}
1805:	
1806:			off = pcpu_alloc_area(chunk, bits, bit_align, off);
1807:			if (off >= 0)
1808:				goto area_found;
1809:	
1810:			err = "alloc from reserved chunk failed";
1811:			goto fail_unlock;
1812:		}
1813:	
1814:	restart:
1815:		/* search through normal chunks */
1816:		for (slot = pcpu_size_to_slot(size); slot <= pcpu_free_slot; slot++) {
1817:			list_for_each_entry_safe(chunk, next, &pcpu_chunk_lists[slot],
1818:						 list) {
1819:				off = pcpu_find_block_fit(chunk, bits, bit_align,
1820:							  is_atomic);
1821:				if (off < 0) {
1822:					if (slot < PCPU_SLOT_FAIL_THRESHOLD)
1823:						pcpu_chunk_move(chunk, 0);
1824:					continue;
1825:				}
1826:	
1827:				off = pcpu_alloc_area(chunk, bits, bit_align, off);
1828:				if (off >= 0) {
1829:					pcpu_reintegrate_chunk(chunk);
1830:					goto area_found;
1831:				}
1832:			}
1833:		}
1834:	
1835:		spin_unlock_irqrestore(&pcpu_lock, flags);
1836:	
1837:		if (is_atomic) {
1838:			err = "atomic alloc failed, no space left";
1839:			goto fail;
1840:		}
1841:	
1842:		/* No space left.  Create a new chunk. */
1843:		if (list_empty(&pcpu_chunk_lists[pcpu_free_slot])) {
1844:			chunk = pcpu_create_chunk(pcpu_gfp);
1845:			if (!chunk) {
1846:				err = "failed to allocate new chunk";
1847:				goto fail;
1848:			}
1849:	
1850:			spin_lock_irqsave(&pcpu_lock, flags);
1851:			pcpu_chunk_relocate(chunk, -1);
1852:		} else {
1853:			spin_lock_irqsave(&pcpu_lock, flags);
1854:		}
1855:	
1856:		goto restart;
1857:	
1858:	area_found:
1859:		pcpu_stats_area_alloc(chunk, size);
1860:	
1861:		if (pcpu_nr_empty_pop_pages < PCPU_EMPTY_POP_PAGES_LOW)
1862:			pcpu_schedule_balance_work();
1863:	
1864:		spin_unlock_irqrestore(&pcpu_lock, flags);
1865:	
1866:		/* populate if not all pages are already there */
1867:		if (!is_atomic) {
1868:			unsigned int page_end, rs, re;
1869:	
1870:			rs = PFN_DOWN(off);
1871:			page_end = PFN_UP(off + size);
1872:	
1873:			for_each_clear_bitrange_from(rs, re, chunk->populated, page_end) {
1874:				WARN_ON(chunk->immutable);
1875:	
1876:				ret = pcpu_populate_chunk(chunk, rs, re, pcpu_gfp);
1877:	
1878:				spin_lock_irqsave(&pcpu_lock, flags);
1879:				if (ret) {
1880:					pcpu_free_area(chunk, off);
1881:					err = "failed to populate";
1882:					goto fail_unlock;
1883:				}
1884:				pcpu_chunk_populated(chunk, rs, re);
1885:				spin_unlock_irqrestore(&pcpu_lock, flags);
1886:			}
1887:	
1888:			mutex_unlock(&pcpu_alloc_mutex);
1889:		}
1890:	
1891:		/* clear the areas and return address relative to base address */
1892:		for_each_possible_cpu(cpu)
1893:			memset((void *)pcpu_chunk_addr(chunk, cpu, 0) + off, 0, size);
1894:	
1895:		ptr = __addr_to_pcpu_ptr(chunk->base_addr + off);
1896:		kmemleak_alloc_percpu(ptr, size, gfp);
1897:	
1898:		trace_percpu_alloc_percpu(_RET_IP_, reserved, is_atomic, size, align,
1899:					  chunk->base_addr, off, ptr,
1900:					  pcpu_obj_full_size(size), gfp);
1901:	
1902:		pcpu_memcg_post_alloc_hook(objcg, chunk, off, size);
1903:	
1904:		pcpu_alloc_tag_alloc_hook(chunk, off, size);
1905:	
1906:		return ptr;
1907:	
1908:	fail_unlock:
1909:		spin_unlock_irqrestore(&pcpu_lock, flags);
1910:	fail:
1911:		trace_percpu_alloc_percpu_fail(reserved, is_atomic, size, align);
1912:	
1913:		if (do_warn) {
1914:			int remaining = atomic_dec_if_positive(&warn_limit);
1915:	
1916:			if (remaining >= 0) {
1917:				pr_warn("allocation failed, size=%zu align=%zu atomic=%d, %s\n",
1918:					size, align, is_atomic, err);
1919:				if (!is_atomic)
1920:					dump_stack();
1921:				if (remaining == 0)
1922:					pr_info("limit reached, disable warning\n");
1923:			}
1924:		}
1925:	
1926:		if (is_atomic) {
1927:			/* see the flag handling in pcpu_balance_workfn() */
1928:			pcpu_atomic_alloc_failed = true;
1929:			pcpu_schedule_balance_work();
1930:		} else {
1931:			mutex_unlock(&pcpu_alloc_mutex);
1932:		}
1933:	
1934:		pcpu_memcg_post_alloc_hook(objcg, NULL, 0, size);
1935:	
1936:		return NULL;
1937:	}
 SourceFile:mm/percpu.c]

gemini-3.1-pro-preview

							input: 18780
							output: 43
							thoughts: 1507
						

**My Thoughts on Reproducing the `percpu_counter_init` Crash**

My initial thought was that `pcpu_alloc_noprof` itself wasn't directly triggering a failure, but then I recalled that syzkaller leverages `CONFIG_FAULT_INJECTION`, which encompasses mechanisms like `failslab` and `fail_page_alloc`. This made me realize that `pcpu_alloc_noprof` might indirectly lead to failures. It calls `pcpu_create_chunk`, which in turn calls `pcpu_alloc_pages` or `vmalloc`. These allocations are susceptible to `fail_page_alloc`. I also considered if `kzalloc_objs` within `__svc_create` could be the culprit.

However, upon closer inspection, if `kzalloc_objs` fails, `__svc_create` would simply return `NULL`. This `NULL` return would propagate up through `svc_create_pooled`, `nfsd_create_serv`, and ultimately `__write_ports_addxprt`, resulting in a `-ENOMEM` error rather than a crash.

The real issue, I discovered, lies in how `percpu_counter_init` functions. The problem is that its return value is entirely ignored. This function calls `__percpu_counter_init_many`, which, in turn, uses `__alloc_percpu_gfp`. If `__alloc_percpu_gfp` fails and returns `-ENOMEM`, this failure isn't handled.

The question then became: how can `__alloc_percpu_gfp` fail? Fault injection is the key. `fail_page_alloc` can cause page allocations to fail within `pcpu_populate_chunk` or `pcpu_create_chunk`. Additionally, since `percpu_counter_init` uses `GFP_KERNEL`, either `fail_page_alloc` or `failslab` (if slab memory is used, as in `kzalloc` for `struct pcpu_chunk`) could be used to trigger the fault.

While exhausting memory directly is an option, it's impractical for a minimal, standalone reproduction. Therefore, fault injection is the standard and most reliable approach.

To reproduce this, my strategy would involve using fault injection. I could either:
1. Directly manipulate the debugfs files (`/sys/kernel/debug/failslab/probability` and `/sys/kernel/debug/fail_page_alloc/probability`) to set the failure probability to 100%.
2. Leverage syzkaller's `task->make_it_fail` mechanism, which is a more integrated way of enabling fault injection for a specific task. This can be done by writing "1" to `/proc/self/make-it-fail`.

Crucially, I would need to ensure that the fault injection is configured to actually trigger a failure when `make-it-fail` is set. This involves setting up `/sys/kernel/debug/failslab` or `fail_page_alloc` appropriately.

Looking deeper into `__svc_create`, I confirmed that the loops iterating through `serv->sv_nrpools` call `percpu_counter_init` multiple times for `sp_messages_arrived`, `sp_sockets_queued`, and `sp_threads_woken`. The critical flaw is that the return values of these `percpu_counter_init` calls are completely ignored.

So, the sequence of events leading to the crash is:
1. Fault injection causes `percpu_counter_init` within `__svc_create` to fail.
2. `__svc_create` continues execution as if the initialization succeeded, even though the per-CPU counters (`pool->sp_sockets_queued.counters`, for instance) would be `NULL`.
3. Later, when `svc_xprt_enqueue` is called (which happens during transport creation via `svc_xprt_create` triggered by adding a port), it attempts to increment a per-CPU counter using `percpu_counter_inc(&pool->sp_sockets_queued)`.
4. This dereferences a `NULL` pointer (or a pointer that effectively points to uninitialized memory due to the failed allocation), leading to a page fault and the eventual crash.

Therefore, the minimal standalone C program would need to set up fault injection, trigger the NFS service initialization (e.g., by writing to `/proc/fs/nfsd/portlist`), and then trigger an operation that eventually calls `svc_xprt_enqueue`. The fault injection will ensure that the `percpu_counter_init` fails, and the subsequent attempt to increment the counter will cause the crash. The key for the reproduction is the ignored return value of `percpu_counter_init`.

map[ContextFile:net/sunrpc/svc_xprt.c Name:svc_xprt_create]

map[SourceCode: 343:	/**
 344:	 * svc_xprt_create - Add a new listener to @serv
 345:	 * @serv: target RPC service
 346:	 * @xprt_name: transport class name
 347:	 * @net: network namespace
 348:	 * @family: network address family
 349:	 * @port: listener port
 350:	 * @flags: SVC_SOCK flags
 351:	 * @cred: credential to bind to this transport
 352:	 *
 353:	 * Return local xprt port on success or %-EPROTONOSUPPORT on failure
 354:	 */
 355:	int svc_xprt_create(struct svc_serv *serv, const char *xprt_name,
 356:			    struct net *net, const int family,
 357:			    const unsigned short port, int flags,
 358:			    const struct cred *cred)
 359:	{
 360:		struct sockaddr_in sin = {
 361:			.sin_family		= AF_INET,
 362:			.sin_addr.s_addr	= htonl(INADDR_ANY),
 363:			.sin_port		= htons(port),
 364:		};
 365:	#if IS_ENABLED(CONFIG_IPV6)
 366:		struct sockaddr_in6 sin6 = {
 367:			.sin6_family		= AF_INET6,
 368:			.sin6_addr		= IN6ADDR_ANY_INIT,
 369:			.sin6_port		= htons(port),
 370:		};
 371:	#endif
 372:		struct sockaddr *sap;
 373:	
 374:		switch (family) {
 375:		case PF_INET:
 376:			sap = (struct sockaddr *)&sin;
 377:			break;
 378:	#if IS_ENABLED(CONFIG_IPV6)
 379:		case PF_INET6:
 380:			sap = (struct sockaddr *)&sin6;
 381:			break;
 382:	#endif
 383:		default:
 384:			return -EAFNOSUPPORT;
 385:		}
 386:	
 387:		return svc_xprt_create_from_sa(serv, xprt_name, net, sap, flags, cred);
 388:	}
 SourceFile:net/sunrpc/svc_xprt.c]

gemini-3.1-pro-preview

							input: 21014
							output: 47
							thoughts: 23
						

**My Thought Process Regarding `svc_xprt_create`**

Alright, let's break down this call chain. My primary focus here is understanding the initiation of a service transport's creation. I see that `svc_xprt_create` is the entry point. My immediate thought is, "Okay, this is where the user-facing or internal request to build a service transport begins."

However, I also recognize that `svc_xprt_create` itself is likely a wrapper or a higher-level abstraction. It's not going to be the function doing all the heavy lifting for *how* to create the transport. Therefore, I'm immediately looking for what it delegates to.

And there it is: `svc_xprt_create_from_sa`. This tells me that the actual, concrete work of instantiating the service transport is being handed off to this other function. The naming convention, `_from_sa`, strongly suggests that the creation process will be driven by some form of "service address" or a similar underlying representation. This is a crucial detail. It implies that `svc_xprt_create` is responsible for determining *what* kind of service transport is needed (perhaps based on some configuration or implicit knowledge) and then passing that information, likely encapsulated in a service address structure, to `svc_xprt_create_from_sa` to handle the actual instantiation and configuration of the transport mechanism.

So, in essence, my thought is: `svc_xprt_create` acts as a dispatcher, receiving the initial request and then deferring the complex details of constructing the service transport to a more specialized function, `svc_xprt_create_from_sa`, which will likely use service address information to guide its creation process.

map[ContextFile:net/sunrpc/svc_xprt.c Name:svc_xprt_create_from_sa]

map[SourceCode: 301:	/**
 302:	 * svc_xprt_create_from_sa - Add a new listener to @serv from socket address
 303:	 * @serv: target RPC service
 304:	 * @xprt_name: transport class name
 305:	 * @net: network namespace
 306:	 * @sap: socket address pointer
 307:	 * @flags: SVC_SOCK flags
 308:	 * @cred: credential to bind to this transport
 309:	 *
 310:	 * Return local xprt port on success or %-EPROTONOSUPPORT on failure
 311:	 */
 312:	int svc_xprt_create_from_sa(struct svc_serv *serv, const char *xprt_name,
 313:				    struct net *net, struct sockaddr *sap,
 314:				    int flags, const struct cred *cred)
 315:	{
 316:		size_t len;
 317:		int err;
 318:	
 319:		switch (sap->sa_family) {
 320:		case AF_INET:
 321:			len = sizeof(struct sockaddr_in);
 322:			break;
 323:	#if IS_ENABLED(CONFIG_IPV6)
 324:		case AF_INET6:
 325:			len = sizeof(struct sockaddr_in6);
 326:			break;
 327:	#endif
 328:		default:
 329:			return -EAFNOSUPPORT;
 330:		}
 331:	
 332:		err = _svc_xprt_create(serv, xprt_name, net, sap, len, flags, cred);
 333:		if (err == -EPROTONOSUPPORT) {
 334:			request_module("svc%s", xprt_name);
 335:			err = _svc_xprt_create(serv, xprt_name, net, sap, len, flags,
 336:					       cred);
 337:		}
 338:	
 339:		return err;
 340:	}
 SourceFile:net/sunrpc/svc_xprt.c]

gemini-3.1-pro-preview

							input: 21689
							output: 44
							thoughts: 24
						

**My Thought Process on `svc_xprt_create_from_sa`**

Okay, so when I see `svc_xprt_create_from_sa` being called, my immediate mental leap is to what it's doing under the hood. I know, from my experience with this codebase, that this function isn't a standalone piece of magic. It's a wrapper, a convenience function, if you will. My thought process is that it's designed to abstract away some of the more granular details of setting up a transport endpoint, and the core logic for that setup is handled by `_svc_xprt_create`. So, my thinking is: "Alright, `svc_xprt_create_from_sa` is essentially delegating the heavy lifting of transport creation to `_svc_xprt_create`. This means I need to understand what `_svc_xprt_create` requires and what it does to truly grasp the full picture of what `svc_xprt_create_from_sa` is accomplishing."

map[ContextFile:net/sunrpc/svc_xprt.c Name:_svc_xprt_create]

map[SourceCode: 263:	static int _svc_xprt_create(struct svc_serv *serv, const char *xprt_name,
 264:				    struct net *net, struct sockaddr *sap,
 265:				    size_t len, int flags, const struct cred *cred)
 266:	{
 267:		struct svc_xprt_class *xcl;
 268:	
 269:		spin_lock(&svc_xprt_class_lock);
 270:		list_for_each_entry(xcl, &svc_xprt_class_list, xcl_list) {
 271:			struct svc_xprt *newxprt;
 272:			unsigned short newport;
 273:	
 274:			if (strcmp(xprt_name, xcl->xcl_name))
 275:				continue;
 276:	
 277:			if (!try_module_get(xcl->xcl_owner))
 278:				goto err;
 279:	
 280:			spin_unlock(&svc_xprt_class_lock);
 281:			newxprt = xcl->xcl_ops->xpo_create(serv, net, sap, len, flags);
 282:			if (IS_ERR(newxprt)) {
 283:				trace_svc_xprt_create_err(serv->sv_programs->pg_name,
 284:							  xcl->xcl_name, sap, len,
 285:							  newxprt);
 286:				module_put(xcl->xcl_owner);
 287:				return PTR_ERR(newxprt);
 288:			}
 289:			newxprt->xpt_cred = get_cred(cred);
 290:			svc_add_new_perm_xprt(serv, newxprt);
 291:			newport = svc_xprt_local_port(newxprt);
 292:			return newport;
 293:		}
 294:	 err:
 295:		spin_unlock(&svc_xprt_class_lock);
 296:		/* This errno is exposed to user space.  Provide a reasonable
 297:		 * perror msg for a bad transport. */
 298:		return -EPROTONOSUPPORT;
 299:	}
 SourceFile:net/sunrpc/svc_xprt.c]

gemini-3.1-pro-preview

							input: 22418
							output: 47
							thoughts: 24
						

**My Thought Process Regarding `_svc_xprt_create` and `svc_add_new_perm_xprt`**

Okay, so when I'm looking at the `_svc_xprt_create` function, the first thing that jumps out at me is its immediate reliance on another function: `svc_add_new_perm_xprt`. This tells me right away that the primary responsibility of `_svc_xprt_create` isn't the *entirety* of creating a new transport, but rather setting up the initial scaffolding or context, and then delegating the core persistence or registration of that transport to `svc_add_new_perm_xprt`.

My immediate inference is that `_svc_xprt_create` is likely handling the in-memory allocation and initialization of the transport object itself. This would involve things like allocating the necessary data structures, setting initial default values, perhaps establishing some basic network address bindings if they're known at this stage, and generally preparing the transport for its subsequent lifecycle.

However, the key insight here, and where my focus sharpens, is the call to `svc_add_new_perm_xprt`. This is a significant clue. The prefix "perm" in `svc_add_new_perm_xprt` strongly suggests that this function is concerned with making the newly created transport *persistent*. In a system like this, "persistent" could mean several things:

*   **Storing it in a central registry:** It's highly probable that `svc_add_new_perm_xprt` is responsible for adding this transport to a system-wide or service-specific registry or list, so that it's known and can be managed by other parts of the system.
*   **Marking it as "permanent" or "active":** It might be that the transport, once added by this function, is now considered a fully functional, available transport for incoming requests.
*   **Writing its configuration to stable storage:** In some scenarios, "perm" could imply writing the transport's configuration to disk or some other non-volatile storage, so that it survives restarts of the service or the system.

Therefore, my mental model solidifies around `_svc_xprt_create` being the initial, ephemeral setup routine for a transport, and `svc_add_new_perm_xprt` being the crucial step that elevates this newly created transport from an unmanaged, in-memory object to a registered, functional, and potentially persistent entity within the service's ecosystem. The distinction between these two functions is critical for understanding the lifecycle and management of transports in this particular architecture.

map[ContextFile:net/sunrpc/svc_xprt.c Name:svc_add_new_perm_xprt]

map[SourceCode: 254:	void svc_add_new_perm_xprt(struct svc_serv *serv, struct svc_xprt *new)
 255:	{
 256:		clear_bit(XPT_TEMP, &new->xpt_flags);
 257:		spin_lock_bh(&serv->sv_lock);
 258:		list_add(&new->xpt_list, &serv->sv_permsocks);
 259:		spin_unlock_bh(&serv->sv_lock);
 260:		svc_xprt_received(new);
 261:	}
 SourceFile:net/sunrpc/svc_xprt.c]

gemini-3.1-pro-preview

							input: 22661
							output: 43
							thoughts: 23
						

**My Thought Process Regarding `svc_add_new_perm_xprt` and `svc_xprt_received`**

As I delve into the intricacies of this system's RPC (Remote Procedure Call) infrastructure, I'm observing a direct causal relationship between the invocation of `svc_add_new_perm_xprt` and the subsequent call to `svc_xprt_received`. This suggests that the `svc_add_new_perm_xprt` function's primary responsibility, or at least a critical side-effect of its execution, is to initiate the process of acknowledging or handling an incoming RPC request.

My hypothesis is that `svc_add_new_perm_xprt` is likely involved in the initial setup or registration of a new transport endpoint, perhaps a network socket or a similar communication channel, that is now ready to receive RPCs. Once this endpoint is established and deemed "permitted" (hence the `perm` in its name, implying some form of authorization or readiness check has passed), the system needs to signal that this transport is now active and awaiting data. This is precisely where `svc_xprt_received` appears to come into play.

Therefore, I'm inferring that `svc_xprt_received` is the mechanism responsible for queuing, processing, or otherwise managing the incoming RPC data from a newly added and permitted transport. It’s the point where the system actively starts listening or reacting to whatever data arrives on that specific transport. It's not just about *adding* the transport, but about making it *functional* for receiving RPCs, and `svc_xprt_received` is the marker of that transition. This flow indicates a deliberate design to separate the establishment of a transport from the immediate handling of its incoming traffic, allowing for potential asynchronous operations or more granular control over resource allocation.

map[ContextFile:net/sunrpc/svc_xprt.c Name:svc_xprt_received]

map[SourceCode: 214:	/**
 215:	 * svc_xprt_received - start next receiver thread
 216:	 * @xprt: controlling transport
 217:	 *
 218:	 * The caller must hold the XPT_BUSY bit and must
 219:	 * not thereafter touch transport data.
 220:	 *
 221:	 * Note: XPT_DATA only gets cleared when a read-attempt finds no (or
 222:	 * insufficient) data.
 223:	 */
 224:	void svc_xprt_received(struct svc_xprt *xprt)
 225:	{
 226:		if (!test_bit(XPT_BUSY, &xprt->xpt_flags)) {
 227:			WARN_ONCE(1, "xprt=0x%p already busy!", xprt);
 228:			return;
 229:		}
 230:	
 231:		/* As soon as we clear busy, the xprt could be closed and
 232:		 * 'put', so we need a reference to call svc_xprt_enqueue with:
 233:		 */
 234:		svc_xprt_get(xprt);
 235:		smp_mb__before_atomic();
 236:		clear_bit(XPT_BUSY, &xprt->xpt_flags);
 237:	
 238:		/*
 239:		 * Skip the enqueue when no actionable flags are set.
 240:		 * Each producer both sets its flag (XPT_DATA, XPT_CLOSE,
 241:		 * etc.) and calls svc_xprt_enqueue(); if a set_bit races
 242:		 * with this check, the producer's own enqueue observes
 243:		 * !XPT_BUSY and dispatches the transport.
 244:		 */
 245:		if (READ_ONCE(xprt->xpt_flags) &
 246:		    (BIT(XPT_CONN) | BIT(XPT_CLOSE) | BIT(XPT_HANDSHAKE) |
 247:		     BIT(XPT_DATA) | BIT(XPT_DEFERRED)))
 248:			svc_xprt_enqueue(xprt);
 249:	
 250:		svc_xprt_put(xprt);
 251:	}
 SourceFile:net/sunrpc/svc_xprt.c]

gemini-3.1-pro-preview

							input: 23388
							output: 36
							thoughts: 402
						

**My Thought Process on Reproducing the NFS Crash**

Ah, I think I've pinpointed the crux of this NFS crash. My analysis shows that the sequence `svc_xprt_received` calls `svc_xprt_enqueue`, and it's within `svc_xprt_enqueue` that the system hits the wall when it attempts to execute `percpu_counter_inc(&pool->sp_sockets_queued);`. This is precisely the reproduction path I was anticipating.

Therefore, my strategy hinges on injecting faults during the `__svc_create` call, specifically when it invokes `percpu_counter_init`. To achieve this, I'll construct a C program that manipulates the kernel's fault injection mechanisms. Here's what I'm planning:

First, I'll interact with the `/sys/kernel/debug/failslab` interface. I'll set the `probability` to `100` to ensure failures are frequent, and the `times` to `-1` for indefinite fault injection. I'll also enable the `task-filter` by writing `Y`. Concurrently, I'll trigger a fault using `/proc/self/make-it-fail` by writing `1`.

With these fault injection settings in place, I'll then attempt to create an NFS service by writing `"tcp 2049"` to `/proc/fs/nfsd/portlist`.

Now, I'm digging a bit deeper into the memory allocation involved. I recall that `percpu_counter_init` relies on `__alloc_percpu_gfp`, which in turn uses `pcpu_alloc_noprof`. My question is whether `pcpu_alloc_noprof` itself allocates from the slab. Looking at its internal workings, it uses `pcpu_create_chunk` to allocate a `struct pcpu_chunk`, which it does via `kzalloc`. If `kzalloc` fails, `pcpu_create_chunk` will fail, and subsequently, `pcpu_alloc_noprof` will fail. Alternatively, it might fall back to using `vmalloc` or `alloc_pages` for the actual memory. This means both `failslab` and `fail_page_alloc` should be effective in triggering the failure. Given that Syzkaller commonly utilizes `failslab` and `fail_page_alloc`, I'm confident either will work. I'll confirm if `pcpu_alloc_noprof` indeed uses `kzalloc` to be absolutely sure.

map[ContextFile:mm/percpu.c Name:pcpu_create_chunk]

map[SourceCode: 333:	static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp)
 334:	{
 335:		struct pcpu_chunk *chunk;
 336:		struct vm_struct **vms;
 337:	
 338:		chunk = pcpu_alloc_chunk(gfp);
 339:		if (!chunk)
 340:			return NULL;
 341:	
 342:		vms = pcpu_get_vm_areas(pcpu_group_offsets, pcpu_group_sizes,
 343:					pcpu_nr_groups, pcpu_atom_size);
 344:		if (!vms) {
 345:			pcpu_free_chunk(chunk);
 346:			return NULL;
 347:		}
 348:	
 349:		chunk->data = vms;
 350:		chunk->base_addr = vms[0]->addr - pcpu_group_offsets[0];
 351:	
 352:		pcpu_stats_chunk_alloc();
 353:		trace_percpu_create_chunk(chunk->base_addr);
 354:	
 355:		return chunk;
 356:	}
 SourceFile:mm/percpu-vm.c]

gemini-3.1-pro-preview

							input: 24178
							output: 36
							thoughts: 13
						

**My Thought Process Regarding `pcpu_alloc_chunk`**

Right, so my initial observation about `pcpu_alloc_chunk` is pretty straightforward: it uses `kzalloc`. That's the fundamental starting point, and it immediately tells me a few things.

First off, `kzalloc` signifies that the memory being allocated for these per-CPU data chunks is zero-initialized. This is a crucial detail for me. Depending on the context of what these per-CPU chunks are being used for, this zeroing could be a significant advantage, saving me from having to explicitly `memset` or otherwise initialize the memory myself. It's one less manual step, and frankly, I appreciate that. It reduces the potential for subtle bugs related to uninitialized data that might have lingering garbage values.

Secondly, the fact that it's `kzalloc` means it's part of the kernel's general-purpose memory allocation infrastructure. This implies a few things about its behavior. I'd expect it to be subject to the kernel's general memory management policies, including potential overhead for tracking allocations, fragmentation, and the like. While `kzalloc` is generally efficient and suitable for many kernel use cases, I'm also acutely aware that for very performance-critical or frequently called allocations, there might be more specialized or optimized allocators I'd consider. However, for a function named `pcpu_alloc_chunk`, suggesting a relatively coarse-grained allocation of per-CPU data, `kzalloc` feels like a perfectly reasonable and expected choice. It's a good default.

Beyond that, understanding that `kzalloc` is the underlying mechanism also means I'm thinking about error handling. `kzalloc` returns `NULL` on failure, so I'd naturally be expecting `pcpu_alloc_chunk` to handle that `NULL` return gracefully. If it's not returning `NULL` and instead panicking or behaving unexpectedly on allocation failure, that would be a significant concern I'd flag immediately.

Ultimately, my thought is: "Okay, `pcpu_alloc_chunk` is using `kzalloc`. This means zero-initialized memory and standard kernel allocation behavior. It's a solid, predictable choice, and I'll be paying attention to how it handles potential allocation failures and its place within the broader per-CPU data management strategy." It's a foundational piece of information that informs my subsequent analysis.

map[ContextFile:mm/percpu.c Name:pcpu_alloc_chunk]

map[SourceCode:1431:	static struct pcpu_chunk *pcpu_alloc_chunk(gfp_t gfp)
1432:	{
1433:		struct pcpu_chunk *chunk;
1434:		int region_bits;
1435:	
1436:		chunk = pcpu_mem_zalloc(pcpu_chunk_struct_size, gfp);
1437:		if (!chunk)
1438:			return NULL;
1439:	
1440:		INIT_LIST_HEAD(&chunk->list);
1441:		chunk->nr_pages = pcpu_unit_pages;
1442:		region_bits = pcpu_chunk_map_bits(chunk);
1443:	
1444:		chunk->alloc_map = pcpu_mem_zalloc(BITS_TO_LONGS(region_bits) *
1445:						   sizeof(chunk->alloc_map[0]), gfp);
1446:		if (!chunk->alloc_map)
1447:			goto alloc_map_fail;
1448:	
1449:		chunk->bound_map = pcpu_mem_zalloc(BITS_TO_LONGS(region_bits + 1) *
1450:						   sizeof(chunk->bound_map[0]), gfp);
1451:		if (!chunk->bound_map)
1452:			goto bound_map_fail;
1453:	
1454:		chunk->md_blocks = pcpu_mem_zalloc(pcpu_chunk_nr_blocks(chunk) *
1455:						   sizeof(chunk->md_blocks[0]), gfp);
1456:		if (!chunk->md_blocks)
1457:			goto md_blocks_fail;
1458:	
1459:	#ifdef NEED_PCPUOBJ_EXT
1460:		if (need_pcpuobj_ext()) {
1461:			chunk->obj_exts =
1462:				pcpu_mem_zalloc(pcpu_chunk_map_bits(chunk) *
1463:						sizeof(struct pcpuobj_ext), gfp);
1464:			if (!chunk->obj_exts)
1465:				goto objcg_fail;
1466:		}
1467:	#endif
1468:	
1469:		pcpu_init_md_blocks(chunk);
1470:	
1471:		/* init metadata */
1472:		chunk->free_bytes = chunk->nr_pages * PAGE_SIZE;
1473:	
1474:		return chunk;
1475:	
1476:	#ifdef NEED_PCPUOBJ_EXT
1477:	objcg_fail:
1478:		pcpu_mem_free(chunk->md_blocks);
1479:	#endif
1480:	md_blocks_fail:
1481:		pcpu_mem_free(chunk->bound_map);
1482:	bound_map_fail:
1483:		pcpu_mem_free(chunk->alloc_map);
1484:	alloc_map_fail:
1485:		pcpu_mem_free(chunk);
1486:	
1487:		return NULL;
1488:	}
 SourceFile:mm/percpu.c]

gemini-3.1-pro-preview

							input: 25109
							output: 1097
							thoughts: 3799
						

**My Thoughts on Reproducing the `nfsd` Kernel Bug**

I've been looking into this `nfsd` bug, and it boils down to a rather straightforward oversight in error handling. The core of the problem lies within the `__svc_create()` function. When a new NFS service is being set up, specifically when it's dealing with service pools, it initializes several percpu counters. The critical functions here are `percpu_counter_init()` for counters like `sp_sockets_queued`. My analysis shows that `__svc_create()` *completely ignores* the return value of `percpu_counter_init()`. This is a red flag. If `percpu_counter_init()` fails – and the most likely reason for failure in this context is a memory allocation issue – it leaves the internal `counters` pointer within the `percpu_counter` structure as `NULL`.

The bug then manifests later. When a transport is eventually enqueued for this service, the `svc_xprt_enqueue()` function is called. This function, in turn, calls `percpu_counter_inc(&pool->sp_sockets_queued)`. Because `sp_sockets_queued`'s internal pointer is `NULL` due to the unhandled `percpu_counter_init()` failure, attempting to increment it (which involves dereferencing that `NULL` pointer, even with the percpu offset) results in a page fault – a definite crash.

Now, regarding how to reliably reproduce this, my strategy centers on leveraging the kernel's fault injection mechanisms. The goal is to specifically cause `percpu_counter_init()` to fail, and crucially, to avoid failing earlier, more fundamental allocations.

Initially, I considered `pcpu_mem_zalloc`, which uses `kvzalloc` or `kzalloc`. If `failslab` is used with 100% probability, it would indeed fail `kzalloc_objs` within `__svc_create`. However, that would prevent the bug from even being reached, as `kzalloc_objs` failing returns `NULL` early, and the `percpu_counter_init` call is never even made. So, a 100% failure rate is counterproductive for *this specific* bug.

What we need is to target the `percpu_counter_init()` allocation specifically. The most practical approach is to simulate a memory allocation failure with a *low probability*. Syzkaller, as I understand it, achieves this by running the triggering sequence repeatedly with different fault injection sites or random probabilities. I can replicate this with a minimal C program.

The plan is to:
1.  **Configure Fault Injection**: I'll set the `failslab` probability to a low value, say 5% (`/sys/kernel/debug/failslab/probability`). I'll also enable the `task-filter` and use `/proc/self/make-it-fail` to ensure the fault applies to my process. This ensures that only some of the allocations will fail.
2.  **Trigger the Vulnerable Path**: The `nfsd` service creation is triggered by writing to `/proc/fs/nfsd/portlist`. This path eventually calls `__write_ports_addxprt()`, which in turn calls `nfsd_create_serv()`, ultimately leading to `__svc_create()` where the faulty `percpu_counter_init()` occurs.
3.  **Looping and Isolation**: To increase the chances of hitting the `percpu_counter_init()` allocation with a fault, and to ensure that we can retry if the initial service creation succeeds (meaning `nfsd_serv` is set and we don't want to hit it again directly), I'll employ a loop. Crucially, to reset the `nfsd` state and allow for repeated attempts at *creating* the service, I'll use `unshare(CLONE_NEWNET | CLONE_NEWNS)` to create a new network and mount namespace for each iteration. This ensures a clean slate where `nfsd_serv` will be `NULL` again, allowing the `nfsd_create_serv` path to be taken. Mounting `nfsd` in this new namespace will expose `/proc/fs/nfsd/portlist` for the trigger.

This refined strategy, using a low probability fault injection combined with looping and namespace isolation, should reliably reproduce the NULL pointer dereference by making `percpu_counter_init()` fail and then proceeding through the code path that dereferences its internal `NULL` pointer. The provided C program encapsulates this exact strategy.

log-in to see details

map[OracleFeedback:]

map[CurrentReproStrategy:### Root Cause Analysis

The crash is a classic NULL pointer dereference in percpu space, caused by a missing error check during initialization. 

When a new NFS service is created, `__svc_create()` initializes several percpu counters for the service pools:
```c
		percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL);
		percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL);
		percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL);
```
However, `percpu_counter_init()` can fail (e.g., due to memory allocation failure), in which case it returns an error code and leaves the internal `counters` pointer as `NULL`. Because `__svc_create()` ignores the return value, the kernel proceeds as if the initialization succeeded.

Later, when a transport is added, `svc_xprt_enqueue()` is called, which attempts to increment the counter:
```c
		percpu_counter_inc(&pool->sp_sockets_queued);
```
This attempts to dereference the `NULL` percpu pointer (offset by the CPU's `gs` base), resulting in the observed page fault at address `ffff88808c54a000`.

### Reproduction Strategy

To reproduce this bug reliably, we must simulate a memory allocation failure specifically during the `percpu_counter_init()` call. We can achieve this using the kernel's fault injection framework (`CONFIG_FAULT_INJECTION` and `CONFIG_FAILSLAB`).

1. **Enable Fault Injection**: Configure `failslab` to fail allocations for the current task.
2. **Trigger Service Creation**: Write a valid transport string (e.g., `"tcp 2049"`) to the `nfsd` `portlist` file. This invokes `__write_ports_addxprt()`, which calls `nfsd_create_serv()` -> `svc_create_pooled()` -> `__svc_create()`.
3. **Loop with Low Probability**: Because we want to fail the `percpu_counter_init()` allocation but allow preceding critical allocations (like `kzalloc_objs` for the pool itself) to succeed, we set a low failure probability (e.g., 5%) and run the trigger in a loop.
4. **Namespace Isolation**: To ensure `nfsd_create_serv()` attempts to create a new service on every iteration, we execute each attempt in a new network namespace (`CLONE_NEWNET`).

### Minimal Reproduction Program

```c
#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/wait.h>

void write_file(const char *path, const char *val) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        write(fd, val, strlen(val));
        close(fd);
    }
}

int main() {
    // 1. Setup fault injection for the current task
    write_file("/sys/kernel/debug/failslab/probability", "5"); // 5% probability
    write_file("/sys/kernel/debug/failslab/times", "-1");
    write_file("/sys/kernel/debug/failslab/task-filter", "Y");
    write_file("/proc/self/make-it-fail", "1");

    mkdir("/tmp/nfsd", 0777);

    // 2. Loop to hit the exact allocation race
    for (int i = 0; i < 1000; i++) {
        pid_t pid = fork();
        if (pid == 0) {
            // Isolate network and mount namespaces for a fresh nfsd state
            if (unshare(CLONE_NEWNET | CLONE_NEWNS) == 0) {
                if (mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL) == 0) {
                    
                    // Trigger __write_ports_addxprt -> nfsd_create_serv -> __svc_create
                    int fd = open("/tmp/nfsd/portlist", O_WRONLY);
                    if (fd >= 0) {
                        write(fd, "tcp 2049", 8);
                        close(fd);
                    }
                }
            }
            exit(0);
        }
        waitpid(pid, NULL, 0);
    }
    
    return 0;
}
```]

best-expensive

map[IsProbe:true RawCandidateReproC:#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <errno.h>

int main(void) {
    printf("[*] Starting capability probe...\n");

    if (unshare(CLONE_NEWNET | CLONE_NEWNS) != 0) {
        printf("[-] unshare failed: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] unshare successful.\n");

    if (mkdir("/tmp/nfsd_probe", 0777) != 0 && errno != EEXIST) {
        printf("[-] mkdir failed: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] mkdir successful.\n");

    if (mount("nfsd", "/tmp/nfsd_probe", "nfsd", 0, NULL) != 0) {
        printf("[-] Failed to mount nfsd: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] nfsd mounted successfully.\n");

    if (access("/tmp/nfsd_probe/portlist", W_OK) != 0) {
        printf("[-] Cannot access /tmp/nfsd_probe/portlist: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] portlist is accessible.\n");

    if (access("/sys/kernel/debug/failslab/probability", W_OK) != 0) {
        printf("[-] Cannot access /sys/kernel/debug/failslab/probability: %s\n", strerror(errno));
        if (mount("debugfs", "/sys/kernel/debug", "debugfs", 0, NULL) != 0) {
            printf("[-] Failed to mount debugfs: %s\n", strerror(errno));
        }
        if (access("/sys/kernel/debug/failslab/probability", W_OK) != 0) {
            printf("[-] failslab not available: %s\n", strerror(errno));
            exit(1);
        }
    }
    printf("[+] failslab is available.\n");

    printf("[+] All probes passed successfully.\n");
    return 0;
}
]

You are a security researcher with deep Linux kernel background.
Your goal is to generate a minimal, standalone C program for the strictly defensive
purpose of verifying a bugfix in an isolated environment.

To ensure that we can diagnose why a program might fail to run on the test environment,
you MUST include detailed logging and error checking in the generated C program:
1. Use 'printf(...)' for all progress messages and error logs.
2. Every system call (e.g., socket, bind, listen, connect, ioctl, send) must check for a failure return value.
3. If a call fails, it must print a specific error message including the function name
   and the error string (use strerror(errno)), and then exit with a non-zero status.
4. The program must print a message after every successful major step.
5. Generate code that follows this pattern for all operations:
    int res = do_something();
    if (res < 0) {
        printf("[-] Failed to do_something: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] do_something successful.\n");
6. The compilation and development environment (including compilers, build
   systems, makefiles, and kernel build/header directories) is NOT available
   on the target test VM guest. Do NOT check for, build, or reference any
   compilation tools, build files, or kernel development directories.
7. Do NOT execute shell commands or run external binaries (e.g. by using
   functions like 'system()', 'popen()', or the 'exec' family such as
   'execve()'). All environment checks, capability probings, and reproduction
   steps must be performed directly using standard Linux system calls (such
   as 'open', 'socket', 'ioctl', 'stat', etc.).
8. When reproducing asynchronous kernel timeouts or warnings, always
   include a sufficient delay (using sleep or similar) after deleting
   or unregistering the device to allow the kernel's asynchronous
   timeout to trigger before program exit.


=== PHASE 1: CAPABILITY PROBING (GENERATION) ===
You MUST start by generating a simple 'probe' program first. This is a strict, non-negotiable requirement
to verify that the test environment has the necessary kernel capabilities and privileges.
This program's sole purpose is to verify subsystem availability and privileges by probing specific
device files, subsystems, or syscalls (for example: opening /dev/vhci to check if the virtual
Bluetooth controller is accessible, loading a minimal dummy BPF program, or making a specific
socket/ioctl call).

Print clear messages indicating success or failure of these probes, and exit with 0 only if
all checks pass.
Do NOT attempt complex logic, and do NOT try to trigger the actual bug/crash in this first version,
regardless of how simple the reproducer seems. You must wait until a successful probe run has been
confirmed in the environment (i.e., when CapabilitiesVerified becomes true).

Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Bug Description: BUG: unable to handle kernel paging request in percpu_counter_add_batch

BUG: unable to handle page fault for address: ffff88808c54a000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 1acd5067 P4D 1acd5067 PUD 0 
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5311 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:percpu_counter_add_batch+0x50/0x1d0 lib/percpu_counter.c:98
Code: f6 48 b7 fc 48 89 5c 24 10 48 83 c3 58 49 89 de 49 c1 ee 03 43 80 3c 3e 00 74 08 48 89 df e8 07 7d 26 fd 48 89 1c 24 48 8b 03 <65> 8b 28 41 89 ef 41 c1 ff 1f 49 c1 e7 20 4c 89 6c 24 08 4d 01 ef
RSP: 0018:ffffc9000dc47810 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888036dc4930 RCX: ffff888012f0ca80
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888036dc48d8
RBP: ffffc9000dc47908 R08: ffff888012c3e03f R09: 1ffff11002587c07
R10: dffffc0000000000 R11: ffffed1002587c08 R12: 0000000000000020
R13: 0000000000000001 R14: 1ffff11006db8926 R15: dffffc0000000000
FS:  00007f711d27e6c0(0000) GS:ffff88808c54a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88808c54a000 CR3: 000000001fde5000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 percpu_counter_add include/linux/percpu_counter.h:71 [inline]
 percpu_counter_inc include/linux/percpu_counter.h:267 [inline]
 svc_xprt_enqueue+0x2ee/0x8b0 net/sunrpc/svc_xprt.c:524
 svc_xprt_received+0x10f/0x150 net/sunrpc/svc_xprt.c:248
 svc_add_new_perm_xprt net/sunrpc/svc_xprt.c:260 [inline]
 _svc_xprt_create+0x3d8/0x600 net/sunrpc/svc_xprt.c:290
 svc_xprt_create_from_sa net/sunrpc/svc_xprt.c:332 [inline]
 svc_xprt_create+0x1aa/0x280 net/sunrpc/svc_xprt.c:387
 __write_ports_addxprt fs/nfsd/nfsctl.c:774 [inline]
 __write_ports fs/nfsd/nfsctl.c:808 [inline]
 write_ports+0x71a/0xd10 fs/nfsd/nfsctl.c:861
 nfsctl_transaction_write+0x10f/0x160 fs/nfsd/nfsctl.c:112
 vfs_write+0x296/0xba0 fs/read_write.c:685
 ksys_write+0x150/0x270 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f711c39e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f711d27dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f711c625fa0 RCX: 00007f711c39e0d9
RDX: 0000000000000005 RSI: 0000200000000300 RDI: 0000000000000004
RBP: 00007f711c435024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f711c626038 R14: 00007f711c625fa0 R15: 00007ffc740e4ce8
 </TASK>
Modules linked in:
CR2: ffff88808c54a000
---[ end trace 0000000000000000 ]---
RIP: 0010:percpu_counter_add_batch+0x50/0x1d0 lib/percpu_counter.c:98
Code: f6 48 b7 fc 48 89 5c 24 10 48 83 c3 58 49 89 de 49 c1 ee 03 43 80 3c 3e 00 74 08 48 89 df e8 07 7d 26 fd 48 89 1c 24 48 8b 03 <65> 8b 28 41 89 ef 41 c1 ff 1f 49 c1 e7 20 4c 89 6c 24 08 4d 01 ef
RSP: 0018:ffffc9000dc47810 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888036dc4930 RCX: ffff888012f0ca80
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888036dc48d8
RBP: ffffc9000dc47908 R08: ffff888012c3e03f R09: 1ffff11002587c07
R10: dffffc0000000000 R11: ffffed1002587c08 R12: 0000000000000020
R13: 0000000000000001 R14: 1ffff11006db8926 R15: dffffc0000000000
FS:  00007f711d27e6c0(0000) GS:ffff88808c54a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88808c54a000 CR3: 000000001fde5000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	f6 48 b7 fc          	testb  $0xfc,-0x49(%rax)
   4:	48 89 5c 24 10       	mov    %rbx,0x10(%rsp)
   9:	48 83 c3 58          	add    $0x58,%rbx
   d:	49 89 de             	mov    %rbx,%r14
  10:	49 c1 ee 03          	shr    $0x3,%r14
  14:	43 80 3c 3e 00       	cmpb   $0x0,(%r14,%r15,1)
  19:	74 08                	je     0x23
  1b:	48 89 df             	mov    %rbx,%rdi
  1e:	e8 07 7d 26 fd       	call   0xfd267d2a
  23:	48 89 1c 24          	mov    %rbx,(%rsp)
  27:	48 8b 03             	mov    (%rbx),%rax
* 2a:	65 8b 28             	mov    %gs:(%rax),%ebp <-- trapping instruction
  2d:	41 89 ef             	mov    %ebp,%r15d
  30:	41 c1 ff 1f          	sar    $0x1f,%r15d
  34:	49 c1 e7 20          	shl    $0x20,%r15
  38:	4c 89 6c 24 08       	mov    %r13,0x8(%rsp)
  3d:	4d 01 ef             	add    %r13,%r15

Strategy: ### Root Cause Analysis

The crash is a classic NULL pointer dereference in percpu space, caused by a missing error check during initialization. 

When a new NFS service is created, `__svc_create()` initializes several percpu counters for the service pools:
```c
		percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL);
		percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL);
		percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL);
```
However, `percpu_counter_init()` can fail (e.g., due to memory allocation failure), in which case it returns an error code and leaves the internal `counters` pointer as `NULL`. Because `__svc_create()` ignores the return value, the kernel proceeds as if the initialization succeeded.

Later, when a transport is added, `svc_xprt_enqueue()` is called, which attempts to increment the counter:
```c
		percpu_counter_inc(&pool->sp_sockets_queued);
```
This attempts to dereference the `NULL` percpu pointer (offset by the CPU's `gs` base), resulting in the observed page fault at address `ffff88808c54a000`.

### Reproduction Strategy

To reproduce this bug reliably, we must simulate a memory allocation failure specifically during the `percpu_counter_init()` call. We can achieve this using the kernel's fault injection framework (`CONFIG_FAULT_INJECTION` and `CONFIG_FAILSLAB`).

1. **Enable Fault Injection**: Configure `failslab` to fail allocations for the current task.
2. **Trigger Service Creation**: Write a valid transport string (e.g., `"tcp 2049"`) to the `nfsd` `portlist` file. This invokes `__write_ports_addxprt()`, which calls `nfsd_create_serv()` -> `svc_create_pooled()` -> `__svc_create()`.
3. **Loop with Low Probability**: Because we want to fail the `percpu_counter_init()` allocation but allow preceding critical allocations (like `kzalloc_objs` for the pool itself) to succeed, we set a low failure probability (e.g., 5%) and run the trigger in a loop.
4. **Namespace Isolation**: To ensure `nfsd_create_serv()` attempts to create a new service on every iteration, we execute each attempt in a new network namespace (`CLONE_NEWNET`).

### Minimal Reproduction Program

```c
#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/wait.h>

void write_file(const char *path, const char *val) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        write(fd, val, strlen(val));
        close(fd);
    }
}

int main() {
    // 1. Setup fault injection for the current task
    write_file("/sys/kernel/debug/failslab/probability", "5"); // 5% probability
    write_file("/sys/kernel/debug/failslab/times", "-1");
    write_file("/sys/kernel/debug/failslab/task-filter", "Y");
    write_file("/proc/self/make-it-fail", "1");

    mkdir("/tmp/nfsd", 0777);

    // 2. Loop to hit the exact allocation race
    for (int i = 0; i < 1000; i++) {
        pid_t pid = fork();
        if (pid == 0) {
            // Isolate network and mount namespaces for a fresh nfsd state
            if (unshare(CLONE_NEWNET | CLONE_NEWNS) == 0) {
                if (mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL) == 0) {
                    
                    // Trigger __write_ports_addxprt -> nfsd_create_serv -> __svc_create
                    int fd = open("/tmp/nfsd/portlist", O_WRONLY);
                    if (fd >= 0) {
                        write(fd, "tcp 2049", 8);
                        close(fd);
                    }
                }
            }
            exit(0);
        }
        waitpid(pid, NULL, 0);
    }
    
    return 0;
}
```

gemini-3.1-pro-preview

							input: 7187
							output: 602
							thoughts: 1790
						

**My Thought Process for Creating the Capability Probe**

My primary goal here is to craft a minimal C program that acts as a probe. This probe isn't meant to trigger the actual bug (a NULL pointer dereference in `percpu_counter_add_batch` resulting from a missed error check in `percpu_counter_init` during `__svc_create`). Instead, its sole purpose is to verify the availability of certain subsystems and confirm that I have the necessary privileges to proceed with the next steps, which will eventually involve fault injection using `failslab`. The user's strategy hinges on `failslab`, so checking for its presence and writability is paramount.

I need to ensure this probe program is straightforward, provides clear output, and exits cleanly (with code 0) if all checks pass. It should avoid any complex logic or attempts to reproduce the bug itself.

The essential subsystems and operations I need to verify are:

1.  **Namespace Creation:** The ability to use `unshare` with specific flags (`CLONE_NEWNET | CLONE_NEWNS`) is crucial, as this often implies necessary privileges and a functional kernel configuration.
2.  **`nfsd` Filesystem Mounting:** I need to be able to mount the `nfsd` filesystem. This typically requires certain kernel modules to be loaded and the user to have adequate permissions.
3.  **`failslab` Availability:** The core of the fault injection strategy relies on `failslab`. I need to confirm that the `failslab` debugfs entry (`/sys/kernel/debug/failslab/probability`) exists and is writable. This is a strong indicator of whether the testing environment is set up for fault injection.

So, my probe program needs to execute a sequence of checks:

*   **Root/Capability Check:** Although not explicitly coded as `geteuid() == 0`, the subsequent operations like writing to debugfs and mounting `nfsd` will implicitly fail if I lack the necessary privileges or capabilities.
*   **`failslab` Accessibility:** First, I'll try to access `/sys/kernel/debug/failslab/probability` for writability. If this fails, I'll attempt to mount `debugfs` just in case it's not already mounted (though it usually is in environments where `failslab` would be expected). If, after attempting to mount `debugfs`, I still can't access `failslab`, I'll report that `failslab` is unavailable and exit with an error.
*   **`unshare` Operation:** I'll attempt `unshare(CLONE_NEWNET | CLONE_NEWNS)`. If this fails, it indicates a potential privilege issue or an environment that restricts namespace operations.
*   **`nfsd` Mount Preparation:** To test mounting `nfsd`, I'll need a mount point. I'll create a temporary directory, `/tmp/nfsd_probe`, ensuring it exists (handling the `EEXIST` error if it's already there).
*   **`nfsd` Mounting:** I'll attempt to mount `nfsd` onto the created directory.
*   **`portlist` Writable Check:** After mounting `nfsd`, I'll verify that the `portlist` file within the mount point is writable. This is a common sanity check for a successfully mounted `nfsd`.

For the C code implementation, I'll include the necessary headers like `<sched.h>` for `unshare`, `<sys/mount.h>` for `mount`, `<unistd.h>` for `access`, and standard I/O headers. I'll use `printf` to output status messages and `exit(1)` on any failure, with clear error messages using `strerror(errno)`.

I considered alternatives like using memory cgroups or simply allocating a lot of memory if `failslab` wasn't available, but since the user's strategy explicitly relies on `failslab`, the priority is to probe for *that specific mechanism* first. If `failslab` isn't present, that's valuable information for the next steps, and we'll need to re-evaluate the fault injection strategy.

Therefore, the refined probe program will systematically check these dependencies, ensuring that before I attempt to inject faults, the environment is demonstrably ready and that I possess the required permissions. This methodical approach minimizes surprises and builds confidence in the subsequent test execution.

map[IsProbe:true RawCandidateReproC:#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <errno.h>

int main(void) {
    printf("[*] Starting capability probe...\n");

    if (unshare(CLONE_NEWNET | CLONE_NEWNS) != 0) {
        printf("[-] unshare failed: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] unshare successful.\n");

    if (mkdir("/tmp/nfsd_probe", 0777) != 0 && errno != EEXIST) {
        printf("[-] mkdir failed: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] mkdir successful.\n");

    if (mount("nfsd", "/tmp/nfsd_probe", "nfsd", 0, NULL) != 0) {
        printf("[-] Failed to mount nfsd: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] nfsd mounted successfully.\n");

    if (access("/tmp/nfsd_probe/portlist", W_OK) != 0) {
        printf("[-] Cannot access /tmp/nfsd_probe/portlist: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] portlist is accessible.\n");

    if (access("/sys/kernel/debug/failslab/probability", W_OK) != 0) {
        printf("[-] Cannot access /sys/kernel/debug/failslab/probability: %s\n", strerror(errno));
        if (mount("debugfs", "/sys/kernel/debug", "debugfs", 0, NULL) != 0) {
            printf("[-] Failed to mount debugfs: %s\n", strerror(errno));
        }
        if (access("/sys/kernel/debug/failslab/probability", W_OK) != 0) {
            printf("[-] failslab not available: %s\n", strerror(errno));
            exit(1);
        }
    }
    printf("[+] failslab is available.\n");

    printf("[+] All probes passed successfully.\n");
    return 0;
}
]

map[IsProbe:true RawCandidateReproC:#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <errno.h>

int main(void) {
    printf("[*] Starting capability probe...\n");

    if (unshare(CLONE_NEWNET | CLONE_NEWNS) != 0) {
        printf("[-] unshare failed: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] unshare successful.\n");

    if (mkdir("/tmp/nfsd_probe", 0777) != 0 && errno != EEXIST) {
        printf("[-] mkdir failed: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] mkdir successful.\n");

    if (mount("nfsd", "/tmp/nfsd_probe", "nfsd", 0, NULL) != 0) {
        printf("[-] Failed to mount nfsd: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] nfsd mounted successfully.\n");

    if (access("/tmp/nfsd_probe/portlist", W_OK) != 0) {
        printf("[-] Cannot access /tmp/nfsd_probe/portlist: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] portlist is accessible.\n");

    if (access("/sys/kernel/debug/failslab/probability", W_OK) != 0) {
        printf("[-] Cannot access /sys/kernel/debug/failslab/probability: %s\n", strerror(errno));
        if (mount("debugfs", "/sys/kernel/debug", "debugfs", 0, NULL) != 0) {
            printf("[-] Failed to mount debugfs: %s\n", strerror(errno));
        }
        if (access("/sys/kernel/debug/failslab/probability", W_OK) != 0) {
            printf("[-] failslab not available: %s\n", strerror(errno));
            exit(1);
        }
    }
    printf("[+] failslab is available.\n");

    printf("[+] All probes passed successfully.\n");
    return 0;
}
]

map[CurrentCandidateReproC:#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <errno.h>

int main(void) {
    printf("[*] Starting capability probe...\n");

    if (unshare(CLONE_NEWNET | CLONE_NEWNS) != 0) {
        printf("[-] unshare failed: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] unshare successful.\n");

    if (mkdir("/tmp/nfsd_probe", 0777) != 0 && errno != EEXIST) {
        printf("[-] mkdir failed: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] mkdir successful.\n");

    if (mount("nfsd", "/tmp/nfsd_probe", "nfsd", 0, NULL) != 0) {
        printf("[-] Failed to mount nfsd: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] nfsd mounted successfully.\n");

    if (access("/tmp/nfsd_probe/portlist", W_OK) != 0) {
        printf("[-] Cannot access /tmp/nfsd_probe/portlist: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] portlist is accessible.\n");

    if (access("/sys/kernel/debug/failslab/probability", W_OK) != 0) {
        printf("[-] Cannot access /sys/kernel/debug/failslab/probability: %s\n", strerror(errno));
        if (mount("debugfs", "/sys/kernel/debug", "debugfs", 0, NULL) != 0) {
            printf("[-] Failed to mount debugfs: %s\n", strerror(errno));
        }
        if (access("/sys/kernel/debug/failslab/probability", W_OK) != 0) {
            printf("[-] failslab not available: %s\n", strerror(errno));
            exit(1);
        }
    }
    printf("[+] failslab is available.\n");

    printf("[+] All probes passed successfully.\n");
    return 0;
}
]

map[CompilerError: FormattedReproC:#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <errno.h>

int main(void) {
    printf("[*] Starting capability probe...\n");

    if (unshare(CLONE_NEWNET | CLONE_NEWNS) != 0) {
        printf("[-] unshare failed: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] unshare successful.\n");

    if (mkdir("/tmp/nfsd_probe", 0777) != 0 && errno != EEXIST) {
        printf("[-] mkdir failed: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] mkdir successful.\n");

    if (mount("nfsd", "/tmp/nfsd_probe", "nfsd", 0, NULL) != 0) {
        printf("[-] Failed to mount nfsd: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] nfsd mounted successfully.\n");

    if (access("/tmp/nfsd_probe/portlist", W_OK) != 0) {
        printf("[-] Cannot access /tmp/nfsd_probe/portlist: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] portlist is accessible.\n");

    if (access("/sys/kernel/debug/failslab/probability", W_OK) != 0) {
        printf("[-] Cannot access /sys/kernel/debug/failslab/probability: %s\n", strerror(errno));
        if (mount("debugfs", "/sys/kernel/debug", "debugfs", 0, NULL) != 0) {
            printf("[-] Failed to mount debugfs: %s\n", strerror(errno));
        }
        if (access("/sys/kernel/debug/failslab/probability", W_OK) != 0) {
            printf("[-] failslab not available: %s\n", strerror(errno));
            exit(1);
        }
    }
    printf("[+] failslab is available.\n");

    printf("[+] All probes passed successfully.\n");
    return 0;
}
]

map[CompilerError:]

map[CandidateBugTitle: CandidateCrashReport: CandidateReproduced:false ConsoleOutput:[   68.915724][   T33] kauditd_printk_skb: 10 callbacks suppressed
[   68.915738][   T33] audit: type=1400 audit(1786543946.891:201): avc:  denied  { transition } for  pid=5824 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   68.931243][   T33] audit: type=1400 audit(1786543946.891:202): avc:  denied  { noatsecure } for  pid=5824 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   68.939243][   T33] audit: type=1400 audit(1786543946.891:203): avc:  denied  { rlimitinh } for  pid=5824 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   68.946638][   T33] audit: type=1400 audit(1786543946.891:204): avc:  denied  { siginh } for  pid=5824 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   71.645128][   T33] audit: type=1400 audit(1786543949.621:205): avc:  denied  { write } for  pid=5837 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
Warning: Permanently added '[localhost]:28988' (ED25519) to the list of known hosts.
[   71.686328][   T33] audit: type=1400 audit(1786543949.661:206): avc:  denied  { write } for  pid=5841 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   71.827871][   T33] audit: type=1400 audit(1786543949.801:207): avc:  denied  { mount } for  pid=5845 comm="syz-executor132" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1
[*] Starting capability probe...
[+] unshare successful.
[+] mkdir successful.
[+] nfsd mounted successfully.
[+] portlist is accessible.
[+] failslab is available.
[+] All probes passed successfully.
[   71.838211][   T33] audit: type=1400 audit(1786543949.811:208): avc:  denied  { search } for  pid=5845 comm="syz-executor132" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=dir permissive=1
[   71.846829][   T33] audit: type=1400 audit(1786543949.811:209): avc:  denied  { write } for  pid=5845 comm="syz-executor132" name="portlist" dev="nfsd" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=file permissive=1
[   72.010461][ T1376] ieee802154 phy0 wpan0: encryption failed: -22
[   72.013012][ T1376] ieee802154 phy1 wpan1: encryption failed: -22
[   72.206025][   T33] audit: type=1400 audit(1786543950.181:210): avc:  denied  { write } for  pid=5848 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   74.111850][   T33] kauditd_printk_skb: 7 callbacks suppressed
[   74.111860][   T33] audit: type=1400 audit(1786543952.091:218): avc:  denied  { write } for  pid=5872 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   74.152513][   T33] audit: type=1400 audit(1786543952.131:219): avc:  denied  { write } for  pid=5875 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   74.693454][   T33] audit: type=1400 audit(1786543952.671:220): avc:  denied  { write } for  pid=5878 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   74.730826][   T33] audit: type=1400 audit(1786543952.711:221): avc:  denied  { write } for  pid=5881 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   75.051334][   T33] audit: type=1400 audit(1786543953.031:222): avc:  denied  { write } for  pid=5884 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   75.090905][   T33] audit: type=1400 audit(1786543953.071:223): avc:  denied  { write } for  pid=5887 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
 OtherCrashReports:<nil> StraceOutput:/strace -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f /syz-executor3604259883

<...>
[   76.575480][   T33] kauditd_printk_skb: 6 callbacks suppressed
[   76.575495][   T33] audit: type=1400 audit(1786544042.296:200): avc:  denied  { transition } for  pid=5827 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   76.599156][   T33] audit: type=1400 audit(1786544042.316:201): avc:  denied  { noatsecure } for  pid=5827 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   76.609282][   T33] audit: type=1400 audit(1786544042.316:202): avc:  denied  { rlimitinh } for  pid=5827 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   76.621710][   T33] audit: type=1400 audit(1786544042.316:203): avc:  denied  { siginh } for  pid=5827 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   78.972097][   T33] audit: type=1400 audit(1786544044.696:204): avc:  denied  { write } for  pid=5833 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   79.048621][   T33] audit: type=1400 audit(1786544044.766:205): avc:  denied  { write } for  pid=5838 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   80.250229][   T33] audit: type=1400 audit(1786544045.976:206): avc:  denied  { write } for  pid=5845 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   80.336083][   T33] audit: type=1400 audit(1786544046.056:207): avc:  denied  { write } for  pid=5848 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   80.473110][   T33] audit: type=1400 audit(1786544046.196:208): avc:  denied  { write } for  pid=5851 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   80.555515][   T33] audit: type=1400 audit(1786544046.276:209): avc:  denied  { write } for  pid=5854 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   81.587181][   T33] kauditd_printk_skb: 3 callbacks suppressed
[   81.587197][   T33] audit: type=1400 audit(1786544047.306:213): avc:  denied  { write } for  pid=5866 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   81.734544][   T33] audit: type=1400 audit(1786544047.456:214): avc:  denied  { write } for  pid=5869 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   81.826693][   T33] audit: type=1400 audit(1786544047.546:215): avc:  denied  { write } for  pid=5872 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   81.941494][   T32] cfg80211: failed to load regulatory.db
[   81.983604][   T33] audit: type=1400 audit(1786544047.706:216): avc:  denied  { write } for  pid=5875 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   82.078252][   T33] audit: type=1400 audit(1786544047.796:217): avc:  denied  { write } for  pid=5879 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   82.981291][   T33] audit: type=1400 audit(1786544048.706:218): avc:  denied  { write } for  pid=5882 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   83.075239][   T33] audit: type=1400 audit(1786544048.796:219): avc:  denied  { write } for  pid=5885 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
Warning: Permanently added '[localhost]:60908' (ED25519) to the list of known hosts.
execve("/syz-executor3604259883", ["/syz-executor3604259883"], 0x7ffd083202c0 /* 11 vars */) = 0
brk(NULL)                               = 0x55556bbd3000
brk(0x55556bbd3d80)                     = 0x55556bbd3d80
arch_prctl(ARCH_SET_FS, 0x55556bbd3400) = 0
set_tid_address(0x55556bbd36d0)         = 5897
set_robust_list(0x55556bbd36e0, 24)     = 0
rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlinkat(AT_FDCWD, "/proc/self/exe", "/syz-executor3604259883", 4096) = 23
getrandom("\x79\x88\xa8\xd5\x54\x1c\x72\x7e", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x55556bbd3d80
brk(0x55556bbf4d80)                     = 0x55556bbf4d80
brk(0x55556bbf5000)                     = 0x55556bbf5000
mprotect(0x7f68bd526000, 20480, PROT_READ) = 0
fstat(1, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
unshare(CLONE_NEWNS|CLONE_NEWNET)       = 0
mkdir("/tmp/nfsd_probe", 0777)          = 0
mount("nfsd", "/tmp/nfsd_probe", "nfsd", 0, NULL) = 0
[   84.291171][   T33] audit: type=1400 audit(1786544050.016:220): avc:  denied  { mount } for  pid=5897 comm="syz-executor360" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1
access("/tmp/nfsd_probe/portlist", W_OK) = 0
[   84.304970][   T33] audit: type=1400 audit(1786544050.026:221): avc:  denied  { search } for  pid=5897 comm="syz-executor360" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=dir permissive=1
[   84.320897][   T33] audit: type=1400 audit(1786544050.026:222): avc:  denied  { write } for  pid=5897 comm="syz-executor360" name="portlist" dev="nfsd" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=file permissive=1
access("/sys/kernel/debug/failslab/probability", W_OK) = 0
[*] Starting capability probe...
[+] unshare successful.
[+] mkdir successful.
[+] nfsd mounted successfully.
[+] portlist is accessible.
[+] failslab is available.
[+] All probes passed successfully.
write(1, "[*] Starting capability probe...\n[+] unshare successful.\n[+] mkdir successful.\n[+] nfsd mounted succ"..., 201) = 201
exit_group(0)                           = ?
+++ exited with 0 +++
 TestError:]

map[TruncatedConsoleOutput:[   68.915724][   T33] kauditd_printk_skb: 10 callbacks suppressed
[   68.915738][   T33] audit: type=1400 audit(1786543946.891:201): avc:  denied  { transition } for  pid=5824 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   68.931243][   T33] audit: type=1400 audit(1786543946.891:202): avc:  denied  { noatsecure } for  pid=5824 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   68.939243][   T33] audit: type=1400 audit(1786543946.891:203): avc:  denied  { rlimitinh } for  pid=5824 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   68.946638][   T33] audit: type=1400 audit(1786543946.891:204): avc:  denied  { siginh } for  pid=5824 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   71.645128][   T33] audit: type=1400 audit(1786543949.621:205): avc:  denied  { write } for  pid=5837 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
Warning: Permanently added '[localhost]:28988' (ED25519) to the list of known hosts.
[   71.686328][   T33] audit: type=1400 audit(1786543949.661:206): avc:  denied  { write } for  pid=5841 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   71.827871][   T33] audit: type=1400 audit(1786543949.801:207): avc:  denied  { mount } for  pid=5845 comm="syz-executor132" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1
[*] Starting capability probe...
[+] unshare successful.
[+] mkdir successful.
[+] nfsd mounted successfully.
[+] portlist is accessible.
[+] failslab is available.
[+] All probes passed successfully.
[   71.838211][   T33] audit: type=1400 audit(1786543949.811:208): avc:  denied  { search } for  pid=5845 comm="syz-executor132" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=dir permissive=1
[   71.846829][   T33] audit: type=1400 audit(1786543949.811:209): avc:  denied  { write } for  pid=5845 comm="syz-executor132" name="portlist" dev="nfsd" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=file permissive=1
[   72.010461][ T1376] ieee802154 phy0 wpan0: encryption failed: -22
[   72.013012][ T1376] ieee802154 phy1 wpan1: encryption failed: -22
[   72.206025][   T33] audit: type=1400 audit(1786543950.181:210): avc:  denied  { write } for  pid=5848 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   74.111850][   T33] kauditd_printk_skb: 7 callbacks suppressed
[   74.111860][   T33] audit: type=1400 audit(1786543952.091:218): avc:  denied  { write } for  pid=5872 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   74.152513][   T33] audit: type=1400 audit(1786543952.131:219): avc:  denied  { write } for  pid=5875 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   74.693454][   T33] audit: type=1400 audit(1786543952.671:220): avc:  denied  { write } for  pid=5878 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   74.730826][   T33] audit: type=1400 audit(1786543952.711:221): avc:  denied  { write } for  pid=5881 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   75.051334][   T33] audit: type=1400 audit(1786543953.031:222): avc:  denied  { write } for  pid=5884 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   75.090905][   T33] audit: type=1400 audit(1786543953.071:223): avc:  denied  { write } for  pid=5887 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
 TruncatedCrashReport: TruncatedStraceOutput:/strace -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f /syz-executor3604259883

<...>
[   76.575480][   T33] kauditd_printk_skb: 6 callbacks suppressed
[   76.575495][   T33] audit: type=1400 audit(1786544042.296:200): avc:  denied  { transition } for  pid=5827 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   76.599156][   T33] audit: type=1400 audit(1786544042.316:201): avc:  denied  { noatsecure } for  pid=5827 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   76.609282][   T33] audit: type=1400 audit(1786544042.316:202): avc:  denied  { rlimitinh } for  pid=5827 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   76.621710][   T33] audit: type=1400 audit(1786544042.316:203): avc:  denied  { siginh } for  pid=5827 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   78.972097][   T33] audit: type=1400 audit(1786544044.696:204): avc:  denied  { write } for  pid=5833 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   79.048621][   T33] audit: type=1400 audit(1786544044.766:205): avc:  denied  { write } for  pid=5838 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   80.250229][   T33] audit: type=1400 audit(1786544045.976:206): avc:  denied  { write } for  pid=5845 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   80.336083][   T33] audit: type=1400 audit(1786544046.056:207): avc:  denied  { write } for  pid=5848 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   80.473110][   T33] audit: type=1400 audit(1786544046.196:208): avc:  denied  { write } for  pid=5851 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   80.555515][   T33] audit: type=1400 audit(1786544046.276:209): avc:  denied  { write } for  pid=5854 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   81.587181][   T33] kauditd_printk_skb: 3 callbacks suppressed
[   81.587197][   T33] audit: type=1400 audit(1786544047.306:213): avc:  denied  { write } for  pid=5866 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   81.734544][   T33] audit: type=1400 audit(1786544047.456:214): avc:  denied  { write } for  pid=5869 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   81.826693][   T33] audit: type=1400 audit(1786544047.546:215): avc:  denied  { write } for  pid=5872 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   81.941494][   T32] cfg80211: failed to load regulatory.db
[   81.983604][   T33] audit: type=1400 audit(1786544047.706:216): avc:  denied  { write } for  pid=5875 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   82.078252][   T33] audit: type=1400 audit(1786544047.796:217): avc:  denied  { write } for  pid=5879 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   82.981291][   T33] audit: type=1400 audit(1786544048.706:218): avc:  denied  { write } for  pid=5882 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   83.075239][   T33] audit: type=1400 audit(1786544048.796:219): avc:  denied  { write } for  pid=5885 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
Warning: Permanently added '[localhost]:60908' (ED25519) to the list of known hosts.
execve("/syz-executor3604259883", ["/syz-executor3604259883"], 0x7ffd083202c0 /* 11 vars */) = 0
brk(NULL)                               = 0x55556bbd3000
brk(0x55556bbd3d80)                     = 0x55556bbd3d80
arch_prctl(ARCH_SET_FS, 0x55556bbd3400) = 0
set_tid_address(0x55556bbd36d0)         = 5897
set_robust_list(0x55556bbd36e0, 24)     = 0
rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlinkat(AT_FDCWD, "/proc/self/exe", "/syz-executor3604259883", 4096) = 23
getrandom("\x79\x88\xa8\xd5\x54\x1c\x72\x7e", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x55556bbd3d80
brk(0x55556bbf4d80)                     = 0x55556bbf4d80
brk(0x55556bbf5000)                     = 0x55556bbf5000
mprotect(0x7f68bd526000, 20480, PROT_READ) = 0
fstat(1, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
unshare(CLONE_NEWNS|CLONE_NEWNET)       = 0
mkdir("/tmp/nfsd_probe", 0777)          = 0
mount("nfsd", "/tmp/nfsd_probe", "nfsd", 0, NULL) = 0
[   84.291171][   T33] audit: type=1400 audit(1786544050.016:220): avc:  denied  { mount } for  pid=5897 comm="syz-executor360" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1
access("/tmp/nfsd_probe/portlist", W_OK) = 0
[   84.304970][   T33] audit: type=1400 audit(1786544050.026:221): avc:  denied  { search } for  pid=5897 comm="syz-executor360" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=dir permissive=1
[   84.320897][   T33] audit: type=1400 audit(1786544050.026:222): avc:  denied  { write } for  pid=5897 comm="syz-executor360" name="portlist" dev="nfsd" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=file permissive=1
access("/sys/kernel/debug/failslab/probability", W_OK) = 0
[*] Starting capability probe...
[+] unshare successful.
[+] mkdir successful.
[+] nfsd mounted successfully.
[+] portlist is accessible.
[+] failslab is available.
[+] All probes passed successfully.
write(1, "[*] Starting capability probe...\n[+] unshare successful.\n[+] mkdir successful.\n[+] nfsd mounted succ"..., 201) = 201
exit_group(0)                           = ?
+++ exited with 0 +++
]

best-expensive

map[Feedback:The capability probe passed successfully. The environment is ready, unshare, nfsd mount, and portlist access are all working. You can now proceed to generate the full reproducer. ProbePassed:true TerminalError: TitleMatches:false]

You are a security researcher with deep Linux kernel background.
Analyze the results of running the generated program.

=== CRITICAL ENVIRONMENT & TARGET CLASSIFICATION ===
Set 'TerminalError' to a descriptive error message ONLY if:
1. The execution failed due to missing hardware device nodes, subsystems, kernel modules, or privilege limits
   that cannot be loaded, created, or bypassed by user-space C code edits in the VM guest.
2. The target source files or functions described in the bug description do not exist in the checked-out codebase,
   meaning the codebase version is mismatched and the target code is absent.

=== CRITICAL PROHIBITIONS ===
- Do NOT classify a run as a terminal failure or assume a bug is fixed based on git log entries, commit titles,
  or commit messages. Reproducibility can ONLY be determined by executing reproducer candidates in the VM.
- Do NOT suggest C code strategies, repairs, or namespace bypasses when setting 'TerminalError'.


=== PHASE 1: CAPABILITY PROBING (EVALUATION) ===
The executed program was a simple environment probe.
Use this to guide your classification and feedback:
1. If the execution was successful (all environment/subsystem probes passed and program exited with 0),
   set the field 'ProbePassed' to true and provide feedback explicitly indicating that the environment
   is ready and the agent should now proceed to generate the full reproducer in the next iteration.
2. If the probe failed (e.g., missing permissions, missing devices, or sandbox restrictions),
   set the field 'ProbePassed' to false, and explain what failed in the 'Feedback'
   field so the generator can adjust its setups.

Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Bug Description: BUG: unable to handle kernel paging request in percpu_counter_add_batch

BUG: unable to handle page fault for address: ffff88808c54a000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 1acd5067 P4D 1acd5067 PUD 0 
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5311 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:percpu_counter_add_batch+0x50/0x1d0 lib/percpu_counter.c:98
Code: f6 48 b7 fc 48 89 5c 24 10 48 83 c3 58 49 89 de 49 c1 ee 03 43 80 3c 3e 00 74 08 48 89 df e8 07 7d 26 fd 48 89 1c 24 48 8b 03 <65> 8b 28 41 89 ef 41 c1 ff 1f 49 c1 e7 20 4c 89 6c 24 08 4d 01 ef
RSP: 0018:ffffc9000dc47810 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888036dc4930 RCX: ffff888012f0ca80
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888036dc48d8
RBP: ffffc9000dc47908 R08: ffff888012c3e03f R09: 1ffff11002587c07
R10: dffffc0000000000 R11: ffffed1002587c08 R12: 0000000000000020
R13: 0000000000000001 R14: 1ffff11006db8926 R15: dffffc0000000000
FS:  00007f711d27e6c0(0000) GS:ffff88808c54a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88808c54a000 CR3: 000000001fde5000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 percpu_counter_add include/linux/percpu_counter.h:71 [inline]
 percpu_counter_inc include/linux/percpu_counter.h:267 [inline]
 svc_xprt_enqueue+0x2ee/0x8b0 net/sunrpc/svc_xprt.c:524
 svc_xprt_received+0x10f/0x150 net/sunrpc/svc_xprt.c:248
 svc_add_new_perm_xprt net/sunrpc/svc_xprt.c:260 [inline]
 _svc_xprt_create+0x3d8/0x600 net/sunrpc/svc_xprt.c:290
 svc_xprt_create_from_sa net/sunrpc/svc_xprt.c:332 [inline]
 svc_xprt_create+0x1aa/0x280 net/sunrpc/svc_xprt.c:387
 __write_ports_addxprt fs/nfsd/nfsctl.c:774 [inline]
 __write_ports fs/nfsd/nfsctl.c:808 [inline]
 write_ports+0x71a/0xd10 fs/nfsd/nfsctl.c:861
 nfsctl_transaction_write+0x10f/0x160 fs/nfsd/nfsctl.c:112
 vfs_write+0x296/0xba0 fs/read_write.c:685
 ksys_write+0x150/0x270 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f711c39e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f711d27dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f711c625fa0 RCX: 00007f711c39e0d9
RDX: 0000000000000005 RSI: 0000200000000300 RDI: 0000000000000004
RBP: 00007f711c435024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f711c626038 R14: 00007f711c625fa0 R15: 00007ffc740e4ce8
 </TASK>
Modules linked in:
CR2: ffff88808c54a000
---[ end trace 0000000000000000 ]---
RIP: 0010:percpu_counter_add_batch+0x50/0x1d0 lib/percpu_counter.c:98
Code: f6 48 b7 fc 48 89 5c 24 10 48 83 c3 58 49 89 de 49 c1 ee 03 43 80 3c 3e 00 74 08 48 89 df e8 07 7d 26 fd 48 89 1c 24 48 8b 03 <65> 8b 28 41 89 ef 41 c1 ff 1f 49 c1 e7 20 4c 89 6c 24 08 4d 01 ef
RSP: 0018:ffffc9000dc47810 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888036dc4930 RCX: ffff888012f0ca80
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888036dc48d8
RBP: ffffc9000dc47908 R08: ffff888012c3e03f R09: 1ffff11002587c07
R10: dffffc0000000000 R11: ffffed1002587c08 R12: 0000000000000020
R13: 0000000000000001 R14: 1ffff11006db8926 R15: dffffc0000000000
FS:  00007f711d27e6c0(0000) GS:ffff88808c54a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88808c54a000 CR3: 000000001fde5000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	f6 48 b7 fc          	testb  $0xfc,-0x49(%rax)
   4:	48 89 5c 24 10       	mov    %rbx,0x10(%rsp)
   9:	48 83 c3 58          	add    $0x58,%rbx
   d:	49 89 de             	mov    %rbx,%r14
  10:	49 c1 ee 03          	shr    $0x3,%r14
  14:	43 80 3c 3e 00       	cmpb   $0x0,(%r14,%r15,1)
  19:	74 08                	je     0x23
  1b:	48 89 df             	mov    %rbx,%rdi
  1e:	e8 07 7d 26 fd       	call   0xfd267d2a
  23:	48 89 1c 24          	mov    %rbx,(%rsp)
  27:	48 8b 03             	mov    (%rbx),%rax
* 2a:	65 8b 28             	mov    %gs:(%rax),%ebp <-- trapping instruction
  2d:	41 89 ef             	mov    %ebp,%r15d
  30:	41 c1 ff 1f          	sar    $0x1f,%r15d
  34:	49 c1 e7 20          	shl    $0x20,%r15
  38:	4c 89 6c 24 08       	mov    %r13,0x8(%rsp)
  3d:	4d 01 ef             	add    %r13,%r15

IsProbe: true
Reproduced: false
Console Output: [   68.915724][   T33] kauditd_printk_skb: 10 callbacks suppressed
[   68.915738][   T33] audit: type=1400 audit(1786543946.891:201): avc:  denied  { transition } for  pid=5824 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   68.931243][   T33] audit: type=1400 audit(1786543946.891:202): avc:  denied  { noatsecure } for  pid=5824 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   68.939243][   T33] audit: type=1400 audit(1786543946.891:203): avc:  denied  { rlimitinh } for  pid=5824 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   68.946638][   T33] audit: type=1400 audit(1786543946.891:204): avc:  denied  { siginh } for  pid=5824 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   71.645128][   T33] audit: type=1400 audit(1786543949.621:205): avc:  denied  { write } for  pid=5837 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
Warning: Permanently added '[localhost]:28988' (ED25519) to the list of known hosts.
[   71.686328][   T33] audit: type=1400 audit(1786543949.661:206): avc:  denied  { write } for  pid=5841 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   71.827871][   T33] audit: type=1400 audit(1786543949.801:207): avc:  denied  { mount } for  pid=5845 comm="syz-executor132" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1
[*] Starting capability probe...
[+] unshare successful.
[+] mkdir successful.
[+] nfsd mounted successfully.
[+] portlist is accessible.
[+] failslab is available.
[+] All probes passed successfully.
[   71.838211][   T33] audit: type=1400 audit(1786543949.811:208): avc:  denied  { search } for  pid=5845 comm="syz-executor132" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=dir permissive=1
[   71.846829][   T33] audit: type=1400 audit(1786543949.811:209): avc:  denied  { write } for  pid=5845 comm="syz-executor132" name="portlist" dev="nfsd" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=file permissive=1
[   72.010461][ T1376] ieee802154 phy0 wpan0: encryption failed: -22
[   72.013012][ T1376] ieee802154 phy1 wpan1: encryption failed: -22
[   72.206025][   T33] audit: type=1400 audit(1786543950.181:210): avc:  denied  { write } for  pid=5848 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   74.111850][   T33] kauditd_printk_skb: 7 callbacks suppressed
[   74.111860][   T33] audit: type=1400 audit(1786543952.091:218): avc:  denied  { write } for  pid=5872 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   74.152513][   T33] audit: type=1400 audit(1786543952.131:219): avc:  denied  { write } for  pid=5875 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   74.693454][   T33] audit: type=1400 audit(1786543952.671:220): avc:  denied  { write } for  pid=5878 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   74.730826][   T33] audit: type=1400 audit(1786543952.711:221): avc:  denied  { write } for  pid=5881 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   75.051334][   T33] audit: type=1400 audit(1786543953.031:222): avc:  denied  { write } for  pid=5884 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   75.090905][   T33] audit: type=1400 audit(1786543953.071:223): avc:  denied  { write } for  pid=5887 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1

Strace Output: /strace -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f /syz-executor3604259883

<...>
[   76.575480][   T33] kauditd_printk_skb: 6 callbacks suppressed
[   76.575495][   T33] audit: type=1400 audit(1786544042.296:200): avc:  denied  { transition } for  pid=5827 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   76.599156][   T33] audit: type=1400 audit(1786544042.316:201): avc:  denied  { noatsecure } for  pid=5827 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   76.609282][   T33] audit: type=1400 audit(1786544042.316:202): avc:  denied  { rlimitinh } for  pid=5827 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   76.621710][   T33] audit: type=1400 audit(1786544042.316:203): avc:  denied  { siginh } for  pid=5827 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[   78.972097][   T33] audit: type=1400 audit(1786544044.696:204): avc:  denied  { write } for  pid=5833 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   79.048621][   T33] audit: type=1400 audit(1786544044.766:205): avc:  denied  { write } for  pid=5838 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   80.250229][   T33] audit: type=1400 audit(1786544045.976:206): avc:  denied  { write } for  pid=5845 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   80.336083][   T33] audit: type=1400 audit(1786544046.056:207): avc:  denied  { write } for  pid=5848 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   80.473110][   T33] audit: type=1400 audit(1786544046.196:208): avc:  denied  { write } for  pid=5851 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   80.555515][   T33] audit: type=1400 audit(1786544046.276:209): avc:  denied  { write } for  pid=5854 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   81.587181][   T33] kauditd_printk_skb: 3 callbacks suppressed
[   81.587197][   T33] audit: type=1400 audit(1786544047.306:213): avc:  denied  { write } for  pid=5866 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   81.734544][   T33] audit: type=1400 audit(1786544047.456:214): avc:  denied  { write } for  pid=5869 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   81.826693][   T33] audit: type=1400 audit(1786544047.546:215): avc:  denied  { write } for  pid=5872 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   81.941494][   T32] cfg80211: failed to load regulatory.db
[   81.983604][   T33] audit: type=1400 audit(1786544047.706:216): avc:  denied  { write } for  pid=5875 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   82.078252][   T33] audit: type=1400 audit(1786544047.796:217): avc:  denied  { write } for  pid=5879 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   82.981291][   T33] audit: type=1400 audit(1786544048.706:218): avc:  denied  { write } for  pid=5882 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[   83.075239][   T33] audit: type=1400 audit(1786544048.796:219): avc:  denied  { write } for  pid=5885 comm="rm" name="hook-state" dev="tmpfs" ino=1794 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
Warning: Permanently added '[localhost]:60908' (ED25519) to the list of known hosts.
execve("/syz-executor3604259883", ["/syz-executor3604259883"], 0x7ffd083202c0 /* 11 vars */) = 0
brk(NULL)                               = 0x55556bbd3000
brk(0x55556bbd3d80)                     = 0x55556bbd3d80
arch_prctl(ARCH_SET_FS, 0x55556bbd3400) = 0
set_tid_address(0x55556bbd36d0)         = 5897
set_robust_list(0x55556bbd36e0, 24)     = 0
rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlinkat(AT_FDCWD, "/proc/self/exe", "/syz-executor3604259883", 4096) = 23
getrandom("\x79\x88\xa8\xd5\x54\x1c\x72\x7e", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x55556bbd3d80
brk(0x55556bbf4d80)                     = 0x55556bbf4d80
brk(0x55556bbf5000)                     = 0x55556bbf5000
mprotect(0x7f68bd526000, 20480, PROT_READ) = 0
fstat(1, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
unshare(CLONE_NEWNS|CLONE_NEWNET)       = 0
mkdir("/tmp/nfsd_probe", 0777)          = 0
mount("nfsd", "/tmp/nfsd_probe", "nfsd", 0, NULL) = 0
[   84.291171][   T33] audit: type=1400 audit(1786544050.016:220): avc:  denied  { mount } for  pid=5897 comm="syz-executor360" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1
access("/tmp/nfsd_probe/portlist", W_OK) = 0
[   84.304970][   T33] audit: type=1400 audit(1786544050.026:221): avc:  denied  { search } for  pid=5897 comm="syz-executor360" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=dir permissive=1
[   84.320897][   T33] audit: type=1400 audit(1786544050.026:222): avc:  denied  { write } for  pid=5897 comm="syz-executor360" name="portlist" dev="nfsd" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=file permissive=1
access("/sys/kernel/debug/failslab/probability", W_OK) = 0
[*] Starting capability probe...
[+] unshare successful.
[+] mkdir successful.
[+] nfsd mounted successfully.
[+] portlist is accessible.
[+] failslab is available.
[+] All probes passed successfully.
write(1, "[*] Starting capability probe...\n[+] unshare successful.\n[+] mkdir successful.\n[+] nfsd mounted succ"..., 201) = 201
exit_group(0)                           = ?
+++ exited with 0 +++

Crash Report: 

gemini-3.1-pro-preview

							input: 11684
							output: 69
							thoughts: 663
						

**My Thought Process: Analyzing the Capability Probe and Preparing for Reproducer Generation**

Alright, let's break down this process. My primary task is to analyze the output from this capability probe program. I've just finished running it, and the results are right here in front of me:

```
[*] Starting capability probe...
[+] unshare successful.
[+] mkdir successful.
[+] nfsd mounted successfully.
[+] portlist is accessible.
[+] failslab is available.
[+] All probes passed successfully.
```

The key takeaway from this output is that the program exited with a status code of 0. This is the universal sign in the shell environment that everything went as expected, without any errors. Looking at the individual messages, it's clear that all the specific checks we were performing have succeeded. This includes crucial steps like `unshare`, successfully mounting `nfsd`, and confirming access to `portlist`, as well as the availability of `failslab`.

Given this, my immediate conclusion is that the environment where this probe was run is properly configured and ready for the next stage. The probe's purpose was to verify these foundational capabilities, and it has done so unequivocally.

Now, I need to integrate this information with the bug description we're working on. The bug itself is reported as `BUG: unable to handle kernel paging request in percpu_counter_add_batch`. I've reviewed the associated call trace, which points to functions like `svc_xprt_enqueue`, `svc_xprt_received`, and ultimately back to operations within `fs/nfsd/nfsctl.c` and `fs/read_write.c`.

Crucially, the capability probe was specifically designed to test our ability to interact with `portlist` within `nfsd` and to leverage `failslab`. The fact that *all* probes passed means that these prerequisite conditions are met. We *can* perform these operations, which is exactly what we needed to confirm before proceeding to the more complex task of generating a full reproducer for the kernel bug.

Therefore, my next action is to communicate these findings and set the necessary parameters for the subsequent steps. I will be invoking a `set-results` function, and I know precisely what information to provide:

*   **Feedback**: I need to clearly state that the probe was successful and that the environment is ready. I'll phrase it like this: "The capability probe passed successfully. The environment is ready, unshare, nfsd mount, and portlist access are all working. You can now proceed to generate the full reproducer." This gives the user a clear confirmation and directs them on what to do next.
*   **ProbePassed**: This is straightforward; since all probes succeeded, this value must be `true`.
*   **TerminalError**: As there was no critical error that halted the probe or indicated an unrecoverable environmental issue, this field should be an empty string `""`.
*   **TitleMatches**: The probe itself didn't trigger the specific bug or a crash that would directly match the bug title. It merely confirmed the environment's readiness. Therefore, `TitleMatches` should be `false`.

In essence, my thought process here is a direct validation and confirmation loop: run the probe, interpret its success, connect that success to the bug's prerequisites, and then package the results for the next stage of development. Everything looks good to move forward.

map[Feedback:The capability probe passed successfully. The environment is ready, unshare, nfsd mount, and portlist access are all working. You can now proceed to generate the full reproducer. ProbePassed:true TerminalError: TitleMatches:false]

map[Feedback:The capability probe passed successfully. The environment is ready, unshare, nfsd mount, and portlist access are all working. You can now proceed to generate the full reproducer. ProbePassed:true TerminalError: TitleMatches:false]

map[CapabilitiesVerified:true ContinueSignal:continue EquivalenceAnalysis: OracleFeedback:The capability probe passed successfully. The environment is ready, unshare, nfsd mount, and portlist access are all working. You can now proceed to generate the full reproducer. ReproC: Reproduced:false ReproducedBugTitle: ReproducedCrashReport:]

map[OracleFeedback:The capability probe passed successfully. The environment is ready, unshare, nfsd mount, and portlist access are all working. You can now proceed to generate the full reproducer.]

best-expensive

You are an expert in Linux kernel debugging.
Refine the reproduction strategy based on feedback from previous attempts.
Analyze the technical diagnosis provided in the oracle feedback and translate it into concrete,
step-by-step instructions for the repro-generator on how to modify the code structure, alignments,
offsets, or parameters of the candidate program.

=== TOOL SELECTION GUIDELINES ===
- Prefer codesearch-definition-source and codesearch-struct-layout first for symbol lookups.
- Fall back to read-file or grepper for macros, headers, or if symbol lookup fails.

=== CRITICAL PROHIBITIONS ===
- Do NOT repeat searches for the same symbols or files. Use information you have already gathered.
- Do NOT write long explanations. Keep your reasoning short and focused on actionable changes.
- Do NOT assume a bug is fixed based on git commit history.
- If you are stuck, try a different approach or proceed to generate a candidate reproducer.
Prefer calling several tools at the same time to save round-trips.

Bug Description: BUG: unable to handle kernel paging request in percpu_counter_add_batch

BUG: unable to handle page fault for address: ffff88808c54a000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 1acd5067 P4D 1acd5067 PUD 0 
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5311 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:percpu_counter_add_batch+0x50/0x1d0 lib/percpu_counter.c:98
Code: f6 48 b7 fc 48 89 5c 24 10 48 83 c3 58 49 89 de 49 c1 ee 03 43 80 3c 3e 00 74 08 48 89 df e8 07 7d 26 fd 48 89 1c 24 48 8b 03 <65> 8b 28 41 89 ef 41 c1 ff 1f 49 c1 e7 20 4c 89 6c 24 08 4d 01 ef
RSP: 0018:ffffc9000dc47810 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888036dc4930 RCX: ffff888012f0ca80
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888036dc48d8
RBP: ffffc9000dc47908 R08: ffff888012c3e03f R09: 1ffff11002587c07
R10: dffffc0000000000 R11: ffffed1002587c08 R12: 0000000000000020
R13: 0000000000000001 R14: 1ffff11006db8926 R15: dffffc0000000000
FS:  00007f711d27e6c0(0000) GS:ffff88808c54a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88808c54a000 CR3: 000000001fde5000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 percpu_counter_add include/linux/percpu_counter.h:71 [inline]
 percpu_counter_inc include/linux/percpu_counter.h:267 [inline]
 svc_xprt_enqueue+0x2ee/0x8b0 net/sunrpc/svc_xprt.c:524
 svc_xprt_received+0x10f/0x150 net/sunrpc/svc_xprt.c:248
 svc_add_new_perm_xprt net/sunrpc/svc_xprt.c:260 [inline]
 _svc_xprt_create+0x3d8/0x600 net/sunrpc/svc_xprt.c:290
 svc_xprt_create_from_sa net/sunrpc/svc_xprt.c:332 [inline]
 svc_xprt_create+0x1aa/0x280 net/sunrpc/svc_xprt.c:387
 __write_ports_addxprt fs/nfsd/nfsctl.c:774 [inline]
 __write_ports fs/nfsd/nfsctl.c:808 [inline]
 write_ports+0x71a/0xd10 fs/nfsd/nfsctl.c:861
 nfsctl_transaction_write+0x10f/0x160 fs/nfsd/nfsctl.c:112
 vfs_write+0x296/0xba0 fs/read_write.c:685
 ksys_write+0x150/0x270 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f711c39e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f711d27dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f711c625fa0 RCX: 00007f711c39e0d9
RDX: 0000000000000005 RSI: 0000200000000300 RDI: 0000000000000004
RBP: 00007f711c435024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f711c626038 R14: 00007f711c625fa0 R15: 00007ffc740e4ce8
 </TASK>
Modules linked in:
CR2: ffff88808c54a000
---[ end trace 0000000000000000 ]---
RIP: 0010:percpu_counter_add_batch+0x50/0x1d0 lib/percpu_counter.c:98
Code: f6 48 b7 fc 48 89 5c 24 10 48 83 c3 58 49 89 de 49 c1 ee 03 43 80 3c 3e 00 74 08 48 89 df e8 07 7d 26 fd 48 89 1c 24 48 8b 03 <65> 8b 28 41 89 ef 41 c1 ff 1f 49 c1 e7 20 4c 89 6c 24 08 4d 01 ef
RSP: 0018:ffffc9000dc47810 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888036dc4930 RCX: ffff888012f0ca80
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888036dc48d8
RBP: ffffc9000dc47908 R08: ffff888012c3e03f R09: 1ffff11002587c07
R10: dffffc0000000000 R11: ffffed1002587c08 R12: 0000000000000020
R13: 0000000000000001 R14: 1ffff11006db8926 R15: dffffc0000000000
FS:  00007f711d27e6c0(0000) GS:ffff88808c54a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88808c54a000 CR3: 000000001fde5000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	f6 48 b7 fc          	testb  $0xfc,-0x49(%rax)
   4:	48 89 5c 24 10       	mov    %rbx,0x10(%rsp)
   9:	48 83 c3 58          	add    $0x58,%rbx
   d:	49 89 de             	mov    %rbx,%r14
  10:	49 c1 ee 03          	shr    $0x3,%r14
  14:	43 80 3c 3e 00       	cmpb   $0x0,(%r14,%r15,1)
  19:	74 08                	je     0x23
  1b:	48 89 df             	mov    %rbx,%rdi
  1e:	e8 07 7d 26 fd       	call   0xfd267d2a
  23:	48 89 1c 24          	mov    %rbx,(%rsp)
  27:	48 8b 03             	mov    (%rbx),%rax
* 2a:	65 8b 28             	mov    %gs:(%rax),%ebp <-- trapping instruction
  2d:	41 89 ef             	mov    %ebp,%r15d
  30:	41 c1 ff 1f          	sar    $0x1f,%r15d
  34:	49 c1 e7 20          	shl    $0x20,%r15
  38:	4c 89 6c 24 08       	mov    %r13,0x8(%rsp)
  3d:	4d 01 ef             	add    %r13,%r15

Current Strategy: ### Root Cause Analysis

The crash is a classic NULL pointer dereference in percpu space, caused by a missing error check during initialization. 

When a new NFS service is created, `__svc_create()` initializes several percpu counters for the service pools:
```c
		percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL);
		percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL);
		percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL);
```
However, `percpu_counter_init()` can fail (e.g., due to memory allocation failure), in which case it returns an error code and leaves the internal `counters` pointer as `NULL`. Because `__svc_create()` ignores the return value, the kernel proceeds as if the initialization succeeded.

Later, when a transport is added, `svc_xprt_enqueue()` is called, which attempts to increment the counter:
```c
		percpu_counter_inc(&pool->sp_sockets_queued);
```
This attempts to dereference the `NULL` percpu pointer (offset by the CPU's `gs` base), resulting in the observed page fault at address `ffff88808c54a000`.

### Reproduction Strategy

To reproduce this bug reliably, we must simulate a memory allocation failure specifically during the `percpu_counter_init()` call. We can achieve this using the kernel's fault injection framework (`CONFIG_FAULT_INJECTION` and `CONFIG_FAILSLAB`).

1. **Enable Fault Injection**: Configure `failslab` to fail allocations for the current task.
2. **Trigger Service Creation**: Write a valid transport string (e.g., `"tcp 2049"`) to the `nfsd` `portlist` file. This invokes `__write_ports_addxprt()`, which calls `nfsd_create_serv()` -> `svc_create_pooled()` -> `__svc_create()`.
3. **Loop with Low Probability**: Because we want to fail the `percpu_counter_init()` allocation but allow preceding critical allocations (like `kzalloc_objs` for the pool itself) to succeed, we set a low failure probability (e.g., 5%) and run the trigger in a loop.
4. **Namespace Isolation**: To ensure `nfsd_create_serv()` attempts to create a new service on every iteration, we execute each attempt in a new network namespace (`CLONE_NEWNET`).

### Minimal Reproduction Program

```c
#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/wait.h>

void write_file(const char *path, const char *val) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        write(fd, val, strlen(val));
        close(fd);
    }
}

int main() {
    // 1. Setup fault injection for the current task
    write_file("/sys/kernel/debug/failslab/probability", "5"); // 5% probability
    write_file("/sys/kernel/debug/failslab/times", "-1");
    write_file("/sys/kernel/debug/failslab/task-filter", "Y");
    write_file("/proc/self/make-it-fail", "1");

    mkdir("/tmp/nfsd", 0777);

    // 2. Loop to hit the exact allocation race
    for (int i = 0; i < 1000; i++) {
        pid_t pid = fork();
        if (pid == 0) {
            // Isolate network and mount namespaces for a fresh nfsd state
            if (unshare(CLONE_NEWNET | CLONE_NEWNS) == 0) {
                if (mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL) == 0) {
                    
                    // Trigger __write_ports_addxprt -> nfsd_create_serv -> __svc_create
                    int fd = open("/tmp/nfsd/portlist", O_WRONLY);
                    if (fd >= 0) {
                        write(fd, "tcp 2049", 8);
                        close(fd);
                    }
                }
            }
            exit(0);
        }
        waitpid(pid, NULL, 0);
    }
    
    return 0;
}
```
Feedback: The capability probe passed successfully. The environment is ready, unshare, nfsd mount, and portlist access are all working. You can now proceed to generate the full reproducer.

```c
#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <sys/socket.h>

void write_file(const char *path, const char *val) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        write(fd, val, strlen(val));
        close(fd);
    }
}

void bring_lo_up() {
    int fd = socket(AF_INET, SOCK_DGRAM, 0);
    if (fd >= 0) {
        struct ifreq ifr;
        strcpy(ifr.ifr_name, "lo");
        if (ioctl(fd, SIOCGIFFLAGS, &ifr) == 0) {
            ifr.ifr_flags |= IFF_UP | IFF_RUNNING;
            ioctl(fd, SIOCSIFFLAGS, &ifr);
        }
        close(fd);
    }
}

int main() {
    // Ensure debugfs is mounted to access fault injection interfaces
    mount("debugfs", "/sys/kernel/debug", "debugfs", 0, NULL);

    // Setup fault injection for slab allocations
    write_file("/sys/kernel/debug/failslab/probability", "5");
    write_file("/sys/kernel/debug/failslab/times", "-1");
    write_file("/sys/kernel/debug/failslab/task-filter", "Y");
    write_file("/sys/kernel/debug/failslab/ignore-gfp-wait", "N");

    // Setup fault injection for page allocations (in case percpu uses alloc_pages)
    write_file("/sys/kernel/debug/fail_page_alloc/probability", "5");
    write_file("/sys/kernel/debug/fail_page_alloc/times", "-1");
    write_file("/sys/kernel/debug/fail_page_alloc/task-filter", "Y");
    write_file("/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", "N");

    mkdir("/tmp/nfsd", 0777);

    // Loop to hit the exact allocation race where percpu_counter_init fails
    for (int i = 0; i < 5000; i++) {
        pid_t pid = fork();
        if (pid == 0) {
            // Isolate network and mount namespaces for a fresh nfsd state
            if (unshare(CLONE_NEWNET | CLONE_NEWNS) == 0) {
                bring_lo_up();
                if (mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL) == 0) {
                    int fd = open("/tmp/nfsd/portlist", O_WRONLY);
                    if (fd >= 0) {
                        // Enable fault injection ONLY for the write syscall
                        // to avoid failing unshare, mount, or open.
                        write_file("/proc/self/make-it-fail", "1");
                        
                        // Trigger __write_ports_addxprt -> nfsd_create_serv -> __svc_create
                        write(fd, "tcp 2049", 8);
                        
                        write_file("/proc/self/make-it-fail", "0");
                        close(fd);
                    }
                }
            }
            exit(0);
        }
        waitpid(pid, NULL, 0);
    }
    
    return 0;
}
```

gemini-3.1-pro-preview

							input: 6665
							output: 911
							thoughts: 12796
						

**The Kernel Panic in NFSd: Unraveling the `percpu_counter` Crash**

I've been investigating a particularly nasty bug where the `percpu_counter_add_batch` function in the Linux kernel is crashing due to a NULL pointer dereference. The stack trace clearly points to an issue within the NFSd subsystem, specifically during the process of adding a new transport service. The call path leads through `svc_xprt_enqueue`, which eventually attempts to increment a per-CPU counter associated with queued sockets (`sp_sockets_queued`), but this counter's underlying data structure appears to be uninitialized (NULL).

My primary suspect is an allocation failure occurring during the initialization of these per-CPU counters, which are part of the NFSd service setup (`__svc_create`). The NFSd service creation involves several memory allocations, including `kzalloc` for the service structure itself and `kcalloc` for its pools. Crucially, within each pool, three `percpu_counter_init` calls are made. If any of these initializations fail to allocate the necessary per-CPU memory, the `counters` field within the `percpu_counter` structure remains NULL. Later, when `svc_xprt_enqueue` tries to increment this counter, it dereferences this NULL pointer, leading to the observed crash.

Given that this is an allocation-related issue, particularly with per-CPU data, fault injection is the most reliable method to trigger the bug. Syzkaller, our fuzzing tool, typically enables `CONFIG_FAULT_INJECTION` and `CONFIG_FAILSLAB`. My strategy involves leveraging the debugfs interface to inject faults into memory allocation routines, specifically `failslab` and `fail_page_alloc`.

I've developed a C reproducer that orchestrates this. The core idea is to:

1.  **Setup Fault Injection:** I configure `/sys/kernel/debug/failslab/` and `/sys/kernel/debug/fail_page_alloc/` to inject failures with a probability of 5%. I also critically disable `ignore-gfp-wait` (setting it to 'N') for both. This is essential because `GFP_KERNEL` allocations, like those used by `percpu_counter_init`, can sleep. Without disabling `ignore-gfp-wait`, fault injection would be bypassed for such allocations.
2.  **Isolate Namespaces:** To ensure a clean state and create independent NFSd instances, I use `unshare(CLONE_NEWNET | CLONE_NEWNS)`. This creates new network and mount namespaces for each attempt.
3.  **Mount NFSd:** Within the new namespace, I mount the `nfsd` filesystem.
4.  **Trigger Allocation Failure:** The critical step is the `write` operation to `/tmp/nfsd/portlist`. Just before this `write` syscall, I enable task-specific fault injection (`/proc/self/make-it-fail`) for the current process. This ensures that any memory allocations happening *within* this `write` operation (which triggers `nfsd_create_serv` and thus `__svc_create`) are subject to fault injection.
5.  **Iterate and Race:** I wrap this entire process in a loop that iterates 5000 times. Each iteration forks a new process, isolates namespaces, mounts `nfsd`, and attempts the `write` operation. The goal is to create enough NFSd service initializations in rapid succession to hit the race condition where earlier allocations (`kzalloc`, `kcalloc`) succeed, but the `percpu_counter_init` for `sp_sockets_queued` fails due to the injected fault. The `bring_lo_up()` helper is included as a safeguard to ensure network interfaces are ready.

The loop with fault injection and namespace isolation is designed to precisely target the `percpu_counter_init` failure that leads to the NULL pointer dereference in `svc_xprt_enqueue`. By setting `failslab` and `fail_page_alloc` with a modest probability and running many iterations, I'm confident we can reliably trigger the crash. The `make-it-fail` flag ensures that the fault injection is scoped to the exact moment of the critical operation within the `write` syscall.

map[CurrentReproStrategy:```c
#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <sys/socket.h>

void write_file(const char *path, const char *val) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        write(fd, val, strlen(val));
        close(fd);
    }
}

void bring_lo_up() {
    int fd = socket(AF_INET, SOCK_DGRAM, 0);
    if (fd >= 0) {
        struct ifreq ifr;
        strcpy(ifr.ifr_name, "lo");
        if (ioctl(fd, SIOCGIFFLAGS, &ifr) == 0) {
            ifr.ifr_flags |= IFF_UP | IFF_RUNNING;
            ioctl(fd, SIOCSIFFLAGS, &ifr);
        }
        close(fd);
    }
}

int main() {
    // Ensure debugfs is mounted to access fault injection interfaces
    mount("debugfs", "/sys/kernel/debug", "debugfs", 0, NULL);

    // Setup fault injection for slab allocations
    write_file("/sys/kernel/debug/failslab/probability", "5");
    write_file("/sys/kernel/debug/failslab/times", "-1");
    write_file("/sys/kernel/debug/failslab/task-filter", "Y");
    write_file("/sys/kernel/debug/failslab/ignore-gfp-wait", "N");

    // Setup fault injection for page allocations (in case percpu uses alloc_pages)
    write_file("/sys/kernel/debug/fail_page_alloc/probability", "5");
    write_file("/sys/kernel/debug/fail_page_alloc/times", "-1");
    write_file("/sys/kernel/debug/fail_page_alloc/task-filter", "Y");
    write_file("/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", "N");

    mkdir("/tmp/nfsd", 0777);

    // Loop to hit the exact allocation race where percpu_counter_init fails
    for (int i = 0; i < 5000; i++) {
        pid_t pid = fork();
        if (pid == 0) {
            // Isolate network and mount namespaces for a fresh nfsd state
            if (unshare(CLONE_NEWNET | CLONE_NEWNS) == 0) {
                bring_lo_up();
                if (mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL) == 0) {
                    int fd = open("/tmp/nfsd/portlist", O_WRONLY);
                    if (fd >= 0) {
                        // Enable fault injection ONLY for the write syscall
                        // to avoid failing unshare, mount, or open.
                        write_file("/proc/self/make-it-fail", "1");
                        
                        // Trigger __write_ports_addxprt -> nfsd_create_serv -> __svc_create
                        write(fd, "tcp 2049", 8);
                        
                        write_file("/proc/self/make-it-fail", "0");
                        close(fd);
                    }
                }
            }
            exit(0);
        }
        waitpid(pid, NULL, 0);
    }
    
    return 0;
}
```]

best-expensive

map[IsProbe:false RawCandidateReproC:#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <sys/socket.h>
#include <errno.h>
#include <signal.h>

void write_file(const char *path, const char *val) {
    int fd = open(path, O_WRONLY);
    if (fd < 0) {
        printf("[-] open %s failed: %s\n", path, strerror(errno));
        return;
    }
    if (write(fd, val, strlen(val)) < 0) {
        printf("[-] write to %s failed: %s\n", path, strerror(errno));
    }
    close(fd);
}

void bring_lo_up(void) {
    int fd = socket(AF_INET, SOCK_DGRAM, 0);
    if (fd < 0) {
        printf("[-] socket failed: %s\n", strerror(errno));
        exit(1);
    }
    struct ifreq ifr;
    strcpy(ifr.ifr_name, "lo");
    if (ioctl(fd, SIOCGIFFLAGS, &ifr) < 0) {
        printf("[-] ioctl SIOCGIFFLAGS failed: %s\n", strerror(errno));
        exit(1);
    }
    ifr.ifr_flags |= IFF_UP | IFF_RUNNING;
    if (ioctl(fd, SIOCSIFFLAGS, &ifr) < 0) {
        printf("[-] ioctl SIOCSIFFLAGS failed: %s\n", strerror(errno));
        exit(1);
    }
    close(fd);
}

int main(void) {
    printf("[*] Starting reproducer...\n");

    if (mount("debugfs", "/sys/kernel/debug", "debugfs", 0, NULL) != 0) {
        if (errno != EBUSY) {
            printf("[-] Failed to mount debugfs: %s\n", strerror(errno));
        }
    }

    // Setup fault injection for slab allocations
    write_file("/sys/kernel/debug/failslab/probability", "5");
    write_file("/sys/kernel/debug/failslab/times", "-1");
    write_file("/sys/kernel/debug/failslab/task-filter", "Y");
    write_file("/sys/kernel/debug/failslab/ignore-gfp-wait", "N");

    // Setup fault injection for page allocations
    write_file("/sys/kernel/debug/fail_page_alloc/probability", "5");
    write_file("/sys/kernel/debug/fail_page_alloc/times", "-1");
    write_file("/sys/kernel/debug/fail_page_alloc/task-filter", "Y");
    write_file("/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", "N");

    int max_procs = 400;
    pid_t *pids = calloc(max_procs, sizeof(pid_t));
    if (!pids) {
        printf("[-] calloc failed: %s\n", strerror(errno));
        exit(1);
    }
    
    int head = 0;
    
    for (int i = 0; i < 5000; i++) {
        if (pids[head] != 0) {
            kill(pids[head], SIGKILL);
            waitpid(pids[head], NULL, 0);
        }
        
        pid_t pid = fork();
        if (pid < 0) {
            printf("[-] fork failed: %s\n", strerror(errno));
            usleep(100000);
            continue;
        }
        if (pid == 0) {
            if (unshare(CLONE_NEWNET | CLONE_NEWNS) != 0) {
                printf("[-] unshare failed: %s\n", strerror(errno));
                exit(1);
            }
            if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL) < 0) {
                printf("[-] mount private failed: %s\n", strerror(errno));
                exit(1);
            }
            
            bring_lo_up();
            
            if (mkdir("/tmp/nfsd", 0777) < 0 && errno != EEXIST) {
                printf("[-] mkdir failed: %s\n", strerror(errno));
                exit(1);
            }
            if (mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL) < 0) {
                printf("[-] mount nfsd failed: %s\n", strerror(errno));
                exit(1);
            }
            
            int fd_threads = open("/tmp/nfsd/threads", O_WRONLY);
            if (fd_threads < 0) {
                printf("[-] open threads failed: %s\n", strerror(errno));
                exit(1);
            }
            
            int fd_portlist = open("/tmp/nfsd/portlist", O_WRONLY);
            if (fd_portlist < 0) {
                printf("[-] open portlist failed: %s\n", strerror(errno));
                exit(1);
            }
            
            write_file("/proc/self/make-it-fail", "1");
            
            // Try to create service and start a thread with fault injection.
            // We ignore the return value because it is expected to fail sometimes.
            if (write(fd_threads, "1\n", 2) < 0) {
                // Failed, but that's fine.
            }
            
            write_file("/proc/self/make-it-fail", "0");
            
            // Now add a port. If the service was created but percpu_counter_init failed,
            // this will crash the kernel.
            // If the service was destroyed, this will recreate it successfully and not crash.
            // In either case, the service is now alive and holding percpu memory!
            if (write(fd_portlist, "tcp 2049\n", 9) < 0) {
                // Failed, but that's fine.
            }
            
            // Keep alive to hold the percpu memory and force pcpu_populate_chunk in other processes
            sleep(10000);
            exit(0);
        }
        
        pids[head] = pid;
        head = (head + 1) % max_procs;
        usleep(2000);
        
        if (i % 100 == 0) {
            printf("[+] Iteration %d\n", i);
        }
    }
    
    for (int i = 0; i < max_procs; i++) {
        if (pids[i] != 0) {
            kill(pids[i], SIGKILL);
            waitpid(pids[i], NULL, 0);
        }
    }
    
    printf("[+] Done.\n");
    return 0;
}
]

You are a security researcher with deep Linux kernel background.
Your goal is to generate a minimal, standalone C program for the strictly defensive
purpose of verifying a bugfix in an isolated environment.

To ensure that we can diagnose why a program might fail to run on the test environment,
you MUST include detailed logging and error checking in the generated C program:
1. Use 'printf(...)' for all progress messages and error logs.
2. Every system call (e.g., socket, bind, listen, connect, ioctl, send) must check for a failure return value.
3. If a call fails, it must print a specific error message including the function name
   and the error string (use strerror(errno)), and then exit with a non-zero status.
4. The program must print a message after every successful major step.
5. Generate code that follows this pattern for all operations:
    int res = do_something();
    if (res < 0) {
        printf("[-] Failed to do_something: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] do_something successful.\n");
6. The compilation and development environment (including compilers, build
   systems, makefiles, and kernel build/header directories) is NOT available
   on the target test VM guest. Do NOT check for, build, or reference any
   compilation tools, build files, or kernel development directories.
7. Do NOT execute shell commands or run external binaries (e.g. by using
   functions like 'system()', 'popen()', or the 'exec' family such as
   'execve()'). All environment checks, capability probings, and reproduction
   steps must be performed directly using standard Linux system calls (such
   as 'open', 'socket', 'ioctl', 'stat', etc.).
8. When reproducing asynchronous kernel timeouts or warnings, always
   include a sufficient delay (using sleep or similar) after deleting
   or unregistering the device to allow the kernel's asynchronous
   timeout to trigger before program exit.


=== PHASE 2: BUG REPRODUCTION (GENERATION) ===
You must now generate a full reproducer candidate attempting to trigger the target bug/crash.
Do NOT generate a probe program. Focus directly on triggering the bug/crash described in the description.
You can assume that all necessary kernel capabilities and privileges (e.g., access to /dev/vhci,
ability to load BPF programs, etc.) have already been verified and are available in the environment.

Do not spend too much time analyzing or trying to generate a perfect one-shot reproducer.
Instead, follow an iterative approach: generate a simple candidate, execute it, analyze the results,
and improve it. Keep your reasoning steps short and focused on the next logical experiment.

Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Bug Description: BUG: unable to handle kernel paging request in percpu_counter_add_batch

BUG: unable to handle page fault for address: ffff88808c54a000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 1acd5067 P4D 1acd5067 PUD 0 
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5311 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:percpu_counter_add_batch+0x50/0x1d0 lib/percpu_counter.c:98
Code: f6 48 b7 fc 48 89 5c 24 10 48 83 c3 58 49 89 de 49 c1 ee 03 43 80 3c 3e 00 74 08 48 89 df e8 07 7d 26 fd 48 89 1c 24 48 8b 03 <65> 8b 28 41 89 ef 41 c1 ff 1f 49 c1 e7 20 4c 89 6c 24 08 4d 01 ef
RSP: 0018:ffffc9000dc47810 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888036dc4930 RCX: ffff888012f0ca80
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888036dc48d8
RBP: ffffc9000dc47908 R08: ffff888012c3e03f R09: 1ffff11002587c07
R10: dffffc0000000000 R11: ffffed1002587c08 R12: 0000000000000020
R13: 0000000000000001 R14: 1ffff11006db8926 R15: dffffc0000000000
FS:  00007f711d27e6c0(0000) GS:ffff88808c54a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88808c54a000 CR3: 000000001fde5000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 percpu_counter_add include/linux/percpu_counter.h:71 [inline]
 percpu_counter_inc include/linux/percpu_counter.h:267 [inline]
 svc_xprt_enqueue+0x2ee/0x8b0 net/sunrpc/svc_xprt.c:524
 svc_xprt_received+0x10f/0x150 net/sunrpc/svc_xprt.c:248
 svc_add_new_perm_xprt net/sunrpc/svc_xprt.c:260 [inline]
 _svc_xprt_create+0x3d8/0x600 net/sunrpc/svc_xprt.c:290
 svc_xprt_create_from_sa net/sunrpc/svc_xprt.c:332 [inline]
 svc_xprt_create+0x1aa/0x280 net/sunrpc/svc_xprt.c:387
 __write_ports_addxprt fs/nfsd/nfsctl.c:774 [inline]
 __write_ports fs/nfsd/nfsctl.c:808 [inline]
 write_ports+0x71a/0xd10 fs/nfsd/nfsctl.c:861
 nfsctl_transaction_write+0x10f/0x160 fs/nfsd/nfsctl.c:112
 vfs_write+0x296/0xba0 fs/read_write.c:685
 ksys_write+0x150/0x270 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f711c39e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f711d27dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f711c625fa0 RCX: 00007f711c39e0d9
RDX: 0000000000000005 RSI: 0000200000000300 RDI: 0000000000000004
RBP: 00007f711c435024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f711c626038 R14: 00007f711c625fa0 R15: 00007ffc740e4ce8
 </TASK>
Modules linked in:
CR2: ffff88808c54a000
---[ end trace 0000000000000000 ]---
RIP: 0010:percpu_counter_add_batch+0x50/0x1d0 lib/percpu_counter.c:98
Code: f6 48 b7 fc 48 89 5c 24 10 48 83 c3 58 49 89 de 49 c1 ee 03 43 80 3c 3e 00 74 08 48 89 df e8 07 7d 26 fd 48 89 1c 24 48 8b 03 <65> 8b 28 41 89 ef 41 c1 ff 1f 49 c1 e7 20 4c 89 6c 24 08 4d 01 ef
RSP: 0018:ffffc9000dc47810 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888036dc4930 RCX: ffff888012f0ca80
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888036dc48d8
RBP: ffffc9000dc47908 R08: ffff888012c3e03f R09: 1ffff11002587c07
R10: dffffc0000000000 R11: ffffed1002587c08 R12: 0000000000000020
R13: 0000000000000001 R14: 1ffff11006db8926 R15: dffffc0000000000
FS:  00007f711d27e6c0(0000) GS:ffff88808c54a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88808c54a000 CR3: 000000001fde5000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	f6 48 b7 fc          	testb  $0xfc,-0x49(%rax)
   4:	48 89 5c 24 10       	mov    %rbx,0x10(%rsp)
   9:	48 83 c3 58          	add    $0x58,%rbx
   d:	49 89 de             	mov    %rbx,%r14
  10:	49 c1 ee 03          	shr    $0x3,%r14
  14:	43 80 3c 3e 00       	cmpb   $0x0,(%r14,%r15,1)
  19:	74 08                	je     0x23
  1b:	48 89 df             	mov    %rbx,%rdi
  1e:	e8 07 7d 26 fd       	call   0xfd267d2a
  23:	48 89 1c 24          	mov    %rbx,(%rsp)
  27:	48 8b 03             	mov    (%rbx),%rax
* 2a:	65 8b 28             	mov    %gs:(%rax),%ebp <-- trapping instruction
  2d:	41 89 ef             	mov    %ebp,%r15d
  30:	41 c1 ff 1f          	sar    $0x1f,%r15d
  34:	49 c1 e7 20          	shl    $0x20,%r15
  38:	4c 89 6c 24 08       	mov    %r13,0x8(%rsp)
  3d:	4d 01 ef             	add    %r13,%r15

Strategy: ```c
#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <sys/socket.h>

void write_file(const char *path, const char *val) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        write(fd, val, strlen(val));
        close(fd);
    }
}

void bring_lo_up() {
    int fd = socket(AF_INET, SOCK_DGRAM, 0);
    if (fd >= 0) {
        struct ifreq ifr;
        strcpy(ifr.ifr_name, "lo");
        if (ioctl(fd, SIOCGIFFLAGS, &ifr) == 0) {
            ifr.ifr_flags |= IFF_UP | IFF_RUNNING;
            ioctl(fd, SIOCSIFFLAGS, &ifr);
        }
        close(fd);
    }
}

int main() {
    // Ensure debugfs is mounted to access fault injection interfaces
    mount("debugfs", "/sys/kernel/debug", "debugfs", 0, NULL);

    // Setup fault injection for slab allocations
    write_file("/sys/kernel/debug/failslab/probability", "5");
    write_file("/sys/kernel/debug/failslab/times", "-1");
    write_file("/sys/kernel/debug/failslab/task-filter", "Y");
    write_file("/sys/kernel/debug/failslab/ignore-gfp-wait", "N");

    // Setup fault injection for page allocations (in case percpu uses alloc_pages)
    write_file("/sys/kernel/debug/fail_page_alloc/probability", "5");
    write_file("/sys/kernel/debug/fail_page_alloc/times", "-1");
    write_file("/sys/kernel/debug/fail_page_alloc/task-filter", "Y");
    write_file("/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", "N");

    mkdir("/tmp/nfsd", 0777);

    // Loop to hit the exact allocation race where percpu_counter_init fails
    for (int i = 0; i < 5000; i++) {
        pid_t pid = fork();
        if (pid == 0) {
            // Isolate network and mount namespaces for a fresh nfsd state
            if (unshare(CLONE_NEWNET | CLONE_NEWNS) == 0) {
                bring_lo_up();
                if (mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL) == 0) {
                    int fd = open("/tmp/nfsd/portlist", O_WRONLY);
                    if (fd >= 0) {
                        // Enable fault injection ONLY for the write syscall
                        // to avoid failing unshare, mount, or open.
                        write_file("/proc/self/make-it-fail", "1");
                        
                        // Trigger __write_ports_addxprt -> nfsd_create_serv -> __svc_create
                        write(fd, "tcp 2049", 8);
                        
                        write_file("/proc/self/make-it-fail", "0");
                        close(fd);
                    }
                }
            }
            exit(0);
        }
        waitpid(pid, NULL, 0);
    }
    
    return 0;
}
```


Previous Reproducer Attempt:
#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <errno.h>

int main(void) {
    printf("[*] Starting capability probe...\n");

    if (unshare(CLONE_NEWNET | CLONE_NEWNS) != 0) {
        printf("[-] unshare failed: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] unshare successful.\n");

    if (mkdir("/tmp/nfsd_probe", 0777) != 0 && errno != EEXIST) {
        printf("[-] mkdir failed: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] mkdir successful.\n");

    if (mount("nfsd", "/tmp/nfsd_probe", "nfsd", 0, NULL) != 0) {
        printf("[-] Failed to mount nfsd: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] nfsd mounted successfully.\n");

    if (access("/tmp/nfsd_probe/portlist", W_OK) != 0) {
        printf("[-] Cannot access /tmp/nfsd_probe/portlist: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] portlist is accessible.\n");

    if (access("/sys/kernel/debug/failslab/probability", W_OK) != 0) {
        printf("[-] Cannot access /sys/kernel/debug/failslab/probability: %s\n", strerror(errno));
        if (mount("debugfs", "/sys/kernel/debug", "debugfs", 0, NULL) != 0) {
            printf("[-] Failed to mount debugfs: %s\n", strerror(errno));
        }
        if (access("/sys/kernel/debug/failslab/probability", W_OK) != 0) {
            printf("[-] failslab not available: %s\n", strerror(errno));
            exit(1);
        }
    }
    printf("[+] failslab is available.\n");

    printf("[+] All probes passed successfully.\n");
    return 0;
}




Execution Results & Debugging Feedback:
The capability probe passed successfully. The environment is ready, unshare, nfsd mount, and portlist access are all working. You can now proceed to generate the full reproducer.

gemini-3.1-pro-preview

							input: 7586
							output: 17
							thoughts: 862
						

**My Thoughts on Debugging `percpu_counter_add_batch` and `svc_xprt_enqueue`**

So, I've been digging into this rather thorny issue with `percpu_counter_add_batch` that seems to be triggered when `svc_xprt_enqueue` is called. My current hypothesis is that the root cause is a botched initialization of a percpu counter, and fault injection is the prime suspect. The suggested approach involves using `failslab` and `fail_page_alloc` to force these faults during the `write_ports` -> `nfsd_create_serv` -> `__svc_create` -> `svc_xprt_create` call chain.

Looking at the provided stack trace, the critical path leading to the crash is clear: `percpu_counter_add` calls `percpu_counter_inc`, which is then invoked by `svc_xprt_enqueue` at `net/sunrpc/svc_xprt.c:524`. This `svc_xprt_enqueue` function is called by `svc_xprt_received`, which in turn is called by `svc_add_new_perm_xprt`. The latter is called within `_svc_xprt_create`.

The core of the problem appears to be within `svc_xprt_enqueue`. It's trying to increment `xpt_server->sv_stats->sockets_queued`. If `sv_stats` itself, or the `sockets_queued` member within it, hasn't been properly initialized, this is a recipe for a crash. My next step is to trace back where `sv_stats` is actually allocated. I need to figure out if it's happening in `svc_create_pooled` or `svc_create`, and then I can start pinpointing how the fault injection could interfere with that allocation.

map[Expression:sv_stats]

map[Output:include/linux/sunrpc/svc.h=72=struct svc_serv {
include/linux/sunrpc/svc.h-73-	struct svc_program *	sv_programs;	/* RPC programs */
include/linux/sunrpc/svc.h:74:	struct svc_stat *	sv_stats;	/* RPC statistics */
include/linux/sunrpc/svc.h-75-	spinlock_t		sv_lock;
--
net/sunrpc/svc.c=483=__svc_create(struct svc_program *prog, int nprogs, struct svc_stat *stats,
--
net/sunrpc/svc.c-495-	serv->sv_nprogs    = nprogs;
net/sunrpc/svc.c:496:	serv->sv_stats     = stats;
net/sunrpc/svc.c-497-	if (bufsize > RPCSVC_MAXPAYLOAD)
--
net/sunrpc/svc.c=1393=svc_process_common(struct svc_rqst *rqstp)
--
net/sunrpc/svc.c-1482-	/* Syntactic check complete */
net/sunrpc/svc.c:1483:	if (serv->sv_stats)
net/sunrpc/svc.c:1484:		serv->sv_stats->rpccnt++;
net/sunrpc/svc.c-1485-	trace_svc_process(rqstp, progp->pg_name);
--
net/sunrpc/svc.c-1533-err_bad_rpc:
net/sunrpc/svc.c:1534:	if (serv->sv_stats)
net/sunrpc/svc.c:1535:		serv->sv_stats->rpcbadfmt++;
net/sunrpc/svc.c-1536-	xdr_stream_encode_u32(xdr, RPC_MSG_DENIED);
--
net/sunrpc/svc.c-1545-		be32_to_cpu(rqstp->rq_auth_stat));
net/sunrpc/svc.c:1546:	if (serv->sv_stats)
net/sunrpc/svc.c:1547:		serv->sv_stats->rpcbadauth++;
net/sunrpc/svc.c-1548-	/* Restore write pointer to location of reply status: */
--
net/sunrpc/svc.c-1556-	dprintk("svc: unknown program %d\n", rqstp->rq_prog);
net/sunrpc/svc.c:1557:	if (serv->sv_stats)
net/sunrpc/svc.c:1558:		serv->sv_stats->rpcbadfmt++;
net/sunrpc/svc.c-1559-	*rqstp->rq_accept_statp = rpc_prog_unavail;
--
net/sunrpc/svc.c-1565-
net/sunrpc/svc.c:1566:	if (serv->sv_stats)
net/sunrpc/svc.c:1567:		serv->sv_stats->rpcbadfmt++;
net/sunrpc/svc.c-1568-	*rqstp->rq_accept_statp = rpc_prog_mismatch;
--
net/sunrpc/svc.c-1580-
net/sunrpc/svc.c:1581:	if (serv->sv_stats)
net/sunrpc/svc.c:1582:		serv->sv_stats->rpcbadfmt++;
net/sunrpc/svc.c-1583-	*rqstp->rq_accept_statp = rpc_proc_unavail;
--
net/sunrpc/svc.c=1614=void svc_process(struct svc_rqst *rqstp)
--
net/sunrpc/svc.c-1661-		   be32_to_cpu(*p));
net/sunrpc/svc.c:1662:	if (rqstp->rq_server->sv_stats)
net/sunrpc/svc.c:1663:		rqstp->rq_server->sv_stats->rpcbadfmt++;
net/sunrpc/svc.c-1664-out_drop:
--
net/sunrpc/svc_xprt.c=832=static void svc_handle_xprt(struct svc_rqst *rqstp, struct svc_xprt *xprt)
--
net/sunrpc/svc_xprt.c-881-
net/sunrpc/svc_xprt.c:882:		if (serv->sv_stats)
net/sunrpc/svc_xprt.c:883:			serv->sv_stats->netcnt++;
net/sunrpc/svc_xprt.c-884-		percpu_counter_inc(&rqstp->rq_pool->sp_messages_arrived);
--
net/sunrpc/svcsock.c=608=static int svc_udp_recvfrom(struct svc_rqst *rqstp)
--
net/sunrpc/svcsock.c-691-
net/sunrpc/svcsock.c:692:	if (serv->sv_stats)
net/sunrpc/svcsock.c:693:		serv->sv_stats->netudpcnt++;
net/sunrpc/svcsock.c-694-
--
net/sunrpc/svcsock.c=927=static struct svc_xprt *svc_tcp_accept(struct svc_xprt *xprt)
--
net/sunrpc/svcsock.c-984-		clear_bit(XPT_LOCAL, &newsvsk->sk_xprt.xpt_flags);
net/sunrpc/svcsock.c:985:	if (serv->sv_stats)
net/sunrpc/svcsock.c:986:		serv->sv_stats->nettcpconn++;
net/sunrpc/svcsock.c-987-
--
net/sunrpc/svcsock.c=1155=static int svc_tcp_recvfrom(struct svc_rqst *rqstp)
--
net/sunrpc/svcsock.c-1210-	svc_xprt_copy_addrs(rqstp, &svsk->sk_xprt);
net/sunrpc/svcsock.c:1211:	if (serv->sv_stats)
net/sunrpc/svcsock.c:1212:		serv->sv_stats->nettcpcnt++;
net/sunrpc/svcsock.c-1213-
]

gemini-3.1-pro-preview

							input: 10114
							output: 18
							thoughts: 31
						

**A Deep Dive into `__svc_create`'s Origins**

My initial thought process, upon noticing that `sv_stats` is being passed into `__svc_create`, is to immediately seek out the origins of this call. It's a crucial step in understanding the flow and context of `sv_stats`. My next logical action is to meticulously trace all invocations of `__svc_create` to pinpoint precisely where this data structure is being supplied, and by extension, how it's intended to be utilized within that specific function. This investigative path is paramount for a comprehensive grasp of the system's behavior.

map[Expression:__svc_create]

map[Output:net/sunrpc/svc.c=482=static struct svc_serv *
net/sunrpc/svc.c:483:__svc_create(struct svc_program *prog, int nprogs, struct svc_stat *stats,
net/sunrpc/svc.c-484-	     unsigned int bufsize, int npools, int (*threadfn)(void *data))
--
net/sunrpc/svc.c=559=struct svc_serv *svc_create(struct svc_program *prog, unsigned int bufsize,
--
net/sunrpc/svc.c-561-{
net/sunrpc/svc.c:562:	return __svc_create(prog, 1, NULL, bufsize, 1, threadfn);
net/sunrpc/svc.c-563-}
--
net/sunrpc/svc.c=576=struct svc_serv *svc_create_pooled(struct svc_program *prog,
--
net/sunrpc/svc.c-584-
net/sunrpc/svc.c:585:	serv = __svc_create(prog, nprogs, stats, bufsize, npools, threadfn);
net/sunrpc/svc.c-586-	if (!serv)
]

gemini-3.1-pro-preview

							input: 10467
							output: 21
							thoughts: 29
						

**My Thought Process as I Navigate `nfsd`'s Initialization**

Okay, so my mental breadcrumbs are leading me through the kernel's Network File System daemon, `nfsd`. I've just traced a call from `nfsd` itself, and I can see it's invoking `svc_create_pooled`. This immediately tells me that the service creation mechanism is designed with pooling in mind, suggesting an effort towards efficient resource management, likely for the RPC (Remote Procedure Call) endpoints that `nfsd` will be using.

Following that, my attention shifts to `nfsd_create_serv`. This is clearly the higher-level function responsible for setting up the *entire* NFS server instance. It's the logical next step after `svc_create_pooled` has potentially allocated some underlying RPC service infrastructure. I'm expecting `nfsd_create_serv` to be the orchestrator, taking the prepped RPC service and configuring it specifically for NFS operations. This will likely involve setting up the necessary RPC program numbers, version handling, and potentially binding it to specific network interfaces or ports. Essentially, this is where the NFS server truly "comes alive" from a structural perspective.

map[Expression:nfsd_create_serv]

map[Output:fs/nfsd/nfsctl.c=725=static ssize_t __write_ports_addfd(char *buf, struct net *net, const struct cred *cred)
--
fs/nfsd/nfsctl.c-736-
fs/nfsd/nfsctl.c:737:	err = nfsd_create_serv(net);
fs/nfsd/nfsctl.c-738-	if (err != 0)
--
fs/nfsd/nfsctl.c=754=static ssize_t __write_ports_addxprt(char *buf, struct net *net, const struct cred *cred)
--
fs/nfsd/nfsctl.c-768-
fs/nfsd/nfsctl.c:769:	err = nfsd_create_serv(net);
fs/nfsd/nfsctl.c-770-	if (err != 0)
--
fs/nfsd/nfsctl.c=1953=int nfsd_nl_listener_set_doit(struct sk_buff *skb, struct genl_info *info)
--
fs/nfsd/nfsctl.c-1965-
fs/nfsd/nfsctl.c:1966:	err = nfsd_create_serv(net);
fs/nfsd/nfsctl.c-1967-	if (err) {
--
fs/nfsd/nfsd.h=134=void nfsd_reset_versions(struct nfsd_net *nn);
fs/nfsd/nfsd.h:135:int nfsd_create_serv(struct net *net);
fs/nfsd/nfsd.h-136-void nfsd_destroy_serv(struct net *net);
--
fs/nfsd/nfssvc.c=589=struct svc_rqst *nfsd_current_rqst(void)
--
fs/nfsd/nfssvc.c-595-
fs/nfsd/nfssvc.c:596:int nfsd_create_serv(struct net *net)
fs/nfsd/nfssvc.c-597-{
--
fs/nfsd/nfssvc.c=751=nfsd_svc(int n, int *nthreads, struct net *net, const struct cred *cred, const char *scope)
--
fs/nfsd/nfssvc.c-763-
fs/nfsd/nfssvc.c:764:	error = nfsd_create_serv(net);
fs/nfsd/nfssvc.c-765-	if (error)
]

gemini-3.1-pro-preview

							input: 11204
							output: 39
							thoughts: 27
						

**My Journey Through `nfsd_create_serv`**

Alright, so I'm diving into the heart of the NFS server implementation, specifically `fs/nfsd/nfssvc.c`, to understand how a new NFS service is brought into existence. My primary focus right now is the `nfsd_create_serv` function. I need to trace its execution, understand its responsibilities, and see how it lays the groundwork for handling client requests. I'll be looking for what resources it allocates, what initial configurations it sets up, and how it integrates this new service into the broader NFS server infrastructure. My goal is to grasp the fundamental steps involved in establishing an NFS serving entity, from its inception within the kernel module.

map[File:fs/nfsd/nfssvc.c FirstLine:596 LineCount:50]

map[Contents: 596:	int nfsd_create_serv(struct net *net)
 597:	{
 598:		int error;
 599:		struct nfsd_net *nn = net_generic(net, nfsd_net_id);
 600:		struct svc_serv *serv;
 601:	
 602:		WARN_ON(!mutex_is_locked(&nfsd_mutex));
 603:		if (nn->nfsd_serv)
 604:			return 0;
 605:	
 606:		error = percpu_ref_init(&nn->nfsd_net_ref, nfsd_net_free,
 607:					0, GFP_KERNEL);
 608:		if (error)
 609:			return error;
 610:		init_completion(&nn->nfsd_net_free_done);
 611:		init_completion(&nn->nfsd_net_confirm_done);
 612:	
 613:		if (nfsd_max_blksize == 0)
 614:			nfsd_max_blksize = nfsd_get_default_max_blksize();
 615:		nfsd_reset_versions(nn);
 616:		serv = svc_create_pooled(nfsd_programs, ARRAY_SIZE(nfsd_programs),
 617:					 &nn->nfsd_svcstats,
 618:					 nfsd_max_blksize, nfsd);
 619:		if (serv == NULL) {
 620:			percpu_ref_exit(&nn->nfsd_net_ref);
 621:			return -ENOMEM;
 622:		}
 623:	
 624:		error = svc_bind(serv, net);
 625:		if (error < 0) {
 626:			svc_destroy(&serv);
 627:			percpu_ref_exit(&nn->nfsd_net_ref);
 628:			return error;
 629:		}
 630:		spin_lock(&nfsd_notifier_lock);
 631:		nn->nfsd_serv = serv;
 632:		spin_unlock(&nfsd_notifier_lock);
 633:	
 634:		/* check if the notifier is already set */
 635:		if (atomic_inc_return(&nfsd_notifier_refcount) == 1) {
 636:			register_inetaddr_notifier(&nfsd_inetaddr_notifier);
 637:	#if IS_ENABLED(CONFIG_IPV6)
 638:			register_inet6addr_notifier(&nfsd_inet6addr_notifier);
 639:	#endif
 640:		}
 641:		nfsd_reset_write_verifier(nn);
 642:		return 0;
 643:	}
 644:	
 645:	int nfsd_nrpools(struct net *net)
]

gemini-3.1-pro-preview

							input: 12079
							output: 21
							thoughts: 38
						

**My Thought Process on NFSv4 Server Statistics**

Ah, I see. So, when the code refers to `stats`, it's actually a shorthand for `&nn->nfsd_svcstats`. That's a crucial piece of context to pin down right away. Now, to truly understand what `stats` represents and how it's being used, my immediate next step is to delve into the definitions of `struct nfsd_net` and `struct nfsd_svcstats`. I need to see the structure of both of these to grasp the full scope of the data being tracked and how it's organized within the network-specific context (`nfsd_net`). This will allow me to understand what specific metrics are being collected and where they reside within the broader NFSd infrastructure.

log-in to see details

map[Expression:struct nfsd_net {]

map[Output:]

gemini-3.1-pro-preview

							input: 12159
							output: 20
							thoughts: 23
						

**My Thought Process on `struct nfsd_net`**

Ah, so I'm digging into the NFS server's network namespace management, specifically `struct nfsd_net` as defined in `fs/nfsd/netns.h`. My immediate thought upon encountering this structure is about its fundamental role: it's the cornerstone for managing NFS server-specific data within the context of a particular network namespace.

I recognize that in modern Linux kernel development, especially for network-related subsystems, network namespaces are paramount. They provide isolation, allowing multiple instances of network protocols and services to coexist without interfering with each other. For NFS, this means each network namespace can potentially host its own independent NFS server instance, or at least have its configuration and state tied to that specific namespace.

So, `struct nfsd_net` must be the container for all that per-namespace NFS server state. What kind of state would that be? I'm thinking about the core operational aspects of an NFS server. This would likely include:

*   **State specific to the NFS server's operation within this namespace:** This is the broadest category. It could encompass things like which NFS versions are enabled or supported for this namespace, any per-namespace tuning parameters, or perhaps flags indicating the operational mode of the NFS server in this specific network context.
*   **Data structures that need to be isolated per namespace:** Many network services maintain internal data structures for tracking connections, operations, or resources. If these need to be independent for each network namespace, then `struct nfsd_net` is where pointers or embedded instances of these structures would reside. For NFS, this might involve things like RPC control blocks, cache management structures, or perhaps even per-namespace statistics.
*   **Links to other per-namespace NFS-related data:** It's unlikely that `struct nfsd_net` would contain *everything*. More realistically, it would act as a central point from which other per-namespace data structures are accessed. For example, it might hold pointers to per-namespace mount information, export table data relevant to this namespace, or even data related to the underlying network sockets used by the NFS server in this namespace.
*   **A mechanism for associating NFS server functionality with a network namespace:** This is the "why" of the structure. It's the kernel's way of saying, "When you're operating within network namespace X, here's the NFS server data that belongs to you." This implies that the kernel's NFS server core logic will likely have access to a `struct nfsd_net` pointer when processing requests or managing resources associated with that namespace.

Looking at its definition, I'd anticipate seeing fields that are typical for such a per-namespace structure:

*   **Pointers to other data structures:** As I mentioned, this is a strong possibility. These pointers would link to more detailed configurations or operational data.
*   **Counters or flags:** Simple integer fields or bitmasks to track certain states or statistics.
*   **Perhaps a lock or synchronization primitive:** Since multiple threads might access NFS server data within a namespace, there might be a lock associated with this structure to ensure safe concurrent access.

Essentially, `struct nfsd_net` is the anchor point for NFS server state within the network namespace subsystem. It's the primary data structure that the NFS server code will interact with to understand and manage its presence and behavior in a specific network isolation context. It's crucial for allowing multiple, distinct NFS server environments to coexist on a single host, each with its own configuration and operational characteristics. My immediate next step in understanding would be to examine the fields within the structure itself and how they are populated and used by the NFS server code.

map[Expression:struct nfsd_net]

map[Output:
Full output is too long, showing 500 out of 1706 lines.
Use more precise expression if possible.

fs/nfsd/cache.h=82=void	nfsd_drc_slab_free(void);
fs/nfsd/cache.h:83:int	nfsd_reply_cache_init(struct nfsd_net *);
fs/nfsd/cache.h:84:void	nfsd_reply_cache_shutdown(struct nfsd_net *);
fs/nfsd/cache.h-85-int	nfsd_cache_lookup(struct svc_rqst *rqstp, unsigned int start,
--
fs/nfsd/export.c=334=int nfsd_nl_expkey_get_reqs_dumpit(struct sk_buff *skb,
--
fs/nfsd/export.c-336-{
fs/nfsd/export.c:337:	struct nfsd_net *nn;
fs/nfsd/export.c-338-	struct cache_detail *cd;
--
fs/nfsd/export.c=551=int nfsd_nl_expkey_set_reqs_doit(struct sk_buff *skb,
--
fs/nfsd/export.c-553-{
fs/nfsd/export.c:554:	struct nfsd_net *nn;
fs/nfsd/export.c-555-	struct cache_detail *cd;
--
fs/nfsd/export.c=660=int nfsd_nl_svc_export_get_reqs_dumpit(struct sk_buff *skb,
--
fs/nfsd/export.c-662-{
fs/nfsd/export.c:663:	struct nfsd_net *nn;
fs/nfsd/export.c-664-	struct cache_detail *cd;
--
fs/nfsd/export.c=1047=int nfsd_nl_svc_export_set_reqs_doit(struct sk_buff *skb,
--
fs/nfsd/export.c-1049-{
fs/nfsd/export.c:1050:	struct nfsd_net *nn;
fs/nfsd/export.c-1051-	struct cache_detail *cd;
--
fs/nfsd/export.c=1726=exp_rootfh(struct net *net, struct auth_domain *clp, char *name,
--
fs/nfsd/export.c-1733-	int			err;
fs/nfsd/export.c:1734:	struct nfsd_net		*nn = net_generic(net, nfsd_net_id);
fs/nfsd/export.c-1735-	struct cache_detail	*cd = nn->svc_export_cache;
--
fs/nfsd/export.c=1770=static struct svc_export *exp_find(struct cache_detail *cd,
--
fs/nfsd/export.c-1774-	struct svc_export *exp;
fs/nfsd/export.c:1775:	struct nfsd_net *nn = net_generic(cd->net, nfsd_net_id);
fs/nfsd/export.c-1776-	struct svc_expkey *ek = exp_find_key(nn->svc_expkey_cache, clp, fsid_type, fsidv, reqp);
--
fs/nfsd/export.c=1920=rqst_exp_get_by_name(struct svc_rqst *rqstp, const struct path *path)
--
fs/nfsd/export.c-1922-	struct svc_export *gssexp, *exp = ERR_PTR(-ENOENT);
fs/nfsd/export.c:1923:	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
fs/nfsd/export.c-1924-	struct cache_detail *cd = nn->svc_export_cache;
--
fs/nfsd/export.c=1966=rqst_exp_find(struct cache_req *reqp, struct net *net,
--
fs/nfsd/export.c-1969-{
fs/nfsd/export.c:1970:	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
fs/nfsd/export.c-1971-	struct svc_export *gssexp, *exp = ERR_PTR(-ENOENT);
--
fs/nfsd/export.c=2190=nfsd_export_init(struct net *net)
--
fs/nfsd/export.c-2192-	int rv;
fs/nfsd/export.c:2193:	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
fs/nfsd/export.c-2194-
--
fs/nfsd/export.c=2227=nfsd_export_flush(struct net *net)
fs/nfsd/export.c-2228-{
fs/nfsd/export.c:2229:	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
fs/nfsd/export.c-2230-
--
fs/nfsd/export.c=2239=nfsd_export_shutdown(struct net *net)
fs/nfsd/export.c-2240-{
fs/nfsd/export.c:2241:	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
fs/nfsd/export.c-2242-
--
fs/nfsd/filecache.c=429=nfsd_file_dispose_list_delayed(struct list_head *dispose)
--
fs/nfsd/filecache.c-433-						struct nfsd_file, nf_gc);
fs/nfsd/filecache.c:434:		struct nfsd_net *nn = net_generic(nf->nf_net, nfsd_net_id);
fs/nfsd/filecache.c-435-		struct nfsd_fcache_disposal *l = nn->fcache_disposal;
--
fs/nfsd/filecache.c-461- */
fs/nfsd/filecache.c:462:void nfsd_file_net_dispose(struct nfsd_net *nn)
fs/nfsd/filecache.c-463-{
--
fs/nfsd/filecache.c=911=__nfsd_file_cache_purge(struct net *net)
--
fs/nfsd/filecache.c-918-	if (net) {
fs/nfsd/filecache.c:919:		struct nfsd_net *nn = net_generic(net, nfsd_net_id);
fs/nfsd/filecache.c-920-		nfs_localio_invalidate_clients(&nn->local_clients,
--
fs/nfsd/filecache.c=964=nfsd_free_fcache_disposal_net(struct net *net)
fs/nfsd/filecache.c-965-{
fs/nfsd/filecache.c:966:	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
fs/nfsd/filecache.c-967-	struct nfsd_fcache_disposal *l = nn->fcache_disposal;
--
fs/nfsd/filecache.c=973=nfsd_file_cache_start_net(struct net *net)
fs/nfsd/filecache.c-974-{
fs/nfsd/filecache.c:975:	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
fs/nfsd/filecache.c-976-
--
fs/nfsd/filecache.h=73=void nfsd_file_close_export(struct net *net, const struct path *path);
fs/nfsd/filecache.h:74:void nfsd_file_net_dispose(struct nfsd_net *nn);
fs/nfsd/filecache.h-75-bool nfsd_file_is_cached(struct inode *inode);
--
fs/nfsd/localio.c=157=static __be32 localio_proc_uuid_is_local(struct svc_rqst *rqstp)
--
fs/nfsd/localio.c-160-	struct net *net = SVC_NET(rqstp);
fs/nfsd/localio.c:161:	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
fs/nfsd/localio.c-162-
--
fs/nfsd/netns.h=27=struct cld_net;
fs/nfsd/netns.h:28:struct nfsd_net_cb;
fs/nfsd/netns.h-29-struct nfsd4_client_tracking_ops;
--
fs/nfsd/netns.h=31=enum {
--
fs/nfsd/netns.h-58- */
fs/nfsd/netns.h:59:struct nfsd_net {
fs/nfsd/netns.h-60-	struct cld_net *cld_net;
--
fs/nfsd/netns.h-232-
fs/nfsd/netns.h:233:	struct nfsd_net_cb	*nfsd_cb;
fs/nfsd/netns.h-234-};
--
fs/nfsd/netns.h=243=void nfsd_net_put(struct net *net);
fs/nfsd/netns.h-244-
fs/nfsd/netns.h:245:void nfsd_copy_write_verifier(__be32 verf[2], struct nfsd_net *nn);
fs/nfsd/netns.h:246:void nfsd_reset_write_verifier(struct nfsd_net *nn);
fs/nfsd/netns.h-247-#endif /* __NFSD_NETNS_H__ */
--
fs/nfsd/nfs4callback.c=1023=static const struct rpc_procinfo nfs4_cb_procedures[] = {
--
fs/nfsd/nfs4callback.c-1037-
fs/nfsd/nfs4callback.c:1038:struct nfsd_net_cb {
fs/nfsd/nfs4callback.c-1039-	struct rpc_version	version4;
--
fs/nfsd/nfs4callback.c=1045=static int max_cb_time(struct net *net)
fs/nfsd/nfs4callback.c-1046-{
fs/nfsd/nfs4callback.c:1047:	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
fs/nfsd/nfs4callback.c-1048-
--
fs/nfsd/nfs4callback.c=1116=static int setup_callback_client(struct nfs4_client *clp, struct nfs4_cb_conn *conn, struct nfsd4_session *ses)
fs/nfsd/nfs4callback.c-1117-{
fs/nfsd/nfs4callback.c:1118:	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
fs/nfsd/nfs4callback.c-1119-	int maxtime = max_cb_time(clp->net);
--
fs/nfsd/nfs4callback.c=1754=bool nfsd4_run_cb(struct nfsd4_callback *cb)
--
fs/nfsd/nfs4callback.c-1771- */
fs/nfsd/nfs4callback.c:1772:void nfsd_net_cb_shutdown(struct nfsd_net *nn)
fs/nfsd/nfs4callback.c-1773-{
fs/nfsd/nfs4callback.c:1774:	struct nfsd_net_cb *cb = nn->nfsd_cb;
fs/nfsd/nfs4callback.c-1775-
--
fs/nfsd/nfs4callback.c-1792- */
fs/nfsd/nfs4callback.c:1793:int nfsd_net_cb_init(struct nfsd_net *nn)
fs/nfsd/nfs4callback.c-1794-{
fs/nfsd/nfs4callback.c:1795:	struct nfsd_net_cb *cb;
fs/nfsd/nfs4callback.c-1796-
--
fs/nfsd/nfs4idmap.c=465=nfsd_idmap_init(struct net *net)
--
fs/nfsd/nfs4idmap.c-467-	int rv;
fs/nfsd/nfs4idmap.c:468:	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
fs/nfsd/nfs4idmap.c-469-
--
fs/nfsd/nfs4idmap.c=496=nfsd_idmap_shutdown(struct net *net)
fs/nfsd/nfs4idmap.c-497-{
fs/nfsd/nfs4idmap.c:498:	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
fs/nfsd/nfs4idmap.c-499-
--
fs/nfsd/nfs4idmap.c=539=idmap_name_to_id(struct svc_rqst *rqstp, int type, const char *name, u32 namelen,
--
fs/nfsd/nfs4idmap.c-545-	int ret;
fs/nfsd/nfs4idmap.c:546:	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
fs/nfsd/nfs4idmap.c-547-
--
fs/nfsd/nfs4idmap.c=577=static __be32 idmap_id_to_name(struct xdr_stream *xdr,
--
fs/nfsd/nfs4idmap.c-586-	int ret;
fs/nfsd/nfs4idmap.c:587:	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
fs/nfsd/nfs4idmap.c-588-
--
fs/nfsd/nfs4layouts.c=667=nfsd4_cb_layout_done(struct nfsd4_callback *cb, struct rpc_task *task)
--
fs/nfsd/nfs4layouts.c-670-		container_of(cb, struct nfs4_layout_stateid, ls_recall);
fs/nfsd/nfs4layouts.c:671:	struct nfsd_net *nn;
fs/nfsd/nfs4layouts.c-672-	ktime_t now, cutoff;
--
fs/nfsd/nfs4layouts.c=784=nfsd4_layout_fence_worker(struct work_struct *work)
--
fs/nfsd/nfs4layouts.c-791-	struct nfs4_client *clp;
fs/nfsd/nfs4layouts.c:792:	struct nfsd_net *nn;
fs/nfsd/nfs4layouts.c-793-
--
fs/nfsd/nfs4proc.c=559=nfsd4_open(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
--
fs/nfsd/nfs4proc.c-565-	struct net *net = SVC_NET(rqstp);
fs/nfsd/nfs4proc.c:566:	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
fs/nfsd/nfs4proc.c-567-	bool reclaim = false;
--
fs/nfsd/nfs4proc.c=1441=bool nfsd4_has_active_async_copies(struct nfs4_client *clp)
--
fs/nfsd/nfs4proc.c-1461- */
fs/nfsd/nfs4proc.c:1462:void nfsd4_async_copy_reaper(struct nfsd_net *nn)
fs/nfsd/nfs4proc.c-1463-{
--
fs/nfsd/nfs4proc.c=1566=void nfsd4_cancel_copy_by_sb(struct net *net, struct super_block *sb)
fs/nfsd/nfs4proc.c-1567-{
fs/nfsd/nfs4proc.c:1568:	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
fs/nfsd/nfs4proc.c-1569-	struct nfsd4_copy *copy, *tmp;
--
fs/nfsd/nfs4proc.c=1621=extern void nfs_sb_deactive(struct super_block *sb);
--
fs/nfsd/nfs4proc.c-1627- */
fs/nfsd/nfs4proc.c:1628:static __be32 nfsd4_ssc_setup_dul(struct nfsd_net *nn, char *ipaddr,
fs/nfsd/nfs4proc.c-1629-				  struct nfsd4_ssc_umount_item **nsui,
--
fs/nfsd/nfs4proc.c-1680-
fs/nfsd/nfs4proc.c:1681:static void nfsd4_ssc_update_dul(struct nfsd_net *nn,
fs/nfsd/nfs4proc.c-1682-				 struct nfsd4_ssc_umount_item *nsui,
--
fs/nfsd/nfs4proc.c-1691-
fs/nfsd/nfs4proc.c:1692:static void nfsd4_ssc_cancel_dul(struct nfsd_net *nn,
fs/nfsd/nfs4proc.c-1693-				 struct nfsd4_ssc_umount_item *nsui)
--
fs/nfsd/nfs4proc.c=1706=nfsd4_interssc_connect(struct nl4_server *nss, struct svc_rqst *rqstp,
--
fs/nfsd/nfs4proc.c-1717-	__be32 status = nfserr_inval;
fs/nfsd/nfs4proc.c:1718:	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
fs/nfsd/nfs4proc.c-1719-
--
fs/nfsd/nfs4proc.c=1839=nfsd4_cleanup_inter_ssc(struct nfsd4_ssc_umount_item *nsui, struct file *filp,
--
fs/nfsd/nfs4proc.c-1841-{
fs/nfsd/nfs4proc.c:1842:	struct nfsd_net *nn = net_generic(dst->nf_net, nfsd_net_id);
fs/nfsd/nfs4proc.c-1843-	long timeout = msecs_to_jiffies(nfsd4_ssc_umount_timeout);
--
fs/nfsd/nfs4proc.c=2135=nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
--
fs/nfsd/nfs4proc.c-2137-{
fs/nfsd/nfs4proc.c:2138:	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
fs/nfsd/nfs4proc.c-2139-	struct nfsd4_copy *async_copy = NULL;
--
fs/nfsd/nfs4proc.c=2267=nfsd4_offload_cancel(struct svc_rqst *rqstp,
--
fs/nfsd/nfs4proc.c-2276-	if (!copy) {
fs/nfsd/nfs4proc.c:2277:		struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
fs/nfsd/nfs4proc.c-2278-
--
fs/nfsd/nfs4proc.c=2287=nfsd4_copy_notify(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
--
fs/nfsd/nfs4proc.c-2291-	__be32 status;
fs/nfsd/nfs4proc.c:2292:	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
fs/nfsd/nfs4proc.c-2293-	struct nfs4_stid *stid = NULL;
--
fs/nfsd/nfs4proc.c=2907=nfsd4_proc_null(struct svc_rqst *rqstp)
--
fs/nfsd/nfs4proc.c-2911-
fs/nfsd/nfs4proc.c:2912:static inline void nfsd4_increment_op_stats(struct nfsd_net *nn, u32 opnum)
fs/nfsd/nfs4proc.c-2913-{
--
fs/nfsd/nfs4proc.c=3048=nfsd4_proc_compound(struct svc_rqst *rqstp)
--
fs/nfsd/nfs4proc.c-3055-	struct svc_fh *save_fh = &cstate->save_fh;
fs/nfsd/nfs4proc.c:3056:	struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
fs/nfsd/nfs4proc.c-3057-	struct nfsd_thread_local_info *ntli = rqstp->rq_private;
--
fs/nfsd/nfs4recover.c=57=struct nfsd4_client_tracking_ops {
--
fs/nfsd/nfs4recover.c-62-	int (*check)(struct nfs4_client *);
fs/nfsd/nfs4recover.c:63:	void (*grace_done)(struct nfsd_net *);
fs/nfsd/nfs4recover.c-64-	uint8_t version;
--
fs/nfsd/nfs4recover.c=111=__nfsd4_create_reclaim_record_grace(struct nfs4_client *clp,
fs/nfsd/nfs4recover.c:112:				    char *dname, struct nfsd_net *nn)
fs/nfsd/nfs4recover.c-113-{
--
fs/nfsd/nfs4recover.c=123=nfsd4_create_clid_dir(struct nfs4_client *clp)
--
fs/nfsd/nfs4recover.c-128-	int status;
fs/nfsd/nfs4recover.c:129:	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
fs/nfsd/nfs4recover.c-130-
--
fs/nfsd/nfs4recover.c-183-
fs/nfsd/nfs4recover.c:184:typedef int (recdir_func)(struct dentry *, char *, struct nfsd_net *);
fs/nfsd/nfs4recover.c-185-
--
fs/nfsd/nfs4recover.c=215=static int
fs/nfsd/nfs4recover.c:216:nfsd4_list_rec_dir(recdir_func *f, struct nfsd_net *nn)
fs/nfsd/nfs4recover.c-217-{
--
fs/nfsd/nfs4recover.c=256=static int
fs/nfsd/nfs4recover.c:257:nfsd4_unlink_clid_dir(char *name, struct nfsd_net *nn)
fs/nfsd/nfs4recover.c-258-{
--
fs/nfsd/nfs4recover.c=275=__nfsd4_remove_reclaim_record_grace(const char *dname, int len,
fs/nfsd/nfs4recover.c:276:		struct nfsd_net *nn)
fs/nfsd/nfs4recover.c-277-{
--
fs/nfsd/nfs4recover.c=295=nfsd4_remove_clid_dir(struct nfs4_client *clp)
--
fs/nfsd/nfs4recover.c-299-	int status;
fs/nfsd/nfs4recover.c:300:	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
fs/nfsd/nfs4recover.c-301-
--
fs/nfsd/nfs4recover.c=332=static int
fs/nfsd/nfs4recover.c:333:purge_old(struct dentry *parent, char *cname, struct nfsd_net *nn)
fs/nfsd/nfs4recover.c-334-{
--
fs/nfsd/nfs4recover.c=371=static void
fs/nfsd/nfs4recover.c:372:nfsd4_recdir_purge_old(struct nfsd_net *nn)
fs/nfsd/nfs4recover.c-373-{
--
fs/nfsd/nfs4recover.c=393=static int
fs/nfsd/nfs4recover.c:394:load_recdir(struct dentry *parent, char *cname, struct nfsd_net *nn)
fs/nfsd/nfs4recover.c-395-{
--
fs/nfsd/nfs4recover.c=410=nfsd4_recdir_load(struct net *net) {
fs/nfsd/nfs4recover.c-411-	int status;
fs/nfsd/nfs4recover.c:412:	struct nfsd_net *nn =  net_generic(net, nfsd_net_id);
fs/nfsd/nfs4recover.c-413-
--
fs/nfsd/nfs4recover.c=429=nfsd4_init_recdir(struct net *net)
fs/nfsd/nfs4recover.c-430-{
fs/nfsd/nfs4recover.c:431:	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
fs/nfsd/nfs4recover.c-432-	const struct cred *original_cred;
--
fs/nfsd/nfs4recover.c=463=nfsd4_shutdown_recdir(struct net *net)
fs/nfsd/nfs4recover.c-464-{
fs/nfsd/nfs4recover.c:465:	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
fs/nfsd/nfs4recover.c-466-
--
fs/nfsd/nfs4recover.c=474=nfs4_legacy_state_init(struct net *net)
fs/nfsd/nfs4recover.c-475-{
fs/nfsd/nfs4recover.c:476:	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
fs/nfsd/nfs4recover.c-477-	int i;
--
fs/nfsd/nfs4recover.c=492=nfs4_legacy_state_shutdown(struct net *net)
fs/nfsd/nfs4recover.c-493-{
fs/nfsd/nfs4recover.c:494:	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
fs/nfsd/nfs4recover.c-495-
--
fs/nfsd/nfs4recover.c=542=nfsd4_legacy_tracking_exit(struct net *net)
fs/nfsd/nfs4recover.c-543-{
fs/nfsd/nfs4recover.c:544:	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
fs/nfsd/nfs4recover.c-545-
--
fs/nfsd/nfs4recover.c=580=nfsd4_check_legacy_client(struct nfs4_client *clp)
--
fs/nfsd/nfs4recover.c-583-	struct nfs4_client_reclaim *crp;
fs/nfsd/nfs4recover.c:584:	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
fs/nfsd/nfs4recover.c-585-	struct xdr_netobj name;
--
fs/nfsd/nfs4recover.c=651=static int
fs/nfsd/nfs4recover.c:652:__cld_pipe_upcall(struct rpc_pipe *pipe, void *cmsg, struct nfsd_net *nn)
fs/nfsd/nfs4recover.c-653-{
--
fs/nfsd/nfs4recover.c=675=static int
fs/nfsd/nfs4recover.c:676:cld_pipe_upcall(struct rpc_pipe *pipe, void *cmsg, struct nfsd_net *nn)
fs/nfsd/nfs4recover.c-677-{
--
fs/nfsd/nfs4recover.c=692=__cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg,
fs/nfsd/nfs4recover.c:693:		struct nfsd_net *nn)
fs/nfsd/nfs4recover.c-694-{
--
fs/nfsd/nfs4recover.c=766=cld_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
--
fs/nfsd/nfs4recover.c-771-	uint32_t xid;
fs/nfsd/nfs4recover.c:772:	struct nfsd_net *nn = net_generic(file_inode(filp)->i_sb->s_fs_info,
fs/nfsd/nfs4recover.c-773-						nfsd_net_id);
--
fs/nfsd/nfs4recover.c=890=__nfsd4_init_cld_pipe(struct net *net)
--
fs/nfsd/nfs4recover.c-892-	int ret;
fs/nfsd/nfs4recover.c:893:	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
fs/nfsd/nfs4recover.c-894-	struct cld_net *cn;
--
fs/nfsd/nfs4recover.c=944=nfsd4_remove_cld_pipe(struct net *net)
fs/nfsd/nfs4recover.c-945-{
fs/nfsd/nfs4recover.c:946:	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
fs/nfsd/nfs4recover.c-947-	struct cld_net *cn = nn->cld_net;
--
fs/nfsd/nfs4recover.c=955=static struct cld_upcall *
fs/nfsd/nfs4recover.c:956:alloc_cld_upcall(struct nfsd_net *nn)
fs/nfsd/nfs4recover.c-957-{
--
fs/nfsd/nfs4recover.c=1000=nfsd4_cld_create(struct nfs4_client *clp)
--
fs/nfsd/nfs4recover.c-1003-	struct cld_upcall *cup;
fs/nfsd/nfs4recover.c:1004:	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
fs/nfsd/nfs4recover.c-1005-	struct cld_net *cn = nn->cld_net;
--
fs/nfsd/nfs4recover.c=1037=nfsd4_cld_create_v2(struct nfs4_client *clp)
--
fs/nfsd/nfs4recover.c-1040-	struct cld_upcall *cup;
fs/nfsd/nfs4recover.c:1041:	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
fs/nfsd/nfs4recover.c-1042-	struct cld_net *cn = nn->cld_net;
--
fs/nfsd/nfs4recover.c=1087=nfsd4_cld_remove(struct nfs4_client *clp)
--
fs/nfsd/nfs4recover.c-1090-	struct cld_upcall *cup;
fs/nfsd/nfs4recover.c:1091:	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
fs/nfsd/nfs4recover.c-1092-	struct cld_net *cn = nn->cld_net;
--
fs/nfsd/nfs4recover.c=1129=nfsd4_cld_check_v0(struct nfs4_client *clp)
--
fs/nfsd/nfs4recover.c-1132-	struct cld_upcall *cup;
fs/nfsd/nfs4recover.c:1133:	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
fs/nfsd/nfs4recover.c-1134-	struct cld_net *cn = nn->cld_net;
--
fs/nfsd/nfs4recover.c=1169=nfsd4_cld_check(struct nfs4_client *clp)
--
fs/nfsd/nfs4recover.c-1171-	struct nfs4_client_reclaim *crp;
fs/nfsd/nfs4recover.c:1172:	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
fs/nfsd/nfs4recover.c-1173-
--
fs/nfsd/nfs4recover.c=1211=nfsd4_cld_check_v2(struct nfs4_client *clp)
fs/nfsd/nfs4recover.c-1212-{
fs/nfsd/nfs4recover.c:1213:	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
fs/nfsd/nfs4recover.c-1214-#ifdef CONFIG_NFSD_LEGACY_CLIENT_TRACKING
--
fs/nfsd/nfs4recover.c=1270=static int
fs/nfsd/nfs4recover.c:1271:nfsd4_cld_grace_start(struct nfsd_net *nn)
fs/nfsd/nfs4recover.c-1272-{
--
fs/nfsd/nfs4recover.c=1297=static void
fs/nfsd/nfs4recover.c:1298:nfsd4_cld_grace_done_v0(struct nfsd_net *nn)
fs/nfsd/nfs4recover.c-1299-{
--
fs/nfsd/nfs4recover.c=1326=static void
fs/nfsd/nfs4recover.c:1327:nfsd4_cld_grace_done(struct nfsd_net *nn)
fs/nfsd/nfs4recover.c-1328-{
--
fs/nfsd/nfs4recover.c=1352=nfs4_cld_state_init(struct net *net)
fs/nfsd/nfs4recover.c-1353-{
fs/nfsd/nfs4recover.c:1354:	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
fs/nfsd/nfs4recover.c-1355-	int i;
--
fs/nfsd/nfs4recover.c=1372=nfs4_cld_state_shutdown(struct net *net)
fs/nfsd/nfs4recover.c-1373-{
fs/nfsd/nfs4recover.c:1374:	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
fs/nfsd/nfs4recover.c-1375-
--
fs/nfsd/nfs4recover.c=1380=static bool
fs/nfsd/nfs4recover.c:1381:cld_running(struct nfsd_net *nn)
fs/nfsd/nfs4recover.c-1382-{
--
fs/nfsd/nfs4recover.c=1389=static int
fs/nfsd/nfs4recover.c:1390:nfsd4_cld_get_version(struct nfsd_net *nn)
fs/nfsd/nfs4recover.c-1391-{
--
fs/nfsd/nfs4recover.c=1437=nfsd4_cld_tracking_init(struct net *net)
--
fs/nfsd/nfs4recover.c-1439-	int status;
fs/nfsd/nfs4recover.c:1440:	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
fs/nfsd/nfs4recover.c-1441-	bool running;
--
fs/nfsd/nfs4recover.c=1490=nfsd4_cld_tracking_exit(struct net *net)
fs/nfsd/nfs4recover.c-1491-{
fs/nfsd/nfs4recover.c:1492:	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
fs/nfsd/nfs4recover.c-1493-
--
fs/nfsd/nfs4recover.c=1719=nfsd4_umh_cltrack_init(struct net *net)
--
fs/nfsd/nfs4recover.c-1721-	int ret;
fs/nfsd/nfs4recover.c:1722:	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
fs/nfsd/nfs4recover.c-1723-	char *grace_start = nfsd4_cltrack_grace_start(nn->boot_time);
--
fs/nfsd/nfs4recover.c=1753=nfsd4_umh_cltrack_create(struct nfs4_client *clp)
--
fs/nfsd/nfs4recover.c-1755-	char *hexid, *has_session, *grace_start;
fs/nfsd/nfs4recover.c:1756:	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
fs/nfsd/nfs4recover.c-1757-
--
fs/nfsd/nfs4recover.c=1850=static void
fs/nfsd/nfs4recover.c:1851:nfsd4_umh_cltrack_grace_done(struct nfsd_net *nn)
fs/nfsd/nfs4recover.c-1852-{
--
fs/nfsd/nfs4recover.c=1873=static inline int check_for_legacy_methods(int status, struct net *net)
fs/nfsd/nfs4recover.c-1874-{
fs/nfsd/nfs4recover.c:1875:	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
fs/nfsd/nfs4recover.c-1876-	struct path path;
--
fs/nfsd/nfs4recover.c=1908=nfsd4_client_tracking_init(struct net *net)
fs/nfsd/nfs4recover.c-1909-{
fs/nfsd/nfs4recover.c:1910:	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
fs/nfsd/nfs4recover.c-1911-	int status;
--
fs/nfsd/nfs4recover.c=1944=nfsd4_client_tracking_exit(struct net *net)
fs/nfsd/nfs4recover.c-1945-{
fs/nfsd/nfs4recover.c:1946:	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
fs/nfsd/nfs4recover.c-1947-
--
fs/nfsd/nfs4recover.c=1956=nfsd4_client_record_create(struct nfs4_client *clp)
fs/nfsd/nfs4recover.c-1957-{
fs/nfsd/nfs4recover.c:1958:	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
fs/nfsd/nfs4recover.c-1959-
--
fs/nfsd/nfs4recover.c=1965=nfsd4_client_record_remove(struct nfs4_client *clp)
fs/nfsd/nfs4recover.c-1966-{
fs/nfsd/nfs4recover.c:1967:	struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
fs/nfsd/nfs4recover.c-1968-
--
fs/nfsd/nfs4recover.c=1974=nfsd4_client_record_check(struct nfs4_client *clp)

]

gemini-3.1-pro-preview

							input: 23707
							output: 38
							thoughts: 22
						

**My Thought Process on Exploring `fs/nfsd/netns.h`**

Alright, my immediate instinct upon encountering this task is to dive right into the code. The instruction points me to `fs/nfsd/netns.h` and specifically around line 59. This tells me the core of what I need to examine is likely within the scope of network namespace handling for the NFS server. Given my expertise in this area, I'm anticipating seeing structures or functions related to how NFS server instances are isolated or managed within different network namespaces.

I'll be looking for definitions, data structures, or function prototypes that clearly indicate their role in network namespace management. My hypothesis is that this header file will define the necessary hooks or data structures that allow an NFS server to be aware of and operate within the context of a specific network namespace. This could involve things like:

*   **`struct nfsd_net` or similar:** I'll be keen to find a structure that encapsulates NFS server-specific data for a given network namespace. This would likely hold per-namespace state.
*   **Registration/Unregistration functions:** How does an NFS server get associated with a network namespace, and how is it cleanly removed? I'd expect to see functions for this.
*   **Internal identifiers:** Are there unique identifiers used to reference NFS server instances within a namespace, or to link network namespace identifiers to NFS server contexts?
*   **Configuration or state pointers:** The code might reveal how network namespace configurations or states influence NFS server behavior.

My mental model is that the NFS server, being a network service, needs to respect network namespace isolation. This header file is the logical place to find the *definitions* of how that isolation is implemented at a structural level. It's less about the *logic* of *how* the NFS protocol itself operates within that namespace (which would be in other `.c` files), and more about the *framework* that enables it.

So, when I read around line 59, I'll be scanning for keywords like `net`, `netns`, `struct`, `init`, `exit`, `register`, `unregister`, and any data types that suggest per-namespace storage or management. I'm not just looking at the line number; I'm using it as a beacon to find the heart of the network namespace integration for the NFS server within this specific header. I'll be evaluating the definitions for clarity, completeness, and adherence to standard Linux kernel practices for namespace handling.

map[File:fs/nfsd/netns.h FirstLine:59 LineCount:100]

map[Contents:  59:	struct nfsd_net {
  60:		struct cld_net *cld_net;
  61:	
  62:		struct cache_detail *svc_expkey_cache;
  63:		struct cache_detail *svc_export_cache;
  64:	
  65:		struct cache_detail *idtoname_cache;
  66:		struct cache_detail *nametoid_cache;
  67:	
  68:		struct lock_manager nfsd4_manager;
  69:		bool grace_ended;
  70:		bool grace_end_forced;
  71:		time64_t boot_time;
  72:	
  73:		struct dentry *nfsd_client_dir;
  74:	
  75:		/*
  76:		 * reclaim_str_hashtbl[] holds known client info from previous reset/reboot
  77:		 * used in reboot/reset lease grace period processing
  78:		 *
  79:		 * conf_id_hashtbl[], and conf_name_tree hold confirmed
  80:		 * setclientid_confirmed info.
  81:		 *
  82:		 * unconf_str_hastbl[] and unconf_name_tree hold unconfirmed
  83:		 * setclientid info.
  84:		 */
  85:		struct list_head *reclaim_str_hashtbl;
  86:		int reclaim_str_hashtbl_size;
  87:		struct list_head *conf_id_hashtbl;
  88:		struct rb_root conf_name_tree;
  89:		struct list_head *unconf_id_hashtbl;
  90:		struct rb_root unconf_name_tree;
  91:		struct list_head *sessionid_hashtbl;
  92:		/*
  93:		 * client_lru holds client queue ordered by nfs4_client.cl_time
  94:		 * for lease renewal.
  95:		 *
  96:		 * close_lru holds (open) stateowner queue ordered by nfs4_stateowner.so_time
  97:		 * for last close replay.
  98:		 *
  99:		 * All of the above fields are protected by the client_mutex.
 100:		 */
 101:		struct list_head client_lru;
 102:		struct list_head close_lru;
 103:	
 104:		/* protects del_recall_lru and delegation hash/unhash */
 105:		spinlock_t deleg_lock ____cacheline_aligned;
 106:		struct list_head del_recall_lru;
 107:	
 108:		/* protected by blocked_locks_lock */
 109:		struct list_head blocked_locks_lru;
 110:	
 111:		struct delayed_work laundromat_work;
 112:	
 113:		/* client_lock protects the client lru list and session hash table */
 114:		spinlock_t client_lock;
 115:	
 116:		/* protects blocked_locks_lru */
 117:		spinlock_t blocked_locks_lock;
 118:	
 119:		struct file *rec_file;
 120:		bool in_grace;
 121:		const struct nfsd4_client_tracking_ops *client_tracking_ops;
 122:	
 123:		time64_t nfsd4_lease;
 124:		time64_t nfsd4_grace;
 125:		bool somebody_reclaimed;
 126:	
 127:		bool track_reclaim_completes;
 128:		atomic_t nr_reclaim_complete;
 129:	
 130:		bool nfsd_net_up;
 131:		bool lockd_up;
 132:	
 133:		seqlock_t writeverf_lock;
 134:		unsigned char writeverf[8];
 135:	
 136:		/*
 137:		 * Minimum number of threads to run per pool.  If 0 then the
 138:		 * min == max requested number of threads.
 139:		 */
 140:		unsigned int min_threads;
 141:	
 142:		u32 clientid_base;
 143:		u32 clientid_counter;
 144:		u32 clverifier_counter;
 145:	
 146:		struct svc_info nfsd_info;
 147:	#define nfsd_serv nfsd_info.serv
 148:	
 149:		struct percpu_ref nfsd_net_ref;
 150:		struct completion nfsd_net_confirm_done;
 151:		struct completion nfsd_net_free_done;
 152:	
 153:		/*
 154:		 * clientid and stateid data for construction of net unique COPY
 155:		 * stateids.
 156:		 */
 157:		u32		s2s_cp_cl_id;
 158:		struct idr	s2s_cp_stateids;
]

gemini-3.1-pro-preview

							input: 25167
							output: 39
							thoughts: 7
						

**My Thought Process**

I need to delve deeper into this material. My initial scan has given me a general understanding, but I'm sensing there's more nuance and critical detail to uncover. I'm going to read further down, specifically looking for information that either supports, refines, or potentially challenges my current interpretations. I want to ensure I'm grasping the full scope of the argument, the underlying evidence, and any implicit assumptions. My goal is to move beyond a superficial reading and engage with the substance of the text at a more profound level, anticipating the kind of detailed analysis that is expected in my field.

map[File:fs/nfsd/netns.h FirstLine:159 LineCount:100]

map[Contents: 159:		spinlock_t	s2s_cp_lock;
 160:		atomic_t	pending_async_copies;
 161:	
 162:		/*
 163:		 * Version information
 164:		 */
 165:		bool nfsd_versions[NFSD_MAXVERS + 1];
 166:		bool nfsd4_minorversions[NFSD_SUPPORTED_MINOR_VERSION + 1];
 167:	
 168:		/*
 169:		 * Duplicate reply cache
 170:		 */
 171:		struct nfsd_drc_bucket   *drc_hashtbl;
 172:	
 173:		/* max number of entries allowed in the cache */
 174:		unsigned int             max_drc_entries;
 175:	
 176:		/* number of significant bits in the hash value */
 177:		unsigned int             maskbits;
 178:		unsigned int             drc_hashsize;
 179:	
 180:		/*
 181:		 * Stats and other tracking of on the duplicate reply cache.
 182:		 * The longest_chain* fields are modified with only the per-bucket
 183:		 * cache lock, which isn't really safe and should be fixed if we want
 184:		 * these statistics to be completely accurate.
 185:		 */
 186:	
 187:		/* total number of entries */
 188:		atomic_t                 num_drc_entries;
 189:	
 190:		/* Per-netns stats counters */
 191:		struct percpu_counter    counter[NFSD_STATS_COUNTERS_NUM];
 192:	
 193:		/* sunrpc svc stats */
 194:		struct svc_stat          nfsd_svcstats;
 195:	
 196:		/* longest hash chain seen */
 197:		unsigned int             longest_chain;
 198:	
 199:		/* size of cache when we saw the longest hash chain */
 200:		unsigned int             longest_chain_cachesize;
 201:	
 202:		struct shrinker		*nfsd_reply_cache_shrinker;
 203:	
 204:		/* tracking server-to-server copy mounts */
 205:		spinlock_t              nfsd_ssc_lock;
 206:		struct list_head        nfsd_ssc_mount_list;
 207:		wait_queue_head_t       nfsd_ssc_waitq;
 208:	
 209:		/* utsname taken from the process that starts the server */
 210:		char			nfsd_name[UNX_MAXNODENAME+1];
 211:	
 212:		struct nfsd_fcache_disposal *fcache_disposal;
 213:	
 214:		siphash_key_t		siphash_key;
 215:	
 216:		atomic_t		nfs4_client_count;
 217:		int			nfs4_max_clients;
 218:	
 219:		atomic_t		nfsd_courtesy_clients;
 220:		struct shrinker		*nfsd_client_shrinker;
 221:		struct work_struct	nfsd_shrinker_work;
 222:	
 223:		/* last time an admin-revoke happened for NFSv4.0 */
 224:		time64_t		nfs40_last_revoke;
 225:	
 226:	#if IS_ENABLED(CONFIG_NFS_LOCALIO)
 227:		/* Local clients to be invalidated when net is shut down */
 228:		spinlock_t              local_clients_lock;
 229:		struct list_head	local_clients;
 230:	#endif
 231:		siphash_key_t		*fh_key;
 232:	
 233:		struct nfsd_net_cb	*nfsd_cb;
 234:	};
 235:	
 236:	/* Simple check to find out if a given net was properly initialized */
 237:	#define nfsd_netns_ready(nn) ((nn)->sessionid_hashtbl)
 238:	
 239:	extern bool nfsd_support_version(int vers);
 240:	extern unsigned int nfsd_net_id;
 241:	
 242:	bool nfsd_net_try_get(struct net *net);
 243:	void nfsd_net_put(struct net *net);
 244:	
 245:	void nfsd_copy_write_verifier(__be32 verf[2], struct nfsd_net *nn);
 246:	void nfsd_reset_write_verifier(struct nfsd_net *nn);
 247:	#endif /* __NFSD_NETNS_H__ */
]

gemini-3.1-pro-preview

							input: 26564
							output: 37
							thoughts: 40
						

**My Internal Monologue on NFS Server Statistics**

Alright, so I'm digging into the NFS server's performance monitoring, and I've just zeroed in on `nfsd_svcstats`. My initial thought is that this isn't some independently allocated structure; rather, it's directly embedded within `struct nfsd_net`. This is an important detail for how it's managed and potentially accessed. My immediate next step, therefore, is to understand the composition of `struct svc_stat` itself. I need to see what metrics and fields are actually contained within it to grasp the full picture of the statistics being collected and how they relate to the per-network namespace aspect of the NFS server.

map[ContextFile:fs/nfsd/netns.h Name:svc_stat]

map[SourceCode:  29:	struct svc_stat {
  30:		struct svc_program *	program;
  31:	
  32:		unsigned int		netcnt,
  33:					netudpcnt,
  34:					nettcpcnt,
  35:					nettcpconn;
  36:		unsigned int		rpccnt,
  37:					rpcbadfmt,
  38:					rpcbadauth,
  39:					rpcbadclnt;
  40:	};
 SourceFile:include/linux/sunrpc/stats.h]

gemini-3.1-pro-preview

							input: 26780
							output: 35
							thoughts: 121
						

**My Debugging Thought Process**

Okay, so I'm looking at this crash, and the traceback points to `percpu_counter_add_batch` which is called by `percpu_counter_inc` with `&xprt->xpt_server->sv_stats->sockets_queued`. My initial thought was, "Alright, `sv_stats` is a pointer to `struct svc_stat`, so `sockets_queued` *should* be in there."

But then I stopped myself. "Hold on a second," I thought. "That doesn't seem right. I'm pretty sure `sockets_queued` isn't actually a member of `struct svc_stat`." This is where the real digging begins. My internal knowledge base is screaming at me that this field access is likely the root cause.

So, the next step is a direct verification. I'm going to pull up the definition of `struct svc_stat` again, just to be absolutely certain. And, as I suspected, it's not there. This confirms my suspicion.

Now, where *is* `sv_stats` coming from? The traceback shows it's part of `xprt->xpt_server`. So, the focus shifts to `xprt->xpt_server`. My mental model, or my actual look-up, tells me that `xprt->xpt_server` is a pointer to `struct svc_serv`. This is a crucial connection.

Therefore, the next logical step is to examine the definition of `struct svc_serv`. I need to see how `sv_stats` is defined within that structure. This is where I anticipate finding the actual location of `sockets_queued`, or perhaps realizing that `sv_stats` itself is a pointer to a different structure entirely, and the confusion stems from that indirectness. My goal is to trace the pointer chain to its logical conclusion and pinpoint the incorrect access.

map[ContextFile:net/sunrpc/svc.c Name:svc_serv]

map[SourceCode:  62:	/*
  63:	 * RPC service.
  64:	 *
  65:	 * An RPC service is a ``daemon,'' possibly multithreaded, which
  66:	 * receives and processes incoming RPC messages.
  67:	 * It has one or more transport sockets associated with it, and maintains
  68:	 * a list of idle threads waiting for input.
  69:	 *
  70:	 * We currently do not support more than one RPC program per daemon.
  71:	 */
  72:	struct svc_serv {
  73:		struct svc_program *	sv_programs;	/* RPC programs */
  74:		struct svc_stat *	sv_stats;	/* RPC statistics */
  75:		spinlock_t		sv_lock;
  76:		unsigned int		sv_nprogs;	/* Number of sv_programs */
  77:		unsigned int		sv_nrthreads;	/* # of running server threads */
  78:		unsigned int		sv_max_payload;	/* datagram payload size */
  79:		unsigned int		sv_max_mesg;	/* max_payload + 1 page for overheads */
  80:		unsigned int		sv_xdrsize;	/* XDR buffer size */
  81:		struct list_head	sv_permsocks;	/* all permanent sockets */
  82:		struct list_head	sv_tempsocks;	/* all temporary sockets */
  83:		int			sv_tmpcnt;	/* count of temporary "valid" sockets */
  84:		struct timer_list	sv_temptimer;	/* timer for aging temporary sockets */
  85:	
  86:		char *			sv_name;	/* service name */
  87:	
  88:		unsigned int		sv_nrpools;	/* number of thread pools */
  89:		bool			sv_is_pooled;	/* is this a pooled service? */
  90:		struct svc_pool *	sv_pools;	/* array of thread pools */
  91:		int			(*sv_threadfn)(void *data);
  92:	
  93:	#if defined(CONFIG_SUNRPC_BACKCHANNEL)
  94:		struct lwq		sv_cb_list;	/* queue for callback requests
  95:							 * that arrive over the same
  96:							 * connection */
  97:		bool			sv_bc_enabled;	/* service uses backchannel */
  98:	#endif /* CONFIG_SUNRPC_BACKCHANNEL */
  99:	};
 SourceFile:include/linux/sunrpc/svc.h]

gemini-3.1-pro-preview

							input: 27583
							output: 17
							thoughts: 21
						

**My Thought Process for Locating `sockets_queued`**

I'm currently trying to understand the intricacies of this system, and a particular variable, `sockets_queued`, has piqued my interest. I've been reviewing the codebase, or perhaps some documentation, and I can't seem to immediately place where `sockets_queued` is defined or used. This is a bit of a sticking point for me, as I usually have a good grasp of where such critical state variables reside.

My immediate inclination is to perform a systematic search. Given that I'm in a context where code is accessible, the most efficient way to do this is to leverage a powerful text-searching tool. My go-to for this kind of exploration is `grep`. I'm planning to execute a `grep` command to search for all occurrences of the string `sockets_queued` across the relevant codebase or files. This will hopefully reveal its definition, any functions that modify it, or any contexts where it's being read. It's a straightforward but highly effective way to get to the bottom of this particular query and re-establish the missing piece of context in my understanding.

map[Expression:sockets_queued]

map[Output:include/linux/sunrpc/svc.h=36=struct svc_pool {
--
include/linux/sunrpc/svc.h-46-	struct percpu_counter	sp_messages_arrived;
include/linux/sunrpc/svc.h:47:	struct percpu_counter	sp_sockets_queued;
include/linux/sunrpc/svc.h-48-	struct percpu_counter	sp_threads_woken;
--
net/sunrpc/svc.c=483=__svc_create(struct svc_program *prog, int nprogs, struct svc_stat *stats,
--
net/sunrpc/svc.c-543-		percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL);
net/sunrpc/svc.c:544:		percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL);
net/sunrpc/svc.c-545-		percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL);
--
net/sunrpc/svc.c=601=svc_destroy(struct svc_serv **servp)
--
net/sunrpc/svc.c-627-		percpu_counter_destroy(&pool->sp_messages_arrived);
net/sunrpc/svc.c:628:		percpu_counter_destroy(&pool->sp_sockets_queued);
net/sunrpc/svc.c-629-		percpu_counter_destroy(&pool->sp_threads_woken);
--
net/sunrpc/svc_xprt.c=507=void svc_xprt_enqueue(struct svc_xprt *xprt)
--
net/sunrpc/svc_xprt.c-523-
net/sunrpc/svc_xprt.c:524:	percpu_counter_inc(&pool->sp_sockets_queued);
net/sunrpc/svc_xprt.c-525-	xprt->xpt_qtime = ktime_get();
--
net/sunrpc/svc_xprt.c=1554=static int svc_pool_stats_show(struct seq_file *m, void *p)
--
net/sunrpc/svc_xprt.c-1565-		   percpu_counter_sum_positive(&pool->sp_messages_arrived),
net/sunrpc/svc_xprt.c:1566:		   percpu_counter_sum_positive(&pool->sp_sockets_queued),
net/sunrpc/svc_xprt.c-1567-		   percpu_counter_sum_positive(&pool->sp_threads_woken));
]

gemini-3.1-pro-preview

							input: 28294
							output: 36
							thoughts: 258
						

**My Debugging Journey: Tracing a Kernel Crash**

My current focus is a perplexing kernel crash, and I've managed to pinpoint its origin. It appears to be happening specifically at the `percpu_counter_inc(&pool->sp_sockets_queued);` line within the `svc_xprt_enqueue` function. This is a critical piece of information, as it narrows down the search considerably.

Looking at the stack trace, it confirms this: the crash is indeed a consequence of `percpu_counter_inc`, which is called from within `svc_xprt_enqueue`. The trace also clearly shows the call path leading up to it.

Now, I'm digging into the initialization of the `percpu_counter` itself. I recall that in `__svc_create`, there are calls to `percpu_counter_init` for `sp_messages_arrived`, `sp_sockets_queued`, and `sp_threads_woken`. This is where my suspicion is now firmly rooted.

The crucial detail I've just remembered, or rather, discovered, is that `percpu_counter_init` *can fail*. It returns an `int`, indicating success or failure. My immediate next step is to meticulously examine the source code for `__svc_create` to determine if the return value of `percpu_counter_init` is actually being checked. If it's not, then a failure during initialization could absolutely lead to the observed crash later on when the counter is incremented. This seems like the most logical path forward.

map[File:net/sunrpc/svc.c FirstLine:530 LineCount:30]

map[Contents: 530:		}
 531:	
 532:		for (i = 0; i < serv->sv_nrpools; i++) {
 533:			struct svc_pool *pool = &serv->sv_pools[i];
 534:	
 535:			dprintk("svc: initialising pool %u for %s\n",
 536:					i, serv->sv_name);
 537:	
 538:			pool->sp_id = i;
 539:			lwq_init(&pool->sp_xprts);
 540:			INIT_LIST_HEAD(&pool->sp_all_threads);
 541:			init_llist_head(&pool->sp_idle_threads);
 542:	
 543:			percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL);
 544:			percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL);
 545:			percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL);
 546:		}
 547:	
 548:		return serv;
 549:	}
 550:	
 551:	/**
 552:	 * svc_create - Create an RPC service
 553:	 * @prog: the RPC program the new service will handle
 554:	 * @bufsize: maximum message size for @prog
 555:	 * @threadfn: a function to service RPC requests for @prog
 556:	 *
 557:	 * Returns an instantiated struct svc_serv object or NULL.
 558:	 */
 559:	struct svc_serv *svc_create(struct svc_program *prog, unsigned int bufsize,
]

gemini-3.1-pro-preview

							input: 29060
							output: 18
							thoughts: 2417
						

**The Root of the Problem: Ignored Errors and Uninitialized Per-CPU Counters**

My investigation into this NFS kernel crash has led me to a rather subtle, yet critical, bug. It all stems from how `__svc_create` handles the initialization of per-CPU counters. I noticed that `__svc_create` calls `percpu_counter_init` for several counters, such as `sp_messages_arrived`, `sp_sockets_queued`, and `sp_threads_woken`. The key issue is that it completely ignores the return value of `percpu_counter_init`.

Now, this might seem benign, but imagine a scenario where `percpu_counter_init` fails. This could happen, for instance, due to fault injection, where the kernel is deliberately made to fail memory allocations. If `percpu_counter_init` fails, the corresponding counter (`pool->sp_sockets_queued`, for example) will not be properly initialized; its underlying memory will effectively be NULL or in an uninitialized state.

The real problem surfaces later, when `svc_xprt_enqueue` is called. This function attempts to increment one of these uninitialized per-CPU counters by accessing `pool->sp_sockets_queued.counters`. Since `counters` is not properly set up due to the ignored failure of `percpu_counter_init`, this access results in a NULL pointer dereference, leading to a page fault and, consequently, a kernel crash.

**Developing a Reproducer: A Strategy of Controlled Chaos**

Understanding this mechanism, my strategy for reproducing the crash became clear:

1.  **Set the Stage:** I need to enable kernel fault injection. This means mounting `debugfs` and then configuring `failslab` and `fail_page_alloc` to have a non-zero probability of failing memory allocations. I opted for a 5% probability (`"5"`) as a starting point, aiming for a balance between triggering failures and not overwhelming the system. I also configured these modules to apply to specific tasks (`"Y"`) and to not wait for memory allocations (`"N"` for `ignore-gfp-wait`).

2.  **Trigger the Target Code Path:** The goal is to reach the `__svc_create` function. My analysis pointed to writing to `/tmp/nfsd/portlist` as the entry point. Specifically, writing `"tcp 2049"` to this file triggers a sequence of calls: `nfsd_create_serv` -> `__svc_create`.

3.  **Introduce the Failure:** With fault injection active, the hope is that during the execution of `__svc_create`, one of the `percpu_counter_init` calls will fail due to the injected faults.

4.  **Observe the Crash:** If the above steps are successful, the subsequent call to `svc_xprt_enqueue` will encounter the uninitialized per-CPU counter, leading to the expected page fault and crash.

**Refining the Reproduction: Tracing the Call Chain**

Initially, I thought `svc_xprt_enqueue` was directly called by the `write` operation on `/tmp/nfsd/portlist`. However, a deeper dive into the call stack revealed a more intricate path: `write_ports` -> `__write_ports_addxprt` -> `svc_xprt_create` -> `svc_xprt_create_from_sa` -> `_svc_xprt_create` -> `svc_add_new_perm_xprt` -> `svc_xprt_received` -> `svc_xprt_enqueue`. This confirms that the write operation indeed leads to the desired `svc_xprt_enqueue` call, but through a series of intermediate functions.

**The C Program: Orchestrating the Reproducer**

To make this reproducible, I've developed a C program that automates these steps. It handles mounting debugfs, configuring the fault injection parameters, creating the `/tmp/nfsd` directory, and then enters a loop of forked processes. Each child process:

*   Unshares network and mount namespaces (`unshare(CLONE_NEWNET | CLONE_NEWNS)`).
*   Brings the loopback interface up.
*   Attempts to mount `nfsd`.
*   Opens `/tmp/nfsd/portlist`.
*   Crucially, it uses `/proc/self/make-it-fail` to potentially guide fault injection to the current process and then writes `"tcp 2049"` to the `portlist`. The `/proc/self/make-it-fail` is a mechanism to try and ensure the fault injection targets the specific process we are interested in.
*   Finally, it resets `/proc/self/make-it-fail` and exits.

The parent process waits for each child to complete and reports progress every 100 iterations. This loop structure with many iterations is designed to increase the probability of hitting the specific, albeit rare, combination of successful memory allocations for the NFS server structures themselves, coupled with a failure in one of the `percpu_counter_init` calls within `__svc_create`.

**Addressing Concerns: Per-CPU Allocation and Fault Injection Scope**

A pertinent question is whether `failslab` or `fail_page_alloc` actually affect the per-CPU memory allocations performed by `percpu_counter_init` via `__alloc_percpu_gfp` and `pcpu_alloc`. My understanding is that `pcpu_alloc` ultimately relies on underlying memory allocation mechanisms like `kmalloc` or `vmalloc` (via `pcpu_mem_zalloc`), which are indeed susceptible to `failslab`.

Furthermore, I've considered that if critical allocations *before* `percpu_counter_init` fail (like the `struct svc_serv` or `serv->sv_pools`), the crash wouldn't occur as intended. The `nfsd_create_serv` and `svc_create_pooled` functions perform these allocations. The strategy relies on a delicate balance: enough memory must be successfully allocated to get to `__svc_create`, but just enough for one of the subsequent `percpu_counter_init` calls to fail, while the critical path to `svc_xprt_enqueue` remains intact. The looping and fault injection probability are intended to navigate this "needle in a haystack" scenario.

The use of `/proc/self/make-it-fail` is an attempt to refine the fault injection's scope, hoping to increase the chance that the injected fault occurs during the relevant per-CPU counter initialization rather than during the `write` system call itself, which might occur earlier in the code path. The entire endeavor is a meticulous dance between enabling faults and carefully tracing the execution flow to isolate the specific failure point.

map[Expression:pcpu_alloc]

map[Output:arch/s390/kernel/smp.c=174=static void pcpu_ec_call(struct pcpu *pcpu, int ec_bit)
--
arch/s390/kernel/smp.c-181-
arch/s390/kernel/smp.c:182:static int pcpu_alloc_lowcore(struct pcpu *pcpu, int cpu)
arch/s390/kernel/smp.c-183-{
--
arch/s390/kernel/smp.c=855=int __cpu_up(unsigned int cpu, struct task_struct *tidle)
--
arch/s390/kernel/smp.c-865-
arch/s390/kernel/smp.c:866:	rc = pcpu_alloc_lowcore(pcpu, cpu);
arch/s390/kernel/smp.c-867-	if (rc)
--
include/linux/percpu.h=79=struct pcpu_group_info {
--
include/linux/percpu.h-85-
include/linux/percpu.h:86:struct pcpu_alloc_info {
include/linux/percpu.h-87-	size_t			static_size;
--
include/linux/percpu.h=110=typedef int (pcpu_fc_cpu_distance_fn_t)(unsigned int from, unsigned int to);
include/linux/percpu.h-111-
include/linux/percpu.h:112:extern struct pcpu_alloc_info * __init pcpu_alloc_alloc_info(int nr_groups,
include/linux/percpu.h-113-							     int nr_units);
include/linux/percpu.h:114:extern void __init pcpu_free_alloc_info(struct pcpu_alloc_info *ai);
include/linux/percpu.h-115-
include/linux/percpu.h:116:extern void __init pcpu_setup_first_chunk(const struct pcpu_alloc_info *ai,
include/linux/percpu.h-117-					 void *base_addr);
--
include/linux/percpu.h=134=extern void __init setup_per_cpu_areas(void);
--
include/linux/percpu.h-136-
include/linux/percpu.h:137:extern void __percpu *pcpu_alloc_noprof(size_t size, size_t align, bool reserved,
include/linux/percpu.h-138-				   gfp_t gfp) __alloc_size(1);
--
include/linux/percpu.h-140-#define __alloc_percpu_gfp(_size, _align, _gfp)				\
include/linux/percpu.h:141:	alloc_hooks(pcpu_alloc_noprof(_size, _align, false, _gfp))
include/linux/percpu.h-142-#define __alloc_percpu(_size, _align)					\
include/linux/percpu.h:143:	alloc_hooks(pcpu_alloc_noprof(_size, _align, false, GFP_KERNEL))
include/linux/percpu.h-144-#define __alloc_reserved_percpu(_size, _align)				\
include/linux/percpu.h:145:	alloc_hooks(pcpu_alloc_noprof(_size, _align, true, GFP_KERNEL))
include/linux/percpu.h-146-
--
include/linux/percpu.h-153-#define alloc_percpu_noprof(type)					\
include/linux/percpu.h:154:	((typeof(type) __percpu *)pcpu_alloc_noprof(sizeof(type),	\
include/linux/percpu.h-155-					__alignof__(type), false, GFP_KERNEL))
--
lib/debugobjects.c=236=static void pcpu_refill_stats(void)
--
lib/debugobjects.c-248-
lib/debugobjects.c:249:static struct debug_obj *pcpu_alloc(void)
lib/debugobjects.c-250-{
--
lib/debugobjects.c=467=static struct debug_obj *alloc_object(void *addr, struct debug_bucket *b,
--
lib/debugobjects.c-474-	if (static_branch_likely(&obj_cache_enabled))
lib/debugobjects.c:475:		obj = pcpu_alloc();
lib/debugobjects.c-476-	else
--
lib/debugobjects.c=1502=static bool __init debug_objects_replace_static_objects(struct kmem_cache *cache)
--
lib/debugobjects.c-1523-		hlist_for_each_entry(obj, &objects, node) {
lib/debugobjects.c:1524:			struct debug_obj *new = pcpu_alloc();
lib/debugobjects.c-1525-
--
lib/test_vmalloc.c=44=__param(int, run_test_mask, 7,
--
lib/test_vmalloc.c-52-		"\t\tid: 64,   name: align_shift_alloc_test\n"
lib/test_vmalloc.c:53:		"\t\tid: 128,  name: pcpu_alloc_test\n"
lib/test_vmalloc.c-54-		"\t\tid: 256,  name: kvfree_rcu_1_arg_vmalloc_test\n"
--
lib/test_vmalloc.c=62=__param(int, nr_pcpu_objects, 35000,
lib/test_vmalloc.c:63:	"Number of pcpu objects to allocate for pcpu_alloc_test");
lib/test_vmalloc.c-64-
--
lib/test_vmalloc.c=315=static int
lib/test_vmalloc.c:316:pcpu_alloc_test(void)
lib/test_vmalloc.c-317-{
--
lib/test_vmalloc.c=491=static struct test_case_desc test_case_array[] = {
--
lib/test_vmalloc.c-498-	{ "align_shift_alloc_test", align_shift_alloc_test, true },
lib/test_vmalloc.c:499:	{ "pcpu_alloc_test", pcpu_alloc_test, },
lib/test_vmalloc.c-500-	{ "kvfree_rcu_1_arg_vmalloc_test", kvfree_rcu_1_arg_vmalloc_test, },
--
mm/percpu-internal.h=180=extern struct percpu_stats pcpu_stats;
mm/percpu-internal.h:181:extern struct pcpu_alloc_info pcpu_stats_ai;
mm/percpu-internal.h-182-
--
mm/percpu-internal.h-185- */
mm/percpu-internal.h:186:static inline void pcpu_stats_save_ai(const struct pcpu_alloc_info *ai)
mm/percpu-internal.h-187-{
mm/percpu-internal.h:188:	memcpy(&pcpu_stats_ai, ai, sizeof(struct pcpu_alloc_info));
mm/percpu-internal.h-189-
--
mm/percpu-internal.h=254=static inline void pcpu_stats_chunk_dealloc(void)
--
mm/percpu-internal.h-265-
mm/percpu-internal.h:266:static inline void pcpu_stats_save_ai(const struct pcpu_alloc_info *ai)
mm/percpu-internal.h-267-{
--
mm/percpu-km.c=53=static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp)
--
mm/percpu-km.c-60-
mm/percpu-km.c:61:	chunk = pcpu_alloc_chunk(gfp);
mm/percpu-km.c-62-	if (!chunk)
--
mm/percpu-km.c=102=static struct page *pcpu_addr_to_page(void *addr)
--
mm/percpu-km.c-106-
mm/percpu-km.c:107:static int __init pcpu_verify_alloc_info(const struct pcpu_alloc_info *ai)
mm/percpu-km.c-108-{
--
mm/percpu-stats.c=21=struct percpu_stats pcpu_stats;
mm/percpu-stats.c:22:struct pcpu_alloc_info pcpu_stats_ai;
mm/percpu-stats.c-23-
--
mm/percpu-vm.c=13=static struct page *pcpu_chunk_page(struct pcpu_chunk *chunk,
--
mm/percpu-vm.c-26- * with pcpu_page_idx().  Note that there is only one array and accesses
mm/percpu-vm.c:27: * should be serialized by pcpu_alloc_mutex.
mm/percpu-vm.c-28- *
--
mm/percpu-vm.c=32=static struct page **pcpu_get_pages(void)
--
mm/percpu-vm.c-36-
mm/percpu-vm.c:37:	lockdep_assert_held(&pcpu_alloc_mutex);
mm/percpu-vm.c-38-
--
mm/percpu-vm.c=54=static void pcpu_free_pages(struct pcpu_chunk *chunk,
--
mm/percpu-vm.c-70-/**
mm/percpu-vm.c:71: * pcpu_alloc_pages - allocates pages for @chunk
mm/percpu-vm.c-72- * @chunk: target chunk
--
mm/percpu-vm.c-81- */
mm/percpu-vm.c:82:static int pcpu_alloc_pages(struct pcpu_chunk *chunk,
mm/percpu-vm.c-83-			    struct page **pages, int page_start, int page_end,
--
mm/percpu-vm.c=255=static void pcpu_post_map_flush(struct pcpu_chunk *chunk,
--
mm/percpu-vm.c-273- * CONTEXT:
mm/percpu-vm.c:274: * pcpu_alloc_mutex, does GFP_KERNEL allocation.
mm/percpu-vm.c-275- */
mm/percpu-vm.c=276=static int pcpu_populate_chunk(struct pcpu_chunk *chunk,
--
mm/percpu-vm.c-284-
mm/percpu-vm.c:285:	if (pcpu_alloc_pages(chunk, pages, page_start, page_end, gfp))
mm/percpu-vm.c-286-		return -ENOMEM;
--
mm/percpu-vm.c-309- * CONTEXT:
mm/percpu-vm.c:310: * pcpu_alloc_mutex.
mm/percpu-vm.c-311- */
--
mm/percpu-vm.c=333=static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp)
--
mm/percpu-vm.c-337-
mm/percpu-vm.c:338:	chunk = pcpu_alloc_chunk(gfp);
mm/percpu-vm.c-339-	if (!chunk)
--
mm/percpu-vm.c=371=static struct page *pcpu_addr_to_page(void *addr)
--
mm/percpu-vm.c-375-
mm/percpu-vm.c:376:static int __init pcpu_verify_alloc_info(const struct pcpu_alloc_info *ai)
mm/percpu-vm.c-377-{
--
mm/percpu.c=171=DEFINE_SPINLOCK(pcpu_lock);	/* all internal data structures */
mm/percpu.c:172:static DEFINE_MUTEX(pcpu_alloc_mutex);	/* chunk create/destroy, [de]pop, map ext */
mm/percpu.c-173-
--
mm/percpu.c=630=static void pcpu_block_update(struct pcpu_block_md *block, int start, int end)
--
mm/percpu.c-702- * Finding the final allocation spot first goes through pcpu_find_block_fit()
mm/percpu.c:703: * to find a block that can hold the allocation and then pcpu_alloc_area()
mm/percpu.c-704- * where a scan is used.  When allocations require specific alignments,
--
mm/percpu.c=1161=static unsigned long pcpu_find_zero_area(unsigned long *map,
--
mm/percpu.c-1197-/**
mm/percpu.c:1198: * pcpu_alloc_area - allocates an area from a pcpu_chunk
mm/percpu.c-1199- * @chunk: chunk of interest
--
mm/percpu.c-1215- */
mm/percpu.c:1216:static int pcpu_alloc_area(struct pcpu_chunk *chunk, int alloc_bits,
mm/percpu.c-1217-			   size_t align, int start)
--
mm/percpu.c=1325=static void pcpu_init_md_blocks(struct pcpu_chunk *chunk)
--
mm/percpu.c-1338-/**
mm/percpu.c:1339: * pcpu_alloc_first_chunk - creates chunks that serve the first chunk
mm/percpu.c-1340- * @tmp_addr: the start of the region served
--
mm/percpu.c-1350- */
mm/percpu.c:1351:static struct pcpu_chunk * __init pcpu_alloc_first_chunk(unsigned long tmp_addr,
mm/percpu.c-1352-							 int map_size)
--
mm/percpu.c-1430-
mm/percpu.c:1431:static struct pcpu_chunk *pcpu_alloc_chunk(gfp_t gfp)
mm/percpu.c-1432-{
--
mm/percpu.c=1575=static struct page *pcpu_addr_to_page(void *addr);
mm/percpu.c:1576:static int __init pcpu_verify_alloc_info(const struct pcpu_alloc_info *ai);
mm/percpu.c-1577-
--
mm/percpu.c=1690=static void pcpu_memcg_free_hook(struct pcpu_chunk *chunk, int off, size_t size)
--
mm/percpu.c-1695-#ifdef CONFIG_MEM_ALLOC_PROFILING
mm/percpu.c:1696:static void pcpu_alloc_tag_alloc_hook(struct pcpu_chunk *chunk, int off,
mm/percpu.c-1697-				      size_t size)
--
mm/percpu.c-1704-
mm/percpu.c:1705:static void pcpu_alloc_tag_free_hook(struct pcpu_chunk *chunk, int off, size_t size)
mm/percpu.c-1706-{
--
mm/percpu.c-1710-#else
mm/percpu.c:1711:static void pcpu_alloc_tag_alloc_hook(struct pcpu_chunk *chunk, int off,
mm/percpu.c-1712-				      size_t size)
--
mm/percpu.c-1715-
mm/percpu.c:1716:static void pcpu_alloc_tag_free_hook(struct pcpu_chunk *chunk, int off, size_t size)
mm/percpu.c-1717-{
--
mm/percpu.c-1721-/**
mm/percpu.c:1722: * pcpu_alloc - the percpu allocator
mm/percpu.c-1723- * @size: size of area to allocate in bytes
--
mm/percpu.c-1735- */
mm/percpu.c:1736:void __percpu *pcpu_alloc_noprof(size_t size, size_t align, bool reserved,
mm/percpu.c-1737-				 gfp_t gfp)
--
mm/percpu.c-1786-		if (gfp & __GFP_NOFAIL) {
mm/percpu.c:1787:			mutex_lock(&pcpu_alloc_mutex);
mm/percpu.c:1788:		} else if (mutex_lock_killable(&pcpu_alloc_mutex)) {
mm/percpu.c-1789-			pcpu_memcg_post_alloc_hook(objcg, NULL, 0, size);
--
mm/percpu.c-1805-
mm/percpu.c:1806:		off = pcpu_alloc_area(chunk, bits, bit_align, off);
mm/percpu.c-1807-		if (off >= 0)
--
mm/percpu.c-1826-
mm/percpu.c:1827:			off = pcpu_alloc_area(chunk, bits, bit_align, off);
mm/percpu.c-1828-			if (off >= 0) {
--
mm/percpu.c-1887-
mm/percpu.c:1888:		mutex_unlock(&pcpu_alloc_mutex);
mm/percpu.c-1889-	}
--
mm/percpu.c-1903-
mm/percpu.c:1904:	pcpu_alloc_tag_alloc_hook(chunk, off, size);
mm/percpu.c-1905-
--
mm/percpu.c-1930-	} else {
mm/percpu.c:1931:		mutex_unlock(&pcpu_alloc_mutex);
mm/percpu.c-1932-	}
--
mm/percpu.c-1937-}
mm/percpu.c:1938:EXPORT_SYMBOL_GPL(pcpu_alloc_noprof);
mm/percpu.c-1939-
--
mm/percpu.c=2005=static void pcpu_balance_populated(void)
--
mm/percpu.c-2049-
mm/percpu.c:2050:		/* @chunk can't go away while pcpu_alloc_mutex is held */
mm/percpu.c-2051-		for_each_clear_bitrange(rs, re, chunk->populated, chunk->nr_pages) {
--
mm/percpu.c=2196=static void pcpu_balance_workfn(struct work_struct *work)
--
mm/percpu.c-2204-	 *
mm/percpu.c:2205:	 * Enforce GFP_NOIO allocations because we have pcpu_alloc users
mm/percpu.c-2206-	 * constrained to GFP_NOIO/NOFS contexts and they could form lock
mm/percpu.c:2207:	 * dependency through pcpu_alloc_mutex
mm/percpu.c-2208-	 */
mm/percpu.c-2209-	unsigned int flags = memalloc_noio_save();
mm/percpu.c:2210:	mutex_lock(&pcpu_alloc_mutex);
mm/percpu.c-2211-	spin_lock_irq(&pcpu_lock);
--
mm/percpu.c-2218-	spin_unlock_irq(&pcpu_lock);
mm/percpu.c:2219:	mutex_unlock(&pcpu_alloc_mutex);
mm/percpu.c-2220-	memalloc_noio_restore(flags);
--
mm/percpu.c=2232=void free_percpu(void __percpu *ptr)
--
mm/percpu.c-2258-
mm/percpu.c:2259:	pcpu_alloc_tag_free_hook(chunk, off, size);
mm/percpu.c-2260-
--
mm/percpu.c=2354=phys_addr_t per_cpu_ptr_to_phys(void *addr)
--
mm/percpu.c-2398-/**
mm/percpu.c:2399: * pcpu_alloc_alloc_info - allocate percpu allocation info
mm/percpu.c-2400- * @nr_groups: the number of groups
--
mm/percpu.c-2409- * RETURNS:
mm/percpu.c:2410: * Pointer to the allocated pcpu_alloc_info on success, NULL on
mm/percpu.c-2411- * failure.
mm/percpu.c-2412- */
mm/percpu.c:2413:struct pcpu_alloc_info * __init pcpu_alloc_alloc_info(int nr_groups,
mm/percpu.c-2414-						      int nr_units)
mm/percpu.c-2415-{
mm/percpu.c:2416:	struct pcpu_alloc_info *ai;
mm/percpu.c-2417-	size_t base_size, ai_size;
--
mm/percpu.c-2443- * pcpu_free_alloc_info - free percpu allocation info
mm/percpu.c:2444: * @ai: pcpu_alloc_info to free
mm/percpu.c-2445- *
mm/percpu.c:2446: * Free @ai which was allocated by pcpu_alloc_alloc_info().
mm/percpu.c-2447- */
mm/percpu.c:2448:void __init pcpu_free_alloc_info(struct pcpu_alloc_info *ai)
mm/percpu.c-2449-{
--
mm/percpu.c-2453-/**
mm/percpu.c:2454: * pcpu_dump_alloc_info - print out information about pcpu_alloc_info
mm/percpu.c-2455- * @lvl: loglevel
--
mm/percpu.c=2460=static void pcpu_dump_alloc_info(const char *lvl,
mm/percpu.c:2461:				 const struct pcpu_alloc_info *ai)
mm/percpu.c-2462-{
--
mm/percpu.c-2511- * pcpu_setup_first_chunk - initialize the first percpu chunk
mm/percpu.c:2512: * @ai: pcpu_alloc_info describing how to percpu area is shaped
mm/percpu.c-2513- * @base_addr: mapped address
--
mm/percpu.c-2563- */
mm/percpu.c:2564:void __init pcpu_setup_first_chunk(const struct pcpu_alloc_info *ai,
mm/percpu.c-2565-				   void *base_addr)
--
mm/percpu.c-2716-	if (ai->reserved_size)
mm/percpu.c:2717:		pcpu_reserved_chunk = pcpu_alloc_first_chunk(tmp_addr,
mm/percpu.c-2718-						ai->reserved_size);
mm/percpu.c-2719-	tmp_addr = (unsigned long)base_addr + static_size + ai->reserved_size;
mm/percpu.c:2720:	pcpu_first_chunk = pcpu_alloc_first_chunk(tmp_addr, dyn_size);
mm/percpu.c-2721-
--
mm/percpu.c=2765=early_param("percpu_alloc", percpu_alloc_setup);
--
mm/percpu.c-2804- */
mm/percpu.c:2805:static struct pcpu_alloc_info * __init __flatten pcpu_build_alloc_info(
mm/percpu.c-2806-				size_t reserved_size, size_t dyn_size,
--
mm/percpu.c-2818-	unsigned int cpu, tcpu;
mm/percpu.c:2819:	struct pcpu_alloc_info *ai;
mm/percpu.c-2820-	unsigned int *cpu_map;
--
mm/percpu.c-2908-
mm/percpu.c:2909:	ai = pcpu_alloc_alloc_info(nr_groups, nr_units);
mm/percpu.c-2910-	if (!ai)
--
mm/percpu.c=3016=int __init pcpu_embed_first_chunk(size_t reserved_size, size_t dyn_size,
--
mm/percpu.c-3022-	void **areas = NULL;
mm/percpu.c:3023:	struct pcpu_alloc_info *ai;
mm/percpu.c-3024-	size_t size_sum, areas_size;
--
mm/percpu.c=3194=int __init pcpu_page_first_chunk(size_t reserved_size, pcpu_fc_cpu_to_node_fn_t cpu_to_nd_fn)
--
mm/percpu.c-3196-	static struct vm_struct vm;
mm/percpu.c:3197:	struct pcpu_alloc_info *ai;
mm/percpu.c-3198-	char psize_str[16];
--
mm/percpu.c=3334=void __init setup_per_cpu_areas(void)
--
mm/percpu.c-3338-					 PERCPU_DYNAMIC_RESERVE));
mm/percpu.c:3339:	struct pcpu_alloc_info *ai;
mm/percpu.c-3340-	void *fc;
mm/percpu.c-3341-
mm/percpu.c:3342:	ai = pcpu_alloc_alloc_info(1, 1);
mm/percpu.c-3343-	fc = memblock_alloc_from(unit_size, PAGE_SIZE, __pa(MAX_DMA_ADDRESS));
--
net/ipv6/route.c=1369=static struct rt6_info *ip6_rt_cache_alloc(const struct fib6_result *res,
--
net/ipv6/route.c-1410-
net/ipv6/route.c:1411:static struct rt6_info *ip6_rt_pcpu_alloc(const struct fib6_result *res)
net/ipv6/route.c-1412-{
--
net/ipv6/route.c=1467=static struct rt6_info *rt6_make_pcpu_route(struct net *net,
--
net/ipv6/route.c-1471-
net/ipv6/route.c:1472:	pcpu_rt = ip6_rt_pcpu_alloc(res);
net/ipv6/route.c-1473-	if (!pcpu_rt)
--
net/ipv6/route.c=3589=int fib6_nh_init(struct net *net, struct fib6_nh *fib6_nh,
--
net/ipv6/route.c-3659-		}
net/ipv6/route.c:3660:		goto pcpu_alloc;
net/ipv6/route.c-3661-	}
--
net/ipv6/route.c-3697-
net/ipv6/route.c:3698:pcpu_alloc:
net/ipv6/route.c-3699-	fib6_nh->rt6i_pcpu = alloc_percpu_gfp(struct rt6_info *, gfp_flags);
--
tools/testing/selftests/mm/test_vmalloc.sh=55=check_memory_requirement()
tools/testing/selftests/mm/test_vmalloc.sh-56-{
tools/testing/selftests/mm/test_vmalloc.sh:57:	# The pcpu_alloc_test allocates nr_pcpu_objects per cpu. If the
tools/testing/selftests/mm/test_vmalloc.sh-58-	# PAGE_SIZE is on the larger side it is easier to set a value
]

gemini-3.1-pro-preview

							input: 38848
							output: 18
							thoughts: 2359
						

**My Thought Process Unraveling the NFSd Per-CPU Counter Crash**

Alright, let's trace this out. I'm trying to understand how a seemingly innocent page allocation failure, specifically via `fail_page_alloc`, can lead to a kernel crash, and specifically, how it impacts the `percpu_counter_init` function within NFSd.

My initial thought was that `pcpu_alloc`, which is the function responsible for allocating per-CPU data, uses `pcpu_alloc_pages`, and that, in turn, calls `alloc_pages`. If that's true, then `fail_page_alloc`, by its very nature, would intercept `alloc_pages` and cause it to fail. Consequently, this failure would propagate and potentially make `percpu_counter_init` fail. This seems like a direct path to the observed issue.

However, I immediately remembered a crucial detail: `fail_page_alloc` isn't a blanket failure mechanism. It *only* fails an allocation if the requested `gfp` flags match a specific filter. So, I need to confirm the `gfp` flags used by `percpu_counter_init`. I recalled that `percpu_counter_init` typically uses `GFP_KERNEL`. Now, the `fail_page_alloc` mechanism, in this particular configuration I'm setting up (`fail_page_alloc/ignore-gfp-wait` is set to `N`), will indeed fail allocations even for `GFP_KERNEL` because `GFP_KERNEL` includes `__GFP_DIRECT_RECLAIM`, which is part of the filter. This confirms my initial suspicion that `fail_page_alloc` *can* indeed cause `percpu_counter_init` to fail.

With this understanding solidified, I started constructing the reproducer. The goal is to trigger this fault injection in a way that realistically exercises the NFSd code path leading to the `percpu_counter_init` failure.

The reproducer code sets up the necessary environment:
1.  It mounts `debugfs` to access the fault injection knobs.
2.  It configures both `failslab` and `fail_page_alloc` to inject faults with a probability of 5% and to not ignore `GFP_WAIT` flags. Critically, `task-filter` is set to `Y` for both, meaning fault injection will only apply to the current task, which is key for targeted testing.
3.  It creates a directory for NFSd to mount.
4.  The core of the reproducer is a loop that forks child processes. Each child process:
    *   Unshares network and mount namespaces to isolate its environment.
    *   Brings the loopback interface (`lo`) up.
    *   Attempts to mount `nfsd`.
    *   Opens `/tmp/nfsd/portlist` for writing.
    *   Crucially, it writes `1` to `/proc/self/make-it-fail`. This is the mechanism to tell the kernel that *this specific task* should be subject to the configured fault injection, leveraging the `task-filter: Y` setting.
    *   It then attempts to write to `/tmp/nfsd/portlist`. This is the point where we expect a write operation to potentially trigger the underlying memory allocation failures.
    *   Finally, it writes `0` to `/proc/self/make-it-fail` to disable fault injection for any subsequent operations within that child (though the child exits immediately after).

Now, I need to carefully analyze the sequence of events within the NFSd code after the write to `portlist` is initiated, and how the `percpu_counter_init` failure plays into it.

My reasoning continues: The write operation to `/tmp/nfsd/portlist` ultimately calls into `nfsctl_transaction_write`. This function, in turn, allocates memory using `simple_transaction_get`. If *this* allocation fails due to `fail_page_alloc`, it returns `-ENOMEM`.

The problem isn't necessarily that `simple_transaction_get` fails. The probability is set to 5%, so it might succeed the first few times. The real issue is that the code might proceed through several memory allocations before hitting the specific `percpu_counter_init` that causes the crash.

Let's trace the path to `percpu_counter_init`:
1.  `nfsd_create_serv` is called. It allocates a `percpu_ref` using `percpu_ref_init`.
2.  `svc_create_pooled` is called. This function allocates the `serv` structure itself (using `kzalloc`) and also allocates the `sv_pools` array (using `kcalloc`).
3.  Then, `__svc_create` is called. This function allocates memory for the service name (`sv_name`) using `kstrdup`.
4.  *This is where it gets critical*: `__svc_create` calls `percpu_counter_init` *three times for each pool* in the `sv_pools` array. If `sv_nrpools` is 1, that's three calls to `percpu_counter_init`.

If `fail_page_alloc` is configured as intended, it *can* fail `alloc_pages`, which `pcpu_alloc_pages` (a part of `pcpu_alloc`) uses. So, one of these `percpu_counter_init` calls might fail, returning `-ENOMEM`.

Here's the twist: `__svc_create` *ignores* the return value of `percpu_counter_init`. This is a critical bug! It continues execution as if the initialization was successful.

After `__svc_create` completes, `svc_xprt_create` is called. This function allocates an `xprt` (transport structure), and if that succeeds, it calls `svc_xprt_enqueue`.

Now, `svc_xprt_enqueue` is where the crash occurs. It calls `percpu_counter_inc(&pool->sp_sockets_queued);`. The `pool` here refers to one of the service pools that was initialized (or attempted to be initialized) earlier.

The problem is that if `percpu_counter_init` failed for `sp_sockets_queued`, its internal `counters` pointer within the `percpu_counter` structure will be `NULL`.

Let's look at `percpu_counter_inc` and `percpu_counter_add` more closely:
*   `percpu_counter_inc` simply calls `percpu_counter_add(fbc, 1)`.
*   `percpu_counter_add` calls `percpu_counter_add_batch(fbc, amount, percpu_counter_batch)`.
*   `percpu_counter_add_batch` starts with `preempt_disable();` and then attempts to read the current CPU's counter using `count = __this_cpu_read(*fbc->counters) + amount;`.

If `fbc->counters` is `NULL` (because `percpu_counter_init` failed and was ignored), `__this_cpu_read(*fbc->counters)` will attempt to dereference a `NULL` pointer, adding a per-CPU offset to it. This dereference of a NULL pointer, in kernel mode, is precisely what triggers a page fault.

This matches the observed bug description: a `BUG: unable to handle page fault for address: ffff88808c54a000` with a `RIP: 0010:percpu_counter_add_batch+0x50/0x1d0 lib/percpu_counter.c:98`. The address is likely derived from the `NULL` pointer plus an offset.

My analysis of the probability also holds up. With a 5% failure rate, there are approximately 7-8 memory allocations before the critical `percpu_counter_init` call in a single pool scenario. The probability of the *specific* `percpu_counter_init` failing while others succeed is roughly `0.95^5 * 0.05 * 0.95^2`, which is about 3.5%. Over 5000 iterations, it's highly likely we'll hit this exact sequence of failures.

However, a nagging doubt remains: `pcpu_alloc`'s internal workings. Does it *always* call `alloc_pages`? `pcpu_alloc` is designed to manage a pool of pre-allocated pages. If the pool is not exhausted, it might not need to call `alloc_pages` or `kmalloc` at all. If `pcpu_alloc` *doesn't* call `alloc_pages` directly, then `fail_page_alloc` wouldn't catch it, and the `percpu_counter_init` wouldn't fail due to page allocation. I need to double-check the exact path within `pcpu_alloc`.

A quick look reveals `pcpu_alloc` uses `pcpu_alloc_pages` which *does* call `alloc_pages`. But it also manages a pre-allocated chunk. If the pre-allocated chunk is sufficient, `alloc_pages` might not be directly invoked for *every* per-CPU allocation. This is where the subtlety lies. The `percpu_counter_init` might rely on `alloc_percpu_gfp`, which ultimately uses `pcpu_alloc`. If `pcpu_alloc` itself is not directly failing via `alloc_pages`, my premise could be wrong.

I need to verify if `alloc_percpu_gfp` (or whatever `percpu_counter_init` uses under the hood for its per-CPU data) *always* goes through `alloc_pages` in a way that `fail_page_alloc` can intercept. My current understanding is that it does, but this is a point of potential refinement. For now, the reasoning stands that `fail_page_alloc` can cause `percpu_counter_init` to fail, and the subsequent ignored error leads to a crash when `percpu_counter_inc` dereferences a NULL pointer.

map[Expression:should_failslab]

map[Output:include/linux/fault-inject.h=119=static inline bool should_fail_alloc_page(gfp_t gfp_mask, unsigned int order)
--
include/linux/fault-inject.h-125-#ifdef CONFIG_FAILSLAB
include/linux/fault-inject.h:126:int should_failslab(struct kmem_cache *s, gfp_t gfpflags);
include/linux/fault-inject.h-127-#else
include/linux/fault-inject.h:128:static inline int should_failslab(struct kmem_cache *s, gfp_t gfpflags)
include/linux/fault-inject.h-129-{
--
kernel/bpf/verifier.c=18750=BTF_ID(func, should_fail_alloc_page)
--
kernel/bpf/verifier.c-18752-#ifdef CONFIG_FAILSLAB
kernel/bpf/verifier.c:18753:BTF_ID(func, should_failslab)
kernel/bpf/verifier.c-18754-#endif
--
mm/fail_page_alloc.c=26=bool should_fail_alloc_page(gfp_t gfp_mask, unsigned int order)
--
mm/fail_page_alloc.c-39-
mm/fail_page_alloc.c:40:	/* See comment in __should_failslab() */
mm/fail_page_alloc.c-41-	if (gfp_mask & __GFP_NOWARN)
--
mm/failslab.c=9=static struct {
--
mm/failslab.c-18-
mm/failslab.c:19:int should_failslab(struct kmem_cache *s, gfp_t gfpflags)
mm/failslab.c-20-{
--
mm/failslab.c-47-}
mm/failslab.c:48:ALLOW_ERROR_INJECTION(should_failslab, ERRNO);
mm/failslab.c-49-
--
mm/slub.c=4533=struct kmem_cache *slab_pre_alloc_hook(struct kmem_cache *s, gfp_t flags)
--
mm/slub.c-4538-
mm/slub.c:4539:	if (unlikely(should_failslab(s, flags)))
mm/slub.c-4540-		return NULL;
--
mm/slub.c=5364=static void *__kmalloc_nolock_noprof(DECL_TOKEN_PARAMS(size, token), gfp_t gfp_flags,
--
mm/slub.c-5415-	 * Do not call slab_alloc_node(), since trylock mode isn't
mm/slub.c:5416:	 * compatible with slab_pre_alloc_hook/should_failslab and
mm/slub.c-5417-	 * kfence_alloc. Hence call __slab_alloc_node() (at most twice)
]

gemini-3.1-pro-preview

							input: 41975
							output: 18
							thoughts: 2185
						

**My Thought Process Unraveling a Per-CPU Memory Allocation Bug**

I've been digging into a curious per-CPU memory allocation issue, and it seems I've finally pieced together the likely cause. Initially, I was looking at `pcpu_alloc` directly and thought, "This doesn't seem to call `should_failslab` or `should_fail_alloc_page`." But then I traced the execution flow: `pcpu_alloc` calls `pcpu_alloc_pages`, which in turn calls `alloc_pages`. And `alloc_pages` *does* call `should_fail_alloc_page`. So there's a path for failure there.

However, I quickly realized a crucial detail: `pcpu_alloc` only invokes `pcpu_alloc_pages` when it needs to *populate* a chunk. If a chunk is already populated, it bypasses `alloc_pages` altogether and just returns the existing memory. This led me to a moment of confusion: if `pcpu_alloc` isn't always calling `alloc_pages`, how can the allocation fail?

My attention then shifted to `percpu_counter_init`. I found that `percpu_counter_init` is a wrapper around `__percpu_counter_init_many`, which uses `__alloc_percpu_gfp`. This `__alloc_percpu_gfp` is where the actual per-CPU memory is requested. If this allocation fails, it returns `NULL`, and `__percpu_counter_init_many` consequently returns `-ENOMEM`.

The critical question became: how can `__alloc_percpu_gfp` return `NULL`? It can fail if `pcpu_alloc` fails. I then listed the conditions under which `pcpu_alloc` itself might fail:
1.  If the requested `size` is larger than `PCPU_MIN_UNIT_SIZE` (which wasn't the case here).
2.  If `pcpu_alloc_area` fails to find space, and `pcpu_create_chunk` also fails.
3.  If `pcpu_populate_chunk` fails.

I confirmed that `pcpu_populate_chunk` calls `pcpu_alloc_pages`, and if `alloc_pages` fails (due to `fail_page_alloc` or similar), `pcpu_populate_chunk` will return `-ENOMEM`. But again, if there's already available space in a populated chunk, `pcpu_alloc` would succeed, and we wouldn't hit this failure path. This implied that to reliably trigger a failure, I'd need to either exhaust per-CPU memory or somehow *force* `pcpu_populate_chunk` to be called and then fail.

I considered the standard fault injection mechanisms, `failslab` and `fail_page_alloc`. I noted that there wasn't a direct way to inject faults specifically into `pcpu_alloc` itself. Then I looked closer at `percpu_counter_init`. I initially wondered if it was allocating a lock, but realized `raw_spin_lock_init` is just an inline macro. I re-examined the `percpu_counter_init` macro and confirmed it *only* allocates the per-CPU counters (`counters`).

This led me to a significant pivot: what if the bug wasn't about `percpu_counter_init` *failing* to allocate memory, but about `__svc_create` *ignoring* the failure? Looking at the `__svc_create` function again, I saw it calls `percpu_counter_init`. If `percpu_counter_init` returns `-ENOMEM`, `__svc_create` completely ignores this return value and proceeds. This is a huge red flag! If the allocation failed, the `pool->sp_messages_arrived`, `pool->sp_sockets_queued`, and `pool->sp_threads_woken` counters would have their `counters` member set to `NULL`.

My suspicion solidified when I examined the crash dump. The fault address, `ffff88808c54a000`, looked suspiciously like a per-CPU offset. Then, I saw the registers: the `GS` segment register was pointing to `ffff88808c54a000`, and the trapping instruction was `mov %gs:(%rax),%ebp`. With `%rax` being zero, this instruction was attempting to read from `%gs:0`, which is effectively dereferencing a `NULL` pointer plus a per-CPU offset. This unequivocally confirmed that the `fbc->counters` pointer was `NULL` at the time of the fault.

And the *only* way `fbc->counters` can be `NULL` is if `percpu_counter_init` failed.

So, the core of the problem seems to be:
1.  `percpu_counter_init` can fail if `__alloc_percpu_gfp` returns `NULL` (meaning `pcpu_alloc` failed to allocate memory).
2.  `__svc_create` does not check the return value of `percpu_counter_init`.
3.  If `percpu_counter_init` fails, the per-CPU counter's `counters` member is `NULL`.
4.  Later operations that try to increment or access these counters (like `percpu_counter_inc`) will then dereference this `NULL` pointer, leading to a crash.

The remaining puzzle was how to reliably trigger `percpu_counter_init` to fail. I speculated that `fail_page_alloc` could cause `pcpu_populate_chunk` to fail, thus failing `pcpu_alloc` and consequently `__alloc_percpu_gfp`. However, I had a concern about the reproducer code: it uses `waitpid`, and the child process exits. This means per-CPU memory might be freed, preventing accumulation. But then I remembered that `fail_page_alloc` introduces failure with a probability. If `pcpu_alloc` found pre-allocated space, it would succeed.

The core issue seems to be that `__svc_create` is not handling the possibility that `percpu_counter_init` might fail to allocate the necessary per-CPU memory. If that allocation fails, the subsequent use of the uninitialized per-CPU counter leads directly to a null pointer dereference.

map[Expression:pcpu_alloc]

map[Output:arch/s390/kernel/smp.c=174=static void pcpu_ec_call(struct pcpu *pcpu, int ec_bit)
--
arch/s390/kernel/smp.c-181-
arch/s390/kernel/smp.c:182:static int pcpu_alloc_lowcore(struct pcpu *pcpu, int cpu)
arch/s390/kernel/smp.c-183-{
--
arch/s390/kernel/smp.c=855=int __cpu_up(unsigned int cpu, struct task_struct *tidle)
--
arch/s390/kernel/smp.c-865-
arch/s390/kernel/smp.c:866:	rc = pcpu_alloc_lowcore(pcpu, cpu);
arch/s390/kernel/smp.c-867-	if (rc)
--
include/linux/percpu.h=79=struct pcpu_group_info {
--
include/linux/percpu.h-85-
include/linux/percpu.h:86:struct pcpu_alloc_info {
include/linux/percpu.h-87-	size_t			static_size;
--
include/linux/percpu.h=110=typedef int (pcpu_fc_cpu_distance_fn_t)(unsigned int from, unsigned int to);
include/linux/percpu.h-111-
include/linux/percpu.h:112:extern struct pcpu_alloc_info * __init pcpu_alloc_alloc_info(int nr_groups,
include/linux/percpu.h-113-							     int nr_units);
include/linux/percpu.h:114:extern void __init pcpu_free_alloc_info(struct pcpu_alloc_info *ai);
include/linux/percpu.h-115-
include/linux/percpu.h:116:extern void __init pcpu_setup_first_chunk(const struct pcpu_alloc_info *ai,
include/linux/percpu.h-117-					 void *base_addr);
--
include/linux/percpu.h=134=extern void __init setup_per_cpu_areas(void);
--
include/linux/percpu.h-136-
include/linux/percpu.h:137:extern void __percpu *pcpu_alloc_noprof(size_t size, size_t align, bool reserved,
include/linux/percpu.h-138-				   gfp_t gfp) __alloc_size(1);
--
include/linux/percpu.h-140-#define __alloc_percpu_gfp(_size, _align, _gfp)				\
include/linux/percpu.h:141:	alloc_hooks(pcpu_alloc_noprof(_size, _align, false, _gfp))
include/linux/percpu.h-142-#define __alloc_percpu(_size, _align)					\
include/linux/percpu.h:143:	alloc_hooks(pcpu_alloc_noprof(_size, _align, false, GFP_KERNEL))
include/linux/percpu.h-144-#define __alloc_reserved_percpu(_size, _align)				\
include/linux/percpu.h:145:	alloc_hooks(pcpu_alloc_noprof(_size, _align, true, GFP_KERNEL))
include/linux/percpu.h-146-
--
include/linux/percpu.h-153-#define alloc_percpu_noprof(type)					\
include/linux/percpu.h:154:	((typeof(type) __percpu *)pcpu_alloc_noprof(sizeof(type),	\
include/linux/percpu.h-155-					__alignof__(type), false, GFP_KERNEL))
--
lib/debugobjects.c=236=static void pcpu_refill_stats(void)
--
lib/debugobjects.c-248-
lib/debugobjects.c:249:static struct debug_obj *pcpu_alloc(void)
lib/debugobjects.c-250-{
--
lib/debugobjects.c=467=static struct debug_obj *alloc_object(void *addr, struct debug_bucket *b,
--
lib/debugobjects.c-474-	if (static_branch_likely(&obj_cache_enabled))
lib/debugobjects.c:475:		obj = pcpu_alloc();
lib/debugobjects.c-476-	else
--
lib/debugobjects.c=1502=static bool __init debug_objects_replace_static_objects(struct kmem_cache *cache)
--
lib/debugobjects.c-1523-		hlist_for_each_entry(obj, &objects, node) {
lib/debugobjects.c:1524:			struct debug_obj *new = pcpu_alloc();
lib/debugobjects.c-1525-
--
lib/test_vmalloc.c=44=__param(int, run_test_mask, 7,
--
lib/test_vmalloc.c-52-		"\t\tid: 64,   name: align_shift_alloc_test\n"
lib/test_vmalloc.c:53:		"\t\tid: 128,  name: pcpu_alloc_test\n"
lib/test_vmalloc.c-54-		"\t\tid: 256,  name: kvfree_rcu_1_arg_vmalloc_test\n"
--
lib/test_vmalloc.c=62=__param(int, nr_pcpu_objects, 35000,
lib/test_vmalloc.c:63:	"Number of pcpu objects to allocate for pcpu_alloc_test");
lib/test_vmalloc.c-64-
--
lib/test_vmalloc.c=315=static int
lib/test_vmalloc.c:316:pcpu_alloc_test(void)
lib/test_vmalloc.c-317-{
--
lib/test_vmalloc.c=491=static struct test_case_desc test_case_array[] = {
--
lib/test_vmalloc.c-498-	{ "align_shift_alloc_test", align_shift_alloc_test, true },
lib/test_vmalloc.c:499:	{ "pcpu_alloc_test", pcpu_alloc_test, },
lib/test_vmalloc.c-500-	{ "kvfree_rcu_1_arg_vmalloc_test", kvfree_rcu_1_arg_vmalloc_test, },
--
mm/percpu-internal.h=180=extern struct percpu_stats pcpu_stats;
mm/percpu-internal.h:181:extern struct pcpu_alloc_info pcpu_stats_ai;
mm/percpu-internal.h-182-
--
mm/percpu-internal.h-185- */
mm/percpu-internal.h:186:static inline void pcpu_stats_save_ai(const struct pcpu_alloc_info *ai)
mm/percpu-internal.h-187-{
mm/percpu-internal.h:188:	memcpy(&pcpu_stats_ai, ai, sizeof(struct pcpu_alloc_info));
mm/percpu-internal.h-189-
--
mm/percpu-internal.h=254=static inline void pcpu_stats_chunk_dealloc(void)
--
mm/percpu-internal.h-265-
mm/percpu-internal.h:266:static inline void pcpu_stats_save_ai(const struct pcpu_alloc_info *ai)
mm/percpu-internal.h-267-{
--
mm/percpu-km.c=53=static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp)
--
mm/percpu-km.c-60-
mm/percpu-km.c:61:	chunk = pcpu_alloc_chunk(gfp);
mm/percpu-km.c-62-	if (!chunk)
--
mm/percpu-km.c=102=static struct page *pcpu_addr_to_page(void *addr)
--
mm/percpu-km.c-106-
mm/percpu-km.c:107:static int __init pcpu_verify_alloc_info(const struct pcpu_alloc_info *ai)
mm/percpu-km.c-108-{
--
mm/percpu-stats.c=21=struct percpu_stats pcpu_stats;
mm/percpu-stats.c:22:struct pcpu_alloc_info pcpu_stats_ai;
mm/percpu-stats.c-23-
--
mm/percpu-vm.c=13=static struct page *pcpu_chunk_page(struct pcpu_chunk *chunk,
--
mm/percpu-vm.c-26- * with pcpu_page_idx().  Note that there is only one array and accesses
mm/percpu-vm.c:27: * should be serialized by pcpu_alloc_mutex.
mm/percpu-vm.c-28- *
--
mm/percpu-vm.c=32=static struct page **pcpu_get_pages(void)
--
mm/percpu-vm.c-36-
mm/percpu-vm.c:37:	lockdep_assert_held(&pcpu_alloc_mutex);
mm/percpu-vm.c-38-
--
mm/percpu-vm.c=54=static void pcpu_free_pages(struct pcpu_chunk *chunk,
--
mm/percpu-vm.c-70-/**
mm/percpu-vm.c:71: * pcpu_alloc_pages - allocates pages for @chunk
mm/percpu-vm.c-72- * @chunk: target chunk
--
mm/percpu-vm.c-81- */
mm/percpu-vm.c:82:static int pcpu_alloc_pages(struct pcpu_chunk *chunk,
mm/percpu-vm.c-83-			    struct page **pages, int page_start, int page_end,
--
mm/percpu-vm.c=255=static void pcpu_post_map_flush(struct pcpu_chunk *chunk,
--
mm/percpu-vm.c-273- * CONTEXT:
mm/percpu-vm.c:274: * pcpu_alloc_mutex, does GFP_KERNEL allocation.
mm/percpu-vm.c-275- */
mm/percpu-vm.c=276=static int pcpu_populate_chunk(struct pcpu_chunk *chunk,
--
mm/percpu-vm.c-284-
mm/percpu-vm.c:285:	if (pcpu_alloc_pages(chunk, pages, page_start, page_end, gfp))
mm/percpu-vm.c-286-		return -ENOMEM;
--
mm/percpu-vm.c-309- * CONTEXT:
mm/percpu-vm.c:310: * pcpu_alloc_mutex.
mm/percpu-vm.c-311- */
--
mm/percpu-vm.c=333=static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp)
--
mm/percpu-vm.c-337-
mm/percpu-vm.c:338:	chunk = pcpu_alloc_chunk(gfp);
mm/percpu-vm.c-339-	if (!chunk)
--
mm/percpu-vm.c=371=static struct page *pcpu_addr_to_page(void *addr)
--
mm/percpu-vm.c-375-
mm/percpu-vm.c:376:static int __init pcpu_verify_alloc_info(const struct pcpu_alloc_info *ai)
mm/percpu-vm.c-377-{
--
mm/percpu.c=171=DEFINE_SPINLOCK(pcpu_lock);	/* all internal data structures */
mm/percpu.c:172:static DEFINE_MUTEX(pcpu_alloc_mutex);	/* chunk create/destroy, [de]pop, map ext */
mm/percpu.c-173-
--
mm/percpu.c=630=static void pcpu_block_update(struct pcpu_block_md *block, int start, int end)
--
mm/percpu.c-702- * Finding the final allocation spot first goes through pcpu_find_block_fit()
mm/percpu.c:703: * to find a block that can hold the allocation and then pcpu_alloc_area()
mm/percpu.c-704- * where a scan is used.  When allocations require specific alignments,
--
mm/percpu.c=1161=static unsigned long pcpu_find_zero_area(unsigned long *map,
--
mm/percpu.c-1197-/**
mm/percpu.c:1198: * pcpu_alloc_area - allocates an area from a pcpu_chunk
mm/percpu.c-1199- * @chunk: chunk of interest
--
mm/percpu.c-1215- */
mm/percpu.c:1216:static int pcpu_alloc_area(struct pcpu_chunk *chunk, int alloc_bits,
mm/percpu.c-1217-			   size_t align, int start)
--
mm/percpu.c=1325=static void pcpu_init_md_blocks(struct pcpu_chunk *chunk)
--
mm/percpu.c-1338-/**
mm/percpu.c:1339: * pcpu_alloc_first_chunk - creates chunks that serve the first chunk
mm/percpu.c-1340- * @tmp_addr: the start of the region served
--
mm/percpu.c-1350- */
mm/percpu.c:1351:static struct pcpu_chunk * __init pcpu_alloc_first_chunk(unsigned long tmp_addr,
mm/percpu.c-1352-							 int map_size)
--
mm/percpu.c-1430-
mm/percpu.c:1431:static struct pcpu_chunk *pcpu_alloc_chunk(gfp_t gfp)
mm/percpu.c-1432-{
--
mm/percpu.c=1575=static struct page *pcpu_addr_to_page(void *addr);
mm/percpu.c:1576:static int __init pcpu_verify_alloc_info(const struct pcpu_alloc_info *ai);
mm/percpu.c-1577-
--
mm/percpu.c=1690=static void pcpu_memcg_free_hook(struct pcpu_chunk *chunk, int off, size_t size)
--
mm/percpu.c-1695-#ifdef CONFIG_MEM_ALLOC_PROFILING
mm/percpu.c:1696:static void pcpu_alloc_tag_alloc_hook(struct pcpu_chunk *chunk, int off,
mm/percpu.c-1697-				      size_t size)
--
mm/percpu.c-1704-
mm/percpu.c:1705:static void pcpu_alloc_tag_free_hook(struct pcpu_chunk *chunk, int off, size_t size)
mm/percpu.c-1706-{
--
mm/percpu.c-1710-#else
mm/percpu.c:1711:static void pcpu_alloc_tag_alloc_hook(struct pcpu_chunk *chunk, int off,
mm/percpu.c-1712-				      size_t size)
--
mm/percpu.c-1715-
mm/percpu.c:1716:static void pcpu_alloc_tag_free_hook(struct pcpu_chunk *chunk, int off, size_t size)
mm/percpu.c-1717-{
--
mm/percpu.c-1721-/**
mm/percpu.c:1722: * pcpu_alloc - the percpu allocator
mm/percpu.c-1723- * @size: size of area to allocate in bytes
--
mm/percpu.c-1735- */
mm/percpu.c:1736:void __percpu *pcpu_alloc_noprof(size_t size, size_t align, bool reserved,
mm/percpu.c-1737-				 gfp_t gfp)
--
mm/percpu.c-1786-		if (gfp & __GFP_NOFAIL) {
mm/percpu.c:1787:			mutex_lock(&pcpu_alloc_mutex);
mm/percpu.c:1788:		} else if (mutex_lock_killable(&pcpu_alloc_mutex)) {
mm/percpu.c-1789-			pcpu_memcg_post_alloc_hook(objcg, NULL, 0, size);
--
mm/percpu.c-1805-
mm/percpu.c:1806:		off = pcpu_alloc_area(chunk, bits, bit_align, off);
mm/percpu.c-1807-		if (off >= 0)
--
mm/percpu.c-1826-
mm/percpu.c:1827:			off = pcpu_alloc_area(chunk, bits, bit_align, off);
mm/percpu.c-1828-			if (off >= 0) {
--
mm/percpu.c-1887-
mm/percpu.c:1888:		mutex_unlock(&pcpu_alloc_mutex);
mm/percpu.c-1889-	}
--
mm/percpu.c-1903-
mm/percpu.c:1904:	pcpu_alloc_tag_alloc_hook(chunk, off, size);
mm/percpu.c-1905-
--
mm/percpu.c-1930-	} else {
mm/percpu.c:1931:		mutex_unlock(&pcpu_alloc_mutex);
mm/percpu.c-1932-	}
--
mm/percpu.c-1937-}
mm/percpu.c:1938:EXPORT_SYMBOL_GPL(pcpu_alloc_noprof);
mm/percpu.c-1939-
--
mm/percpu.c=2005=static void pcpu_balance_populated(void)
--
mm/percpu.c-2049-
mm/percpu.c:2050:		/* @chunk can't go away while pcpu_alloc_mutex is held */
mm/percpu.c-2051-		for_each_clear_bitrange(rs, re, chunk->populated, chunk->nr_pages) {
--
mm/percpu.c=2196=static void pcpu_balance_workfn(struct work_struct *work)
--
mm/percpu.c-2204-	 *
mm/percpu.c:2205:	 * Enforce GFP_NOIO allocations because we have pcpu_alloc users
mm/percpu.c-2206-	 * constrained to GFP_NOIO/NOFS contexts and they could form lock
mm/percpu.c:2207:	 * dependency through pcpu_alloc_mutex
mm/percpu.c-2208-	 */
mm/percpu.c-2209-	unsigned int flags = memalloc_noio_save();
mm/percpu.c:2210:	mutex_lock(&pcpu_alloc_mutex);
mm/percpu.c-2211-	spin_lock_irq(&pcpu_lock);
--
mm/percpu.c-2218-	spin_unlock_irq(&pcpu_lock);
mm/percpu.c:2219:	mutex_unlock(&pcpu_alloc_mutex);
mm/percpu.c-2220-	memalloc_noio_restore(flags);
--
mm/percpu.c=2232=void free_percpu(void __percpu *ptr)
--
mm/percpu.c-2258-
mm/percpu.c:2259:	pcpu_alloc_tag_free_hook(chunk, off, size);
mm/percpu.c-2260-
--
mm/percpu.c=2354=phys_addr_t per_cpu_ptr_to_phys(void *addr)
--
mm/percpu.c-2398-/**
mm/percpu.c:2399: * pcpu_alloc_alloc_info - allocate percpu allocation info
mm/percpu.c-2400- * @nr_groups: the number of groups
--
mm/percpu.c-2409- * RETURNS:
mm/percpu.c:2410: * Pointer to the allocated pcpu_alloc_info on success, NULL on
mm/percpu.c-2411- * failure.
mm/percpu.c-2412- */
mm/percpu.c:2413:struct pcpu_alloc_info * __init pcpu_alloc_alloc_info(int nr_groups,
mm/percpu.c-2414-						      int nr_units)
mm/percpu.c-2415-{
mm/percpu.c:2416:	struct pcpu_alloc_info *ai;
mm/percpu.c-2417-	size_t base_size, ai_size;
--
mm/percpu.c-2443- * pcpu_free_alloc_info - free percpu allocation info
mm/percpu.c:2444: * @ai: pcpu_alloc_info to free
mm/percpu.c-2445- *
mm/percpu.c:2446: * Free @ai which was allocated by pcpu_alloc_alloc_info().
mm/percpu.c-2447- */
mm/percpu.c:2448:void __init pcpu_free_alloc_info(struct pcpu_alloc_info *ai)
mm/percpu.c-2449-{
--
mm/percpu.c-2453-/**
mm/percpu.c:2454: * pcpu_dump_alloc_info - print out information about pcpu_alloc_info
mm/percpu.c-2455- * @lvl: loglevel
--
mm/percpu.c=2460=static void pcpu_dump_alloc_info(const char *lvl,
mm/percpu.c:2461:				 const struct pcpu_alloc_info *ai)
mm/percpu.c-2462-{
--
mm/percpu.c-2511- * pcpu_setup_first_chunk - initialize the first percpu chunk
mm/percpu.c:2512: * @ai: pcpu_alloc_info describing how to percpu area is shaped
mm/percpu.c-2513- * @base_addr: mapped address
--
mm/percpu.c-2563- */
mm/percpu.c:2564:void __init pcpu_setup_first_chunk(const struct pcpu_alloc_info *ai,
mm/percpu.c-2565-				   void *base_addr)
--
mm/percpu.c-2716-	if (ai->reserved_size)
mm/percpu.c:2717:		pcpu_reserved_chunk = pcpu_alloc_first_chunk(tmp_addr,
mm/percpu.c-2718-						ai->reserved_size);
mm/percpu.c-2719-	tmp_addr = (unsigned long)base_addr + static_size + ai->reserved_size;
mm/percpu.c:2720:	pcpu_first_chunk = pcpu_alloc_first_chunk(tmp_addr, dyn_size);
mm/percpu.c-2721-
--
mm/percpu.c=2765=early_param("percpu_alloc", percpu_alloc_setup);
--
mm/percpu.c-2804- */
mm/percpu.c:2805:static struct pcpu_alloc_info * __init __flatten pcpu_build_alloc_info(
mm/percpu.c-2806-				size_t reserved_size, size_t dyn_size,
--
mm/percpu.c-2818-	unsigned int cpu, tcpu;
mm/percpu.c:2819:	struct pcpu_alloc_info *ai;
mm/percpu.c-2820-	unsigned int *cpu_map;
--
mm/percpu.c-2908-
mm/percpu.c:2909:	ai = pcpu_alloc_alloc_info(nr_groups, nr_units);
mm/percpu.c-2910-	if (!ai)
--
mm/percpu.c=3016=int __init pcpu_embed_first_chunk(size_t reserved_size, size_t dyn_size,
--
mm/percpu.c-3022-	void **areas = NULL;
mm/percpu.c:3023:	struct pcpu_alloc_info *ai;
mm/percpu.c-3024-	size_t size_sum, areas_size;
--
mm/percpu.c=3194=int __init pcpu_page_first_chunk(size_t reserved_size, pcpu_fc_cpu_to_node_fn_t cpu_to_nd_fn)
--
mm/percpu.c-3196-	static struct vm_struct vm;
mm/percpu.c:3197:	struct pcpu_alloc_info *ai;
mm/percpu.c-3198-	char psize_str[16];
--
mm/percpu.c=3334=void __init setup_per_cpu_areas(void)
--
mm/percpu.c-3338-					 PERCPU_DYNAMIC_RESERVE));
mm/percpu.c:3339:	struct pcpu_alloc_info *ai;
mm/percpu.c-3340-	void *fc;
mm/percpu.c-3341-
mm/percpu.c:3342:	ai = pcpu_alloc_alloc_info(1, 1);
mm/percpu.c-3343-	fc = memblock_alloc_from(unit_size, PAGE_SIZE, __pa(MAX_DMA_ADDRESS));
--
net/ipv6/route.c=1369=static struct rt6_info *ip6_rt_cache_alloc(const struct fib6_result *res,
--
net/ipv6/route.c-1410-
net/ipv6/route.c:1411:static struct rt6_info *ip6_rt_pcpu_alloc(const struct fib6_result *res)
net/ipv6/route.c-1412-{
--
net/ipv6/route.c=1467=static struct rt6_info *rt6_make_pcpu_route(struct net *net,
--
net/ipv6/route.c-1471-
net/ipv6/route.c:1472:	pcpu_rt = ip6_rt_pcpu_alloc(res);
net/ipv6/route.c-1473-	if (!pcpu_rt)
--
net/ipv6/route.c=3589=int fib6_nh_init(struct net *net, struct fib6_nh *fib6_nh,
--
net/ipv6/route.c-3659-		}
net/ipv6/route.c:3660:		goto pcpu_alloc;
net/ipv6/route.c-3661-	}
--
net/ipv6/route.c-3697-
net/ipv6/route.c:3698:pcpu_alloc:
net/ipv6/route.c-3699-	fib6_nh->rt6i_pcpu = alloc_percpu_gfp(struct rt6_info *, gfp_flags);
--
tools/testing/selftests/mm/test_vmalloc.sh=55=check_memory_requirement()
tools/testing/selftests/mm/test_vmalloc.sh-56-{
tools/testing/selftests/mm/test_vmalloc.sh:57:	# The pcpu_alloc_test allocates nr_pcpu_objects per cpu. If the
tools/testing/selftests/mm/test_vmalloc.sh-58-	# PAGE_SIZE is on the larger side it is easier to set a value
]

gemini-3.1-pro-preview

							input: 51531
							output: 35
							thoughts: 586
						

**My Thought Process Regarding Per-CPU Allocations and Failure Scenarios**

Okay, I'm looking at the `pcpu_alloc_chunk` function, and my initial thought is, "Wait a minute." I see it uses `kzalloc` to allocate the chunk metadata. This is a crucial detail.

So, if `failslab` is active, and it's designed to make `kzalloc` fail, then `pcpu_alloc_chunk` *will* fail. And if `pcpu_alloc_chunk` fails, then `pcpu_create_chunk` also fails. Following that logic, `pcpu_alloc` itself will return `NULL`. This means that `failslab` *is* sufficient to cause `percpu_counter_init` to fail. That's a direct path I've identified.

Now, I'm trying to understand *how often* `pcpu_alloc` actually calls `pcpu_alloc_chunk` (and thus `kzalloc`). My understanding is that it only calls it when it needs a *new* chunk. So, to *force* a new chunk allocation, I could theoretically just allocate a massive amount of per-CPU memory.

But then I pause. What if `failslab` hits `kzalloc` somewhere else first? Specifically, what if `svc_create_pooled` fails? If that happens, we won't even *reach* the `percpu_counter_init` call that I'm focusing on.

However, I remind myself that `failslab` is probabilistic. So, even if `svc_create_pooled` *could* fail, if I run this test, say, 5000 times, I should eventually hit a scenario where `svc_create_pooled` succeeds, but the subsequent `percpu_alloc_chunk` within `percpu_counter_init` fails.

Then I have another thought, a bit of a backtrack: if `pcpu_alloc` *doesn't* need a new chunk, it won't call `pcpu_alloc_chunk` at all. In that situation, `kzalloc` isn't invoked by `pcpu_alloc`, and therefore `failslab` wouldn't cause a failure here. If `pcpu_alloc` can simply use existing free space within an already allocated chunk, it doesn't need to allocate any new slab memory. I'm double-checking: does `pcpu_alloc` call `kzalloc` for any *other* purpose? No, it doesn't appear to.

This leads me to a critical realization: if there's *already* free space within the per-CPU chunk, `failslab` *won't* cause `pcpu_alloc` to fail.

Now I'm shifting my focus to `fail_page_alloc`. I know that `pcpu_populate_chunk` calls `pcpu_alloc_pages`, which in turn calls `alloc_pages`. So, if there's unpopulated space within a chunk, `pcpu_populate_chunk` gets called, and `fail_page_alloc` *could* indeed cause a failure there.

But here's the catch, and it's a significant one: if the space within the per-CPU chunk is *already populated* (perhaps because an `nfsd` instance was previously freed and its memory is now available), `pcpu_alloc` won't call `alloc_pages` *or* `kzalloc`. It will just reuse that existing, freed space.

Ah! This is the key insight: If the space is already populated and free, `pcpu_alloc` will *never* fail due to `failslab` or `fail_page_alloc` in this context. Why? Because all `pcpu_alloc` does is update some bits in the bitmap to mark the space as in use and then return the address. It doesn't trigger any new memory allocations that the failure injection mechanisms would target. I need to go back and carefully examine the implementation of `pcpu_alloc` in `mm/percpu.c` to confirm this behavior.

map[File:mm/percpu.c FirstLine:1780 LineCount:50]

map[Contents:1780:		if (!is_atomic) {
1781:			/*
1782:			 * pcpu_balance_workfn() allocates memory under this mutex,
1783:			 * and it may wait for memory reclaim. Allow current task
1784:			 * to become OOM victim, in case of memory pressure.
1785:			 */
1786:			if (gfp & __GFP_NOFAIL) {
1787:				mutex_lock(&pcpu_alloc_mutex);
1788:			} else if (mutex_lock_killable(&pcpu_alloc_mutex)) {
1789:				pcpu_memcg_post_alloc_hook(objcg, NULL, 0, size);
1790:				return NULL;
1791:			}
1792:		}
1793:	
1794:		spin_lock_irqsave(&pcpu_lock, flags);
1795:	
1796:		/* serve reserved allocations from the reserved chunk if available */
1797:		if (reserved && pcpu_reserved_chunk) {
1798:			chunk = pcpu_reserved_chunk;
1799:	
1800:			off = pcpu_find_block_fit(chunk, bits, bit_align, is_atomic);
1801:			if (off < 0) {
1802:				err = "alloc from reserved chunk failed";
1803:				goto fail_unlock;
1804:			}
1805:	
1806:			off = pcpu_alloc_area(chunk, bits, bit_align, off);
1807:			if (off >= 0)
1808:				goto area_found;
1809:	
1810:			err = "alloc from reserved chunk failed";
1811:			goto fail_unlock;
1812:		}
1813:	
1814:	restart:
1815:		/* search through normal chunks */
1816:		for (slot = pcpu_size_to_slot(size); slot <= pcpu_free_slot; slot++) {
1817:			list_for_each_entry_safe(chunk, next, &pcpu_chunk_lists[slot],
1818:						 list) {
1819:				off = pcpu_find_block_fit(chunk, bits, bit_align,
1820:							  is_atomic);
1821:				if (off < 0) {
1822:					if (slot < PCPU_SLOT_FAIL_THRESHOLD)
1823:						pcpu_chunk_move(chunk, 0);
1824:					continue;
1825:				}
1826:	
1827:				off = pcpu_alloc_area(chunk, bits, bit_align, off);
1828:				if (off >= 0) {
1829:					pcpu_reintegrate_chunk(chunk);
]

gemini-3.1-pro-preview

							input: 52916
							output: 35
							thoughts: 13
						

**My Thought Process on `pcpu_alloc`**

Alright, so I'm digging deeper into the `pcpu_alloc` function. My current focus is on understanding exactly what's happening *after* the initial allocation and setup. I need to get a clear picture of how these per-CPU data structures are being managed throughout their lifecycle, and that means looking beyond the immediate allocation point. I'm curious about the specifics of the internal mechanisms at play here, and I'm assuming, given my expertise, that there will be some sophisticated or at least well-reasoned approaches being employed. I want to see the nitty-gritty, the details that a casual observer might miss.

map[File:mm/percpu.c FirstLine:1830 LineCount:50]

map[Contents:1830:					goto area_found;
1831:				}
1832:			}
1833:		}
1834:	
1835:		spin_unlock_irqrestore(&pcpu_lock, flags);
1836:	
1837:		if (is_atomic) {
1838:			err = "atomic alloc failed, no space left";
1839:			goto fail;
1840:		}
1841:	
1842:		/* No space left.  Create a new chunk. */
1843:		if (list_empty(&pcpu_chunk_lists[pcpu_free_slot])) {
1844:			chunk = pcpu_create_chunk(pcpu_gfp);
1845:			if (!chunk) {
1846:				err = "failed to allocate new chunk";
1847:				goto fail;
1848:			}
1849:	
1850:			spin_lock_irqsave(&pcpu_lock, flags);
1851:			pcpu_chunk_relocate(chunk, -1);
1852:		} else {
1853:			spin_lock_irqsave(&pcpu_lock, flags);
1854:		}
1855:	
1856:		goto restart;
1857:	
1858:	area_found:
1859:		pcpu_stats_area_alloc(chunk, size);
1860:	
1861:		if (pcpu_nr_empty_pop_pages < PCPU_EMPTY_POP_PAGES_LOW)
1862:			pcpu_schedule_balance_work();
1863:	
1864:		spin_unlock_irqrestore(&pcpu_lock, flags);
1865:	
1866:		/* populate if not all pages are already there */
1867:		if (!is_atomic) {
1868:			unsigned int page_end, rs, re;
1869:	
1870:			rs = PFN_DOWN(off);
1871:			page_end = PFN_UP(off + size);
1872:	
1873:			for_each_clear_bitrange_from(rs, re, chunk->populated, page_end) {
1874:				WARN_ON(chunk->immutable);
1875:	
1876:				ret = pcpu_populate_chunk(chunk, rs, re, pcpu_gfp);
1877:	
1878:				spin_lock_irqsave(&pcpu_lock, flags);
1879:				if (ret) {
]

gemini-3.1-pro-preview

							input: 53660
							output: 17
							thoughts: 3755
						

**The Path to Reproducing the Per-CPU Allocation Failure**

I've been wrestling with this issue, trying to pinpoint exactly how `percpu_counter_init` can fail. My initial understanding was that `pcpu_alloc_area` might find an existing, populated area and simply reuse it. If that happens, `pcpu_populate_chunk` isn't called, and `pcpu_alloc` succeeds without hitting any slab or page allocators. This means that if I keep creating and destroying `nfsd` instances sequentially, I'll just reuse the same pre-populated per-CPU memory, and `percpu_counter_init` will never fail.

So, the immediate question became: how *can* I make it fail? My initial thoughts were to leak per-CPU memory or to create instances concurrently, forcing the allocation of new chunks or their population. I also considered using `failslab` to make `kzalloc` in `__svc_create` fail. However, if `kzalloc` fails there, `__svc_create` returns `NULL`, and `nfsd_create_serv` returns `-ENOMEM`. This *doesn't* trigger the bug I'm looking for. I need `percpu_counter_init` to fail, but `__svc_create` to succeed.

Delving deeper, `percpu_counter_init` fails only if `__alloc_percpu_gfp` returns `NULL`. And `__alloc_percpu_gfp` returns `NULL` only if `pcpu_alloc` returns `NULL`. For `pcpu_alloc` to return `NULL`, it needs to either fail during `pcpu_create_chunk` or `pcpu_populate_chunk`.

To force `pcpu_alloc` to fail, I realized I need to make sure it *actually calls* `pcpu_create_chunk` or `pcpu_populate_chunk`. This led me back to the idea of concurrent allocations. If I create many `nfsd` instances simultaneously, they'd all try to allocate per-CPU memory at once, potentially exhausting current chunks and forcing new ones to be populated, which could then fail.

I also considered using `failslab` and `fail_page_alloc` and just running a loop. But then I looked at my reproducer: it used `fork()` and `waitpid()`. This means the child process would run, create an `nfsd` instance, and then exit. When the child exits, the network namespace is destroyed, `nfsd` is destroyed, and its per-CPU memory is freed. This is sequential! If it's sequential, it reuses the same per-CPU memory, and `pcpu_alloc` will never fail. This was a critical realization.

I need to run these processes *concurrently*, or I need to *not* destroy the `nfsd` instances until the end. If I don't destroy them, I'll accumulate per-CPU memory, forcing new chunks to be populated, and then `fail_page_alloc` can do its work.

So, the next step was to modify the reproducer. Instead of exiting the child immediately or waiting for them all, I need to keep them alive to overlap and consume per-CPU memory.

I started by considering 5000 concurrent processes, but that seemed like it might hit PID or memory limits. I then thought about 500, but staggered. Then it hit me: if `fail_page_alloc` is enabled, *any* allocation can fail. With `task-filter` set to `Y` and writing `1` to `/proc/self/make-it-fail`, the fault injection is specific to the task. This is exactly what I need.

I refined the approach. Instead of just blindly enabling fault injection and writing to `portlist`, I realized I could be more precise. Writing to `/tmp/nfsd/threads` calls `nfsd_svc` which calls `nfsd_create_serv`. This triggers the `nfsd_create_serv` and `__svc_create` part of the code. After that, I could disable fault injection and *then* write to `/tmp/nfsd/portlist` to trigger `svc_xprt_create`. This separation ensures that the potential failure point, `percpu_counter_init`, is targeted *after* the initial successful creation of the `nfsd` service.

The key insight is that the `write` syscall to `/tmp/nfsd/portlist` triggers a chain of events that ultimately leads to `svc_xprt_enqueue`. If `sp_sockets_queued` is uninitialized due to a failure in `percpu_counter_init`, it will crash immediately during this `write` syscall.

Therefore, the strategy is to:
1.  Enable fault injection for both slab and page allocations.
2.  Create multiple `nfsd` instances concurrently, keeping them alive for a short period to overlap and consume per-CPU memory.
3.  Trigger the creation of `nfsd` services in a way that *doesn't* immediately cause a crash if `percpu_counter_init` fails, but *does* attempt to allocate per-CPU resources.
4.  Let the fault injection mechanism do its work. If `pcpu_populate_chunk` fails due to `fail_page_alloc`, `pcpu_alloc` will return `NULL`, `percpu_counter_init` will fail, and the subsequent operations within the `write` syscall will lead to the desired crash.

My refined reproducer aims to achieve this by forking many processes, each creating its own network namespace and then setting up `nfsd`. By staggering the forks and keeping them alive briefly, I increase the probability of concurrent per-CPU allocations, making it more likely for `fail_page_alloc` to intervene at the critical `pcpu_populate_chunk` stage.

map[Expression:write_threads]

map[Output:fs/nfsd/nfsctl.c=65=static ssize_t write_unlock_fs(struct file *file, char *buf, size_t size);
fs/nfsd/nfsctl.c:66:static ssize_t write_threads(struct file *file, char *buf, size_t size);
fs/nfsd/nfsctl.c-67-static ssize_t write_pool_threads(struct file *file, char *buf, size_t size);
--
fs/nfsd/nfsctl.c=80=static ssize_t (*const write_op[])(struct file *, char *, size_t) = {
--
fs/nfsd/nfsctl.c-83-	[NFSD_FO_UnlockFS] = write_unlock_fs,
fs/nfsd/nfsctl.c:84:	[NFSD_Threads] = write_threads,
fs/nfsd/nfsctl.c-85-	[NFSD_Pool_Threads] = write_pool_threads,
--
fs/nfsd/nfsctl.c=334=static ssize_t write_filehandle(struct file *file, char *buf, size_t size)
--
fs/nfsd/nfsctl.c-390-/*
fs/nfsd/nfsctl.c:391: * write_threads - Start NFSD, or report the configured number of threads
fs/nfsd/nfsctl.c-392- *
--
fs/nfsd/nfsctl.c-417- */
fs/nfsd/nfsctl.c:418:static ssize_t write_threads(struct file *file, char *buf, size_t size)
fs/nfsd/nfsctl.c-419-{
]

gemini-3.1-pro-preview

							input: 57874
							output: 39
							thoughts: 9
						

**My Thought Process on `write_threads`**

Alright, let's dive into this `write_threads` function. My immediate goal is to grasp its core purpose and how it achieves it. I'm expecting to see some form of concurrent processing, likely involving threads, given the name. I'll be looking for how data is managed, how threads are created and synchronized, and what the overall outcome of this operation is.

First, I'll trace the function's entry point and any initial setup. Are there any parameters being passed in? What are their types and what information do they convey? This will set the context for the rest of the execution.

Next, I'll scrutinize the creation of threads. How many threads are being instantiated? Is this a fixed number, or is it dynamic based on some input or system resource? What specific task or function is assigned to each of these threads? I'll pay close attention to the `Thread` object instantiation and its `target` argument.

Synchronization is a critical aspect of multithreaded programming. I'll be on the lookout for any mechanisms used to coordinate thread execution and prevent race conditions. This could involve locks, semaphores, condition variables, or other synchronization primitives. If shared data is being accessed, I'll need to see how modifications are protected.

I'll also be examining how the threads communicate, if at all. Are they passing data back and forth? If so, what data structures are being used for this inter-thread communication? Is there a queue, a shared buffer, or some other mechanism at play?

Furthermore, I'll track how the main thread waits for the worker threads to complete their tasks. This is often done using `join()` calls. Understanding this waiting mechanism will tell me if the function is designed to block until all operations are finished or if it's more of an asynchronous operation.

Finally, I'll consider the expected output or side effects of this function. What is the ultimate goal of these threads working together? Are they processing a dataset, performing calculations, or interacting with external resources? What is the final state of the program or data after `write_threads` has executed?

In essence, I'm dissecting `write_threads` by asking: what is it doing, how is it doing it with threads, how is it keeping things orderly, and what is the end result?

map[File:fs/nfsd/nfsctl.c FirstLine:418 LineCount:30]

map[Contents: 418:	static ssize_t write_threads(struct file *file, char *buf, size_t size)
 419:	{
 420:		char *mesg = buf;
 421:		int rv;
 422:		struct net *net = netns(file);
 423:	
 424:		if (size > 0) {
 425:			int newthreads;
 426:			rv = get_int(&mesg, &newthreads);
 427:			if (rv)
 428:				return rv;
 429:			if (newthreads < 0)
 430:				return -EINVAL;
 431:			trace_nfsd_ctl_threads(net, newthreads);
 432:			mutex_lock(&nfsd_mutex);
 433:			rv = nfsd_svc(1, &newthreads, net, file->f_cred, NULL);
 434:			mutex_unlock(&nfsd_mutex);
 435:			if (rv < 0)
 436:				return rv;
 437:		} else
 438:			rv = nfsd_nrthreads(net);
 439:	
 440:		return scnprintf(buf, SIMPLE_TRANSACTION_LIMIT, "%d\n", rv);
 441:	}
 442:	
 443:	/*
 444:	 * write_pool_threads - Set or report the configured number of threads per pool
 445:	 *
 446:	 * Input:
 447:	 *			buf:		ignored
]

gemini-3.1-pro-preview

							input: 58349
							output: 39
							thoughts: 18
						

**My Thought Process Regarding `nfsd_svc` and `nfsd_create_serv`**

My current line of inquiry is tracing the execution flow within the NFS server daemon, specifically how the initial service setup is initiated. I've identified that the `nfsd_svc` function serves as a critical entry point for establishing the NFS server's operational framework. My immediate thought is to understand what happens immediately after `nfsd_svc` begins its execution. Given the function's role in service initialization, I'm expecting it to delegate the core task of actually *creating* the server infrastructure to another function. This leads me directly to the observation that `nfsd_svc`, in turn, invokes `nfsd_create_serv`. This subsequent call strongly suggests that `nfsd_create_serv` is responsible for the heavy lifting of setting up the server's listening sockets, registering necessary RPC services, and generally preparing the environment for handling incoming NFS requests. I'm now focused on dissecting the functionality within `nfsd_create_serv` to understand the precise mechanisms employed for this server instantiation.

map[File:fs/nfsd/nfssvc.c FirstLine:751 LineCount:30]

map[Contents: 751:	nfsd_svc(int n, int *nthreads, struct net *net, const struct cred *cred, const char *scope)
 752:	{
 753:		int	error;
 754:		struct nfsd_net *nn = net_generic(net, nfsd_net_id);
 755:		struct svc_serv *serv;
 756:	
 757:		lockdep_assert_held(&nfsd_mutex);
 758:	
 759:		dprintk("nfsd: creating service\n");
 760:	
 761:		strscpy(nn->nfsd_name, scope ? scope : utsname()->nodename,
 762:			sizeof(nn->nfsd_name));
 763:	
 764:		error = nfsd_create_serv(net);
 765:		if (error)
 766:			goto out;
 767:		serv = nn->nfsd_serv;
 768:	
 769:		error = nfsd_startup_net(net, cred);
 770:		if (error)
 771:			goto out_put;
 772:		error = nfsd_set_nrthreads(n, nthreads, net);
 773:		if (error)
 774:			goto out_put;
 775:		error = serv->sv_nrthreads;
 776:	out_put:
 777:		if (serv->sv_nrthreads == 0)
 778:			nfsd_destroy_serv(net);
 779:	out:
 780:		return error;
]

gemini-3.1-pro-preview

							input: 58854
							output: 19
							thoughts: 481
						

**My Thought Process on Exploiting NFSd Threading and Initialization**

Here's how my mind worked through this problem, aiming to find a reliable exploit vector within the NFSd subsystem.

Initially, I considered what would happen if I wrote `0` to `/tmp/nfsd/threads`. My understanding was that this would trigger a call to `nfsd_svc` with `newthreads = 0`. This, in turn, would lead to `nfsd_create_serv(net)`, followed by `nfsd_startup_net(net, cred)`, and then `nfsd_set_nrthreads(1, &newthreads, net)`. Because `newthreads` was `0`, the `sv_nrthreads` field within the service structure would be set to `0`. The critical realization came with the `if (serv->sv_nrthreads == 0)` check, which would then call `nfsd_destroy_serv(net)`. The consequence of this destruction is that the per-CPU counters, specifically `sp_sockets_queued` which is crucial for the RPC dispatcher, would be freed. This offered a potential avenue for a crash, but the immediate freeing of the counters seemed like it might lead to a quick exit or a less controllable state.

Therefore, writing `0` seemed problematic for achieving a controlled crash related to uninitialized per-CPU data. I then shifted my focus to writing `1`. My initial thought was, "Okay, if I write `1`, it will start a thread." I paused to consider if this was inherently a problem. No, not directly. The real vulnerability lay elsewhere.

The next step in my thought process involved fault injection. I hypothesized that if I enabled fault injection, and then wrote `1` to `threads`, `nfsd_create_serv` *might* succeed, but more importantly, `percpu_counter_init` (which is responsible for initializing those critical per-CPU counters) *might fail*. This failure is key. After this potential failure, I would then disable fault injection.

The crucial exploit sequence was then to write `tcp 2049` to `portlist`. This action triggers the creation of the transport endpoint and the enqueuing of data. The problem arises because if `percpu_counter_init` failed earlier, the `sp_sockets_queued` counter (or a similar per-CPU counter used by the receiving threads) would be uninitialized. When `svc_xprt_create` and subsequently `svc_xprt_enqueue` are called, they would attempt to operate on this uninitialized counter, leading to a crash.

This approach felt much more reliable. Unlike relying on fault injection directly within `svc_xprt_create` or `svc_xprt_enqueue` (which could be non-deterministic or have other side effects), this method creates a state where a subsequent, seemingly normal operation (writing to `portlist`) is guaranteed to hit an uninitialized data structure due to the earlier, controlled failure of `percpu_counter_init`. It sidesteps the complexities of predicting the exact failure point of fault injection within the transport layer creation itself.

Finally, I took a moment to trace the execution path with `newthreads = 1` to solidify my understanding. `nfsd_svc(1, &newthreads, net, file->f_cred, NULL)` would call `nfsd_create_serv(net)`. Assuming `nfsd_create_serv` succeeds and `nn->nfsd_serv` is populated, `nfsd_startup_net` would be invoked, followed by `nfsd_set_nrthreads`, which would indeed start one thread. The critical question remained: if `percpu_counter_init` had failed during this sequence, would the newly started thread crash immediately when it tried to access `sp_sockets_queued` in functions like `svc_recv`? This is the exact scenario I was aiming for – a race condition where a thread is started but operates on uninitialized critical data.

map[Expression:sp_sockets_queued]

map[Output:include/linux/sunrpc/svc.h=36=struct svc_pool {
--
include/linux/sunrpc/svc.h-46-	struct percpu_counter	sp_messages_arrived;
include/linux/sunrpc/svc.h:47:	struct percpu_counter	sp_sockets_queued;
include/linux/sunrpc/svc.h-48-	struct percpu_counter	sp_threads_woken;
--
net/sunrpc/svc.c=483=__svc_create(struct svc_program *prog, int nprogs, struct svc_stat *stats,
--
net/sunrpc/svc.c-543-		percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL);
net/sunrpc/svc.c:544:		percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL);
net/sunrpc/svc.c-545-		percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL);
--
net/sunrpc/svc.c=601=svc_destroy(struct svc_serv **servp)
--
net/sunrpc/svc.c-627-		percpu_counter_destroy(&pool->sp_messages_arrived);
net/sunrpc/svc.c:628:		percpu_counter_destroy(&pool->sp_sockets_queued);
net/sunrpc/svc.c-629-		percpu_counter_destroy(&pool->sp_threads_woken);
--
net/sunrpc/svc_xprt.c=507=void svc_xprt_enqueue(struct svc_xprt *xprt)
--
net/sunrpc/svc_xprt.c-523-
net/sunrpc/svc_xprt.c:524:	percpu_counter_inc(&pool->sp_sockets_queued);
net/sunrpc/svc_xprt.c-525-	xprt->xpt_qtime = ktime_get();
--
net/sunrpc/svc_xprt.c=1554=static int svc_pool_stats_show(struct seq_file *m, void *p)
--
net/sunrpc/svc_xprt.c-1565-		   percpu_counter_sum_positive(&pool->sp_messages_arrived),
net/sunrpc/svc_xprt.c:1566:		   percpu_counter_sum_positive(&pool->sp_sockets_queued),
net/sunrpc/svc_xprt.c-1567-		   percpu_counter_sum_positive(&pool->sp_threads_woken));
]

gemini-3.1-pro-preview

							input: 60027
							output: 39
							thoughts: 8320
						

**My Thoughts on Triggering the NFS Daemon Bug**

Alright, let's break down my thought process here. The core of this puzzle is a race condition involving per-CPU memory allocations within the NFS daemon, specifically triggered by `percpu_counter_init` failing when it shouldn't. My goal is to reliably trigger this specific failure and then hit a subsequent code path that crashes.

Initially, I noticed that the `sp_sockets_queued` counter, which is crucial for triggering the crash via `svc_xprt_enqueue`, is only accessed by `svc_xprt_enqueue` and `svc_pool_stats_show`. This is important because it means directly starting the thread associated with these accesses should be safe from immediate race conditions with our fault injection.

My initial sequence involved these steps:

1.  **Inject a failure**: I planned to write "1" to `/proc/self/make-it-fail`. This is my primary mechanism for enabling kernel fault injection for memory allocations.
2.  **Trigger `nfsd_create_serv`**: I would then write "1" to `/proc/self/threads`. This action, according to the kernel code, initiates the `nfsd_create_serv` function. This is where the critical per-CPU allocations happen.
    *   If `nfsd_create_serv` fails catastrophically (e.g., a `kzalloc` failure), the `write` operation to `/proc/self/threads` would return an error, and I'd know to restart.
    *   Crucially, if `nfsd_create_serv` *succeeds* but `percpu_counter_init` fails internally, the `write` to `/proc/self/threads` would report success. This is the state I'm aiming for.
3.  **Disable fault injection**: I'd write "0" back to `/proc/self/make-it-fail` to turn off the fault injection.
4.  **Trigger the crash**: If the previous `write` to `/proc/self/threads` succeeded (meaning `nfsd_create_serv` ran and potentially had a per-CPU allocation failure), I'd then write "tcp 2049" to `/proc/self/portlist`. This action is designed to call `svc_xprt_create` and then `svc_xprt_enqueue`. If `percpu_counter_init` had failed during the earlier `nfsd_create_serv` call, this `svc_xprt_enqueue` call would hit the bug and crash.

This approach seemed incredibly clean and reliable at first glance. I wouldn't have to worry about `svc_xprt_create` itself failing due to fault injection, as I'd disable it before that step.

However, a problem arose with sequential execution: if I simply looped this sequence and the child process exited after each attempt, the per-CPU memory might never fail. The reason is that if a process exits, its namespaces are destroyed, and crucially, the per-CPU memory associated with its `nfsd` instance would be freed. The next iteration would then simply reuse the same, already populated, per-CPU memory structures. This means `pcpu_alloc` wouldn't need to allocate a *new* chunk or populate *new* pages, bypassing the opportunity for `fail_page_alloc` or `failslab` to intervene.

So, the solution was to **keep the child process alive** if it successfully set up the NFS service without crashing. This child process would then continuously hold onto its per-CPU memory allocations.

My revised strategy became:

1.  **Fork a child process**: Each child would set up its own isolated network and mount namespaces (`unshare(CLONE_NEWNET | CLONE_NEWNS)`).
2.  **Mount NFSd**: Mount the `nfsd` pseudo-filesystem.
3.  **Enable fault injection**: Write "1" to `/proc/self/make-it-fail`.
4.  **Trigger `nfsd_create_serv`**: Write "1\n" to `/tmp/nfsd/threads`. This is the key step where `percpu_counter_init` might fail.
5.  **Disable fault injection**: Write "0" to `/proc/self/make-it-fail`.
6.  **Trigger the crash path**: Write "tcp 2049\n" to `/tmp/nfsd/portlist`. Since fault injection is off, `svc_xprt_create` should succeed, and `svc_xprt_enqueue` should then trigger the crash if `percpu_counter_init` failed earlier.
7.  **Keep the child alive**: If the child process *didn't* crash (meaning `percpu_counter_init` succeeded in this iteration), instead of exiting, it would `sleep(10000)`. This is vital! By keeping the process alive, it continues to consume per-CPU memory.

The reason this is brilliant is that `nfsd_create_serv` allocates several per-CPU counters, and `percpu_ref_init` also allocates per-CPU memory. With multiple concurrent processes (up to 1000 in my final design), each holding onto its per-CPU allocations, we rapidly deplete available per-CPU memory pages. This forces `pcpu_populate_chunk` to be called frequently. With a 5% probability set on `fail_page_alloc`, it's highly likely that `pcpu_populate_chunk` will eventually fail. When it fails, `__alloc_percpu_gfp` returns `NULL`, and `percpu_counter_init` fails with `-ENOMEM`.

My initial concern about `nfsd_startup_net` or `nfsd_set_nrthreads` failing and destroying the service was addressed by realizing that writing to `/proc/self/portlist` is the more reliable path. This write operation first calls `nfsd_create_serv`. If `nfsd_create_serv` succeeds (even if a per-CPU counter failed), it sets `nn->nfsd_serv`. Then, the write proceeds to call `svc_xprt_create`. Because I disable fault injection *before* this write, `svc_xprt_create` is much more likely to succeed. And if `nfsd_create_serv` did indeed have a per-CPU allocation failure, the subsequent `svc_xprt_enqueue` will then trigger the crash.

The strategy of keeping processes alive and managing a pool of up to 1000 concurrent offenders is the key to ensuring that we saturate the per-CPU memory allocator, thereby guaranteeing that `pcpu_populate_chunk` is called frequently enough for the fault injection to take effect on the specific per-CPU counter responsible for the crash. It's a clever way to create the necessary conditions for the bug to manifest.

map[File:fs/nfsd/nfsctl.c FirstLine:725 LineCount:25]

map[Contents: 725:	static ssize_t __write_ports_addfd(char *buf, struct net *net, const struct cred *cred)
 726:	{
 727:		char *mesg = buf;
 728:		int fd, err;
 729:		struct nfsd_net *nn = net_generic(net, nfsd_net_id);
 730:		struct svc_serv *serv;
 731:	
 732:		err = get_int(&mesg, &fd);
 733:		if (err != 0 || fd < 0)
 734:			return -EINVAL;
 735:		trace_nfsd_ctl_ports_addfd(net, fd);
 736:	
 737:		err = nfsd_create_serv(net);
 738:		if (err != 0)
 739:			return err;
 740:	
 741:		serv = nn->nfsd_serv;
 742:		err = svc_addsock(serv, net, fd, buf, SIMPLE_TRANSACTION_LIMIT, cred);
 743:	
 744:		if (!serv->sv_nrthreads && list_empty(&nn->nfsd_serv->sv_permsocks))
 745:			nfsd_destroy_serv(net);
 746:	
 747:		return err;
 748:	}
 749:	
]

gemini-3.1-pro-preview

							input: 68770
							output: 39
							thoughts: 83
						

**My Thought Process Regarding NFS Daemon Socket Handling**

So, I've been digging into the NFS daemon's socket management, and a rather concerning interaction caught my eye. It seems that within the `__write_ports_addfd` function, there's a conditional destruction of the NFS service (`nfsd_destroy_serv`). This destruction is triggered if two specific conditions are met: the number of threads (`sv_nrthreads`) is zero, and importantly, the `sv_permsocks` list is empty.

This immediately made me think about the implications of `svc_addsock` failing. If `svc_addsock` were to fail for any reason, it would naturally leave `sv_permsocks` empty. And then, according to the logic in `__write_ports_addfd`, this would directly lead to the NFS service being destroyed. That's a pretty drastic outcome for a single socket addition failure – essentially a denial-of-service scenario if this path is hit unexpectedly.

My next logical step, naturally, was to consider a related function: `__write_ports_addxprt`. I'm wondering if a similar, or perhaps even a different, failure mode exists there, and how its error handling might impact the overall NFS service stability. It's crucial to understand if this fragility is isolated to `__write_ports_addfd` or if it's a more systemic issue across how transports and file descriptors are added to the NFS service. I need to trace that path as well to ensure a comprehensive understanding of the potential failure vectors.

map[File:fs/nfsd/nfsctl.c FirstLine:754 LineCount:30]

map[Contents: 754:	static ssize_t __write_ports_addxprt(char *buf, struct net *net, const struct cred *cred)
 755:	{
 756:		char transport[16];
 757:		struct svc_xprt *xprt;
 758:		int port, err;
 759:		struct nfsd_net *nn = net_generic(net, nfsd_net_id);
 760:		struct svc_serv *serv;
 761:	
 762:		if (sscanf(buf, "%15s %5u", transport, &port) != 2)
 763:			return -EINVAL;
 764:	
 765:		if (port < 1 || port > USHRT_MAX)
 766:			return -EINVAL;
 767:		trace_nfsd_ctl_ports_addxprt(net, transport, port);
 768:	
 769:		err = nfsd_create_serv(net);
 770:		if (err != 0)
 771:			return err;
 772:	
 773:		serv = nn->nfsd_serv;
 774:		err = svc_xprt_create(serv, transport, net,
 775:				      PF_INET, port, SVC_SOCK_ANONYMOUS, cred);
 776:		if (err < 0)
 777:			goto out_err;
 778:	
 779:		err = svc_xprt_create(serv, transport, net,
 780:				      PF_INET6, port, SVC_SOCK_ANONYMOUS, cred);
 781:		if (err < 0 && err != -EAFNOSUPPORT)
 782:			goto out_close;
 783:	
]

gemini-3.1-pro-preview

							input: 69386
							output: 39
							thoughts: 18
						

**My Thought Process for Analyzing `__write_ports_addxprt`**

Alright, the immediate thought upon encountering `__write_ports_addxprt` is, "What exactly is this function trying to achieve, and what are the implications of its implementation?" My expertise tells me that port writing, especially in a context that suggests hardware interaction or low-level system operations, is a critical area. Errors here can manifest in subtle, hard-to-debug issues, or outright system instability.

So, my primary objective is to meticulously dissect this function. I'm not just looking for a surface-level understanding; I need to grasp the *intent* behind each instruction. Is this function responsible for configuring a peripheral? Is it involved in data transfer to a device? Is it setting up some kind of communication channel? The name `addxprt` hints at something related to "add" and perhaps "export" or "transport," which is intriguing. It could imply the addition of a new transmission point or the initiation of data movement.

I'll be paying very close attention to the arguments passed to the function. What data types are involved? Are there any pointers? What are the expected ranges or constraints of these arguments? This is where I can start to infer the *context* of `__write_ports_addxprt`. If it takes a device handle and a data buffer, the purpose becomes clearer. If it takes a port number and a configuration value, that points in a different direction.

Then, the core logic of the function is paramount. I'll be tracing the execution flow, step by step. Are there any conditional branches? What are the conditions? How does the function handle different states or error conditions? I'll be looking for common pitfalls:

*   **Race conditions:** If this function is intended for concurrent access, how does it ensure atomicity? Are there any locks or synchronization primitives in play?
*   **Buffer overflows/underflows:** If it's dealing with data buffers, are the sizes being validated correctly?
*   **Invalid port addresses:** Is there any validation of the port numbers or addresses being written to?
*   **Error handling:** How are errors reported? Is there a return code? Are exceptions thrown? Or is it assumed that these operations are infallible in the intended environment?
*   **Side effects:** What other parts of the system might be affected by a write to these ports? Does it trigger interrupts? Does it change system state in an observable way?

The "ports" themselves are a key focus. What *kind* of ports are we talking about? Are these I/O ports in the traditional sense (like on an x86 system), or are they more abstract concepts within a software framework, perhaps representing communication endpoints in a distributed system or a kernel module? The term "ports" can be overloaded, and understanding its specific meaning here is crucial.

Furthermore, I'm considering the implications for performance. Port writes, especially if they involve hardware, can be blocking operations. How does the function's implementation impact the overall responsiveness of the system? Are there any optimizations that could be made, or any inherent performance bottlenecks?

Finally, and perhaps most importantly for an expert, I'll be thinking about how this function integrates with the surrounding code. What is the contract of `__write_ports_addxprt`? What are the preconditions for calling it, and what are the postconditions that are guaranteed? Understanding its role within the larger system architecture will help me assess its correctness and identify potential areas for improvement or security vulnerabilities. It's all about building a comprehensive mental model of its behavior and its impact.

map[File:fs/nfsd/nfsctl.c FirstLine:784 LineCount:20]

map[Contents: 784:		return 0;
 785:	out_close:
 786:		xprt = svc_find_xprt(serv, transport, net, PF_INET, port);
 787:		if (xprt != NULL) {
 788:			svc_xprt_close(xprt);
 789:			svc_xprt_put(xprt);
 790:		}
 791:	out_err:
 792:		if (!serv->sv_nrthreads && list_empty(&nn->nfsd_serv->sv_permsocks))
 793:			nfsd_destroy_serv(net);
 794:	
 795:		return err;
 796:	}
 797:	
 798:	static ssize_t __write_ports(struct file *file, char *buf, size_t size,
 799:				     struct net *net)
 800:	{
 801:		if (size == 0)
 802:			return __write_ports_names(buf, net);
 803:	
]

gemini-3.1-pro-preview

							input: 69739
							output: 40
							thoughts: 529
						

**My Thought Process on Unlocking the NFS Daemon Bug**

Okay, so I've been digging into this NFS daemon behavior, and it's a bit of a maze, but I think I've finally pieced together the critical path to trigger this bug. My primary goal is to reliably cause `svc_xprt_enqueue` to crash, but the way the service destruction logic is set up is making it tricky.

My initial realization was that under specific conditions – namely, when `sv_nrthreads` is zero and `sv_permsocks` is empty – the `nfsd_destroy_serv` function is *always* invoked. This is a major hurdle because it means any failure in the early stages of setting up the service will immediately tear it down, preventing me from progressing to the point where the bug might occur.

This immediately ruled out any approach that involved splitting the setup into two separate system calls where the first could fail and then the subsequent steps would be executed. The service destruction would just cut me off.

Then I had a breakthrough regarding the `write_threads` mechanism. If I use `write_threads` to initiate just one thread (`newthreads = 1`), and critically, if *both* `nfsd_startup_net` and `nfsd_set_nrthreads` *succeed*, then `sv_nrthreads` will be set to 1. This is huge because it means the service *won't* be destroyed.

Now, the key here is fault injection. I'm using fault injection, which has a probabilistic nature (around 5%). My strategy is to disable fault injection *after* `write_threads` has completed successfully. So, the challenge shifts to ensuring that `nfsd_startup_net` and `nfsd_set_nrthreads` can *succeed* even while fault injection is still active. Because it's probabilistic, there's a good chance they *will* succeed in a given iteration.

If they do succeed, the service remains alive, and the `nn->nfsd_serv` pointer gets populated. Once that happens, I disable fault injection. Then, I proceed to write to the `portlist`. This write operation will trigger `__write_ports_addxprt`. Inside that, `nfsd_create_serv` will be called, but it should return immediately (as it's designed to do nothing if the service is already initialized). The crucial part is `svc_xprt_create`, which, with fault injection now disabled, *should* succeed. Finally, `svc_xprt_enqueue` is called, and that's where I anticipate the crash will occur.

I believe this is still the most viable path. The core requirement is that `write_threads` must succeed. If it fails in any given iteration, I'm just going to retry. With a large number of iterations, say 5000, I'm confident I'll eventually hit an iteration where `percpu_counter_init` might fail (which is fine, it doesn't destroy the service), but critically, `nfsd_startup_net` and `nfsd_set_nrthreads` will succeed.

However, I have a lingering concern. `nfsd_startup_net` and `nfsd_set_nrthreads` are memory-intensive operations. If they fail too frequently due to fault injection, it might skew the probability and I might not reach the specific condition needed for the bug. This makes me wonder if there's a more direct way to initialize the service, perhaps just calling `nfsd_create_serv` and nothing else? Or maybe exploring functions like `nfsd_nl_listener_set_doit` could offer an alternative entry point? This remains an open question I need to explore.

map[File:fs/nfsd/nfsctl.c FirstLine:1953 LineCount:30]

map[Contents:1953:	int nfsd_nl_listener_set_doit(struct sk_buff *skb, struct genl_info *info)
1954:	{
1955:		struct net *net = genl_info_net(info);
1956:		struct svc_xprt *xprt, *tmp;
1957:		const struct nlattr *attr;
1958:		struct svc_serv *serv;
1959:		LIST_HEAD(permsocks);
1960:		struct nfsd_net *nn;
1961:		bool delete = false;
1962:		int err, rem;
1963:	
1964:		mutex_lock(&nfsd_mutex);
1965:	
1966:		err = nfsd_create_serv(net);
1967:		if (err) {
1968:			mutex_unlock(&nfsd_mutex);
1969:			return err;
1970:		}
1971:	
1972:		nn = net_generic(net, nfsd_net_id);
1973:		serv = nn->nfsd_serv;
1974:	
1975:		spin_lock_bh(&serv->sv_lock);
1976:	
1977:		/* Move all of the old listener sockets to a temp list */
1978:		list_splice_init(&serv->sv_permsocks, &permsocks);
1979:	
1980:		/*
1981:		 * Walk the list of server_socks from userland and move any that match
1982:		 * back to sv_permsocks
]

gemini-3.1-pro-preview

							input: 70747
							output: 40
							thoughts: 84
						

**My Thought Process Regarding `nfsd_nl_listener_set_doit`**

Alright, so I'm looking at `nfsd_nl_listener_set_doit`. My initial scan tells me it kicks off by calling `nfsd_create_serv(net)`. The success or failure of that call seems to dictate the next step. If `nfsd_create_serv` *does* work out, then I see some netlink operations happening. However, if it *doesn't* succeed, the function simply returns the `err` value.

This immediately raises a question in my mind: what happens if `nfsd_create_serv` succeeds, but then some *subsequent* operation within `nfsd_nl_listener_set_doit` fails? Does the function clean up and destroy the service it just created, or does it leave it in some potentially inconsistent state? I need to dig deeper into the rest of the `nfsd_nl_listener_set_doit` function to understand the full error handling and resource management behavior in those later stages. My next step is to trace the execution path following a successful `nfsd_create_serv` call to see how potential failures are managed.

map[File:fs/nfsd/nfsctl.c FirstLine:1983 LineCount:50]

map[Contents:1983:		 */
1984:		nlmsg_for_each_attr_type(attr, NFSD_A_SERVER_SOCK_ADDR, info->nlhdr,
1985:					 GENL_HDRLEN, rem) {
1986:			struct nlattr *tb[NFSD_A_SOCK_MAX + 1];
1987:			const char *xcl_name;
1988:			struct sockaddr *sa;
1989:	
1990:			if (nla_parse_nested(tb, NFSD_A_SOCK_MAX, attr,
1991:					     nfsd_sock_nl_policy, info->extack) < 0)
1992:				continue;
1993:	
1994:			if (!tb[NFSD_A_SOCK_ADDR] || !tb[NFSD_A_SOCK_TRANSPORT_NAME])
1995:				continue;
1996:	
1997:			if (nla_len(tb[NFSD_A_SOCK_ADDR]) < sizeof(*sa))
1998:				continue;
1999:	
2000:			xcl_name = nla_data(tb[NFSD_A_SOCK_TRANSPORT_NAME]);
2001:			sa = nla_data(tb[NFSD_A_SOCK_ADDR]);
2002:	
2003:			/* Put back any matching sockets */
2004:			list_for_each_entry_safe(xprt, tmp, &permsocks, xpt_list) {
2005:				/* This shouldn't be possible */
2006:				if (WARN_ON_ONCE(xprt->xpt_net != net)) {
2007:					list_move(&xprt->xpt_list, &serv->sv_permsocks);
2008:					continue;
2009:				}
2010:	
2011:				/* If everything matches, put it back */
2012:				if (!strcmp(xprt->xpt_class->xcl_name, xcl_name) &&
2013:				    rpc_cmp_addr_port(sa, (struct sockaddr *)&xprt->xpt_local)) {
2014:					list_move(&xprt->xpt_list, &serv->sv_permsocks);
2015:					break;
2016:				}
2017:			}
2018:		}
2019:	
2020:		/*
2021:		 * If there are listener transports remaining on the permsocks list,
2022:		 * it means we were asked to remove a listener.
2023:		 */
2024:		if (!list_empty(&permsocks)) {
2025:			list_splice_init(&permsocks, &serv->sv_permsocks);
2026:			delete = true;
2027:		}
2028:		spin_unlock_bh(&serv->sv_lock);
2029:	
2030:		/* Do not remove listeners while there are active threads. */
2031:		if (serv->sv_nrthreads) {
2032:			err = -EBUSY;
]

gemini-3.1-pro-preview

							input: 71698
							output: 40
							thoughts: 21
						

map[File:fs/nfsd/nfsctl.c FirstLine:2033 LineCount:30]

map[Contents:2033:			goto out_unlock_mtx;
2034:		}
2035:	
2036:		/*
2037:		 * Since we can't delete an arbitrary llist entry, destroy the
2038:		 * remaining listeners and recreate the list.
2039:		 */
2040:		if (delete)
2041:			svc_xprt_destroy_all(serv, net, false);
2042:	
2043:		/* walk list of addrs again, open any that still don't exist */
2044:		nlmsg_for_each_attr_type(attr, NFSD_A_SERVER_SOCK_ADDR, info->nlhdr,
2045:					 GENL_HDRLEN, rem) {
2046:			struct nlattr *tb[NFSD_A_SOCK_MAX + 1];
2047:			const char *xcl_name;
2048:			struct sockaddr *sa;
2049:			int ret;
2050:	
2051:			if (nla_parse_nested(tb, NFSD_A_SOCK_MAX, attr,
2052:					     nfsd_sock_nl_policy, info->extack) < 0)
2053:				continue;
2054:	
2055:			if (!tb[NFSD_A_SOCK_ADDR] || !tb[NFSD_A_SOCK_TRANSPORT_NAME])
2056:				continue;
2057:	
2058:			if (nla_len(tb[NFSD_A_SOCK_ADDR]) < sizeof(*sa))
2059:				continue;
2060:	
2061:			xcl_name = nla_data(tb[NFSD_A_SOCK_TRANSPORT_NAME]);
2062:			sa = nla_data(tb[NFSD_A_SOCK_ADDR]);
]

gemini-3.1-pro-preview

							input: 72249
							output: 40
							thoughts: 5
						

**My Thought Process for Navigating the Data Landscape**

When I begin any analytical endeavor, my immediate focus is on establishing a robust understanding of the data at my disposal. This isn't merely about *having* data, but about truly *knowing* it. I consider it my responsibility to delve into its origins, its intended purpose, and the potential biases it might carry from its collection or processing. This foundational understanding is crucial because it informs every subsequent step, from data cleaning to model selection. I'm always asking myself: "Where did this come from? Who generated it? What assumptions were baked in?" This critical inquiry helps me to anticipate potential pitfalls and to approach the data with a healthy dose of skepticism, ensuring I don't blindly trust what I see.

Following this initial assessment, I transition to the practicalities of data preparation. This involves a multi-faceted approach to ensure the data is fit for analysis. I meticulously handle missing values, not just by imputation, but by understanding *why* they are missing. Are they random, or do they represent a systematic issue? I also pay close attention to outliers; they can be errors, or they can be the most valuable insights. My approach here is to investigate, not just to remove. Data transformation is another key area. I consider what scales, encodings, or feature engineering techniques will best represent the underlying information and optimize it for the analytical methods I intend to employ. This phase is iterative; as I explore the data, new questions arise, leading me back to earlier steps to refine my preparation.

The next critical juncture is exploratory data analysis (EDA). This is where I begin to uncover the narrative within the data. I employ a variety of statistical summaries and visualizations to identify patterns, relationships, and anomalies. My goal here is to build intuition. I'm looking for correlations, distributions, and potential clusters that might suggest underlying structures or hypotheses. This exploration is not just about confirming expectations but also about discovering the unexpected. I'm constantly looking for signals that challenge my initial assumptions or point towards a more nuanced interpretation of the data.

Once I have a solid grasp of the data and have prepared it appropriately, I move to the selection of analytical methods. This decision is heavily influenced by the nature of the problem I'm trying to solve, the characteristics of the data, and the specific insights I aim to derive. I consider the trade-offs between different techniques, evaluating their assumptions, their computational complexity, and their interpretability. I often start with simpler, more robust methods to establish a baseline and then progressively explore more sophisticated approaches if warranted.

After applying my chosen methods, I enter the crucial phase of evaluation and interpretation. This is where I assess the performance of my models or the validity of my findings against relevant metrics and domain knowledge. I am particularly vigilant about avoiding overfitting and ensuring that my results generalize well. My interpretation is not just about reporting numbers; it's about translating those numbers into actionable insights. I strive to communicate the implications of my analysis clearly, honestly, and in a manner that is directly relevant to the stakeholders. This often involves acknowledging limitations and suggesting avenues for further investigation.

Finally, and perhaps most importantly, I maintain a continuous feedback loop throughout the entire process. The insights gained at each stage inform and refine the subsequent ones. I am always open to revising my approach based on new discoveries, challenging my own assumptions, and seeking to improve the accuracy and robustness of my analysis. My ultimate aim is not just to process data, but to derive meaningful and reliable knowledge from it.

map[File:fs/nfsd/nfsctl.c FirstLine:2063 LineCount:30]

map[Contents:2063:	
2064:			xprt = svc_find_listener(serv, xcl_name, net, sa);
2065:			if (xprt) {
2066:				if (delete)
2067:					WARN_ONCE(1, "Transport type=%s already exists\n",
2068:						  xcl_name);
2069:				svc_xprt_put(xprt);
2070:				continue;
2071:			}
2072:	
2073:			ret = svc_xprt_create_from_sa(serv, xcl_name, net, sa, 0,
2074:						      current_cred());
2075:			/* always save the latest error */
2076:			if (ret < 0)
2077:				err = ret;
2078:		}
2079:	
2080:		if (!serv->sv_nrthreads && list_empty(&nn->nfsd_serv->sv_permsocks))
2081:			nfsd_destroy_serv(net);
2082:	
2083:	out_unlock_mtx:
2084:		mutex_unlock(&nfsd_mutex);
2085:	
2086:		return err;
2087:	}
2088:	
2089:	/**
2090:	 * nfsd_nl_listener_get_doit - get the nfs running listeners
2091:	 * @skb: reply buffer
2092:	 * @info: netlink metadata and command arguments
]

gemini-3.1-pro-preview

							input: 72718
							output: 1794
							thoughts: 6595
						

**The Crucial Realization: Why a Single Syscall Falls Short**

I've been wrestling with how to reliably trigger this NFS-related bug, specifically focusing on the interaction between `nfsd_create_serv` and `svc_xprt_create` under fault injection. My initial thought was that a single syscall to write to `/tmp/nfsd/portlist` would be sufficient. I reasoned that if `nfsd_create_serv` partially succeeded and `svc_xprt_create` then hit a fault during its allocations (like `kzalloc`), the system would return an error, triggering `nfsd_destroy_serv` and effectively cleaning up. This seemed plausible if I could inject faults into `percpu_counter_init` within `nfsd_create_serv`.

However, a deeper dive revealed a critical flaw in this single-syscall approach. The problem lies with how percpu memory is managed. If `nfsd_create_serv` fails entirely, or if `svc_xprt_create` fails and subsequently calls `nfsd_destroy_serv`, the percpu memory associated with the service is freed. If this percpu memory is freed, the *next* time `nfsd_create_serv` is called (even within the same process or iteration), it will simply re-allocate and potentially reuse the same memory region. This means `pcpu_populate_chunk` – the very function where `fail_page_alloc` can trigger the critical failure – might *never* be called after the initial few iterations because the memory is already populated. Similarly, `failslab` would also be ineffective if the slab cache chunks aren't being newly allocated.

**The Elegant Solution: Leveraging Threads to Maintain PerCPU State**

This realization led me to understand why my initial attempts were failing to reproduce the bug consistently. The key is that we *must* ensure the percpu memory remains allocated and occupied to force new allocations and subsequent `pcpu_populate_chunk` calls under fault injection.

The only robust way to achieve this, as dictated by the `nfsd_nl_listener_set_doit` logic, is to keep the NFS service alive. This can be done either by starting a worker thread (`sv_nrthreads > 0`) or by adding a persistent socket (`sv_permsocks` not empty). My initial thought was to use `write_threads` with `newthreads = 1` to keep it alive. This is indeed the path forward.

The breakthrough came when I realized I could *split* the operation into two distinct writes: one to `/tmp/nfsd/threads` and another to `/tmp/nfsd/portlist`. Here's the refined thought process:

1.  **First Write (`/tmp/nfsd/threads`):** I enable fault injection (`write_file("/proc/self/make-it-fail", "1");`) and then write to `/tmp/nfsd/threads` to initiate the creation of the NFS service and a worker thread.
    *   **Scenario A (Success):** If `nfsd_create_serv` and related initializations succeed *except* for `percpu_counter_init` (due to fault injection), the service is still kept alive because `sv_nrthreads` becomes greater than 0. Crucially, the percpu memory is now held and won't be freed.
    *   **Scenario B (Failure):** If `nfsd_create_serv` or its initializations fail *and* lead to the service's destruction, the percpu memory is freed.

2.  **Second Write (`/tmp/nfsd/portlist`):** Immediately after, I disable fault injection (`write_file("/proc/self/make-it-fail", "0");`) and write to `/tmp/nfsd/portlist`.
    *   **Continuing Scenario A:** If the service was kept alive from step 1 (even with a failed `percpu_counter_init`), this second write triggers `svc_xprt_create`. Because `svc_xprt_create` now calls `svc_xprt_enqueue`, and the `percpu_counter_init` failed earlier, this is precisely where the crash occurs (`percpu_counter_inc` on an uninitialized counter).
    *   **Continuing Scenario B:** If the service was destroyed in step 1, this second write will call `nfsd_create_serv` again. Since fault injection is now off, `nfsd_create_serv` will succeed, followed by `svc_xprt_create`. This time, all percpu initializations will succeed, and the service will be created with a valid socket. Importantly, because a socket is now added (`sv_permsocks` is not empty), the service is kept alive, and its percpu memory is held.

**The Guarantee of Memory Occupation**

The beauty of this two-step approach is that, regardless of whether the first write succeeds or fails in creating a *fully functional* service, the second write (or the successful path of the first write) *always* ensures that the NFS service is kept alive, and its percpu memory is held. This guarantees that each iteration of my reproducer creates a *new* NFS service with *new* percpu memory allocations.

With enough iterations (around 400 in my setup, consuming about 9.6 KB of percpu memory), we are guaranteed to exhaust the existing populated percpu memory chunks and force a new page population. When this happens, the `write_file("/proc/self/make-it-fail", "1");` at the beginning of the next iteration will re-enable fault injection. This means that the `pcpu_populate_chunk` called during the creation of the new percpu memory *will* have a high probability (5%) of failing, leading directly to the crash scenario we are aiming for.

This split approach elegantly sidesteps the problem of percpu memory being freed and re-allocated, ensuring that fault injection has a consistent opportunity to fail the critical percpu initializations, thereby leading to the desired race condition and crash. It's a much simpler and more direct path to reproduction than any previous attempt.

The final reproducer code reflects this refined understanding, carefully orchestrating the fault injection and the writes to `threads` and `portlist` to reliably trigger the bug.

map[IsProbe:false RawCandidateReproC:#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <sys/socket.h>
#include <errno.h>
#include <signal.h>

void write_file(const char *path, const char *val) {
    int fd = open(path, O_WRONLY);
    if (fd < 0) {
        printf("[-] open %s failed: %s\n", path, strerror(errno));
        return;
    }
    if (write(fd, val, strlen(val)) < 0) {
        printf("[-] write to %s failed: %s\n", path, strerror(errno));
    }
    close(fd);
}

void bring_lo_up(void) {
    int fd = socket(AF_INET, SOCK_DGRAM, 0);
    if (fd < 0) {
        printf("[-] socket failed: %s\n", strerror(errno));
        exit(1);
    }
    struct ifreq ifr;
    strcpy(ifr.ifr_name, "lo");
    if (ioctl(fd, SIOCGIFFLAGS, &ifr) < 0) {
        printf("[-] ioctl SIOCGIFFLAGS failed: %s\n", strerror(errno));
        exit(1);
    }
    ifr.ifr_flags |= IFF_UP | IFF_RUNNING;
    if (ioctl(fd, SIOCSIFFLAGS, &ifr) < 0) {
        printf("[-] ioctl SIOCSIFFLAGS failed: %s\n", strerror(errno));
        exit(1);
    }
    close(fd);
}

int main(void) {
    printf("[*] Starting reproducer...\n");

    if (mount("debugfs", "/sys/kernel/debug", "debugfs", 0, NULL) != 0) {
        if (errno != EBUSY) {
            printf("[-] Failed to mount debugfs: %s\n", strerror(errno));
        }
    }

    // Setup fault injection for slab allocations
    write_file("/sys/kernel/debug/failslab/probability", "5");
    write_file("/sys/kernel/debug/failslab/times", "-1");
    write_file("/sys/kernel/debug/failslab/task-filter", "Y");
    write_file("/sys/kernel/debug/failslab/ignore-gfp-wait", "N");

    // Setup fault injection for page allocations
    write_file("/sys/kernel/debug/fail_page_alloc/probability", "5");
    write_file("/sys/kernel/debug/fail_page_alloc/times", "-1");
    write_file("/sys/kernel/debug/fail_page_alloc/task-filter", "Y");
    write_file("/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", "N");

    int max_procs = 400;
    pid_t *pids = calloc(max_procs, sizeof(pid_t));
    if (!pids) {
        printf("[-] calloc failed: %s\n", strerror(errno));
        exit(1);
    }
    
    int head = 0;
    
    for (int i = 0; i < 5000; i++) {
        if (pids[head] != 0) {
            kill(pids[head], SIGKILL);
            waitpid(pids[head], NULL, 0);
        }
        
        pid_t pid = fork();
        if (pid < 0) {
            printf("[-] fork failed: %s\n", strerror(errno));
            usleep(100000);
            continue;
        }
        if (pid == 0) {
            if (unshare(CLONE_NEWNET | CLONE_NEWNS) != 0) {
                printf("[-] unshare failed: %s\n", strerror(errno));
                exit(1);
            }
            if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL) < 0) {
                printf("[-] mount private failed: %s\n", strerror(errno));
                exit(1);
            }
            
            bring_lo_up();
            
            if (mkdir("/tmp/nfsd", 0777) < 0 && errno != EEXIST) {
                printf("[-] mkdir failed: %s\n", strerror(errno));
                exit(1);
            }
            if (mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL) < 0) {
                printf("[-] mount nfsd failed: %s\n", strerror(errno));
                exit(1);
            }
            
            int fd_threads = open("/tmp/nfsd/threads", O_WRONLY);
            if (fd_threads < 0) {
                printf("[-] open threads failed: %s\n", strerror(errno));
                exit(1);
            }
            
            int fd_portlist = open("/tmp/nfsd/portlist", O_WRONLY);
            if (fd_portlist < 0) {
                printf("[-] open portlist failed: %s\n", strerror(errno));
                exit(1);
            }
            
            write_file("/proc/self/make-it-fail", "1");
            
            // Try to create service and start a thread with fault injection.
            // We ignore the return value because it is expected to fail sometimes.
            if (write(fd_threads, "1\n", 2) < 0) {
                // Failed, but that's fine.
            }
            
            write_file("/proc/self/make-it-fail", "0");
            
            // Now add a port. If the service was created but percpu_counter_init failed,
            // this will crash the kernel.
            // If the service was destroyed, this will recreate it successfully and not crash.
            // In either case, the service is now alive and holding percpu memory!
            if (write(fd_portlist, "tcp 2049\n", 9) < 0) {
                // Failed, but that's fine.
            }
            
            // Keep alive to hold the percpu memory and force pcpu_populate_chunk in other processes
            sleep(10000);
            exit(0);
        }
        
        pids[head] = pid;
        head = (head + 1) % max_procs;
        usleep(2000);
        
        if (i % 100 == 0) {
            printf("[+] Iteration %d\n", i);
        }
    }
    
    for (int i = 0; i < max_procs; i++) {
        if (pids[i] != 0) {
            kill(pids[i], SIGKILL);
            waitpid(pids[i], NULL, 0);
        }
    }
    
    printf("[+] Done.\n");
    return 0;
}
]

map[IsProbe:false RawCandidateReproC:#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <sys/socket.h>
#include <errno.h>
#include <signal.h>

void write_file(const char *path, const char *val) {
    int fd = open(path, O_WRONLY);
    if (fd < 0) {
        printf("[-] open %s failed: %s\n", path, strerror(errno));
        return;
    }
    if (write(fd, val, strlen(val)) < 0) {
        printf("[-] write to %s failed: %s\n", path, strerror(errno));
    }
    close(fd);
}

void bring_lo_up(void) {
    int fd = socket(AF_INET, SOCK_DGRAM, 0);
    if (fd < 0) {
        printf("[-] socket failed: %s\n", strerror(errno));
        exit(1);
    }
    struct ifreq ifr;
    strcpy(ifr.ifr_name, "lo");
    if (ioctl(fd, SIOCGIFFLAGS, &ifr) < 0) {
        printf("[-] ioctl SIOCGIFFLAGS failed: %s\n", strerror(errno));
        exit(1);
    }
    ifr.ifr_flags |= IFF_UP | IFF_RUNNING;
    if (ioctl(fd, SIOCSIFFLAGS, &ifr) < 0) {
        printf("[-] ioctl SIOCSIFFLAGS failed: %s\n", strerror(errno));
        exit(1);
    }
    close(fd);
}

int main(void) {
    printf("[*] Starting reproducer...\n");

    if (mount("debugfs", "/sys/kernel/debug", "debugfs", 0, NULL) != 0) {
        if (errno != EBUSY) {
            printf("[-] Failed to mount debugfs: %s\n", strerror(errno));
        }
    }

    // Setup fault injection for slab allocations
    write_file("/sys/kernel/debug/failslab/probability", "5");
    write_file("/sys/kernel/debug/failslab/times", "-1");
    write_file("/sys/kernel/debug/failslab/task-filter", "Y");
    write_file("/sys/kernel/debug/failslab/ignore-gfp-wait", "N");

    // Setup fault injection for page allocations
    write_file("/sys/kernel/debug/fail_page_alloc/probability", "5");
    write_file("/sys/kernel/debug/fail_page_alloc/times", "-1");
    write_file("/sys/kernel/debug/fail_page_alloc/task-filter", "Y");
    write_file("/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", "N");

    int max_procs = 400;
    pid_t *pids = calloc(max_procs, sizeof(pid_t));
    if (!pids) {
        printf("[-] calloc failed: %s\n", strerror(errno));
        exit(1);
    }
    
    int head = 0;
    
    for (int i = 0; i < 5000; i++) {
        if (pids[head] != 0) {
            kill(pids[head], SIGKILL);
            waitpid(pids[head], NULL, 0);
        }
        
        pid_t pid = fork();
        if (pid < 0) {
            printf("[-] fork failed: %s\n", strerror(errno));
            usleep(100000);
            continue;
        }
        if (pid == 0) {
            if (unshare(CLONE_NEWNET | CLONE_NEWNS) != 0) {
                printf("[-] unshare failed: %s\n", strerror(errno));
                exit(1);
            }
            if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL) < 0) {
                printf("[-] mount private failed: %s\n", strerror(errno));
                exit(1);
            }
            
            bring_lo_up();
            
            if (mkdir("/tmp/nfsd", 0777) < 0 && errno != EEXIST) {
                printf("[-] mkdir failed: %s\n", strerror(errno));
                exit(1);
            }
            if (mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL) < 0) {
                printf("[-] mount nfsd failed: %s\n", strerror(errno));
                exit(1);
            }
            
            int fd_threads = open("/tmp/nfsd/threads", O_WRONLY);
            if (fd_threads < 0) {
                printf("[-] open threads failed: %s\n", strerror(errno));
                exit(1);
            }
            
            int fd_portlist = open("/tmp/nfsd/portlist", O_WRONLY);
            if (fd_portlist < 0) {
                printf("[-] open portlist failed: %s\n", strerror(errno));
                exit(1);
            }
            
            write_file("/proc/self/make-it-fail", "1");
            
            // Try to create service and start a thread with fault injection.
            // We ignore the return value because it is expected to fail sometimes.
            if (write(fd_threads, "1\n", 2) < 0) {
                // Failed, but that's fine.
            }
            
            write_file("/proc/self/make-it-fail", "0");
            
            // Now add a port. If the service was created but percpu_counter_init failed,
            // this will crash the kernel.
            // If the service was destroyed, this will recreate it successfully and not crash.
            // In either case, the service is now alive and holding percpu memory!
            if (write(fd_portlist, "tcp 2049\n", 9) < 0) {
                // Failed, but that's fine.
            }
            
            // Keep alive to hold the percpu memory and force pcpu_populate_chunk in other processes
            sleep(10000);
            exit(0);
        }
        
        pids[head] = pid;
        head = (head + 1) % max_procs;
        usleep(2000);
        
        if (i % 100 == 0) {
            printf("[+] Iteration %d\n", i);
        }
    }
    
    for (int i = 0; i < max_procs; i++) {
        if (pids[i] != 0) {
            kill(pids[i], SIGKILL);
            waitpid(pids[i], NULL, 0);
        }
    }
    
    printf("[+] Done.\n");
    return 0;
}
]

map[CurrentCandidateReproC:#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <sys/socket.h>
#include <errno.h>
#include <signal.h>

void write_file(const char *path, const char *val) {
    int fd = open(path, O_WRONLY);
    if (fd < 0) {
        printf("[-] open %s failed: %s\n", path, strerror(errno));
        return;
    }
    if (write(fd, val, strlen(val)) < 0) {
        printf("[-] write to %s failed: %s\n", path, strerror(errno));
    }
    close(fd);
}

void bring_lo_up(void) {
    int fd = socket(AF_INET, SOCK_DGRAM, 0);
    if (fd < 0) {
        printf("[-] socket failed: %s\n", strerror(errno));
        exit(1);
    }
    struct ifreq ifr;
    strcpy(ifr.ifr_name, "lo");
    if (ioctl(fd, SIOCGIFFLAGS, &ifr) < 0) {
        printf("[-] ioctl SIOCGIFFLAGS failed: %s\n", strerror(errno));
        exit(1);
    }
    ifr.ifr_flags |= IFF_UP | IFF_RUNNING;
    if (ioctl(fd, SIOCSIFFLAGS, &ifr) < 0) {
        printf("[-] ioctl SIOCSIFFLAGS failed: %s\n", strerror(errno));
        exit(1);
    }
    close(fd);
}

int main(void) {
    printf("[*] Starting reproducer...\n");

    if (mount("debugfs", "/sys/kernel/debug", "debugfs", 0, NULL) != 0) {
        if (errno != EBUSY) {
            printf("[-] Failed to mount debugfs: %s\n", strerror(errno));
        }
    }

    // Setup fault injection for slab allocations
    write_file("/sys/kernel/debug/failslab/probability", "5");
    write_file("/sys/kernel/debug/failslab/times", "-1");
    write_file("/sys/kernel/debug/failslab/task-filter", "Y");
    write_file("/sys/kernel/debug/failslab/ignore-gfp-wait", "N");

    // Setup fault injection for page allocations
    write_file("/sys/kernel/debug/fail_page_alloc/probability", "5");
    write_file("/sys/kernel/debug/fail_page_alloc/times", "-1");
    write_file("/sys/kernel/debug/fail_page_alloc/task-filter", "Y");
    write_file("/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", "N");

    int max_procs = 400;
    pid_t *pids = calloc(max_procs, sizeof(pid_t));
    if (!pids) {
        printf("[-] calloc failed: %s\n", strerror(errno));
        exit(1);
    }
    
    int head = 0;
    
    for (int i = 0; i < 5000; i++) {
        if (pids[head] != 0) {
            kill(pids[head], SIGKILL);
            waitpid(pids[head], NULL, 0);
        }
        
        pid_t pid = fork();
        if (pid < 0) {
            printf("[-] fork failed: %s\n", strerror(errno));
            usleep(100000);
            continue;
        }
        if (pid == 0) {
            if (unshare(CLONE_NEWNET | CLONE_NEWNS) != 0) {
                printf("[-] unshare failed: %s\n", strerror(errno));
                exit(1);
            }
            if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL) < 0) {
                printf("[-] mount private failed: %s\n", strerror(errno));
                exit(1);
            }
            
            bring_lo_up();
            
            if (mkdir("/tmp/nfsd", 0777) < 0 && errno != EEXIST) {
                printf("[-] mkdir failed: %s\n", strerror(errno));
                exit(1);
            }
            if (mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL) < 0) {
                printf("[-] mount nfsd failed: %s\n", strerror(errno));
                exit(1);
            }
            
            int fd_threads = open("/tmp/nfsd/threads", O_WRONLY);
            if (fd_threads < 0) {
                printf("[-] open threads failed: %s\n", strerror(errno));
                exit(1);
            }
            
            int fd_portlist = open("/tmp/nfsd/portlist", O_WRONLY);
            if (fd_portlist < 0) {
                printf("[-] open portlist failed: %s\n", strerror(errno));
                exit(1);
            }
            
            write_file("/proc/self/make-it-fail", "1");
            
            // Try to create service and start a thread with fault injection.
            // We ignore the return value because it is expected to fail sometimes.
            if (write(fd_threads, "1\n", 2) < 0) {
                // Failed, but that's fine.
            }
            
            write_file("/proc/self/make-it-fail", "0");
            
            // Now add a port. If the service was created but percpu_counter_init failed,
            // this will crash the kernel.
            // If the service was destroyed, this will recreate it successfully and not crash.
            // In either case, the service is now alive and holding percpu memory!
            if (write(fd_portlist, "tcp 2049\n", 9) < 0) {
                // Failed, but that's fine.
            }
            
            // Keep alive to hold the percpu memory and force pcpu_populate_chunk in other processes
            sleep(10000);
            exit(0);
        }
        
        pids[head] = pid;
        head = (head + 1) % max_procs;
        usleep(2000);
        
        if (i % 100 == 0) {
            printf("[+] Iteration %d\n", i);
        }
    }
    
    for (int i = 0; i < max_procs; i++) {
        if (pids[i] != 0) {
            kill(pids[i], SIGKILL);
            waitpid(pids[i], NULL, 0);
        }
    }
    
    printf("[+] Done.\n");
    return 0;
}
]

map[CompilerError: FormattedReproC:#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <sys/socket.h>
#include <errno.h>
#include <signal.h>

void write_file(const char *path, const char *val) {
    int fd = open(path, O_WRONLY);
    if (fd < 0) {
        printf("[-] open %s failed: %s\n", path, strerror(errno));
        return;
    }
    if (write(fd, val, strlen(val)) < 0) {
        printf("[-] write to %s failed: %s\n", path, strerror(errno));
    }
    close(fd);
}

void bring_lo_up(void) {
    int fd = socket(AF_INET, SOCK_DGRAM, 0);
    if (fd < 0) {
        printf("[-] socket failed: %s\n", strerror(errno));
        exit(1);
    }
    struct ifreq ifr;
    strcpy(ifr.ifr_name, "lo");
    if (ioctl(fd, SIOCGIFFLAGS, &ifr) < 0) {
        printf("[-] ioctl SIOCGIFFLAGS failed: %s\n", strerror(errno));
        exit(1);
    }
    ifr.ifr_flags |= IFF_UP | IFF_RUNNING;
    if (ioctl(fd, SIOCSIFFLAGS, &ifr) < 0) {
        printf("[-] ioctl SIOCSIFFLAGS failed: %s\n", strerror(errno));
        exit(1);
    }
    close(fd);
}

int main(void) {
    printf("[*] Starting reproducer...\n");

    if (mount("debugfs", "/sys/kernel/debug", "debugfs", 0, NULL) != 0) {
        if (errno != EBUSY) {
            printf("[-] Failed to mount debugfs: %s\n", strerror(errno));
        }
    }

    // Setup fault injection for slab allocations
    write_file("/sys/kernel/debug/failslab/probability", "5");
    write_file("/sys/kernel/debug/failslab/times", "-1");
    write_file("/sys/kernel/debug/failslab/task-filter", "Y");
    write_file("/sys/kernel/debug/failslab/ignore-gfp-wait", "N");

    // Setup fault injection for page allocations
    write_file("/sys/kernel/debug/fail_page_alloc/probability", "5");
    write_file("/sys/kernel/debug/fail_page_alloc/times", "-1");
    write_file("/sys/kernel/debug/fail_page_alloc/task-filter", "Y");
    write_file("/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", "N");

    int max_procs = 400;
    pid_t *pids = calloc(max_procs, sizeof(pid_t));
    if (!pids) {
        printf("[-] calloc failed: %s\n", strerror(errno));
        exit(1);
    }
    
    int head = 0;
    
    for (int i = 0; i < 5000; i++) {
        if (pids[head] != 0) {
            kill(pids[head], SIGKILL);
            waitpid(pids[head], NULL, 0);
        }
        
        pid_t pid = fork();
        if (pid < 0) {
            printf("[-] fork failed: %s\n", strerror(errno));
            usleep(100000);
            continue;
        }
        if (pid == 0) {
            if (unshare(CLONE_NEWNET | CLONE_NEWNS) != 0) {
                printf("[-] unshare failed: %s\n", strerror(errno));
                exit(1);
            }
            if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL) < 0) {
                printf("[-] mount private failed: %s\n", strerror(errno));
                exit(1);
            }
            
            bring_lo_up();
            
            if (mkdir("/tmp/nfsd", 0777) < 0 && errno != EEXIST) {
                printf("[-] mkdir failed: %s\n", strerror(errno));
                exit(1);
            }
            if (mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL) < 0) {
                printf("[-] mount nfsd failed: %s\n", strerror(errno));
                exit(1);
            }
            
            int fd_threads = open("/tmp/nfsd/threads", O_WRONLY);
            if (fd_threads < 0) {
                printf("[-] open threads failed: %s\n", strerror(errno));
                exit(1);
            }
            
            int fd_portlist = open("/tmp/nfsd/portlist", O_WRONLY);
            if (fd_portlist < 0) {
                printf("[-] open portlist failed: %s\n", strerror(errno));
                exit(1);
            }
            
            write_file("/proc/self/make-it-fail", "1");
            
            // Try to create service and start a thread with fault injection.
            // We ignore the return value because it is expected to fail sometimes.
            if (write(fd_threads, "1\n", 2) < 0) {
                // Failed, but that's fine.
            }
            
            write_file("/proc/self/make-it-fail", "0");
            
            // Now add a port. If the service was created but percpu_counter_init failed,
            // this will crash the kernel.
            // If the service was destroyed, this will recreate it successfully and not crash.
            // In either case, the service is now alive and holding percpu memory!
            if (write(fd_portlist, "tcp 2049\n", 9) < 0) {
                // Failed, but that's fine.
            }
            
            // Keep alive to hold the percpu memory and force pcpu_populate_chunk in other processes
            sleep(10000);
            exit(0);
        }
        
        pids[head] = pid;
        head = (head + 1) % max_procs;
        usleep(2000);
        
        if (i % 100 == 0) {
            printf("[+] Iteration %d\n", i);
        }
    }
    
    for (int i = 0; i < max_procs; i++) {
        if (pids[i] != 0) {
            kill(pids[i], SIGKILL);
            waitpid(pids[i], NULL, 0);
        }
    }
    
    printf("[+] Done.\n");
    return 0;
}
]

map[CompilerError:]

map[CandidateBugTitle: CandidateCrashReport: CandidateReproduced:false ConsoleOutput:52][ T5965]  ? __pfx_nfsd_create_serv+0x10/0x10
[  265.067364][ T5965]  ? net_generic+0x1e/0x240
[  265.067375][ T5965]  ? net_generic+0x1e/0x240
[  265.067389][ T5965]  ? net_generic+0x1e/0x240
[  265.067403][ T5965]  nfsd_svc+0x189/0x780
[  265.067418][ T5965]  write_threads+0x3cd/0x5a0
[  265.067426][ T5965]  ? __might_fault+0xaf/0x130
[  265.067438][ T5965]  ? __pfx_write_threads+0x10/0x10
[  265.067453][ T5965]  ? _copy_from_user+0x94/0xb0
[  265.067465][ T5965]  ? simple_transaction_get+0x12d/0x160
[  265.067498][ T5965]  nfsctl_transaction_write+0x10f/0x160
[  265.067508][ T5965]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  265.067517][ T5965]  vfs_write+0x296/0xba0
[  265.067532][ T5965]  ? __pfx_vfs_write+0x10/0x10
[  265.067541][ T5965]  ? lockdep_hardirqs_on+0x7a/0x110
[  265.067556][ T5965]  ? fput_close_sync+0x11f/0x240
[  265.067568][ T5965]  ksys_write+0x150/0x270
[  265.067580][ T5965]  ? __pfx_ksys_write+0x10/0x10
[  265.067599][ T5965]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  265.067608][ T5965]  do_syscall_64+0x174/0x580
[  265.067619][ T5965]  ? trace_irq_disable+0x3b/0x140
[  265.067628][ T5965]  ? clear_bhb_loop+0x70/0xc0
[  265.067638][ T5965]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  265.067647][ T5965] RIP: 0033:0x7f67c8dd3df7
[  265.067658][ T5965] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  265.067665][ T5965] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  265.067675][ T5965] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  265.067682][ T5965] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  265.067687][ T5965] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  265.067692][ T5965] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  265.067698][ T5965] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c85c
[  265.067711][ T5965]  </TASK>
[  265.067773][ T5965] FAULT_INJECTION: forcing a failure.
[  265.067773][ T5965] name failslab, interval 1, probability 5, space 0, times -1
[  265.068723][ T6048] CPU: 1 UID: 0 PID: 6048 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  265.068735][ T6048] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  265.068740][ T6048] Call Trace:
[  265.068744][ T6048]  <TASK>
[  265.068748][ T6048]  dump_stack_lvl+0xe8/0x150
[  265.068764][ T6048]  should_fail_ex+0x40c/0x560
[  265.068780][ T6048]  should_failslab+0xa8/0x100
[  265.068791][ T6048]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  265.068804][ T6048]  ? alloc_empty_file+0x5b/0x1d0
[  265.068812][ T6048]  ? alloc_empty_file+0x5b/0x1d0
[  265.068820][ T6048]  ? stack_trace_save+0xa9/0x100
[  265.068834][ T6048]  alloc_empty_file+0x5b/0x1d0
[  265.068843][ T6048]  path_openat+0x8f/0x3830
[  265.068854][ T6048]  ? __mutex_unlock_slowpath+0x1/0x900
[  265.068867][ T6048]  ? kasan_save_track+0x4f/0x80
[  265.068874][ T6048]  ? kasan_save_track+0x3e/0x80
[  265.068881][ T6048]  ? __kasan_slab_alloc+0x6c/0x80
[  265.068890][ T6048]  ? kmem_cache_alloc_noprof+0x2a0/0x5f0
[  265.068900][ T6048]  ? do_getname+0x2e/0x250
[  265.068913][ T6048]  ? do_sys_openat2+0xcc/0x200
[  265.068920][ T6048]  ? __x64_sys_openat+0x138/0x170
[  265.068928][ T6048]  ? do_syscall_64+0x174/0x580
[  265.068938][ T6048]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  265.068950][ T6048]  ? __lock_acquire+0x683/0x2cf0
[  265.068962][ T6048]  do_file_open+0x23e/0x4a0
[  265.068975][ T6048]  ? __pfx_do_file_open+0x10/0x10
[  265.068993][ T6048]  ? _raw_spin_unlock+0x28/0x50
[  265.069002][ T6048]  ? alloc_fd+0x651/0x6c0
[  265.069014][ T6048]  do_sys_openat2+0x115/0x200
[  265.069023][ T6048]  ? __pfx_do_sys_openat2+0x10/0x10
[  265.069034][ T6048]  ? rcu_is_watching+0x15/0xb0
[  265.069045][ T6048]  __x64_sys_openat+0x138/0x170
[  265.069055][ T6048]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  265.069063][ T6048]  do_syscall_64+0x174/0x580
[  265.069074][ T6048]  ? trace_irq_disable+0x3b/0x140
[  265.069082][ T6048]  ? clear_bhb_loop+0x70/0xc0
[  265.069092][ T6048]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  265.069100][ T6048] RIP: 0033:0x7f67c8dd3df7
[  265.069109][ T6048] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  265.069116][ T6048] RSP: 002b:00007ffc9caa0f00 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
[  265.069126][ T6048] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  265.069132][ T6048] RDX: 0000000000000001 RSI: 00007f67c8e0e192 RDI: ffffffffffffff9c
[  265.069138][ T6048] RBP: 00007f67c8e0e68c R08: 0000000000000000 R09: 0000000000000000
[  265.069143][ T6048] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  265.069149][ T6048] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c9a4
[  265.069161][ T6048]  </TASK>
[  265.311224][ T5965] CPU: 0 UID: 0 PID: 5965 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  265.311238][ T5965] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  265.311245][ T5965] Call Trace:
[  265.311249][ T5965]  <TASK>
[  265.311254][ T5965]  dump_stack_lvl+0xe8/0x150
[  265.311271][ T5965]  should_fail_ex+0x40c/0x560
[  265.311309][ T5965]  should_failslab+0xa8/0x100
[  265.311320][ T5965]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  265.311333][ T5965]  ? kstrdup+0x81/0x100
[  265.311347][ T5965]  ? __kernfs_new_node+0xe6/0x980
[  265.311358][ T5965]  ? __kernfs_new_node+0xe6/0x980
[  265.311372][ T5965]  __kernfs_new_node+0xe6/0x980
[  265.311387][ T5965]  ? __pfx___kernfs_new_node+0x10/0x10
[  265.311399][ T5965]  ? kernfs_root+0x1c/0x230
[  265.311412][ T5965]  ? kernfs_root+0x1c/0x230
[  265.311422][ T5965]  ? kernfs_root+0x1c/0x230
[  265.311431][ T5965]  ? kernfs_root+0x1c/0x230
[  265.311471][ T5965]  kernfs_create_dir_ns+0xfe/0x230
[  265.311487][ T5965]  sysfs_create_dir_ns+0x12f/0x2a0
[  265.311500][ T5965]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  265.311512][ T5965]  ? do_raw_spin_unlock+0xf5/0x210
[  265.311525][ T5965]  kobject_add_internal+0x622/0xcd0
[  265.311543][ T5965]  kobject_init_and_add+0x12b/0x1a0
[  265.311564][ T5965]  ? __pfx_kobject_init_and_add+0x10/0x10
[  265.311578][ T5965]  ? __kmalloc_cache_noprof+0x150/0x660
[  265.311590][ T5965]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  265.311602][ T5965]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  265.311617][ T5965]  rpc_sysfs_xprt_switch_setup+0x169/0x2b0
[  265.311631][ T5965]  xprt_switch_alloc+0x238/0x590
[  265.311644][ T5965]  rpc_create_xprt+0x1c7/0xa90
[  265.311654][ T5965]  ? __pfx_rpc_create_xprt+0x10/0x10
[  265.311671][ T5965]  ? rcu_is_watching+0x15/0xb0
[  265.311682][ T5965]  ? trace_kmalloc+0x2a/0xf0
[  265.311695][ T5965]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  265.311708][ T5965]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  265.311720][ T5965]  ? xprt_create_transport+0x39b/0x5f0
[  265.311729][ T5965]  ? xprt_create_transport+0x39b/0x5f0
[  265.311738][ T5965]  ? kstrdup+0x81/0x100
[  265.311751][ T5965]  ? __asan_memcpy+0x40/0x70
[  265.311765][ T5965]  ? xprt_create_transport+0x438/0x5f0
[  265.311776][ T5965]  rpc_create+0x649/0x900
[  265.311790][ T5965]  ? __pfx_rpc_create+0x10/0x10
[  265.311817][ T5965]  ? __lock_acquire+0x683/0x2cf0
[  265.311831][ T5965]  rpcb_create_af_local+0x1c7/0x3c0
[  265.311840][ T5965]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  265.311858][ T5965]  ? do_raw_spin_unlock+0xf5/0x210
[  265.311875][ T5965]  rpcb_create_local+0x268/0x670
[  265.311885][ T5965]  ? __pfx_rpcb_create_local+0x10/0x10
[  265.311893][ T5965]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  265.311903][ T5965]  ? lockdep_hardirqs_on+0x7a/0x110
[  265.311914][ T5965]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  265.311923][ T5965]  ? __percpu_counter_init_many+0x35f/0x380
[  265.311937][ T5965]  ? __svc_create+0x88f/0x990
[  265.311951][ T5965]  svc_bind+0x1b4/0x230
[  265.311962][ T5965]  nfsd_create_serv+0x581/0x840
[  265.311975][ T5965]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  265.311985][ T5965]  ? lockdep_hardirqs_on+0x7a/0x110
[  265.311997][ T5965]  ? __pfx_nfsd_create_serv+0x10/0x10
[  265.312010][ T5965]  ? net_generic+0x1e/0x240
[  265.312021][ T5965]  ? net_generic+0x1e/0x240
[  265.312035][ T5965]  ? net_generic+0x1e/0x240
[  265.312049][ T5965]  nfsd_svc+0x189/0x780
[  265.312063][ T5965]  write_threads+0x3cd/0x5a0
[  265.312072][ T5965]  ? __might_fault+0xaf/0x130
[  265.312084][ T5965]  ? __pfx_write_threads+0x10/0x10
[  265.312100][ T5965]  ? _copy_from_user+0x94/0xb0
[  265.312110][ T5965]  ? simple_transaction_get+0x12d/0x160
[  265.312121][ T5965]  nfsctl_transaction_write+0x10f/0x160
[  265.312131][ T5965]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  265.312140][ T5965]  vfs_write+0x296/0xba0
[  265.312160][ T5965]  ? __pfx_vfs_write+0x10/0x10
[  265.312174][ T5965]  ? lockdep_hardirqs_on+0x7a/0x110
[  265.312189][ T5965]  ? fput_close_sync+0x11f/0x240
[  265.312201][ T5965]  ksys_write+0x150/0x270
[  265.312213][ T5965]  ? __pfx_ksys_write+0x10/0x10
[  265.312227][ T5965]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  265.312237][ T5965]  do_syscall_64+0x174/0x580
[  265.312247][ T5965]  ? trace_irq_disable+0x3b/0x140
[  265.312257][ T5965]  ? clear_bhb_loop+0x70/0xc0
[  265.312267][ T5965]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  265.312276][ T5965] RIP: 0033:0x7f67c8dd3df7
[  265.312287][ T5965] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  265.312295][ T5965] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  265.312305][ T5965] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  265.312312][ T5965] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  265.312317][ T5965] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  265.312322][ T5965] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  265.312328][ T5965] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c85c
[  265.312341][ T5965]  </TASK>
[  265.312388][ T5965] kobject: kobject_add_internal failed for switch-55 (error: -12 parent: xprt-switches)
[  265.462852][ T5965] FAULT_INJECTION: forcing a failure.
[  265.462852][ T5965] name failslab, interval 1, probability 5, space 0, times -1
[  265.466691][ T5965] CPU: 0 UID: 0 PID: 5965 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  265.466702][ T5965] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  265.466709][ T5965] Call Trace:
[  265.466713][ T5965]  <TASK>
[  265.466717][ T5965]  dump_stack_lvl+0xe8/0x150
[  265.466735][ T5965]  should_fail_ex+0x40c/0x560
[  265.466752][ T5965]  should_failslab+0xa8/0x100
[  265.466763][ T5965]  kmem_cache_alloc_node_noprof+0xb3/0x610
[  265.466776][ T5965]  ? local_lock_release+0x9c/0x160
[  265.466789][ T5965]  ? __alloc_skb+0x1d7/0x7a0
[  265.466800][ T5965]  ? __alloc_skb+0x1d7/0x7a0
[  265.466815][ T5965]  __alloc_skb+0x1d7/0x7a0
[  265.466828][ T5965]  sock_wmalloc+0xb2/0x130
[  265.466839][ T5965]  unix_stream_connect+0x3b5/0xfd0
[  265.466855][ T5965]  kernel_connect+0x141/0x1c0
[  265.466866][ T5965]  ? __pfx_kernel_connect+0x10/0x10
[  265.466882][ T5965]  ? __local_bh_enable_ip+0xd0/0x130
[  265.466896][ T5965]  xs_local_connect+0x626/0x810
[  265.466908][ T5965]  ? __pfx_xs_local_connect+0x10/0x10
[  265.466920][ T5965]  ? do_raw_spin_unlock+0xf5/0x210
[  265.466933][ T5965]  xprt_connect+0x613/0x850
[  265.466947][ T5965]  ? __pfx_call_connect+0x10/0x10
[  265.466958][ T5965]  __rpc_execute+0x526/0x1280
[  265.466978][ T5965]  ? __pfx___rpc_execute+0x10/0x10
[  265.466991][ T5965]  ? rpc_task_get_xprt+0x26/0x250
[  265.467002][ T5965]  ? rpc_make_runnable+0xae/0x1c0
[  265.467015][ T5965]  rpc_execute+0x1c1/0x390
[  265.467028][ T5965]  rpc_run_task+0x4a6/0x660
[  265.467038][ T5965]  rpc_create_xprt+0x533/0xa90
[  265.467048][ T5965]  ? __pfx_rpc_create_xprt+0x10/0x10
[  265.467065][ T5965]  ? rcu_is_watching+0x15/0xb0
[  265.467076][ T5965]  ? trace_kmalloc+0x2a/0xf0
[  265.467090][ T5965]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  265.467102][ T5965]  ? xprt_create_transport+0x39b/0x5f0
[  265.467117][ T5965]  ? xprt_create_transport+0x438/0x5f0
[  265.467127][ T5965]  rpc_create+0x649/0x900
[  265.467141][ T5965]  ? __pfx_rpc_create+0x10/0x10
[  265.467169][ T5965]  ? __lock_acquire+0x683/0x2cf0
[  265.467182][ T5965]  rpcb_create_af_local+0x1c7/0x3c0
[  265.467192][ T5965]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  265.467209][ T5965]  ? do_raw_spin_unlock+0xf5/0x210
[  265.467222][ T5965]  rpcb_create_local+0x268/0x670
[  265.467232][ T5965]  ? __pfx_rpcb_create_local+0x10/0x10
[  265.467240][ T5965]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  265.467250][ T5965]  ? lockdep_hardirqs_on+0x7a/0x110
[  265.467262][ T5965]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  265.467271][ T5965]  ? __percpu_counter_init_many+0x35f/0x380
[  265.467286][ T5965]  ? __svc_create+0x88f/0x990
[  265.467299][ T5965]  svc_bind+0x1b4/0x230
[  265.467310][ T5965]  nfsd_create_serv+0x581/0x840
[  265.467323][ T5965]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  265.467333][ T5965]  ? lockdep_hardirqs_on+0x7a/0x110
[  265.467345][ T5965]  ? __pfx_nfsd_create_serv+0x10/0x10
[  265.467358][ T5965]  ? net_generic+0x1e/0x240
[  265.467369][ T5965]  ? net_generic+0x1e/0x240
[  265.467382][ T5965]  ? net_generic+0x1e/0x240
[  265.467397][ T5965]  nfsd_svc+0x189/0x780
[  265.467411][ T5965]  write_threads+0x3cd/0x5a0
[  265.467419][ T5965]  ? __might_fault+0xaf/0x130
[  265.467453][ T5965]  ? __pfx_write_threads+0x10/0x10
[  265.467474][ T5965]  ? _copy_from_user+0x94/0xb0
[  265.467485][ T5965]  ? simple_transaction_get+0x12d/0x160
[  265.467496][ T5965]  nfsctl_transaction_write+0x10f/0x160
[  265.467506][ T5965]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  265.467515][ T5965]  vfs_write+0x296/0xba0
[  265.467530][ T5965]  ? __pfx_vfs_write+0x10/0x10
[  265.467539][ T5965]  ? lockdep_hardirqs_on+0x7a/0x110
[  265.467554][ T5965]  ? fput_close_sync+0x11f/0x240
[  265.467567][ T5965]  ksys_write+0x150/0x270
[  265.467578][ T5965]  ? __pfx_ksys_write+0x10/0x10
[  265.467593][ T5965]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  265.467602][ T5965]  do_syscall_64+0x174/0x580
[  265.467613][ T5965]  ? trace_irq_disable+0x3b/0x140
[  265.467622][ T5965]  ? clear_bhb_loop+0x70/0xc0
[  265.467633][ T5965]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  265.467641][ T5965] RIP: 0033:0x7f67c8dd3df7
[  265.467651][ T5965] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  265.467659][ T5965] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  265.467669][ T5965] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  265.467675][ T5965] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  265.467681][ T5965] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  265.467686][ T5965] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  265.467691][ T5965] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c85c
[  265.467704][ T5965]  </TASK>
[  265.467746][ T5965] xs_local_setup_socket: unhandled error (12) connecting to @/run/rpcbind.sock
[  265.610732][ T5965] FAULT_INJECTION: forcing a failure.
[  265.610732][ T5965] name failslab, interval 1, probability 5, space 0, times -1
[  265.614664][ T5965] CPU: 0 UID: 0 PID: 5965 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  265.614676][ T5965] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  265.614682][ T5965] Call Trace:
[  265.614687][ T5965]  <TASK>
[  265.614692][ T5965]  dump_stack_lvl+0xe8/0x150
[  265.614709][ T5965]  should_fail_ex+0x40c/0x560
[  265.614726][ T5965]  should_failslab+0xa8/0x100
[  265.614737][ T5965]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  265.614751][ T5965]  ? __kernfs_new_node+0xe6/0x980
[  265.614763][ T5965]  ? __kernfs_new_node+0xe6/0x980
[  265.614777][ T5965]  __kernfs_new_node+0xe6/0x980
[  265.614791][ T5965]  ? __pfx___kernfs_new_node+0x10/0x10
[  265.614803][ T5965]  ? kernfs_root+0x1c/0x230
[  265.614837][ T5965]  ? kernfs_root+0x1c/0x230
[  265.614849][ T5965]  ? kernfs_root+0x1c/0x230
[  265.614858][ T5965]  ? kernfs_root+0x1c/0x230
[  265.614871][ T5965]  kernfs_new_node+0xea/0x140
[  265.614884][ T5965]  __kernfs_create_file+0x4b/0x2e0
[  265.614894][ T5965]  sysfs_add_file_mode_ns+0x237/0x300
[  265.614907][ T5965]  internal_create_group+0x679/0x1180
[  265.614923][ T5965]  ? kernfs_create_dir_ns+0x1d5/0x230
[  265.614937][ T5965]  ? __pfx_internal_create_group+0x10/0x10
[  265.614947][ T5965]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  265.614958][ T5965]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  265.614971][ T5965]  sysfs_create_groups+0x59/0x120
[  265.614983][ T5965]  kobject_add_internal+0x669/0xcd0
[  265.615000][ T5965]  kobject_init_and_add+0x12b/0x1a0
[  265.615015][ T5965]  ? __pfx_kobject_init_and_add+0x10/0x10
[  265.615029][ T5965]  ? __kmalloc_cache_noprof+0x150/0x660
[  265.615041][ T5965]  ? rpc_sysfs_client_setup+0x106/0x310
[  265.615052][ T5965]  ? rpc_sysfs_client_setup+0x106/0x310
[  265.615067][ T5965]  rpc_sysfs_client_setup+0x191/0x310
[  265.615081][ T5965]  ? __pfx_rpc_sysfs_client_setup+0x10/0x10
[  265.615093][ T5965]  ? rpc_net_ns+0x1e/0x230
[  265.615103][ T5965]  ? rpc_net_ns+0x1e/0x230
[  265.615111][ T5965]  ? rpc_net_ns+0x1e/0x230
[  265.615122][ T5965]  rpc_new_client+0x716/0xc50
[  265.615136][ T5965]  rpc_create_xprt+0x29f/0xa90
[  265.615145][ T5965]  ? __pfx_rpc_create_xprt+0x10/0x10
[  265.615162][ T5965]  ? rcu_is_watching+0x15/0xb0
[  265.615173][ T5965]  ? trace_kmalloc+0x2a/0xf0
[  265.615186][ T5965]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  265.615199][ T5965]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  265.615211][ T5965]  ? xprt_create_transport+0x39b/0x5f0
[  265.615220][ T5965]  ? xprt_create_transport+0x39b/0x5f0
[  265.615229][ T5965]  ? kstrdup+0x81/0x100
[  265.615243][ T5965]  ? __asan_memcpy+0x40/0x70
[  265.615276][ T5965]  ? xprt_create_transport+0x438/0x5f0
[  265.615287][ T5965]  rpc_create+0x649/0x900
[  265.615302][ T5965]  ? __pfx_rpc_create+0x10/0x10
[  265.615347][ T5965]  ? __lock_acquire+0x683/0x2cf0
[  265.615361][ T5965]  rpcb_create_af_local+0x1c7/0x3c0
[  265.615370][ T5965]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  265.615388][ T5965]  ? do_raw_spin_unlock+0xf5/0x210
[  265.615402][ T5965]  rpcb_create_local+0x28f/0x670
[  265.615430][ T5965]  ? __pfx_rpcb_create_local+0x10/0x10
[  265.615439][ T5965]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  265.615450][ T5965]  ? lockdep_hardirqs_on+0x7a/0x110
[  265.615460][ T5965]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  265.615470][ T5965]  ? __percpu_counter_init_many+0x35f/0x380
[  265.615485][ T5965]  ? __svc_create+0x88f/0x990
[  265.615498][ T5965]  svc_bind+0x1b4/0x230
[  265.615509][ T5965]  nfsd_create_serv+0x581/0x840
[  265.615523][ T5965]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  265.615532][ T5965]  ? lockdep_hardirqs_on+0x7a/0x110
[  265.615545][ T5965]  ? __pfx_nfsd_create_serv+0x10/0x10
[  265.615569][ T5965]  ? net_generic+0x1e/0x240
[  265.615583][ T5965]  ? net_generic+0x1e/0x240
[  265.615601][ T5965]  ? net_generic+0x1e/0x240
[  265.615633][ T5965]  nfsd_svc+0x189/0x780
[  265.615648][ T5965]  write_threads+0x3cd/0x5a0
[  265.615656][ T5965]  ? __might_fault+0xaf/0x130
[  265.615685][ T5965]  ? __pfx_write_threads+0x10/0x10
[  265.615702][ T5965]  ? _copy_from_user+0x94/0xb0
[  265.615713][ T5965]  ? simple_transaction_get+0x12d/0x160
[  265.615725][ T5965]  nfsctl_transaction_write+0x10f/0x160
[  265.615734][ T5965]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  265.615743][ T5965]  vfs_write+0x296/0xba0
[  265.615758][ T5965]  ? __pfx_vfs_write+0x10/0x10
[  265.615768][ T5965]  ? lockdep_hardirqs_on+0x7a/0x110
[  265.615783][ T5965]  ? fput_close_sync+0x11f/0x240
[  265.615795][ T5965]  ksys_write+0x150/0x270
[  265.615807][ T5965]  ? __pfx_ksys_write+0x10/0x10
[  265.615821][ T5965]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  265.615831][ T5965]  do_syscall_64+0x174/0x580
[  265.615841][ T5965]  ? trace_irq_disable+0x3b/0x140
[  265.615850][ T5965]  ? clear_bhb_loop+0x70/0xc0
[  265.615861][ T5965]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  265.615869][ T5965] RIP: 0033:0x7f67c8dd3df7
[  265.615880][ T5965] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  265.615886][ T5965] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  265.615897][ T5965] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  265.615903][ T5965] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  265.615908][ T5965] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  265.615913][ T5965] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  265.615918][ T5965] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c85c
[  265.615931][ T5965]  </TASK>
[  265.777676][ T5965] kobject: kobject_add_internal failed for clnt-55 (error: -12 parent: rpc-clients)
[  265.780936][ T5965] FAULT_INJECTION: forcing a failure.
[  265.780936][ T5965] name failslab, interval 1, probability 5, space 0, times -1
[  265.784641][ T5965] CPU: 0 UID: 0 PID: 5965 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  265.784652][ T5965] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  265.784658][ T5965] Call Trace:
[  265.784663][ T5965]  <TASK>
[  265.784667][ T5965]  dump_stack_lvl+0xe8/0x150
[  265.784684][ T5965]  should_fail_ex+0x40c/0x560
[  265.784702][ T5965]  should_failslab+0xa8/0x100
[  265.784713][ T5965]  __kmalloc_noprof+0xfe/0x720
[  265.784728][ T5965]  ? kobject_get_path+0xc5/0x2f0
[  265.784741][ T5965]  ? kobject_get_path+0xc5/0x2f0
[  265.784756][ T5965]  kobject_get_path+0xc5/0x2f0
[  265.784771][ T5965]  kobject_uevent_env+0x29e/0x9e0
[  265.784783][ T5965]  rpc_sysfs_xprt_switch_destroy+0x51/0x90
[  265.784797][ T5965]  xprt_switch_put+0x33d/0x3c0
[  265.784811][ T5965]  rpc_release_client+0x350/0x6a0
[  265.784823][ T5965]  rpc_shutdown_client+0x4c6/0x6c0
[  265.784834][ T5965]  ? __pfx_rpc_shutdown_client+0x10/0x10
[  265.784842][ T5965]  ? kmem_cache_free+0x182/0x650
[  265.784854][ T5965]  ? rpc_task_get_xprt+0x26/0x250
[  265.784864][ T5965]  ? __pfx_mempool_free_slab+0x10/0x10
[  265.784877][ T5965]  ? mempool_free+0xec/0x130
[  265.784889][ T5965]  ? __pfx_mempool_free+0x10/0x10
[  265.784900][ T5965]  ? put_rpccred+0x74/0x960
[  265.784914][ T5965]  ? rpc_final_put_task+0x1e4/0x220
[  265.784926][ T5965]  rpc_create_xprt+0x612/0xa90
[  265.784935][ T5965]  ? __pfx_rpc_create_xprt+0x10/0x10
[  265.784953][ T5965]  ? rcu_is_watching+0x15/0xb0
[  265.784963][ T5965]  ? trace_kmalloc+0x2a/0xf0
[  265.784978][ T5965]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  265.784990][ T5965]  ? xprt_create_transport+0x39b/0x5f0
[  265.785005][ T5965]  ? xprt_create_transport+0x438/0x5f0
[  265.785016][ T5965]  rpc_create+0x649/0x900
[  265.785030][ T5965]  ? __pfx_rpc_create+0x10/0x10
[  265.785058][ T5965]  ? __lock_acquire+0x683/0x2cf0
[  265.785071][ T5965]  rpcb_create_af_local+0x1c7/0x3c0
[  265.785081][ T5965]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  265.785099][ T5965]  ? do_raw_spin_unlock+0xf5/0x210
[  265.785112][ T5965]  rpcb_create_local+0x28f/0x670
[  265.785121][ T5965]  ? __pfx_rpcb_create_local+0x10/0x10
[  265.785129][ T5965]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  265.785139][ T5965]  ? lockdep_hardirqs_on+0x7a/0x110
[  265.785150][ T5965]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  265.785159][ T5965]  ? __percpu_counter_init_many+0x35f/0x380
[  265.785174][ T5965]  ? __svc_create+0x88f/0x990
[  265.785187][ T5965]  svc_bind+0x1b4/0x230
[  265.785198][ T5965]  nfsd_create_serv+0x581/0x840
[  265.785211][ T5965]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  265.785221][ T5965]  ? lockdep_hardirqs_on+0x7a/0x110
[  265.785233][ T5965]  ? __pfx_nfsd_create_serv+0x10/0x10
[  265.785245][ T5965]  ? net_generic+0x1e/0x240
[  265.785256][ T5965]  ? net_generic+0x1e/0x240
[  265.785270][ T5965]  ? net_generic+0x1e/0x240
[  265.785284][ T5965]  nfsd_svc+0x189/0x780
[  265.785298][ T5965]  write_threads+0x3cd/0x5a0
[  265.785307][ T5965]  ? __might_fault+0xaf/0x130
[  265.785318][ T5965]  ? __pfx_write_threads+0x10/0x10
[  265.785335][ T5965]  ? _copy_from_user+0x94/0xb0
[  265.785346][ T5965]  ? simple_transaction_get+0x12d/0x160
[  265.785357][ T5965]  nfsctl_transaction_write+0x10f/0x160
[  265.785366][ T5965]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  265.785375][ T5965]  vfs_write+0x296/0xba0
[  265.785390][ T5965]  ? __pfx_vfs_write+0x10/0x10
[  265.785418][ T5965]  ? lockdep_hardirqs_on+0x7a/0x110
[  265.785433][ T5965]  ? fput_close_sync+0x11f/0x240
[  265.785446][ T5965]  ksys_write+0x150/0x270
[  265.785458][ T5965]  ? __pfx_ksys_write+0x10/0x10
[  265.785472][ T5965]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  265.785481][ T5965]  do_syscall_64+0x174/0x580
[  265.785492][ T5965]  ? trace_irq_disable+0x3b/0x140
[  265.785501][ T5965]  ? clear_bhb_loop+0x70/0xc0
[  265.785511][ T5965]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  265.785520][ T5965] RIP: 0033:0x7f67c8dd3df7
[  265.785530][ T5965] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  265.785537][ T5965] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  265.785547][ T5965] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  265.785553][ T5965] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  265.785576][ T5965] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  265.785582][ T5965] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  265.785587][ T5965] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c85c
[  265.785600][ T5965]  </TASK>
[  265.922460][ T5965] FAULT_INJECTION: forcing a failure.
[  265.922460][ T5965] name failslab, interval 1, probability 5, space 0, times -1
[  265.926229][ T5965] CPU: 0 UID: 0 PID: 5965 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  265.926241][ T5965] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  265.926246][ T5965] Call Trace:
[  265.926251][ T5965]  <TASK>
[  265.926255][ T5965]  dump_stack_lvl+0xe8/0x150
[  265.926271][ T5965]  should_fail_ex+0x40c/0x560
[  265.926288][ T5965]  should_failslab+0xa8/0x100
[  265.926300][ T5965]  kmem_cache_alloc_node_noprof+0xb3/0x610
[  265.926317][ T5965]  ? local_lock_release+0x9c/0x160
[  265.926330][ T5965]  ? __alloc_skb+0x1d7/0x7a0
[  265.926341][ T5965]  ? __alloc_skb+0x1d7/0x7a0
[  265.926355][ T5965]  __alloc_skb+0x1d7/0x7a0
[  265.926369][ T5965]  alloc_uevent_skb+0x7d/0x230
[  265.926399][ T5965]  kobject_uevent_net_broadcast+0x184/0x560
[  265.926412][ T5965]  kobject_uevent_env+0x566/0x9e0
[  265.926424][ T5965]  xprt_switch_alloc+0x238/0x590
[  265.926438][ T5965]  rpc_create_xprt+0x1c7/0xa90
[  265.926447][ T5965]  ? __pfx_rpc_create_xprt+0x10/0x10
[  265.926464][ T5965]  ? rcu_is_watching+0x15/0xb0
[  265.926475][ T5965]  ? trace_kmalloc+0x2a/0xf0
[  265.926488][ T5965]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  265.926502][ T5965]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  265.926514][ T5965]  ? xprt_create_transport+0x39b/0x5f0
[  265.926523][ T5965]  ? xprt_create_transport+0x39b/0x5f0
[  265.926532][ T5965]  ? kstrdup+0x81/0x100
[  265.926546][ T5965]  ? __asan_memcpy+0x40/0x70
[  265.926565][ T5965]  ? xprt_create_transport+0x438/0x5f0
[  265.926576][ T5965]  rpc_create+0x649/0x900
[  265.926591][ T5965]  ? __pfx_rpc_create+0x10/0x10
[  265.926624][ T5965]  rpcb_create_local+0x3ab/0x670
[  265.926634][ T5965]  ? __pfx_rpcb_create_local+0x10/0x10
[  265.926649][ T5965]  ? __svc_create+0x88f/0x990
[  265.926662][ T5965]  svc_bind+0x1b4/0x230
[  265.926673][ T5965]  nfsd_create_serv+0x581/0x840
[  265.926686][ T5965]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  265.926697][ T5965]  ? lockdep_hardirqs_on+0x7a/0x110
[  265.926710][ T5965]  ? __pfx_nfsd_create_serv+0x10/0x10
[  265.926722][ T5965]  ? net_generic+0x1e/0x240
[  265.926733][ T5965]  ? net_generic+0x1e/0x240
[  265.926747][ T5965]  ? net_generic+0x1e/0x240
[  265.926761][ T5965]  nfsd_svc+0x189/0x780
[  265.926775][ T5965]  write_threads+0x3cd/0x5a0
[  265.926784][ T5965]  ? __might_fault+0xaf/0x130
[  265.926796][ T5965]  ? __pfx_write_threads+0x10/0x10
[  265.926812][ T5965]  ? _copy_from_user+0x94/0xb0
[  265.926822][ T5965]  ? simple_transaction_get+0x12d/0x160
[  265.926833][ T5965]  nfsctl_transaction_write+0x10f/0x160
[  265.926843][ T5965]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  265.926852][ T5965]  vfs_write+0x296/0xba0
[  265.926866][ T5965]  ? __pfx_vfs_write+0x10/0x10
[  265.926876][ T5965]  ? lockdep_hardirqs_on+0x7a/0x110
[  265.926891][ T5965]  ? fput_close_sync+0x11f/0x240
[  265.926903][ T5965]  ksys_write+0x150/0x270
[  265.926915][ T5965]  ? __pfx_ksys_write+0x10/0x10
[  265.926929][ T5965]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  265.926938][ T5965]  do_syscall_64+0x174/0x580
[  265.926949][ T5965]  ? trace_irq_disable+0x3b/0x140
[  265.926957][ T5965]  ? clear_bhb_loop+0x70/0xc0
[  265.926968][ T5965]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  265.926976][ T5965] RIP: 0033:0x7f67c8dd3df7
[  265.926986][ T5965] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  265.926993][ T5965] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  265.927003][ T5965] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  265.927009][ T5965] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  265.927014][ T5965] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  265.927019][ T5965] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  265.927025][ T5965] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c85c
[  265.927038][ T5965]  </TASK>
[  265.930959][ T5965] FAULT_INJECTION: forcing a failure.
[  265.930959][ T5965] name failslab, interval 1, probability 5, space 0, times -1
[  266.052652][ T5965] CPU: 0 UID: 0 PID: 5965 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  266.052665][ T5965] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  266.052671][ T5965] Call Trace:
[  266.052675][ T5965]  <TASK>
[  266.052679][ T5965]  dump_stack_lvl+0xe8/0x150
[  266.052696][ T5965]  should_fail_ex+0x40c/0x560
[  266.052713][ T5965]  should_failslab+0xa8/0x100
[  266.052725][ T5965]  kmem_cache_alloc_node_noprof+0xb3/0x610
[  266.052738][ T5965]  ? do_kmem_cache_create+0x11a/0x970
[  266.052748][ T5965]  ? do_kmem_cache_create+0x180/0x970
[  266.052756][ T5965]  ? do_kmem_cache_create+0x180/0x970
[  266.052767][ T5965]  do_kmem_cache_create+0x180/0x970
[  266.052779][ T5965]  __kmem_cache_create_args+0x307/0x440
[  266.052792][ T5965]  nfsd_file_cache_init+0x197/0x530
[  266.052804][ T5965]  ? __pfx_nfsd_file_cache_init+0x10/0x10
[  266.052815][ T5965]  ? net_generic+0x1e/0x240
[  266.052830][ T5965]  ? net_generic+0x1e/0x240
[  266.052841][ T5965]  ? net_generic+0x1e/0x240
[  266.052851][ T5965]  ? net_generic+0x1e/0x240
[  266.052862][ T5965]  ? net_generic+0x1f4/0x240
[  266.052874][ T5965]  nfsd_svc+0x315/0x780
[  266.052889][ T5965]  write_threads+0x3cd/0x5a0
[  266.052897][ T5965]  ? __might_fault+0xaf/0x130
[  266.052909][ T5965]  ? __pfx_write_threads+0x10/0x10
[  266.052925][ T5965]  ? _copy_from_user+0x94/0xb0
[  266.052936][ T5965]  ? simple_transaction_get+0x12d/0x160
[  266.052946][ T5965]  nfsctl_transaction_write+0x10f/0x160
[  266.052956][ T5965]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  266.052965][ T5965]  vfs_write+0x296/0xba0
[  266.052982][ T5965]  ? __pfx_vfs_write+0x10/0x10
[  266.052992][ T5965]  ? lockdep_hardirqs_on+0x7a/0x110
[  266.053008][ T5965]  ? fput_close_sync+0x11f/0x240
[  266.053020][ T5965]  ksys_write+0x150/0x270
[  266.053032][ T5965]  ? __pfx_ksys_write+0x10/0x10
[  266.053053][ T5965]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  266.053063][ T5965]  do_syscall_64+0x174/0x580
[  266.053073][ T5965]  ? trace_irq_disable+0x3b/0x140
[  266.053082][ T5965]  ? clear_bhb_loop+0x70/0xc0
[  266.053093][ T5965]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  266.053101][ T5965] RIP: 0033:0x7f67c8dd3df7
[  266.053111][ T5965] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  266.053119][ T5965] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  266.053129][ T5965] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  266.053135][ T5965] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  266.053140][ T5965] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  266.053145][ T5965] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  266.053150][ T5965] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c85c
[  266.053163][ T5965]  </TASK>
[  266.053182][ T5965] __kmem_cache_create_args(nfsd_file) failed with error -22
[  266.138502][ T5965] CPU: 0 UID: 0 PID: 5965 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  266.138515][ T5965] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  266.138521][ T5965] Call Trace:
[  266.138526][ T5965]  <TASK>
[  266.138531][ T5965]  dump_stack_lvl+0xe8/0x150
[  266.138548][ T5965]  __kmem_cache_create_args+0x3d8/0x440
[  266.138562][ T5965]  nfsd_file_cache_init+0x197/0x530
[  266.138575][ T5965]  ? __pfx_nfsd_file_cache_init+0x10/0x10
[  266.138585][ T5965]  ? net_generic+0x1e/0x240
[  266.138601][ T5965]  ? net_generic+0x1e/0x240
[  266.138611][ T5965]  ? net_generic+0x1e/0x240
[  266.138621][ T5965]  ? net_generic+0x1e/0x240
[  266.138633][ T5965]  ? net_generic+0x1f4/0x240
[  266.138644][ T5965]  nfsd_svc+0x315/0x780
[  266.138658][ T5965]  write_threads+0x3cd/0x5a0
[  266.138667][ T5965]  ? __might_fault+0xaf/0x130
[  266.138679][ T5965]  ? __pfx_write_threads+0x10/0x10
[  266.138695][ T5965]  ? _copy_from_user+0x94/0xb0
[  266.138706][ T5965]  ? simple_transaction_get+0x12d/0x160
[  266.138717][ T5965]  nfsctl_transaction_write+0x10f/0x160
[  266.138727][ T5965]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  266.138736][ T5965]  vfs_write+0x296/0xba0
[  266.138751][ T5965]  ? __pfx_vfs_write+0x10/0x10
[  266.138761][ T5965]  ? lockdep_hardirqs_on+0x7a/0x110
[  266.138777][ T5965]  ? fput_close_sync+0x11f/0x240
[  266.138790][ T5965]  ksys_write+0x150/0x270
[  266.138801][ T5965]  ? __pfx_ksys_write+0x10/0x10
[  266.138815][ T5965]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  266.138825][ T5965]  do_syscall_64+0x174/0x580
[  266.138836][ T5965]  ? trace_irq_disable+0x3b/0x140
[  266.138845][ T5965]  ? clear_bhb_loop+0x70/0xc0
[  266.138855][ T5965]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  266.138864][ T5965] RIP: 0033:0x7f67c8dd3df7
[  266.138874][ T5965] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  266.138882][ T5965] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  266.138893][ T5965] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  266.138899][ T5965] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  266.138905][ T5965] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  266.138910][ T5965] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  266.138915][ T5965] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c85c
[  266.138928][ T5965]  </TASK>
[  266.138932][ T5965] nfsd: unable to create nfsd_file_slab
[  266.217269][ T5965] FAULT_INJECTION: forcing a failure.
[  266.217269][ T5965] name failslab, interval 1, probability 5, space 0, times -1
[  266.217647][ T6051] FAULT_INJECTION: forcing a failure.
[  266.217647][ T6051] name failslab, interval 1, probability 5, space 0, times -1
[  266.221044][ T5965] CPU: 0 UID: 0 PID: 5965 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  266.221056][ T5965] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  266.221063][ T5965] Call Trace:
[  266.221067][ T5965]  <TASK>
[  266.221071][ T5965]  dump_stack_lvl+0xe8/0x150
[  266.221089][ T5965]  should_fail_ex+0x40c/0x560
[  266.221105][ T5965]  should_failslab+0xa8/0x100
[  266.221116][ T5965]  __kmalloc_noprof+0xfe/0x720
[  266.221130][ T5965]  ? rcu_is_watching+0x15/0xb0
[  266.221140][ T5965]  ? tomoyo_realpath_from_path+0xef/0x640
[  266.221154][ T5965]  ? tomoyo_realpath_from_path+0xef/0x640
[  266.221170][ T5965]  tomoyo_realpath_from_path+0xef/0x640
[  266.221188][ T5965]  tomoyo_check_open_permission+0x229/0x470
[  266.221200][ T5965]  ? tomoyo_check_open_permission+0x1d3/0x470
[  266.221211][ T5965]  ? __pfx_tomoyo_check_open_permission+0x10/0x10
[  266.221222][ T5965]  ? __asan_memset+0x22/0x50
[  266.221245][ T5965]  ? mnt_get_write_access+0x66/0x280
[  266.221259][ T5965]  security_file_open+0xa9/0x240
[  266.221271][ T5965]  do_dentry_open+0x4a0/0x1380
[  266.221284][ T5965]  vfs_open+0x3b/0x340
[  266.221291][ T5965]  ? path_openat+0x2e2d/0x3830
[  266.221303][ T5965]  path_openat+0x2e44/0x3830
[  266.221315][ T5965]  ? kasan_save_track+0x3e/0x80
[  266.221323][ T5965]  ? do_sys_openat2+0xcc/0x200
[  266.221332][ T5965]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  266.221367][ T5965]  do_file_open+0x23e/0x4a0
[  266.221382][ T5965]  ? __pfx_do_file_open+0x10/0x10
[  266.221396][ T5965]  ? __pfx_kfree_link+0x10/0x10
[  266.221410][ T5965]  ? _raw_spin_unlock+0x28/0x50
[  266.221419][ T5965]  ? alloc_fd+0x651/0x6c0
[  266.221431][ T5965]  do_sys_openat2+0x115/0x200
[  266.221441][ T5965]  ? __pfx_do_sys_openat2+0x10/0x10
[  266.221451][ T5965]  ? rcu_is_watching+0x15/0xb0
[  266.221463][ T5965]  __x64_sys_openat+0x138/0x170
[  266.221472][ T5965]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  266.221481][ T5965]  do_syscall_64+0x174/0x580
[  266.221492][ T5965]  ? trace_irq_disable+0x3b/0x140
[  266.221501][ T5965]  ? clear_bhb_loop+0x70/0xc0
[  266.221511][ T5965]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  266.221520][ T5965] RIP: 0033:0x7f67c8dd3df7
[  266.221529][ T5965] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  266.221536][ T5965] RSP: 002b:00007ffc9caa0f00 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
[  266.221547][ T5965] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  266.221553][ T5965] RDX: 0000000000000001 RSI: 00007f67c8e0e192 RDI: ffffffffffffff9c
[  266.221559][ T5965] RBP: 00007f67c8e0e68c R08: 0000000000000000 R09: 0000000000000000
[  266.221564][ T5965] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  266.221570][ T5965] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c85c
[  266.221582][ T5965]  </TASK>
[  266.221587][ T5965] ERROR: Out of memory at tomoyo_realpath_from_path.
[  266.255658][ T6051] CPU: 1 UID: 0 PID: 6051 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  266.255672][ T6051] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  266.255678][ T6051] Call Trace:
[  266.255682][ T6051]  <TASK>
[  266.255686][ T6051]  dump_stack_lvl+0xe8/0x150
[  266.255704][ T6051]  should_fail_ex+0x40c/0x560
[  266.255721][ T6051]  should_failslab+0xa8/0x100
[  266.255733][ T6051]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  266.255746][ T6051]  ? __kernfs_new_node+0xe6/0x980
[  266.255758][ T6051]  ? __kernfs_new_node+0xe6/0x980
[  266.255772][ T6051]  __kernfs_new_node+0xe6/0x980
[  266.255787][ T6051]  ? __pfx___kernfs_new_node+0x10/0x10
[  266.255799][ T6051]  ? kernfs_root+0x1c/0x230
[  266.255812][ T6051]  ? kernfs_root+0x1c/0x230
[  266.255823][ T6051]  ? kernfs_root+0x1c/0x230
[  266.255832][ T6051]  ? kernfs_root+0x1c/0x230
[  266.255844][ T6051]  kernfs_new_node+0xea/0x140
[  266.255858][ T6051]  __kernfs_create_file+0x4b/0x2e0
[  266.255868][ T6051]  sysfs_add_file_mode_ns+0x237/0x300
[  266.255881][ T6051]  internal_create_group+0x679/0x1180
[  266.255896][ T6051]  ? kernfs_create_dir_ns+0x1d5/0x230
[  266.255910][ T6051]  ? __pfx_internal_create_group+0x10/0x10
[  266.255921][ T6051]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  266.255932][ T6051]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  266.255944][ T6051]  sysfs_create_groups+0x59/0x120
[  266.255957][ T6051]  kobject_add_internal+0x669/0xcd0
[  266.255974][ T6051]  kobject_init_and_add+0x12b/0x1a0
[  266.255990][ T6051]  ? __pfx_kobject_init_and_add+0x10/0x10
[  266.256003][ T6051]  ? __kmalloc_cache_noprof+0x150/0x660
[  266.256015][ T6051]  ? rpc_sysfs_xprt_setup+0xa7/0x260
[  266.256027][ T6051]  ? rpc_sysfs_xprt_setup+0xa7/0x260
[  266.256041][ T6051]  rpc_sysfs_xprt_setup+0x132/0x260
[  266.256055][ T6051]  xprt_switch_alloc+0x420/0x590
[  266.256067][ T6051]  rpc_create_xprt+0x1c7/0xa90
[  266.256077][ T6051]  ? __pfx_rpc_create_xprt+0x10/0x10
[  266.256094][ T6051]  ? rcu_is_watching+0x15/0xb0
[  266.256105][ T6051]  ? trace_kmalloc+0x2a/0xf0
[  266.256118][ T6051]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  266.256131][ T6051]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  266.256143][ T6051]  ? xprt_create_transport+0x39b/0x5f0
[  266.256152][ T6051]  ? xprt_create_transport+0x39b/0x5f0
[  266.256161][ T6051]  ? kstrdup+0x81/0x100
[  266.256176][ T6051]  ? __asan_memcpy+0x40/0x70
[  266.256191][ T6051]  ? xprt_create_transport+0x438/0x5f0
[  266.256202][ T6051]  rpc_create+0x649/0x900
[  266.256216][ T6051]  ? __pfx_rpc_create+0x10/0x10
[  266.256244][ T6051]  ? __lock_acquire+0x683/0x2cf0
[  266.256257][ T6051]  rpcb_create_af_local+0x1c7/0x3c0
[  266.256267][ T6051]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  266.256285][ T6051]  ? do_raw_spin_unlock+0xf5/0x210
[  266.256298][ T6051]  rpcb_create_local+0x268/0x670
[  266.256308][ T6051]  ? __pfx_rpcb_create_local+0x10/0x10
[  266.256317][ T6051]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  266.256326][ T6051]  ? lockdep_hardirqs_on+0x7a/0x110
[  266.256338][ T6051]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  266.256369][ T6051]  ? __percpu_counter_init_many+0x35f/0x380
[  266.256385][ T6051]  ? __svc_create+0x88f/0x990
[  266.256398][ T6051]  svc_bind+0x1b4/0x230
[  266.256410][ T6051]  nfsd_create_serv+0x581/0x840
[  266.256427][ T6051]  ? __pfx_nfsd_create_serv+0x10/0x10
[  266.256440][ T6051]  ? net_generic+0x1e/0x240
[  266.256456][ T6051]  ? net_generic+0x1e/0x240
[  266.256470][ T6051]  ? net_generic+0x1e/0x240
[  266.256485][ T6051]  nfsd_svc+0x189/0x780
[  266.256500][ T6051]  write_threads+0x3cd/0x5a0
[  266.256509][ T6051]  ? __might_fault+0xaf/0x130
[  266.256521][ T6051]  ? __pfx_write_threads+0x10/0x10
[  266.256537][ T6051]  ? _copy_from_user+0x94/0xb0
[  266.256548][ T6051]  ? simple_transaction_get+0x12d/0x160
[  266.256560][ T6051]  nfsctl_transaction_write+0x10f/0x160
[  266.256570][ T6051]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  266.256579][ T6051]  vfs_write+0x296/0xba0
[  266.256594][ T6051]  ? __pfx_vfs_write+0x10/0x10
[  266.256603][ T6051]  ? lockdep_hardirqs_on+0x7a/0x110
[  266.256618][ T6051]  ? fput_close_sync+0x11f/0x240
[  266.256631][ T6051]  ksys_write+0x150/0x270
[  266.256642][ T6051]  ? __pfx_ksys_write+0x10/0x10
[  266.256656][ T6051]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  266.256665][ T6051]  do_syscall_64+0x174/0x580
[  266.256676][ T6051]  ? trace_irq_disable+0x3b/0x140
[  266.256686][ T6051]  ? clear_bhb_loop+0x70/0xc0
[  266.256696][ T6051]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  266.256705][ T6051] RIP: 0033:0x7f67c8dd3df7
[  266.256714][ T6051] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  266.256722][ T6051] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  266.256732][ T6051] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  266.256739][ T6051] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  266.256744][ T6051] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  266.256749][ T6051] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  266.256755][ T6051] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c9b0
[  266.256768][ T6051]  </TASK>
[  266.256836][ T6051] kobject: kobject_add_internal failed for xprt-54-local (error: -12 parent: switch-55)
[  266.484845][ T6051] FAULT_INJECTION: forcing a failure.
[  266.484845][ T6051] name failslab, interval 1, probability 5, space 0, times -1
[  266.488756][ T6051] CPU: 1 UID: 0 PID: 6051 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  266.488768][ T6051] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  266.488774][ T6051] Call Trace:
[  266.488779][ T6051]  <TASK>
[  266.488783][ T6051]  dump_stack_lvl+0xe8/0x150
[  266.488800][ T6051]  should_fail_ex+0x40c/0x560
[  266.488818][ T6051]  should_failslab+0xa8/0x100
[  266.488829][ T6051]  kmem_cache_alloc_node_noprof+0xb3/0x610
[  266.488842][ T6051]  ? local_lock_release+0x9c/0x160
[  266.488855][ T6051]  ? __alloc_skb+0x1d7/0x7a0
[  266.488866][ T6051]  ? __alloc_skb+0x1d7/0x7a0
[  266.488881][ T6051]  __alloc_skb+0x1d7/0x7a0
[  266.488894][ T6051]  sock_wmalloc+0xb2/0x130
[  266.488904][ T6051]  unix_stream_connect+0x3b5/0xfd0
[  266.488922][ T6051]  kernel_connect+0x141/0x1c0
[  266.488932][ T6051]  ? __pfx_kernel_connect+0x10/0x10
[  266.488948][ T6051]  ? __local_bh_enable_ip+0xd0/0x130
[  266.488962][ T6051]  xs_local_connect+0x626/0x810
[  266.488975][ T6051]  ? __pfx_xs_local_connect+0x10/0x10
[  266.488986][ T6051]  ? do_raw_spin_unlock+0xf5/0x210
[  266.489000][ T6051]  xprt_connect+0x613/0x850
[  266.489013][ T6051]  ? __pfx_call_connect+0x10/0x10
[  266.489024][ T6051]  __rpc_execute+0x526/0x1280
[  266.489043][ T6051]  ? __pfx___rpc_execute+0x10/0x10
[  266.489056][ T6051]  ? rpc_task_get_xprt+0x26/0x250
[  266.489066][ T6051]  ? rpc_make_runnable+0xae/0x1c0
[  266.489079][ T6051]  rpc_execute+0x1c1/0x390
[  266.489091][ T6051]  rpc_run_task+0x4a6/0x660
[  266.489102][ T6051]  rpc_create_xprt+0x533/0xa90
[  266.489111][ T6051]  ? __pfx_rpc_create_xprt+0x10/0x10
[  266.489128][ T6051]  ? rcu_is_watching+0x15/0xb0
[  266.489138][ T6051]  ? trace_kmalloc+0x2a/0xf0
[  266.489152][ T6051]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  266.489164][ T6051]  ? xprt_create_transport+0x39b/0x5f0
[  266.489179][ T6051]  ? xprt_create_transport+0x438/0x5f0
[  266.489189][ T6051]  rpc_create+0x649/0x900
[  266.489203][ T6051]  ? __pfx_rpc_create+0x10/0x10
[  266.489230][ T6051]  ? __lock_acquire+0x683/0x2cf0
[  266.489243][ T6051]  rpcb_create_af_local+0x1c7/0x3c0
[  266.489253][ T6051]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  266.489271][ T6051]  ? do_raw_spin_unlock+0xf5/0x210
[  266.489283][ T6051]  rpcb_create_local+0x268/0x670
[  266.489293][ T6051]  ? __pfx_rpcb_create_local+0x10/0x10
[  266.489301][ T6051]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  266.489312][ T6051]  ? lockdep_hardirqs_on+0x7a/0x110
[  266.489344][ T6051]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  266.489354][ T6051]  ? __percpu_counter_init_many+0x35f/0x380
[  266.489369][ T6051]  ? __svc_create+0x88f/0x990
[  266.489382][ T6051]  svc_bind+0x1b4/0x230
[  266.489393][ T6051]  nfsd_create_serv+0x581/0x840
[  266.489410][ T6051]  ? __pfx_nfsd_create_serv+0x10/0x10
[  266.489423][ T6051]  ? net_generic+0x1e/0x240
[  266.489434][ T6051]  ? net_generic+0x1e/0x240
[  266.489448][ T6051]  ? net_generic+0x1e/0x240
[  266.489462][ T6051]  nfsd_svc+0x189/0x780
[  266.489476][ T6051]  write_threads+0x3cd/0x5a0
[  266.489484][ T6051]  ? __might_fault+0xaf/0x130
[  266.489501][ T6051]  ? __pfx_write_threads+0x10/0x10
[  266.489518][ T6051]  ? _copy_from_user+0x94/0xb0
[  266.489528][ T6051]  ? simple_transaction_get+0x12d/0x160
[  266.489539][ T6051]  nfsctl_transaction_write+0x10f/0x160
[  266.489549][ T6051]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  266.489558][ T6051]  vfs_write+0x296/0xba0
[  266.489573][ T6051]  ? __pfx_vfs_write+0x10/0x10
[  266.489582][ T6051]  ? lockdep_hardirqs_on+0x7a/0x110
[  266.489597][ T6051]  ? fput_close_sync+0x11f/0x240
[  266.489610][ T6051]  ksys_write+0x150/0x270
[  266.489622][ T6051]  ? __pfx_ksys_write+0x10/0x10
[  266.489636][ T6051]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  266.489645][ T6051]  do_syscall_64+0x174/0x580
[  266.489657][ T6051]  ? trace_irq_disable+0x3b/0x140
[  266.489671][ T6051]  ? clear_bhb_loop+0x70/0xc0
[  266.489688][ T6051]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  266.489703][ T6051] RIP: 0033:0x7f67c8dd3df7
[  266.489718][ T6051] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  266.489732][ T6051] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  266.489748][ T6051] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  266.489755][ T6051] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  266.489761][ T6051] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  266.489766][ T6051] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  266.489771][ T6051] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c9b0
[  266.489784][ T6051]  </TASK>
[  266.489833][ T6051] xs_local_setup_socket: unhandled error (12) connecting to @/run/rpcbind.sock
[  266.627157][ T6051] FAULT_INJECTION: forcing a failure.
[  266.627157][ T6051] name failslab, interval 1, probability 5, space 0, times -1
[  266.630932][ T6051] CPU: 1 UID: 0 PID: 6051 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  266.630943][ T6051] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  266.630950][ T6051] Call Trace:
[  266.630954][ T6051]  <TASK>
[  266.630958][ T6051]  dump_stack_lvl+0xe8/0x150
[  266.630975][ T6051]  should_fail_ex+0x40c/0x560
[  266.630992][ T6051]  should_failslab+0xa8/0x100
[  266.631004][ T6051]  __kmalloc_node_track_caller_noprof+0x100/0x730
[  266.631019][ T6051]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  266.631031][ T6051]  ? xs_format_peer_addresses+0x3e7/0x530
[  266.631042][ T6051]  ? xs_format_peer_addresses+0x3e7/0x530
[  266.631055][ T6051]  kstrdup+0x42/0x100
[  266.631070][ T6051]  xs_format_peer_addresses+0x3e7/0x530
[  266.631081][ T6051]  ? __pfx_xs_format_peer_addresses+0x10/0x10
[  266.631099][ T6051]  ? timer_init_key+0x161/0x2c0
[  266.631114][ T6051]  xs_setup_local+0x49d/0x5d0
[  266.631125][ T6051]  xprt_create_transport+0x166/0x5f0
[  266.631137][ T6051]  rpc_create+0x4ff/0x900
[  266.631151][ T6051]  ? __pfx_rpc_create+0x10/0x10
[  266.631179][ T6051]  ? __lock_acquire+0x683/0x2cf0
[  266.631193][ T6051]  rpcb_create_af_local+0x1c7/0x3c0
[  266.631202][ T6051]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  266.631221][ T6051]  ? do_raw_spin_unlock+0xf5/0x210
[  266.631234][ T6051]  rpcb_create_local+0x28f/0x670
[  266.631244][ T6051]  ? __pfx_rpcb_create_local+0x10/0x10
[  266.631252][ T6051]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  266.631263][ T6051]  ? lockdep_hardirqs_on+0x7a/0x110
[  266.631274][ T6051]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  266.631283][ T6051]  ? __percpu_counter_init_many+0x35f/0x380
[  266.631298][ T6051]  ? __svc_create+0x88f/0x990
[  266.631332][ T6051]  svc_bind+0x1b4/0x230
[  266.631344][ T6051]  nfsd_create_serv+0x581/0x840
[  266.631361][ T6051]  ? __pfx_nfsd_create_serv+0x10/0x10
[  266.631374][ T6051]  ? net_generic+0x1e/0x240
[  266.631385][ T6051]  ? net_generic+0x1e/0x240
[  266.631399][ T6051]  ? net_generic+0x1e/0x240
[  266.631413][ T6051]  nfsd_svc+0x189/0x780
[  266.631428][ T6051]  write_threads+0x3cd/0x5a0
[  266.631436][ T6051]  ? __might_fault+0xaf/0x130
[  266.631448][ T6051]  ? __pfx_write_threads+0x10/0x10
[  266.631464][ T6051]  ? _copy_from_user+0x94/0xb0
[  266.631474][ T6051]  ? simple_transaction_get+0x12d/0x160
[  266.631491][ T6051]  nfsctl_transaction_write+0x10f/0x160
[  266.631500][ T6051]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  266.631509][ T6051]  vfs_write+0x296/0xba0
[  266.631524][ T6051]  ? __pfx_vfs_write+0x10/0x10
[  266.631533][ T6051]  ? lockdep_hardirqs_on+0x7a/0x110
[  266.631549][ T6051]  ? fput_close_sync+0x11f/0x240
[  266.631561][ T6051]  ksys_write+0x150/0x270
[  266.631573][ T6051]  ? __pfx_ksys_write+0x10/0x10
[  266.631587][ T6051]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  266.631596][ T6051]  do_syscall_64+0x174/0x580
[  266.631607][ T6051]  ? trace_irq_disable+0x3b/0x140
[  266.631616][ T6051]  ? clear_bhb_loop+0x70/0xc0
[  266.631627][ T6051]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  266.631635][ T6051] RIP: 0033:0x7f67c8dd3df7
[  266.631646][ T6051] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  266.631653][ T6051] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  266.631663][ T6051] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  266.631669][ T6051] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  266.631675][ T6051] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  266.631680][ T6051] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  266.631685][ T6051] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c9b0
[  266.631699][ T6051]  </TASK>
[  266.631733][ T6051] FAULT_INJECTION: forcing a failure.
[  266.631733][ T6051] name failslab, interval 1, probability 5, space 0, times -1
[  266.750795][ T6051] CPU: 1 UID: 0 PID: 6051 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  266.750809][ T6051] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  266.750815][ T6051] Call Trace:
[  266.750820][ T6051]  <TASK>
[  266.750824][ T6051]  dump_stack_lvl+0xe8/0x150
[  266.750841][ T6051]  should_fail_ex+0x40c/0x560
[  266.750858][ T6051]  should_failslab+0xa8/0x100
[  266.750870][ T6051]  __kmalloc_cache_noprof+0xa8/0x660
[  266.750884][ T6051]  ? ksys_write+0x150/0x270
[  266.750895][ T6051]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  266.750910][ T6051]  ? xprt_switch_alloc+0x7a/0x590
[  266.750921][ T6051]  ? xprt_switch_alloc+0x7a/0x590
[  266.750933][ T6051]  xprt_switch_alloc+0x7a/0x590
[  266.750945][ T6051]  rpc_create_xprt+0x1c7/0xa90
[  266.750955][ T6051]  ? __pfx_rpc_create_xprt+0x10/0x10
[  266.750972][ T6051]  ? rcu_is_watching+0x15/0xb0
[  266.750982][ T6051]  ? trace_kmalloc+0x2a/0xf0
[  266.750995][ T6051]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  266.751009][ T6051]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  266.751021][ T6051]  ? xprt_create_transport+0x39b/0x5f0
[  266.751030][ T6051]  ? xprt_create_transport+0x39b/0x5f0
[  266.751039][ T6051]  ? kstrdup+0x81/0x100
[  266.751052][ T6051]  ? __asan_memcpy+0x40/0x70
[  266.751066][ T6051]  ? xprt_create_transport+0x438/0x5f0
[  266.751077][ T6051]  rpc_create+0x649/0x900
[  266.751091][ T6051]  ? __pfx_rpc_create+0x10/0x10
[  266.751119][ T6051]  ? __lock_acquire+0x683/0x2cf0
[  266.751132][ T6051]  rpcb_create_af_local+0x1c7/0x3c0
[  266.751142][ T6051]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  266.751159][ T6051]  ? do_raw_spin_unlock+0xf5/0x210
[  266.751173][ T6051]  rpcb_create_local+0x28f/0x670
[  266.751183][ T6051]  ? __pfx_rpcb_create_local+0x10/0x10
[  266.751191][ T6051]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  266.751201][ T6051]  ? lockdep_hardirqs_on+0x7a/0x110
[  266.751212][ T6051]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  266.751222][ T6051]  ? __percpu_counter_init_many+0x35f/0x380
[  266.751236][ T6051]  ? __svc_create+0x88f/0x990
[  266.751250][ T6051]  svc_bind+0x1b4/0x230
[  266.751261][ T6051]  nfsd_create_serv+0x581/0x840
[  266.751278][ T6051]  ? __pfx_nfsd_create_serv+0x10/0x10
[  266.751310][ T6051]  ? net_generic+0x1e/0x240
[  266.751323][ T6051]  ? net_generic+0x1e/0x240
[  266.751336][ T6051]  ? net_generic+0x1e/0x240
[  266.751351][ T6051]  nfsd_svc+0x189/0x780
[  266.751369][ T6051]  write_threads+0x3cd/0x5a0
[  266.751379][ T6051]  ? __might_fault+0xaf/0x130
[  266.751391][ T6051]  ? __pfx_write_threads+0x10/0x10
[  266.751407][ T6051]  ? _copy_from_user+0x94/0xb0
[  266.751418][ T6051]  ? simple_transaction_get+0x12d/0x160
[  266.751429][ T6051]  nfsctl_transaction_write+0x10f/0x160
[  266.751439][ T6051]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  266.751448][ T6051]  vfs_write+0x296/0xba0
[  266.751462][ T6051]  ? __pfx_vfs_write+0x10/0x10
[  266.751471][ T6051]  ? lockdep_hardirqs_on+0x7a/0x110
[  266.751487][ T6051]  ? fput_close_sync+0x11f/0x240
[  266.751499][ T6051]  ksys_write+0x150/0x270
[  266.751511][ T6051]  ? __pfx_ksys_write+0x10/0x10
[  266.751525][ T6051]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  266.751534][ T6051]  do_syscall_64+0x174/0x580
[  266.751545][ T6051]  ? trace_irq_disable+0x3b/0x140
[  266.751554][ T6051]  ? clear_bhb_loop+0x70/0xc0
[  266.751568][ T6051]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  266.751577][ T6051] RIP: 0033:0x7f67c8dd3df7
[  266.751587][ T6051] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  266.751595][ T6051] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  266.751605][ T6051] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  266.751611][ T6051] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  266.751617][ T6051] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  266.751622][ T6051] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  266.751627][ T6051] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c9b0
[  266.751640][ T6051]  </TASK>
[  266.751836][ T6051] FAULT_INJECTION: forcing a failure.
[  266.751836][ T6051] name failslab, interval 1, probability 5, space 0, times -1
[  266.878130][ T6051] CPU: 1 UID: 0 PID: 6051 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  266.878143][ T6051] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  266.878149][ T6051] Call Trace:
[  266.878153][ T6051]  <TASK>
[  266.878157][ T6051]  dump_stack_lvl+0xe8/0x150
[  266.878174][ T6051]  should_fail_ex+0x40c/0x560
[  266.878191][ T6051]  should_failslab+0xa8/0x100
[  266.878202][ T6051]  __kmalloc_cache_noprof+0xa8/0x660
[  266.878215][ T6051]  ? do_syscall_64+0x174/0x580
[  266.878228][ T6051]  ? xprt_switch_alloc+0x7a/0x590
[  266.878237][ T6051]  ? xprt_switch_alloc+0x7a/0x590
[  266.878249][ T6051]  xprt_switch_alloc+0x7a/0x590
[  266.878261][ T6051]  rpc_create_xprt+0x1c7/0xa90
[  266.878271][ T6051]  ? __pfx_rpc_create_xprt+0x10/0x10
[  266.878313][ T6051]  ? rcu_is_watching+0x15/0xb0
[  266.878323][ T6051]  ? trace_kmalloc+0x2a/0xf0
[  266.878337][ T6051]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  266.878350][ T6051]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  266.878362][ T6051]  ? xprt_create_transport+0x39b/0x5f0
[  266.878371][ T6051]  ? xprt_create_transport+0x39b/0x5f0
[  266.878380][ T6051]  ? kstrdup+0x81/0x100
[  266.878394][ T6051]  ? __asan_memcpy+0x40/0x70
[  266.878409][ T6051]  ? xprt_create_transport+0x438/0x5f0
[  266.878420][ T6051]  rpc_create+0x649/0x900
[  266.878434][ T6051]  ? __pfx_rpc_create+0x10/0x10
[  266.878467][ T6051]  rpcb_create_local+0x3ab/0x670
[  266.878478][ T6051]  ? __pfx_rpcb_create_local+0x10/0x10
[  266.878492][ T6051]  ? __svc_create+0x88f/0x990
[  266.878506][ T6051]  svc_bind+0x1b4/0x230
[  266.878517][ T6051]  nfsd_create_serv+0x581/0x840
[  266.878534][ T6051]  ? __pfx_nfsd_create_serv+0x10/0x10
[  266.878547][ T6051]  ? net_generic+0x1e/0x240
[  266.878558][ T6051]  ? net_generic+0x1e/0x240
[  266.878571][ T6051]  ? net_generic+0x1e/0x240
[  266.878586][ T6051]  nfsd_svc+0x189/0x780
[  266.878600][ T6051]  write_threads+0x3cd/0x5a0
[  266.878608][ T6051]  ? __might_fault+0xaf/0x130
[  266.878620][ T6051]  ? __pfx_write_threads+0x10/0x10
[  266.878636][ T6051]  ? _copy_from_user+0x94/0xb0
[  266.878646][ T6051]  ? simple_transaction_get+0x12d/0x160
[  266.878657][ T6051]  nfsctl_transaction_write+0x10f/0x160
[  266.878667][ T6051]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  266.878676][ T6051]  vfs_write+0x296/0xba0
[  266.878691][ T6051]  ? __pfx_vfs_write+0x10/0x10
[  266.878701][ T6051]  ? lockdep_hardirqs_on+0x7a/0x110
[  266.878716][ T6051]  ? fput_close_sync+0x11f/0x240
[  266.878728][ T6051]  ksys_write+0x150/0x270
[  266.878740][ T6051]  ? __pfx_ksys_write+0x10/0x10
[  266.878754][ T6051]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  266.878763][ T6051]  do_syscall_64+0x174/0x580
[  266.878774][ T6051]  ? trace_irq_disable+0x3b/0x140
[  266.878782][ T6051]  ? clear_bhb_loop+0x70/0xc0
[  266.878793][ T6051]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  266.878802][ T6051] RIP: 0033:0x7f67c8dd3df7
[  266.878811][ T6051] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  266.878819][ T6051] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  266.878829][ T6051] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  266.878835][ T6051] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  266.878841][ T6051] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  266.878846][ T6051] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  266.878852][ T6051] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c9b0
[  266.878864][ T6051]  </TASK>
[  266.879182][ T6051] FAULT_INJECTION: forcing a failure.
[  266.879182][ T6051] name failslab, interval 1, probability 5, space 0, times -1
[  266.880419][ T5933] FAULT_INJECTION: forcing a failure.
[  266.880419][ T5933] name failslab, interval 1, probability 5, space 0, times -1
[  266.882128][ T6051] CPU: 1 UID: 0 PID: 6051 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  266.882139][ T6051] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  266.882145][ T6051] Call Trace:
[  266.882149][ T6051]  <TASK>
[  266.882153][ T6051]  dump_stack_lvl+0xe8/0x150
[  266.882168][ T6051]  should_fail_ex+0x40c/0x560
[  266.882184][ T6051]  should_failslab+0xa8/0x100
[  266.882195][ T6051]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  266.882207][ T6051]  ? alloc_empty_file+0x5b/0x1d0
[  266.882215][ T6051]  ? alloc_empty_file+0x5b/0x1d0
[  266.882223][ T6051]  ? stack_trace_save+0xa9/0x100
[  266.882237][ T6051]  alloc_empty_file+0x5b/0x1d0
[  266.882245][ T6051]  path_openat+0x8f/0x3830
[  266.882273][ T6051]  ? __mutex_unlock_slowpath+0x1/0x900
[  266.882308][ T6051]  ? kasan_save_track+0x4f/0x80
[  266.882315][ T6051]  ? kasan_save_track+0x3e/0x80
[  266.882322][ T6051]  ? __kasan_slab_alloc+0x6c/0x80
[  266.882330][ T6051]  ? kmem_cache_alloc_noprof+0x2a0/0x5f0
[  266.882341][ T6051]  ? do_getname+0x2e/0x250
[  266.882352][ T6051]  ? do_sys_openat2+0xcc/0x200
[  266.882360][ T6051]  ? __x64_sys_openat+0x138/0x170
[  266.882368][ T6051]  ? do_syscall_64+0x174/0x580
[  266.882378][ T6051]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  266.882390][ T6051]  ? __lock_acquire+0x683/0x2cf0
[  266.882402][ T6051]  do_file_open+0x23e/0x4a0
[  266.882414][ T6051]  ? __pfx_do_file_open+0x10/0x10
[  266.882432][ T6051]  ? _raw_spin_unlock+0x28/0x50
[  266.882442][ T6051]  ? alloc_fd+0x651/0x6c0
[  266.882454][ T6051]  do_sys_openat2+0x115/0x200
[  266.882463][ T6051]  ? __pfx_do_sys_openat2+0x10/0x10
[  266.882474][ T6051]  ? rcu_is_watching+0x15/0xb0
[  266.882486][ T6051]  __x64_sys_openat+0x138/0x170
[  266.882495][ T6051]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  266.882504][ T6051]  do_syscall_64+0x174/0x580
[  266.882514][ T6051]  ? trace_irq_disable+0x3b/0x140
[  266.882523][ T6051]  ? clear_bhb_loop+0x70/0xc0
[  266.882534][ T6051]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  266.882542][ T6051] RIP: 0033:0x7f67c8dd3df7
[  266.882550][ T6051] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  266.882558][ T6051] RSP: 002b:00007ffc9caa0f00 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
[  266.882567][ T6051] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  266.882574][ T6051] RDX: 0000000000000001 RSI: 00007f67c8e0e192 RDI: ffffffffffffff9c
[  266.882580][ T6051] RBP: 00007f67c8e0e68c R08: 0000000000000000 R09: 0000000000000000
[  266.882585][ T6051] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  266.882591][ T6051] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c9b0
[  266.882603][ T6051]  </TASK>
[  267.119222][ T5933] CPU: 0 UID: 0 PID: 5933 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  267.119236][ T5933] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  267.119242][ T5933] Call Trace:
[  267.119248][ T5933]  <TASK>
[  267.119271][ T5933]  dump_stack_lvl+0xe8/0x150
[  267.119290][ T5933]  should_fail_ex+0x40c/0x560
[  267.119307][ T5933]  should_failslab+0xa8/0x100
[  267.119319][ T5933]  __kmalloc_node_track_caller_noprof+0x100/0x730
[  267.119335][ T5933]  ? kobject_set_name_vargs+0x61/0x110
[  267.119349][ T5933]  ? kobject_set_name_vargs+0x61/0x110
[  267.119365][ T5933]  kvasprintf+0xeb/0x1a0
[  267.119377][ T5933]  ? __pfx_kvasprintf+0x10/0x10
[  267.119391][ T5933]  ? kvasprintf_const+0xe1/0x240
[  267.119402][ T5933]  kobject_set_name_vargs+0x61/0x110
[  267.119416][ T5933]  kobject_init_and_add+0xee/0x1a0
[  267.119437][ T5933]  ? __pfx_kobject_init_and_add+0x10/0x10
[  267.119450][ T5933]  ? __kmalloc_cache_noprof+0x150/0x660
[  267.119463][ T5933]  ? rpc_sysfs_xprt_setup+0xa7/0x260
[  267.119475][ T5933]  ? rpc_sysfs_xprt_setup+0xa7/0x260
[  267.119489][ T5933]  rpc_sysfs_xprt_setup+0x132/0x260
[  267.119503][ T5933]  xprt_switch_alloc+0x420/0x590
[  267.119515][ T5933]  rpc_create_xprt+0x1c7/0xa90
[  267.119525][ T5933]  ? __pfx_rpc_create_xprt+0x10/0x10
[  267.119542][ T5933]  ? rcu_is_watching+0x15/0xb0
[  267.119554][ T5933]  ? trace_kmalloc+0x2a/0xf0
[  267.119567][ T5933]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  267.119579][ T5933]  ? uvc_ctrl_status_event+0x2a8/0x390
[  267.119589][ T5933]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  267.119601][ T5933]  ? xprt_create_transport+0x39b/0x5f0
[  267.119610][ T5933]  ? xprt_create_transport+0x39b/0x5f0
[  267.119618][ T5933]  ? kstrdup+0x81/0x100
[  267.119632][ T5933]  ? __asan_memcpy+0x40/0x70
[  267.119647][ T5933]  ? xprt_create_transport+0x438/0x5f0
[  267.119658][ T5933]  rpc_create+0x649/0x900
[  267.119672][ T5933]  ? __pfx_rpc_create+0x10/0x10
[  267.119699][ T5933]  ? __lock_acquire+0x683/0x2cf0
[  267.119713][ T5933]  rpcb_create_af_local+0x1c7/0x3c0
[  267.119722][ T5933]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  267.119740][ T5933]  ? do_raw_spin_unlock+0xf5/0x210
[  267.119753][ T5933]  rpcb_create_local+0x268/0x670
[  267.119763][ T5933]  ? __pfx_rpcb_create_local+0x10/0x10
[  267.119771][ T5933]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  267.119781][ T5933]  ? lockdep_hardirqs_on+0x7a/0x110
[  267.119792][ T5933]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  267.119801][ T5933]  ? __percpu_counter_init_many+0x35f/0x380
[  267.119816][ T5933]  ? __svc_create+0x88f/0x990
[  267.119829][ T5933]  svc_bind+0x1b4/0x230
[  267.119840][ T5933]  nfsd_create_serv+0x581/0x840
[  267.119853][ T5933]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  267.119863][ T5933]  ? lockdep_hardirqs_on+0x7a/0x110
[  267.119875][ T5933]  ? __pfx_nfsd_create_serv+0x10/0x10
[  267.119887][ T5933]  ? net_generic+0x1e/0x240
[  267.119899][ T5933]  ? net_generic+0x1e/0x240
[  267.119912][ T5933]  ? net_generic+0x1e/0x240
[  267.119926][ T5933]  nfsd_svc+0x189/0x780
[  267.119941][ T5933]  write_threads+0x3cd/0x5a0
[  267.119949][ T5933]  ? __might_fault+0xaf/0x130
[  267.119961][ T5933]  ? __pfx_write_threads+0x10/0x10
[  267.119977][ T5933]  ? _copy_from_user+0x94/0xb0
[  267.119987][ T5933]  ? simple_transaction_get+0x12d/0x160
[  267.119998][ T5933]  nfsctl_transaction_write+0x10f/0x160
[  267.120008][ T5933]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  267.120017][ T5933]  vfs_write+0x296/0xba0
[  267.120032][ T5933]  ? __pfx_vfs_write+0x10/0x10
[  267.120041][ T5933]  ? lockdep_hardirqs_on+0x7a/0x110
[  267.120056][ T5933]  ? fput_close_sync+0x11f/0x240
[  267.120068][ T5933]  ksys_write+0x150/0x270
[  267.120080][ T5933]  ? __pfx_ksys_write+0x10/0x10
[  267.120094][ T5933]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  267.120103][ T5933]  do_syscall_64+0x174/0x580
[  267.120114][ T5933]  ? trace_irq_disable+0x3b/0x140
[  267.120123][ T5933]  ? clear_bhb_loop+0x70/0xc0
[  267.120133][ T5933]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  267.120142][ T5933] RIP: 0033:0x7f67c8dd3df7
[  267.120152][ T5933] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  267.120159][ T5933] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  267.120169][ T5933] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  267.120176][ T5933] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  267.120181][ T5933] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  267.120186][ T5933] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  267.120192][ T5933] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c7dc
[  267.120205][ T5933]  </TASK>
[  267.120210][ T5933] kobject: can not set name properly!
[  267.263444][ T5933] FAULT_INJECTION: forcing a failure.
[  267.263444][ T5933] name failslab, interval 1, probability 5, space 0, times -1
[  267.267322][ T5933] CPU: 0 UID: 0 PID: 5933 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  267.267333][ T5933] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  267.267340][ T5933] Call Trace:
[  267.267345][ T5933]  <TASK>
[  267.267349][ T5933]  dump_stack_lvl+0xe8/0x150
[  267.267366][ T5933]  should_fail_ex+0x40c/0x560
[  267.267383][ T5933]  should_failslab+0xa8/0x100
[  267.267395][ T5933]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  267.267407][ T5933]  ? kstrdup+0x81/0x100
[  267.267426][ T5933]  ? __kernfs_new_node+0xe6/0x980
[  267.267438][ T5933]  ? __kernfs_new_node+0xe6/0x980
[  267.267452][ T5933]  __kernfs_new_node+0xe6/0x980
[  267.267467][ T5933]  ? __pfx___kernfs_new_node+0x10/0x10
[  267.267479][ T5933]  ? kernfs_root+0x1c/0x230
[  267.267492][ T5933]  ? kernfs_root+0x1c/0x230
[  267.267502][ T5933]  ? kernfs_root+0x1c/0x230
[  267.267512][ T5933]  ? kernfs_root+0x1c/0x230
[  267.267525][ T5933]  kernfs_create_dir_ns+0xfe/0x230
[  267.267539][ T5933]  sysfs_create_dir_ns+0x12f/0x2a0
[  267.267551][ T5933]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  267.267563][ T5933]  ? do_raw_spin_unlock+0xf5/0x210
[  267.267577][ T5933]  kobject_add_internal+0x622/0xcd0
[  267.267594][ T5933]  kobject_init_and_add+0x12b/0x1a0
[  267.267609][ T5933]  ? __pfx_kobject_init_and_add+0x10/0x10
[  267.267623][ T5933]  ? __kmalloc_cache_noprof+0x150/0x660
[  267.267636][ T5933]  ? rpc_sysfs_client_setup+0x106/0x310
[  267.267647][ T5933]  ? rpc_sysfs_client_setup+0x106/0x310
[  267.267661][ T5933]  rpc_sysfs_client_setup+0x191/0x310
[  267.267676][ T5933]  ? __pfx_rpc_sysfs_client_setup+0x10/0x10
[  267.267688][ T5933]  ? rpc_net_ns+0x1e/0x230
[  267.267697][ T5933]  ? rpc_net_ns+0x1e/0x230
[  267.267705][ T5933]  ? rpc_net_ns+0x1e/0x230
[  267.267716][ T5933]  rpc_new_client+0x716/0xc50
[  267.267730][ T5933]  rpc_create_xprt+0x29f/0xa90
[  267.267739][ T5933]  ? __pfx_rpc_create_xprt+0x10/0x10
[  267.267756][ T5933]  ? rcu_is_watching+0x15/0xb0
[  267.267767][ T5933]  ? trace_kmalloc+0x2a/0xf0
[  267.267780][ T5933]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  267.267792][ T5933]  ? uvc_ctrl_status_event+0x2a8/0x390
[  267.267802][ T5933]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  267.267814][ T5933]  ? xprt_create_transport+0x39b/0x5f0
[  267.267823][ T5933]  ? xprt_create_transport+0x39b/0x5f0
[  267.267832][ T5933]  ? kstrdup+0x81/0x100
[  267.267845][ T5933]  ? __asan_memcpy+0x40/0x70
[  267.267859][ T5933]  ? xprt_create_transport+0x438/0x5f0
[  267.267870][ T5933]  rpc_create+0x649/0x900
[  267.267884][ T5933]  ? __pfx_rpc_create+0x10/0x10
[  267.267911][ T5933]  ? __lock_acquire+0x683/0x2cf0
[  267.267924][ T5933]  rpcb_create_af_local+0x1c7/0x3c0
[  267.267933][ T5933]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  267.267951][ T5933]  ? do_raw_spin_unlock+0xf5/0x210
[  267.267964][ T5933]  rpcb_create_local+0x268/0x670
[  267.267974][ T5933]  ? __pfx_rpcb_create_local+0x10/0x10
[  267.267981][ T5933]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  267.267991][ T5933]  ? lockdep_hardirqs_on+0x7a/0x110
[  267.268002][ T5933]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  267.268012][ T5933]  ? __percpu_counter_init_many+0x35f/0x380
[  267.268026][ T5933]  ? __svc_create+0x88f/0x990
[  267.268039][ T5933]  svc_bind+0x1b4/0x230
[  267.268050][ T5933]  nfsd_create_serv+0x581/0x840
[  267.268063][ T5933]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  267.268073][ T5933]  ? lockdep_hardirqs_on+0x7a/0x110
[  267.268085][ T5933]  ? __pfx_nfsd_create_serv+0x10/0x10
[  267.268097][ T5933]  ? net_generic+0x1e/0x240
[  267.268109][ T5933]  ? net_generic+0x1e/0x240
[  267.268122][ T5933]  ? net_generic+0x1e/0x240
[  267.268136][ T5933]  nfsd_svc+0x189/0x780
[  267.268151][ T5933]  write_threads+0x3cd/0x5a0
[  267.268159][ T5933]  ? __might_fault+0xaf/0x130
[  267.268171][ T5933]  ? __pfx_write_threads+0x10/0x10
[  267.268187][ T5933]  ? _copy_from_user+0x94/0xb0
[  267.268198][ T5933]  ? simple_transaction_get+0x12d/0x160
[  267.268209][ T5933]  nfsctl_transaction_write+0x10f/0x160
[  267.268218][ T5933]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  267.268227][ T5933]  vfs_write+0x296/0xba0
[  267.268261][ T5933]  ? __pfx_vfs_write+0x10/0x10
[  267.268271][ T5933]  ? lockdep_hardirqs_on+0x7a/0x110
[  267.268286][ T5933]  ? fput_close_sync+0x11f/0x240
[  267.268299][ T5933]  ksys_write+0x150/0x270
[  267.268310][ T5933]  ? __pfx_ksys_write+0x10/0x10
[  267.268324][ T5933]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  267.268334][ T5933]  do_syscall_64+0x174/0x580
[  267.268345][ T5933]  ? trace_irq_disable+0x3b/0x140
[  267.268353][ T5933]  ? clear_bhb_loop+0x70/0xc0
[  267.268364][ T5933]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  267.268373][ T5933] RIP: 0033:0x7f67c8dd3df7
[  267.268383][ T5933] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  267.268390][ T5933] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  267.268401][ T5933] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  267.268407][ T5933] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  267.268413][ T5933] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  267.268422][ T5933] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  267.268427][ T5933] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c7dc
[  267.268440][ T5933]  </TASK>
[  267.268457][ T5933] kobject: kobject_add_internal failed for clnt-55 (error: -12 parent: rpc-clients)
[  267.493862][ T5933] FAULT_INJECTION: forcing a failure.
[  267.493862][ T5933] name failslab, interval 1, probability 5, space 0, times -1
[  267.497883][ T5933] CPU: 0 UID: 0 PID: 5933 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  267.497895][ T5933] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  267.497902][ T5933] Call Trace:
[  267.497906][ T5933]  <TASK>
[  267.497910][ T5933]  dump_stack_lvl+0xe8/0x150
[  267.497927][ T5933]  should_fail_ex+0x40c/0x560
[  267.497944][ T5933]  should_failslab+0xa8/0x100
[  267.497956][ T5933]  kmem_cache_alloc_node_noprof+0xb3/0x610
[  267.497968][ T5933]  ? local_lock_release+0x9c/0x160
[  267.497982][ T5933]  ? __alloc_skb+0x1d7/0x7a0
[  267.497993][ T5933]  ? __alloc_skb+0x1d7/0x7a0
[  267.498007][ T5933]  __alloc_skb+0x1d7/0x7a0
[  267.498020][ T5933]  sock_wmalloc+0xb2/0x130
[  267.498030][ T5933]  unix_stream_connect+0x3b5/0xfd0
[  267.498046][ T5933]  kernel_connect+0x141/0x1c0
[  267.498057][ T5933]  ? __pfx_kernel_connect+0x10/0x10
[  267.498073][ T5933]  ? __local_bh_enable_ip+0xd0/0x130
[  267.498087][ T5933]  xs_local_connect+0x626/0x810
[  267.498100][ T5933]  ? __pfx_xs_local_connect+0x10/0x10
[  267.498111][ T5933]  ? do_raw_spin_unlock+0xf5/0x210
[  267.498125][ T5933]  xprt_connect+0x613/0x850
[  267.498139][ T5933]  ? __pfx_call_connect+0x10/0x10
[  267.498150][ T5933]  __rpc_execute+0x526/0x1280
[  267.498170][ T5933]  ? __pfx___rpc_execute+0x10/0x10
[  267.498182][ T5933]  ? rpc_task_get_xprt+0x26/0x250
[  267.498193][ T5933]  ? rpc_make_runnable+0xae/0x1c0
[  267.498206][ T5933]  rpc_execute+0x1c1/0x390
[  267.498249][ T5933]  rpc_run_task+0x4a6/0x660
[  267.498260][ T5933]  rpc_create_xprt+0x533/0xa90
[  267.498270][ T5933]  ? __pfx_rpc_create_xprt+0x10/0x10
[  267.498287][ T5933]  ? rcu_is_watching+0x15/0xb0
[  267.498297][ T5933]  ? trace_kmalloc+0x2a/0xf0
[  267.498312][ T5933]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  267.498325][ T5933]  ? xprt_create_transport+0x39b/0x5f0
[  267.498339][ T5933]  ? xprt_create_transport+0x438/0x5f0
[  267.498350][ T5933]  rpc_create+0x649/0x900
[  267.498364][ T5933]  ? __pfx_rpc_create+0x10/0x10
[  267.498391][ T5933]  ? __lock_acquire+0x683/0x2cf0
[  267.498405][ T5933]  rpcb_create_af_local+0x1c7/0x3c0
[  267.498414][ T5933]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  267.498432][ T5933]  ? do_raw_spin_unlock+0xf5/0x210
[  267.498445][ T5933]  rpcb_create_local+0x268/0x670
[  267.498454][ T5933]  ? __pfx_rpcb_create_local+0x10/0x10
[  267.498462][ T5933]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  267.498473][ T5933]  ? lockdep_hardirqs_on+0x7a/0x110
[  267.498484][ T5933]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  267.498493][ T5933]  ? __percpu_counter_init_many+0x35f/0x380
[  267.498507][ T5933]  ? __svc_create+0x88f/0x990
[  267.498521][ T5933]  svc_bind+0x1b4/0x230
[  267.498532][ T5933]  nfsd_create_serv+0x581/0x840
[  267.498545][ T5933]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  267.498554][ T5933]  ? lockdep_hardirqs_on+0x7a/0x110
[  267.498566][ T5933]  ? __pfx_nfsd_create_serv+0x10/0x10
[  267.498579][ T5933]  ? net_generic+0x1e/0x240
[  267.498590][ T5933]  ? net_generic+0x1e/0x240
[  267.498603][ T5933]  ? net_generic+0x1e/0x240
[  267.498618][ T5933]  nfsd_svc+0x189/0x780
[  267.498632][ T5933]  write_threads+0x3cd/0x5a0
[  267.498641][ T5933]  ? __might_fault+0xaf/0x130
[  267.498652][ T5933]  ? __pfx_write_threads+0x10/0x10
[  267.498668][ T5933]  ? _copy_from_user+0x94/0xb0
[  267.498679][ T5933]  ? simple_transaction_get+0x12d/0x160
[  267.498690][ T5933]  nfsctl_transaction_write+0x10f/0x160
[  267.498700][ T5933]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  267.498709][ T5933]  vfs_write+0x296/0xba0
[  267.498723][ T5933]  ? __pfx_vfs_write+0x10/0x10
[  267.498733][ T5933]  ? lockdep_hardirqs_on+0x7a/0x110
[  267.498748][ T5933]  ? fput_close_sync+0x11f/0x240
[  267.498760][ T5933]  ksys_write+0x150/0x270
[  267.498772][ T5933]  ? __pfx_ksys_write+0x10/0x10
[  267.498786][ T5933]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  267.498795][ T5933]  do_syscall_64+0x174/0x580
[  267.498805][ T5933]  ? trace_irq_disable+0x3b/0x140
[  267.498814][ T5933]  ? clear_bhb_loop+0x70/0xc0
[  267.498825][ T5933]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  267.498833][ T5933] RIP: 0033:0x7f67c8dd3df7
[  267.498842][ T5933] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  267.498850][ T5933] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  267.498860][ T5933] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  267.498867][ T5933] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  267.498872][ T5933] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  267.498877][ T5933] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  267.498882][ T5933] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c7dc
[  267.498895][ T5933]  </TASK>
[  267.498937][ T5933] xs_local_setup_socket: unhandled error (12) connecting to @/run/rpcbind.sock
[  267.641880][ T5933] FAULT_INJECTION: forcing a failure.
[  267.641880][ T5933] name failslab, interval 1, probability 5, space 0, times -1
[  267.645703][ T5933] CPU: 0 UID: 0 PID: 5933 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  267.645715][ T5933] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  267.645721][ T5933] Call Trace:
[  267.645726][ T5933]  <TASK>
[  267.645730][ T5933]  dump_stack_lvl+0xe8/0x150
[  267.645748][ T5933]  should_fail_ex+0x40c/0x560
[  267.645765][ T5933]  should_failslab+0xa8/0x100
[  267.645777][ T5933]  __kmalloc_cache_noprof+0xa8/0x660
[  267.645792][ T5933]  ? rpc_new_client+0x153/0xc50
[  267.645803][ T5933]  ? rpc_new_client+0x153/0xc50
[  267.645815][ T5933]  rpc_new_client+0x153/0xc50
[  267.645825][ T5933]  ? xprt_switch_alloc+0x420/0x590
[  267.645838][ T5933]  rpc_create_xprt+0x29f/0xa90
[  267.645847][ T5933]  ? __pfx_rpc_create_xprt+0x10/0x10
[  267.645865][ T5933]  ? rcu_is_watching+0x15/0xb0
[  267.645876][ T5933]  ? trace_kmalloc+0x2a/0xf0
[  267.645889][ T5933]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  267.645901][ T5933]  ? uvc_ctrl_status_event+0x2a8/0x390
[  267.645912][ T5933]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  267.645924][ T5933]  ? xprt_create_transport+0x39b/0x5f0
[  267.645933][ T5933]  ? xprt_create_transport+0x39b/0x5f0
[  267.645943][ T5933]  ? kstrdup+0x81/0x100
[  267.645957][ T5933]  ? __asan_memcpy+0x40/0x70
[  267.645971][ T5933]  ? xprt_create_transport+0x438/0x5f0
[  267.645982][ T5933]  rpc_create+0x649/0x900
[  267.645996][ T5933]  ? __pfx_rpc_create+0x10/0x10
[  267.646023][ T5933]  ? __lock_acquire+0x683/0x2cf0
[  267.646037][ T5933]  rpcb_create_af_local+0x1c7/0x3c0
[  267.646046][ T5933]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  267.646064][ T5933]  ? do_raw_spin_unlock+0xf5/0x210
[  267.646078][ T5933]  rpcb_create_local+0x28f/0x670
[  267.646087][ T5933]  ? __pfx_rpcb_create_local+0x10/0x10
[  267.646095][ T5933]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  267.646106][ T5933]  ? lockdep_hardirqs_on+0x7a/0x110
[  267.646116][ T5933]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  267.646126][ T5933]  ? __percpu_counter_init_many+0x35f/0x380
[  267.646140][ T5933]  ? __svc_create+0x88f/0x990
[  267.646154][ T5933]  svc_bind+0x1b4/0x230
[  267.646164][ T5933]  nfsd_create_serv+0x581/0x840
[  267.646178][ T5933]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  267.646187][ T5933]  ? lockdep_hardirqs_on+0x7a/0x110
[  267.646219][ T5933]  ? __pfx_nfsd_create_serv+0x10/0x10
[  267.646233][ T5933]  ? net_generic+0x1e/0x240
[  267.646244][ T5933]  ? net_generic+0x1e/0x240
[  267.646258][ T5933]  ? net_generic+0x1e/0x240
[  267.646272][ T5933]  nfsd_svc+0x189/0x780
[  267.646286][ T5933]  write_threads+0x3cd/0x5a0
[  267.646295][ T5933]  ? __might_fault+0xaf/0x130
[  267.646306][ T5933]  ? __pfx_write_threads+0x10/0x10
[  267.646322][ T5933]  ? _copy_from_user+0x94/0xb0
[  267.646333][ T5933]  ? simple_transaction_get+0x12d/0x160
[  267.646344][ T5933]  nfsctl_transaction_write+0x10f/0x160
[  267.646353][ T5933]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  267.646362][ T5933]  vfs_write+0x296/0xba0
[  267.646377][ T5933]  ? __pfx_vfs_write+0x10/0x10
[  267.646391][ T5933]  ? lockdep_hardirqs_on+0x7a/0x110
[  267.646406][ T5933]  ? fput_close_sync+0x11f/0x240
[  267.646418][ T5933]  ksys_write+0x150/0x270
[  267.646430][ T5933]  ? __pfx_ksys_write+0x10/0x10
[  267.646444][ T5933]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  267.646453][ T5933]  do_syscall_64+0x174/0x580
[  267.646463][ T5933]  ? trace_irq_disable+0x3b/0x140
[  267.646472][ T5933]  ? clear_bhb_loop+0x70/0xc0
[  267.646483][ T5933]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  267.646491][ T5933] RIP: 0033:0x7f67c8dd3df7
[  267.646502][ T5933] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  267.646509][ T5933] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  267.646520][ T5933] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  267.646527][ T5933] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  267.646532][ T5933] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  267.646537][ T5933] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  267.646543][ T5933] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c7dc
[  267.646555][ T5933]  </TASK>
[  267.646588][ T5933] FAULT_INJECTION: forcing a failure.
[  267.646588][ T5933] name failslab, interval 1, probability 5, space 0, times -1
[  267.772659][ T5933] CPU: 0 UID: 0 PID: 5933 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  267.772672][ T5933] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  267.772679][ T5933] Call Trace:
[  267.772685][ T5933]  <TASK>
[  267.772690][ T5933]  dump_stack_lvl+0xe8/0x150
[  267.772707][ T5933]  should_fail_ex+0x40c/0x560
[  267.772724][ T5933]  should_failslab+0xa8/0x100
[  267.772735][ T5933]  kmem_cache_alloc_node_noprof+0xb3/0x610
[  267.772748][ T5933]  ? local_lock_release+0x9c/0x160
[  267.772762][ T5933]  ? __alloc_skb+0x1d7/0x7a0
[  267.772773][ T5933]  ? __alloc_skb+0x1d7/0x7a0
[  267.772787][ T5933]  __alloc_skb+0x1d7/0x7a0
[  267.772802][ T5933]  alloc_uevent_skb+0x7d/0x230
[  267.772814][ T5933]  kobject_uevent_net_broadcast+0x184/0x560
[  267.772825][ T5933]  kobject_uevent_env+0x566/0x9e0
[  267.772837][ T5933]  rpc_sysfs_xprt_switch_destroy+0x51/0x90
[  267.772852][ T5933]  xprt_switch_put+0x33d/0x3c0
[  267.772871][ T5933]  rpc_new_client+0x844/0xc50
[  267.772882][ T5933]  ? xprt_switch_alloc+0x420/0x590
[  267.772894][ T5933]  rpc_create_xprt+0x29f/0xa90
[  267.772903][ T5933]  ? __pfx_rpc_create_xprt+0x10/0x10
[  267.772920][ T5933]  ? rcu_is_watching+0x15/0xb0
[  267.772931][ T5933]  ? trace_kmalloc+0x2a/0xf0
[  267.772947][ T5933]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  267.772959][ T5933]  ? uvc_ctrl_status_event+0x2a8/0x390
[  267.772969][ T5933]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  267.772981][ T5933]  ? xprt_create_transport+0x39b/0x5f0
[  267.772990][ T5933]  ? xprt_create_transport+0x39b/0x5f0
[  267.772999][ T5933]  ? kstrdup+0x81/0x100
[  267.773012][ T5933]  ? __asan_memcpy+0x40/0x70
[  267.773027][ T5933]  ? xprt_create_transport+0x438/0x5f0
[  267.773037][ T5933]  rpc_create+0x649/0x900
[  267.773051][ T5933]  ? __pfx_rpc_create+0x10/0x10
[  267.773078][ T5933]  ? __lock_acquire+0x683/0x2cf0
[  267.773092][ T5933]  rpcb_create_af_local+0x1c7/0x3c0
[  267.773101][ T5933]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  267.773119][ T5933]  ? do_raw_spin_unlock+0xf5/0x210
[  267.773132][ T5933]  rpcb_create_local+0x28f/0x670
[  267.773142][ T5933]  ? __pfx_rpcb_create_local+0x10/0x10
[  267.773150][ T5933]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  267.773161][ T5933]  ? lockdep_hardirqs_on+0x7a/0x110
[  267.773171][ T5933]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  267.773180][ T5933]  ? __percpu_counter_init_many+0x35f/0x380
[  267.773218][ T5933]  ? __svc_create+0x88f/0x990
[  267.773231][ T5933]  svc_bind+0x1b4/0x230
[  267.773242][ T5933]  nfsd_create_serv+0x581/0x840
[  267.773255][ T5933]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  267.773265][ T5933]  ? lockdep_hardirqs_on+0x7a/0x110
[  267.773277][ T5933]  ? __pfx_nfsd_create_serv+0x10/0x10
[  267.773289][ T5933]  ? net_generic+0x1e/0x240
[  267.773301][ T5933]  ? net_generic+0x1e/0x240
[  267.773314][ T5933]  ? net_generic+0x1e/0x240
[  267.773329][ T5933]  nfsd_svc+0x189/0x780
[  267.773343][ T5933]  write_threads+0x3cd/0x5a0
[  267.773351][ T5933]  ? __might_fault+0xaf/0x130
[  267.773363][ T5933]  ? __pfx_write_threads+0x10/0x10
[  267.773379][ T5933]  ? _copy_from_user+0x94/0xb0
[  267.773390][ T5933]  ? simple_transaction_get+0x12d/0x160
[  267.773401][ T5933]  nfsctl_transaction_write+0x10f/0x160
[  267.773411][ T5933]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  267.773420][ T5933]  vfs_write+0x296/0xba0
[  267.773435][ T5933]  ? __pfx_vfs_write+0x10/0x10
[  267.773444][ T5933]  ? lockdep_hardirqs_on+0x7a/0x110
[  267.773459][ T5933]  ? fput_close_sync+0x11f/0x240
[  267.773472][ T5933]  ksys_write+0x150/0x270
[  267.773484][ T5933]  ? __pfx_ksys_write+0x10/0x10
[  267.773498][ T5933]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  267.773507][ T5933]  do_syscall_64+0x174/0x580
[  267.773518][ T5933]  ? trace_irq_disable+0x3b/0x140
[  267.773527][ T5933]  ? clear_bhb_loop+0x70/0xc0
[  267.773537][ T5933]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  267.773546][ T5933] RIP: 0033:0x7f67c8dd3df7
[  267.773556][ T5933] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  267.773563][ T5933] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  267.773573][ T5933] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  267.773579][ T5933] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  267.773585][ T5933] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  267.773590][ T5933] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  267.773595][ T5933] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c7dc
[  267.773608][ T5933]  </TASK>
[  267.774781][ T5933] FAULT_INJECTION: forcing a failure.
[  267.774781][ T5933] name failslab, interval 1, probability 5, space 0, times -1
[  267.911746][ T5933] CPU: 0 UID: 0 PID: 5933 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  267.911760][ T5933] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  267.911766][ T5933] Call Trace:
[  267.911771][ T5933]  <TASK>
[  267.911776][ T5933]  dump_stack_lvl+0xe8/0x150
[  267.911793][ T5933]  should_fail_ex+0x40c/0x560
[  267.911810][ T5933]  should_failslab+0xa8/0x100
[  267.911822][ T5933]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  267.911834][ T5933]  ? kstrdup+0x81/0x100
[  267.911852][ T5933]  ? __kernfs_new_node+0xe6/0x980
[  267.911863][ T5933]  ? __kernfs_new_node+0xe6/0x980
[  267.911877][ T5933]  __kernfs_new_node+0xe6/0x980
[  267.911893][ T5933]  ? __pfx___kernfs_new_node+0x10/0x10
[  267.911904][ T5933]  ? kernfs_root+0x1c/0x230
[  267.911918][ T5933]  ? kernfs_root+0x1c/0x230
[  267.911928][ T5933]  ? kernfs_root+0x1c/0x230
[  267.911937][ T5933]  ? kernfs_root+0x1c/0x230
[  267.911950][ T5933]  kernfs_create_dir_ns+0xfe/0x230
[  267.911964][ T5933]  sysfs_create_dir_ns+0x12f/0x2a0
[  267.911977][ T5933]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  267.911989][ T5933]  ? do_raw_spin_unlock+0xf5/0x210
[  267.912003][ T5933]  kobject_add_internal+0x622/0xcd0
[  267.912020][ T5933]  kobject_init_and_add+0x12b/0x1a0
[  267.912036][ T5933]  ? __pfx_kobject_init_and_add+0x10/0x10
[  267.912049][ T5933]  ? __kmalloc_cache_noprof+0x150/0x660
[  267.912061][ T5933]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  267.912073][ T5933]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  267.912088][ T5933]  rpc_sysfs_xprt_switch_setup+0x169/0x2b0
[  267.912102][ T5933]  xprt_switch_alloc+0x238/0x590
[  267.912114][ T5933]  rpc_create_xprt+0x1c7/0xa90
[  267.912124][ T5933]  ? __pfx_rpc_create_xprt+0x10/0x10
[  267.912142][ T5933]  ? rcu_is_watching+0x15/0xb0
[  267.912152][ T5933]  ? trace_kmalloc+0x2a/0xf0
[  267.912166][ T5933]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  267.912199][ T5933]  ? uvc_ctrl_status_event+0x2a8/0x390
[  267.912210][ T5933]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  267.912223][ T5933]  ? xprt_create_transport+0x39b/0x5f0
[  267.912232][ T5933]  ? xprt_create_transport+0x39b/0x5f0
[  267.912241][ T5933]  ? kstrdup+0x81/0x100
[  267.912253][ T5933]  ? __asan_memcpy+0x40/0x70
[  267.912268][ T5933]  ? xprt_create_transport+0x438/0x5f0
[  267.912279][ T5933]  rpc_create+0x649/0x900
[  267.912293][ T5933]  ? __pfx_rpc_create+0x10/0x10
[  267.912327][ T5933]  rpcb_create_local+0x3ab/0x670
[  267.912337][ T5933]  ? __pfx_rpcb_create_local+0x10/0x10
[  267.912352][ T5933]  ? __svc_create+0x88f/0x990
[  267.912365][ T5933]  svc_bind+0x1b4/0x230
[  267.912376][ T5933]  nfsd_create_serv+0x581/0x840
[  267.912389][ T5933]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  267.912398][ T5933]  ? lockdep_hardirqs_on+0x7a/0x110
[  267.912411][ T5933]  ? __pfx_nfsd_create_serv+0x10/0x10
[  267.912423][ T5933]  ? net_generic+0x1e/0x240
[  267.912435][ T5933]  ? net_generic+0x1e/0x240
[  267.912448][ T5933]  ? net_generic+0x1e/0x240
[  267.912463][ T5933]  nfsd_svc+0x189/0x780
[  267.912477][ T5933]  write_threads+0x3cd/0x5a0
[  267.912485][ T5933]  ? __might_fault+0xaf/0x130
[  267.912497][ T5933]  ? __pfx_write_threads+0x10/0x10
[  267.912513][ T5933]  ? _copy_from_user+0x94/0xb0
[  267.912524][ T5933]  ? simple_transaction_get+0x12d/0x160
[  267.912535][ T5933]  nfsctl_transaction_write+0x10f/0x160
[  267.912544][ T5933]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  267.912553][ T5933]  vfs_write+0x296/0xba0
[  267.912568][ T5933]  ? __pfx_vfs_write+0x10/0x10
[  267.912577][ T5933]  ? lockdep_hardirqs_on+0x7a/0x110
[  267.912592][ T5933]  ? fput_close_sync+0x11f/0x240
[  267.912604][ T5933]  ksys_write+0x150/0x270
[  267.912616][ T5933]  ? __pfx_ksys_write+0x10/0x10
[  267.912630][ T5933]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  267.912639][ T5933]  do_syscall_64+0x174/0x580
[  267.912650][ T5933]  ? trace_irq_disable+0x3b/0x140
[  267.912659][ T5933]  ? clear_bhb_loop+0x70/0xc0
[  267.912669][ T5933]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  267.912678][ T5933] RIP: 0033:0x7f67c8dd3df7
[  267.912688][ T5933] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  267.912696][ T5933] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  267.912706][ T5933] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  267.912712][ T5933] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  267.912718][ T5933] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  267.912723][ T5933] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  267.912728][ T5933] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c7dc
[  267.912741][ T5933]  </TASK>
[  267.912760][ T5933] kobject: kobject_add_internal failed for switch-55 (error: -12 parent: xprt-switches)
[  268.063968][ T5933] FAULT_INJECTION: forcing a failure.
[  268.063968][ T5933] name failslab, interval 1, probability 5, space 0, times -1
[  268.067888][ T5933] CPU: 0 UID: 0 PID: 5933 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  268.067900][ T5933] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  268.067906][ T5933] Call Trace:
[  268.067910][ T5933]  <TASK>
[  268.067915][ T5933]  dump_stack_lvl+0xe8/0x150
[  268.067931][ T5933]  should_fail_ex+0x40c/0x560
[  268.067948][ T5933]  should_failslab+0xa8/0x100
[  268.067965][ T5933]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  268.067979][ T5933]  ? __kernfs_new_node+0xe6/0x980
[  268.067990][ T5933]  ? __kernfs_new_node+0xe6/0x980
[  268.068004][ T5933]  __kernfs_new_node+0xe6/0x980
[  268.068020][ T5933]  ? __pfx___kernfs_new_node+0x10/0x10
[  268.068031][ T5933]  ? kernfs_root+0x1c/0x230
[  268.068045][ T5933]  ? kernfs_root+0x1c/0x230
[  268.068055][ T5933]  ? kernfs_root+0x1c/0x230
[  268.068064][ T5933]  ? kernfs_root+0x1c/0x230
[  268.068076][ T5933]  kernfs_new_node+0xea/0x140
[  268.068090][ T5933]  __kernfs_create_file+0x4b/0x2e0
[  268.068100][ T5933]  sysfs_add_file_mode_ns+0x237/0x300
[  268.068113][ T5933]  internal_create_group+0x679/0x1180
[  268.068128][ T5933]  ? kernfs_create_dir_ns+0x1d5/0x230
[  268.068142][ T5933]  ? __pfx_internal_create_group+0x10/0x10
[  268.068172][ T5933]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  268.068185][ T5933]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  268.068198][ T5933]  sysfs_create_groups+0x59/0x120
[  268.068210][ T5933]  kobject_add_internal+0x669/0xcd0
[  268.068228][ T5933]  kobject_init_and_add+0x12b/0x1a0
[  268.068243][ T5933]  ? __pfx_kobject_init_and_add+0x10/0x10
[  268.068257][ T5933]  ? kernfs_remove_by_name_ns+0x101/0x140
[  268.068272][ T5933]  ? kernfs_remove_by_name_ns+0x101/0x140
[  268.068286][ T5933]  sysfs_slab_add+0x7b/0x260
[  268.068296][ T5933]  do_kmem_cache_create+0x8bf/0x970
[  268.068308][ T5933]  __kmem_cache_create_args+0x307/0x440
[  268.068321][ T5933]  nfsd_file_cache_init+0x197/0x530
[  268.068338][ T5933]  ? __pfx_nfsd_file_cache_init+0x10/0x10
[  268.068348][ T5933]  ? net_generic+0x1e/0x240
[  268.068364][ T5933]  ? net_generic+0x1e/0x240
[  268.068375][ T5933]  ? net_generic+0x1e/0x240
[  268.068385][ T5933]  ? net_generic+0x1e/0x240
[  268.068396][ T5933]  ? net_generic+0x1f4/0x240
[  268.068408][ T5933]  nfsd_svc+0x315/0x780
[  268.068422][ T5933]  write_threads+0x3cd/0x5a0
[  268.068430][ T5933]  ? __might_fault+0xaf/0x130
[  268.068442][ T5933]  ? __pfx_write_threads+0x10/0x10
[  268.068459][ T5933]  ? _copy_from_user+0x94/0xb0
[  268.068470][ T5933]  ? simple_transaction_get+0x12d/0x160
[  268.068481][ T5933]  nfsctl_transaction_write+0x10f/0x160
[  268.068490][ T5933]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  268.068499][ T5933]  vfs_write+0x296/0xba0
[  268.068514][ T5933]  ? __pfx_vfs_write+0x10/0x10
[  268.068524][ T5933]  ? lockdep_hardirqs_on+0x7a/0x110
[  268.068539][ T5933]  ? fput_close_sync+0x11f/0x240
[  268.068551][ T5933]  ksys_write+0x150/0x270
[  268.068563][ T5933]  ? __pfx_ksys_write+0x10/0x10
[  268.068577][ T5933]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  268.068586][ T5933]  do_syscall_64+0x174/0x580
[  268.068597][ T5933]  ? trace_irq_disable+0x3b/0x140
[  268.068606][ T5933]  ? clear_bhb_loop+0x70/0xc0
[  268.068616][ T5933]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  268.068625][ T5933] RIP: 0033:0x7f67c8dd3df7
[  268.068635][ T5933] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  268.068642][ T5933] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  268.068652][ T5933] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  268.068659][ T5933] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  268.068664][ T5933] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  268.068669][ T5933] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  268.068675][ T5933] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c7dc
[  268.068688][ T5933]  </TASK>
[  268.068799][ T5933] kobject: kobject_add_internal failed for nfsd_file (error: -12 parent: slab)
[  268.186128][ T5933] SLUB: Unable to add cache nfsd_file to sysfs
[  268.188755][ T5933] NFSD: Failed to start, no listeners configured.
[  268.357354][ T5933] FAULT_INJECTION: forcing a failure.
[  268.357354][ T5933] name failslab, interval 1, probability 5, space 0, times -1
[  268.357794][ T6049] FAULT_INJECTION: forcing a failure.
[  268.357794][ T6049] name failslab, interval 1, probability 5, space 0, times -1
[  268.361962][ T5933] CPU: 1 UID: 0 PID: 5933 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  268.361974][ T5933] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  268.361981][ T5933] Call Trace:
[  268.361986][ T5933]  <TASK>
[  268.361990][ T5933]  dump_stack_lvl+0xe8/0x150
[  268.362007][ T5933]  should_fail_ex+0x40c/0x560
[  268.362023][ T5933]  should_failslab+0xa8/0x100
[  268.362035][ T5933]  __kmalloc_cache_noprof+0xa8/0x660
[  268.362049][ T5933]  ? __pfx_vma_policy_mof+0x10/0x10
[  268.362065][ T5933]  ? task_numa_work+0x9be/0x15b0
[  268.362083][ T5933]  ? task_numa_work+0x9be/0x15b0
[  268.362118][ T5933]  task_numa_work+0x9be/0x15b0
[  268.362185][ T5933]  ? __pfx_task_numa_work+0x10/0x10
[  268.362208][ T5933]  ? _raw_spin_unlock_irq+0x23/0x50
[  268.362220][ T5933]  task_work_run+0x1d9/0x270
[  268.362237][ T5933]  ? __pfx_task_work_run+0x10/0x10
[  268.362250][ T5933]  ? ksys_write+0x1fc/0x270
[  268.362276][ T5933]  exit_to_user_mode_loop+0x1fa/0x730
[  268.362299][ T5933]  ? rcu_is_watching+0x15/0xb0
[  268.362317][ T5933]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  268.362334][ T5933]  do_syscall_64+0x353/0x580
[  268.362352][ T5933]  ? trace_irq_disable+0x3b/0x140
[  268.362367][ T5933]  ? clear_bhb_loop+0x70/0xc0
[  268.362386][ T5933]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  268.362401][ T5933] RIP: 0033:0x7f67c8dd3df7
[  268.362416][ T5933] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  268.362430][ T5933] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  268.362447][ T5933] RAX: fffffffffffffffb RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  268.362458][ T5933] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  268.362468][ T5933] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  268.362477][ T5933] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  268.362488][ T5933] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c7dc
[  268.362516][ T5933]  </TASK>
[  268.429844][ T6049] CPU: 0 UID: 0 PID: 6049 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  268.429858][ T6049] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  268.429864][ T6049] Call Trace:
[  268.429868][ T6049]  <TASK>
[  268.429872][ T6049]  dump_stack_lvl+0xe8/0x150
[  268.429891][ T6049]  should_fail_ex+0x40c/0x560
[  268.429908][ T6049]  should_failslab+0xa8/0x100
[  268.429919][ T6049]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  268.429933][ T6049]  ? __kernfs_new_node+0xe6/0x980
[  268.429945][ T6049]  ? __kernfs_new_node+0xe6/0x980
[  268.429959][ T6049]  __kernfs_new_node+0xe6/0x980
[  268.429974][ T6049]  ? __pfx___kernfs_new_node+0x10/0x10
[  268.429985][ T6049]  ? kernfs_root+0x1c/0x230
[  268.429999][ T6049]  ? kernfs_root+0x1c/0x230
[  268.430009][ T6049]  ? kernfs_root+0x1c/0x230
[  268.430019][ T6049]  ? kernfs_root+0x1c/0x230
[  268.430031][ T6049]  kernfs_new_node+0xea/0x140
[  268.430044][ T6049]  __kernfs_create_file+0x4b/0x2e0
[  268.430054][ T6049]  sysfs_add_file_mode_ns+0x237/0x300
[  268.430067][ T6049]  internal_create_group+0x679/0x1180
[  268.430082][ T6049]  ? kernfs_create_dir_ns+0x1d5/0x230
[  268.430096][ T6049]  ? __pfx_internal_create_group+0x10/0x10
[  268.430106][ T6049]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  268.430135][ T6049]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  268.430149][ T6049]  sysfs_create_groups+0x59/0x120
[  268.430161][ T6049]  kobject_add_internal+0x669/0xcd0
[  268.430178][ T6049]  kobject_init_and_add+0x12b/0x1a0
[  268.430194][ T6049]  ? __pfx_kobject_init_and_add+0x10/0x10
[  268.430207][ T6049]  ? __kmalloc_cache_noprof+0x150/0x660
[  268.430220][ T6049]  ? rpc_sysfs_xprt_setup+0xa7/0x260
[  268.430232][ T6049]  ? rpc_sysfs_xprt_setup+0xa7/0x260
[  268.430246][ T6049]  rpc_sysfs_xprt_setup+0x132/0x260
[  268.430260][ T6049]  xprt_switch_alloc+0x420/0x590
[  268.430273][ T6049]  rpc_create_xprt+0x1c7/0xa90
[  268.430283][ T6049]  ? __pfx_rpc_create_xprt+0x10/0x10
[  268.430310][ T6049]  ? rcu_is_watching+0x15/0xb0
[  268.430321][ T6049]  ? trace_kmalloc+0x2a/0xf0
[  268.430334][ T6049]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  268.430347][ T6049]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  268.430359][ T6049]  ? xprt_create_transport+0x39b/0x5f0
[  268.430368][ T6049]  ? xprt_create_transport+0x39b/0x5f0
[  268.430377][ T6049]  ? kstrdup+0x81/0x100
[  268.430391][ T6049]  ? __asan_memcpy+0x40/0x70
[  268.430406][ T6049]  ? xprt_create_transport+0x438/0x5f0
[  268.430416][ T6049]  rpc_create+0x649/0x900
[  268.430431][ T6049]  ? __pfx_rpc_create+0x10/0x10
[  268.430458][ T6049]  ? __lock_acquire+0x683/0x2cf0
[  268.430472][ T6049]  rpcb_create_af_local+0x1c7/0x3c0
[  268.430481][ T6049]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  268.430499][ T6049]  ? do_raw_spin_unlock+0xf5/0x210
[  268.430512][ T6049]  rpcb_create_local+0x268/0x670
[  268.430522][ T6049]  ? __pfx_rpcb_create_local+0x10/0x10
[  268.430530][ T6049]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  268.430540][ T6049]  ? lockdep_hardirqs_on+0x7a/0x110
[  268.430551][ T6049]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  268.430560][ T6049]  ? __percpu_counter_init_many+0x35f/0x380
[  268.430575][ T6049]  ? __svc_create+0x88f/0x990
[  268.430588][ T6049]  svc_bind+0x1b4/0x230
[  268.430599][ T6049]  nfsd_create_serv+0x581/0x840
[  268.430612][ T6049]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  268.430622][ T6049]  ? lockdep_hardirqs_on+0x7a/0x110
[  268.430634][ T6049]  ? __pfx_nfsd_create_serv+0x10/0x10
[  268.430646][ T6049]  ? net_generic+0x1e/0x240
[  268.430657][ T6049]  ? net_generic+0x1e/0x240
[  268.430671][ T6049]  ? net_generic+0x1e/0x240
[  268.430685][ T6049]  nfsd_svc+0x189/0x780
[  268.430699][ T6049]  write_threads+0x3cd/0x5a0
[  268.430708][ T6049]  ? __might_fault+0xaf/0x130
[  268.430720][ T6049]  ? __pfx_write_threads+0x10/0x10
[  268.430736][ T6049]  ? _copy_from_user+0x94/0xb0
[  268.430746][ T6049]  ? simple_transaction_get+0x12d/0x160
[  268.430757][ T6049]  nfsctl_transaction_write+0x10f/0x160
[  268.430767][ T6049]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  268.430776][ T6049]  vfs_write+0x296/0xba0
[  268.430791][ T6049]  ? __pfx_vfs_write+0x10/0x10
[  268.430801][ T6049]  ? lockdep_hardirqs_on+0x7a/0x110
[  268.430816][ T6049]  ? fput_close_sync+0x11f/0x240
[  268.430828][ T6049]  ksys_write+0x150/0x270
[  268.430840][ T6049]  ? __pfx_ksys_write+0x10/0x10
[  268.430853][ T6049]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  268.430863][ T6049]  do_syscall_64+0x174/0x580
[  268.430873][ T6049]  ? trace_irq_disable+0x3b/0x140
[  268.430882][ T6049]  ? clear_bhb_loop+0x70/0xc0
[  268.430892][ T6049]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  268.430901][ T6049] RIP: 0033:0x7f67c8dd3df7
[  268.430911][ T6049] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  268.430919][ T6049] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  268.430929][ T6049] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  268.430935][ T6049] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  268.430941][ T6049] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  268.430946][ T6049] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  268.430951][ T6049] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c9a8
[  268.430964][ T6049]  </TASK>
[  268.431089][ T6049] kobject: kobject_add_internal failed for xprt-56-local (error: -12 parent: switch-55)
[  268.592546][ T6049] FAULT_INJECTION: forcing a failure.
[  268.592546][ T6049] name failslab, interval 1, probability 5, space 0, times -1
[  268.596459][ T6049] CPU: 0 UID: 0 PID: 6049 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  268.596472][ T6049] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  268.596478][ T6049] Call Trace:
[  268.596483][ T6049]  <TASK>
[  268.596487][ T6049]  dump_stack_lvl+0xe8/0x150
[  268.596508][ T6049]  should_fail_ex+0x40c/0x560
[  268.596535][ T6049]  should_failslab+0xa8/0x100
[  268.596555][ T6049]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  268.596577][ T6049]  ? security_file_alloc+0x34/0x310
[  268.596594][ T6049]  ? security_file_alloc+0x34/0x310
[  268.596611][ T6049]  security_file_alloc+0x34/0x310
[  268.596622][ T6049]  init_file+0x90/0x2b0
[  268.596632][ T6049]  alloc_empty_file+0x74/0x1d0
[  268.596641][ T6049]  alloc_file_pseudo+0x115/0x1e0
[  268.596651][ T6049]  ? __pfx_alloc_file_pseudo+0x10/0x10
[  268.596660][ T6049]  ? __raw_spin_lock_init+0x45/0x100
[  268.596675][ T6049]  sock_alloc_file+0xb8/0x2e0
[  268.596687][ T6049]  xs_local_connect+0x179/0x810
[  268.596700][ T6049]  ? __pfx_xs_local_connect+0x10/0x10
[  268.596712][ T6049]  ? do_raw_spin_unlock+0xf5/0x210
[  268.596725][ T6049]  xprt_connect+0x613/0x850
[  268.596738][ T6049]  ? __pfx_call_connect+0x10/0x10
[  268.596750][ T6049]  __rpc_execute+0x526/0x1280
[  268.596769][ T6049]  ? __pfx___rpc_execute+0x10/0x10
[  268.596784][ T6049]  ? rpc_task_get_xprt+0x26/0x250
[  268.596794][ T6049]  ? rpc_make_runnable+0xae/0x1c0
[  268.596807][ T6049]  rpc_execute+0x1c1/0x390
[  268.596820][ T6049]  rpc_run_task+0x4a6/0x660
[  268.596831][ T6049]  rpc_create_xprt+0x533/0xa90
[  268.596840][ T6049]  ? __pfx_rpc_create_xprt+0x10/0x10
[  268.596857][ T6049]  ? rcu_is_watching+0x15/0xb0
[  268.596868][ T6049]  ? trace_kmalloc+0x2a/0xf0
[  268.596882][ T6049]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  268.596894][ T6049]  ? xprt_create_transport+0x39b/0x5f0
[  268.596909][ T6049]  ? xprt_create_transport+0x438/0x5f0
[  268.596919][ T6049]  rpc_create+0x649/0x900
[  268.596933][ T6049]  ? __pfx_rpc_create+0x10/0x10
[  268.596960][ T6049]  ? __lock_acquire+0x683/0x2cf0
[  268.596974][ T6049]  rpcb_create_af_local+0x1c7/0x3c0
[  268.596985][ T6049]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  268.597017][ T6049]  ? do_raw_spin_unlock+0xf5/0x210
[  268.597032][ T6049]  rpcb_create_local+0x268/0x670
[  268.597042][ T6049]  ? __pfx_rpcb_create_local+0x10/0x10
[  268.597050][ T6049]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  268.597060][ T6049]  ? lockdep_hardirqs_on+0x7a/0x110
[  268.597071][ T6049]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  268.597081][ T6049]  ? __percpu_counter_init_many+0x35f/0x380
[  268.597095][ T6049]  ? __svc_create+0x88f/0x990
[  268.597147][ T6049]  svc_bind+0x1b4/0x230
[  268.597166][ T6049]  nfsd_create_serv+0x581/0x840
[  268.597180][ T6049]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  268.597190][ T6049]  ? lockdep_hardirqs_on+0x7a/0x110
[  268.597202][ T6049]  ? __pfx_nfsd_create_serv+0x10/0x10
[  268.597214][ T6049]  ? net_generic+0x1e/0x240
[  268.597225][ T6049]  ? net_generic+0x1e/0x240
[  268.597238][ T6049]  ? net_generic+0x1e/0x240
[  268.597253][ T6049]  nfsd_svc+0x189/0x780
[  268.597268][ T6049]  write_threads+0x3cd/0x5a0
[  268.597281][ T6049]  ? __might_fault+0xaf/0x130
[  268.597293][ T6049]  ? __pfx_write_threads+0x10/0x10
[  268.597309][ T6049]  ? _copy_from_user+0x94/0xb0
[  268.597320][ T6049]  ? simple_transaction_get+0x12d/0x160
[  268.597331][ T6049]  nfsctl_transaction_write+0x10f/0x160
[  268.597341][ T6049]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  268.597350][ T6049]  vfs_write+0x296/0xba0
[  268.597364][ T6049]  ? __pfx_vfs_write+0x10/0x10
[  268.597374][ T6049]  ? lockdep_hardirqs_on+0x7a/0x110
[  268.597389][ T6049]  ? fput_close_sync+0x11f/0x240
[  268.597401][ T6049]  ksys_write+0x150/0x270
[  268.597413][ T6049]  ? __pfx_ksys_write+0x10/0x10
[  268.597427][ T6049]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  268.597437][ T6049]  do_syscall_64+0x174/0x580
[  268.597448][ T6049]  ? trace_irq_disable+0x3b/0x140
[  268.597462][ T6049]  ? clear_bhb_loop+0x70/0xc0
[  268.597481][ T6049]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  268.597494][ T6049] RIP: 0033:0x7f67c8dd3df7
[  268.597505][ T6049] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  268.597512][ T6049] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  268.597522][ T6049] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  268.597529][ T6049] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  268.597534][ T6049] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  268.597542][ T6049] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  268.597552][ T6049] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c9a8
[  268.597577][ T6049]  </TASK>
[  268.598483][ T6049] FAULT_INJECTION: forcing a failure.
[  268.598483][ T6049] name failslab, interval 1, probability 5, space 0, times -1
[  268.743658][ T6049] CPU: 0 UID: 0 PID: 6049 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  268.743671][ T6049] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  268.743678][ T6049] Call Trace:
[  268.743683][ T6049]  <TASK>
[  268.743688][ T6049]  dump_stack_lvl+0xe8/0x150
[  268.743705][ T6049]  should_fail_ex+0x40c/0x560
[  268.743722][ T6049]  should_failslab+0xa8/0x100
[  268.743734][ T6049]  __kmalloc_cache_noprof+0xa8/0x660
[  268.743749][ T6049]  ? __pfx_kobject_init_and_add+0x10/0x10
[  268.743763][ T6049]  ? kobject_uevent_env+0x289/0x9e0
[  268.743770][ T6049]  ? kobject_uevent_env+0x289/0x9e0
[  268.743779][ T6049]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  268.743793][ T6049]  kobject_uevent_env+0x289/0x9e0
[  268.743802][ T6049]  ? rpc_sysfs_xprt_switch_setup+0x1c6/0x2b0
[  268.743816][ T6049]  xprt_switch_alloc+0x238/0x590
[  268.743829][ T6049]  rpc_create_xprt+0x1c7/0xa90
[  268.743839][ T6049]  ? __pfx_rpc_create_xprt+0x10/0x10
[  268.743856][ T6049]  ? rcu_is_watching+0x15/0xb0
[  268.743866][ T6049]  ? trace_kmalloc+0x2a/0xf0
[  268.743879][ T6049]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  268.743893][ T6049]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  268.743905][ T6049]  ? xprt_create_transport+0x39b/0x5f0
[  268.743914][ T6049]  ? xprt_create_transport+0x39b/0x5f0
[  268.743923][ T6049]  ? kstrdup+0x81/0x100
[  268.743937][ T6049]  ? __asan_memcpy+0x40/0x70
[  268.743952][ T6049]  ? xprt_create_transport+0x438/0x5f0
[  268.743962][ T6049]  rpc_create+0x649/0x900
[  268.743977][ T6049]  ? __pfx_rpc_create+0x10/0x10
[  268.744004][ T6049]  ? __lock_acquire+0x683/0x2cf0
[  268.744017][ T6049]  rpcb_create_af_local+0x1c7/0x3c0
[  268.744027][ T6049]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  268.744044][ T6049]  ? do_raw_spin_unlock+0xf5/0x210
[  268.744057][ T6049]  rpcb_create_local+0x28f/0x670
[  268.744067][ T6049]  ? __pfx_rpcb_create_local+0x10/0x10
[  268.744075][ T6049]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  268.744105][ T6049]  ? lockdep_hardirqs_on+0x7a/0x110
[  268.744116][ T6049]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  268.744125][ T6049]  ? __percpu_counter_init_many+0x35f/0x380
[  268.744140][ T6049]  ? __svc_create+0x88f/0x990
[  268.744153][ T6049]  svc_bind+0x1b4/0x230
[  268.744164][ T6049]  nfsd_create_serv+0x581/0x840
[  268.744177][ T6049]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  268.744187][ T6049]  ? lockdep_hardirqs_on+0x7a/0x110
[  268.744199][ T6049]  ? __pfx_nfsd_create_serv+0x10/0x10
[  268.744211][ T6049]  ? net_generic+0x1e/0x240
[  268.744223][ T6049]  ? net_generic+0x1e/0x240
[  268.744236][ T6049]  ? net_generic+0x1e/0x240
[  268.744250][ T6049]  nfsd_svc+0x189/0x780
[  268.744275][ T6049]  write_threads+0x3cd/0x5a0
[  268.744283][ T6049]  ? __might_fault+0xaf/0x130
[  268.744295][ T6049]  ? __pfx_write_threads+0x10/0x10
[  268.744311][ T6049]  ? _copy_from_user+0x94/0xb0
[  268.744323][ T6049]  ? simple_transaction_get+0x12d/0x160
[  268.744334][ T6049]  nfsctl_transaction_write+0x10f/0x160
[  268.744344][ T6049]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  268.744353][ T6049]  vfs_write+0x296/0xba0
[  268.744368][ T6049]  ? __pfx_vfs_write+0x10/0x10
[  268.744377][ T6049]  ? lockdep_hardirqs_on+0x7a/0x110
[  268.744392][ T6049]  ? fput_close_sync+0x11f/0x240
[  268.744404][ T6049]  ksys_write+0x150/0x270
[  268.744416][ T6049]  ? __pfx_ksys_write+0x10/0x10
[  268.744430][ T6049]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  268.744440][ T6049]  do_syscall_64+0x174/0x580
[  268.744451][ T6049]  ? trace_irq_disable+0x3b/0x140
[  268.744459][ T6049]  ? clear_bhb_loop+0x70/0xc0
[  268.744470][ T6049]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  268.744479][ T6049] RIP: 0033:0x7f67c8dd3df7
[  268.744489][ T6049] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  268.744497][ T6049] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  268.744507][ T6049] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  268.744513][ T6049] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  268.744519][ T6049] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  268.744524][ T6049] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  268.744530][ T6049] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c9a8
[  268.744542][ T6049]  </TASK>
[  268.745553][ T6049] FAULT_INJECTION: forcing a failure.
[  268.745553][ T6049] name failslab, interval 1, probability 5, space 0, times -1
[  268.876536][ T6049] CPU: 0 UID: 0 PID: 6049 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  268.876548][ T6049] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  268.876554][ T6049] Call Trace:
[  268.876559][ T6049]  <TASK>
[  268.876563][ T6049]  dump_stack_lvl+0xe8/0x150
[  268.876580][ T6049]  should_fail_ex+0x40c/0x560
[  268.876614][ T6049]  should_failslab+0xa8/0x100
[  268.876626][ T6049]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  268.876639][ T6049]  ? __kernfs_new_node+0xe6/0x980
[  268.876650][ T6049]  ? __kernfs_new_node+0xe6/0x980
[  268.876664][ T6049]  __kernfs_new_node+0xe6/0x980
[  268.876679][ T6049]  ? __pfx___kernfs_new_node+0x10/0x10
[  268.876691][ T6049]  ? kernfs_root+0x1c/0x230
[  268.876704][ T6049]  ? kernfs_root+0x1c/0x230
[  268.876714][ T6049]  ? kernfs_root+0x1c/0x230
[  268.876724][ T6049]  ? kernfs_root+0x1c/0x230
[  268.876736][ T6049]  kernfs_new_node+0xea/0x140
[  268.876750][ T6049]  __kernfs_create_file+0x4b/0x2e0
[  268.876764][ T6049]  sysfs_add_file_mode_ns+0x237/0x300
[  268.876777][ T6049]  internal_create_group+0x679/0x1180
[  268.876793][ T6049]  ? kernfs_create_dir_ns+0x1d5/0x230
[  268.876807][ T6049]  ? __pfx_internal_create_group+0x10/0x10
[  268.876817][ T6049]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  268.876828][ T6049]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  268.876841][ T6049]  sysfs_create_groups+0x59/0x120
[  268.876853][ T6049]  kobject_add_internal+0x669/0xcd0
[  268.876870][ T6049]  kobject_init_and_add+0x12b/0x1a0
[  268.876885][ T6049]  ? __pfx_kobject_init_and_add+0x10/0x10
[  268.876899][ T6049]  ? __kmalloc_cache_noprof+0x150/0x660
[  268.876911][ T6049]  ? rpc_sysfs_client_setup+0x106/0x310
[  268.876923][ T6049]  ? rpc_sysfs_client_setup+0x106/0x310
[  268.876937][ T6049]  rpc_sysfs_client_setup+0x191/0x310
[  268.876951][ T6049]  ? __pfx_rpc_sysfs_client_setup+0x10/0x10
[  268.876964][ T6049]  ? rpc_net_ns+0x1e/0x230
[  268.876973][ T6049]  ? rpc_net_ns+0x1e/0x230
[  268.876981][ T6049]  ? rpc_net_ns+0x1e/0x230
[  268.876992][ T6049]  rpc_new_client+0x716/0xc50
[  268.877006][ T6049]  rpc_create_xprt+0x29f/0xa90
[  268.877015][ T6049]  ? __pfx_rpc_create_xprt+0x10/0x10
[  268.877032][ T6049]  ? rcu_is_watching+0x15/0xb0
[  268.877043][ T6049]  ? trace_kmalloc+0x2a/0xf0
[  268.877055][ T6049]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  268.877089][ T6049]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  268.877102][ T6049]  ? xprt_create_transport+0x39b/0x5f0
[  268.877111][ T6049]  ? xprt_create_transport+0x39b/0x5f0
[  268.877120][ T6049]  ? kstrdup+0x81/0x100
[  268.877134][ T6049]  ? __asan_memcpy+0x40/0x70
[  268.877148][ T6049]  ? xprt_create_transport+0x438/0x5f0
[  268.877159][ T6049]  rpc_create+0x649/0x900
[  268.877173][ T6049]  ? __pfx_rpc_create+0x10/0x10
[  268.877201][ T6049]  ? __lock_acquire+0x683/0x2cf0
[  268.877214][ T6049]  rpcb_create_af_local+0x1c7/0x3c0
[  268.877223][ T6049]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  268.877241][ T6049]  ? do_raw_spin_unlock+0xf5/0x210
[  268.877260][ T6049]  rpcb_create_local+0x28f/0x670
[  268.877270][ T6049]  ? __pfx_rpcb_create_local+0x10/0x10
[  268.877278][ T6049]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  268.877288][ T6049]  ? lockdep_hardirqs_on+0x7a/0x110
[  268.877299][ T6049]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  268.877309][ T6049]  ? __percpu_counter_init_many+0x35f/0x380
[  268.877323][ T6049]  ? __svc_create+0x88f/0x990
[  268.877337][ T6049]  svc_bind+0x1b4/0x230
[  268.877348][ T6049]  nfsd_create_serv+0x581/0x840
[  268.877361][ T6049]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  268.877370][ T6049]  ? lockdep_hardirqs_on+0x7a/0x110
[  268.877383][ T6049]  ? __pfx_nfsd_create_serv+0x10/0x10
[  268.877395][ T6049]  ? net_generic+0x1e/0x240
[  268.877407][ T6049]  ? net_generic+0x1e/0x240
[  268.877420][ T6049]  ? net_generic+0x1e/0x240
[  268.877434][ T6049]  nfsd_svc+0x189/0x780
[  268.877449][ T6049]  write_threads+0x3cd/0x5a0
[  268.877457][ T6049]  ? __might_fault+0xaf/0x130
[  268.877469][ T6049]  ? __pfx_write_threads+0x10/0x10
[  268.877485][ T6049]  ? _copy_from_user+0x94/0xb0
[  268.877496][ T6049]  ? simple_transaction_get+0x12d/0x160
[  268.877507][ T6049]  nfsctl_transaction_write+0x10f/0x160
[  268.877517][ T6049]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  268.877526][ T6049]  vfs_write+0x296/0xba0
[  268.877541][ T6049]  ? __pfx_vfs_write+0x10/0x10
[  268.877550][ T6049]  ? lockdep_hardirqs_on+0x7a/0x110
[  268.877566][ T6049]  ? fput_close_sync+0x11f/0x240
[  268.877578][ T6049]  ksys_write+0x150/0x270
[  268.877590][ T6049]  ? __pfx_ksys_write+0x10/0x10
[  268.877604][ T6049]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  268.877613][ T6049]  do_syscall_64+0x174/0x580
[  268.877624][ T6049]  ? trace_irq_disable+0x3b/0x140
[  268.877633][ T6049]  ? clear_bhb_loop+0x70/0xc0
[  268.877643][ T6049]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  268.877651][ T6049] RIP: 0033:0x7f67c8dd3df7
[  268.877661][ T6049] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  268.877668][ T6049] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  268.877678][ T6049] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  268.877684][ T6049] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  268.877690][ T6049] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  268.877695][ T6049] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  268.877700][ T6049] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c9a8
[  268.877713][ T6049]  </TASK>
[  268.877825][ T6049] kobject: kobject_add_internal failed for clnt-55 (error: -12 parent: rpc-clients)
[  269.040296][ T6049] FAULT_INJECTION: forcing a failure.
[  269.040296][ T6049] name failslab, interval 1, probability 5, space 0, times -1
[  269.044150][ T6049] CPU: 0 UID: 0 PID: 6049 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  269.044162][ T6049] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  269.044168][ T6049] Call Trace:
[  269.044173][ T6049]  <TASK>
[  269.044177][ T6049]  dump_stack_lvl+0xe8/0x150
[  269.044193][ T6049]  should_fail_ex+0x40c/0x560
[  269.044210][ T6049]  should_failslab+0xa8/0x100
[  269.044221][ T6049]  __kmalloc_noprof+0xfe/0x720
[  269.044239][ T6049]  ? trace_kmem_cache_alloc+0x29/0xe0
[  269.044251][ T6049]  ? security_sk_alloc+0x52/0x360
[  269.044261][ T6049]  ? security_sk_alloc+0x52/0x360
[  269.044272][ T6049]  security_sk_alloc+0x52/0x360
[  269.044283][ T6049]  sk_prot_alloc+0x101/0x210
[  269.044299][ T6049]  sk_alloc+0x3a/0x390
[  269.044313][ T6049]  unix_create1+0xb0/0x7c0
[  269.044324][ T6049]  ? _raw_spin_unlock_irq+0x2e/0x50
[  269.044333][ T6049]  ? pidfs_register_pid_gfp+0x16a/0x1c0
[  269.044344][ T6049]  unix_stream_connect+0x387/0xfd0
[  269.044360][ T6049]  kernel_connect+0x141/0x1c0
[  269.044370][ T6049]  ? __pfx_kernel_connect+0x10/0x10
[  269.044386][ T6049]  ? __local_bh_enable_ip+0xd0/0x130
[  269.044400][ T6049]  xs_local_connect+0x626/0x810
[  269.044412][ T6049]  ? __pfx_xs_local_connect+0x10/0x10
[  269.044424][ T6049]  ? do_raw_spin_unlock+0xf5/0x210
[  269.044437][ T6049]  xprt_connect+0x613/0x850
[  269.044450][ T6049]  ? __pfx_call_connect+0x10/0x10
[  269.044462][ T6049]  __rpc_execute+0x526/0x1280
[  269.044482][ T6049]  ? __pfx___rpc_execute+0x10/0x10
[  269.044494][ T6049]  ? rpc_task_get_xprt+0x26/0x250
[  269.044505][ T6049]  ? rpc_make_runnable+0xae/0x1c0
[  269.044518][ T6049]  rpc_execute+0x1c1/0x390
[  269.044531][ T6049]  rpc_run_task+0x4a6/0x660
[  269.044541][ T6049]  rpc_create_xprt+0x533/0xa90
[  269.044551][ T6049]  ? __pfx_rpc_create_xprt+0x10/0x10
[  269.044567][ T6049]  ? rcu_is_watching+0x15/0xb0
[  269.044577][ T6049]  ? trace_kmalloc+0x2a/0xf0
[  269.044591][ T6049]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  269.044603][ T6049]  ? xprt_create_transport+0x39b/0x5f0
[  269.044618][ T6049]  ? xprt_create_transport+0x438/0x5f0
[  269.044628][ T6049]  rpc_create+0x649/0x900
[  269.044643][ T6049]  ? __pfx_rpc_create+0x10/0x10
[  269.044670][ T6049]  ? __lock_acquire+0x683/0x2cf0
[  269.044683][ T6049]  rpcb_create_af_local+0x1c7/0x3c0
[  269.044692][ T6049]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  269.044710][ T6049]  ? do_raw_spin_unlock+0xf5/0x210
[  269.044722][ T6049]  rpcb_create_local+0x28f/0x670
[  269.044732][ T6049]  ? __pfx_rpcb_create_local+0x10/0x10
[  269.044740][ T6049]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  269.044750][ T6049]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.044761][ T6049]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  269.044770][ T6049]  ? __percpu_counter_init_many+0x35f/0x380
[  269.044785][ T6049]  ? __svc_create+0x88f/0x990
[  269.044798][ T6049]  svc_bind+0x1b4/0x230
[  269.044809][ T6049]  nfsd_create_serv+0x581/0x840
[  269.044823][ T6049]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  269.044832][ T6049]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.044844][ T6049]  ? __pfx_nfsd_create_serv+0x10/0x10
[  269.044856][ T6049]  ? net_generic+0x1e/0x240
[  269.044868][ T6049]  ? net_generic+0x1e/0x240
[  269.044881][ T6049]  ? net_generic+0x1e/0x240
[  269.044896][ T6049]  nfsd_svc+0x189/0x780
[  269.044910][ T6049]  write_threads+0x3cd/0x5a0
[  269.044918][ T6049]  ? __might_fault+0xaf/0x130
[  269.044930][ T6049]  ? __pfx_write_threads+0x10/0x10
[  269.044946][ T6049]  ? _copy_from_user+0x94/0xb0
[  269.044957][ T6049]  ? simple_transaction_get+0x12d/0x160
[  269.044968][ T6049]  nfsctl_transaction_write+0x10f/0x160
[  269.044977][ T6049]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  269.044986][ T6049]  vfs_write+0x296/0xba0
[  269.045001][ T6049]  ? __pfx_vfs_write+0x10/0x10
[  269.045010][ T6049]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.045025][ T6049]  ? fput_close_sync+0x11f/0x240
[  269.045038][ T6049]  ksys_write+0x150/0x270
[  269.045068][ T6049]  ? __pfx_ksys_write+0x10/0x10
[  269.045084][ T6049]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  269.045094][ T6049]  do_syscall_64+0x174/0x580
[  269.045105][ T6049]  ? trace_irq_disable+0x3b/0x140
[  269.045114][ T6049]  ? clear_bhb_loop+0x70/0xc0
[  269.045124][ T6049]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  269.045133][ T6049] RIP: 0033:0x7f67c8dd3df7
[  269.045144][ T6049] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  269.045151][ T6049] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  269.045162][ T6049] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  269.045168][ T6049] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  269.045174][ T6049] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  269.045179][ T6049] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  269.045184][ T6049] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c9a8
[  269.045197][ T6049]  </TASK>
[  269.045216][ T6049] xs_local_setup_socket: unhandled error (12) connecting to /var/run/rpcbind.sock
[  269.194998][ T6049] FAULT_INJECTION: forcing a failure.
[  269.194998][ T6049] name failslab, interval 1, probability 5, space 0, times -1
[  269.198910][ T6049] CPU: 0 UID: 0 PID: 6049 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  269.198922][ T6049] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  269.198928][ T6049] Call Trace:
[  269.198932][ T6049]  <TASK>
[  269.198937][ T6049]  dump_stack_lvl+0xe8/0x150
[  269.198954][ T6049]  should_fail_ex+0x40c/0x560
[  269.198971][ T6049]  should_failslab+0xa8/0x100
[  269.198983][ T6049]  __kmalloc_node_track_caller_noprof+0x100/0x730
[  269.198998][ T6049]  ? xprt_create_transport+0x39b/0x5f0
[  269.199008][ T6049]  ? xprt_create_transport+0x39b/0x5f0
[  269.199020][ T6049]  kstrdup+0x42/0x100
[  269.199055][ T6049]  xprt_create_transport+0x39b/0x5f0
[  269.199067][ T6049]  rpc_create+0x4ff/0x900
[  269.199083][ T6049]  ? __pfx_rpc_create+0x10/0x10
[  269.199116][ T6049]  rpcb_create_local+0x3ab/0x670
[  269.199126][ T6049]  ? __pfx_rpcb_create_local+0x10/0x10
[  269.199141][ T6049]  ? __svc_create+0x88f/0x990
[  269.199154][ T6049]  svc_bind+0x1b4/0x230
[  269.199165][ T6049]  nfsd_create_serv+0x581/0x840
[  269.199178][ T6049]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  269.199193][ T6049]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.199206][ T6049]  ? __pfx_nfsd_create_serv+0x10/0x10
[  269.199219][ T6049]  ? net_generic+0x1e/0x240
[  269.199230][ T6049]  ? net_generic+0x1e/0x240
[  269.199243][ T6049]  ? net_generic+0x1e/0x240
[  269.199258][ T6049]  nfsd_svc+0x189/0x780
[  269.199272][ T6049]  write_threads+0x3cd/0x5a0
[  269.199280][ T6049]  ? __might_fault+0xaf/0x130
[  269.199292][ T6049]  ? __pfx_write_threads+0x10/0x10
[  269.199309][ T6049]  ? _copy_from_user+0x94/0xb0
[  269.199325][ T6049]  ? simple_transaction_get+0x12d/0x160
[  269.199342][ T6049]  nfsctl_transaction_write+0x10f/0x160
[  269.199358][ T6049]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  269.199371][ T6049]  vfs_write+0x296/0xba0
[  269.199394][ T6049]  ? __pfx_vfs_write+0x10/0x10
[  269.199405][ T6049]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.199420][ T6049]  ? fput_close_sync+0x11f/0x240
[  269.199432][ T6049]  ksys_write+0x150/0x270
[  269.199444][ T6049]  ? __pfx_ksys_write+0x10/0x10
[  269.199458][ T6049]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  269.199468][ T6049]  do_syscall_64+0x174/0x580
[  269.199478][ T6049]  ? trace_irq_disable+0x3b/0x140
[  269.199487][ T6049]  ? clear_bhb_loop+0x70/0xc0
[  269.199498][ T6049]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  269.199507][ T6049] RIP: 0033:0x7f67c8dd3df7
[  269.199517][ T6049] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  269.199524][ T6049] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  269.199535][ T6049] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  269.199542][ T6049] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  269.199547][ T6049] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  269.199552][ T6049] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  269.199557][ T6049] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c9a8
[  269.199570][ T6049]  </TASK>
[  269.200098][ T6052] FAULT_INJECTION: forcing a failure.
[  269.200098][ T6052] name failslab, interval 1, probability 5, space 0, times -1
[  269.295768][ T6052] CPU: 0 UID: 0 PID: 6052 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  269.295781][ T6052] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  269.295787][ T6052] Call Trace:
[  269.295792][ T6052]  <TASK>
[  269.295796][ T6052]  dump_stack_lvl+0xe8/0x150
[  269.295813][ T6052]  should_fail_ex+0x40c/0x560
[  269.295830][ T6052]  should_failslab+0xa8/0x100
[  269.295841][ T6052]  __kmalloc_cache_noprof+0xa8/0x660
[  269.295856][ T6052]  ? rpc_sysfs_xprt_setup+0xa7/0x260
[  269.295867][ T6052]  ? rpc_sysfs_xprt_setup+0xa7/0x260
[  269.295882][ T6052]  rpc_sysfs_xprt_setup+0xa7/0x260
[  269.295896][ T6052]  xprt_switch_alloc+0x420/0x590
[  269.295909][ T6052]  rpc_create_xprt+0x1c7/0xa90
[  269.295919][ T6052]  ? __pfx_rpc_create_xprt+0x10/0x10
[  269.295936][ T6052]  ? rcu_is_watching+0x15/0xb0
[  269.295947][ T6052]  ? trace_kmalloc+0x2a/0xf0
[  269.295960][ T6052]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  269.295973][ T6052]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  269.295985][ T6052]  ? xprt_create_transport+0x39b/0x5f0
[  269.295995][ T6052]  ? xprt_create_transport+0x39b/0x5f0
[  269.296004][ T6052]  ? kstrdup+0x81/0x100
[  269.296017][ T6052]  ? __asan_memcpy+0x40/0x70
[  269.296060][ T6052]  ? xprt_create_transport+0x438/0x5f0
[  269.296070][ T6052]  rpc_create+0x649/0x900
[  269.296085][ T6052]  ? __pfx_rpc_create+0x10/0x10
[  269.296112][ T6052]  ? __lock_acquire+0x683/0x2cf0
[  269.296126][ T6052]  rpcb_create_af_local+0x1c7/0x3c0
[  269.296135][ T6052]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  269.296167][ T6052]  ? do_raw_spin_unlock+0xf5/0x210
[  269.296187][ T6052]  rpcb_create_local+0x268/0x670
[  269.296197][ T6052]  ? __pfx_rpcb_create_local+0x10/0x10
[  269.296205][ T6052]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  269.296216][ T6052]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.296227][ T6052]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  269.296237][ T6052]  ? __percpu_counter_init_many+0x35f/0x380
[  269.296251][ T6052]  ? __svc_create+0x88f/0x990
[  269.296265][ T6052]  svc_bind+0x1b4/0x230
[  269.296276][ T6052]  nfsd_create_serv+0x581/0x840
[  269.296289][ T6052]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  269.296298][ T6052]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.296310][ T6052]  ? __pfx_nfsd_create_serv+0x10/0x10
[  269.296322][ T6052]  ? net_generic+0x1e/0x240
[  269.296333][ T6052]  ? net_generic+0x1e/0x240
[  269.296347][ T6052]  ? net_generic+0x1e/0x240
[  269.296361][ T6052]  nfsd_svc+0x189/0x780
[  269.296375][ T6052]  write_threads+0x3cd/0x5a0
[  269.296383][ T6052]  ? __might_fault+0xaf/0x130
[  269.296395][ T6052]  ? __pfx_write_threads+0x10/0x10
[  269.296411][ T6052]  ? _copy_from_user+0x94/0xb0
[  269.296422][ T6052]  ? simple_transaction_get+0x12d/0x160
[  269.296433][ T6052]  nfsctl_transaction_write+0x10f/0x160
[  269.296442][ T6052]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  269.296451][ T6052]  vfs_write+0x296/0xba0
[  269.296466][ T6052]  ? __pfx_vfs_write+0x10/0x10
[  269.296475][ T6052]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.296490][ T6052]  ? fput_close_sync+0x11f/0x240
[  269.296502][ T6052]  ksys_write+0x150/0x270
[  269.296513][ T6052]  ? __pfx_ksys_write+0x10/0x10
[  269.296527][ T6052]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  269.296537][ T6052]  do_syscall_64+0x174/0x580
[  269.296547][ T6052]  ? trace_irq_disable+0x3b/0x140
[  269.296556][ T6052]  ? clear_bhb_loop+0x70/0xc0
[  269.296566][ T6052]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  269.296574][ T6052] RIP: 0033:0x7f67c8dd3df7
[  269.296583][ T6052] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  269.296591][ T6052] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  269.296601][ T6052] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  269.296607][ T6052] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  269.296613][ T6052] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  269.296617][ T6052] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  269.296623][ T6052] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c9b4
[  269.296636][ T6052]  </TASK>
[  269.296883][ T6052] FAULT_INJECTION: forcing a failure.
[  269.296883][ T6052] name failslab, interval 1, probability 5, space 0, times -1
[  269.422958][ T6052] CPU: 0 UID: 0 PID: 6052 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  269.422971][ T6052] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  269.422978][ T6052] Call Trace:
[  269.422983][ T6052]  <TASK>
[  269.422987][ T6052]  dump_stack_lvl+0xe8/0x150
[  269.423004][ T6052]  should_fail_ex+0x40c/0x560
[  269.423041][ T6052]  should_failslab+0xa8/0x100
[  269.423053][ T6052]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  269.423065][ T6052]  ? kstrdup+0x81/0x100
[  269.423080][ T6052]  ? __kernfs_new_node+0xe6/0x980
[  269.423092][ T6052]  ? __kernfs_new_node+0xe6/0x980
[  269.423105][ T6052]  __kernfs_new_node+0xe6/0x980
[  269.423121][ T6052]  ? __pfx___kernfs_new_node+0x10/0x10
[  269.423132][ T6052]  ? kernfs_root+0x1c/0x230
[  269.423146][ T6052]  ? kernfs_root+0x1c/0x230
[  269.423156][ T6052]  ? kernfs_root+0x1c/0x230
[  269.423165][ T6052]  ? kernfs_root+0x1c/0x230
[  269.423178][ T6052]  kernfs_new_node+0xea/0x140
[  269.423196][ T6052]  kernfs_create_link+0xa7/0x200
[  269.423206][ T6052]  sysfs_do_create_link_sd+0x83/0x110
[  269.423218][ T6052]  rpc_sysfs_client_setup+0x27c/0x310
[  269.423234][ T6052]  ? __pfx_rpc_sysfs_client_setup+0x10/0x10
[  269.423246][ T6052]  ? rpc_net_ns+0x1e/0x230
[  269.423256][ T6052]  ? rpc_net_ns+0x1e/0x230
[  269.423263][ T6052]  ? rpc_net_ns+0x1e/0x230
[  269.423274][ T6052]  rpc_new_client+0x716/0xc50
[  269.423288][ T6052]  rpc_create_xprt+0x29f/0xa90
[  269.423298][ T6052]  ? __pfx_rpc_create_xprt+0x10/0x10
[  269.423316][ T6052]  ? rcu_is_watching+0x15/0xb0
[  269.423326][ T6052]  ? trace_kmalloc+0x2a/0xf0
[  269.423343][ T6052]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  269.423356][ T6052]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  269.423368][ T6052]  ? xprt_create_transport+0x39b/0x5f0
[  269.423377][ T6052]  ? xprt_create_transport+0x39b/0x5f0
[  269.423386][ T6052]  ? kstrdup+0x81/0x100
[  269.423399][ T6052]  ? __asan_memcpy+0x40/0x70
[  269.423413][ T6052]  ? xprt_create_transport+0x438/0x5f0
[  269.423424][ T6052]  rpc_create+0x649/0x900
[  269.423438][ T6052]  ? __pfx_rpc_create+0x10/0x10
[  269.423465][ T6052]  ? __lock_acquire+0x683/0x2cf0
[  269.423479][ T6052]  rpcb_create_af_local+0x1c7/0x3c0
[  269.423488][ T6052]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  269.423506][ T6052]  ? do_raw_spin_unlock+0xf5/0x210
[  269.423519][ T6052]  rpcb_create_local+0x268/0x670
[  269.423529][ T6052]  ? __pfx_rpcb_create_local+0x10/0x10
[  269.423537][ T6052]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  269.423547][ T6052]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.423558][ T6052]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  269.423567][ T6052]  ? __percpu_counter_init_many+0x35f/0x380
[  269.423582][ T6052]  ? __svc_create+0x88f/0x990
[  269.423595][ T6052]  svc_bind+0x1b4/0x230
[  269.423606][ T6052]  nfsd_create_serv+0x581/0x840
[  269.423619][ T6052]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  269.423629][ T6052]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.423641][ T6052]  ? __pfx_nfsd_create_serv+0x10/0x10
[  269.423653][ T6052]  ? net_generic+0x1e/0x240
[  269.423665][ T6052]  ? net_generic+0x1e/0x240
[  269.423679][ T6052]  ? net_generic+0x1e/0x240
[  269.423695][ T6052]  nfsd_svc+0x189/0x780
[  269.423712][ T6052]  write_threads+0x3cd/0x5a0
[  269.423720][ T6052]  ? __might_fault+0xaf/0x130
[  269.423734][ T6052]  ? __pfx_write_threads+0x10/0x10
[  269.423751][ T6052]  ? _copy_from_user+0x94/0xb0
[  269.423762][ T6052]  ? simple_transaction_get+0x12d/0x160
[  269.423773][ T6052]  nfsctl_transaction_write+0x10f/0x160
[  269.423783][ T6052]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  269.423792][ T6052]  vfs_write+0x296/0xba0
[  269.423808][ T6052]  ? __pfx_vfs_write+0x10/0x10
[  269.423817][ T6052]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.423832][ T6052]  ? fput_close_sync+0x11f/0x240
[  269.423844][ T6052]  ksys_write+0x150/0x270
[  269.423856][ T6052]  ? __pfx_ksys_write+0x10/0x10
[  269.423870][ T6052]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  269.423880][ T6052]  do_syscall_64+0x174/0x580
[  269.423891][ T6052]  ? trace_irq_disable+0x3b/0x140
[  269.423900][ T6052]  ? clear_bhb_loop+0x70/0xc0
[  269.423910][ T6052]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  269.423918][ T6052] RIP: 0033:0x7f67c8dd3df7
[  269.423929][ T6052] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  269.423936][ T6052] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  269.423947][ T6052] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  269.423953][ T6052] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  269.423958][ T6052] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  269.423963][ T6052] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  269.423968][ T6052] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c9b4
[  269.423981][ T6052]  </TASK>
[  269.423999][ T6052] can't create link to switch in sysfs (-12)
[  269.565856][ T6052] FAULT_INJECTION: forcing a failure.
[  269.565856][ T6052] name failslab, interval 1, probability 5, space 0, times -1
[  269.569622][ T6052] CPU: 0 UID: 0 PID: 6052 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  269.569634][ T6052] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  269.569640][ T6052] Call Trace:
[  269.569644][ T6052]  <TASK>
[  269.569649][ T6052]  dump_stack_lvl+0xe8/0x150
[  269.569666][ T6052]  should_fail_ex+0x40c/0x560
[  269.569683][ T6052]  should_failslab+0xa8/0x100
[  269.569695][ T6052]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  269.569708][ T6052]  ? security_file_alloc+0x34/0x310
[  269.569718][ T6052]  ? security_file_alloc+0x34/0x310
[  269.569731][ T6052]  security_file_alloc+0x34/0x310
[  269.569742][ T6052]  init_file+0x90/0x2b0
[  269.569752][ T6052]  alloc_empty_file+0x74/0x1d0
[  269.569761][ T6052]  alloc_file_pseudo+0x115/0x1e0
[  269.569770][ T6052]  ? __pfx_alloc_file_pseudo+0x10/0x10
[  269.569779][ T6052]  ? __raw_spin_lock_init+0x45/0x100
[  269.569794][ T6052]  sock_alloc_file+0xb8/0x2e0
[  269.569807][ T6052]  xs_local_connect+0x179/0x810
[  269.569819][ T6052]  ? __pfx_xs_local_connect+0x10/0x10
[  269.569831][ T6052]  ? do_raw_spin_unlock+0xf5/0x210
[  269.569844][ T6052]  xprt_connect+0x613/0x850
[  269.569858][ T6052]  ? __pfx_call_connect+0x10/0x10
[  269.569870][ T6052]  __rpc_execute+0x526/0x1280
[  269.569889][ T6052]  ? __pfx___rpc_execute+0x10/0x10
[  269.569901][ T6052]  ? rpc_task_get_xprt+0x26/0x250
[  269.569912][ T6052]  ? rpc_make_runnable+0xae/0x1c0
[  269.569924][ T6052]  rpc_execute+0x1c1/0x390
[  269.569937][ T6052]  rpc_run_task+0x4a6/0x660
[  269.569947][ T6052]  rpc_create_xprt+0x533/0xa90
[  269.569957][ T6052]  ? __pfx_rpc_create_xprt+0x10/0x10
[  269.569974][ T6052]  ? rcu_is_watching+0x15/0xb0
[  269.569984][ T6052]  ? trace_kmalloc+0x2a/0xf0
[  269.570017][ T6052]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  269.570030][ T6052]  ? xprt_create_transport+0x39b/0x5f0
[  269.570045][ T6052]  ? xprt_create_transport+0x438/0x5f0
[  269.570055][ T6052]  rpc_create+0x649/0x900
[  269.570069][ T6052]  ? __pfx_rpc_create+0x10/0x10
[  269.570096][ T6052]  ? __lock_acquire+0x683/0x2cf0
[  269.570110][ T6052]  rpcb_create_af_local+0x1c7/0x3c0
[  269.570119][ T6052]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  269.570137][ T6052]  ? do_raw_spin_unlock+0xf5/0x210
[  269.570150][ T6052]  rpcb_create_local+0x268/0x670
[  269.570160][ T6052]  ? __pfx_rpcb_create_local+0x10/0x10
[  269.570168][ T6052]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  269.570183][ T6052]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.570194][ T6052]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  269.570203][ T6052]  ? __percpu_counter_init_many+0x35f/0x380
[  269.570217][ T6052]  ? __svc_create+0x88f/0x990
[  269.570231][ T6052]  svc_bind+0x1b4/0x230
[  269.570242][ T6052]  nfsd_create_serv+0x581/0x840
[  269.570255][ T6052]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  269.570265][ T6052]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.570277][ T6052]  ? __pfx_nfsd_create_serv+0x10/0x10
[  269.570289][ T6052]  ? net_generic+0x1e/0x240
[  269.570300][ T6052]  ? net_generic+0x1e/0x240
[  269.570314][ T6052]  ? net_generic+0x1e/0x240
[  269.570328][ T6052]  nfsd_svc+0x189/0x780
[  269.570343][ T6052]  write_threads+0x3cd/0x5a0
[  269.570351][ T6052]  ? __might_fault+0xaf/0x130
[  269.570362][ T6052]  ? __pfx_write_threads+0x10/0x10
[  269.570378][ T6052]  ? _copy_from_user+0x94/0xb0
[  269.570389][ T6052]  ? simple_transaction_get+0x12d/0x160
[  269.570400][ T6052]  nfsctl_transaction_write+0x10f/0x160
[  269.570409][ T6052]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  269.570418][ T6052]  vfs_write+0x296/0xba0
[  269.570432][ T6052]  ? __pfx_vfs_write+0x10/0x10
[  269.570442][ T6052]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.570457][ T6052]  ? fput_close_sync+0x11f/0x240
[  269.570469][ T6052]  ksys_write+0x150/0x270
[  269.570480][ T6052]  ? __pfx_ksys_write+0x10/0x10
[  269.570494][ T6052]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  269.570503][ T6052]  do_syscall_64+0x174/0x580
[  269.570514][ T6052]  ? trace_irq_disable+0x3b/0x140
[  269.570523][ T6052]  ? clear_bhb_loop+0x70/0xc0
[  269.570534][ T6052]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  269.570542][ T6052] RIP: 0033:0x7f67c8dd3df7
[  269.570552][ T6052] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  269.570559][ T6052] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  269.570569][ T6052] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  269.570575][ T6052] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  269.570581][ T6052] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  269.570586][ T6052] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  269.570592][ T6052] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c9b4
[  269.570604][ T6052]  </TASK>
[  269.571461][ T6052] FAULT_INJECTION: forcing a failure.
[  269.571461][ T6052] name failslab, interval 1, probability 5, space 0, times -1
[  269.718383][ T6052] CPU: 0 UID: 0 PID: 6052 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  269.718396][ T6052] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  269.718403][ T6052] Call Trace:
[  269.718407][ T6052]  <TASK>
[  269.718411][ T6052]  dump_stack_lvl+0xe8/0x150
[  269.718428][ T6052]  should_fail_ex+0x40c/0x560
[  269.718445][ T6052]  should_failslab+0xa8/0x100
[  269.718456][ T6052]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  269.718469][ T6052]  ? __kernfs_new_node+0xe6/0x980
[  269.718481][ T6052]  ? __kernfs_new_node+0xe6/0x980
[  269.718495][ T6052]  __kernfs_new_node+0xe6/0x980
[  269.718511][ T6052]  ? __pfx___kernfs_new_node+0x10/0x10
[  269.718522][ T6052]  ? kernfs_root+0x1c/0x230
[  269.718535][ T6052]  ? kernfs_root+0x1c/0x230
[  269.718546][ T6052]  ? kernfs_root+0x1c/0x230
[  269.718555][ T6052]  ? kernfs_root+0x1c/0x230
[  269.718567][ T6052]  kernfs_new_node+0xea/0x140
[  269.718581][ T6052]  __kernfs_create_file+0x4b/0x2e0
[  269.718591][ T6052]  sysfs_add_file_mode_ns+0x237/0x300
[  269.718604][ T6052]  internal_create_group+0x679/0x1180
[  269.718619][ T6052]  ? kernfs_create_dir_ns+0x1d5/0x230
[  269.718634][ T6052]  ? __pfx_internal_create_group+0x10/0x10
[  269.718644][ T6052]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  269.718655][ T6052]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  269.718667][ T6052]  sysfs_create_groups+0x59/0x120
[  269.718679][ T6052]  kobject_add_internal+0x669/0xcd0
[  269.718713][ T6052]  kobject_init_and_add+0x12b/0x1a0
[  269.718730][ T6052]  ? __pfx_kobject_init_and_add+0x10/0x10
[  269.718743][ T6052]  ? __kmalloc_cache_noprof+0x150/0x660
[  269.718755][ T6052]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  269.718767][ T6052]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  269.718781][ T6052]  rpc_sysfs_xprt_switch_setup+0x169/0x2b0
[  269.718795][ T6052]  xprt_switch_alloc+0x238/0x590
[  269.718808][ T6052]  rpc_create_xprt+0x1c7/0xa90
[  269.718818][ T6052]  ? __pfx_rpc_create_xprt+0x10/0x10
[  269.718835][ T6052]  ? rcu_is_watching+0x15/0xb0
[  269.718846][ T6052]  ? trace_kmalloc+0x2a/0xf0
[  269.718859][ T6052]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  269.718872][ T6052]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  269.718884][ T6052]  ? xprt_create_transport+0x39b/0x5f0
[  269.718893][ T6052]  ? xprt_create_transport+0x39b/0x5f0
[  269.718902][ T6052]  ? kstrdup+0x81/0x100
[  269.718916][ T6052]  ? __asan_memcpy+0x40/0x70
[  269.718930][ T6052]  ? xprt_create_transport+0x438/0x5f0
[  269.718941][ T6052]  rpc_create+0x649/0x900
[  269.718955][ T6052]  ? __pfx_rpc_create+0x10/0x10
[  269.719001][ T6052]  ? __lock_acquire+0x683/0x2cf0
[  269.719016][ T6052]  rpcb_create_af_local+0x1c7/0x3c0
[  269.719026][ T6052]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  269.719044][ T6052]  ? do_raw_spin_unlock+0xf5/0x210
[  269.719057][ T6052]  rpcb_create_local+0x28f/0x670
[  269.719067][ T6052]  ? __pfx_rpcb_create_local+0x10/0x10
[  269.719075][ T6052]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  269.719085][ T6052]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.719096][ T6052]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  269.719105][ T6052]  ? __percpu_counter_init_many+0x35f/0x380
[  269.719120][ T6052]  ? __svc_create+0x88f/0x990
[  269.719133][ T6052]  svc_bind+0x1b4/0x230
[  269.719144][ T6052]  nfsd_create_serv+0x581/0x840
[  269.719162][ T6052]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  269.719171][ T6052]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.719184][ T6052]  ? __pfx_nfsd_create_serv+0x10/0x10
[  269.719196][ T6052]  ? net_generic+0x1e/0x240
[  269.719207][ T6052]  ? net_generic+0x1e/0x240
[  269.719221][ T6052]  ? net_generic+0x1e/0x240
[  269.719235][ T6052]  nfsd_svc+0x189/0x780
[  269.719249][ T6052]  write_threads+0x3cd/0x5a0
[  269.719258][ T6052]  ? __might_fault+0xaf/0x130
[  269.719270][ T6052]  ? __pfx_write_threads+0x10/0x10
[  269.719286][ T6052]  ? _copy_from_user+0x94/0xb0
[  269.719297][ T6052]  ? simple_transaction_get+0x12d/0x160
[  269.719308][ T6052]  nfsctl_transaction_write+0x10f/0x160
[  269.719317][ T6052]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  269.719326][ T6052]  vfs_write+0x296/0xba0
[  269.719341][ T6052]  ? __pfx_vfs_write+0x10/0x10
[  269.719351][ T6052]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.719366][ T6052]  ? fput_close_sync+0x11f/0x240
[  269.719378][ T6052]  ksys_write+0x150/0x270
[  269.719390][ T6052]  ? __pfx_ksys_write+0x10/0x10
[  269.719404][ T6052]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  269.719413][ T6052]  do_syscall_64+0x174/0x580
[  269.719424][ T6052]  ? trace_irq_disable+0x3b/0x140
[  269.719433][ T6052]  ? clear_bhb_loop+0x70/0xc0
[  269.719444][ T6052]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  269.719452][ T6052] RIP: 0033:0x7f67c8dd3df7
[  269.719462][ T6052] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  269.719470][ T6052] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  269.719481][ T6052] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  269.719487][ T6052] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003

[host] Command execution timed out after 2m30s
 OtherCrashReports:<nil> StraceOutput:/strace -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f /syz-executor1653723494

<...>
ardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  219.960663][ T6097] Call Trace:
[  219.960671][ T6097]  <TASK>
[  219.960679][ T6097]  dump_stack_lvl+0xe8/0x150
[  219.960706][ T6097]  should_fail_ex+0x40c/0x560
[  219.960731][ T6097]  should_failslab+0xa8/0x100
[  219.960749][ T6097]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  219.960770][ T6097]  ? __kernfs_new_node+0xe6/0x980
[  219.960789][ T6097]  ? __kernfs_new_node+0xe6/0x980
[  219.960812][ T6097]  __kernfs_new_node+0xe6/0x980
[  219.960867][ T6097]  ? __pfx___kernfs_new_node+0x10/0x10
[  219.960888][ T6097]  ? kernfs_root+0x1c/0x230
[  219.960910][ T6097]  ? kernfs_root+0x1c/0x230
[  219.960927][ T6097]  ? kernfs_root+0x1c/0x230
[  219.960943][ T6097]  ? kernfs_root+0x1c/0x230
[  219.960964][ T6097]  kernfs_new_node+0xea/0x140
[  219.960986][ T6097]  __kernfs_create_file+0x4b/0x2e0
[  219.961004][ T6097]  sysfs_add_file_mode_ns+0x237/0x300
[  219.961026][ T6097]  internal_create_group+0x679/0x1180
[  219.961051][ T6097]  ? kernfs_create_dir_ns+0x1d5/0x230
[  219.961074][ T6097]  ? __pfx_internal_create_group+0x10/0x10
[  219.961091][ T6097]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  219.961110][ T6097]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  219.961132][ T6097]  sysfs_create_groups+0x59/0x120
[  219.961152][ T6097]  kobject_add_internal+0x669/0xcd0
[  219.961180][ T6097]  kobject_init_and_add+0x12b/0x1a0
[  219.961205][ T6097]  ? __pfx_kobject_init_and_add+0x10/0x10
[  219.961226][ T6097]  ? kernfs_remove_by_name_ns+0x101/0x140
[  219.961252][ T6097]  ? kernfs_remove_by_name_ns+0x101/0x140
[  219.961275][ T6097]  sysfs_slab_add+0x7b/0x260
[  219.961293][ T6097]  do_kmem_cache_create+0x8bf/0x970
[  219.961313][ T6097]  __kmem_cache_create_args+0x307/0x440
[  219.961335][ T6097]  nfsd_file_cache_init+0x197/0x530
[  219.961354][ T6097]  ? __pfx_nfsd_file_cache_init+0x10/0x10
[  219.961371][ T6097]  ? net_generic+0x1e/0x240
[  219.961397][ T6097]  ? net_generic+0x1e/0x240
[  219.961415][ T6097]  ? net_generic+0x1e/0x240
[  219.961432][ T6097]  ? net_generic+0x1e/0x240
[  219.961459][ T6097]  ? net_generic+0x1f4/0x240
[  219.961479][ T6097]  nfsd_svc+0x315/0x780
[  219.961501][ T6097]  write_threads+0x3cd/0x5a0
[  219.961516][ T6097]  ? __might_fault+0xaf/0x130
[  219.961535][ T6097]  ? __pfx_write_threads+0x10/0x10
[  219.961563][ T6097]  ? _copy_from_user+0x94/0xb0
[  219.961581][ T6097]  ? simple_transaction_get+0x12d/0x160
[  219.961600][ T6097]  nfsctl_transaction_write+0x10f/0x160
[  219.961616][ T6097]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  219.961632][ T6097]  vfs_write+0x296/0xba0
[  219.961657][ T6097]  ? __pfx_vfs_write+0x10/0x10
[  219.961682][ T6097]  ? _raw_spin_unlock_irq+0x23/0x50
[  219.961698][ T6097]  ? lockdep_hardirqs_on+0x7a/0x110
[  219.961722][ T6097]  ksys_write+0x150/0x270
[  219.961741][ T6097]  ? __pfx_ksys_write+0x10/0x10
[  219.961764][ T6097]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  219.961778][ T6097]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  219.961793][ T6097]  do_syscall_64+0x174/0x580
[  219.961810][ T6097]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  219.961825][ T6097]  ? clear_bhb_loop+0x70/0xc0
[  219.961877][ T6097]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  219.961891][ T6097] RIP: 0033:0x7f3343939df7
[  219.961907][ T6097] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  219.961920][ T6097] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  219.961937][ T6097] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  219.961948][ T6097] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  219.961956][ T6097] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  219.961964][ T6097] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  219.961974][ T6097] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7da34
[  219.961995][ T6097]  </TASK>
[  219.962160][ T6097] kobject: kobject_add_internal failed for nfsd_file (error: -12 parent: slab)
[  220.140926][ T6097] SLUB: Unable to add cache nfsd_file to sysfs
[  220.144088][ T6097] FAULT_INJECTION: forcing a failure.
[  220.144088][ T6097] name failslab, interval 1, probability 5, space 0, times -1
[  220.149903][ T6097] CPU: 0 UID: 0 PID: 6097 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  220.149924][ T6097] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  220.149942][ T6097] Call Trace:
[  220.149950][ T6097]  <TASK>
[  220.149957][ T6097]  dump_stack_lvl+0xe8/0x150
[  220.149983][ T6097]  should_fail_ex+0x40c/0x560
[  220.150008][ T6097]  should_failslab+0xa8/0x100
[  220.150026][ T6097]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  220.150047][ T6097]  ? __kernfs_new_node+0xe6/0x980
[  220.150065][ T6097]  ? __kernfs_new_node+0xe6/0x980
[  220.150087][ T6097]  __kernfs_new_node+0xe6/0x980
[  220.150113][ T6097]  ? __pfx___kernfs_new_node+0x10/0x10
[  220.150132][ T6097]  ? kernfs_root+0x1c/0x230
[  220.150154][ T6097]  ? kernfs_root+0x1c/0x230
[  220.150171][ T6097]  ? kernfs_root+0x1c/0x230
[  220.150185][ T6097]  ? kernfs_root+0x1c/0x230
[  220.150204][ T6097]  kernfs_new_node+0xea/0x140
[  220.150226][ T6097]  __kernfs_create_file+0x4b/0x2e0
[  220.150243][ T6097]  sysfs_add_file_mode_ns+0x237/0x300
[  220.150264][ T6097]  internal_create_group+0x679/0x1180
[  220.150289][ T6097]  ? kernfs_create_dir_ns+0x1d5/0x230
[  220.150312][ T6097]  ? __pfx_internal_create_group+0x10/0x10
[  220.150328][ T6097]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  220.150346][ T6097]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  220.150368][ T6097]  sysfs_create_groups+0x59/0x120
[  220.150389][ T6097]  kobject_add_internal+0x669/0xcd0
[  220.150415][ T6097]  kobject_init_and_add+0x12b/0x1a0
[  220.150438][ T6097]  ? __pfx_kobject_init_and_add+0x10/0x10
[  220.150459][ T6097]  ? kernfs_remove_by_name_ns+0x101/0x140
[  220.150483][ T6097]  ? kernfs_remove_by_name_ns+0x101/0x140
[  220.150503][ T6097]  sysfs_slab_add+0x7b/0x260
[  220.150520][ T6097]  do_kmem_cache_create+0x8bf/0x970
[  220.150538][ T6097]  __kmem_cache_create_args+0x307/0x440
[  220.150558][ T6097]  nfsd_file_cache_init+0x1d9/0x530
[  220.150578][ T6097]  ? __pfx_nfsd_file_cache_init+0x10/0x10
[  220.150596][ T6097]  ? net_generic+0x1e/0x240
[  220.150621][ T6097]  ? net_generic+0x1e/0x240
[  220.150640][ T6097]  ? net_generic+0x1e/0x240
[  220.150656][ T6097]  ? net_generic+0x1e/0x240
[  220.150674][ T6097]  ? net_generic+0x1f4/0x240
[  220.150693][ T6097]  nfsd_svc+0x315/0x780
[  220.150717][ T6097]  write_threads+0x3cd/0x5a0
[  220.150732][ T6097]  ? __might_fault+0xaf/0x130
[  220.150751][ T6097]  ? __pfx_write_threads+0x10/0x10
[  220.150779][ T6097]  ? _copy_from_user+0x94/0xb0
[  220.150795][ T6097]  ? simple_transaction_get+0x12d/0x160
[  220.150851][ T6097]  nfsctl_transaction_write+0x10f/0x160
[  220.150915][ T6097]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  220.150938][ T6097]  vfs_write+0x296/0xba0
[  220.150961][ T6097]  ? __pfx_vfs_write+0x10/0x10
[  220.150984][ T6097]  ? _raw_spin_unlock_irq+0x23/0x50
[  220.151000][ T6097]  ? lockdep_hardirqs_on+0x7a/0x110
[  220.151021][ T6097]  ksys_write+0x150/0x270
[  220.151040][ T6097]  ? __pfx_ksys_write+0x10/0x10
[  220.151061][ T6097]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  220.151076][ T6097]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  220.151090][ T6097]  do_syscall_64+0x174/0x580
[  220.151106][ T6097]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  220.151120][ T6097]  ? clear_bhb_loop+0x70/0xc0
[  220.151137][ T6097]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  220.151152][ T6097] RIP: 0033:0x7f3343939df7
[  220.151168][ T6097] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  220.151182][ T6097] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  220.151198][ T6097] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  220.151210][ T6097] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  220.151219][ T6097] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  220.151228][ T6097] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  220.151237][ T6097] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7da34
[  220.151259][ T6097]  </TASK>
[  220.151452][ T6097] kobject: kobject_add_internal failed for nfsd_file_mark (error: -12 parent: slab)
[  220.329845][ T6097] SLUB: Unable to add cache nfsd_file_mark to sysfs
[  220.332601][ T6097] FAULT_INJECTION: forcing a failure.
[  220.332601][ T6097] name failslab, interval 1, probability 5, space 0, times -1
[  220.338051][ T6097] CPU: 0 UID: 0 PID: 6097 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  220.338073][ T6097] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  220.338082][ T6097] Call Trace:
[  220.338090][ T6097]  <TASK>
[  220.338097][ T6097]  dump_stack_lvl+0xe8/0x150
[  220.338122][ T6097]  should_fail_ex+0x40c/0x560
[  220.338144][ T6097]  ? __rhashtable_init_noprof+0x545/0xaf0
[  220.338161][ T6097]  should_failslab+0xa8/0x100
[  220.338179][ T6097]  __kvmalloc_node_noprof+0x176/0x860
[  220.338203][ T6097]  ? __rhashtable_init_noprof+0x545/0xaf0
[  220.338221][ T6097]  __rhashtable_init_noprof+0x545/0xaf0
[  220.338238][ T6097]  __rhltable_init_noprof+0x26/0x70
[  220.338255][ T6097]  nfs4_state_start+0x28/0x100
[  220.338277][ T6097]  nfsd_svc+0x3c0/0x780
[  220.338301][ T6097]  write_threads+0x3cd/0x5a0
[  220.338314][ T6097]  ? __might_fault+0xaf/0x130
[  220.338334][ T6097]  ? __pfx_write_threads+0x10/0x10
[  220.338360][ T6097]  ? _copy_from_user+0x94/0xb0
[  220.338377][ T6097]  ? simple_transaction_get+0x12d/0x160
[  220.338395][ T6097]  nfsctl_transaction_write+0x10f/0x160
[  220.338423][ T6097]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  220.338439][ T6097]  vfs_write+0x296/0xba0
[  220.338462][ T6097]  ? __pfx_vfs_write+0x10/0x10
[  220.338487][ T6097]  ? _raw_spin_unlock_irq+0x23/0x50
[  220.338504][ T6097]  ? lockdep_hardirqs_on+0x7a/0x110
[  220.338527][ T6097]  ksys_write+0x150/0x270
[  220.338547][ T6097]  ? __pfx_ksys_write+0x10/0x10
[  220.338568][ T6097]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  220.338583][ T6097]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  220.338598][ T6097]  do_syscall_64+0x174/0x580
[  220.338615][ T6097]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  220.338630][ T6097]  ? clear_bhb_loop+0x70/0xc0
[  220.338645][ T6097]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  220.338658][ T6097] RIP: 0033:0x7f3343939df7
[  220.338675][ T6097] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  220.338688][ T6097] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  220.338704][ T6097] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  220.338714][ T6097] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  220.338722][ T6097] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  220.338730][ T6097] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  220.338738][ T6097] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7da34
[  220.338759][ T6097]  </TASK>
[  220.338850][ T6097] NFSD: Failed to start, no listeners configured.
[  220.759070][ T5902] FAULT_INJECTION: forcing a failure.
[  220.759070][ T5902] name failslab, interval 1, probability 5, space 0, times -1
[pid  6097] <... write resumed>)        = -1 EIO (Input/output error)
[  220.764934][ T5902] CPU: 0 UID: 0 PID: 5902 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  220.764956][ T5902] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[pid  6097] openat(AT_FDCWD, "/proc/self/make-it-fail", O_WRONLY) = -1 ENOMEM (Cannot allocate memory)
[  220.764966][ T5902] Call Trace:
[  220.764975][ T5902]  <TASK>
[  220.764982][ T5902]  dump_stack_lvl+0xe8/0x150
[  220.765010][ T5902]  should_fail_ex+0x40c/0x560
[  220.765037][ T5902]  should_failslab+0xa8/0x100
[  220.765058][ T5902]  __kmalloc_node_track_caller_noprof+0x100/0x730
[  220.765084][ T5902]  ? kobject_set_name_vargs+0x61/0x110
[  220.765106][ T5902]  ? kobject_set_name_vargs+0x61/0x110
[  220.765134][ T5902]  kvasprintf+0xeb/0x1a0
[  220.765155][ T5902]  ? __pfx_kvasprintf+0x10/0x10
[  220.765181][ T5902]  ? kvasprintf_const+0xe1/0x240
[  220.765201][ T5902]  kobject_set_name_vargs+0x61/0x110
[  220.765225][ T5902]  kobject_init_and_add+0xee/0x1a0
[  220.765253][ T5902]  ? __pfx_kobject_init_and_add+0x10/0x10
[  220.765276][ T5902]  ? __kmalloc_cache_noprof+0x150/0x660
[  220.765296][ T5902]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  220.765316][ T5902]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  220.765343][ T5902]  rpc_sysfs_xprt_switch_setup+0x169/0x2b0
[  220.765367][ T5902]  xprt_switch_alloc+0x238/0x590
[  220.765390][ T5902]  rpc_create_xprt+0x1c7/0xa90
[  220.765408][ T5902]  ? __pfx_rpc_create_xprt+0x10/0x10
[  220.765439][ T5902]  ? rcu_is_watching+0x15/0xb0
[  220.765457][ T5902]  ? trace_kmalloc+0x2a/0xf0
[  220.765480][ T5902]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  220.765501][ T5902]  ? br_mrp_rcv+0x248/0x2030
[  220.765519][ T5902]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  220.765540][ T5902]  ? xprt_create_transport+0x39b/0x5f0
[  220.765557][ T5902]  ? xprt_create_transport+0x39b/0x5f0
[  220.765573][ T5902]  ? kstrdup+0x81/0x100
[  220.765596][ T5902]  ? __asan_memcpy+0x40/0x70
[  220.765622][ T5902]  ? xprt_create_transport+0x438/0x5f0
[  220.765642][ T5902]  rpc_create+0x649/0x900
[  220.765666][ T5902]  ? __pfx_rpc_create+0x10/0x10
[  220.765716][ T5902]  ? __lock_acquire+0x683/0x2cf0
[  220.765742][ T5902]  rpcb_create_af_local+0x1c7/0x3c0
[  220.765786][ T5902]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  220.765818][ T5902]  ? do_raw_spin_unlock+0xf5/0x210
[  220.765842][ T5902]  rpcb_create_local+0x268/0x670
[  220.765860][ T5902]  ? __pfx_rpcb_create_local+0x10/0x10
[  220.765897][ T5902]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  220.765915][ T5902]  ? lockdep_hardirqs_on+0x7a/0x110
[  220.765934][ T5902]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  220.765951][ T5902]  ? __percpu_counter_init_many+0x35f/0x380
[  220.765978][ T5902]  ? __svc_create+0x88f/0x990
[  220.766001][ T5902]  svc_bind+0x1b4/0x230
[  220.766020][ T5902]  nfsd_create_serv+0x581/0x840
[  220.766096][ T5902]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  220.766113][ T5902]  ? lockdep_hardirqs_on+0x7a/0x110
[  220.766135][ T5902]  ? __pfx_nfsd_create_serv+0x10/0x10
[  220.766156][ T5902]  ? net_generic+0x1e/0x240
[  220.766177][ T5902]  ? net_generic+0x1e/0x240
[  220.766201][ T5902]  ? net_generic+0x1e/0x240
[  220.766226][ T5902]  nfsd_svc+0x189/0x780
[  220.766249][ T5902]  write_threads+0x3cd/0x5a0
[  220.766265][ T5902]  ? __might_fault+0xaf/0x130
[  220.766285][ T5902]  ? __pfx_write_threads+0x10/0x10
[  220.766315][ T5902]  ? _copy_from_user+0x94/0xb0
[  220.766334][ T5902]  ? simple_transaction_get+0x12d/0x160
[  220.766353][ T5902]  nfsctl_transaction_write+0x10f/0x160
[  220.766370][ T5902]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  220.766386][ T5902]  vfs_write+0x296/0xba0
[  220.766411][ T5902]  ? __pfx_vfs_write+0x10/0x10
[  220.766438][ T5902]  ? _raw_spin_unlock_irq+0x23/0x50
[  220.766454][ T5902]  ? lockdep_hardirqs_on+0x7a/0x110
[  220.766479][ T5902]  ksys_write+0x150/0x270
[  220.766501][ T5902]  ? __pfx_ksys_write+0x10/0x10
[  220.766567][ T5902]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  220.766584][ T5902]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  220.766601][ T5902]  do_syscall_64+0x174/0x580
[  220.766619][ T5902]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  220.766635][ T5902]  ? clear_bhb_loop+0x70/0xc0
[  220.766654][ T5902]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  220.766670][ T5902] RIP: 0033:0x7f3343939df7
[  220.766687][ T5902] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  220.766701][ T5902] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  220.766717][ T5902] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  220.766728][ T5902] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  220.766739][ T5902] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  220.766771][ T5902] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  220.766783][ T5902] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d790
[  220.766808][ T5902]  </TASK>
[  220.766817][ T5902] kobject: can not set name properly!
[  220.770404][ T6097] FAULT_INJECTION: forcing a failure.
[  220.770404][ T6097] name failslab, interval 1, probability 5, space 0, times -1
[  220.771709][ T5902] FAULT_INJECTION: forcing a failure.
[  220.771709][ T5902] name failslab, interval 1, probability 5, space 0, times -1
[  220.777261][ T6097] CPU: 1 UID: 0 PID: 6097 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  220.777282][ T6097] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  220.777291][ T6097] Call Trace:
[  220.777300][ T6097]  <TASK>
[  220.777306][ T6097]  dump_stack_lvl+0xe8/0x150
[  220.777343][ T6097]  should_fail_ex+0x40c/0x560
[  220.777370][ T6097]  should_failslab+0xa8/0x100
[  220.777390][ T6097]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  220.777411][ T6097]  ? do_getname+0x2e/0x250
[  220.777433][ T6097]  ? do_getname+0x2e/0x250
[  220.777460][ T6097]  do_getname+0x2e/0x250
[  220.777478][ T6097]  ? getname_flags+0x11/0x20
[  220.777498][ T6097]  do_sys_openat2+0xcc/0x200
[  220.777512][ T6097]  ? _raw_spin_unlock_irq+0x2e/0x50
[  220.777530][ T6097]  ? __pfx_do_sys_openat2+0x10/0x10
[  220.777553][ T6097]  __x64_sys_openat+0x138/0x170
[  220.777571][ T6097]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  220.777588][ T6097]  do_syscall_64+0x174/0x580
[  220.777606][ T6097]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  220.777649][ T6097]  ? clear_bhb_loop+0x70/0xc0
[  220.777669][ T6097]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  220.777685][ T6097] RIP: 0033:0x7f3343939df7
[  220.777701][ T6097] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  220.777902][ T6097] RSP: 002b:00007ffd7b7fb660 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
[  220.777919][ T6097] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  220.777931][ T6097] RDX: 0000000000000001 RSI: 00007f3343974192 RDI: ffffffffffffff9c
[  220.777941][ T6097] RBP: 00007f334397468c R08: 0000000000000000 R09: 0000000000000000
[  220.777950][ T6097] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  220.777960][ T6097] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7da34
[  220.777995][ T6097]  </TASK>
[  221.089173][ T5902] CPU: 0 UID: 0 PID: 5902 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  221.089196][ T5902] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  221.089206][ T5902] Call Trace:
[  221.089213][ T5902]  <TASK>
[  221.089220][ T5902]  dump_stack_lvl+0xe8/0x150
[  221.089247][ T5902]  should_fail_ex+0x40c/0x560
[  221.089274][ T5902]  should_failslab+0xa8/0x100
[  221.089295][ T5902]  __kmalloc_cache_noprof+0xa8/0x660
[  221.089317][ T5902]  ? __pfx_xprt_get+0x10/0x10
[  221.089336][ T5902]  ? rpc_new_client+0x153/0xc50
[  221.089354][ T5902]  ? rpc_new_client+0x153/0xc50
[  221.089377][ T5902]  rpc_new_client+0x153/0xc50
[  221.089395][ T5902]  ? xprt_switch_alloc+0x420/0x590
[  221.089418][ T5902]  rpc_create_xprt+0x29f/0xa90
[  221.089436][ T5902]  ? __pfx_rpc_create_xprt+0x10/0x10
[  221.089465][ T5902]  ? rcu_is_watching+0x15/0xb0
[  221.089483][ T5902]  ? trace_kmalloc+0x2a/0xf0
[  221.089506][ T5902]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  221.089527][ T5902]  ? br_mrp_rcv+0x248/0x2030
[  221.089545][ T5902]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  221.089566][ T5902]  ? xprt_create_transport+0x39b/0x5f0
[  221.089582][ T5902]  ? xprt_create_transport+0x39b/0x5f0
[  221.089598][ T5902]  ? kstrdup+0x81/0x100
[  221.089621][ T5902]  ? __asan_memcpy+0x40/0x70
[  221.089647][ T5902]  ? xprt_create_transport+0x438/0x5f0
[  221.089666][ T5902]  rpc_create+0x649/0x900
[  221.089691][ T5902]  ? __pfx_rpc_create+0x10/0x10
[  221.089775][ T5902]  ? __lock_acquire+0x683/0x2cf0
[  221.089801][ T5902]  rpcb_create_af_local+0x1c7/0x3c0
[  221.089819][ T5902]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  221.089851][ T5902]  ? do_raw_spin_unlock+0xf5/0x210
[  221.089875][ T5902]  rpcb_create_local+0x268/0x670
[  221.089894][ T5902]  ? __pfx_rpcb_create_local+0x10/0x10
[  221.089908][ T5902]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  221.089928][ T5902]  ? lockdep_hardirqs_on+0x7a/0x110
[  221.089947][ T5902]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  221.089964][ T5902]  ? __percpu_counter_init_many+0x35f/0x380
[  221.089990][ T5902]  ? __svc_create+0x88f/0x990
[  221.090015][ T5902]  svc_bind+0x1b4/0x230
[  221.090036][ T5902]  nfsd_create_serv+0x581/0x840
[  221.090058][ T5902]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  221.090076][ T5902]  ? lockdep_hardirqs_on+0x7a/0x110
[  221.090098][ T5902]  ? __pfx_nfsd_create_serv+0x10/0x10
[  221.090119][ T5902]  ? net_generic+0x1e/0x240
[  221.090137][ T5902]  ? net_generic+0x1e/0x240
[  221.090162][ T5902]  ? net_generic+0x1e/0x240
[  221.090187][ T5902]  nfsd_svc+0x189/0x780
[  221.090212][ T5902]  write_threads+0x3cd/0x5a0
[  221.090227][ T5902]  ? __might_fault+0xaf/0x130
[  221.090248][ T5902]  ? __pfx_write_threads+0x10/0x10
[  221.090277][ T5902]  ? _copy_from_user+0x94/0xb0
[  221.090296][ T5902]  ? simple_transaction_get+0x12d/0x160
[  221.090316][ T5902]  nfsctl_transaction_write+0x10f/0x160
[  221.090334][ T5902]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  221.090350][ T5902]  vfs_write+0x296/0xba0
[  221.090377][ T5902]  ? __pfx_vfs_write+0x10/0x10
[  221.090404][ T5902]  ? _raw_spin_unlock_irq+0x23/0x50
[  221.090421][ T5902]  ? lockdep_hardirqs_on+0x7a/0x110
[  221.090446][ T5902]  ksys_write+0x150/0x270
[  221.090466][ T5902]  ? __pfx_ksys_write+0x10/0x10
[  221.090491][ T5902]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  221.090507][ T5902]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  221.090524][ T5902]  do_syscall_64+0x174/0x580
[  221.090542][ T5902]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  221.090558][ T5902]  ? clear_bhb_loop+0x70/0xc0
[  221.090578][ T5902]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  221.090593][ T5902] RIP: 0033:0x7f3343939df7
[  221.090610][ T5902] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  221.090624][ T5902] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  221.090641][ T5902] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  221.090653][ T5902] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  221.090663][ T5902] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  221.090672][ T5902] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  221.090682][ T5902] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d790
[  221.090708][ T5902]  </TASK>
[  221.091459][ T5902] FAULT_INJECTION: forcing a failure.
[  221.091459][ T5902] name failslab, interval 1, probability 5, space 0, times -1
[  221.299658][ T5902] CPU: 0 UID: 0 PID: 5902 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  221.299682][ T5902] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  221.299717][ T5902] Call Trace:
[  221.299725][ T5902]  <TASK>
[  221.299733][ T5902]  dump_stack_lvl+0xe8/0x150
[  221.299762][ T5902]  should_fail_ex+0x40c/0x560
[  221.299791][ T5902]  should_failslab+0xa8/0x100
[  221.299820][ T5902]  __kmalloc_node_track_caller_noprof+0x100/0x730
[  221.299844][ T5902]  ? __lock_acquire+0x683/0x2cf0
[  221.299860][ T5902]  ? __kernfs_new_node+0xa9/0x980
[  221.299879][ T5902]  ? __kernfs_new_node+0xa9/0x980
[  221.299904][ T5902]  kstrdup+0x42/0x100
[  221.299928][ T5902]  __kernfs_new_node+0xa9/0x980
[  221.299954][ T5902]  ? __pfx___kernfs_new_node+0x10/0x10
[  221.299974][ T5902]  ? kernfs_root+0x1c/0x230
[  221.299998][ T5902]  ? kernfs_root+0x1c/0x230
[  221.300017][ T5902]  ? kernfs_root+0x1c/0x230
[  221.300034][ T5902]  ? kernfs_root+0x1c/0x230
[  221.300056][ T5902]  kernfs_create_dir_ns+0xfe/0x230
[  221.300082][ T5902]  sysfs_create_dir_ns+0x12f/0x2a0
[  221.300105][ T5902]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  221.300126][ T5902]  ? do_raw_spin_unlock+0xf5/0x210
[  221.300148][ T5902]  kobject_add_internal+0x622/0xcd0
[  221.300177][ T5902]  kobject_init_and_add+0x12b/0x1a0
[  221.300203][ T5902]  ? __pfx_kobject_init_and_add+0x10/0x10
[  221.300227][ T5902]  ? __kmalloc_cache_noprof+0x150/0x660
[  221.300247][ T5902]  ? rpc_sysfs_xprt_setup+0xa7/0x260
[  221.300267][ T5902]  ? rpc_sysfs_xprt_setup+0xa7/0x260
[  221.300292][ T5902]  rpc_sysfs_xprt_setup+0x132/0x260
[  221.300315][ T5902]  xprt_switch_alloc+0x420/0x590
[  221.300339][ T5902]  rpc_create_xprt+0x1c7/0xa90
[  221.300357][ T5902]  ? __pfx_rpc_create_xprt+0x10/0x10
[  221.300386][ T5902]  ? rcu_is_watching+0x15/0xb0
[  221.300404][ T5902]  ? trace_kmalloc+0x2a/0xf0
[  221.300428][ T5902]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  221.300448][ T5902]  ? br_mrp_rcv+0x248/0x2030
[  221.300466][ T5902]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  221.300487][ T5902]  ? xprt_create_transport+0x39b/0x5f0
[  221.300505][ T5902]  ? xprt_create_transport+0x39b/0x5f0
[  221.300521][ T5902]  ? kstrdup+0x81/0x100
[  221.300543][ T5902]  ? __asan_memcpy+0x40/0x70
[  221.300569][ T5902]  ? xprt_create_transport+0x438/0x5f0
[  221.300588][ T5902]  rpc_create+0x649/0x900
[  221.300612][ T5902]  ? __pfx_rpc_create+0x10/0x10
[  221.300663][ T5902]  ? __lock_acquire+0x683/0x2cf0
[  221.300687][ T5902]  rpcb_create_af_local+0x1c7/0x3c0
[  221.300731][ T5902]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  221.300765][ T5902]  ? do_raw_spin_unlock+0xf5/0x210
[  221.300787][ T5902]  rpcb_create_local+0x28f/0x670
[  221.300806][ T5902]  ? __pfx_rpcb_create_local+0x10/0x10
[  221.300827][ T5902]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  221.300845][ T5902]  ? lockdep_hardirqs_on+0x7a/0x110
[  221.300864][ T5902]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  221.300880][ T5902]  ? __percpu_counter_init_many+0x35f/0x380
[  221.300906][ T5902]  ? __svc_create+0x88f/0x990
[  221.300931][ T5902]  svc_bind+0x1b4/0x230
[  221.300951][ T5902]  nfsd_create_serv+0x581/0x840
[  221.300974][ T5902]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  221.300990][ T5902]  ? lockdep_hardirqs_on+0x7a/0x110
[  221.301028][ T5902]  ? __pfx_nfsd_create_serv+0x10/0x10
[  221.301051][ T5902]  ? net_generic+0x1e/0x240
[  221.301072][ T5902]  ? net_generic+0x1e/0x240
[  221.301096][ T5902]  ? net_generic+0x1e/0x240
[  221.301121][ T5902]  nfsd_svc+0x189/0x780
[  221.301147][ T5902]  write_threads+0x3cd/0x5a0
[  221.301163][ T5902]  ? __might_fault+0xaf/0x130
[  221.301184][ T5902]  ? __pfx_write_threads+0x10/0x10
[  221.301214][ T5902]  ? _copy_from_user+0x94/0xb0
[  221.301232][ T5902]  ? simple_transaction_get+0x12d/0x160
[  221.301252][ T5902]  nfsctl_transaction_write+0x10f/0x160
[  221.301270][ T5902]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  221.301287][ T5902]  vfs_write+0x296/0xba0
[  221.301312][ T5902]  ? __pfx_vfs_write+0x10/0x10
[  221.301339][ T5902]  ? _raw_spin_unlock_irq+0x23/0x50
[  221.301355][ T5902]  ? lockdep_hardirqs_on+0x7a/0x110
[  221.301379][ T5902]  ksys_write+0x150/0x270
[  221.301401][ T5902]  ? __pfx_ksys_write+0x10/0x10
[  221.301425][ T5902]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  221.301441][ T5902]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  221.301458][ T5902]  do_syscall_64+0x174/0x580
[  221.301477][ T5902]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  221.301493][ T5902]  ? clear_bhb_loop+0x70/0xc0
[  221.301512][ T5902]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  221.301528][ T5902] RIP: 0033:0x7f3343939df7
[  221.301544][ T5902] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  221.301558][ T5902] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  221.301575][ T5902] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  221.301586][ T5902] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  221.301596][ T5902] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  221.301605][ T5902] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  221.301615][ T5902] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d790
[  221.301640][ T5902]  </TASK>
[  221.301717][ T5902] kobject: kobject_add_internal failed for xprt-23-local (error: -12 parent: switch-23)
[  221.527074][ T5902] FAULT_INJECTION: forcing a failure.
[  221.527074][ T5902] name failslab, interval 1, probability 5, space 0, times -1
[  221.532300][ T5902] CPU: 0 UID: 0 PID: 5902 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  221.532320][ T5902] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  221.532328][ T5902] Call Trace:
[  221.532336][ T5902]  <TASK>
[  221.532361][ T5902]  dump_stack_lvl+0xe8/0x150
[  221.532390][ T5902]  should_fail_ex+0x40c/0x560
[  221.532418][ T5902]  should_failslab+0xa8/0x100
[  221.532439][ T5902]  __kmalloc_noprof+0xfe/0x720
[  221.532462][ T5902]  ? rpc_alloc_iostats+0x4f/0x140
[  221.532481][ T5902]  ? rpc_alloc_iostats+0x4f/0x140
[  221.532499][ T5902]  ? __kmalloc_cache_noprof+0x150/0x660
[  221.532524][ T5902]  rpc_alloc_iostats+0x4f/0x140
[  221.532546][ T5902]  rpc_new_client+0x456/0xc50
[  221.532572][ T5902]  rpc_create_xprt+0x29f/0xa90
[  221.532590][ T5902]  ? __pfx_rpc_create_xprt+0x10/0x10
[  221.532620][ T5902]  ? rcu_is_watching+0x15/0xb0
[  221.532638][ T5902]  ? trace_kmalloc+0x2a/0xf0
[  221.532661][ T5902]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  221.532708][ T5902]  ? br_mrp_rcv+0x248/0x2030
[  221.532727][ T5902]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  221.532747][ T5902]  ? xprt_create_transport+0x39b/0x5f0
[  221.532763][ T5902]  ? xprt_create_transport+0x39b/0x5f0
[  221.532779][ T5902]  ? kstrdup+0x81/0x100
[  221.532803][ T5902]  ? __asan_memcpy+0x40/0x70
[  221.532828][ T5902]  ? xprt_create_transport+0x438/0x5f0
[  221.532848][ T5902]  rpc_create+0x649/0x900
[  221.532872][ T5902]  ? __pfx_rpc_create+0x10/0x10
[  221.532923][ T5902]  ? __lock_acquire+0x683/0x2cf0
[  221.532948][ T5902]  rpcb_create_af_local+0x1c7/0x3c0
[  221.532965][ T5902]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  221.532999][ T5902]  ? do_raw_spin_unlock+0xf5/0x210
[  221.533023][ T5902]  rpcb_create_local+0x28f/0x670
[  221.533041][ T5902]  ? __pfx_rpcb_create_local+0x10/0x10
[  221.533056][ T5902]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  221.533074][ T5902]  ? lockdep_hardirqs_on+0x7a/0x110
[  221.533093][ T5902]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  221.533109][ T5902]  ? __percpu_counter_init_many+0x35f/0x380
[  221.533136][ T5902]  ? __svc_create+0x88f/0x990
[  221.533160][ T5902]  svc_bind+0x1b4/0x230
[  221.533181][ T5902]  nfsd_create_serv+0x581/0x840
[  221.533202][ T5902]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  221.533220][ T5902]  ? lockdep_hardirqs_on+0x7a/0x110
[  221.533242][ T5902]  ? __pfx_nfsd_create_serv+0x10/0x10
[  221.533263][ T5902]  ? net_generic+0x1e/0x240
[  221.533289][ T5902]  ? net_generic+0x1e/0x240
[  221.533314][ T5902]  ? net_generic+0x1e/0x240
[  221.533340][ T5902]  nfsd_svc+0x189/0x780
[  221.533366][ T5902]  write_threads+0x3cd/0x5a0
[  221.533381][ T5902]  ? __might_fault+0xaf/0x130
[  221.533402][ T5902]  ? __pfx_write_threads+0x10/0x10
[  221.533433][ T5902]  ? _copy_from_user+0x94/0xb0
[  221.533452][ T5902]  ? simple_transaction_get+0x12d/0x160
[  221.533472][ T5902]  nfsctl_transaction_write+0x10f/0x160
[  221.533489][ T5902]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  221.533506][ T5902]  vfs_write+0x296/0xba0
[  221.533533][ T5902]  ? __pfx_vfs_write+0x10/0x10
[  221.533560][ T5902]  ? _raw_spin_unlock_irq+0x23/0x50
[  221.533577][ T5902]  ? lockdep_hardirqs_on+0x7a/0x110
[  221.533601][ T5902]  ksys_write+0x150/0x270
[  221.533622][ T5902]  ? __pfx_ksys_write+0x10/0x10
[  221.533646][ T5902]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  221.533783][ T5902]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  221.533840][ T5902]  do_syscall_64+0x174/0x580
[  221.533858][ T5902]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  221.533875][ T5902]  ? clear_bhb_loop+0x70/0xc0
[  221.533892][ T5902]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  221.533906][ T5902] RIP: 0033:0x7f3343939df7
[  221.533923][ T5902] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  221.533937][ T5902] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  221.533954][ T5902] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  221.533966][ T5902] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  221.533977][ T5902] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  221.533986][ T5902] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  221.533996][ T5902] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d790
[  221.534021][ T5902]  </TASK>
[  221.713807][ T5902] FAULT_INJECTION: forcing a failure.
[  221.713807][ T5902] name failslab, interval 1, probability 5, space 0, times -1
[  221.720899][ T5902] CPU: 0 UID: 0 PID: 5902 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  221.720921][ T5902] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  221.720931][ T5902] Call Trace:
[  221.720938][ T5902]  <TASK>
[  221.720945][ T5902]  dump_stack_lvl+0xe8/0x150
[  221.720973][ T5902]  should_fail_ex+0x40c/0x560
[  221.721002][ T5902]  should_failslab+0xa8/0x100
[  221.721021][ T5902]  __kmalloc_noprof+0xfe/0x720
[  221.721044][ T5902]  ? kobject_get_path+0xc5/0x2f0
[  221.721063][ T5902]  ? kobject_get_path+0xc5/0x2f0
[  221.721089][ T5902]  kobject_get_path+0xc5/0x2f0
[  221.721115][ T5902]  kobject_uevent_env+0x29e/0x9e0
[  221.721137][ T5902]  rpc_sysfs_xprt_switch_destroy+0x51/0x90
[  221.721161][ T5902]  xprt_switch_put+0x33d/0x3c0
[  221.721185][ T5902]  rpc_new_client+0x844/0xc50
[  221.721210][ T5902]  rpc_create_xprt+0x29f/0xa90
[  221.721228][ T5902]  ? __pfx_rpc_create_xprt+0x10/0x10
[  221.721257][ T5902]  ? rcu_is_watching+0x15/0xb0
[  221.721276][ T5902]  ? trace_kmalloc+0x2a/0xf0
[  221.721299][ T5902]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  221.721321][ T5902]  ? br_mrp_rcv+0x248/0x2030
[  221.721339][ T5902]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  221.721360][ T5902]  ? xprt_create_transport+0x39b/0x5f0
[  221.721377][ T5902]  ? xprt_create_transport+0x39b/0x5f0
[  221.721393][ T5902]  ? kstrdup+0x81/0x100
[  221.721416][ T5902]  ? __asan_memcpy+0x40/0x70
[  221.721442][ T5902]  ? xprt_create_transport+0x438/0x5f0
[  221.721461][ T5902]  rpc_create+0x649/0x900
[  221.721486][ T5902]  ? __pfx_rpc_create+0x10/0x10
[  221.721536][ T5902]  ? __lock_acquire+0x683/0x2cf0
[  221.721562][ T5902]  rpcb_create_af_local+0x1c7/0x3c0
[  221.721579][ T5902]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  221.721613][ T5902]  ? do_raw_spin_unlock+0xf5/0x210
[  221.721637][ T5902]  rpcb_create_local+0x28f/0x670
[  221.721687][ T5902]  ? __pfx_rpcb_create_local+0x10/0x10
[  221.721703][ T5902]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  221.721720][ T5902]  ? lockdep_hardirqs_on+0x7a/0x110
[  221.721739][ T5902]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  221.721756][ T5902]  ? __percpu_counter_init_many+0x35f/0x380
[  221.721782][ T5902]  ? __svc_create+0x88f/0x990
[  221.721807][ T5902]  svc_bind+0x1b4/0x230
[  221.721827][ T5902]  nfsd_create_serv+0x581/0x840
[  221.721849][ T5902]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  221.721866][ T5902]  ? lockdep_hardirqs_on+0x7a/0x110
[  221.721887][ T5902]  ? __pfx_nfsd_create_serv+0x10/0x10
[  221.721909][ T5902]  ? net_generic+0x1e/0x240
[  221.721929][ T5902]  ? net_generic+0x1e/0x240
[  221.721953][ T5902]  ? net_generic+0x1e/0x240
[  221.721979][ T5902]  nfsd_svc+0x189/0x780
[  221.722004][ T5902]  write_threads+0x3cd/0x5a0
[  221.722019][ T5902]  ? __might_fault+0xaf/0x130
[  221.722040][ T5902]  ? __pfx_write_threads+0x10/0x10
[  221.722071][ T5902]  ? _copy_from_user+0x94/0xb0
[  221.722089][ T5902]  ? simple_transaction_get+0x12d/0x160
[  221.722109][ T5902]  nfsctl_transaction_write+0x10f/0x160
[  221.722126][ T5902]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  221.722143][ T5902]  vfs_write+0x296/0xba0
[  221.722167][ T5902]  ? __pfx_vfs_write+0x10/0x10
[  221.722193][ T5902]  ? _raw_spin_unlock_irq+0x23/0x50
[  221.722210][ T5902]  ? lockdep_hardirqs_on+0x7a/0x110
[  221.722234][ T5902]  ksys_write+0x150/0x270
[  221.722255][ T5902]  ? __pfx_ksys_write+0x10/0x10
[  221.722279][ T5902]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  221.722295][ T5902]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  221.722312][ T5902]  do_syscall_64+0x174/0x580
[  221.722329][ T5902]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  221.722345][ T5902]  ? clear_bhb_loop+0x70/0xc0
[  221.722365][ T5902]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  221.722380][ T5902] RIP: 0033:0x7f3343939df7
[  221.722397][ T5902] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  221.722411][ T5902] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  221.722428][ T5902] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  221.722440][ T5902] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  221.722450][ T5902] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  221.722460][ T5902] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  221.722470][ T5902] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d790
[  221.722496][ T5902]  </TASK>
[  221.723145][ T5902] FAULT_INJECTION: forcing a failure.
[  221.723145][ T5902] name failslab, interval 1, probability 5, space 0, times -1
[  221.914967][ T5902] CPU: 0 UID: 0 PID: 5902 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  221.914989][ T5902] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  221.914998][ T5902] Call Trace:
[  221.915005][ T5902]  <TASK>
[  221.915011][ T5902]  dump_stack_lvl+0xe8/0x150
[  221.915035][ T5902]  should_fail_ex+0x40c/0x560
[  221.915060][ T5902]  should_failslab+0xa8/0x100
[  221.915078][ T5902]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  221.915101][ T5902]  ? __kernfs_new_node+0xe6/0x980
[  221.915121][ T5902]  ? __kernfs_new_node+0xe6/0x980
[  221.915146][ T5902]  __kernfs_new_node+0xe6/0x980
[  221.915174][ T5902]  ? __pfx___kernfs_new_node+0x10/0x10
[  221.915194][ T5902]  ? kernfs_root+0x1c/0x230
[  221.915218][ T5902]  ? kernfs_root+0x1c/0x230
[  221.915236][ T5902]  ? kernfs_root+0x1c/0x230
[  221.915253][ T5902]  ? kernfs_root+0x1c/0x230
[  221.915275][ T5902]  kernfs_new_node+0xea/0x140
[  221.915297][ T5902]  __kernfs_create_file+0x4b/0x2e0
[  221.915314][ T5902]  sysfs_add_file_mode_ns+0x237/0x300
[  221.915338][ T5902]  internal_create_group+0x679/0x1180
[  221.915365][ T5902]  ? kernfs_create_dir_ns+0x1d5/0x230
[  221.915388][ T5902]  ? __pfx_internal_create_group+0x10/0x10
[  221.915407][ T5902]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  221.915427][ T5902]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  221.915450][ T5902]  sysfs_create_groups+0x59/0x120
[  221.915472][ T5902]  kobject_add_internal+0x669/0xcd0
[  221.915501][ T5902]  kobject_init_and_add+0x12b/0x1a0
[  221.915529][ T5902]  ? __pfx_kobject_init_and_add+0x10/0x10
[  221.915552][ T5902]  ? __kmalloc_cache_noprof+0x150/0x660
[  221.915573][ T5902]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  221.915593][ T5902]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  221.915619][ T5902]  rpc_sysfs_xprt_switch_setup+0x169/0x2b0
[  221.915791][ T5902]  xprt_switch_alloc+0x238/0x590
[  221.915815][ T5902]  rpc_create_xprt+0x1c7/0xa90
[  221.915833][ T5902]  ? __pfx_rpc_create_xprt+0x10/0x10
[  221.915863][ T5902]  ? rcu_is_watching+0x15/0xb0
[  221.915882][ T5902]  ? trace_kmalloc+0x2a/0xf0
[  221.915905][ T5902]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  221.915926][ T5902]  ? br_mrp_rcv+0x248/0x2030
[  221.915944][ T5902]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  221.915966][ T5902]  ? xprt_create_transport+0x39b/0x5f0
[  221.915982][ T5902]  ? xprt_create_transport+0x39b/0x5f0
[  221.915999][ T5902]  ? kstrdup+0x81/0x100
[  221.916021][ T5902]  ? __asan_memcpy+0x40/0x70
[  221.916047][ T5902]  ? xprt_create_transport+0x438/0x5f0
[  221.916067][ T5902]  rpc_create+0x649/0x900
[  221.916092][ T5902]  ? __pfx_rpc_create+0x10/0x10
[  221.916153][ T5902]  rpcb_create_local+0x3ab/0x670
[  221.916172][ T5902]  ? __pfx_rpcb_create_local+0x10/0x10
[  221.916200][ T5902]  ? __svc_create+0x88f/0x990
[  221.916225][ T5902]  svc_bind+0x1b4/0x230
[  221.916245][ T5902]  nfsd_create_serv+0x581/0x840
[  221.916267][ T5902]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  221.916285][ T5902]  ? lockdep_hardirqs_on+0x7a/0x110
[  221.916308][ T5902]  ? __pfx_nfsd_create_serv+0x10/0x10
[  221.916327][ T5902]  ? net_generic+0x1e/0x240
[  221.916345][ T5902]  ? net_generic+0x1e/0x240
[  221.916368][ T5902]  ? net_generic+0x1e/0x240
[  221.916394][ T5902]  nfsd_svc+0x189/0x780
[  221.916435][ T5902]  write_threads+0x3cd/0x5a0
[  221.916447][ T5902]  ? __might_fault+0xaf/0x130
[  221.916464][ T5902]  ? __pfx_write_threads+0x10/0x10
[  221.916488][ T5902]  ? _copy_from_user+0x94/0xb0
[  221.916503][ T5902]  ? simple_transaction_get+0x12d/0x160
[  221.916519][ T5902]  nfsctl_transaction_write+0x10f/0x160
[  221.916533][ T5902]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  221.916547][ T5902]  vfs_write+0x296/0xba0
[  221.916568][ T5902]  ? __pfx_vfs_write+0x10/0x10
[  221.916589][ T5902]  ? _raw_spin_unlock_irq+0x23/0x50
[  221.916602][ T5902]  ? lockdep_hardirqs_on+0x7a/0x110
[  221.916622][ T5902]  ksys_write+0x150/0x270
[  221.916665][ T5902]  ? __pfx_ksys_write+0x10/0x10
[  221.916683][ T5902]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  221.916697][ T5902]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  221.916710][ T5902]  do_syscall_64+0x174/0x580
[  221.916725][ T5902]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  221.916738][ T5902]  ? clear_bhb_loop+0x70/0xc0
[  221.916757][ T5902]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  221.916769][ T5902] RIP: 0033:0x7f3343939df7
[  221.916784][ T5902] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  221.916796][ T5902] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  221.916811][ T5902] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  221.916820][ T5902] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  221.916828][ T5902] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  221.916836][ T5902] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  221.916844][ T5902] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d790
[  221.916863][ T5902]  </TASK>
[  221.916979][ T5902] kobject: kobject_add_internal failed for switch-23 (error: -12 parent: xprt-switches)
[  222.135868][ T5902] FAULT_INJECTION: forcing a failure.
[  222.135868][ T5902] name failslab, interval 1, probability 5, space 0, times -1
[  222.141386][ T5902] CPU: 0 UID: 0 PID: 5902 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  222.141406][ T5902] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  222.141415][ T5902] Call Trace:
[  222.141423][ T5902]  <TASK>
[  222.141429][ T5902]  dump_stack_lvl+0xe8/0x150
[  222.141454][ T5902]  should_fail_ex+0x40c/0x560
[  222.141483][ T5902]  should_failslab+0xa8/0x100
[  222.141503][ T5902]  __kmalloc_cache_noprof+0xa8/0x660
[  222.141522][ T5902]  ? __pfx_xprt_get+0x10/0x10
[  222.141537][ T5902]  ? rpc_new_client+0x153/0xc50
[  222.141553][ T5902]  ? rpc_new_client+0x153/0xc50
[  222.141572][ T5902]  rpc_new_client+0x153/0xc50
[  222.141588][ T5902]  ? xprt_switch_alloc+0x420/0x590
[  222.141636][ T5902]  rpc_create_xprt+0x29f/0xa90
[  222.141653][ T5902]  ? __pfx_rpc_create_xprt+0x10/0x10
[  222.141678][ T5902]  ? rcu_is_watching+0x15/0xb0
[  222.141694][ T5902]  ? trace_kmalloc+0x2a/0xf0
[  222.141716][ T5902]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  222.141736][ T5902]  ? br_mrp_rcv+0x248/0x2030
[  222.141754][ T5902]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  222.141775][ T5902]  ? xprt_create_transport+0x39b/0x5f0
[  222.141791][ T5902]  ? xprt_create_transport+0x39b/0x5f0
[  222.141806][ T5902]  ? kstrdup+0x81/0x100
[  222.141828][ T5902]  ? __asan_memcpy+0x40/0x70
[  222.141852][ T5902]  ? xprt_create_transport+0x438/0x5f0
[  222.141872][ T5902]  rpc_create+0x649/0x900
[  222.141896][ T5902]  ? __pfx_rpc_create+0x10/0x10
[  222.141957][ T5902]  rpcb_create_local+0x3ab/0x670
[  222.141977][ T5902]  ? __pfx_rpcb_create_local+0x10/0x10
[  222.142004][ T5902]  ? __svc_create+0x88f/0x990
[  222.142029][ T5902]  svc_bind+0x1b4/0x230
[  222.142049][ T5902]  nfsd_create_serv+0x581/0x840
[  222.142072][ T5902]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  222.142098][ T5902]  ? lockdep_hardirqs_on+0x7a/0x110
[  222.142121][ T5902]  ? __pfx_nfsd_create_serv+0x10/0x10
[  222.142142][ T5902]  ? net_generic+0x1e/0x240
[  222.142162][ T5902]  ? net_generic+0x1e/0x240
[  222.142185][ T5902]  ? net_generic+0x1e/0x240
[  222.142211][ T5902]  nfsd_svc+0x189/0x780
[pid  6097] write(4, "tcp 2049\n", 9 <unfinished ...>
[pid  5902] <... write resumed>)        = -1 ENOMEM (Cannot allocate memory)
[  222.142236][ T5902]  write_threads+0x3cd/0x5a0
[pid  5902] openat(AT_FDCWD, "/proc/self/make-it-fail", O_WRONLY) = 5
[  222.142251][ T5902]  ? __might_fault+0xaf/0x130
[  222.142271][ T5902]  ? __pfx_write_threads+0x10/0x10
[pid  5902] write(5, "0", 1)            = 1
[pid  5902] close(5)                    = 0
[  222.142302][ T5902]  ? _copy_from_user+0x94/0xb0
[  222.142322][ T5902]  ? simple_transaction_get+0x12d/0x160
[  222.142342][ T5902]  nfsctl_transaction_write+0x10f/0x160
[  222.142360][ T5902]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  222.142377][ T5902]  vfs_write+0x296/0xba0
[  222.142402][ T5902]  ? __pfx_vfs_write+0x10/0x10
[  222.142428][ T5902]  ? _raw_spin_unlock_irq+0x23/0x50
[  222.142445][ T5902]  ? lockdep_hardirqs_on+0x7a/0x110
[  222.142468][ T5902]  ksys_write+0x150/0x270
[  222.142489][ T5902]  ? __pfx_ksys_write+0x10/0x10
[  222.142513][ T5902]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  222.142530][ T5902]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  222.142546][ T5902]  do_syscall_64+0x174/0x580
[  222.142563][ T5902]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  222.142578][ T5902]  ? clear_bhb_loop+0x70/0xc0
[  222.142597][ T5902]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  222.142641][ T5902] RIP: 0033:0x7f3343939df7
[  222.142760][ T5902] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  222.142773][ T5902] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  222.142791][ T5902] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  222.142803][ T5902] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  222.142812][ T5902] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  222.142821][ T5902] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  222.142831][ T5902] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d790
[  222.142855][ T5902]  </TASK>
[  222.143506][ T6004] FAULT_INJECTION: forcing a failure.
[  222.143506][ T6004] name failslab, interval 1, probability 5, space 0, times -1
[  222.322723][ T6004] CPU: 0 UID: 0 PID: 6004 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  222.322747][ T6004] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  222.322757][ T6004] Call Trace:
[  222.322765][ T6004]  <TASK>
[  222.322772][ T6004]  dump_stack_lvl+0xe8/0x150
[  222.322801][ T6004]  should_fail_ex+0x40c/0x560
[  222.322829][ T6004]  should_failslab+0xa8/0x100
[  222.322850][ T6004]  __kmalloc_node_track_caller_noprof+0x100/0x730
[  222.322876][ T6004]  ? xprt_create_transport+0x39b/0x5f0
[  222.322895][ T6004]  ? xprt_create_transport+0x39b/0x5f0
[  222.322917][ T6004]  kstrdup+0x42/0x100
[  222.322942][ T6004]  xprt_create_transport+0x39b/0x5f0
[  222.322963][ T6004]  rpc_create+0x4ff/0x900
[  222.322989][ T6004]  ? __pfx_rpc_create+0x10/0x10
[  222.323040][ T6004]  ? __lock_acquire+0x683/0x2cf0
[  222.323065][ T6004]  rpcb_create_af_local+0x1c7/0x3c0
[  222.323083][ T6004]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  222.323117][ T6004]  ? do_raw_spin_unlock+0xf5/0x210
[  222.323141][ T6004]  rpcb_create_local+0x268/0x670
[  222.323159][ T6004]  ? __pfx_rpcb_create_local+0x10/0x10
[  222.323174][ T6004]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  222.323193][ T6004]  ? lockdep_hardirqs_on+0x7a/0x110
[  222.323210][ T6004]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  222.323228][ T6004]  ? __percpu_counter_init_many+0x35f/0x380
[  222.323254][ T6004]  ? __svc_create+0x88f/0x990
[  222.323279][ T6004]  svc_bind+0x1b4/0x230
[  222.323300][ T6004]  nfsd_create_serv+0x581/0x840
[  222.323321][ T6004]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  222.323338][ T6004]  ? lockdep_hardirqs_on+0x7a/0x110
[  222.323360][ T6004]  ? __pfx_nfsd_create_serv+0x10/0x10
[  222.323382][ T6004]  ? net_generic+0x1e/0x240
[  222.323402][ T6004]  ? net_generic+0x1e/0x240
[  222.323426][ T6004]  ? net_generic+0x1e/0x240
[  222.323452][ T6004]  nfsd_svc+0x189/0x780
[  222.323479][ T6004]  write_threads+0x3cd/0x5a0
[  222.323494][ T6004]  ? __might_fault+0xaf/0x130
[  222.323516][ T6004]  ? __pfx_write_threads+0x10/0x10
[  222.323546][ T6004]  ? _copy_from_user+0x94/0xb0
[  222.323637][ T6004]  ? simple_transaction_get+0x12d/0x160
[  222.323657][ T6004]  nfsctl_transaction_write+0x10f/0x160
[  222.323675][ T6004]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  222.323692][ T6004]  vfs_write+0x296/0xba0
[  222.323725][ T6004]  ? __pfx_vfs_write+0x10/0x10
[  222.323752][ T6004]  ? _raw_spin_unlock_irq+0x23/0x50
[  222.323768][ T6004]  ? lockdep_hardirqs_on+0x7a/0x110
[  222.323793][ T6004]  ksys_write+0x150/0x270
[  222.323814][ T6004]  ? __pfx_ksys_write+0x10/0x10
[  222.323838][ T6004]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  222.323855][ T6004]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  222.323872][ T6004]  do_syscall_64+0x174/0x580
[  222.323891][ T6004]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  222.323907][ T6004]  ? clear_bhb_loop+0x70/0xc0
[  222.323926][ T6004]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  222.323941][ T6004] RIP: 0033:0x7f3343939df7
[  222.323957][ T6004] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  222.323971][ T6004] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  222.323989][ T6004] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  222.324001][ T6004] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  222.324011][ T6004] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  222.324020][ T6004] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  222.324031][ T6004] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d8ec
[  222.324056][ T6004]  </TASK>
[  222.324428][ T6004] FAULT_INJECTION: forcing a failure.
[  222.324428][ T6004] name failslab, interval 1, probability 5, space 0, times -1
[  222.481529][ T6004] CPU: 0 UID: 0 PID: 6004 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  222.481550][ T6004] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  222.481559][ T6004] Call Trace:
[  222.481565][ T6004]  <TASK>
[  222.481601][ T6004]  dump_stack_lvl+0xe8/0x150
[  222.481672][ T6004]  should_fail_ex+0x40c/0x560
[  222.481703][ T6004]  should_failslab+0xa8/0x100
[  222.481722][ T6004]  __kmalloc_cache_noprof+0xa8/0x660
[  222.481762][ T6004]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  222.481783][ T6004]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  222.481807][ T6004]  rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  222.481876][ T6004]  xprt_switch_alloc+0x238/0x590
[  222.481900][ T6004]  rpc_create_xprt+0x1c7/0xa90
[  222.481918][ T6004]  ? __pfx_rpc_create_xprt+0x10/0x10
[  222.481948][ T6004]  ? rcu_is_watching+0x15/0xb0
[  222.481967][ T6004]  ? trace_kmalloc+0x2a/0xf0
[  222.481990][ T6004]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  222.482013][ T6004]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  222.482035][ T6004]  ? xprt_create_transport+0x39b/0x5f0
[  222.482051][ T6004]  ? xprt_create_transport+0x39b/0x5f0
[  222.482067][ T6004]  ? kstrdup+0x81/0x100
[  222.482089][ T6004]  ? __asan_memcpy+0x40/0x70
[  222.482115][ T6004]  ? xprt_create_transport+0x438/0x5f0
[  222.482135][ T6004]  rpc_create+0x649/0x900
[  222.482159][ T6004]  ? __pfx_rpc_create+0x10/0x10
[  222.482207][ T6004]  ? __lock_acquire+0x683/0x2cf0
[  222.482232][ T6004]  rpcb_create_af_local+0x1c7/0x3c0
[  222.482249][ T6004]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  222.482283][ T6004]  ? do_raw_spin_unlock+0xf5/0x210
[  222.482307][ T6004]  rpcb_create_local+0x28f/0x670
[  222.482325][ T6004]  ? __pfx_rpcb_create_local+0x10/0x10
[  222.482340][ T6004]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  222.482358][ T6004]  ? lockdep_hardirqs_on+0x7a/0x110
[  222.482377][ T6004]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  222.482394][ T6004]  ? __percpu_counter_init_many+0x35f/0x380
[  222.482420][ T6004]  ? __svc_create+0x88f/0x990
[  222.482445][ T6004]  svc_bind+0x1b4/0x230
[  222.482466][ T6004]  nfsd_create_serv+0x581/0x840
[  222.482488][ T6004]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  222.482504][ T6004]  ? lockdep_hardirqs_on+0x7a/0x110
[  222.482526][ T6004]  ? __pfx_nfsd_create_serv+0x10/0x10
[  222.482548][ T6004]  ? net_generic+0x1e/0x240
[  222.482594][ T6004]  ? net_generic+0x1e/0x240
[  222.482618][ T6004]  ? net_generic+0x1e/0x240
[  222.482644][ T6004]  nfsd_svc+0x189/0x780
[  222.482669][ T6004]  write_threads+0x3cd/0x5a0
[  222.482691][ T6004]  ? __might_fault+0xaf/0x130
[  222.482711][ T6004]  ? __pfx_write_threads+0x10/0x10
[  222.482740][ T6004]  ? _copy_from_user+0x94/0xb0
[  222.482759][ T6004]  ? simple_transaction_get+0x12d/0x160
[  222.482779][ T6004]  nfsctl_transaction_write+0x10f/0x160
[  222.482797][ T6004]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  222.482814][ T6004]  vfs_write+0x296/0xba0
[  222.482841][ T6004]  ? __pfx_vfs_write+0x10/0x10
[  222.482868][ T6004]  ? _raw_spin_unlock_irq+0x23/0x50
[  222.482903][ T6004]  ? lockdep_hardirqs_on+0x7a/0x110
[  222.482927][ T6004]  ksys_write+0x150/0x270
[  222.482949][ T6004]  ? __pfx_ksys_write+0x10/0x10
[  222.482973][ T6004]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  222.482991][ T6004]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  222.483007][ T6004]  do_syscall_64+0x174/0x580
[  222.483026][ T6004]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  222.483042][ T6004]  ? clear_bhb_loop+0x70/0xc0
[  222.483061][ T6004]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  222.483077][ T6004] RIP: 0033:0x7f3343939df7
[  222.483093][ T6004] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  222.483107][ T6004] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  222.483125][ T6004] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  222.483137][ T6004] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  222.483147][ T6004] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  222.483157][ T6004] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  222.483167][ T6004] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d8ec
[  222.483191][ T6004]  </TASK>
[  222.483600][ T6004] FAULT_INJECTION: forcing a failure.
[  222.483600][ T6004] name failslab, interval 1, probability 5, space 0, times -1
[  222.665528][ T6004] CPU: 0 UID: 0 PID: 6004 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  222.665663][ T6004] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  222.665674][ T6004] Call Trace:
[  222.665682][ T6004]  <TASK>
[  222.665690][ T6004]  dump_stack_lvl+0xe8/0x150
[  222.665719][ T6004]  should_fail_ex+0x40c/0x560
[  222.665749][ T6004]  should_failslab+0xa8/0x100
[  222.665769][ T6004]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  222.665793][ T6004]  ? pidfs_register_pid_gfp+0xab/0x1c0
[  222.665810][ T6004]  ? pidfs_register_pid_gfp+0xab/0x1c0
[  222.665833][ T6004]  pidfs_register_pid_gfp+0xab/0x1c0
[  222.665854][ T6004]  unix_stream_connect+0x276/0xfd0
[  222.665885][ T6004]  kernel_connect+0x141/0x1c0
[  222.665906][ T6004]  ? __pfx_kernel_connect+0x10/0x10
[  222.665936][ T6004]  ? __local_bh_enable_ip+0xd0/0x130
[  222.665961][ T6004]  xs_local_connect+0x626/0x810
[  222.665984][ T6004]  ? __pfx_xs_local_connect+0x10/0x10
[  222.666006][ T6004]  ? do_raw_spin_unlock+0xf5/0x210
[  222.666032][ T6004]  xprt_connect+0x613/0x850
[  222.666063][ T6004]  ? __pfx_call_connect+0x10/0x10
[  222.666085][ T6004]  __rpc_execute+0x526/0x1280
[  222.666120][ T6004]  ? __pfx___rpc_execute+0x10/0x10
[  222.666144][ T6004]  ? rpc_task_get_xprt+0x26/0x250
[  222.666163][ T6004]  ? rpc_make_runnable+0xae/0x1c0
[  222.666187][ T6004]  rpc_execute+0x1c1/0x390
[  222.666210][ T6004]  rpc_run_task+0x4a6/0x660
[  222.666231][ T6004]  rpc_create_xprt+0x533/0xa90
[  222.666249][ T6004]  ? __pfx_rpc_create_xprt+0x10/0x10
[  222.666281][ T6004]  ? rcu_is_watching+0x15/0xb0
[  222.666300][ T6004]  ? trace_kmalloc+0x2a/0xf0
[  222.666326][ T6004]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  222.666349][ T6004]  ? xprt_create_transport+0x39b/0x5f0
[  222.666377][ T6004]  ? xprt_create_transport+0x438/0x5f0
[  222.666397][ T6004]  rpc_create+0x649/0x900
[  222.666422][ T6004]  ? __pfx_rpc_create+0x10/0x10
[  222.666475][ T6004]  ? __lock_acquire+0x683/0x2cf0
[  222.666502][ T6004]  rpcb_create_af_local+0x1c7/0x3c0
[  222.666520][ T6004]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  222.666585][ T6004]  ? do_raw_spin_unlock+0xf5/0x210
[  222.666610][ T6004]  rpcb_create_local+0x28f/0x670
[  222.666628][ T6004]  ? __pfx_rpcb_create_local+0x10/0x10
[  222.666644][ T6004]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  222.666663][ T6004]  ? lockdep_hardirqs_on+0x7a/0x110
[  222.666683][ T6004]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  222.666701][ T6004]  ? __percpu_counter_init_many+0x35f/0x380
[  222.666728][ T6004]  ? __svc_create+0x88f/0x990
[  222.666755][ T6004]  svc_bind+0x1b4/0x230
[  222.666776][ T6004]  nfsd_create_serv+0x581/0x840
[  222.666799][ T6004]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  222.666817][ T6004]  ? lockdep_hardirqs_on+0x7a/0x110
[  222.666840][ T6004]  ? __pfx_nfsd_create_serv+0x10/0x10
[  222.666863][ T6004]  ? net_generic+0x1e/0x240
[  222.666884][ T6004]  ? net_generic+0x1e/0x240
[  222.666909][ T6004]  ? net_generic+0x1e/0x240
[  222.666937][ T6004]  nfsd_svc+0x189/0x780
[  222.666963][ T6004]  write_threads+0x3cd/0x5a0
[  222.666979][ T6004]  ? __might_fault+0xaf/0x130
[  222.667000][ T6004]  ? __pfx_write_threads+0x10/0x10
[  222.667031][ T6004]  ? _copy_from_user+0x94/0xb0
[  222.667057][ T6004]  ? simple_transaction_get+0x12d/0x160
[  222.667078][ T6004]  nfsctl_transaction_write+0x10f/0x160
[  222.667097][ T6004]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  222.667114][ T6004]  vfs_write+0x296/0xba0
[  222.667141][ T6004]  ? __pfx_vfs_write+0x10/0x10
[  222.667169][ T6004]  ? _raw_spin_unlock_irq+0x23/0x50
[  222.667187][ T6004]  ? lockdep_hardirqs_on+0x7a/0x110
[  222.667212][ T6004]  ksys_write+0x150/0x270
[  222.667234][ T6004]  ? __pfx_ksys_write+0x10/0x10
[  222.667259][ T6004]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  222.667276][ T6004]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  222.667293][ T6004]  do_syscall_64+0x174/0x580
[  222.667312][ T6004]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  222.667329][ T6004]  ? clear_bhb_loop+0x70/0xc0
[  222.667348][ T6004]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  222.667364][ T6004] RIP: 0033:0x7f3343939df7
[  222.667381][ T6004] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  222.667396][ T6004] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  222.667413][ T6004] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  222.667425][ T6004] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  222.667435][ T6004] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  222.667445][ T6004] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  222.667456][ T6004] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d8ec
[  222.667481][ T6004]  </TASK>
[  222.667490][ T6004] xs_local_setup_socket: unhandled error (12) connecting to /var/run/rpcbind.sock
[  222.897074][ T6004] FAULT_INJECTION: forcing a failure.
[  222.897074][ T6004] name failslab, interval 1, probability 5, space 0, times -1
[  222.902139][ T6004] CPU: 0 UID: 0 PID: 6004 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  222.902160][ T6004] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  222.902168][ T6004] Call Trace:
[  222.902174][ T6004]  <TASK>
[  222.902179][ T6004]  dump_stack_lvl+0xe8/0x150
[  222.902203][ T6004]  should_fail_ex+0x40c/0x560
[  222.902230][ T6004]  should_failslab+0xa8/0x100
[  222.902248][ T6004]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  222.902268][ T6004]  ? __kernfs_new_node+0xe6/0x980
[  222.902285][ T6004]  ? __kernfs_new_node+0xe6/0x980
[  222.902309][ T6004]  __kernfs_new_node+0xe6/0x980
[  222.902333][ T6004]  ? __pfx___kernfs_new_node+0x10/0x10
[  222.902354][ T6004]  ? kernfs_root+0x1c/0x230
[  222.902378][ T6004]  ? kernfs_root+0x1c/0x230
[  222.902397][ T6004]  ? kernfs_root+0x1c/0x230
[  222.902415][ T6004]  ? kernfs_root+0x1c/0x230
[  222.902438][ T6004]  kernfs_new_node+0xea/0x140
[  222.902462][ T6004]  __kernfs_create_file+0x4b/0x2e0
[  222.902480][ T6004]  sysfs_add_file_mode_ns+0x237/0x300
[  222.902504][ T6004]  internal_create_group+0x679/0x1180
[  222.902561][ T6004]  ? kernfs_create_dir_ns+0x1d5/0x230
[  222.902586][ T6004]  ? __pfx_internal_create_group+0x10/0x10
[  222.902605][ T6004]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  222.902625][ T6004]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  222.902648][ T6004]  sysfs_create_groups+0x59/0x120
[  222.902676][ T6004]  kobject_add_internal+0x669/0xcd0
[  222.902706][ T6004]  kobject_init_and_add+0x12b/0x1a0
[  222.902732][ T6004]  ? __pfx_kobject_init_and_add+0x10/0x10
[  222.902755][ T6004]  ? __kmalloc_cache_noprof+0x150/0x660
[  222.902774][ T6004]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  222.902793][ T6004]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  222.902816][ T6004]  rpc_sysfs_xprt_switch_setup+0x169/0x2b0
[  222.902837][ T6004]  xprt_switch_alloc+0x238/0x590
[  222.902860][ T6004]  rpc_create_xprt+0x1c7/0xa90
[  222.902879][ T6004]  ? __pfx_rpc_create_xprt+0x10/0x10
[  222.902907][ T6004]  ? rcu_is_watching+0x15/0xb0
[  222.902926][ T6004]  ? trace_kmalloc+0x2a/0xf0
[  222.902949][ T6004]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  222.902972][ T6004]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  222.902993][ T6004]  ? xprt_create_transport+0x39b/0x5f0
[  222.903009][ T6004]  ? xprt_create_transport+0x39b/0x5f0
[  222.903026][ T6004]  ? kstrdup+0x81/0x100
[  222.903049][ T6004]  ? __asan_memcpy+0x40/0x70
[  222.903075][ T6004]  ? xprt_create_transport+0x438/0x5f0
[  222.903094][ T6004]  rpc_create+0x649/0x900
[  222.903117][ T6004]  ? __pfx_rpc_create+0x10/0x10
[  222.903178][ T6004]  rpcb_create_local+0x3ab/0x670
[  222.903197][ T6004]  ? __pfx_rpcb_create_local+0x10/0x10
[  222.903224][ T6004]  ? __svc_create+0x88f/0x990
[  222.903249][ T6004]  svc_bind+0x1b4/0x230
[  222.903270][ T6004]  nfsd_create_serv+0x581/0x840
[  222.903290][ T6004]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  222.903310][ T6004]  ? lockdep_hardirqs_on+0x7a/0x110
[  222.903333][ T6004]  ? __pfx_nfsd_create_serv+0x10/0x10
[  222.903355][ T6004]  ? net_generic+0x1e/0x240
[  222.903376][ T6004]  ? net_generic+0x1e/0x240
[  222.903400][ T6004]  ? net_generic+0x1e/0x240
[  222.903426][ T6004]  nfsd_svc+0x189/0x780
[  222.903452][ T6004]  write_threads+0x3cd/0x5a0
[  222.903467][ T6004]  ? __might_fault+0xaf/0x130
[  222.903489][ T6004]  ? __pfx_write_threads+0x10/0x10
[  222.903519][ T6004]  ? _copy_from_user+0x94/0xb0
[  222.903566][ T6004]  ? simple_transaction_get+0x12d/0x160
[  222.903586][ T6004]  nfsctl_transaction_write+0x10f/0x160
[  222.903602][ T6004]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  222.903618][ T6004]  vfs_write+0x296/0xba0
[  222.903642][ T6004]  ? __pfx_vfs_write+0x10/0x10
[  222.903674][ T6004]  ? _raw_spin_unlock_irq+0x23/0x50
[  222.903690][ T6004]  ? lockdep_hardirqs_on+0x7a/0x110
[  222.903715][ T6004]  ksys_write+0x150/0x270
[  222.903736][ T6004]  ? __pfx_ksys_write+0x10/0x10
[  222.903760][ T6004]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  222.903776][ T6004]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  222.903793][ T6004]  do_syscall_64+0x174/0x580
[  222.903812][ T6004]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  222.903827][ T6004]  ? clear_bhb_loop+0x70/0xc0
[  222.903847][ T6004]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  222.903862][ T6004] RIP: 0033:0x7f3343939df7
[  222.903879][ T6004] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  222.903892][ T6004] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  222.903909][ T6004] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  222.903921][ T6004] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  222.903930][ T6004] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  222.903939][ T6004] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  222.903949][ T6004] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d8ec
[  222.903974][ T6004]  </TASK>
[  222.904098][ T6004] kobject: kobject_add_internal failed for switch-23 (error: -12 parent: xprt-switches)
[  223.126661][ T6004] FAULT_INJECTION: forcing a failure.
[  223.126661][ T6004] name failslab, interval 1, probability 5, space 0, times -1
[  223.132135][ T6004] CPU: 0 UID: 0 PID: 6004 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  223.132158][ T6004] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  223.132168][ T6004] Call Trace:
[  223.132176][ T6004]  <TASK>
[  223.132184][ T6004]  dump_stack_lvl+0xe8/0x150
[  223.132212][ T6004]  should_fail_ex+0x40c/0x560
[  223.132240][ T6004]  should_failslab+0xa8/0x100
[  223.132260][ T6004]  __kmalloc_noprof+0xfe/0x720
[  223.132282][ T6004]  ? __pfx_ida_alloc_range+0x10/0x10
[  223.132301][ T6004]  ? __kasan_kmalloc+0x93/0xb0
[  223.132317][ T6004]  ? rpc_alloc_iostats+0x4f/0x140
[  223.132336][ T6004]  ? rpc_alloc_iostats+0x4f/0x140
[  223.132354][ T6004]  ? __kmalloc_cache_noprof+0x150/0x660
[  223.132378][ T6004]  rpc_alloc_iostats+0x4f/0x140
[  223.132400][ T6004]  rpc_new_client+0x456/0xc50
[  223.132426][ T6004]  __rpc_clone_client+0x342/0x7a0
[  223.132444][ T6004]  rpc_bind_new_program+0x25c/0x530
[  223.132461][ T6004]  ? __pfx_rpc_create+0x10/0x10
[  223.132484][ T6004]  ? __pfx_rpc_bind_new_program+0x10/0x10
[  223.132680][ T6004]  rpcb_create_local+0x3ed/0x670
[  223.132701][ T6004]  ? __pfx_rpcb_create_local+0x10/0x10
[  223.132727][ T6004]  ? __svc_create+0x88f/0x990
[  223.132753][ T6004]  svc_bind+0x1b4/0x230
[  223.132773][ T6004]  nfsd_create_serv+0x581/0x840
[  223.132796][ T6004]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  223.132814][ T6004]  ? lockdep_hardirqs_on+0x7a/0x110
[  223.132837][ T6004]  ? __pfx_nfsd_create_serv+0x10/0x10
[  223.132858][ T6004]  ? net_generic+0x1e/0x240
[  223.132878][ T6004]  ? net_generic+0x1e/0x240
[  223.132903][ T6004]  ? net_generic+0x1e/0x240
[  223.132929][ T6004]  nfsd_svc+0x189/0x780
[  223.132954][ T6004]  write_threads+0x3cd/0x5a0
[  223.132969][ T6004]  ? __might_fault+0xaf/0x130
[  223.132990][ T6004]  ? __pfx_write_threads+0x10/0x10
[  223.133020][ T6004]  ? _copy_from_user+0x94/0xb0
[  223.133039][ T6004]  ? simple_transaction_get+0x12d/0x160
[  223.133059][ T6004]  nfsctl_transaction_write+0x10f/0x160
[  223.133076][ T6004]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  223.133092][ T6004]  vfs_write+0x296/0xba0
[  223.133124][ T6004]  ? __pfx_vfs_write+0x10/0x10
[  223.133150][ T6004]  ? _raw_spin_unlock_irq+0x23/0x50
[  223.133167][ T6004]  ? lockdep_hardirqs_on+0x7a/0x110
[  223.133191][ T6004]  ksys_write+0x150/0x270
[  223.133212][ T6004]  ? __pfx_ksys_write+0x10/0x10
[  223.133236][ T6004]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.133252][ T6004]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.133269][ T6004]  do_syscall_64+0x174/0x580
[  223.133287][ T6004]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.133303][ T6004]  ? clear_bhb_loop+0x70/0xc0
[  223.133321][ T6004]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.133336][ T6004] RIP: 0033:0x7f3343939df7
[  223.133420][ T6004] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  223.133435][ T6004] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  223.133453][ T6004] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  223.133465][ T6004] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  223.133475][ T6004] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  223.133524][ T6004] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  223.133535][ T6004] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d8ec
[  223.133560][ T6004]  </TASK>
[  223.136044][ T6004] FAULT_INJECTION: forcing a failure.
[  223.136044][ T6004] name failslab, interval 1, probability 5, space 0, times -1
[  223.291178][ T6004] CPU: 0 UID: 0 PID: 6004 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  223.291203][ T6004] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  223.291214][ T6004] Call Trace:
[  223.291222][ T6004]  <TASK>
[  223.291230][ T6004]  dump_stack_lvl+0xe8/0x150
[  223.291258][ T6004]  should_fail_ex+0x40c/0x560
[  223.291286][ T6004]  should_failslab+0xa8/0x100
[  223.291305][ T6004]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  223.291327][ T6004]  ? rpc_new_task+0xf3/0x800
[  223.291347][ T6004]  ? rpc_new_task+0xf3/0x800
[  223.291373][ T6004]  rpc_new_task+0xf3/0x800
[  223.291393][ T6004]  ? __lock_acquire+0x683/0x2cf0
[  223.291413][ T6004]  ? __pfx_rpc_new_task+0x10/0x10
[  223.291434][ T6004]  ? __pfx_mempool_free_slab+0x10/0x10
[  223.291456][ T6004]  ? mempool_free+0xec/0x130
[  223.291476][ T6004]  ? __pfx_mempool_free+0x10/0x10
[  223.291533][ T6004]  ? put_rpccred+0x74/0x960
[  223.291556][ T6004]  rpc_run_task+0x22/0x660
[  223.291578][ T6004]  rpc_call_sync+0x10f/0x200
[  223.291595][ T6004]  ? __pfx_rpc_call_sync+0x10/0x10
[  223.291619][ T6004]  ? net_generic+0x1e/0x240
[  223.291635][ T6004]  ? net_generic+0x1e/0x240
[  223.291655][ T6004]  rpcb_register+0x2d0/0x530
[  223.291673][ T6004]  ? __pfx_rpcb_register+0x10/0x10
[  223.291688][ T6004]  ? net_generic+0x1e/0x240
[  223.291708][ T6004]  ? rpcb_create_local+0x4ee/0x670
[  223.291726][ T6004]  ? __pfx_rpcb_create_local+0x10/0x10
[  223.291751][ T6004]  svc_unregister+0x24d/0x780
[  223.291780][ T6004]  svc_bind+0x1e9/0x230
[  223.291801][ T6004]  nfsd_create_serv+0x581/0x840
[  223.291824][ T6004]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  223.291844][ T6004]  ? lockdep_hardirqs_on+0x7a/0x110
[  223.291867][ T6004]  ? __pfx_nfsd_create_serv+0x10/0x10
[  223.291890][ T6004]  ? net_generic+0x1e/0x240
[  223.291911][ T6004]  ? net_generic+0x1e/0x240
[  223.291936][ T6004]  ? net_generic+0x1e/0x240
[  223.291963][ T6004]  nfsd_svc+0x189/0x780
[  223.291990][ T6004]  write_threads+0x3cd/0x5a0
[  223.292005][ T6004]  ? __might_fault+0xaf/0x130
[  223.292026][ T6004]  ? __pfx_write_threads+0x10/0x10
[  223.292076][ T6004]  ? _copy_from_user+0x94/0xb0
[  223.292096][ T6004]  ? simple_transaction_get+0x12d/0x160
[  223.292116][ T6004]  nfsctl_transaction_write+0x10f/0x160
[  223.292134][ T6004]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  223.292157][ T6004]  vfs_write+0x296/0xba0
[  223.292184][ T6004]  ? __pfx_vfs_write+0x10/0x10
[  223.292211][ T6004]  ? _raw_spin_unlock_irq+0x23/0x50
[  223.292229][ T6004]  ? lockdep_hardirqs_on+0x7a/0x110
[  223.292254][ T6004]  ksys_write+0x150/0x270
[  223.292276][ T6004]  ? __pfx_ksys_write+0x10/0x10
[  223.292301][ T6004]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.292317][ T6004]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.292331][ T6004]  do_syscall_64+0x174/0x580
[  223.292348][ T6004]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.292365][ T6004]  ? clear_bhb_loop+0x70/0xc0
[  223.292381][ T6004]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.292394][ T6004] RIP: 0033:0x7f3343939df7
[  223.292410][ T6004] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  223.292422][ T6004] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  223.292439][ T6004] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  223.292451][ T6004] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  223.292462][ T6004] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  223.292471][ T6004] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  223.292507][ T6004] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d8ec
[  223.292534][ T6004]  </TASK>
[  223.294562][ T6004] FAULT_INJECTION: forcing a failure.
[  223.294562][ T6004] name failslab, interval 1, probability 5, space 0, times -1
[  223.482370][ T6004] CPU: 0 UID: 0 PID: 6004 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  223.482393][ T6004] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  223.482402][ T6004] Call Trace:
[  223.482410][ T6004]  <TASK>
[  223.482417][ T6004]  dump_stack_lvl+0xe8/0x150
[  223.482445][ T6004]  should_fail_ex+0x40c/0x560
[  223.482663][ T6004]  should_failslab+0xa8/0x100
[  223.482683][ T6004]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  223.482704][ T6004]  ? __kernfs_new_node+0xe6/0x980
[  223.482721][ T6004]  ? __kernfs_new_node+0xe6/0x980
[  223.482744][ T6004]  __kernfs_new_node+0xe6/0x980
[  223.482767][ T6004]  ? __pfx___kernfs_new_node+0x10/0x10
[  223.482784][ T6004]  ? kernfs_root+0x1c/0x230
[  223.482804][ T6004]  ? kernfs_root+0x1c/0x230
[  223.482820][ T6004]  ? kernfs_root+0x1c/0x230
[  223.482833][ T6004]  ? kernfs_root+0x1c/0x230
[  223.482854][ T6004]  kernfs_new_node+0xea/0x140
[  223.482874][ T6004]  __kernfs_create_file+0x4b/0x2e0
[  223.482891][ T6004]  sysfs_add_file_mode_ns+0x237/0x300
[  223.482911][ T6004]  internal_create_group+0x679/0x1180
[  223.482935][ T6004]  ? kernfs_create_dir_ns+0x1d5/0x230
[  223.482956][ T6004]  ? __pfx_internal_create_group+0x10/0x10
[  223.482973][ T6004]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  223.482991][ T6004]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  223.483084][ T6004]  sysfs_create_groups+0x59/0x120
[  223.483105][ T6004]  kobject_add_internal+0x669/0xcd0
[  223.483129][ T6004]  kobject_init_and_add+0x12b/0x1a0
[  223.483152][ T6004]  ? __pfx_kobject_init_and_add+0x10/0x10
[  223.483173][ T6004]  ? kernfs_remove_by_name_ns+0x101/0x140
[  223.483198][ T6004]  ? kernfs_remove_by_name_ns+0x101/0x140
[  223.483220][ T6004]  sysfs_slab_add+0x7b/0x260
[  223.483237][ T6004]  do_kmem_cache_create+0x8bf/0x970
[  223.483257][ T6004]  __kmem_cache_create_args+0x307/0x440
[  223.483276][ T6004]  nfsd_file_cache_init+0x197/0x530
[  223.483296][ T6004]  ? __pfx_nfsd_file_cache_init+0x10/0x10
[  223.483313][ T6004]  ? net_generic+0x1e/0x240
[  223.483338][ T6004]  ? net_generic+0x1e/0x240
[  223.483353][ T6004]  ? net_generic+0x1e/0x240
[  223.483368][ T6004]  ? net_generic+0x1e/0x240
[  223.483385][ T6004]  ? net_generic+0x1f4/0x240
[  223.483402][ T6004]  nfsd_svc+0x315/0x780
[  223.483425][ T6004]  write_threads+0x3cd/0x5a0
[  223.483439][ T6004]  ? __might_fault+0xaf/0x130
[  223.483458][ T6004]  ? __pfx_write_threads+0x10/0x10
[  223.483521][ T6004]  ? _copy_from_user+0x94/0xb0
[  223.483540][ T6004]  ? simple_transaction_get+0x12d/0x160
[  223.483558][ T6004]  nfsctl_transaction_write+0x10f/0x160
[  223.483582][ T6004]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  223.483596][ T6004]  vfs_write+0x296/0xba0
[  223.483619][ T6004]  ? __pfx_vfs_write+0x10/0x10
[  223.483643][ T6004]  ? _raw_spin_unlock_irq+0x23/0x50
[  223.483659][ T6004]  ? lockdep_hardirqs_on+0x7a/0x110
[  223.483683][ T6004]  ksys_write+0x150/0x270
[  223.483702][ T6004]  ? __pfx_ksys_write+0x10/0x10
[  223.483723][ T6004]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.483739][ T6004]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.483754][ T6004]  do_syscall_64+0x174/0x580
[  223.483771][ T6004]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.483786][ T6004]  ? clear_bhb_loop+0x70/0xc0
[  223.483803][ T6004]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.483817][ T6004] RIP: 0033:0x7f3343939df7
[  223.483834][ T6004] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  223.483846][ T6004] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  223.483863][ T6004] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  223.483872][ T6004] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  223.483881][ T6004] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  223.483889][ T6004] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  223.483899][ T6004] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d8ec
[  223.483921][ T6004]  </TASK>
[  223.484513][ T6004] kobject: kobject_add_internal failed for nfsd_file (error: -12 parent: slab)
[  223.680762][ T6004] SLUB: Unable to add cache nfsd_file to sysfs
[  223.684248][ T6004] FAULT_INJECTION: forcing a failure.
[  223.684248][ T6004] name failslab, interval 1, probability 5, space 0, times -1
[  223.689562][ T6004] CPU: 0 UID: 0 PID: 6004 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  223.689582][ T6004] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  223.689591][ T6004] Call Trace:
[  223.689598][ T6004]  <TASK>
[  223.689605][ T6004]  dump_stack_lvl+0xe8/0x150
[  223.689632][ T6004]  should_fail_ex+0x40c/0x560
[  223.689659][ T6004]  should_failslab+0xa8/0x100
[  223.689677][ T6004]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  223.689699][ T6004]  ? __kernfs_new_node+0xe6/0x980
[  223.689716][ T6004]  ? __kernfs_new_node+0xe6/0x980
[  223.689739][ T6004]  __kernfs_new_node+0xe6/0x980
[  223.689764][ T6004]  ? __pfx___kernfs_new_node+0x10/0x10
[  223.689784][ T6004]  ? kernfs_root+0x1c/0x230
[  223.689805][ T6004]  ? kernfs_root+0x1c/0x230
[  223.689823][ T6004]  ? kernfs_root+0x1c/0x230
[  223.689839][ T6004]  ? kernfs_root+0x1c/0x230
[  223.689860][ T6004]  kernfs_new_node+0xea/0x140
[  223.689883][ T6004]  __kernfs_create_file+0x4b/0x2e0
[  223.689900][ T6004]  sysfs_add_file_mode_ns+0x237/0x300
[  223.689924][ T6004]  internal_create_group+0x679/0x1180
[  223.689948][ T6004]  ? kernfs_create_dir_ns+0x1d5/0x230
[  223.689971][ T6004]  ? __pfx_internal_create_group+0x10/0x10
[  223.689988][ T6004]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  223.690007][ T6004]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  223.690027][ T6004]  sysfs_create_groups+0x59/0x120
[  223.690049][ T6004]  kobject_add_internal+0x669/0xcd0
[  223.690077][ T6004]  kobject_init_and_add+0x12b/0x1a0
[  223.690114][ T6004]  ? __pfx_kobject_init_and_add+0x10/0x10
[  223.690136][ T6004]  ? kernfs_remove_by_name_ns+0x101/0x140
[  223.690162][ T6004]  ? kernfs_remove_by_name_ns+0x101/0x140
[  223.690187][ T6004]  sysfs_slab_add+0x7b/0x260
[  223.690222][ T6004]  do_kmem_cache_create+0x8bf/0x970
[  223.690243][ T6004]  __kmem_cache_create_args+0x307/0x440
[  223.690265][ T6004]  nfsd_file_cache_init+0x1d9/0x530
[  223.690285][ T6004]  ? __pfx_nfsd_file_cache_init+0x10/0x10
[  223.690301][ T6004]  ? net_generic+0x1e/0x240
[  223.690327][ T6004]  ? net_generic+0x1e/0x240
[  223.690343][ T6004]  ? net_generic+0x1e/0x240
[  223.690359][ T6004]  ? net_generic+0x1e/0x240
[  223.690378][ T6004]  ? net_generic+0x1f4/0x240
[  223.690397][ T6004]  nfsd_svc+0x315/0x780
[  223.690420][ T6004]  write_threads+0x3cd/0x5a0
[  223.690435][ T6004]  ? __might_fault+0xaf/0x130
[  223.690455][ T6004]  ? __pfx_write_threads+0x10/0x10
[  223.690517][ T6004]  ? _copy_from_user+0x94/0xb0
[  223.690534][ T6004]  ? simple_transaction_get+0x12d/0x160
[  223.690550][ T6004]  nfsctl_transaction_write+0x10f/0x160
[  223.690565][ T6004]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  223.690579][ T6004]  vfs_write+0x296/0xba0
[  223.690601][ T6004]  ? __pfx_vfs_write+0x10/0x10
[  223.690624][ T6004]  ? _raw_spin_unlock_irq+0x23/0x50
[  223.690641][ T6004]  ? lockdep_hardirqs_on+0x7a/0x110
[  223.690664][ T6004]  ksys_write+0x150/0x270
[  223.690681][ T6004]  ? __pfx_ksys_write+0x10/0x10
[  223.690701][ T6004]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.690715][ T6004]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.690729][ T6004]  do_syscall_64+0x174/0x580
[  223.690746][ T6004]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.690759][ T6004]  ? clear_bhb_loop+0x70/0xc0
[  223.690775][ T6004]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.690787][ T6004] RIP: 0033:0x7f3343939df7
[  223.690802][ T6004] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  223.690816][ T6004] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  223.690831][ T6004] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  223.690842][ T6004] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  223.690850][ T6004] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  223.690858][ T6004] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  223.690866][ T6004] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d8ec
[  223.690889][ T6004]  </TASK>
[  223.691068][ T6004] kobject: kobject_add_internal failed for nfsd_file_mark (error: -12 parent: slab)
[  223.880058][ T6004] SLUB: Unable to add cache nfsd_file_mark to sysfs
[  223.882696][ T6004] FAULT_INJECTION: forcing a failure.
[  223.882696][ T6004] name failslab, interval 1, probability 5, space 0, times -1
[  223.888632][ T6004] CPU: 0 UID: 0 PID: 6004 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  223.888654][ T6004] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  223.888663][ T6004] Call Trace:
[  223.888671][ T6004]  <TASK>
[  223.888678][ T6004]  dump_stack_lvl+0xe8/0x150
[  223.888705][ T6004]  should_fail_ex+0x40c/0x560
[  223.888727][ T6004]  ? __rhashtable_init_noprof+0x545/0xaf0
[  223.888743][ T6004]  should_failslab+0xa8/0x100
[  223.888761][ T6004]  __kvmalloc_node_noprof+0x176/0x860
[  223.888786][ T6004]  ? __rhashtable_init_noprof+0x545/0xaf0
[  223.888805][ T6004]  __rhashtable_init_noprof+0x545/0xaf0
[  223.888822][ T6004]  __rhltable_init_noprof+0x26/0x70
[  223.888838][ T6004]  nfs4_state_start+0x28/0x100
[  223.888859][ T6004]  nfsd_svc+0x3c0/0x780
[  223.888883][ T6004]  write_threads+0x3cd/0x5a0
[  223.888897][ T6004]  ? __might_fault+0xaf/0x130
[  223.888916][ T6004]  ? __pfx_write_threads+0x10/0x10
[  223.888944][ T6004]  ? _copy_from_user+0x94/0xb0
[  223.888973][ T6004]  ? simple_transaction_get+0x12d/0x160
[  223.888991][ T6004]  nfsctl_transaction_write+0x10f/0x160
[  223.889006][ T6004]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  223.889020][ T6004]  vfs_write+0x296/0xba0
[  223.889043][ T6004]  ? __pfx_vfs_write+0x10/0x10
[  223.889066][ T6004]  ? _raw_spin_unlock_irq+0x23/0x50
[  223.889083][ T6004]  ? lockdep_hardirqs_on+0x7a/0x110
[  223.889103][ T6004]  ksys_write+0x150/0x270
[  223.889122][ T6004]  ? __pfx_ksys_write+0x10/0x10
[  223.889144][ T6004]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.889160][ T6004]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.889174][ T6004]  do_syscall_64+0x174/0x580
[  223.889190][ T6004]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.889205][ T6004]  ? clear_bhb_loop+0x70/0xc0
[  223.889222][ T6004]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.889237][ T6004] RIP: 0033:0x7f3343939df7
[  223.889252][ T6004] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  223.889263][ T6004] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  223.889279][ T6004] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  223.889288][ T6004] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  223.889296][ T6004] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  223.889303][ T6004] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  223.889312][ T6004] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d8ec
[  223.889332][ T6004]  </TASK>
[  223.889388][ T6004] NFSD: Failed to start, no listeners configured.
[  224.276487][ T6004] FAULT_INJECTION: forcing a failure.
[  224.276487][ T6004] name failslab, interval 1, probability 5, space 0, times -1
[  224.282677][ T6004] CPU: 1 UID: 0 PID: 6004 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  224.282698][ T6004] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  224.282706][ T6004] Call Trace:
[  224.282712][ T6004]  <TASK>
[  224.282718][ T6004]  dump_stack_lvl+0xe8/0x150
[  224.282744][ T6004]  should_fail_ex+0x40c/0x560
[  224.282768][ T6004]  should_failslab+0xa8/0x100
[  224.282786][ T6004]  __kmalloc_cache_noprof+0xa8/0x660
[  224.282807][ T6004]  ? unx_lookup_cred+0x83/0x170
[  224.282820][ T6004]  ? unx_lookup_cred+0x83/0x170
[  224.282836][ T6004]  unx_lookup_cred+0x83/0x170
[  224.282851][ T6004]  rpcauth_refreshcred+0x63e/0xa20
[  224.282878][ T6004]  ? __pfx_rpcauth_refreshcred+0x10/0x10
[  224.282898][ T6004]  ? __pfx_do_raw_spin_lock+0x10/0x10
[  224.282926][ T6004]  ? __pfx_call_refresh+0x10/0x10
[  224.282943][ T6004]  ? __pfx_call_refresh+0x10/0x10
[  224.282961][ T6004]  __rpc_execute+0x526/0x1280
[  224.282991][ T6004]  ? __pfx___rpc_execute+0x10/0x10
[  224.283011][ T6004]  ? rpc_task_get_xprt+0x26/0x250
[  224.283087][ T6004]  ? rpc_make_runnable+0xae/0x1c0
[  224.283146][ T6004]  rpc_execute+0x1c1/0x390
[  224.283166][ T6004]  rpc_run_task+0x4a6/0x660
[  224.283182][ T6004]  rpc_call_sync+0x10f/0x200
[  224.283194][ T6004]  ? __pfx_rpc_call_sync+0x10/0x10
[  224.283210][ T6004]  ? net_generic+0x1e/0x240
[  224.283221][ T6004]  ? net_generic+0x1e/0x240
[  224.283236][ T6004]  rpcb_register+0x2d0/0x530
[  224.283250][ T6004]  ? __pfx_rpcb_register+0x10/0x10
[  224.283260][ T6004]  ? __lock_acquire+0x683/0x2cf0
[  224.283280][ T6004]  ? __kasan_slab_free+0x5c/0x80
[  224.283293][ T6004]  ? kfree+0x1c5/0x640
[  224.283307][ T6004]  ? rhashtable_free_and_destroy+0x4e0/0x540
[  224.283552][ T6004]  ? nfsd_file_cache_shutdown+0x146/0x350
[  224.283653][ T6004]  ? nfsd_svc+0x4fe/0x780
[  224.283673][ T6004]  ? write_threads+0x3cd/0x5a0
[  224.283687][ T6004]  ? vfs_write+0x296/0xba0
[  224.283702][ T6004]  ? ksys_write+0x150/0x270
[  224.283762][ T6004]  ? do_syscall_64+0x174/0x580
[  224.283782][ T6004]  svc_unregister+0x24d/0x780
[  224.283846][ T6004]  svc_rpcb_cleanup+0x1d/0x30
[  224.283898][ T6004]  svc_xprt_destroy_all+0x6d3/0x730
[  224.283921][ T6004]  ? __pfx_svc_xprt_destroy_all+0x10/0x10
[  224.283979][ T6004]  ? do_raw_spin_unlock+0xf5/0x210
[  224.284006][ T6004]  nfsd_destroy_serv+0x1bf/0x4b0
[  224.284027][ T6004]  ? __pfx_nfsd_destroy_serv+0x10/0x10
[  224.284105][ T6004]  ? nfsd_file_cache_shutdown+0x2fc/0x350
[  224.284125][ T6004]  nfsd_svc+0x540/0x780
[  224.284223][ T6004]  write_threads+0x3cd/0x5a0
[  224.284236][ T6004]  ? __might_fault+0xaf/0x130
[  224.284299][ T6004]  ? __pfx_write_threads+0x10/0x10
[  224.284327][ T6004]  ? _copy_from_user+0x94/0xb0
[  224.284344][ T6004]  ? simple_transaction_get+0x12d/0x160
[  224.284445][ T6004]  nfsctl_transaction_write+0x10f/0x160
[  224.284555][ T6004]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  224.284572][ T6004]  vfs_write+0x296/0xba0
[  224.284595][ T6004]  ? __pfx_vfs_write+0x10/0x10
[  224.284678][ T6004]  ? _raw_spin_unlock_irq+0x23/0x50
[  224.284694][ T6004]  ? lockdep_hardirqs_on+0x7a/0x110
[  224.284755][ T6004]  ksys_write+0x150/0x270
[  224.284776][ T6004]  ? __pfx_ksys_write+0x10/0x10
[  224.284797][ T6004]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.284855][ T6004]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.284869][ T6004]  do_syscall_64+0x174/0x580
[  224.284885][ T6004]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.284939][ T6004]  ? clear_bhb_loop+0x70/0xc0
[  224.284957][ T6004]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.284970][ T6004] RIP: 0033:0x7f3343939df7
[  224.284985][ T6004] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  224.285068][ T6004] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  224.285085][ T6004] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  224.285096][ T6004] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  224.285105][ T6004] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  224.285150][ T6004] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  224.285159][ T6004] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d8ec
[  224.285179][ T6004]  </TASK>
[pid  5902] write(4, "tcp 2049\n", 9 <unfinished ...>
[pid  6004] <... write resumed>)        = -1 EIO (Input/output error)
[pid  6004] openat(AT_FDCWD, "/proc/self/make-it-fail", O_WRONLY) = 5
[  224.495808][ T5924] FAULT_INJECTION: forcing a failure.
[  224.495808][ T5924] name failslab, interval 1, probability 5, space 0, times -1
[pid  6004] write(5, "0", 1)            = 1
[pid  6004] close(5)                    = 0
[  224.517796][ T5924] CPU: 0 UID: 0 PID: 5924 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  224.517821][ T5924] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  224.517830][ T5924] Call Trace:
[  224.517837][ T5924]  <TASK>
[  224.517845][ T5924]  dump_stack_lvl+0xe8/0x150
[  224.517873][ T5924]  should_fail_ex+0x40c/0x560
[  224.517899][ T5924]  should_failslab+0xa8/0x100
[  224.517917][ T5924]  __kmalloc_cache_noprof+0xa8/0x660
[  224.517942][ T5924]  ? __svc_create+0x63/0x990
[pid  6004] write(4, "tcp 2049\n", 9 <unfinished ...>
[pid  5924] <... write resumed>)        = -1 ENOMEM (Cannot allocate memory)
[  224.517958][ T5924]  ? __svc_create+0x63/0x990
[  224.517975][ T5924]  ? __pfx_nfsd+0x10/0x10
[  224.517995][ T5924]  __svc_create+0x63/0x990
[  224.518012][ T5924]  ? __kmalloc_cache_noprof+0x150/0x660
[pid  5924] openat(AT_FDCWD, "/proc/self/make-it-fail", O_WRONLY) = 5
[pid  5924] write(5, "0", 1)            = 1
[pid  5924] close(5)                    = 0
[  224.518030][ T5924]  ? percpu_ref_init+0xc5/0x350
[  224.518051][ T5924]  ? percpu_ref_init+0xc5/0x350
[  224.518072][ T5924]  ? __pfx_nfsd+0x10/0x10
[  224.518091][ T5924]  svc_create_pooled+0x5ad/0x770
[  224.518107][ T5924]  ? __init_swait_queue_head+0xa8/0x150
[  224.518128][ T5924]  nfsd_create_serv+0x565/0x840
[  224.518147][ T5924]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  224.518164][ T5924]  ? lockdep_hardirqs_on+0x7a/0x110
[  224.518186][ T5924]  ? __pfx_nfsd_create_serv+0x10/0x10
[  224.518207][ T5924]  ? net_generic+0x1e/0x240
[  224.518226][ T5924]  ? net_generic+0x1e/0x240
[  224.518249][ T5924]  ? net_generic+0x1e/0x240
[  224.518272][ T5924]  nfsd_svc+0x189/0x780
[  224.518295][ T5924]  write_threads+0x3cd/0x5a0
[  224.518309][ T5924]  ? __might_fault+0xaf/0x130
[  224.518326][ T5924]  ? __pfx_write_threads+0x10/0x10
[  224.518383][ T5924]  ? _copy_from_user+0x94/0xb0
[  224.518402][ T5924]  ? simple_transaction_get+0x12d/0x160
[  224.518420][ T5924]  nfsctl_transaction_write+0x10f/0x160
[  224.518436][ T5924]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  224.518450][ T5924]  vfs_write+0x296/0xba0
[  224.518473][ T5924]  ? __pfx_vfs_write+0x10/0x10
[  224.518495][ T5924]  ? _raw_spin_unlock_irq+0x23/0x50
[  224.518509][ T5924]  ? lockdep_hardirqs_on+0x7a/0x110
[  224.518540][ T5924]  ksys_write+0x150/0x270
[  224.518666][ T5924]  ? __pfx_ksys_write+0x10/0x10
[  224.518687][ T5924]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.518701][ T5924]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.518717][ T5924]  do_syscall_64+0x174/0x580
[  224.518734][ T5924]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.518749][ T5924]  ? clear_bhb_loop+0x70/0xc0
[  224.518767][ T5924]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.518782][ T5924] RIP: 0033:0x7f3343939df7
[  224.518797][ T5924] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  224.518810][ T5924] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  224.518827][ T5924] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  224.518837][ T5924] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  224.518847][ T5924] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  224.518855][ T5924] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  224.518863][ T5924] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d7d8
[  224.518882][ T5924]  </TASK>
[  224.519121][ T6218] FAULT_INJECTION: forcing a failure.
[  224.519121][ T6218] name failslab, interval 1, probability 5, space 0, times -1
[  224.711039][ T6218] CPU: 0 UID: 0 PID: 6218 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  224.711061][ T6218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  224.711071][ T6218] Call Trace:
[  224.711077][ T6218]  <TASK>
[  224.711084][ T6218]  dump_stack_lvl+0xe8/0x150
[  224.711110][ T6218]  should_fail_ex+0x40c/0x560
[  224.711134][ T6218]  should_failslab+0xa8/0x100
[  224.711152][ T6218]  __kmalloc_node_track_caller_noprof+0x100/0x730
[  224.711175][ T6218]  ? __pfx_snprintf+0x10/0x10
[  224.711190][ T6218]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  224.711209][ T6218]  ? xs_format_common_peer_ports+0x226/0x320
[  224.711228][ T6218]  ? xs_format_common_peer_ports+0x226/0x320
[  224.711251][ T6218]  kstrdup+0x42/0x100
[  224.711273][ T6218]  xs_format_common_peer_ports+0x226/0x320
[  224.711296][ T6218]  ? __pfx_xs_format_common_peer_ports+0x10/0x10
[  224.711314][ T6218]  ? trace_kmalloc+0x2a/0xf0
[  224.711384][ T6218]  xs_format_peer_addresses+0x427/0x530
[  224.711402][ T6218]  ? __pfx_xs_format_peer_addresses+0x10/0x10
[  224.711430][ T6218]  ? timer_init_key+0x161/0x2c0
[  224.711453][ T6218]  xs_setup_local+0x49d/0x5d0
[  224.711472][ T6218]  xprt_create_transport+0x166/0x5f0
[  224.711489][ T6218]  rpc_create+0x4ff/0x900
[  224.711512][ T6218]  ? __pfx_rpc_create+0x10/0x10
[  224.711554][ T6218]  ? __lock_acquire+0x683/0x2cf0
[  224.711576][ T6218]  rpcb_create_af_local+0x1c7/0x3c0
[  224.711592][ T6218]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  224.711620][ T6218]  ? do_raw_spin_unlock+0xf5/0x210
[  224.711643][ T6218]  rpcb_create_local+0x268/0x670
[  224.711660][ T6218]  ? __pfx_rpcb_create_local+0x10/0x10
[  224.711674][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  224.711691][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  224.711711][ T6218]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  224.711728][ T6218]  ? __percpu_counter_init_many+0x35f/0x380
[  224.711755][ T6218]  ? __svc_create+0x88f/0x990
[  224.711778][ T6218]  svc_bind+0x1b4/0x230
[  224.711799][ T6218]  nfsd_create_serv+0x581/0x840
[  224.711821][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  224.711837][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  224.711856][ T6218]  ? __pfx_nfsd_create_serv+0x10/0x10
[  224.711875][ T6218]  ? net_generic+0x1e/0x240
[  224.711923][ T6218]  ? net_generic+0x1e/0x240
[  224.711944][ T6218]  ? net_generic+0x1e/0x240
[  224.711976][ T6218]  nfsd_svc+0x189/0x780
[  224.711998][ T6218]  write_threads+0x3cd/0x5a0
[  224.712011][ T6218]  ? __might_fault+0xaf/0x130
[  224.712030][ T6218]  ? __pfx_write_threads+0x10/0x10
[  224.712056][ T6218]  ? _copy_from_user+0x94/0xb0
[  224.712074][ T6218]  ? simple_transaction_get+0x12d/0x160
[  224.712091][ T6218]  nfsctl_transaction_write+0x10f/0x160
[  224.712107][ T6218]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  224.712123][ T6218]  vfs_write+0x296/0xba0
[  224.712147][ T6218]  ? __pfx_vfs_write+0x10/0x10
[  224.712170][ T6218]  ? _raw_spin_unlock_irq+0x23/0x50
[  224.712185][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  224.712206][ T6218]  ksys_write+0x150/0x270
[  224.712226][ T6218]  ? __pfx_ksys_write+0x10/0x10
[  224.712248][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.712263][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.712278][ T6218]  do_syscall_64+0x174/0x580
[  224.712295][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.712310][ T6218]  ? clear_bhb_loop+0x70/0xc0
[  224.712328][ T6218]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.712377][ T6218] RIP: 0033:0x7f3343939df7
[  224.712393][ T6218] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  224.712405][ T6218] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  224.712421][ T6218] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  224.712431][ T6218] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  224.712440][ T6218] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  224.712448][ T6218] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  224.712457][ T6218] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbdc
[  224.712478][ T6218]  </TASK>
[  224.714576][ T6218] FAULT_INJECTION: forcing a failure.
[  224.714576][ T6218] name failslab, interval 1, probability 5, space 0, times -1
[  224.911935][ T6218] CPU: 0 UID: 0 PID: 6218 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  224.911957][ T6218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  224.911966][ T6218] Call Trace:
[  224.911973][ T6218]  <TASK>
[  224.911980][ T6218]  dump_stack_lvl+0xe8/0x150
[  224.912005][ T6218]  should_fail_ex+0x40c/0x560
[  224.912029][ T6218]  should_failslab+0xa8/0x100
[  224.912046][ T6218]  __kmalloc_noprof+0xfe/0x720
[  224.912066][ T6218]  ? trace_kmem_cache_alloc+0x29/0xe0
[  224.912085][ T6218]  ? security_sk_alloc+0x52/0x360
[  224.912100][ T6218]  ? security_sk_alloc+0x52/0x360
[  224.912119][ T6218]  security_sk_alloc+0x52/0x360
[  224.912137][ T6218]  sk_prot_alloc+0x101/0x210
[  224.912162][ T6218]  sk_alloc+0x3a/0x390
[  224.912201][ T6218]  unix_create1+0xb0/0x7c0
[  224.912225][ T6218]  unix_create+0x14c/0x1d0
[  224.912243][ T6218]  __sock_create+0x4b3/0x9d0
[  224.912267][ T6218]  xs_local_connect+0x144/0x810
[  224.912289][ T6218]  ? __pfx_xs_local_connect+0x10/0x10
[  224.912308][ T6218]  ? do_raw_spin_unlock+0xf5/0x210
[  224.912536][ T6218]  xprt_connect+0x613/0x850
[  224.912561][ T6218]  ? __pfx_call_connect+0x10/0x10
[  224.912580][ T6218]  __rpc_execute+0x526/0x1280
[  224.912611][ T6218]  ? __pfx___rpc_execute+0x10/0x10
[  224.912631][ T6218]  ? rpc_task_get_xprt+0x26/0x250
[  224.912650][ T6218]  ? rpc_make_runnable+0xae/0x1c0
[  224.912671][ T6218]  rpc_execute+0x1c1/0x390
[  224.912691][ T6218]  rpc_run_task+0x4a6/0x660
[  224.912708][ T6218]  rpc_create_xprt+0x533/0xa90
[  224.912723][ T6218]  ? __pfx_rpc_create_xprt+0x10/0x10
[  224.912749][ T6218]  ? rcu_is_watching+0x15/0xb0
[  224.912765][ T6218]  ? trace_kmalloc+0x2a/0xf0
[  224.912786][ T6218]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  224.912804][ T6218]  ? xprt_create_transport+0x39b/0x5f0
[  224.912829][ T6218]  ? xprt_create_transport+0x438/0x5f0
[  224.912847][ T6218]  rpc_create+0x649/0x900
[  224.912868][ T6218]  ? __pfx_rpc_create+0x10/0x10
[  224.912912][ T6218]  ? __lock_acquire+0x683/0x2cf0
[  224.912935][ T6218]  rpcb_create_af_local+0x1c7/0x3c0
[  224.912951][ T6218]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  224.912979][ T6218]  ? do_raw_spin_unlock+0xf5/0x210
[  224.913001][ T6218]  rpcb_create_local+0x268/0x670
[  224.913017][ T6218]  ? __pfx_rpcb_create_local+0x10/0x10
[  224.913031][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  224.913049][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  224.913067][ T6218]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  224.913083][ T6218]  ? __percpu_counter_init_many+0x35f/0x380
[  224.913138][ T6218]  ? __svc_create+0x88f/0x990
[  224.913163][ T6218]  svc_bind+0x1b4/0x230
[  224.913180][ T6218]  nfsd_create_serv+0x581/0x840
[  224.913200][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  224.913215][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  224.913237][ T6218]  ? __pfx_nfsd_create_serv+0x10/0x10
[  224.913255][ T6218]  ? net_generic+0x1e/0x240
[  224.913272][ T6218]  ? net_generic+0x1e/0x240
[  224.913307][ T6218]  ? net_generic+0x1e/0x240
[  224.913363][ T6218]  nfsd_svc+0x189/0x780
[  224.913394][ T6218]  write_threads+0x3cd/0x5a0
[  224.913409][ T6218]  ? __might_fault+0xaf/0x130
[  224.913428][ T6218]  ? __pfx_write_threads+0x10/0x10
[  224.913455][ T6218]  ? _copy_from_user+0x94/0xb0
[  224.913474][ T6218]  ? simple_transaction_get+0x12d/0x160
[  224.913493][ T6218]  nfsctl_transaction_write+0x10f/0x160
[  224.913509][ T6218]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  224.913524][ T6218]  vfs_write+0x296/0xba0
[  224.913547][ T6218]  ? __pfx_vfs_write+0x10/0x10
[  224.913570][ T6218]  ? _raw_spin_unlock_irq+0x23/0x50
[  224.913586][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  224.913606][ T6218]  ksys_write+0x150/0x270
[  224.913624][ T6218]  ? __pfx_ksys_write+0x10/0x10
[  224.913646][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.913662][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.913676][ T6218]  do_syscall_64+0x174/0x580
[  224.913693][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.913707][ T6218]  ? clear_bhb_loop+0x70/0xc0
[  224.913725][ T6218]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.913740][ T6218] RIP: 0033:0x7f3343939df7
[  224.913755][ T6218] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  224.913768][ T6218] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  224.913785][ T6218] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  224.913796][ T6218] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  224.913805][ T6218] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  224.913814][ T6218] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  224.913824][ T6218] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbdc
[  224.913846][ T6218]  </TASK>
[  225.188999][ T6218] FAULT_INJECTION: forcing a failure.
[  225.188999][ T6218] name failslab, interval 1, probability 5, space 0, times -1
[  225.195461][ T6218] CPU: 1 UID: 0 PID: 6218 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  225.195483][ T6218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  225.195494][ T6218] Call Trace:
[  225.195503][ T6218]  <TASK>
[  225.195511][ T6218]  dump_stack_lvl+0xe8/0x150
[  225.195539][ T6218]  should_fail_ex+0x40c/0x560
[  225.195566][ T6218]  should_failslab+0xa8/0x100
[  225.195586][ T6218]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  225.195609][ T6218]  ? security_file_alloc+0x34/0x310
[  225.195626][ T6218]  ? security_file_alloc+0x34/0x310
[  225.195649][ T6218]  security_file_alloc+0x34/0x310
[  225.195669][ T6218]  init_file+0x90/0x2b0
[  225.195687][ T6218]  alloc_empty_file+0x74/0x1d0
[  225.195703][ T6218]  alloc_file_pseudo+0x115/0x1e0
[  225.195722][ T6218]  ? __pfx_alloc_file_pseudo+0x10/0x10
[  225.195738][ T6218]  ? __raw_spin_lock_init+0x45/0x100
[  225.195764][ T6218]  sock_alloc_file+0xb8/0x2e0
[  225.195869][ T6218]  xs_local_connect+0x179/0x810
[  225.195909][ T6218]  ? __pfx_xs_local_connect+0x10/0x10
[  225.195930][ T6218]  ? do_raw_spin_unlock+0xf5/0x210
[  225.195956][ T6218]  xprt_connect+0x613/0x850
[  225.195979][ T6218]  ? __pfx_call_connect+0x10/0x10
[  225.196000][ T6218]  __rpc_execute+0x526/0x1280
[  225.196034][ T6218]  ? __pfx___rpc_execute+0x10/0x10
[  225.196055][ T6218]  ? rpc_task_get_xprt+0x26/0x250
[  225.196075][ T6218]  ? rpc_make_runnable+0xae/0x1c0
[  225.196098][ T6218]  rpc_execute+0x1c1/0x390
[  225.196121][ T6218]  rpc_run_task+0x4a6/0x660
[  225.196139][ T6218]  rpc_create_xprt+0x533/0xa90
[  225.196157][ T6218]  ? __pfx_rpc_create_xprt+0x10/0x10
[  225.196188][ T6218]  ? rcu_is_watching+0x15/0xb0
[  225.196207][ T6218]  ? trace_kmalloc+0x2a/0xf0
[  225.196233][ T6218]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  225.196253][ T6218]  ? xprt_create_transport+0x39b/0x5f0
[  225.196280][ T6218]  ? xprt_create_transport+0x438/0x5f0
[  225.198431][ T6218]  rpc_create+0x649/0x900
[  225.198458][ T6218]  ? __pfx_rpc_create+0x10/0x10
[  225.198508][ T6218]  ? __lock_acquire+0x683/0x2cf0
[  225.198534][ T6218]  rpcb_create_af_local+0x1c7/0x3c0
[  225.198551][ T6218]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  225.198585][ T6218]  ? do_raw_spin_unlock+0xf5/0x210
[  225.198609][ T6218]  rpcb_create_local+0x28f/0x670
[  225.198627][ T6218]  ? __pfx_rpcb_create_local+0x10/0x10
[  225.198642][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  225.198660][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.198679][ T6218]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  225.198696][ T6218]  ? __percpu_counter_init_many+0x35f/0x380
[  225.198724][ T6218]  ? __svc_create+0x88f/0x990
[  225.198749][ T6218]  svc_bind+0x1b4/0x230
[  225.198770][ T6218]  nfsd_create_serv+0x581/0x840
[  225.198790][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  225.198808][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.198829][ T6218]  ? __pfx_nfsd_create_serv+0x10/0x10
[  225.198851][ T6218]  ? net_generic+0x1e/0x240
[  225.198883][ T6218]  ? net_generic+0x1e/0x240
[  225.198906][ T6218]  ? net_generic+0x1e/0x240
[  225.198931][ T6218]  nfsd_svc+0x189/0x780
[  225.198956][ T6218]  write_threads+0x3cd/0x5a0
[  225.198971][ T6218]  ? __might_fault+0xaf/0x130
[  225.198993][ T6218]  ? __pfx_write_threads+0x10/0x10
[  225.199023][ T6218]  ? _copy_from_user+0x94/0xb0
[  225.199042][ T6218]  ? simple_transaction_get+0x12d/0x160
[  225.199061][ T6218]  nfsctl_transaction_write+0x10f/0x160
[  225.199079][ T6218]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  225.199095][ T6218]  vfs_write+0x296/0xba0
[  225.199122][ T6218]  ? __pfx_vfs_write+0x10/0x10
[  225.199281][ T6218]  ? _raw_spin_unlock_irq+0x23/0x50
[  225.199390][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.199417][ T6218]  ksys_write+0x150/0x270
[  225.199441][ T6218]  ? __pfx_ksys_write+0x10/0x10
[  225.199554][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.199577][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.199595][ T6218]  do_syscall_64+0x174/0x580
[  225.199615][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.199631][ T6218]  ? clear_bhb_loop+0x70/0xc0
[  225.199651][ T6218]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.199667][ T6218] RIP: 0033:0x7f3343939df7
[  225.199684][ T6218] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  225.199698][ T6218] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  225.199716][ T6218] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  225.199728][ T6218] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  225.199739][ T6218] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  225.199748][ T6218] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  225.199759][ T6218] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbdc
[  225.199783][ T6218]  </TASK>
[  225.433207][ T6218] FAULT_INJECTION: forcing a failure.
[  225.433207][ T6218] name failslab, interval 1, probability 5, space 0, times -1
[  225.476303][ T6218] CPU: 1 UID: 0 PID: 6218 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  225.476326][ T6218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  225.476335][ T6218] Call Trace:
[  225.476342][ T6218]  <TASK>
[  225.476350][ T6218]  dump_stack_lvl+0xe8/0x150
[  225.476378][ T6218]  should_fail_ex+0x40c/0x560
[  225.476402][ T6218]  should_failslab+0xa8/0x100
[  225.476419][ T6218]  __kmalloc_cache_noprof+0xa8/0x660
[  225.476443][ T6218]  ? kobject_uevent_env+0x289/0x9e0
[  225.476457][ T6218]  ? kobject_uevent_env+0x289/0x9e0
[  225.476474][ T6218]  kobject_uevent_env+0x289/0x9e0
[  225.476494][ T6218]  rpc_sysfs_xprt_switch_destroy+0x51/0x90
[  225.476516][ T6218]  xprt_switch_put+0x33d/0x3c0
[  225.476538][ T6218]  rpc_release_client+0x350/0x6a0
[  225.476559][ T6218]  rpc_shutdown_client+0x4c6/0x6c0
[  225.476576][ T6218]  ? __pfx_rpc_shutdown_client+0x10/0x10
[  225.476590][ T6218]  ? kmem_cache_free+0x182/0x650
[  225.476609][ T6218]  ? rpc_task_get_xprt+0x26/0x250
[  225.476627][ T6218]  ? __pfx_mempool_free_slab+0x10/0x10
[  225.476647][ T6218]  ? mempool_free+0xec/0x130
[  225.476666][ T6218]  ? __pfx_mempool_free+0x10/0x10
[  225.476683][ T6218]  ? put_rpccred+0x74/0x960
[  225.476704][ T6218]  ? rpc_final_put_task+0x1e4/0x220
[  225.476723][ T6218]  rpc_create_xprt+0x612/0xa90
[  225.476739][ T6218]  ? __pfx_rpc_create_xprt+0x10/0x10
[  225.476766][ T6218]  ? rcu_is_watching+0x15/0xb0
[  225.476785][ T6218]  ? trace_kmalloc+0x2a/0xf0
[  225.476808][ T6218]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  225.476827][ T6218]  ? xprt_create_transport+0x39b/0x5f0
[  225.476852][ T6218]  ? xprt_create_transport+0x438/0x5f0
[  225.476869][ T6218]  rpc_create+0x649/0x900
[  225.476892][ T6218]  ? __pfx_rpc_create+0x10/0x10
[  225.476934][ T6218]  ? __lock_acquire+0x683/0x2cf0
[  225.476955][ T6218]  rpcb_create_af_local+0x1c7/0x3c0
[  225.476982][ T6218]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  225.477011][ T6218]  ? do_raw_spin_unlock+0xf5/0x210
[  225.477033][ T6218]  rpcb_create_local+0x28f/0x670
[  225.477049][ T6218]  ? __pfx_rpcb_create_local+0x10/0x10
[  225.477063][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  225.477080][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.477097][ T6218]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  225.477113][ T6218]  ? __percpu_counter_init_many+0x35f/0x380
[  225.477137][ T6218]  ? __svc_create+0x88f/0x990
[  225.477159][ T6218]  svc_bind+0x1b4/0x230
[  225.477178][ T6218]  nfsd_create_serv+0x581/0x840
[  225.477198][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  225.477213][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.477233][ T6218]  ? __pfx_nfsd_create_serv+0x10/0x10
[  225.477287][ T6218]  ? net_generic+0x1e/0x240
[  225.477307][ T6218]  ? net_generic+0x1e/0x240
[  225.477329][ T6218]  ? net_generic+0x1e/0x240
[  225.477352][ T6218]  nfsd_svc+0x189/0x780
[  225.477376][ T6218]  write_threads+0x3cd/0x5a0
[  225.477389][ T6218]  ? __might_fault+0xaf/0x130
[  225.477409][ T6218]  ? __pfx_write_threads+0x10/0x10
[  225.477434][ T6218]  ? _copy_from_user+0x94/0xb0
[  225.477451][ T6218]  ? simple_transaction_get+0x12d/0x160
[  225.477469][ T6218]  nfsctl_transaction_write+0x10f/0x160
[  225.477484][ T6218]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  225.477500][ T6218]  vfs_write+0x296/0xba0
[  225.477524][ T6218]  ? __pfx_vfs_write+0x10/0x10
[  225.477546][ T6218]  ? _raw_spin_unlock_irq+0x23/0x50
[  225.477562][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.477584][ T6218]  ksys_write+0x150/0x270
[  225.477604][ T6218]  ? __pfx_ksys_write+0x10/0x10
[  225.477649][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.477666][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.477681][ T6218]  do_syscall_64+0x174/0x580
[  225.477699][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.477713][ T6218]  ? clear_bhb_loop+0x70/0xc0
[  225.477731][ T6218]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.477744][ T6218] RIP: 0033:0x7f3343939df7
[  225.477760][ T6218] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  225.477773][ T6218] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  225.477789][ T6218] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  225.477799][ T6218] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  225.477808][ T6218] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  225.477816][ T6218] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  225.477825][ T6218] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbdc
[  225.477846][ T6218]  </TASK>
[  225.703057][ T6218] FAULT_INJECTION: forcing a failure.
[  225.703057][ T6218] name failslab, interval 1, probability 5, space 0, times -1
[  225.708216][ T6218] CPU: 1 UID: 0 PID: 6218 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  225.708332][ T6218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  225.708341][ T6218] Call Trace:
[  225.708348][ T6218]  <TASK>
[  225.708354][ T6218]  dump_stack_lvl+0xe8/0x150
[  225.708376][ T6218]  should_fail_ex+0x40c/0x560
[  225.708397][ T6218]  should_failslab+0xa8/0x100
[  225.708413][ T6218]  __kmalloc_node_track_caller_noprof+0x100/0x730
[  225.708432][ T6218]  ? __pfx_snprintf+0x10/0x10
[  225.708444][ T6218]  ? xs_format_common_peer_ports+0x15c/0x320
[  225.708461][ T6218]  ? xs_format_common_peer_ports+0x15c/0x320
[  225.708480][ T6218]  kstrdup+0x42/0x100
[  225.708498][ T6218]  xs_format_common_peer_ports+0x15c/0x320
[  225.708515][ T6218]  ? __pfx_xs_format_common_peer_ports+0x10/0x10
[  225.708529][ T6218]  ? trace_kmalloc+0x2a/0xf0
[  225.708557][ T6218]  xs_format_peer_addresses+0x427/0x530
[  225.708571][ T6218]  ? __pfx_xs_format_peer_addresses+0x10/0x10
[  225.708594][ T6218]  ? timer_init_key+0x161/0x2c0
[  225.708613][ T6218]  xs_setup_tcp+0x751/0x920
[  225.708631][ T6218]  ? __pfx_xs_setup_tcp+0x10/0x10
[  225.708646][ T6218]  ? preempt_schedule_common+0x82/0xd0
[  225.708661][ T6218]  ? preempt_schedule_thunk+0x16/0x40
[  225.708678][ T6218]  xprt_create_transport+0x166/0x5f0
[  225.708692][ T6218]  rpc_create+0x4ff/0x900
[  225.708711][ T6218]  ? __pfx_rpc_create+0x10/0x10
[  225.708756][ T6218]  rpcb_create_local+0x3ab/0x670
[  225.708771][ T6218]  ? __pfx_rpcb_create_local+0x10/0x10
[  225.708790][ T6218]  ? __svc_create+0x88f/0x990
[  225.708809][ T6218]  svc_bind+0x1b4/0x230
[  225.708825][ T6218]  nfsd_create_serv+0x581/0x840
[  225.708843][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  225.708856][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.708875][ T6218]  ? __pfx_nfsd_create_serv+0x10/0x10
[  225.708892][ T6218]  ? net_generic+0x1e/0x240
[  225.708908][ T6218]  ? net_generic+0x1e/0x240
[  225.708927][ T6218]  ? net_generic+0x1e/0x240
[  225.708955][ T6218]  nfsd_svc+0x189/0x780
[  225.708976][ T6218]  write_threads+0x3cd/0x5a0
[  225.708988][ T6218]  ? __might_fault+0xaf/0x130
[  225.709005][ T6218]  ? __pfx_write_threads+0x10/0x10
[  225.709029][ T6218]  ? _copy_from_user+0x94/0xb0
[  225.709045][ T6218]  ? simple_transaction_get+0x12d/0x160
[  225.709060][ T6218]  nfsctl_transaction_write+0x10f/0x160
[  225.709075][ T6218]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  225.709088][ T6218]  vfs_write+0x296/0xba0
[  225.709109][ T6218]  ? __pfx_vfs_write+0x10/0x10
[  225.709129][ T6218]  ? _raw_spin_unlock_irq+0x23/0x50
[  225.709142][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.709161][ T6218]  ksys_write+0x150/0x270
[  225.709177][ T6218]  ? __pfx_ksys_write+0x10/0x10
[  225.709197][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.709210][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.709224][ T6218]  do_syscall_64+0x174/0x580
[  225.709276][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.709291][ T6218]  ? clear_bhb_loop+0x70/0xc0
[  225.709308][ T6218]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.709322][ T6218] RIP: 0033:0x7f3343939df7
[  225.709336][ T6218] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  225.709349][ T6218] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  225.709365][ T6218] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  225.709375][ T6218] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  225.709385][ T6218] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  225.709394][ T6218] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  225.709403][ T6218] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbdc
[  225.709425][ T6218]  </TASK>
[  225.709533][ T6218] FAULT_INJECTION: forcing a failure.
[  225.709533][ T6218] name failslab, interval 1, probability 5, space 0, times -1
[  225.888501][ T6218] CPU: 1 UID: 0 PID: 6218 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  225.888521][ T6218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  225.888530][ T6218] Call Trace:
[  225.888537][ T6218]  <TASK>
[  225.888544][ T6218]  dump_stack_lvl+0xe8/0x150
[  225.888569][ T6218]  should_fail_ex+0x40c/0x560
[  225.888596][ T6218]  should_failslab+0xa8/0x100
[  225.888614][ T6218]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  225.888634][ T6218]  ? kstrdup+0x81/0x100
[  225.888655][ T6218]  ? __kernfs_new_node+0xe6/0x980
[  225.888673][ T6218]  ? __kernfs_new_node+0xe6/0x980
[  225.888695][ T6218]  __kernfs_new_node+0xe6/0x980
[  225.888721][ T6218]  ? __pfx___kernfs_new_node+0x10/0x10
[  225.888740][ T6218]  ? kernfs_root+0x1c/0x230
[  225.888762][ T6218]  ? kernfs_root+0x1c/0x230
[  225.888779][ T6218]  ? kernfs_root+0x1c/0x230
[  225.888795][ T6218]  ? kernfs_root+0x1c/0x230
[  225.888816][ T6218]  kernfs_create_dir_ns+0xfe/0x230
[  225.888840][ T6218]  sysfs_create_dir_ns+0x12f/0x2a0
[  225.888861][ T6218]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  225.888882][ T6218]  ? do_raw_spin_unlock+0xf5/0x210
[  225.888904][ T6218]  kobject_add_internal+0x622/0xcd0
[  225.888930][ T6218]  kobject_init_and_add+0x12b/0x1a0
[  225.888955][ T6218]  ? __pfx_kobject_init_and_add+0x10/0x10
[  225.888975][ T6218]  ? __kmalloc_cache_noprof+0x150/0x660
[  225.888995][ T6218]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  225.889015][ T6218]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  225.889038][ T6218]  rpc_sysfs_xprt_switch_setup+0x169/0x2b0
[  225.889062][ T6218]  xprt_switch_alloc+0x238/0x590
[  225.889084][ T6218]  rpc_create_xprt+0x1c7/0xa90
[  225.889101][ T6218]  ? __pfx_rpc_create_xprt+0x10/0x10
[  225.889129][ T6218]  ? rcu_is_watching+0x15/0xb0
[  225.889146][ T6218]  ? trace_kmalloc+0x2a/0xf0
[  225.889168][ T6218]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  225.889190][ T6218]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  225.889244][ T6218]  ? xprt_create_transport+0x39b/0x5f0
[  225.889261][ T6218]  ? xprt_create_transport+0x39b/0x5f0
[  225.889276][ T6218]  ? kstrdup+0x81/0x100
[  225.889296][ T6218]  ? __asan_memcpy+0x40/0x70
[  225.889320][ T6218]  ? xprt_create_transport+0x438/0x5f0
[  225.889338][ T6218]  rpc_create+0x649/0x900
[  225.889360][ T6218]  ? __pfx_rpc_create+0x10/0x10
[  225.889414][ T6218]  rpcb_create_local+0x3ab/0x670
[  225.889441][ T6218]  ? __pfx_rpcb_create_local+0x10/0x10
[  225.889464][ T6218]  ? __svc_create+0x88f/0x990
[  225.889487][ T6218]  svc_bind+0x1b4/0x230
[  225.889504][ T6218]  nfsd_create_serv+0x581/0x840
[  225.889523][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  225.889538][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.889558][ T6218]  ? __pfx_nfsd_create_serv+0x10/0x10
[  225.889577][ T6218]  ? net_generic+0x1e/0x240
[  225.889611][ T6218]  ? net_generic+0x1e/0x240
[  225.889633][ T6218]  ? net_generic+0x1e/0x240
[  225.889657][ T6218]  nfsd_svc+0x189/0x780
[  225.889682][ T6218]  write_threads+0x3cd/0x5a0
[  225.889697][ T6218]  ? __might_fault+0xaf/0x130
[  225.889718][ T6218]  ? __pfx_write_threads+0x10/0x10
[  225.889745][ T6218]  ? _copy_from_user+0x94/0xb0
[  225.889762][ T6218]  ? simple_transaction_get+0x12d/0x160
[  225.889778][ T6218]  nfsctl_transaction_write+0x10f/0x160
[  225.889793][ T6218]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  225.889807][ T6218]  vfs_write+0x296/0xba0
[  225.889830][ T6218]  ? __pfx_vfs_write+0x10/0x10
[  225.889853][ T6218]  ? _raw_spin_unlock_irq+0x23/0x50
[  225.889869][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.889892][ T6218]  ksys_write+0x150/0x270
[  225.889911][ T6218]  ? __pfx_ksys_write+0x10/0x10
[  225.889933][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.889948][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.889963][ T6218]  do_syscall_64+0x174/0x580
[  225.889979][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.889994][ T6218]  ? clear_bhb_loop+0x70/0xc0
[  225.890011][ T6218]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.890025][ T6218] RIP: 0033:0x7f3343939df7
[  225.890040][ T6218] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  225.890053][ T6218] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  225.890069][ T6218] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  225.890079][ T6218] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  225.890088][ T6218] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  225.890095][ T6218] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  225.890104][ T6218] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbdc
[  225.890127][ T6218]  </TASK>
[  225.890158][ T6218] kobject: kobject_add_internal failed for switch-23 (error: -12 parent: xprt-switches)
[  226.100551][ T6218] FAULT_INJECTION: forcing a failure.
[  226.100551][ T6218] name failslab, interval 1, probability 5, space 0, times -1
[  226.105574][ T6218] CPU: 1 UID: 0 PID: 6218 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  226.105597][ T6218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  226.105607][ T6218] Call Trace:
[  226.105615][ T6218]  <TASK>
[  226.105622][ T6218]  dump_stack_lvl+0xe8/0x150
[  226.105648][ T6218]  should_fail_ex+0x40c/0x560
[  226.105674][ T6218]  should_failslab+0xa8/0x100
[  226.105692][ T6218]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  226.105713][ T6218]  ? rpc_new_task+0xf3/0x800
[  226.105743][ T6218]  ? rpc_new_task+0xf3/0x800
[  226.105766][ T6218]  rpc_new_task+0xf3/0x800
[  226.105787][ T6218]  ? rcu_is_watching+0x15/0xb0
[  226.105804][ T6218]  ? trace_rpc_clnt_new+0x84/0x200
[  226.105821][ T6218]  ? __pfx_rpc_new_task+0x10/0x10
[  226.105840][ T6218]  ? rpc_new_client+0x940/0xc50
[  226.105861][ T6218]  rpc_run_task+0x22/0x660
[  226.105880][ T6218]  rpc_bind_new_program+0x3ae/0x530
[  226.105895][ T6218]  ? __pfx_rpc_create+0x10/0x10
[  226.105916][ T6218]  ? __pfx_rpc_bind_new_program+0x10/0x10
[  226.105959][ T6218]  rpcb_create_local+0x3ed/0x670
[  226.105975][ T6218]  ? __pfx_rpcb_create_local+0x10/0x10
[  226.105997][ T6218]  ? __svc_create+0x88f/0x990
[  226.106021][ T6218]  svc_bind+0x1b4/0x230
[  226.106039][ T6218]  nfsd_create_serv+0x581/0x840
[  226.106059][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  226.106077][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  226.106095][ T6218]  ? __pfx_nfsd_create_serv+0x10/0x10
[  226.106113][ T6218]  ? net_generic+0x1e/0x240
[  226.106131][ T6218]  ? net_generic+0x1e/0x240
[  226.106153][ T6218]  ? net_generic+0x1e/0x240
[  226.106177][ T6218]  nfsd_svc+0x189/0x780
[  226.106240][ T6218]  write_threads+0x3cd/0x5a0
[  226.106254][ T6218]  ? __might_fault+0xaf/0x130
[  226.106273][ T6218]  ? __pfx_write_threads+0x10/0x10
[  226.106297][ T6218]  ? _copy_from_user+0x94/0xb0
[  226.106314][ T6218]  ? simple_transaction_get+0x12d/0x160
[  226.106391][ T6218]  nfsctl_transaction_write+0x10f/0x160
[  226.106409][ T6218]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  226.106423][ T6218]  vfs_write+0x296/0xba0
[  226.106447][ T6218]  ? __pfx_vfs_write+0x10/0x10
[  226.106470][ T6218]  ? _raw_spin_unlock_irq+0x23/0x50
[  226.106485][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  226.106509][ T6218]  ksys_write+0x150/0x270
[  226.106529][ T6218]  ? __pfx_ksys_write+0x10/0x10
[  226.106551][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.106566][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.106581][ T6218]  do_syscall_64+0x174/0x580
[  226.106597][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.106612][ T6218]  ? clear_bhb_loop+0x70/0xc0
[  226.106630][ T6218]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.106645][ T6218] RIP: 0033:0x7f3343939df7
[  226.106661][ T6218] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  226.106674][ T6218] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  226.106691][ T6218] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  226.106701][ T6218] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  226.106709][ T6218] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  226.106727][ T6218] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  226.106737][ T6218] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbdc
[  226.106759][ T6218]  </TASK>
[  226.309160][ T6218] FAULT_INJECTION: forcing a failure.
[  226.309160][ T6218] name failslab, interval 1, probability 5, space 0, times -1
[  226.325743][ T6218] CPU: 0 UID: 0 PID: 6218 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  226.325768][ T6218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  226.325778][ T6218] Call Trace:
[  226.325785][ T6218]  <TASK>
[  226.325826][ T6218]  dump_stack_lvl+0xe8/0x150
[  226.325855][ T6218]  should_fail_ex+0x40c/0x560
[  226.325883][ T6218]  should_failslab+0xa8/0x100
[  226.325902][ T6218]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  226.325921][ T6218]  ? kmem_cache_free+0x182/0x650
[  226.325943][ T6218]  ? rpc_new_task+0xf3/0x800
[  226.325961][ T6218]  ? rpc_new_task+0xf3/0x800
[  226.326007][ T6218]  rpc_new_task+0xf3/0x800
[  226.326020][ T6218]  ? __lock_acquire+0x683/0x2cf0
[  226.326034][ T6218]  ? __pfx_rpc_new_task+0x10/0x10
[  226.326094][ T6218]  rpc_run_task+0x22/0x660
[  226.326115][ T6218]  rpc_call_sync+0x10f/0x200
[  226.326198][ T6218]  ? __pfx_rpc_call_sync+0x10/0x10
[  226.326222][ T6218]  ? net_generic+0x1e/0x240
[  226.326237][ T6218]  ? net_generic+0x1e/0x240
[  226.326256][ T6218]  rpcb_register+0x2d0/0x530
[  226.326314][ T6218]  ? __pfx_rpcb_register+0x10/0x10
[  226.326327][ T6218]  ? net_generic+0x1e/0x240
[  226.326381][ T6218]  ? rpcb_create_local+0x4ee/0x670
[  226.326400][ T6218]  ? __pfx_rpcb_create_local+0x10/0x10
[  226.326458][ T6218]  svc_unregister+0x24d/0x780
[  226.326487][ T6218]  svc_bind+0x1e9/0x230
[  226.326572][ T6218]  nfsd_create_serv+0x581/0x840
[  226.326596][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  226.326615][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  226.326672][ T6218]  ? __pfx_nfsd_create_serv+0x10/0x10
[  226.326727][ T6218]  ? net_generic+0x1e/0x240
[  226.326747][ T6218]  ? net_generic+0x1e/0x240
[  226.326839][ T6218]  ? net_generic+0x1e/0x240
[  226.326866][ T6218]  nfsd_svc+0x189/0x780
[  226.326925][ T6218]  write_threads+0x3cd/0x5a0
[  226.326974][ T6218]  ? __might_fault+0xaf/0x130
[  226.326996][ T6218]  ? __pfx_write_threads+0x10/0x10
[  226.327059][ T6218]  ? _copy_from_user+0x94/0xb0
[  226.327109][ T6218]  ? simple_transaction_get+0x12d/0x160
[  226.327130][ T6218]  nfsctl_transaction_write+0x10f/0x160
[  226.327147][ T6218]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  226.327200][ T6218]  vfs_write+0x296/0xba0
[  226.327228][ T6218]  ? __pfx_vfs_write+0x10/0x10
[  226.327305][ T6218]  ? _raw_spin_unlock_irq+0x23/0x50
[  226.327324][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  226.327383][ T6218]  ksys_write+0x150/0x270
[  226.327405][ T6218]  ? __pfx_ksys_write+0x10/0x10
[  226.327428][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.327480][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.327497][ T6218]  do_syscall_64+0x174/0x580
[  226.327515][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.327564][ T6218]  ? clear_bhb_loop+0x70/0xc0
[  226.327581][ T6218]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.327595][ T6218] RIP: 0033:0x7f3343939df7
[  226.327610][ T6218] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  226.327621][ T6218] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  226.327638][ T6218] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  226.327648][ T6218] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  226.327656][ T6218] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  226.327664][ T6218] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  226.327672][ T6218] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbdc
[  226.327693][ T6218]  </TASK>
[  226.500306][ T6218] FAULT_INJECTION: forcing a failure.
[  226.500306][ T6218] name failslab, interval 1, probability 5, space 0, times -1
[  226.507049][ T6218] CPU: 0 UID: 0 PID: 6218 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  226.507072][ T6218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  226.507081][ T6218] Call Trace:
[  226.507090][ T6218]  <TASK>
[  226.507097][ T6218]  dump_stack_lvl+0xe8/0x150
[  226.507124][ T6218]  should_fail_ex+0x40c/0x560
[  226.507177][ T6218]  should_failslab+0xa8/0x100
[  226.507197][ T6218]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  226.507218][ T6218]  ? __kernfs_new_node+0xe6/0x980
[  226.507237][ T6218]  ? __kernfs_new_node+0xe6/0x980
[  226.507262][ T6218]  __kernfs_new_node+0xe6/0x980
[  226.507287][ T6218]  ? __pfx___kernfs_new_node+0x10/0x10
[  226.507306][ T6218]  ? kernfs_root+0x1c/0x230
[  226.507327][ T6218]  ? kernfs_root+0x1c/0x230
[  226.507344][ T6218]  ? kernfs_root+0x1c/0x230
[  226.507358][ T6218]  ? kernfs_root+0x1c/0x230
[  226.507378][ T6218]  kernfs_new_node+0xea/0x140
[  226.507399][ T6218]  __kernfs_create_file+0x4b/0x2e0
[  226.507414][ T6218]  sysfs_add_file_mode_ns+0x237/0x300
[  226.507434][ T6218]  internal_create_group+0x679/0x1180
[  226.507457][ T6218]  ? kernfs_create_dir_ns+0x1d5/0x230
[  226.507568][ T6218]  ? __pfx_internal_create_group+0x10/0x10
[  226.507605][ T6218]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  226.507675][ T6218]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  226.507703][ T6218]  sysfs_create_groups+0x59/0x120
[  226.507722][ T6218]  kobject_add_internal+0x669/0xcd0
[  226.507753][ T6218]  kobject_init_and_add+0x12b/0x1a0
[  226.507777][ T6218]  ? __pfx_kobject_init_and_add+0x10/0x10
[  226.507797][ T6218]  ? kernfs_remove_by_name_ns+0x101/0x140
[  226.507820][ T6218]  ? kernfs_remove_by_name_ns+0x101/0x140
[  226.507842][ T6218]  sysfs_slab_add+0x7b/0x260
[  226.507859][ T6218]  do_kmem_cache_create+0x8bf/0x970
[  226.507897][ T6218]  __kmem_cache_create_args+0x307/0x440
[  226.507918][ T6218]  nfsd_file_cache_init+0x197/0x530
[  226.507938][ T6218]  ? __pfx_nfsd_file_cache_init+0x10/0x10
[  226.507955][ T6218]  ? net_generic+0x1e/0x240
[  226.507978][ T6218]  ? net_generic+0x1e/0x240
[  226.507995][ T6218]  ? net_generic+0x1e/0x240
[  226.508011][ T6218]  ? net_generic+0x1e/0x240
[  226.508062][ T6218]  ? net_generic+0x1f4/0x240
[  226.508101][ T6218]  nfsd_svc+0x315/0x780
[  226.508125][ T6218]  write_threads+0x3cd/0x5a0
[  226.508141][ T6218]  ? __might_fault+0xaf/0x130
[  226.508192][ T6218]  ? __pfx_write_threads+0x10/0x10
[  226.508218][ T6218]  ? _copy_from_user+0x94/0xb0
[  226.508235][ T6218]  ? simple_transaction_get+0x12d/0x160
[  226.508251][ T6218]  nfsctl_transaction_write+0x10f/0x160
[  226.508265][ T6218]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  226.508278][ T6218]  vfs_write+0x296/0xba0
[  226.508301][ T6218]  ? __pfx_vfs_write+0x10/0x10
[  226.508323][ T6218]  ? _raw_spin_unlock_irq+0x23/0x50
[  226.508439][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  226.508465][ T6218]  ksys_write+0x150/0x270
[  226.508484][ T6218]  ? __pfx_ksys_write+0x10/0x10
[  226.508505][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.508520][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.508533][ T6218]  do_syscall_64+0x174/0x580
[  226.508550][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.508565][ T6218]  ? clear_bhb_loop+0x70/0xc0
[  226.508582][ T6218]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.508595][ T6218] RIP: 0033:0x7f3343939df7
[  226.508610][ T6218] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  226.508624][ T6218] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  226.508639][ T6218] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  226.508651][ T6218] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  226.508659][ T6218] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  226.508668][ T6218] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  226.508677][ T6218] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbdc
[  226.508698][ T6218]  </TASK>
[  226.698035][ T6218] kobject: kobject_add_internal failed for nfsd_file (error: -12 parent: slab)
[  226.701487][ T6218] SLUB: Unable to add cache nfsd_file to sysfs
[  226.704489][ T6218] FAULT_INJECTION: forcing a failure.
[  226.704489][ T6218] name failslab, interval 1, probability 5, space 0, times -1
[  226.709683][ T6218] CPU: 0 UID: 0 PID: 6218 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  226.709704][ T6218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  226.709714][ T6218] Call Trace:
[  226.709721][ T6218]  <TASK>
[  226.709729][ T6218]  dump_stack_lvl+0xe8/0x150
[  226.709756][ T6218]  should_fail_ex+0x40c/0x560
[  226.709785][ T6218]  should_failslab+0xa8/0x100
[  226.709805][ T6218]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  226.709828][ T6218]  ? __kernfs_new_node+0xe6/0x980
[  226.709846][ T6218]  ? __kernfs_new_node+0xe6/0x980
[  226.709872][ T6218]  __kernfs_new_node+0xe6/0x980
[  226.709896][ T6218]  ? __pfx___kernfs_new_node+0x10/0x10
[  226.709912][ T6218]  ? kernfs_root+0x1c/0x230
[  226.709931][ T6218]  ? kernfs_root+0x1c/0x230
[  226.709949][ T6218]  ? kernfs_root+0x1c/0x230
[  226.709966][ T6218]  ? kernfs_root+0x1c/0x230
[  226.709986][ T6218]  kernfs_new_node+0xea/0x140
[  226.710009][ T6218]  __kernfs_create_file+0x4b/0x2e0
[  226.710027][ T6218]  sysfs_add_file_mode_ns+0x237/0x300
[  226.710051][ T6218]  internal_create_group+0x679/0x1180
[  226.710079][ T6218]  ? kernfs_create_dir_ns+0x1d5/0x230
[  226.710102][ T6218]  ? __pfx_internal_create_group+0x10/0x10
[  226.710120][ T6218]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  226.711613][ T6218]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  226.711635][ T6218]  sysfs_create_groups+0x59/0x120
[  226.711656][ T6218]  kobject_add_internal+0x669/0xcd0
[  226.711684][ T6218]  kobject_init_and_add+0x12b/0x1a0
[  226.711709][ T6218]  ? __pfx_kobject_init_and_add+0x10/0x10
[  226.711731][ T6218]  ? kernfs_remove_by_name_ns+0x101/0x140
[  226.711753][ T6218]  ? kernfs_remove_by_name_ns+0x101/0x140
[  226.711775][ T6218]  sysfs_slab_add+0x7b/0x260
[  226.711793][ T6218]  do_kmem_cache_create+0x8bf/0x970
[  226.711814][ T6218]  __kmem_cache_create_args+0x307/0x440
[  226.711835][ T6218]  nfsd_file_cache_init+0x1d9/0x530
[  226.711855][ T6218]  ? __pfx_nfsd_file_cache_init+0x10/0x10
[  226.711872][ T6218]  ? net_generic+0x1e/0x240
[  226.711899][ T6218]  ? net_generic+0x1e/0x240
[  226.711917][ T6218]  ? net_generic+0x1e/0x240
[  226.711933][ T6218]  ? net_generic+0x1e/0x240
[  226.711952][ T6218]  ? net_generic+0x1f4/0x240
[  226.711972][ T6218]  nfsd_svc+0x315/0x780
[  226.711996][ T6218]  write_threads+0x3cd/0x5a0
[  226.712011][ T6218]  ? __might_fault+0xaf/0x130
[  226.712031][ T6218]  ? __pfx_write_threads+0x10/0x10
[  226.712059][ T6218]  ? _copy_from_user+0x94/0xb0
[  226.712077][ T6218]  ? simple_transaction_get+0x12d/0x160
[  226.712096][ T6218]  nfsctl_transaction_write+0x10f/0x160
[  226.712112][ T6218]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  226.712155][ T6218]  vfs_write+0x296/0xba0
[  226.712179][ T6218]  ? __pfx_vfs_write+0x10/0x10
[  226.712200][ T6218]  ? _raw_spin_unlock_irq+0x23/0x50
[  226.712216][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  226.712237][ T6218]  ksys_write+0x150/0x270
[  226.712257][ T6218]  ? __pfx_ksys_write+0x10/0x10
[  226.712280][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.712299][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.712316][ T6218]  do_syscall_64+0x174/0x580
[  226.712334][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.712363][ T6218]  ? clear_bhb_loop+0x70/0xc0
[  226.712382][ T6218]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.712397][ T6218] RIP: 0033:0x7f3343939df7
[  226.712414][ T6218] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  226.712428][ T6218] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  226.712445][ T6218] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  226.712457][ T6218] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  226.712467][ T6218] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  226.712476][ T6218] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  226.712486][ T6218] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbdc
[  226.712511][ T6218]  </TASK>
[  226.712805][ T6218] kobject: kobject_add_internal failed for nfsd_file_mark (error: -12 parent: slab)
[  226.892952][ T6218] SLUB: Unable to add cache nfsd_file_mark to sysfs
[  226.895910][ T6218] NFSD: Failed to start, no listeners configured.
[pid  5924] write(4, "tcp 2049\n", 9 <unfinished ...>
[pid  6218] <... write resumed>)        = -1 EIO (Input/output error)
[  227.184062][ T6213] FAULT_INJECTION: forcing a failure.
[  227.184062][ T6213] name failslab, interval 1, probability 5, space 0, times -1
[pid  6218] openat(AT_FDCWD, "/proc/self/make-it-fail", O_WRONLY) = 5
[  227.193292][ T6213] CPU: 0 UID: 0 PID: 6213 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  227.193314][ T6213] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  227.193324][ T6213] Call Trace:
[  227.193331][ T6213]  <TASK>
[  227.193338][ T6213]  dump_stack_lvl+0xe8/0x150
[  227.193367][ T6213]  should_fail_ex+0x40c/0x560
[  227.193394][ T6213]  should_failslab+0xa8/0x100
[  227.193414][ T6213]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  227.193434][ T6213]  ? kstrdup+0x81/0x100
[  227.193457][ T6213]  ? __kernfs_new_node+0xe6/0x980
[  227.193475][ T6213]  ? __kernfs_new_node+0xe6/0x980
[  227.193500][ T6213]  __kernfs_new_node+0xe6/0x980
[  227.193548][ T6213]  ? __pfx___kernfs_new_node+0x10/0x10
[  227.193577][ T6213]  ? kernfs_root+0x1c/0x230
[  227.193600][ T6213]  ? kernfs_root+0x1c/0x230
[  227.193655][ T6213]  ? kernfs_root+0x1c/0x230
[  227.193672][ T6213]  ? kernfs_root+0x1c/0x230
[  227.193696][ T6213]  kernfs_create_dir_ns+0xfe/0x230
[  227.193723][ T6213]  sysfs_create_dir_ns+0x12f/0x2a0
[  227.193747][ T6213]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  227.193770][ T6213]  ? do_raw_spin_unlock+0xf5/0x210
[  227.193794][ T6213]  kobject_add_internal+0x622/0xcd0
[  227.193844][ T6213]  kobject_init_and_add+0x12b/0x1a0
[  227.193872][ T6213]  ? __pfx_kobject_init_and_add+0x10/0x10
[  227.193896][ T6213]  ? __kmalloc_cache_noprof+0x150/0x660
[  227.193918][ T6213]  ? rpc_sysfs_xprt_setup+0xa7/0x260
[  227.193939][ T6213]  ? rpc_sysfs_xprt_setup+0xa7/0x260
[  227.193965][ T6213]  rpc_sysfs_xprt_setup+0x132/0x260
[  227.193989][ T6213]  xprt_switch_alloc+0x420/0x590
[  227.194013][ T6213]  rpc_create_xprt+0x1c7/0xa90
[  227.194032][ T6213]  ? __pfx_rpc_create_xprt+0x10/0x10
[  227.194061][ T6213]  ? rcu_is_watching+0x15/0xb0
[  227.195137][ T6213]  ? trace_kmalloc+0x2a/0xf0
[  227.195162][ T6213]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  227.195186][ T6213]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  227.195208][ T6213]  ? xprt_create_transport+0x39b/0x5f0
[  227.195225][ T6213]  ? xprt_create_transport+0x39b/0x5f0
[  227.195243][ T6213]  ? kstrdup+0x81/0x100
[  227.195265][ T6213]  ? __asan_memcpy+0x40/0x70
[  227.195292][ T6213]  ? xprt_create_transport+0x438/0x5f0
[  227.195311][ T6213]  rpc_create+0x649/0x900
[  227.195336][ T6213]  ? __pfx_rpc_create+0x10/0x10
[  227.195388][ T6213]  ? __lock_acquire+0x683/0x2cf0
[  227.195414][ T6213]  rpcb_create_af_local+0x1c7/0x3c0
[  227.195431][ T6213]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  227.195466][ T6213]  ? do_raw_spin_unlock+0xf5/0x210
[  227.195489][ T6213]  rpcb_create_local+0x268/0x670
[  227.195508][ T6213]  ? __pfx_rpcb_create_local+0x10/0x10
[  227.195523][ T6213]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  227.195542][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.195568][ T6213]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  227.195586][ T6213]  ? __percpu_counter_init_many+0x35f/0x380
[  227.195614][ T6213]  ? __svc_create+0x88f/0x990
[  227.195640][ T6213]  svc_bind+0x1b4/0x230
[  227.195662][ T6213]  nfsd_create_serv+0x581/0x840
[  227.195684][ T6213]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  227.195702][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.195723][ T6213]  ? __pfx_nfsd_create_serv+0x10/0x10
[  227.195746][ T6213]  ? net_generic+0x1e/0x240
[  227.195766][ T6213]  ? net_generic+0x1e/0x240
[  227.195791][ T6213]  ? net_generic+0x1e/0x240
[  227.195818][ T6213]  nfsd_svc+0x189/0x780
[  227.195845][ T6213]  write_threads+0x3cd/0x5a0
[  227.195861][ T6213]  ? __might_fault+0xaf/0x130
[  227.195883][ T6213]  ? __pfx_write_threads+0x10/0x10
[  227.195914][ T6213]  ? _copy_from_user+0x94/0xb0
[  227.195933][ T6213]  ? simple_transaction_get+0x12d/0x160
[  227.195953][ T6213]  nfsctl_transaction_write+0x10f/0x160
[  227.195971][ T6213]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  227.195988][ T6213]  vfs_write+0x296/0xba0
[  227.196015][ T6213]  ? __pfx_vfs_write+0x10/0x10
[  227.196042][ T6213]  ? _raw_spin_unlock_irq+0x23/0x50
[  227.196059][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.196112][ T6213]  ksys_write+0x150/0x270
[  227.196135][ T6213]  ? __pfx_ksys_write+0x10/0x10
[  227.196159][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.196176][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.196193][ T6213]  do_syscall_64+0x174/0x580
[  227.196212][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.196228][ T6213]  ? clear_bhb_loop+0x70/0xc0
[  227.196247][ T6213]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.196263][ T6213] RIP: 0033:0x7f3343939df7
[  227.196280][ T6213] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  227.196294][ T6213] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  227.196313][ T6213] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  227.196325][ T6213] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  227.196335][ T6213] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  227.196345][ T6213] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  227.196355][ T6213] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbc8
[  227.196380][ T6213]  </TASK>
[  227.197129][ T6213] kobject: kobject_add_internal failed for xprt-24-local (error: -12 parent: switch-23)
[pid  6218] write(5, "0", 1)            = 1
[  227.401508][ T6213] FAULT_INJECTION: forcing a failure.
[  227.401508][ T6213] name failslab, interval 1, probability 5, space 0, times -1
[  227.407043][ T6213] CPU: 0 UID: 0 PID: 6213 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  227.407093][ T6213] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  227.407184][ T6213] Call Trace:
[  227.407193][ T6213]  <TASK>
[  227.407212][ T6213]  dump_stack_lvl+0xe8/0x150
[  227.407241][ T6213]  should_fail_ex+0x40c/0x560
[  227.407270][ T6213]  should_failslab+0xa8/0x100
[  227.407289][ T6213]  __kmalloc_node_track_caller_noprof+0x100/0x730
[  227.407315][ T6213]  ? __lock_acquire+0x683/0x2cf0
[  227.407346][ T6213]  ? __kernfs_new_node+0xa9/0x980
[  227.407365][ T6213]  ? __kernfs_new_node+0xa9/0x980
[  227.407390][ T6213]  kstrdup+0x42/0x100
[  227.407413][ T6213]  __kernfs_new_node+0xa9/0x980
[  227.407441][ T6213]  ? __pfx___kernfs_new_node+0x10/0x10
[  227.407462][ T6213]  ? kernfs_root+0x1c/0x230
[  227.407531][ T6213]  ? kernfs_root+0x1c/0x230
[  227.407549][ T6213]  ? kernfs_root+0x1c/0x230
[  227.407566][ T6213]  ? kernfs_root+0x1c/0x230
[  227.407641][ T6213]  kernfs_create_dir_ns+0xfe/0x230
[  227.407666][ T6213]  sysfs_create_dir_ns+0x12f/0x2a0
[  227.407687][ T6213]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  227.407709][ T6213]  ? do_raw_spin_unlock+0xf5/0x210
[  227.407732][ T6213]  kobject_add_internal+0x622/0xcd0
[  227.407761][ T6213]  kobject_init_and_add+0x12b/0x1a0
[  227.407789][ T6213]  ? __pfx_kobject_init_and_add+0x10/0x10
[  227.407812][ T6213]  ? __kmalloc_cache_noprof+0x150/0x660
[  227.407832][ T6213]  ? rpc_sysfs_client_setup+0x106/0x310
[  227.407852][ T6213]  ? rpc_sysfs_client_setup+0x106/0x310
[  227.407878][ T6213]  rpc_sysfs_client_setup+0x191/0x310
[  227.407903][ T6213]  ? __pfx_rpc_sysfs_client_setup+0x10/0x10
[  227.407925][ T6213]  ? rpc_net_ns+0x1e/0x230
[  227.407942][ T6213]  ? rpc_net_ns+0x1e/0x230
[  227.407956][ T6213]  ? rpc_net_ns+0x1e/0x230
[  227.407976][ T6213]  rpc_new_client+0x716/0xc50
[  227.408002][ T6213]  rpc_create_xprt+0x29f/0xa90
[  227.408019][ T6213]  ? __pfx_rpc_create_xprt+0x10/0x10
[  227.408077][ T6213]  ? rcu_is_watching+0x15/0xb0
[  227.408098][ T6213]  ? trace_kmalloc+0x2a/0xf0
[  227.408122][ T6213]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  227.408145][ T6213]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  227.408166][ T6213]  ? xprt_create_transport+0x39b/0x5f0
[  227.408183][ T6213]  ? xprt_create_transport+0x39b/0x5f0
[  227.408199][ T6213]  ? kstrdup+0x81/0x100
[  227.408222][ T6213]  ? __asan_memcpy+0x40/0x70
[  227.408304][ T6213]  ? xprt_create_transport+0x438/0x5f0
[  227.408324][ T6213]  rpc_create+0x649/0x900
[  227.408349][ T6213]  ? __pfx_rpc_create+0x10/0x10
[  227.408397][ T6213]  ? __lock_acquire+0x683/0x2cf0
[  227.408421][ T6213]  rpcb_create_af_local+0x1c7/0x3c0
[  227.408438][ T6213]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  227.408471][ T6213]  ? do_raw_spin_unlock+0xf5/0x210
[  227.408493][ T6213]  rpcb_create_local+0x268/0x670
[  227.408512][ T6213]  ? __pfx_rpcb_create_local+0x10/0x10
[  227.408526][ T6213]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  227.408543][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.408562][ T6213]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  227.408579][ T6213]  ? __percpu_counter_init_many+0x35f/0x380
[  227.408606][ T6213]  ? __svc_create+0x88f/0x990
[  227.408630][ T6213]  svc_bind+0x1b4/0x230
[  227.408649][ T6213]  nfsd_create_serv+0x581/0x840
[  227.408670][ T6213]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  227.408688][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.408709][ T6213]  ? __pfx_nfsd_create_serv+0x10/0x10
[  227.408731][ T6213]  ? net_generic+0x1e/0x240
[  227.408751][ T6213]  ? net_generic+0x1e/0x240
[  227.408777][ T6213]  ? net_generic+0x1e/0x240
[  227.408803][ T6213]  nfsd_svc+0x189/0x780
[  227.408829][ T6213]  write_threads+0x3cd/0x5a0
[  227.408842][ T6213]  ? __might_fault+0xaf/0x130
[  227.408863][ T6213]  ? __pfx_write_threads+0x10/0x10
[  227.408893][ T6213]  ? _copy_from_user+0x94/0xb0
[  227.408912][ T6213]  ? simple_transaction_get+0x12d/0x160
[  227.408931][ T6213]  nfsctl_transaction_write+0x10f/0x160
[  227.408949][ T6213]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  227.408966][ T6213]  vfs_write+0x296/0xba0
[  227.408992][ T6213]  ? __pfx_vfs_write+0x10/0x10
[  227.409018][ T6213]  ? _raw_spin_unlock_irq+0x23/0x50
[  227.409041][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.409091][ T6213]  ksys_write+0x150/0x270
[  227.409112][ T6213]  ? __pfx_ksys_write+0x10/0x10
[  227.409136][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.409153][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.409170][ T6213]  do_syscall_64+0x174/0x580
[  227.409188][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.409203][ T6213]  ? clear_bhb_loop+0x70/0xc0
[  227.409222][ T6213]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.409238][ T6213] RIP: 0033:0x7f3343939df7
[  227.409255][ T6213] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  227.409268][ T6213] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  227.409286][ T6213] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  227.409297][ T6213] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  227.409306][ T6213] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  227.409315][ T6213] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  227.409325][ T6213] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbc8
[  227.409348][ T6213]  </TASK>
[  227.620278][ T6213] kobject: kobject_add_internal failed for clnt-23 (error: -12 parent: rpc-clients)
[  227.625345][ T6213] FAULT_INJECTION: forcing a failure.
[  227.625345][ T6213] name failslab, interval 1, probability 5, space 0, times -1
[  227.631950][ T6213] CPU: 0 UID: 0 PID: 6213 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  227.631970][ T6213] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  227.631980][ T6213] Call Trace:
[  227.631986][ T6213]  <TASK>
[  227.631993][ T6213]  dump_stack_lvl+0xe8/0x150
[  227.632021][ T6213]  should_fail_ex+0x40c/0x560
[  227.632137][ T6213]  should_failslab+0xa8/0x100
[  227.632156][ T6213]  __kmalloc_noprof+0xfe/0x720
[  227.632176][ T6213]  ? trace_kmem_cache_alloc+0x29/0xe0
[  227.632196][ T6213]  ? security_sk_alloc+0x52/0x360
[  227.632211][ T6213]  ? security_sk_alloc+0x52/0x360
[  227.632231][ T6213]  security_sk_alloc+0x52/0x360
[  227.632267][ T6213]  sk_prot_alloc+0x101/0x210
[  227.632294][ T6213]  sk_alloc+0x3a/0x390
[  227.632317][ T6213]  unix_create1+0xb0/0x7c0
[  227.632336][ T6213]  ? _raw_spin_unlock_irq+0x2e/0x50
[  227.632352][ T6213]  ? pidfs_register_pid_gfp+0x16a/0x1c0
[  227.632372][ T6213]  unix_stream_connect+0x387/0xfd0
[  227.632400][ T6213]  kernel_connect+0x141/0x1c0
[  227.632418][ T6213]  ? __pfx_kernel_connect+0x10/0x10
[  227.632446][ T6213]  ? __local_bh_enable_ip+0xd0/0x130
[  227.632469][ T6213]  xs_local_connect+0x626/0x810
[  227.632490][ T6213]  ? __pfx_xs_local_connect+0x10/0x10
[  227.632511][ T6213]  ? do_raw_spin_unlock+0xf5/0x210
[pid  6218] close(5)                    = 0
[  227.632533][ T6213]  xprt_connect+0x613/0x850
[  227.632556][ T6213]  ? __pfx_call_connect+0x10/0x10
[  227.632575][ T6213]  __rpc_execute+0x526/0x1280
[  227.632605][ T6213]  ? __pfx___rpc_execute+0x10/0x10
[  227.632643][ T6213]  ? rpc_task_get_xprt+0x26/0x250
[  227.632659][ T6213]  ? rpc_make_runnable+0xae/0x1c0
[  227.632678][ T6213]  rpc_execute+0x1c1/0x390
[  227.632697][ T6213]  rpc_run_task+0x4a6/0x660
[  227.632715][ T6213]  rpc_create_xprt+0x533/0xa90
[  227.632730][ T6213]  ? __pfx_rpc_create_xprt+0x10/0x10
[  227.632757][ T6213]  ? rcu_is_watching+0x15/0xb0
[  227.632774][ T6213]  ? trace_kmalloc+0x2a/0xf0
[  227.632797][ T6213]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  227.632817][ T6213]  ? xprt_create_transport+0x39b/0x5f0
[  227.632841][ T6213]  ? xprt_create_transport+0x438/0x5f0
[  227.632859][ T6213]  rpc_create+0x649/0x900
[  227.632882][ T6213]  ? __pfx_rpc_create+0x10/0x10
[  227.632929][ T6213]  ? __lock_acquire+0x683/0x2cf0
[  227.632952][ T6213]  rpcb_create_af_local+0x1c7/0x3c0
[  227.632968][ T6213]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  227.633000][ T6213]  ? do_raw_spin_unlock+0xf5/0x210
[  227.633067][ T6213]  rpcb_create_local+0x268/0x670
[  227.633084][ T6213]  ? __pfx_rpcb_create_local+0x10/0x10
[  227.633098][ T6213]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  227.633114][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.633139][ T6213]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  227.633156][ T6213]  ? __percpu_counter_init_many+0x35f/0x380
[  227.633181][ T6213]  ? __svc_create+0x88f/0x990
[  227.633204][ T6213]  svc_bind+0x1b4/0x230
[  227.633224][ T6213]  nfsd_create_serv+0x581/0x840
[  227.633245][ T6213]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  227.633261][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.633282][ T6213]  ? __pfx_nfsd_create_serv+0x10/0x10
[  227.633301][ T6213]  ? net_generic+0x1e/0x240
[  227.633320][ T6213]  ? net_generic+0x1e/0x240
[  227.633343][ T6213]  ? net_generic+0x1e/0x240
[  227.633368][ T6213]  nfsd_svc+0x189/0x780
[  227.633392][ T6213]  write_threads+0x3cd/0x5a0
[  227.633406][ T6213]  ? __might_fault+0xaf/0x130
[  227.633426][ T6213]  ? __pfx_write_threads+0x10/0x10
[  227.633455][ T6213]  ? _copy_from_user+0x94/0xb0
[  227.633472][ T6213]  ? simple_transaction_get+0x12d/0x160
[  227.633490][ T6213]  nfsctl_transaction_write+0x10f/0x160
[  227.633506][ T6213]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  227.633522][ T6213]  vfs_write+0x296/0xba0
[  227.633546][ T6213]  ? __pfx_vfs_write+0x10/0x10
[  227.633570][ T6213]  ? _raw_spin_unlock_irq+0x23/0x50
[  227.633586][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.633608][ T6213]  ksys_write+0x150/0x270
[  227.633627][ T6213]  ? __pfx_ksys_write+0x10/0x10
[  227.633649][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.633664][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.633680][ T6213]  do_syscall_64+0x174/0x580
[  227.633697][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.633712][ T6213]  ? clear_bhb_loop+0x70/0xc0
[  227.633729][ T6213]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.633743][ T6213] RIP: 0033:0x7f3343939df7
[  227.633783][ T6213] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  227.633795][ T6213] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  227.633811][ T6213] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  227.633822][ T6213] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  227.633831][ T6213] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  227.633840][ T6213] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  227.633849][ T6213] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbc8
[  227.633873][ T6213]  </TASK>
[  227.634355][ T6213] xs_local_setup_socket: unhandled error (12) connecting to @/run/rpcbind.sock
[  227.862566][ T6213] FAULT_INJECTION: forcing a failure.
[  227.862566][ T6213] name failslab, interval 1, probability 5, space 0, times -1
[  227.867985][ T6213] CPU: 0 UID: 0 PID: 6213 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  227.868286][ T6213] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  227.868297][ T6213] Call Trace:
[  227.868305][ T6213]  <TASK>
[  227.868312][ T6213]  dump_stack_lvl+0xe8/0x150
[  227.868337][ T6213]  should_fail_ex+0x40c/0x560
[  227.868361][ T6213]  should_failslab+0xa8/0x100
[  227.868378][ T6213]  __kmalloc_noprof+0xfe/0x720
[  227.868400][ T6213]  ? kobject_get_path+0xc5/0x2f0
[  227.868420][ T6213]  ? kobject_get_path+0xc5/0x2f0
[  227.868443][ T6213]  kobject_get_path+0xc5/0x2f0
[  227.868466][ T6213]  kobject_uevent_env+0x29e/0x9e0
[  227.868487][ T6213]  xprt_switch_alloc+0x420/0x590
[  227.868508][ T6213]  rpc_create_xprt+0x1c7/0xa90
[  227.868525][ T6213]  ? __pfx_rpc_create_xprt+0x10/0x10
[  227.868551][ T6213]  ? rcu_is_watching+0x15/0xb0
[  227.868569][ T6213]  ? trace_kmalloc+0x2a/0xf0
[  227.868588][ T6213]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  227.868607][ T6213]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  227.868625][ T6213]  ? xprt_create_transport+0x39b/0x5f0
[  227.868639][ T6213]  ? xprt_create_transport+0x39b/0x5f0
[  227.868655][ T6213]  ? kstrdup+0x81/0x100
[  227.868742][ T6213]  ? __asan_memcpy+0x40/0x70
[  227.868765][ T6213]  ? xprt_create_transport+0x438/0x5f0
[  227.868783][ T6213]  rpc_create+0x649/0x900
[  227.868804][ T6213]  ? __pfx_rpc_create+0x10/0x10
[  227.868846][ T6213]  ? __lock_acquire+0x683/0x2cf0
[  227.868869][ T6213]  rpcb_create_af_local+0x1c7/0x3c0
[  227.868884][ T6213]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  227.868913][ T6213]  ? do_raw_spin_unlock+0xf5/0x210
[  227.868990][ T6213]  rpcb_create_local+0x28f/0x670
[  227.869034][ T6213]  ? __pfx_rpcb_create_local+0x10/0x10
[  227.869047][ T6213]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  227.869063][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.869080][ T6213]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  227.869095][ T6213]  ? __percpu_counter_init_many+0x35f/0x380
[  227.869126][ T6213]  ? __svc_create+0x88f/0x990
[  227.869147][ T6213]  svc_bind+0x1b4/0x230
[  227.869165][ T6213]  nfsd_create_serv+0x581/0x840
[  227.869185][ T6213]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  227.869201][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.869220][ T6213]  ? __pfx_nfsd_create_serv+0x10/0x10
[  227.869239][ T6213]  ? net_generic+0x1e/0x240
[  227.869256][ T6213]  ? net_generic+0x1e/0x240
[  227.869276][ T6213]  ? net_generic+0x1e/0x240
[  227.869299][ T6213]  nfsd_svc+0x189/0x780
[  227.869322][ T6213]  write_threads+0x3cd/0x5a0
[  227.869335][ T6213]  ? __might_fault+0xaf/0x130
[  227.869355][ T6213]  ? __pfx_write_threads+0x10/0x10
[  227.869382][ T6213]  ? _copy_from_user+0x94/0xb0
[  227.869399][ T6213]  ? simple_transaction_get+0x12d/0x160
[  227.869417][ T6213]  nfsctl_transaction_write+0x10f/0x160
[  227.869434][ T6213]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  227.869449][ T6213]  vfs_write+0x296/0xba0
[  227.869473][ T6213]  ? __pfx_vfs_write+0x10/0x10
[  227.869496][ T6213]  ? _raw_spin_unlock_irq+0x23/0x50
[  227.869511][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.869532][ T6213]  ksys_write+0x150/0x270
[  227.869551][ T6213]  ? __pfx_ksys_write+0x10/0x10
[  227.869571][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.869587][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.869602][ T6213]  do_syscall_64+0x174/0x580
[  227.869618][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.869632][ T6213]  ? clear_bhb_loop+0x70/0xc0
[  227.869648][ T6213]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.869662][ T6213] RIP: 0033:0x7f3343939df7
[  227.869679][ T6213] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  227.869691][ T6213] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  227.869708][ T6213] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  227.869719][ T6213] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  227.869727][ T6213] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  227.869736][ T6213] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  227.869745][ T6213] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbc8
[  227.869767][ T6213]  </TASK>
[  227.873058][ T6213] FAULT_INJECTION: forcing a failure.
[  227.873058][ T6213] name failslab, interval 1, probability 5, space 0, times -1
[pid  6218] write(4, "tcp 2049\n", 9 <unfinished ...>
[pid  6213] <... write resumed>)        = -1 ENOMEM (Cannot allocate memory)
[  228.071271][ T6213] CPU: 0 UID: 0 PID: 6213 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  228.071291][ T6213] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  228.071300][ T6213] Call Trace:
[  228.071308][ T6213]  <TASK>
[  228.071314][ T6213]  dump_stack_lvl+0xe8/0x150
[  228.071339][ T6213]  should_fail_ex+0x40c/0x560
[  228.071364][ T6213]  should_failslab+0xa8/0x100
[  228.071382][ T6213]  __kmalloc_cache_noprof+0xa8/0x660
[  228.071403][ T6213]  ? do_syscall_64+0x174/0x580
[  228.071423][ T6213]  ? xprt_switch_alloc+0x7a/0x590
[  228.071439][ T6213]  ? xprt_switch_alloc+0x7a/0x590
[  228.071460][ T6213]  xprt_switch_alloc+0x7a/0x590
[  228.071481][ T6213]  rpc_create_xprt+0x1c7/0xa90
[  228.071496][ T6213]  ? __pfx_rpc_create_xprt+0x10/0x10
[  228.071523][ T6213]  ? rcu_is_watching+0x15/0xb0
[  228.071539][ T6213]  ? trace_kmalloc+0x2a/0xf0
[  228.071559][ T6213]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  228.071578][ T6213]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  228.071597][ T6213]  ? xprt_create_transport+0x39b/0x5f0
[  228.071612][ T6213]  ? xprt_create_transport+0x39b/0x5f0
[  228.071628][ T6213]  ? kstrdup+0x81/0x100
[  228.071649][ T6213]  ? __asan_memcpy+0x40/0x70
[  228.071672][ T6213]  ? xprt_create_transport+0x438/0x5f0
[  228.071689][ T6213]  rpc_create+0x649/0x900
[  228.071712][ T6213]  ? __pfx_rpc_create+0x10/0x10
[  228.071771][ T6213]  rpcb_create_local+0x3ab/0x670
[  228.071790][ T6213]  ? __pfx_rpcb_create_local+0x10/0x10
[  228.071815][ T6213]  ? __svc_create+0x88f/0x990
[  228.071840][ T6213]  svc_bind+0x1b4/0x230
[  228.071861][ T6213]  nfsd_create_serv+0x581/0x840
[  228.071881][ T6213]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  228.071899][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  228.071921][ T6213]  ? __pfx_nfsd_create_serv+0x10/0x10
[  228.071940][ T6213]  ? net_generic+0x1e/0x240
[  228.071961][ T6213]  ? net_generic+0x1e/0x240
[  228.072023][ T6213]  ? net_generic+0x1e/0x240
[  228.072106][ T6213]  nfsd_svc+0x189/0x780
[  228.072128][ T6213]  write_threads+0x3cd/0x5a0
[  228.072141][ T6213]  ? __might_fault+0xaf/0x130
[  228.072167][ T6213]  ? __pfx_write_threads+0x10/0x10
[  228.072193][ T6213]  ? _copy_from_user+0x94/0xb0
[  228.072213][ T6213]  ? simple_transaction_get+0x12d/0x160
[  228.072231][ T6213]  nfsctl_transaction_write+0x10f/0x160
[  228.072247][ T6213]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  228.072261][ T6213]  vfs_write+0x296/0xba0
[  228.072284][ T6213]  ? __pfx_vfs_write+0x10/0x10
[  228.072307][ T6213]  ? _raw_spin_unlock_irq+0x23/0x50
[  228.072323][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  228.072346][ T6213]  ksys_write+0x150/0x270
[  228.072365][ T6213]  ? __pfx_ksys_write+0x10/0x10
[pid  6213] openat(AT_FDCWD, "/proc/self/make-it-fail", O_WRONLY) = 5
[pid  6213] write(5, "0", 1)            = 1
[pid  6213] close(5)                    = 0
[  228.072388][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.072403][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.072419][ T6213]  do_syscall_64+0x174/0x580
[  228.072437][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.072453][ T6213]  ? clear_bhb_loop+0x70/0xc0
[  228.072470][ T6213]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.072485][ T6213] RIP: 0033:0x7f3343939df7
[  228.072500][ T6213] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  228.072513][ T6213] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  228.072530][ T6213] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  228.072541][ T6213] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  228.072580][ T6213] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  228.072588][ T6213] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  228.072598][ T6213] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbc8
[  228.072620][ T6213]  </TASK>
[  228.073497][ T6019] FAULT_INJECTION: forcing a failure.
[  228.073497][ T6019] name failslab, interval 1, probability 5, space 0, times -1
[  228.242885][ T6019] CPU: 0 UID: 0 PID: 6019 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  228.242908][ T6019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  228.242917][ T6019] Call Trace:
[  228.242924][ T6019]  <TASK>
[  228.242931][ T6019]  dump_stack_lvl+0xe8/0x150
[  228.242957][ T6019]  should_fail_ex+0x40c/0x560
[  228.243014][ T6019]  should_failslab+0xa8/0x100
[  228.243031][ T6019]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  228.243052][ T6019]  ? __kernfs_new_node+0xe6/0x980
[  228.243069][ T6019]  ? __kernfs_new_node+0xe6/0x980
[  228.243099][ T6019]  __kernfs_new_node+0xe6/0x980
[  228.243123][ T6019]  ? __pfx___kernfs_new_node+0x10/0x10
[  228.243142][ T6019]  ? kernfs_root+0x1c/0x230
[  228.243163][ T6019]  ? kernfs_root+0x1c/0x230
[  228.243179][ T6019]  ? kernfs_root+0x1c/0x230
[  228.243194][ T6019]  ? kernfs_root+0x1c/0x230
[  228.243214][ T6019]  kernfs_new_node+0xea/0x140
[  228.243236][ T6019]  __kernfs_create_file+0x4b/0x2e0
[  228.243253][ T6019]  sysfs_add_file_mode_ns+0x237/0x300
[  228.243274][ T6019]  internal_create_group+0x679/0x1180
[  228.243300][ T6019]  ? kernfs_create_dir_ns+0x1d5/0x230
[  228.243323][ T6019]  ? __pfx_internal_create_group+0x10/0x10
[  228.243339][ T6019]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  228.243357][ T6019]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  228.243378][ T6019]  sysfs_create_groups+0x59/0x120
[  228.243399][ T6019]  kobject_add_internal+0x669/0xcd0
[  228.243425][ T6019]  kobject_init_and_add+0x12b/0x1a0
[  228.243449][ T6019]  ? __pfx_kobject_init_and_add+0x10/0x10
[  228.243468][ T6019]  ? __kmalloc_cache_noprof+0x150/0x660
[  228.243488][ T6019]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  228.243506][ T6019]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  228.243529][ T6019]  rpc_sysfs_xprt_switch_setup+0x169/0x2b0
[  228.243554][ T6019]  xprt_switch_alloc+0x238/0x590
[  228.243575][ T6019]  rpc_create_xprt+0x1c7/0xa90
[  228.243591][ T6019]  ? __pfx_rpc_create_xprt+0x10/0x10
[  228.243616][ T6019]  ? rcu_is_watching+0x15/0xb0
[  228.243633][ T6019]  ? trace_kmalloc+0x2a/0xf0
[  228.243652][ T6019]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  228.243673][ T6019]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  228.243690][ T6019]  ? xprt_create_transport+0x39b/0x5f0
[  228.243706][ T6019]  ? xprt_create_transport+0x39b/0x5f0
[  228.243722][ T6019]  ? kstrdup+0x81/0x100
[  228.243743][ T6019]  ? __asan_memcpy+0x40/0x70
[  228.243766][ T6019]  ? xprt_create_transport+0x438/0x5f0
[  228.243783][ T6019]  rpc_create+0x649/0x900
[  228.243805][ T6019]  ? __pfx_rpc_create+0x10/0x10
[  228.243848][ T6019]  ? __lock_acquire+0x683/0x2cf0
[  228.243871][ T6019]  rpcb_create_af_local+0x1c7/0x3c0
[  228.243886][ T6019]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  228.243916][ T6019]  ? do_raw_spin_unlock+0xf5/0x210
[  228.243937][ T6019]  rpcb_create_local+0x268/0x670
[  228.243955][ T6019]  ? __pfx_rpcb_create_local+0x10/0x10
[  228.244008][ T6019]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  228.244025][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  228.244042][ T6019]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  228.244056][ T6019]  ? __percpu_counter_init_many+0x35f/0x380
[  228.244088][ T6019]  ? __svc_create+0x88f/0x990
[  228.244110][ T6019]  svc_bind+0x1b4/0x230
[  228.244128][ T6019]  nfsd_create_serv+0x581/0x840
[  228.244148][ T6019]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  228.244163][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  228.244182][ T6019]  ? __pfx_nfsd_create_serv+0x10/0x10
[  228.244203][ T6019]  ? net_generic+0x1e/0x240
[  228.244220][ T6019]  ? net_generic+0x1e/0x240
[  228.244241][ T6019]  ? net_generic+0x1e/0x240
[  228.244264][ T6019]  nfsd_svc+0x189/0x780
[  228.244313][ T6019]  write_threads+0x3cd/0x5a0
[  228.244329][ T6019]  ? __might_fault+0xaf/0x130
[  228.244348][ T6019]  ? __pfx_write_threads+0x10/0x10
[  228.244374][ T6019]  ? _copy_from_user+0x94/0xb0
[  228.244392][ T6019]  ? simple_transaction_get+0x12d/0x160
[  228.244412][ T6019]  nfsctl_transaction_write+0x10f/0x160
[  228.244428][ T6019]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  228.244444][ T6019]  vfs_write+0x296/0xba0
[  228.244470][ T6019]  ? __pfx_vfs_write+0x10/0x10
[  228.244493][ T6019]  ? _raw_spin_unlock_irq+0x23/0x50
[  228.244508][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  228.244530][ T6019]  ksys_write+0x150/0x270
[  228.244547][ T6019]  ? __pfx_ksys_write+0x10/0x10
[  228.244567][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.244582][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.244596][ T6019]  do_syscall_64+0x174/0x580
[  228.244613][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.244627][ T6019]  ? clear_bhb_loop+0x70/0xc0
[  228.244644][ T6019]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.244659][ T6019] RIP: 0033:0x7f3343939df7
[  228.244675][ T6019] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  228.244688][ T6019] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  228.244705][ T6019] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  228.244716][ T6019] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  228.244725][ T6019] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  228.244734][ T6019] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  228.244743][ T6019] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d924
[  228.244765][ T6019]  </TASK>
[  228.244928][ T6019] kobject: kobject_add_internal failed for switch-23 (error: -12 parent: xprt-switches)
[  228.507446][ T6019] FAULT_INJECTION: forcing a failure.
[  228.507446][ T6019] name failslab, interval 1, probability 5, space 0, times -1
[  228.514872][ T6019] CPU: 0 UID: 0 PID: 6019 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  228.514894][ T6019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  228.514903][ T6019] Call Trace:
[  228.514911][ T6019]  <TASK>
[  228.514918][ T6019]  dump_stack_lvl+0xe8/0x150
[  228.514976][ T6019]  should_fail_ex+0x40c/0x560
[  228.515002][ T6019]  should_failslab+0xa8/0x100
[  228.515036][ T6019]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  228.515062][ T6019]  ? __kernfs_new_node+0xe6/0x980
[  228.515079][ T6019]  ? __kernfs_new_node+0xe6/0x980
[  228.515102][ T6019]  __kernfs_new_node+0xe6/0x980
[  228.515127][ T6019]  ? __pfx___kernfs_new_node+0x10/0x10
[  228.515145][ T6019]  ? kernfs_root+0x1c/0x230
[  228.515167][ T6019]  ? kernfs_root+0x1c/0x230
[  228.515182][ T6019]  ? kernfs_root+0x1c/0x230
[  228.515197][ T6019]  ? kernfs_root+0x1c/0x230
[  228.515216][ T6019]  kernfs_new_node+0xea/0x140
[  228.515237][ T6019]  __kernfs_create_file+0x4b/0x2e0
[  228.515252][ T6019]  sysfs_add_file_mode_ns+0x237/0x300
[  228.515273][ T6019]  internal_create_group+0x679/0x1180
[  228.515299][ T6019]  ? kernfs_create_dir_ns+0x1d5/0x230
[  228.515320][ T6019]  ? __pfx_internal_create_group+0x10/0x10
[  228.515336][ T6019]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  228.515356][ T6019]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  228.515375][ T6019]  sysfs_create_groups+0x59/0x120
[  228.515395][ T6019]  kobject_add_internal+0x669/0xcd0
[  228.515422][ T6019]  kobject_init_and_add+0x12b/0x1a0
[  228.515449][ T6019]  ? __pfx_kobject_init_and_add+0x10/0x10
[  228.515469][ T6019]  ? __kmalloc_cache_noprof+0x150/0x660
[  228.515487][ T6019]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  228.515508][ T6019]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  228.515533][ T6019]  rpc_sysfs_xprt_switch_setup+0x169/0x2b0
[  228.515556][ T6019]  xprt_switch_alloc+0x238/0x590
[  228.515577][ T6019]  rpc_create_xprt+0x1c7/0xa90
[  228.515594][ T6019]  ? __pfx_rpc_create_xprt+0x10/0x10
[  228.515619][ T6019]  ? rcu_is_watching+0x15/0xb0
[  228.515635][ T6019]  ? trace_kmalloc+0x2a/0xf0
[  228.515655][ T6019]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  228.515674][ T6019]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  228.515692][ T6019]  ? xprt_create_transport+0x39b/0x5f0
[  228.515707][ T6019]  ? xprt_create_transport+0x39b/0x5f0
[  228.515721][ T6019]  ? kstrdup+0x81/0x100
[  228.515742][ T6019]  ? __asan_memcpy+0x40/0x70
[  228.515764][ T6019]  ? xprt_create_transport+0x438/0x5f0
[  228.515782][ T6019]  rpc_create+0x649/0x900
[  228.515804][ T6019]  ? __pfx_rpc_create+0x10/0x10
[  228.515850][ T6019]  ? __lock_acquire+0x683/0x2cf0
[  228.515873][ T6019]  rpcb_create_af_local+0x1c7/0x3c0
[  228.515888][ T6019]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  228.515918][ T6019]  ? do_raw_spin_unlock+0xf5/0x210
[  228.515977][ T6019]  rpcb_create_local+0x28f/0x670
[  228.515994][ T6019]  ? __pfx_rpcb_create_local+0x10/0x10
[  228.516075][ T6019]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  228.516091][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  228.516109][ T6019]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  228.516123][ T6019]  ? __percpu_counter_init_many+0x35f/0x380
[  228.516147][ T6019]  ? __svc_create+0x88f/0x990
[  228.516170][ T6019]  svc_bind+0x1b4/0x230
[  228.516188][ T6019]  nfsd_create_serv+0x581/0x840
[  228.516210][ T6019]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  228.516226][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  228.516247][ T6019]  ? __pfx_nfsd_create_serv+0x10/0x10
[  228.516265][ T6019]  ? net_generic+0x1e/0x240
[  228.516283][ T6019]  ? net_generic+0x1e/0x240
[  228.516303][ T6019]  ? net_generic+0x1e/0x240
[  228.516325][ T6019]  nfsd_svc+0x189/0x780
[  228.516346][ T6019]  write_threads+0x3cd/0x5a0
[  228.516360][ T6019]  ? __might_fault+0xaf/0x130
[  228.516379][ T6019]  ? __pfx_write_threads+0x10/0x10
[  228.516405][ T6019]  ? _copy_from_user+0x94/0xb0
[  228.516423][ T6019]  ? simple_transaction_get+0x12d/0x160
[  228.516440][ T6019]  nfsctl_transaction_write+0x10f/0x160
[  228.516457][ T6019]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  228.516471][ T6019]  vfs_write+0x296/0xba0
[  228.516493][ T6019]  ? __pfx_vfs_write+0x10/0x10
[  228.516515][ T6019]  ? _raw_spin_unlock_irq+0x23/0x50
[  228.516530][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  228.516551][ T6019]  ksys_write+0x150/0x270
[  228.516570][ T6019]  ? __pfx_ksys_write+0x10/0x10
[  228.516590][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.516605][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.516619][ T6019]  do_syscall_64+0x174/0x580
[  228.516636][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.516650][ T6019]  ? clear_bhb_loop+0x70/0xc0
[  228.516667][ T6019]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.516681][ T6019] RIP: 0033:0x7f3343939df7
[  228.516696][ T6019] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  228.516710][ T6019] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  228.516726][ T6019] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  228.516737][ T6019] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  228.516747][ T6019] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  228.516755][ T6019] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  228.516764][ T6019] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d924
[  228.516786][ T6019]  </TASK>
[  228.517282][ T6019] kobject: kobject_add_internal failed for switch-23 (error: -12 parent: xprt-switches)
[  228.780084][ T6019] FAULT_INJECTION: forcing a failure.
[  228.780084][ T6019] name failslab, interval 1, probability 5, space 0, times -1
[  228.785178][ T6019] CPU: 0 UID: 0 PID: 6019 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  228.785199][ T6019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  228.785209][ T6019] Call Trace:
[  228.785217][ T6019]  <TASK>
[  228.785224][ T6019]  dump_stack_lvl+0xe8/0x150
[  228.785250][ T6019]  should_fail_ex+0x40c/0x560
[  228.785275][ T6019]  should_failslab+0xa8/0x100
[  228.785295][ T6019]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  228.785316][ T6019]  ? __kernfs_new_node+0xe6/0x980
[  228.785333][ T6019]  ? __kernfs_new_node+0xe6/0x980
[  228.785354][ T6019]  __kernfs_new_node+0xe6/0x980
[  228.785377][ T6019]  ? __pfx___kernfs_new_node+0x10/0x10
[  228.785395][ T6019]  ? kernfs_root+0x1c/0x230
[  228.785416][ T6019]  ? kernfs_root+0x1c/0x230
[  228.785432][ T6019]  ? kernfs_root+0x1c/0x230
[  228.785447][ T6019]  ? kernfs_root+0x1c/0x230
[  228.785467][ T6019]  kernfs_new_node+0xea/0x140
[  228.785489][ T6019]  __kernfs_create_file+0x4b/0x2e0
[  228.785506][ T6019]  sysfs_add_file_mode_ns+0x237/0x300
[  228.785528][ T6019]  internal_create_group+0x679/0x1180
[  228.785552][ T6019]  ? kernfs_create_dir_ns+0x1d5/0x230
[  228.785575][ T6019]  ? __pfx_internal_create_group+0x10/0x10
[  228.785603][ T6019]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  228.785620][ T6019]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  228.785640][ T6019]  sysfs_create_groups+0x59/0x120
[  228.785772][ T6019]  kobject_add_internal+0x669/0xcd0
[  228.785798][ T6019]  kobject_init_and_add+0x12b/0x1a0
[  228.785822][ T6019]  ? __pfx_kobject_init_and_add+0x10/0x10
[  228.785844][ T6019]  ? __kmalloc_cache_noprof+0x150/0x660
[  228.785864][ T6019]  ? rpc_sysfs_xprt_setup+0xa7/0x260
[  228.785882][ T6019]  ? rpc_sysfs_xprt_setup+0xa7/0x260
[  228.785935][ T6019]  rpc_sysfs_xprt_setup+0x132/0x260
[  228.785958][ T6019]  xprt_switch_alloc+0x420/0x590
[  228.785978][ T6019]  rpc_create_xprt+0x1c7/0xa90
[  228.785994][ T6019]  ? __pfx_rpc_create_xprt+0x10/0x10
[  228.786020][ T6019]  ? rcu_is_watching+0x15/0xb0
[  228.786036][ T6019]  ? trace_kmalloc+0x2a/0xf0
[  228.786056][ T6019]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  228.786075][ T6019]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  228.786093][ T6019]  ? xprt_create_transport+0x39b/0x5f0
[  228.786107][ T6019]  ? xprt_create_transport+0x39b/0x5f0
[  228.786120][ T6019]  ? kstrdup+0x81/0x100
[  228.786141][ T6019]  ? __asan_memcpy+0x40/0x70
[  228.786166][ T6019]  ? xprt_create_transport+0x438/0x5f0
[  228.786247][ T6019]  rpc_create+0x649/0x900
[  228.786269][ T6019]  ? __pfx_rpc_create+0x10/0x10
[  228.786378][ T6019]  rpcb_create_local+0x3ab/0x670
[  228.786472][ T6019]  ? __pfx_rpcb_create_local+0x10/0x10
[  228.786497][ T6019]  ? __svc_create+0x88f/0x990
[  228.786518][ T6019]  svc_bind+0x1b4/0x230
[  228.786536][ T6019]  nfsd_create_serv+0x581/0x840
[  228.786557][ T6019]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  228.786572][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  228.786602][ T6019]  ? __pfx_nfsd_create_serv+0x10/0x10
[  228.786623][ T6019]  ? net_generic+0x1e/0x240
[  228.786641][ T6019]  ? net_generic+0x1e/0x240
[  228.786661][ T6019]  ? net_generic+0x1e/0x240
[  228.786686][ T6019]  nfsd_svc+0x189/0x780
[  228.786709][ T6019]  write_threads+0x3cd/0x5a0
[  228.786722][ T6019]  ? __might_fault+0xaf/0x130
[  228.786741][ T6019]  ? __pfx_write_threads+0x10/0x10
[  228.786855][ T6019]  ? _copy_from_user+0x94/0xb0
[  228.786876][ T6019]  ? simple_transaction_get+0x12d/0x160
[  228.786893][ T6019]  nfsctl_transaction_write+0x10f/0x160
[  228.786938][ T6019]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  228.786954][ T6019]  vfs_write+0x296/0xba0
[  228.786978][ T6019]  ? __pfx_vfs_write+0x10/0x10
[  228.787001][ T6019]  ? _raw_spin_unlock_irq+0x23/0x50
[  228.787017][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  228.787038][ T6019]  ksys_write+0x150/0x270
[  228.787058][ T6019]  ? __pfx_ksys_write+0x10/0x10
[  228.787080][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.787095][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.787109][ T6019]  do_syscall_64+0x174/0x580
[  228.787126][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.787141][ T6019]  ? clear_bhb_loop+0x70/0xc0
[  228.787159][ T6019]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.787173][ T6019] RIP: 0033:0x7f3343939df7
[  228.787188][ T6019] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  228.787202][ T6019] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  228.787219][ T6019] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  228.787230][ T6019] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  228.787239][ T6019] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  228.787248][ T6019] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  228.787257][ T6019] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d924
[  228.787279][ T6019]  </TASK>
[  229.011468][ T6019] kobject: kobject_add_internal failed for xprt-23-tcp (error: -12 parent: switch-23)
[  229.016333][ T6019] FAULT_INJECTION: forcing a failure.
[  229.016333][ T6019] name failslab, interval 1, probability 5, space 0, times -1
[  229.021448][ T6019] CPU: 0 UID: 0 PID: 6019 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  229.021469][ T6019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  229.021478][ T6019] Call Trace:
[  229.021496][ T6019]  <TASK>
[  229.021502][ T6019]  dump_stack_lvl+0xe8/0x150
[  229.021528][ T6019]  should_fail_ex+0x40c/0x560
[  229.021552][ T6019]  should_failslab+0xa8/0x100
[  229.021569][ T6019]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  229.021590][ T6019]  ? __kernfs_new_node+0xe6/0x980
[  229.021609][ T6019]  ? __kernfs_new_node+0xe6/0x980
[  229.021631][ T6019]  __kernfs_new_node+0xe6/0x980
[  229.021656][ T6019]  ? __pfx___kernfs_new_node+0x10/0x10
[  229.021674][ T6019]  ? kernfs_root+0x1c/0x230
[  229.021695][ T6019]  ? kernfs_root+0x1c/0x230
[  229.021711][ T6019]  ? kernfs_root+0x1c/0x230
[  229.021726][ T6019]  ? kernfs_root+0x1c/0x230
[  229.021745][ T6019]  kernfs_new_node+0xea/0x140
[  229.021767][ T6019]  __kernfs_create_file+0x4b/0x2e0
[  229.021784][ T6019]  sysfs_add_file_mode_ns+0x237/0x300
[  229.021802][ T6019]  internal_create_group+0x679/0x1180
[  229.021823][ T6019]  ? kernfs_create_dir_ns+0x1d5/0x230
[  229.021843][ T6019]  ? __pfx_internal_create_group+0x10/0x10
[  229.021858][ T6019]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  229.021875][ T6019]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  229.022037][ T6019]  sysfs_create_groups+0x59/0x120
[  229.022057][ T6019]  kobject_add_internal+0x669/0xcd0
[  229.022083][ T6019]  kobject_init_and_add+0x12b/0x1a0
[  229.022106][ T6019]  ? __pfx_kobject_init_and_add+0x10/0x10
[  229.022125][ T6019]  ? __kmalloc_cache_noprof+0x150/0x660
[  229.022143][ T6019]  ? rpc_sysfs_client_setup+0x106/0x310
[  229.022161][ T6019]  ? rpc_sysfs_client_setup+0x106/0x310
[  229.022184][ T6019]  rpc_sysfs_client_setup+0x191/0x310
[  229.022201][ T6019]  ? rpc_net_ns+0x1e/0x230
[  229.022218][ T6019]  ? __pfx_rpc_sysfs_client_setup+0x10/0x10
[  229.022235][ T6019]  ? rpc_net_ns+0x1e/0x230
[  229.022249][ T6019]  ? rpc_net_ns+0x1e/0x230
[  229.022267][ T6019]  rpc_new_client+0x716/0xc50
[  229.022289][ T6019]  __rpc_clone_client+0x342/0x7a0
[  229.022305][ T6019]  rpc_bind_new_program+0x25c/0x530
[  229.022319][ T6019]  ? __pfx_rpc_create+0x10/0x10
[  229.022341][ T6019]  ? __pfx_rpc_bind_new_program+0x10/0x10
[  229.022391][ T6019]  rpcb_create_local+0x3ed/0x670
[  229.022409][ T6019]  ? __pfx_rpcb_create_local+0x10/0x10
[  229.022432][ T6019]  ? __svc_create+0x88f/0x990
[  229.022452][ T6019]  svc_bind+0x1b4/0x230
[  229.022470][ T6019]  nfsd_create_serv+0x581/0x840
[  229.022503][ T6019]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  229.022520][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  229.022542][ T6019]  ? __pfx_nfsd_create_serv+0x10/0x10
[  229.022561][ T6019]  ? net_generic+0x1e/0x240
[  229.022579][ T6019]  ? net_generic+0x1e/0x240
[  229.022598][ T6019]  ? net_generic+0x1e/0x240
[  229.022618][ T6019]  nfsd_svc+0x189/0x780
[  229.022641][ T6019]  write_threads+0x3cd/0x5a0
[  229.022654][ T6019]  ? __might_fault+0xaf/0x130
[  229.022672][ T6019]  ? __pfx_write_threads+0x10/0x10
[  229.022698][ T6019]  ? _copy_from_user+0x94/0xb0
[  229.022717][ T6019]  ? simple_transaction_get+0x12d/0x160
[  229.022735][ T6019]  nfsctl_transaction_write+0x10f/0x160
[  229.022752][ T6019]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  229.022766][ T6019]  vfs_write+0x296/0xba0
[  229.022790][ T6019]  ? __pfx_vfs_write+0x10/0x10
[  229.022813][ T6019]  ? _raw_spin_unlock_irq+0x23/0x50
[  229.022829][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  229.022850][ T6019]  ksys_write+0x150/0x270
[  229.022868][ T6019]  ? __pfx_ksys_write+0x10/0x10
[  229.022926][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.022942][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.022957][ T6019]  do_syscall_64+0x174/0x580
[  229.022973][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.022987][ T6019]  ? clear_bhb_loop+0x70/0xc0
[  229.023004][ T6019]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.023018][ T6019] RIP: 0033:0x7f3343939df7
[  229.023035][ T6019] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  229.023048][ T6019] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  229.023065][ T6019] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  229.023076][ T6019] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  229.023085][ T6019] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  229.023093][ T6019] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  229.023103][ T6019] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d924
[  229.023125][ T6019]  </TASK>
[  229.023227][ T6019] kobject: kobject_add_internal failed for clnt-24 (error: -12 parent: rpc-clients)
[  229.242936][ T6019] FAULT_INJECTION: forcing a failure.
[  229.242936][ T6019] name failslab, interval 1, probability 5, space 0, times -1
[  229.248585][ T6019] CPU: 0 UID: 0 PID: 6019 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  229.248607][ T6019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  229.248617][ T6019] Call Trace:
[  229.248624][ T6019]  <TASK>
[  229.248631][ T6019]  dump_stack_lvl+0xe8/0x150
[  229.248656][ T6019]  should_fail_ex+0x40c/0x560
[  229.248681][ T6019]  should_failslab+0xa8/0x100
[  229.248700][ T6019]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  229.248720][ T6019]  ? __pfx_rpcauth_refreshcred+0x10/0x10
[  229.248742][ T6019]  ? rpc_malloc+0xeb/0x260
[  229.248760][ T6019]  ? rpc_malloc+0xeb/0x260
[  229.248783][ T6019]  rpc_malloc+0xeb/0x260
[  229.248805][ T6019]  call_allocate+0x26d/0x680
[  229.248823][ T6019]  ? __pfx_call_allocate+0x10/0x10
[  229.248842][ T6019]  __rpc_execute+0x526/0x1280
[  229.248907][ T6019]  ? __pfx___rpc_execute+0x10/0x10
[  229.248927][ T6019]  ? rpc_task_get_xprt+0x26/0x250
[  229.248944][ T6019]  ? rpc_make_runnable+0xae/0x1c0
[  229.248963][ T6019]  rpc_execute+0x1c1/0x390
[  229.248981][ T6019]  rpc_run_task+0x4a6/0x660
[  229.248998][ T6019]  rpc_call_sync+0x10f/0x200
[  229.249012][ T6019]  ? __pfx_rpc_call_sync+0x10/0x10
[  229.249031][ T6019]  ? net_generic+0x1e/0x240
[  229.249045][ T6019]  ? net_generic+0x1e/0x240
[  229.249062][ T6019]  rpcb_register+0x2d0/0x530
[  229.249078][ T6019]  ? __pfx_rpcb_register+0x10/0x10
[  229.249090][ T6019]  ? net_generic+0x1e/0x240
[  229.249107][ T6019]  ? rpcb_create_local+0x4ee/0x670
[  229.249123][ T6019]  ? __pfx_rpcb_create_local+0x10/0x10
[  229.249145][ T6019]  svc_unregister+0x24d/0x780
[  229.249170][ T6019]  svc_bind+0x1e9/0x230
[  229.249190][ T6019]  nfsd_create_serv+0x581/0x840
[  229.249211][ T6019]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  229.249228][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  229.249250][ T6019]  ? __pfx_nfsd_create_serv+0x10/0x10
[  229.249270][ T6019]  ? net_generic+0x1e/0x240
[  229.249288][ T6019]  ? net_generic+0x1e/0x240
[  229.249309][ T6019]  ? net_generic+0x1e/0x240
[  229.249331][ T6019]  nfsd_svc+0x189/0x780
[  229.249354][ T6019]  write_threads+0x3cd/0x5a0
[  229.249368][ T6019]  ? __might_fault+0xaf/0x130
[  229.249387][ T6019]  ? __pfx_write_threads+0x10/0x10
[  229.249412][ T6019]  ? _copy_from_user+0x94/0xb0
[  229.249439][ T6019]  ? simple_transaction_get+0x12d/0x160
[  229.249456][ T6019]  nfsctl_transaction_write+0x10f/0x160
[  229.249471][ T6019]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  229.249486][ T6019]  vfs_write+0x296/0xba0
[  229.249510][ T6019]  ? __pfx_vfs_write+0x10/0x10
[  229.249534][ T6019]  ? _raw_spin_unlock_irq+0x23/0x50
[  229.249550][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  229.249573][ T6019]  ksys_write+0x150/0x270
[  229.249593][ T6019]  ? __pfx_ksys_write+0x10/0x10
[  229.249615][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.249630][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.249646][ T6019]  do_syscall_64+0x174/0x580
[  229.249664][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.249679][ T6019]  ? clear_bhb_loop+0x70/0xc0
[  229.249695][ T6019]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.249709][ T6019] RIP: 0033:0x7f3343939df7
[  229.249725][ T6019] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  229.249737][ T6019] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  229.249754][ T6019] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  229.249766][ T6019] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  229.249775][ T6019] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  229.249783][ T6019] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  229.249793][ T6019] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d924
[  229.249815][ T6019]  </TASK>
[  229.486110][ T6019] FAULT_INJECTION: forcing a failure.
[  229.486110][ T6019] name failslab, interval 1, probability 5, space 0, times -1
[  229.491438][ T6019] CPU: 0 UID: 0 PID: 6019 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  229.491460][ T6019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  229.491470][ T6019] Call Trace:
[  229.491477][ T6019]  <TASK>
[  229.491484][ T6019]  dump_stack_lvl+0xe8/0x150
[  229.491510][ T6019]  should_fail_ex+0x40c/0x560
[  229.491535][ T6019]  should_failslab+0xa8/0x100
[  229.491553][ T6019]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  229.491573][ T6019]  ? __kernfs_new_node+0xe6/0x980
[  229.491591][ T6019]  ? __kernfs_new_node+0xe6/0x980
[  229.491615][ T6019]  __kernfs_new_node+0xe6/0x980
[  229.491640][ T6019]  ? __pfx___kernfs_new_node+0x10/0x10
[  229.491659][ T6019]  ? kernfs_root+0x1c/0x230
[  229.491681][ T6019]  ? kernfs_root+0x1c/0x230
[  229.491698][ T6019]  ? kernfs_root+0x1c/0x230
[  229.491713][ T6019]  ? kernfs_root+0x1c/0x230
[  229.491734][ T6019]  kernfs_new_node+0xea/0x140
[  229.491756][ T6019]  __kernfs_create_file+0x4b/0x2e0
[  229.491773][ T6019]  sysfs_add_file_mode_ns+0x237/0x300
[  229.491794][ T6019]  internal_create_group+0x679/0x1180
[  229.491819][ T6019]  ? kernfs_create_dir_ns+0x1d5/0x230
[  229.491871][ T6019]  ? __pfx_internal_create_group+0x10/0x10
[  229.491888][ T6019]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  229.491907][ T6019]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  229.491935][ T6019]  sysfs_create_groups+0x59/0x120
[  229.491955][ T6019]  kobject_add_internal+0x669/0xcd0
[  229.491982][ T6019]  kobject_init_and_add+0x12b/0x1a0
[  229.492007][ T6019]  ? __pfx_kobject_init_and_add+0x10/0x10
[  229.492029][ T6019]  ? kernfs_remove_by_name_ns+0x101/0x140
[  229.492053][ T6019]  ? kernfs_remove_by_name_ns+0x101/0x140
[  229.492074][ T6019]  sysfs_slab_add+0x7b/0x260
[  229.492092][ T6019]  do_kmem_cache_create+0x8bf/0x970
[  229.492110][ T6019]  __kmem_cache_create_args+0x307/0x440
[  229.492132][ T6019]  nfsd_file_cache_init+0x197/0x530
[  229.492150][ T6019]  ? __pfx_nfsd_file_cache_init+0x10/0x10
[  229.492166][ T6019]  ? net_generic+0x1e/0x240
[  229.492190][ T6019]  ? net_generic+0x1e/0x240
[  229.492208][ T6019]  ? net_generic+0x1e/0x240
[  229.492224][ T6019]  ? net_generic+0x1e/0x240
[  229.492242][ T6019]  ? net_generic+0x1f4/0x240
[  229.492261][ T6019]  nfsd_svc+0x315/0x780
[  229.492285][ T6019]  write_threads+0x3cd/0x5a0
[  229.492298][ T6019]  ? __might_fault+0xaf/0x130
[  229.492318][ T6019]  ? __pfx_write_threads+0x10/0x10
[  229.492345][ T6019]  ? _copy_from_user+0x94/0xb0
[  229.492362][ T6019]  ? simple_transaction_get+0x12d/0x160
[  229.492380][ T6019]  nfsctl_transaction_write+0x10f/0x160
[  229.492396][ T6019]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  229.492412][ T6019]  vfs_write+0x296/0xba0
[  229.492435][ T6019]  ? __pfx_vfs_write+0x10/0x10
[  229.492461][ T6019]  ? _raw_spin_unlock_irq+0x23/0x50
[  229.492476][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  229.492500][ T6019]  ksys_write+0x150/0x270
[  229.492520][ T6019]  ? __pfx_ksys_write+0x10/0x10
[  229.492541][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.492556][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.492572][ T6019]  do_syscall_64+0x174/0x580
[  229.492589][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.492604][ T6019]  ? clear_bhb_loop+0x70/0xc0
[  229.492622][ T6019]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.492637][ T6019] RIP: 0033:0x7f3343939df7
[  229.492653][ T6019] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  229.492666][ T6019] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  229.492683][ T6019] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  229.492694][ T6019] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  229.492704][ T6019] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  229.492712][ T6019] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  229.492722][ T6019] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d924
[  229.492745][ T6019]  </TASK>
[  229.493541][ T6019] kobject: kobject_add_internal failed for nfsd_file (error: -12 parent: slab)
[  229.670669][ T6019] SLUB: Unable to add cache nfsd_file to sysfs
[  229.673678][ T6019] FAULT_INJECTION: forcing a failure.
[  229.673678][ T6019] name failslab, interval 1, probability 5, space 0, times -1
[  229.679864][ T6019] CPU: 0 UID: 0 PID: 6019 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  229.679885][ T6019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  229.679893][ T6019] Call Trace:
[  229.679900][ T6019]  <TASK>
[  229.679907][ T6019]  dump_stack_lvl+0xe8/0x150
[  229.679931][ T6019]  should_fail_ex+0x40c/0x560
[  229.679958][ T6019]  ? do_kmem_cache_create+0x877/0x970
[  229.679974][ T6019]  should_failslab+0xa8/0x100
[  229.679992][ T6019]  __kmalloc_flags_noprof+0x135/0x800
[  229.680014][ T6019]  ? __kmalloc_flags_noprof+0x35e/0x800
[  229.680031][ T6019]  ? do_kmem_cache_create+0x877/0x970
[  229.680044][ T6019]  ? do_kmem_cache_create+0x877/0x970
[  229.680063][ T6019]  do_kmem_cache_create+0x877/0x970
[  229.680080][ T6019]  __kmem_cache_create_args+0x307/0x440
[  229.680099][ T6019]  nfsd_file_cache_init+0x1d9/0x530
[  229.680118][ T6019]  ? __pfx_nfsd_file_cache_init+0x10/0x10
[  229.680133][ T6019]  ? net_generic+0x1e/0x240
[  229.680156][ T6019]  ? net_generic+0x1e/0x240
[  229.680173][ T6019]  ? net_generic+0x1e/0x240
[  229.680188][ T6019]  ? net_generic+0x1e/0x240
[  229.680206][ T6019]  ? net_generic+0x1f4/0x240
[  229.680222][ T6019]  nfsd_svc+0x315/0x780
[  229.680244][ T6019]  write_threads+0x3cd/0x5a0
[  229.680257][ T6019]  ? __might_fault+0xaf/0x130
[  229.680274][ T6019]  ? __pfx_write_threads+0x10/0x10
[  229.680300][ T6019]  ? _copy_from_user+0x94/0xb0
[  229.680318][ T6019]  ? simple_transaction_get+0x12d/0x160
[  229.680335][ T6019]  nfsctl_transaction_write+0x10f/0x160
[  229.680352][ T6019]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  229.680367][ T6019]  vfs_write+0x296/0xba0
[  229.680391][ T6019]  ? __pfx_vfs_write+0x10/0x10
[  229.680411][ T6019]  ? _raw_spin_unlock_irq+0x23/0x50
[  229.680426][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  229.680457][ T6019]  ksys_write+0x150/0x270
[  229.680476][ T6019]  ? __pfx_ksys_write+0x10/0x10
[  229.680498][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.680514][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.680529][ T6019]  do_syscall_64+0x174/0x580
[  229.680545][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.680559][ T6019]  ? clear_bhb_loop+0x70/0xc0
[  229.680576][ T6019]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.680590][ T6019] RIP: 0033:0x7f3343939df7
[  229.680604][ T6019] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  229.680616][ T6019] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  229.680632][ T6019] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  229.680642][ T6019] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  229.680651][ T6019] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  229.680660][ T6019] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  229.680669][ T6019] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d924
[  229.680692][ T6019]  </TASK>
[  229.680778][ T6019] __kmem_cache_create_args(nfsd_file_mark) failed with error -12
[  229.827581][ T6019] CPU: 0 UID: 0 PID: 6019 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  229.827603][ T6019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  229.827613][ T6019] Call Trace:
[  229.827667][ T6019]  <TASK>
[  229.827674][ T6019]  dump_stack_lvl+0xe8/0x150
[  229.827701][ T6019]  __kmem_cache_create_args+0x3d8/0x440
[  229.827724][ T6019]  nfsd_file_cache_init+0x1d9/0x530
[  229.827744][ T6019]  ? __pfx_nfsd_file_cache_init+0x10/0x10
[  229.827761][ T6019]  ? net_generic+0x1e/0x240
[  229.827786][ T6019]  ? net_generic+0x1e/0x240
[  229.827829][ T6019]  ? net_generic+0x1e/0x240
[  229.827845][ T6019]  ? net_generic+0x1e/0x240
[  229.827863][ T6019]  ? net_generic+0x1f4/0x240
[  229.827881][ T6019]  nfsd_svc+0x315/0x780
[  229.827903][ T6019]  write_threads+0x3cd/0x5a0
[  229.827927][ T6019]  ? __might_fault+0xaf/0x130
[  229.827946][ T6019]  ? __pfx_write_threads+0x10/0x10
[  229.827973][ T6019]  ? _copy_from_user+0x94/0xb0
[  229.828094][ T6019]  ? simple_transaction_get+0x12d/0x160
[  229.828113][ T6019]  nfsctl_transaction_write+0x10f/0x160
[  229.828128][ T6019]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  229.828143][ T6019]  vfs_write+0x296/0xba0
[  229.828165][ T6019]  ? __pfx_vfs_write+0x10/0x10
[  229.828188][ T6019]  ? _raw_spin_unlock_irq+0x23/0x50
[  229.828206][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  229.828225][ T6019]  ksys_write+0x150/0x270
[  229.828243][ T6019]  ? __pfx_ksys_write+0x10/0x10
[  229.828262][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.828275][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.828289][ T6019]  do_syscall_64+0x174/0x580
[  229.828306][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.828320][ T6019]  ? clear_bhb_loop+0x70/0xc0
[  229.828337][ T6019]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.828350][ T6019] RIP: 0033:0x7f3343939df7
[  229.828366][ T6019] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  229.828379][ T6019] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  229.828395][ T6019] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  229.828405][ T6019] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  229.828413][ T6019] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  229.828420][ T6019] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  229.828428][ T6019] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d924
[  229.828447][ T6019]  </TASK>
[  229.944131][ T6019] nfsd: unable to create nfsd_file_mark_slab
[  230.144303][ T6019] FAULT_INJECTION: forcing a failure.
[  230.144303][ T6019] name failslab, interval 1, probability 5, space 0, times -1
[  230.149678][ T6019] CPU: 0 UID: 0 PID: 6019 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  230.149699][ T6019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  230.149709][ T6019] Call Trace:
[  230.149717][ T6019]  <TASK>
[  230.149725][ T6019]  dump_stack_lvl+0xe8/0x150
[  230.149752][ T6019]  should_fail_ex+0x40c/0x560
[  230.149839][ T6019]  should_failslab+0xa8/0x100
[  230.149885][ T6019]  __kmalloc_cache_noprof+0xa8/0x660
[  230.149911][ T6019]  ? unx_lookup_cred+0x83/0x170
[  230.149923][ T6019]  ? unx_lookup_cred+0x83/0x170
[  230.149938][ T6019]  unx_lookup_cred+0x83/0x170
[  230.149954][ T6019]  rpcauth_refreshcred+0x63e/0xa20
[  230.149981][ T6019]  ? __pfx_rpcauth_refreshcred+0x10/0x10
[  230.150000][ T6019]  ? __pfx_do_raw_spin_lock+0x10/0x10
[  230.150026][ T6019]  ? __pfx_call_refresh+0x10/0x10
[  230.150044][ T6019]  ? __pfx_call_refresh+0x10/0x10
[  230.150062][ T6019]  __rpc_execute+0x526/0x1280
[  230.150093][ T6019]  ? __pfx___rpc_execute+0x10/0x10
[  230.150114][ T6019]  ? rpc_task_get_xprt+0x26/0x250
[  230.150130][ T6019]  ? rpc_make_runnable+0xae/0x1c0
[  230.150150][ T6019]  rpc_execute+0x1c1/0x390
[  230.150168][ T6019]  rpc_run_task+0x4a6/0x660
[  230.150185][ T6019]  rpc_call_sync+0x10f/0x200
[  230.150199][ T6019]  ? __pfx_rpc_call_sync+0x10/0x10
[  230.150220][ T6019]  ? net_generic+0x1e/0x240
[  230.150234][ T6019]  ? net_generic+0x1e/0x240
[  230.150251][ T6019]  rpcb_register+0x2d0/0x530
[  230.150267][ T6019]  ? __pfx_rpcb_register+0x10/0x10
[  230.150280][ T6019]  ? __lock_acquire+0x683/0x2cf0
[  230.150313][ T6019]  svc_unregister+0x24d/0x780
[  230.150338][ T6019]  svc_rpcb_cleanup+0x1d/0x30
[  230.150353][ T6019]  svc_xprt_destroy_all+0x6d3/0x730
[  230.150367][ T6019]  ? kfree+0x1c5/0x640
[  230.150382][ T6019]  ? rhashtable_free_and_destroy+0x4e0/0x540
[  230.150408][ T6019]  ? __pfx_svc_xprt_destroy_all+0x10/0x10
[  230.150426][ T6019]  ? do_raw_spin_unlock+0xf5/0x210
[  230.150447][ T6019]  nfsd_destroy_serv+0x1bf/0x4b0
[  230.150469][ T6019]  ? __pfx_nfsd_destroy_serv+0x10/0x10
[  230.150486][ T6019]  ? net_generic+0x1e/0x240
[  230.150507][ T6019]  nfsd_svc+0x540/0x780
[  230.150529][ T6019]  write_threads+0x3cd/0x5a0
[  230.150543][ T6019]  ? __might_fault+0xaf/0x130
[  230.150562][ T6019]  ? __pfx_write_threads+0x10/0x10
[  230.150588][ T6019]  ? _copy_from_user+0x94/0xb0
[  230.150605][ T6019]  ? simple_transaction_get+0x12d/0x160
[  230.150623][ T6019]  nfsctl_transaction_write+0x10f/0x160
[  230.150639][ T6019]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  230.150654][ T6019]  vfs_write+0x296/0xba0
[  230.150676][ T6019]  ? __pfx_vfs_write+0x10/0x10
[  230.150700][ T6019]  ? _raw_spin_unlock_irq+0x23/0x50
[  230.150716][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  230.150737][ T6019]  ksys_write+0x150/0x270
[  230.150756][ T6019]  ? __pfx_ksys_write+0x10/0x10
[  230.150817][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.150831][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.150845][ T6019]  do_syscall_64+0x174/0x580
[  230.150862][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.150886][ T6019]  ? clear_bhb_loop+0x70/0xc0
[  230.150903][ T6019]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.150916][ T6019] RIP: 0033:0x7f3343939df7
[  230.150931][ T6019] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  230.150944][ T6019] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  230.150960][ T6019] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  230.150970][ T6019] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  230.150979][ T6019] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  230.150987][ T6019] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  230.150997][ T6019] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d924
[  230.151019][ T6019]  </TASK>
[pid  6213] write(4, "tcp 2049\n", 9 <unfinished ...>
[pid  6019] <... write resumed>)        = -1 ENOMEM (Cannot allocate memory)
[  230.345846][ T6027] FAULT_INJECTION: forcing a failure.
[  230.345846][ T6027] name failslab, interval 1, probability 5, space 0, times -1
[pid  6019] openat(AT_FDCWD, "/proc/self/make-it-fail", O_WRONLY) = 5
[pid  6019] write(5, "0", 1)            = 1
[pid  6019] close(5)                    = 0
[  230.357994][ T6027] CPU: 0 UID: 0 PID: 6027 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  230.358015][ T6027] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  230.358024][ T6027] Call Trace:
[  230.358030][ T6027]  <TASK>
[  230.358037][ T6027]  dump_stack_lvl+0xe8/0x150
[  230.358062][ T6027]  should_fail_ex+0x40c/0x560
[  230.358089][ T6027]  should_failslab+0xa8/0x100
[  230.358107][ T6027]  __kmalloc_noprof+0xfe/0x720
[  230.358129][ T6027]  ? __svc_create+0x65c/0x990
[  230.358143][ T6027]  ? __svc_create+0x65c/0x990
[  230.358162][ T6027]  __svc_create+0x65c/0x990
[  230.358243][ T6027]  ? __pfx_nfsd+0x10/0x10
[  230.358263][ T6027]  svc_create_pooled+0x5ad/0x770
[  230.358278][ T6027]  ? __init_swait_queue_head+0xa8/0x150
[  230.358296][ T6027]  nfsd_create_serv+0x565/0x840
[  230.358313][ T6027]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  230.358329][ T6027]  ? lockdep_hardirqs_on+0x7a/0x110
[  230.358347][ T6027]  ? __pfx_nfsd_create_serv+0x10/0x10
[  230.358364][ T6027]  ? net_generic+0x1e/0x240
[  230.358380][ T6027]  ? net_generic+0x1e/0x240
[  230.358399][ T6027]  ? net_generic+0x1e/0x240
[  230.358420][ T6027]  nfsd_svc+0x189/0x780
[  230.358441][ T6027]  write_threads+0x3cd/0x5a0
[  230.358454][ T6027]  ? __might_fault+0xaf/0x130
[  230.358471][ T6027]  ? __pfx_write_threads+0x10/0x10
[  230.358496][ T6027]  ? _copy_from_user+0x94/0xb0
[  230.358512][ T6027]  ? simple_transaction_get+0x12d/0x160
[  230.358530][ T6027]  nfsctl_transaction_write+0x10f/0x160
[  230.358545][ T6027]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  230.358560][ T6027]  vfs_write+0x296/0xba0
[  230.358582][ T6027]  ? __pfx_vfs_write+0x10/0x10
[  230.358604][ T6027]  ? _raw_spin_unlock_irq+0x23/0x50
[  230.358618][ T6027]  ? lockdep_hardirqs_on+0x7a/0x110
[  230.358639][ T6027]  ksys_write+0x150/0x270
[  230.358658][ T6027]  ? __pfx_ksys_write+0x10/0x10
[  230.358680][ T6027]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.358696][ T6027]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.358712][ T6027]  do_syscall_64+0x174/0x580
[  230.358729][ T6027]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.358778][ T6027]  ? clear_bhb_loop+0x70/0xc0
[  230.358797][ T6027]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.358829][ T6027] RIP: 0033:0x7f3343939df7
[  230.358846][ T6027] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  230.358859][ T6027] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  230.358874][ T6027] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  230.358883][ T6027] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  230.358891][ T6027] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  230.358899][ T6027] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  230.358907][ T6027] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d93c
[  230.358927][ T6027]  </TASK>
[pid  6019] write(4, "tcp 2049\n", 9 <unfinished ...>
[pid  5972] <... write resumed>)        = 9
[  230.515705][ T6239] FAULT_INJECTION: forcing a failure.
[  230.515705][ T6239] name failslab, interval 1, probability 5, space 0, times -1
[  230.524804][ T6239] CPU: 0 UID: 0 PID: 6239 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  230.524828][ T6239] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  230.524848][ T6239] Call Trace:
[  230.524856][ T6239]  <TASK>
[  230.524864][ T6239]  dump_stack_lvl+0xe8/0x150
[  230.524892][ T6239]  should_fail_ex+0x40c/0x560
[  230.524921][ T6239]  should_failslab+0xa8/0x100
[  230.524941][ T6239]  __kmalloc_noprof+0xfe/0x720
[  230.524965][ T6239]  ? kobject_get_path+0xc5/0x2f0
[  230.524986][ T6239]  ? kobject_get_path+0xc5/0x2f0
[  230.525013][ T6239]  kobject_get_path+0xc5/0x2f0
[  230.525039][ T6239]  kobject_uevent_env+0x29e/0x9e0
[  230.525057][ T6239]  ? rpc_sysfs_xprt_switch_setup+0x1c6/0x2b0
[  230.525083][ T6239]  xprt_switch_alloc+0x238/0x590
[  230.525106][ T6239]  rpc_create_xprt+0x1c7/0xa90
[  230.525125][ T6239]  ? __pfx_rpc_create_xprt+0x10/0x10
[  230.525155][ T6239]  ? rcu_is_watching+0x15/0xb0
[  230.525173][ T6239]  ? trace_kmalloc+0x2a/0xf0
[  230.525197][ T6239]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  230.525220][ T6239]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  230.525242][ T6239]  ? xprt_create_transport+0x39b/0x5f0
[  230.525259][ T6239]  ? xprt_create_transport+0x39b/0x5f0
[  230.525276][ T6239]  ? kstrdup+0x81/0x100
[  230.525299][ T6239]  ? __asan_memcpy+0x40/0x70
[  230.525325][ T6239]  ? xprt_create_transport+0x438/0x5f0
[  230.525345][ T6239]  rpc_create+0x649/0x900
[pid  6027] <... write resumed>)        = -1 ENOMEM (Cannot allocate memory)
[  230.525370][ T6239]  ? __pfx_rpc_create+0x10/0x10
[pid  6027] openat(AT_FDCWD, "/proc/self/make-it-fail", O_WRONLY) = 5
[pid  6027] write(5, "0", 1)            = 1
[pid  6027] close(5)                    = 0
[  230.525421][ T6239]  ? __lock_acquire+0x683/0x2cf0
[  230.525447][ T6239]  rpcb_create_af_local+0x1c7/0x3c0
[  230.525464][ T6239]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  230.525499][ T6239]  ? do_raw_spin_unlock+0xf5/0x210
[  230.525523][ T6239]  rpcb_create_local+0x268/0x670
[  230.525542][ T6239]  ? __pfx_rpcb_create_local+0x10/0x10
[  230.525557][ T6239]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  230.525575][ T6239]  ? lockdep_hardirqs_on+0x7a/0x110
[  230.525595][ T6239]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  230.525612][ T6239]  ? __percpu_counter_init_many+0x35f/0x380
[  230.525640][ T6239]  ? __svc_create+0x88f/0x990
[  230.525666][ T6239]  svc_bind+0x1b4/0x230
[  230.525687][ T6239]  nfsd_create_serv+0x581/0x840
[  230.525709][ T6239]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  230.525757][ T6239]  ? lockdep_hardirqs_on+0x7a/0x110
[  230.525778][ T6239]  ? __pfx_nfsd_create_serv+0x10/0x10
[  230.525800][ T6239]  ? net_generic+0x1e/0x240
[  230.525821][ T6239]  ? net_generic+0x1e/0x240
[  230.525851][ T6239]  ? net_generic+0x1e/0x240
[  230.525878][ T6239]  nfsd_svc+0x189/0x780
[  230.525904][ T6239]  write_threads+0x3cd/0x5a0
[  230.525919][ T6239]  ? __might_fault+0xaf/0x130
[  230.525940][ T6239]  ? __pfx_write_threads+0x10/0x10
[  230.525970][ T6239]  ? _copy_from_user+0x94/0xb0
[  230.525989][ T6239]  ? simple_transaction_get+0x12d/0x160
[  230.526009][ T6239]  nfsctl_transaction_write+0x10f/0x160
[  230.526027][ T6239]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  230.526043][ T6239]  vfs_write+0x296/0xba0
[  230.526070][ T6239]  ? __pfx_vfs_write+0x10/0x10
[  230.526098][ T6239]  ? _raw_spin_unlock_irq+0x23/0x50
[  230.526113][ T6239]  ? lockdep_hardirqs_on+0x7a/0x110
[  230.526138][ T6239]  ksys_write+0x150/0x270
[  230.526160][ T6239]  ? __pfx_ksys_write+0x10/0x10
[  230.526184][ T6239]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.526201][ T6239]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.526218][ T6239]  do_syscall_64+0x174/0x580
[  230.526236][ T6239]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.526252][ T6239]  ? clear_bhb_loop+0x70/0xc0
[  230.526272][ T6239]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.526288][ T6239] RIP: 0033:0x7f3343939df7
[  230.526303][ T6239] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  230.526318][ T6239] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  230.526336][ T6239] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  230.526348][ T6239] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  230.526358][ T6239] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  230.526368][ T6239] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  230.526378][ T6239] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dc2c
[  230.526403][ T6239]  </TASK>
[  230.526471][ T6239] FAULT_INJECTION: forcing a failure.
[  230.526471][ T6239] name failslab, interval 1, probability 5, space 0, times -1
[  230.732303][ T6239] CPU: 0 UID: 0 PID: 6239 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  230.732326][ T6239] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  230.732336][ T6239] Call Trace:
[  230.732343][ T6239]  <TASK>
[  230.732350][ T6239]  dump_stack_lvl+0xe8/0x150
[  230.732379][ T6239]  should_fail_ex+0x40c/0x560
[  230.732407][ T6239]  should_failslab+0xa8/0x100
[  230.732427][ T6239]  __kmalloc_node_track_caller_noprof+0x100/0x730
[  230.732452][ T6239]  ? __lock_acquire+0x683/0x2cf0
[  230.732468][ T6239]  ? __kernfs_new_node+0xa9/0x980
[  230.732488][ T6239]  ? __kernfs_new_node+0xa9/0x980
[  230.732513][ T6239]  kstrdup+0x42/0x100
[  230.732538][ T6239]  __kernfs_new_node+0xa9/0x980
[  230.732565][ T6239]  ? __pfx___kernfs_new_node+0x10/0x10
[  230.732586][ T6239]  ? kernfs_root+0x1c/0x230
[  230.732610][ T6239]  ? kernfs_root+0x1c/0x230
[  230.732652][ T6239]  ? kernfs_root+0x1c/0x230
[  230.732669][ T6239]  ? kernfs_root+0x1c/0x230
[  230.732738][ T6239]  kernfs_create_dir_ns+0xfe/0x230
[  230.732765][ T6239]  sysfs_create_dir_ns+0x12f/0x2a0
[  230.732787][ T6239]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  230.732809][ T6239]  ? do_raw_spin_unlock+0xf5/0x210
[  230.732833][ T6239]  kobject_add_internal+0x622/0xcd0
[  230.732862][ T6239]  kobject_init_and_add+0x12b/0x1a0
[  230.732890][ T6239]  ? __pfx_kobject_init_and_add+0x10/0x10
[  230.732914][ T6239]  ? __kmalloc_cache_noprof+0x150/0x660
[  230.732936][ T6239]  ? rpc_sysfs_xprt_setup+0xa7/0x260

[host] Command execution timed out after 2m30s
 TestError:]

map[TruncatedConsoleOutput:[  269.423808][ T6052]  ? __pfx_vfs_write+0x10/0x10
[  269.423817][ T6052]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.423832][ T6052]  ? fput_close_sync+0x11f/0x240
[  269.423844][ T6052]  ksys_write+0x150/0x270
[  269.423856][ T6052]  ? __pfx_ksys_write+0x10/0x10
[  269.423870][ T6052]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  269.423880][ T6052]  do_syscall_64+0x174/0x580
[  269.423891][ T6052]  ? trace_irq_disable+0x3b/0x140
[  269.423900][ T6052]  ? clear_bhb_loop+0x70/0xc0
[  269.423910][ T6052]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  269.423918][ T6052] RIP: 0033:0x7f67c8dd3df7
[  269.423929][ T6052] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  269.423936][ T6052] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  269.423947][ T6052] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  269.423953][ T6052] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  269.423958][ T6052] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  269.423963][ T6052] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  269.423968][ T6052] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c9b4
[  269.423981][ T6052]  </TASK>
[  269.423999][ T6052] can't create link to switch in sysfs (-12)
[  269.565856][ T6052] FAULT_INJECTION: forcing a failure.
[  269.565856][ T6052] name failslab, interval 1, probability 5, space 0, times -1
[  269.569622][ T6052] CPU: 0 UID: 0 PID: 6052 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  269.569634][ T6052] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  269.569640][ T6052] Call Trace:
[  269.569644][ T6052]  <TASK>
[  269.569649][ T6052]  dump_stack_lvl+0xe8/0x150
[  269.569666][ T6052]  should_fail_ex+0x40c/0x560
[  269.569683][ T6052]  should_failslab+0xa8/0x100
[  269.569695][ T6052]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  269.569708][ T6052]  ? security_file_alloc+0x34/0x310
[  269.569718][ T6052]  ? security_file_alloc+0x34/0x310
[  269.569731][ T6052]  security_file_alloc+0x34/0x310
[  269.569742][ T6052]  init_file+0x90/0x2b0
[  269.569752][ T6052]  alloc_empty_file+0x74/0x1d0
[  269.569761][ T6052]  alloc_file_pseudo+0x115/0x1e0
[  269.569770][ T6052]  ? __pfx_alloc_file_pseudo+0x10/0x10
[  269.569779][ T6052]  ? __raw_spin_lock_init+0x45/0x100
[  269.569794][ T6052]  sock_alloc_file+0xb8/0x2e0
[  269.569807][ T6052]  xs_local_connect+0x179/0x810
[  269.569819][ T6052]  ? __pfx_xs_local_connect+0x10/0x10
[  269.569831][ T6052]  ? do_raw_spin_unlock+0xf5/0x210
[  269.569844][ T6052]  xprt_connect+0x613/0x850
[  269.569858][ T6052]  ? __pfx_call_connect+0x10/0x10
[  269.569870][ T6052]  __rpc_execute+0x526/0x1280
[  269.569889][ T6052]  ? __pfx___rpc_execute+0x10/0x10
[  269.569901][ T6052]  ? rpc_task_get_xprt+0x26/0x250
[  269.569912][ T6052]  ? rpc_make_runnable+0xae/0x1c0
[  269.569924][ T6052]  rpc_execute+0x1c1/0x390
[  269.569937][ T6052]  rpc_run_task+0x4a6/0x660
[  269.569947][ T6052]  rpc_create_xprt+0x533/0xa90
[  269.569957][ T6052]  ? __pfx_rpc_create_xprt+0x10/0x10
[  269.569974][ T6052]  ? rcu_is_watching+0x15/0xb0
[  269.569984][ T6052]  ? trace_kmalloc+0x2a/0xf0
[  269.570017][ T6052]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  269.570030][ T6052]  ? xprt_create_transport+0x39b/0x5f0
[  269.570045][ T6052]  ? xprt_create_transport+0x438/0x5f0
[  269.570055][ T6052]  rpc_create+0x649/0x900
[  269.570069][ T6052]  ? __pfx_rpc_create+0x10/0x10
[  269.570096][ T6052]  ? __lock_acquire+0x683/0x2cf0
[  269.570110][ T6052]  rpcb_create_af_local+0x1c7/0x3c0
[  269.570119][ T6052]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  269.570137][ T6052]  ? do_raw_spin_unlock+0xf5/0x210
[  269.570150][ T6052]  rpcb_create_local+0x268/0x670
[  269.570160][ T6052]  ? __pfx_rpcb_create_local+0x10/0x10
[  269.570168][ T6052]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  269.570183][ T6052]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.570194][ T6052]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  269.570203][ T6052]  ? __percpu_counter_init_many+0x35f/0x380
[  269.570217][ T6052]  ? __svc_create+0x88f/0x990
[  269.570231][ T6052]  svc_bind+0x1b4/0x230
[  269.570242][ T6052]  nfsd_create_serv+0x581/0x840
[  269.570255][ T6052]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  269.570265][ T6052]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.570277][ T6052]  ? __pfx_nfsd_create_serv+0x10/0x10
[  269.570289][ T6052]  ? net_generic+0x1e/0x240
[  269.570300][ T6052]  ? net_generic+0x1e/0x240
[  269.570314][ T6052]  ? net_generic+0x1e/0x240
[  269.570328][ T6052]  nfsd_svc+0x189/0x780
[  269.570343][ T6052]  write_threads+0x3cd/0x5a0
[  269.570351][ T6052]  ? __might_fault+0xaf/0x130
[  269.570362][ T6052]  ? __pfx_write_threads+0x10/0x10
[  269.570378][ T6052]  ? _copy_from_user+0x94/0xb0
[  269.570389][ T6052]  ? simple_transaction_get+0x12d/0x160
[  269.570400][ T6052]  nfsctl_transaction_write+0x10f/0x160
[  269.570409][ T6052]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  269.570418][ T6052]  vfs_write+0x296/0xba0
[  269.570432][ T6052]  ? __pfx_vfs_write+0x10/0x10
[  269.570442][ T6052]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.570457][ T6052]  ? fput_close_sync+0x11f/0x240
[  269.570469][ T6052]  ksys_write+0x150/0x270
[  269.570480][ T6052]  ? __pfx_ksys_write+0x10/0x10
[  269.570494][ T6052]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  269.570503][ T6052]  do_syscall_64+0x174/0x580
[  269.570514][ T6052]  ? trace_irq_disable+0x3b/0x140
[  269.570523][ T6052]  ? clear_bhb_loop+0x70/0xc0
[  269.570534][ T6052]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  269.570542][ T6052] RIP: 0033:0x7f67c8dd3df7
[  269.570552][ T6052] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  269.570559][ T6052] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  269.570569][ T6052] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  269.570575][ T6052] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  269.570581][ T6052] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  269.570586][ T6052] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  269.570592][ T6052] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c9b4
[  269.570604][ T6052]  </TASK>
[  269.571461][ T6052] FAULT_INJECTION: forcing a failure.
[  269.571461][ T6052] name failslab, interval 1, probability 5, space 0, times -1
[  269.718383][ T6052] CPU: 0 UID: 0 PID: 6052 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  269.718396][ T6052] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  269.718403][ T6052] Call Trace:
[  269.718407][ T6052]  <TASK>
[  269.718411][ T6052]  dump_stack_lvl+0xe8/0x150
[  269.718428][ T6052]  should_fail_ex+0x40c/0x560
[  269.718445][ T6052]  should_failslab+0xa8/0x100
[  269.718456][ T6052]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  269.718469][ T6052]  ? __kernfs_new_node+0xe6/0x980
[  269.718481][ T6052]  ? __kernfs_new_node+0xe6/0x980
[  269.718495][ T6052]  __kernfs_new_node+0xe6/0x980
[  269.718511][ T6052]  ? __pfx___kernfs_new_node+0x10/0x10
[  269.718522][ T6052]  ? kernfs_root+0x1c/0x230
[  269.718535][ T6052]  ? kernfs_root+0x1c/0x230
[  269.718546][ T6052]  ? kernfs_root+0x1c/0x230
[  269.718555][ T6052]  ? kernfs_root+0x1c/0x230
[  269.718567][ T6052]  kernfs_new_node+0xea/0x140
[  269.718581][ T6052]  __kernfs_create_file+0x4b/0x2e0
[  269.718591][ T6052]  sysfs_add_file_mode_ns+0x237/0x300
[  269.718604][ T6052]  internal_create_group+0x679/0x1180
[  269.718619][ T6052]  ? kernfs_create_dir_ns+0x1d5/0x230
[  269.718634][ T6052]  ? __pfx_internal_create_group+0x10/0x10
[  269.718644][ T6052]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  269.718655][ T6052]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  269.718667][ T6052]  sysfs_create_groups+0x59/0x120
[  269.718679][ T6052]  kobject_add_internal+0x669/0xcd0
[  269.718713][ T6052]  kobject_init_and_add+0x12b/0x1a0
[  269.718730][ T6052]  ? __pfx_kobject_init_and_add+0x10/0x10
[  269.718743][ T6052]  ? __kmalloc_cache_noprof+0x150/0x660
[  269.718755][ T6052]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  269.718767][ T6052]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  269.718781][ T6052]  rpc_sysfs_xprt_switch_setup+0x169/0x2b0
[  269.718795][ T6052]  xprt_switch_alloc+0x238/0x590
[  269.718808][ T6052]  rpc_create_xprt+0x1c7/0xa90
[  269.718818][ T6052]  ? __pfx_rpc_create_xprt+0x10/0x10
[  269.718835][ T6052]  ? rcu_is_watching+0x15/0xb0
[  269.718846][ T6052]  ? trace_kmalloc+0x2a/0xf0
[  269.718859][ T6052]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  269.718872][ T6052]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  269.718884][ T6052]  ? xprt_create_transport+0x39b/0x5f0
[  269.718893][ T6052]  ? xprt_create_transport+0x39b/0x5f0
[  269.718902][ T6052]  ? kstrdup+0x81/0x100
[  269.718916][ T6052]  ? __asan_memcpy+0x40/0x70
[  269.718930][ T6052]  ? xprt_create_transport+0x438/0x5f0
[  269.718941][ T6052]  rpc_create+0x649/0x900
[  269.718955][ T6052]  ? __pfx_rpc_create+0x10/0x10
[  269.719001][ T6052]  ? __lock_acquire+0x683/0x2cf0
[  269.719016][ T6052]  rpcb_create_af_local+0x1c7/0x3c0
[  269.719026][ T6052]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  269.719044][ T6052]  ? do_raw_spin_unlock+0xf5/0x210
[  269.719057][ T6052]  rpcb_create_local+0x28f/0x670
[  269.719067][ T6052]  ? __pfx_rpcb_create_local+0x10/0x10
[  269.719075][ T6052]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  269.719085][ T6052]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.719096][ T6052]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  269.719105][ T6052]  ? __percpu_counter_init_many+0x35f/0x380
[  269.719120][ T6052]  ? __svc_create+0x88f/0x990
[  269.719133][ T6052]  svc_bind+0x1b4/0x230
[  269.719144][ T6052]  nfsd_create_serv+0x581/0x840
[  269.719162][ T6052]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  269.719171][ T6052]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.719184][ T6052]  ? __pfx_nfsd_create_serv+0x10/0x10
[  269.719196][ T6052]  ? net_generic+0x1e/0x240
[  269.719207][ T6052]  ? net_generic+0x1e/0x240
[  269.719221][ T6052]  ? net_generic+0x1e/0x240
[  269.719235][ T6052]  nfsd_svc+0x189/0x780
[  269.719249][ T6052]  write_threads+0x3cd/0x5a0
[  269.719258][ T6052]  ? __might_fault+0xaf/0x130
[  269.719270][ T6052]  ? __pfx_write_threads+0x10/0x10
[  269.719286][ T6052]  ? _copy_from_user+0x94/0xb0
[  269.719297][ T6052]  ? simple_transaction_get+0x12d/0x160
[  269.719308][ T6052]  nfsctl_transaction_write+0x10f/0x160
[  269.719317][ T6052]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  269.719326][ T6052]  vfs_write+0x296/0xba0
[  269.719341][ T6052]  ? __pfx_vfs_write+0x10/0x10
[  269.719351][ T6052]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.719366][ T6052]  ? fput_close_sync+0x11f/0x240
[  269.719378][ T6052]  ksys_write+0x150/0x270
[  269.719390][ T6052]  ? __pfx_ksys_write+0x10/0x10
[  269.719404][ T6052]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  269.719413][ T6052]  do_syscall_64+0x174/0x580
[  269.719424][ T6052]  ? trace_irq_disable+0x3b/0x140
[  269.719433][ T6052]  ? clear_bhb_loop+0x70/0xc0
[  269.719444][ T6052]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  269.719452][ T6052] RIP: 0033:0x7f67c8dd3df7
[  269.719462][ T6052] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  269.719470][ T6052] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  269.719481][ T6052] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  269.719487][ T6052] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003

[host] Command execution timed out after 2m30s
 TruncatedCrashReport: TruncatedStraceOutput:[  224.711778][ T6218]  svc_bind+0x1b4/0x230
[  224.711799][ T6218]  nfsd_create_serv+0x581/0x840
[  224.711821][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  224.711837][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  224.711856][ T6218]  ? __pfx_nfsd_create_serv+0x10/0x10
[  224.711875][ T6218]  ? net_generic+0x1e/0x240
[  224.711923][ T6218]  ? net_generic+0x1e/0x240
[  224.711944][ T6218]  ? net_generic+0x1e/0x240
[  224.711976][ T6218]  nfsd_svc+0x189/0x780
[  224.711998][ T6218]  write_threads+0x3cd/0x5a0
[  224.712011][ T6218]  ? __might_fault+0xaf/0x130
[  224.712030][ T6218]  ? __pfx_write_threads+0x10/0x10
[  224.712056][ T6218]  ? _copy_from_user+0x94/0xb0
[  224.712074][ T6218]  ? simple_transaction_get+0x12d/0x160
[  224.712091][ T6218]  nfsctl_transaction_write+0x10f/0x160
[  224.712107][ T6218]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  224.712123][ T6218]  vfs_write+0x296/0xba0
[  224.712147][ T6218]  ? __pfx_vfs_write+0x10/0x10
[  224.712170][ T6218]  ? _raw_spin_unlock_irq+0x23/0x50
[  224.712185][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  224.712206][ T6218]  ksys_write+0x150/0x270
[  224.712226][ T6218]  ? __pfx_ksys_write+0x10/0x10
[  224.712248][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.712263][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.712278][ T6218]  do_syscall_64+0x174/0x580
[  224.712295][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.712310][ T6218]  ? clear_bhb_loop+0x70/0xc0
[  224.712328][ T6218]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.712377][ T6218] RIP: 0033:0x7f3343939df7
[  224.712393][ T6218] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  224.712405][ T6218] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  224.712421][ T6218] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  224.712431][ T6218] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  224.712440][ T6218] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  224.712448][ T6218] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  224.712457][ T6218] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbdc
[  224.712478][ T6218]  </TASK>
[  224.714576][ T6218] FAULT_INJECTION: forcing a failure.
[  224.714576][ T6218] name failslab, interval 1, probability 5, space 0, times -1
[  224.911935][ T6218] CPU: 0 UID: 0 PID: 6218 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  224.911957][ T6218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  224.911966][ T6218] Call Trace:
[  224.911973][ T6218]  <TASK>
[  224.911980][ T6218]  dump_stack_lvl+0xe8/0x150
[  224.912005][ T6218]  should_fail_ex+0x40c/0x560
[  224.912029][ T6218]  should_failslab+0xa8/0x100
[  224.912046][ T6218]  __kmalloc_noprof+0xfe/0x720
[  224.912066][ T6218]  ? trace_kmem_cache_alloc+0x29/0xe0
[  224.912085][ T6218]  ? security_sk_alloc+0x52/0x360
[  224.912100][ T6218]  ? security_sk_alloc+0x52/0x360
[  224.912119][ T6218]  security_sk_alloc+0x52/0x360
[  224.912137][ T6218]  sk_prot_alloc+0x101/0x210
[  224.912162][ T6218]  sk_alloc+0x3a/0x390
[  224.912201][ T6218]  unix_create1+0xb0/0x7c0
[  224.912225][ T6218]  unix_create+0x14c/0x1d0
[  224.912243][ T6218]  __sock_create+0x4b3/0x9d0
[  224.912267][ T6218]  xs_local_connect+0x144/0x810
[  224.912289][ T6218]  ? __pfx_xs_local_connect+0x10/0x10
[  224.912308][ T6218]  ? do_raw_spin_unlock+0xf5/0x210
[  224.912536][ T6218]  xprt_connect+0x613/0x850
[  224.912561][ T6218]  ? __pfx_call_connect+0x10/0x10
[  224.912580][ T6218]  __rpc_execute+0x526/0x1280
[  224.912611][ T6218]  ? __pfx___rpc_execute+0x10/0x10
[  224.912631][ T6218]  ? rpc_task_get_xprt+0x26/0x250
[  224.912650][ T6218]  ? rpc_make_runnable+0xae/0x1c0
[  224.912671][ T6218]  rpc_execute+0x1c1/0x390
[  224.912691][ T6218]  rpc_run_task+0x4a6/0x660
[  224.912708][ T6218]  rpc_create_xprt+0x533/0xa90
[  224.912723][ T6218]  ? __pfx_rpc_create_xprt+0x10/0x10
[  224.912749][ T6218]  ? rcu_is_watching+0x15/0xb0
[  224.912765][ T6218]  ? trace_kmalloc+0x2a/0xf0
[  224.912786][ T6218]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  224.912804][ T6218]  ? xprt_create_transport+0x39b/0x5f0
[  224.912829][ T6218]  ? xprt_create_transport+0x438/0x5f0
[  224.912847][ T6218]  rpc_create+0x649/0x900
[  224.912868][ T6218]  ? __pfx_rpc_create+0x10/0x10
[  224.912912][ T6218]  ? __lock_acquire+0x683/0x2cf0
[  224.912935][ T6218]  rpcb_create_af_local+0x1c7/0x3c0
[  224.912951][ T6218]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  224.912979][ T6218]  ? do_raw_spin_unlock+0xf5/0x210
[  224.913001][ T6218]  rpcb_create_local+0x268/0x670
[  224.913017][ T6218]  ? __pfx_rpcb_create_local+0x10/0x10
[  224.913031][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  224.913049][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  224.913067][ T6218]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  224.913083][ T6218]  ? __percpu_counter_init_many+0x35f/0x380
[  224.913138][ T6218]  ? __svc_create+0x88f/0x990
[  224.913163][ T6218]  svc_bind+0x1b4/0x230
[  224.913180][ T6218]  nfsd_create_serv+0x581/0x840
[  224.913200][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  224.913215][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  224.913237][ T6218]  ? __pfx_nfsd_create_serv+0x10/0x10
[  224.913255][ T6218]  ? net_generic+0x1e/0x240
[  224.913272][ T6218]  ? net_generic+0x1e/0x240
[  224.913307][ T6218]  ? net_generic+0x1e/0x240
[  224.913363][ T6218]  nfsd_svc+0x189/0x780
[  224.913394][ T6218]  write_threads+0x3cd/0x5a0
[  224.913409][ T6218]  ? __might_fault+0xaf/0x130
[  224.913428][ T6218]  ? __pfx_write_threads+0x10/0x10
[  224.913455][ T6218]  ? _copy_from_user+0x94/0xb0
[  224.913474][ T6218]  ? simple_transaction_get+0x12d/0x160
[  224.913493][ T6218]  nfsctl_transaction_write+0x10f/0x160
[  224.913509][ T6218]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  224.913524][ T6218]  vfs_write+0x296/0xba0
[  224.913547][ T6218]  ? __pfx_vfs_write+0x10/0x10
[  224.913570][ T6218]  ? _raw_spin_unlock_irq+0x23/0x50
[  224.913586][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  224.913606][ T6218]  ksys_write+0x150/0x270
[  224.913624][ T6218]  ? __pfx_ksys_write+0x10/0x10
[  224.913646][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.913662][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.913676][ T6218]  do_syscall_64+0x174/0x580
[  224.913693][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.913707][ T6218]  ? clear_bhb_loop+0x70/0xc0
[  224.913725][ T6218]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.913740][ T6218] RIP: 0033:0x7f3343939df7
[  224.913755][ T6218] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  224.913768][ T6218] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  224.913785][ T6218] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  224.913796][ T6218] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  224.913805][ T6218] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  224.913814][ T6218] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  224.913824][ T6218] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbdc
[  224.913846][ T6218]  </TASK>
[  225.188999][ T6218] FAULT_INJECTION: forcing a failure.
[  225.188999][ T6218] name failslab, interval 1, probability 5, space 0, times -1
[  225.195461][ T6218] CPU: 1 UID: 0 PID: 6218 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  225.195483][ T6218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  225.195494][ T6218] Call Trace:
[  225.195503][ T6218]  <TASK>
[  225.195511][ T6218]  dump_stack_lvl+0xe8/0x150
[  225.195539][ T6218]  should_fail_ex+0x40c/0x560
[  225.195566][ T6218]  should_failslab+0xa8/0x100
[  225.195586][ T6218]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  225.195609][ T6218]  ? security_file_alloc+0x34/0x310
[  225.195626][ T6218]  ? security_file_alloc+0x34/0x310
[  225.195649][ T6218]  security_file_alloc+0x34/0x310
[  225.195669][ T6218]  init_file+0x90/0x2b0
[  225.195687][ T6218]  alloc_empty_file+0x74/0x1d0
[  225.195703][ T6218]  alloc_file_pseudo+0x115/0x1e0
[  225.195722][ T6218]  ? __pfx_alloc_file_pseudo+0x10/0x10
[  225.195738][ T6218]  ? __raw_spin_lock_init+0x45/0x100
[  225.195764][ T6218]  sock_alloc_file+0xb8/0x2e0
[  225.195869][ T6218]  xs_local_connect+0x179/0x810
[  225.195909][ T6218]  ? __pfx_xs_local_connect+0x10/0x10
[  225.195930][ T6218]  ? do_raw_spin_unlock+0xf5/0x210
[  225.195956][ T6218]  xprt_connect+0x613/0x850
[  225.195979][ T6218]  ? __pfx_call_connect+0x10/0x10
[  225.196000][ T6218]  __rpc_execute+0x526/0x1280
[  225.196034][ T6218]  ? __pfx___rpc_execute+0x10/0x10
[  225.196055][ T6218]  ? rpc_task_get_xprt+0x26/0x250
[  225.196075][ T6218]  ? rpc_make_runnable+0xae/0x1c0
[  225.196098][ T6218]  rpc_execute+0x1c1/0x390
[  225.196121][ T6218]  rpc_run_task+0x4a6/0x660
[  225.196139][ T6218]  rpc_create_xprt+0x533/0xa90
[  225.196157][ T6218]  ? __pfx_rpc_create_xprt+0x10/0x10
[  225.196188][ T6218]  ? rcu_is_watching+0x15/0xb0
[  225.196207][ T6218]  ? trace_kmalloc+0x2a/0xf0
[  225.196233][ T6218]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  225.196253][ T6218]  ? xprt_create_transport+0x39b/0x5f0
[  225.196280][ T6218]  ? xprt_create_transport+0x438/0x5f0
[  225.198431][ T6218]  rpc_create+0x649/0x900
[  225.198458][ T6218]  ? __pfx_rpc_create+0x10/0x10
[  225.198508][ T6218]  ? __lock_acquire+0x683/0x2cf0
[  225.198534][ T6218]  rpcb_create_af_local+0x1c7/0x3c0
[  225.198551][ T6218]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  225.198585][ T6218]  ? do_raw_spin_unlock+0xf5/0x210
[  225.198609][ T6218]  rpcb_create_local+0x28f/0x670
[  225.198627][ T6218]  ? __pfx_rpcb_create_local+0x10/0x10
[  225.198642][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  225.198660][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.198679][ T6218]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  225.198696][ T6218]  ? __percpu_counter_init_many+0x35f/0x380
[  225.198724][ T6218]  ? __svc_create+0x88f/0x990
[  225.198749][ T6218]  svc_bind+0x1b4/0x230
[  225.198770][ T6218]  nfsd_create_serv+0x581/0x840
[  225.198790][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  225.198808][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.198829][ T6218]  ? __pfx_nfsd_create_serv+0x10/0x10
[  225.198851][ T6218]  ? net_generic+0x1e/0x240
[  225.198883][ T6218]  ? net_generic+0x1e/0x240
[  225.198906][ T6218]  ? net_generic+0x1e/0x240
[  225.198931][ T6218]  nfsd_svc+0x189/0x780
[  225.198956][ T6218]  write_threads+0x3cd/0x5a0
[  225.198971][ T6218]  ? __might_fault+0xaf/0x130
[  225.198993][ T6218]  ? __pfx_write_threads+0x10/0x10
[  225.199023][ T6218]  ? _copy_from_user+0x94/0xb0
[  225.199042][ T6218]  ? simple_transaction_get+0x12d/0x160
[  225.199061][ T6218]  nfsctl_transaction_write+0x10f/0x160
[  225.199079][ T6218]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  225.199095][ T6218]  vfs_write+0x296/0xba0
[  225.199122][ T6218]  ? __pfx_vfs_write+0x10/0x10
[  225.199281][ T6218]  ? _raw_spin_unlock_irq+0x23/0x50
[  225.199390][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.199417][ T6218]  ksys_write+0x150/0x270
[  225.199441][ T6218]  ? __pfx_ksys_write+0x10/0x10
[  225.199554][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.199577][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.199595][ T6218]  do_syscall_64+0x174/0x580
[  225.199615][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.199631][ T6218]  ? clear_bhb_loop+0x70/0xc0
[  225.199651][ T6218]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.199667][ T6218] RIP: 0033:0x7f3343939df7
[  225.199684][ T6218] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  225.199698][ T6218] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  225.199716][ T6218] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  225.199728][ T6218] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  225.199739][ T6218] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  225.199748][ T6218] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  225.199759][ T6218] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbdc
[  225.199783][ T6218]  </TASK>
[  225.433207][ T6218] FAULT_INJECTION: forcing a failure.
[  225.433207][ T6218] name failslab, interval 1, probability 5, space 0, times -1
[  225.476303][ T6218] CPU: 1 UID: 0 PID: 6218 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  225.476326][ T6218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  225.476335][ T6218] Call Trace:
[  225.476342][ T6218]  <TASK>
[  225.476350][ T6218]  dump_stack_lvl+0xe8/0x150
[  225.476378][ T6218]  should_fail_ex+0x40c/0x560
[  225.476402][ T6218]  should_failslab+0xa8/0x100
[  225.476419][ T6218]  __kmalloc_cache_noprof+0xa8/0x660
[  225.476443][ T6218]  ? kobject_uevent_env+0x289/0x9e0
[  225.476457][ T6218]  ? kobject_uevent_env+0x289/0x9e0
[  225.476474][ T6218]  kobject_uevent_env+0x289/0x9e0
[  225.476494][ T6218]  rpc_sysfs_xprt_switch_destroy+0x51/0x90
[  225.476516][ T6218]  xprt_switch_put+0x33d/0x3c0
[  225.476538][ T6218]  rpc_release_client+0x350/0x6a0
[  225.476559][ T6218]  rpc_shutdown_client+0x4c6/0x6c0
[  225.476576][ T6218]  ? __pfx_rpc_shutdown_client+0x10/0x10
[  225.476590][ T6218]  ? kmem_cache_free+0x182/0x650
[  225.476609][ T6218]  ? rpc_task_get_xprt+0x26/0x250
[  225.476627][ T6218]  ? __pfx_mempool_free_slab+0x10/0x10
[  225.476647][ T6218]  ? mempool_free+0xec/0x130
[  225.476666][ T6218]  ? __pfx_mempool_free+0x10/0x10
[  225.476683][ T6218]  ? put_rpccred+0x74/0x960
[  225.476704][ T6218]  ? rpc_final_put_task+0x1e4/0x220
[  225.476723][ T6218]  rpc_create_xprt+0x612/0xa90
[  225.476739][ T6218]  ? __pfx_rpc_create_xprt+0x10/0x10
[  225.476766][ T6218]  ? rcu_is_watching+0x15/0xb0
[  225.476785][ T6218]  ? trace_kmalloc+0x2a/0xf0
[  225.476808][ T6218]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  225.476827][ T6218]  ? xprt_create_transport+0x39b/0x5f0
[  225.476852][ T6218]  ? xprt_create_transport+0x438/0x5f0
[  225.476869][ T6218]  rpc_create+0x649/0x900
[  225.476892][ T6218]  ? __pfx_rpc_create+0x10/0x10
[  225.476934][ T6218]  ? __lock_acquire+0x683/0x2cf0
[  225.476955][ T6218]  rpcb_create_af_local+0x1c7/0x3c0
[  225.476982][ T6218]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  225.477011][ T6218]  ? do_raw_spin_unlock+0xf5/0x210
[  225.477033][ T6218]  rpcb_create_local+0x28f/0x670
[  225.477049][ T6218]  ? __pfx_rpcb_create_local+0x10/0x10
[  225.477063][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  225.477080][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.477097][ T6218]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  225.477113][ T6218]  ? __percpu_counter_init_many+0x35f/0x380
[  225.477137][ T6218]  ? __svc_create+0x88f/0x990
[  225.477159][ T6218]  svc_bind+0x1b4/0x230
[  225.477178][ T6218]  nfsd_create_serv+0x581/0x840
[  225.477198][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  225.477213][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.477233][ T6218]  ? __pfx_nfsd_create_serv+0x10/0x10
[  225.477287][ T6218]  ? net_generic+0x1e/0x240
[  225.477307][ T6218]  ? net_generic+0x1e/0x240
[  225.477329][ T6218]  ? net_generic+0x1e/0x240
[  225.477352][ T6218]  nfsd_svc+0x189/0x780
[  225.477376][ T6218]  write_threads+0x3cd/0x5a0
[  225.477389][ T6218]  ? __might_fault+0xaf/0x130
[  225.477409][ T6218]  ? __pfx_write_threads+0x10/0x10
[  225.477434][ T6218]  ? _copy_from_user+0x94/0xb0
[  225.477451][ T6218]  ? simple_transaction_get+0x12d/0x160
[  225.477469][ T6218]  nfsctl_transaction_write+0x10f/0x160
[  225.477484][ T6218]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  225.477500][ T6218]  vfs_write+0x296/0xba0
[  225.477524][ T6218]  ? __pfx_vfs_write+0x10/0x10
[  225.477546][ T6218]  ? _raw_spin_unlock_irq+0x23/0x50
[  225.477562][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.477584][ T6218]  ksys_write+0x150/0x270
[  225.477604][ T6218]  ? __pfx_ksys_write+0x10/0x10
[  225.477649][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.477666][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.477681][ T6218]  do_syscall_64+0x174/0x580
[  225.477699][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.477713][ T6218]  ? clear_bhb_loop+0x70/0xc0
[  225.477731][ T6218]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.477744][ T6218] RIP: 0033:0x7f3343939df7
[  225.477760][ T6218] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  225.477773][ T6218] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  225.477789][ T6218] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  225.477799][ T6218] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  225.477808][ T6218] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  225.477816][ T6218] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  225.477825][ T6218] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbdc
[  225.477846][ T6218]  </TASK>
[  225.703057][ T6218] FAULT_INJECTION: forcing a failure.
[  225.703057][ T6218] name failslab, interval 1, probability 5, space 0, times -1
[  225.708216][ T6218] CPU: 1 UID: 0 PID: 6218 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  225.708332][ T6218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  225.708341][ T6218] Call Trace:
[  225.708348][ T6218]  <TASK>
[  225.708354][ T6218]  dump_stack_lvl+0xe8/0x150
[  225.708376][ T6218]  should_fail_ex+0x40c/0x560
[  225.708397][ T6218]  should_failslab+0xa8/0x100
[  225.708413][ T6218]  __kmalloc_node_track_caller_noprof+0x100/0x730
[  225.708432][ T6218]  ? __pfx_snprintf+0x10/0x10
[  225.708444][ T6218]  ? xs_format_common_peer_ports+0x15c/0x320
[  225.708461][ T6218]  ? xs_format_common_peer_ports+0x15c/0x320
[  225.708480][ T6218]  kstrdup+0x42/0x100
[  225.708498][ T6218]  xs_format_common_peer_ports+0x15c/0x320
[  225.708515][ T6218]  ? __pfx_xs_format_common_peer_ports+0x10/0x10
[  225.708529][ T6218]  ? trace_kmalloc+0x2a/0xf0
[  225.708557][ T6218]  xs_format_peer_addresses+0x427/0x530
[  225.708571][ T6218]  ? __pfx_xs_format_peer_addresses+0x10/0x10
[  225.708594][ T6218]  ? timer_init_key+0x161/0x2c0
[  225.708613][ T6218]  xs_setup_tcp+0x751/0x920
[  225.708631][ T6218]  ? __pfx_xs_setup_tcp+0x10/0x10
[  225.708646][ T6218]  ? preempt_schedule_common+0x82/0xd0
[  225.708661][ T6218]  ? preempt_schedule_thunk+0x16/0x40
[  225.708678][ T6218]  xprt_create_transport+0x166/0x5f0
[  225.708692][ T6218]  rpc_create+0x4ff/0x900
[  225.708711][ T6218]  ? __pfx_rpc_create+0x10/0x10
[  225.708756][ T6218]  rpcb_create_local+0x3ab/0x670
[  225.708771][ T6218]  ? __pfx_rpcb_create_local+0x10/0x10
[  225.708790][ T6218]  ? __svc_create+0x88f/0x990
[  225.708809][ T6218]  svc_bind+0x1b4/0x230
[  225.708825][ T6218]  nfsd_create_serv+0x581/0x840
[  225.708843][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  225.708856][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.708875][ T6218]  ? __pfx_nfsd_create_serv+0x10/0x10
[  225.708892][ T6218]  ? net_generic+0x1e/0x240
[  225.708908][ T6218]  ? net_generic+0x1e/0x240
[  225.708927][ T6218]  ? net_generic+0x1e/0x240
[  225.708955][ T6218]  nfsd_svc+0x189/0x780
[  225.708976][ T6218]  write_threads+0x3cd/0x5a0
[  225.708988][ T6218]  ? __might_fault+0xaf/0x130
[  225.709005][ T6218]  ? __pfx_write_threads+0x10/0x10
[  225.709029][ T6218]  ? _copy_from_user+0x94/0xb0
[  225.709045][ T6218]  ? simple_transaction_get+0x12d/0x160
[  225.709060][ T6218]  nfsctl_transaction_write+0x10f/0x160
[  225.709075][ T6218]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  225.709088][ T6218]  vfs_write+0x296/0xba0
[  225.709109][ T6218]  ? __pfx_vfs_write+0x10/0x10
[  225.709129][ T6218]  ? _raw_spin_unlock_irq+0x23/0x50
[  225.709142][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.709161][ T6218]  ksys_write+0x150/0x270
[  225.709177][ T6218]  ? __pfx_ksys_write+0x10/0x10
[  225.709197][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.709210][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.709224][ T6218]  do_syscall_64+0x174/0x580
[  225.709276][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.709291][ T6218]  ? clear_bhb_loop+0x70/0xc0
[  225.709308][ T6218]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.709322][ T6218] RIP: 0033:0x7f3343939df7
[  225.709336][ T6218] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  225.709349][ T6218] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  225.709365][ T6218] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  225.709375][ T6218] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  225.709385][ T6218] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  225.709394][ T6218] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  225.709403][ T6218] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbdc
[  225.709425][ T6218]  </TASK>
[  225.709533][ T6218] FAULT_INJECTION: forcing a failure.
[  225.709533][ T6218] name failslab, interval 1, probability 5, space 0, times -1
[  225.888501][ T6218] CPU: 1 UID: 0 PID: 6218 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  225.888521][ T6218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  225.888530][ T6218] Call Trace:
[  225.888537][ T6218]  <TASK>
[  225.888544][ T6218]  dump_stack_lvl+0xe8/0x150
[  225.888569][ T6218]  should_fail_ex+0x40c/0x560
[  225.888596][ T6218]  should_failslab+0xa8/0x100
[  225.888614][ T6218]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  225.888634][ T6218]  ? kstrdup+0x81/0x100
[  225.888655][ T6218]  ? __kernfs_new_node+0xe6/0x980
[  225.888673][ T6218]  ? __kernfs_new_node+0xe6/0x980
[  225.888695][ T6218]  __kernfs_new_node+0xe6/0x980
[  225.888721][ T6218]  ? __pfx___kernfs_new_node+0x10/0x10
[  225.888740][ T6218]  ? kernfs_root+0x1c/0x230
[  225.888762][ T6218]  ? kernfs_root+0x1c/0x230
[  225.888779][ T6218]  ? kernfs_root+0x1c/0x230
[  225.888795][ T6218]  ? kernfs_root+0x1c/0x230
[  225.888816][ T6218]  kernfs_create_dir_ns+0xfe/0x230
[  225.888840][ T6218]  sysfs_create_dir_ns+0x12f/0x2a0
[  225.888861][ T6218]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  225.888882][ T6218]  ? do_raw_spin_unlock+0xf5/0x210
[  225.888904][ T6218]  kobject_add_internal+0x622/0xcd0
[  225.888930][ T6218]  kobject_init_and_add+0x12b/0x1a0
[  225.888955][ T6218]  ? __pfx_kobject_init_and_add+0x10/0x10
[  225.888975][ T6218]  ? __kmalloc_cache_noprof+0x150/0x660
[  225.888995][ T6218]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  225.889015][ T6218]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  225.889038][ T6218]  rpc_sysfs_xprt_switch_setup+0x169/0x2b0
[  225.889062][ T6218]  xprt_switch_alloc+0x238/0x590
[  225.889084][ T6218]  rpc_create_xprt+0x1c7/0xa90
[  225.889101][ T6218]  ? __pfx_rpc_create_xprt+0x10/0x10
[  225.889129][ T6218]  ? rcu_is_watching+0x15/0xb0
[  225.889146][ T6218]  ? trace_kmalloc+0x2a/0xf0
[  225.889168][ T6218]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  225.889190][ T6218]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  225.889244][ T6218]  ? xprt_create_transport+0x39b/0x5f0
[  225.889261][ T6218]  ? xprt_create_transport+0x39b/0x5f0
[  225.889276][ T6218]  ? kstrdup+0x81/0x100
[  225.889296][ T6218]  ? __asan_memcpy+0x40/0x70
[  225.889320][ T6218]  ? xprt_create_transport+0x438/0x5f0
[  225.889338][ T6218]  rpc_create+0x649/0x900
[  225.889360][ T6218]  ? __pfx_rpc_create+0x10/0x10
[  225.889414][ T6218]  rpcb_create_local+0x3ab/0x670
[  225.889441][ T6218]  ? __pfx_rpcb_create_local+0x10/0x10
[  225.889464][ T6218]  ? __svc_create+0x88f/0x990
[  225.889487][ T6218]  svc_bind+0x1b4/0x230
[  225.889504][ T6218]  nfsd_create_serv+0x581/0x840
[  225.889523][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  225.889538][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.889558][ T6218]  ? __pfx_nfsd_create_serv+0x10/0x10
[  225.889577][ T6218]  ? net_generic+0x1e/0x240
[  225.889611][ T6218]  ? net_generic+0x1e/0x240
[  225.889633][ T6218]  ? net_generic+0x1e/0x240
[  225.889657][ T6218]  nfsd_svc+0x189/0x780
[  225.889682][ T6218]  write_threads+0x3cd/0x5a0
[  225.889697][ T6218]  ? __might_fault+0xaf/0x130
[  225.889718][ T6218]  ? __pfx_write_threads+0x10/0x10
[  225.889745][ T6218]  ? _copy_from_user+0x94/0xb0
[  225.889762][ T6218]  ? simple_transaction_get+0x12d/0x160
[  225.889778][ T6218]  nfsctl_transaction_write+0x10f/0x160
[  225.889793][ T6218]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  225.889807][ T6218]  vfs_write+0x296/0xba0
[  225.889830][ T6218]  ? __pfx_vfs_write+0x10/0x10
[  225.889853][ T6218]  ? _raw_spin_unlock_irq+0x23/0x50
[  225.889869][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.889892][ T6218]  ksys_write+0x150/0x270
[  225.889911][ T6218]  ? __pfx_ksys_write+0x10/0x10
[  225.889933][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.889948][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.889963][ T6218]  do_syscall_64+0x174/0x580
[  225.889979][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.889994][ T6218]  ? clear_bhb_loop+0x70/0xc0
[  225.890011][ T6218]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.890025][ T6218] RIP: 0033:0x7f3343939df7
[  225.890040][ T6218] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  225.890053][ T6218] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  225.890069][ T6218] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  225.890079][ T6218] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  225.890088][ T6218] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  225.890095][ T6218] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  225.890104][ T6218] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbdc
[  225.890127][ T6218]  </TASK>
[  225.890158][ T6218] kobject: kobject_add_internal failed for switch-23 (error: -12 parent: xprt-switches)
[  226.100551][ T6218] FAULT_INJECTION: forcing a failure.
[  226.100551][ T6218] name failslab, interval 1, probability 5, space 0, times -1
[  226.105574][ T6218] CPU: 1 UID: 0 PID: 6218 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  226.105597][ T6218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  226.105607][ T6218] Call Trace:
[  226.105615][ T6218]  <TASK>
[  226.105622][ T6218]  dump_stack_lvl+0xe8/0x150
[  226.105648][ T6218]  should_fail_ex+0x40c/0x560
[  226.105674][ T6218]  should_failslab+0xa8/0x100
[  226.105692][ T6218]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  226.105713][ T6218]  ? rpc_new_task+0xf3/0x800
[  226.105743][ T6218]  ? rpc_new_task+0xf3/0x800
[  226.105766][ T6218]  rpc_new_task+0xf3/0x800
[  226.105787][ T6218]  ? rcu_is_watching+0x15/0xb0
[  226.105804][ T6218]  ? trace_rpc_clnt_new+0x84/0x200
[  226.105821][ T6218]  ? __pfx_rpc_new_task+0x10/0x10
[  226.105840][ T6218]  ? rpc_new_client+0x940/0xc50
[  226.105861][ T6218]  rpc_run_task+0x22/0x660
[  226.105880][ T6218]  rpc_bind_new_program+0x3ae/0x530
[  226.105895][ T6218]  ? __pfx_rpc_create+0x10/0x10
[  226.105916][ T6218]  ? __pfx_rpc_bind_new_program+0x10/0x10
[  226.105959][ T6218]  rpcb_create_local+0x3ed/0x670
[  226.105975][ T6218]  ? __pfx_rpcb_create_local+0x10/0x10
[  226.105997][ T6218]  ? __svc_create+0x88f/0x990
[  226.106021][ T6218]  svc_bind+0x1b4/0x230
[  226.106039][ T6218]  nfsd_create_serv+0x581/0x840
[  226.106059][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  226.106077][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  226.106095][ T6218]  ? __pfx_nfsd_create_serv+0x10/0x10
[  226.106113][ T6218]  ? net_generic+0x1e/0x240
[  226.106131][ T6218]  ? net_generic+0x1e/0x240
[  226.106153][ T6218]  ? net_generic+0x1e/0x240
[  226.106177][ T6218]  nfsd_svc+0x189/0x780
[  226.106240][ T6218]  write_threads+0x3cd/0x5a0
[  226.106254][ T6218]  ? __might_fault+0xaf/0x130
[  226.106273][ T6218]  ? __pfx_write_threads+0x10/0x10
[  226.106297][ T6218]  ? _copy_from_user+0x94/0xb0
[  226.106314][ T6218]  ? simple_transaction_get+0x12d/0x160
[  226.106391][ T6218]  nfsctl_transaction_write+0x10f/0x160
[  226.106409][ T6218]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  226.106423][ T6218]  vfs_write+0x296/0xba0
[  226.106447][ T6218]  ? __pfx_vfs_write+0x10/0x10
[  226.106470][ T6218]  ? _raw_spin_unlock_irq+0x23/0x50
[  226.106485][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  226.106509][ T6218]  ksys_write+0x150/0x270
[  226.106529][ T6218]  ? __pfx_ksys_write+0x10/0x10
[  226.106551][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.106566][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.106581][ T6218]  do_syscall_64+0x174/0x580
[  226.106597][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.106612][ T6218]  ? clear_bhb_loop+0x70/0xc0
[  226.106630][ T6218]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.106645][ T6218] RIP: 0033:0x7f3343939df7
[  226.106661][ T6218] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  226.106674][ T6218] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  226.106691][ T6218] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  226.106701][ T6218] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  226.106709][ T6218] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  226.106727][ T6218] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  226.106737][ T6218] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbdc
[  226.106759][ T6218]  </TASK>
[  226.309160][ T6218] FAULT_INJECTION: forcing a failure.
[  226.309160][ T6218] name failslab, interval 1, probability 5, space 0, times -1
[  226.325743][ T6218] CPU: 0 UID: 0 PID: 6218 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  226.325768][ T6218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  226.325778][ T6218] Call Trace:
[  226.325785][ T6218]  <TASK>
[  226.325826][ T6218]  dump_stack_lvl+0xe8/0x150
[  226.325855][ T6218]  should_fail_ex+0x40c/0x560
[  226.325883][ T6218]  should_failslab+0xa8/0x100
[  226.325902][ T6218]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  226.325921][ T6218]  ? kmem_cache_free+0x182/0x650
[  226.325943][ T6218]  ? rpc_new_task+0xf3/0x800
[  226.325961][ T6218]  ? rpc_new_task+0xf3/0x800
[  226.326007][ T6218]  rpc_new_task+0xf3/0x800
[  226.326020][ T6218]  ? __lock_acquire+0x683/0x2cf0
[  226.326034][ T6218]  ? __pfx_rpc_new_task+0x10/0x10
[  226.326094][ T6218]  rpc_run_task+0x22/0x660
[  226.326115][ T6218]  rpc_call_sync+0x10f/0x200
[  226.326198][ T6218]  ? __pfx_rpc_call_sync+0x10/0x10
[  226.326222][ T6218]  ? net_generic+0x1e/0x240
[  226.326237][ T6218]  ? net_generic+0x1e/0x240
[  226.326256][ T6218]  rpcb_register+0x2d0/0x530
[  226.326314][ T6218]  ? __pfx_rpcb_register+0x10/0x10
[  226.326327][ T6218]  ? net_generic+0x1e/0x240
[  226.326381][ T6218]  ? rpcb_create_local+0x4ee/0x670
[  226.326400][ T6218]  ? __pfx_rpcb_create_local+0x10/0x10
[  226.326458][ T6218]  svc_unregister+0x24d/0x780
[  226.326487][ T6218]  svc_bind+0x1e9/0x230
[  226.326572][ T6218]  nfsd_create_serv+0x581/0x840
[  226.326596][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  226.326615][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  226.326672][ T6218]  ? __pfx_nfsd_create_serv+0x10/0x10
[  226.326727][ T6218]  ? net_generic+0x1e/0x240
[  226.326747][ T6218]  ? net_generic+0x1e/0x240
[  226.326839][ T6218]  ? net_generic+0x1e/0x240
[  226.326866][ T6218]  nfsd_svc+0x189/0x780
[  226.326925][ T6218]  write_threads+0x3cd/0x5a0
[  226.326974][ T6218]  ? __might_fault+0xaf/0x130
[  226.326996][ T6218]  ? __pfx_write_threads+0x10/0x10
[  226.327059][ T6218]  ? _copy_from_user+0x94/0xb0
[  226.327109][ T6218]  ? simple_transaction_get+0x12d/0x160
[  226.327130][ T6218]  nfsctl_transaction_write+0x10f/0x160
[  226.327147][ T6218]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  226.327200][ T6218]  vfs_write+0x296/0xba0
[  226.327228][ T6218]  ? __pfx_vfs_write+0x10/0x10
[  226.327305][ T6218]  ? _raw_spin_unlock_irq+0x23/0x50
[  226.327324][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  226.327383][ T6218]  ksys_write+0x150/0x270
[  226.327405][ T6218]  ? __pfx_ksys_write+0x10/0x10
[  226.327428][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.327480][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.327497][ T6218]  do_syscall_64+0x174/0x580
[  226.327515][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.327564][ T6218]  ? clear_bhb_loop+0x70/0xc0
[  226.327581][ T6218]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.327595][ T6218] RIP: 0033:0x7f3343939df7
[  226.327610][ T6218] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  226.327621][ T6218] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  226.327638][ T6218] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  226.327648][ T6218] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  226.327656][ T6218] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  226.327664][ T6218] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  226.327672][ T6218] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbdc
[  226.327693][ T6218]  </TASK>
[  226.500306][ T6218] FAULT_INJECTION: forcing a failure.
[  226.500306][ T6218] name failslab, interval 1, probability 5, space 0, times -1
[  226.507049][ T6218] CPU: 0 UID: 0 PID: 6218 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  226.507072][ T6218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  226.507081][ T6218] Call Trace:
[  226.507090][ T6218]  <TASK>
[  226.507097][ T6218]  dump_stack_lvl+0xe8/0x150
[  226.507124][ T6218]  should_fail_ex+0x40c/0x560
[  226.507177][ T6218]  should_failslab+0xa8/0x100
[  226.507197][ T6218]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  226.507218][ T6218]  ? __kernfs_new_node+0xe6/0x980
[  226.507237][ T6218]  ? __kernfs_new_node+0xe6/0x980
[  226.507262][ T6218]  __kernfs_new_node+0xe6/0x980
[  226.507287][ T6218]  ? __pfx___kernfs_new_node+0x10/0x10
[  226.507306][ T6218]  ? kernfs_root+0x1c/0x230
[  226.507327][ T6218]  ? kernfs_root+0x1c/0x230
[  226.507344][ T6218]  ? kernfs_root+0x1c/0x230
[  226.507358][ T6218]  ? kernfs_root+0x1c/0x230
[  226.507378][ T6218]  kernfs_new_node+0xea/0x140
[  226.507399][ T6218]  __kernfs_create_file+0x4b/0x2e0
[  226.507414][ T6218]  sysfs_add_file_mode_ns+0x237/0x300
[  226.507434][ T6218]  internal_create_group+0x679/0x1180
[  226.507457][ T6218]  ? kernfs_create_dir_ns+0x1d5/0x230
[  226.507568][ T6218]  ? __pfx_internal_create_group+0x10/0x10
[  226.507605][ T6218]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  226.507675][ T6218]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  226.507703][ T6218]  sysfs_create_groups+0x59/0x120
[  226.507722][ T6218]  kobject_add_internal+0x669/0xcd0
[  226.507753][ T6218]  kobject_init_and_add+0x12b/0x1a0
[  226.507777][ T6218]  ? __pfx_kobject_init_and_add+0x10/0x10
[  226.507797][ T6218]  ? kernfs_remove_by_name_ns+0x101/0x140
[  226.507820][ T6218]  ? kernfs_remove_by_name_ns+0x101/0x140
[  226.507842][ T6218]  sysfs_slab_add+0x7b/0x260
[  226.507859][ T6218]  do_kmem_cache_create+0x8bf/0x970
[  226.507897][ T6218]  __kmem_cache_create_args+0x307/0x440
[  226.507918][ T6218]  nfsd_file_cache_init+0x197/0x530
[  226.507938][ T6218]  ? __pfx_nfsd_file_cache_init+0x10/0x10
[  226.507955][ T6218]  ? net_generic+0x1e/0x240
[  226.507978][ T6218]  ? net_generic+0x1e/0x240
[  226.507995][ T6218]  ? net_generic+0x1e/0x240
[  226.508011][ T6218]  ? net_generic+0x1e/0x240
[  226.508062][ T6218]  ? net_generic+0x1f4/0x240
[  226.508101][ T6218]  nfsd_svc+0x315/0x780
[  226.508125][ T6218]  write_threads+0x3cd/0x5a0
[  226.508141][ T6218]  ? __might_fault+0xaf/0x130
[  226.508192][ T6218]  ? __pfx_write_threads+0x10/0x10
[  226.508218][ T6218]  ? _copy_from_user+0x94/0xb0
[  226.508235][ T6218]  ? simple_transaction_get+0x12d/0x160
[  226.508251][ T6218]  nfsctl_transaction_write+0x10f/0x160
[  226.508265][ T6218]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  226.508278][ T6218]  vfs_write+0x296/0xba0
[  226.508301][ T6218]  ? __pfx_vfs_write+0x10/0x10
[  226.508323][ T6218]  ? _raw_spin_unlock_irq+0x23/0x50
[  226.508439][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  226.508465][ T6218]  ksys_write+0x150/0x270
[  226.508484][ T6218]  ? __pfx_ksys_write+0x10/0x10
[  226.508505][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.508520][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.508533][ T6218]  do_syscall_64+0x174/0x580
[  226.508550][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.508565][ T6218]  ? clear_bhb_loop+0x70/0xc0
[  226.508582][ T6218]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.508595][ T6218] RIP: 0033:0x7f3343939df7
[  226.508610][ T6218] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  226.508624][ T6218] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  226.508639][ T6218] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  226.508651][ T6218] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  226.508659][ T6218] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  226.508668][ T6218] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  226.508677][ T6218] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbdc
[  226.508698][ T6218]  </TASK>
[  226.698035][ T6218] kobject: kobject_add_internal failed for nfsd_file (error: -12 parent: slab)
[  226.701487][ T6218] SLUB: Unable to add cache nfsd_file to sysfs
[  226.704489][ T6218] FAULT_INJECTION: forcing a failure.
[  226.704489][ T6218] name failslab, interval 1, probability 5, space 0, times -1
[  226.709683][ T6218] CPU: 0 UID: 0 PID: 6218 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  226.709704][ T6218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  226.709714][ T6218] Call Trace:
[  226.709721][ T6218]  <TASK>
[  226.709729][ T6218]  dump_stack_lvl+0xe8/0x150
[  226.709756][ T6218]  should_fail_ex+0x40c/0x560
[  226.709785][ T6218]  should_failslab+0xa8/0x100
[  226.709805][ T6218]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  226.709828][ T6218]  ? __kernfs_new_node+0xe6/0x980
[  226.709846][ T6218]  ? __kernfs_new_node+0xe6/0x980
[  226.709872][ T6218]  __kernfs_new_node+0xe6/0x980
[  226.709896][ T6218]  ? __pfx___kernfs_new_node+0x10/0x10
[  226.709912][ T6218]  ? kernfs_root+0x1c/0x230
[  226.709931][ T6218]  ? kernfs_root+0x1c/0x230
[  226.709949][ T6218]  ? kernfs_root+0x1c/0x230
[  226.709966][ T6218]  ? kernfs_root+0x1c/0x230
[  226.709986][ T6218]  kernfs_new_node+0xea/0x140
[  226.710009][ T6218]  __kernfs_create_file+0x4b/0x2e0
[  226.710027][ T6218]  sysfs_add_file_mode_ns+0x237/0x300
[  226.710051][ T6218]  internal_create_group+0x679/0x1180
[  226.710079][ T6218]  ? kernfs_create_dir_ns+0x1d5/0x230
[  226.710102][ T6218]  ? __pfx_internal_create_group+0x10/0x10
[  226.710120][ T6218]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  226.711613][ T6218]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  226.711635][ T6218]  sysfs_create_groups+0x59/0x120
[  226.711656][ T6218]  kobject_add_internal+0x669/0xcd0
[  226.711684][ T6218]  kobject_init_and_add+0x12b/0x1a0
[  226.711709][ T6218]  ? __pfx_kobject_init_and_add+0x10/0x10
[  226.711731][ T6218]  ? kernfs_remove_by_name_ns+0x101/0x140
[  226.711753][ T6218]  ? kernfs_remove_by_name_ns+0x101/0x140
[  226.711775][ T6218]  sysfs_slab_add+0x7b/0x260
[  226.711793][ T6218]  do_kmem_cache_create+0x8bf/0x970
[  226.711814][ T6218]  __kmem_cache_create_args+0x307/0x440
[  226.711835][ T6218]  nfsd_file_cache_init+0x1d9/0x530
[  226.711855][ T6218]  ? __pfx_nfsd_file_cache_init+0x10/0x10
[  226.711872][ T6218]  ? net_generic+0x1e/0x240
[  226.711899][ T6218]  ? net_generic+0x1e/0x240
[  226.711917][ T6218]  ? net_generic+0x1e/0x240
[  226.711933][ T6218]  ? net_generic+0x1e/0x240
[  226.711952][ T6218]  ? net_generic+0x1f4/0x240
[  226.711972][ T6218]  nfsd_svc+0x315/0x780
[  226.711996][ T6218]  write_threads+0x3cd/0x5a0
[  226.712011][ T6218]  ? __might_fault+0xaf/0x130
[  226.712031][ T6218]  ? __pfx_write_threads+0x10/0x10
[  226.712059][ T6218]  ? _copy_from_user+0x94/0xb0
[  226.712077][ T6218]  ? simple_transaction_get+0x12d/0x160
[  226.712096][ T6218]  nfsctl_transaction_write+0x10f/0x160
[  226.712112][ T6218]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  226.712155][ T6218]  vfs_write+0x296/0xba0
[  226.712179][ T6218]  ? __pfx_vfs_write+0x10/0x10
[  226.712200][ T6218]  ? _raw_spin_unlock_irq+0x23/0x50
[  226.712216][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  226.712237][ T6218]  ksys_write+0x150/0x270
[  226.712257][ T6218]  ? __pfx_ksys_write+0x10/0x10
[  226.712280][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.712299][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.712316][ T6218]  do_syscall_64+0x174/0x580
[  226.712334][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.712363][ T6218]  ? clear_bhb_loop+0x70/0xc0
[  226.712382][ T6218]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.712397][ T6218] RIP: 0033:0x7f3343939df7
[  226.712414][ T6218] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  226.712428][ T6218] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  226.712445][ T6218] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  226.712457][ T6218] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  226.712467][ T6218] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  226.712476][ T6218] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  226.712486][ T6218] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbdc
[  226.712511][ T6218]  </TASK>
[  226.712805][ T6218] kobject: kobject_add_internal failed for nfsd_file_mark (error: -12 parent: slab)
[  226.892952][ T6218] SLUB: Unable to add cache nfsd_file_mark to sysfs
[  226.895910][ T6218] NFSD: Failed to start, no listeners configured.
[pid  5924] write(4, "tcp 2049\n", 9 <unfinished ...>
[pid  6218] <... write resumed>)        = -1 EIO (Input/output error)
[  227.184062][ T6213] FAULT_INJECTION: forcing a failure.
[  227.184062][ T6213] name failslab, interval 1, probability 5, space 0, times -1
[pid  6218] openat(AT_FDCWD, "/proc/self/make-it-fail", O_WRONLY) = 5
[  227.193292][ T6213] CPU: 0 UID: 0 PID: 6213 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  227.193314][ T6213] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  227.193324][ T6213] Call Trace:
[  227.193331][ T6213]  <TASK>
[  227.193338][ T6213]  dump_stack_lvl+0xe8/0x150
[  227.193367][ T6213]  should_fail_ex+0x40c/0x560
[  227.193394][ T6213]  should_failslab+0xa8/0x100
[  227.193414][ T6213]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  227.193434][ T6213]  ? kstrdup+0x81/0x100
[  227.193457][ T6213]  ? __kernfs_new_node+0xe6/0x980
[  227.193475][ T6213]  ? __kernfs_new_node+0xe6/0x980
[  227.193500][ T6213]  __kernfs_new_node+0xe6/0x980
[  227.193548][ T6213]  ? __pfx___kernfs_new_node+0x10/0x10
[  227.193577][ T6213]  ? kernfs_root+0x1c/0x230
[  227.193600][ T6213]  ? kernfs_root+0x1c/0x230
[  227.193655][ T6213]  ? kernfs_root+0x1c/0x230
[  227.193672][ T6213]  ? kernfs_root+0x1c/0x230
[  227.193696][ T6213]  kernfs_create_dir_ns+0xfe/0x230
[  227.193723][ T6213]  sysfs_create_dir_ns+0x12f/0x2a0
[  227.193747][ T6213]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  227.193770][ T6213]  ? do_raw_spin_unlock+0xf5/0x210
[  227.193794][ T6213]  kobject_add_internal+0x622/0xcd0
[  227.193844][ T6213]  kobject_init_and_add+0x12b/0x1a0
[  227.193872][ T6213]  ? __pfx_kobject_init_and_add+0x10/0x10
[  227.193896][ T6213]  ? __kmalloc_cache_noprof+0x150/0x660
[  227.193918][ T6213]  ? rpc_sysfs_xprt_setup+0xa7/0x260
[  227.193939][ T6213]  ? rpc_sysfs_xprt_setup+0xa7/0x260
[  227.193965][ T6213]  rpc_sysfs_xprt_setup+0x132/0x260
[  227.193989][ T6213]  xprt_switch_alloc+0x420/0x590
[  227.194013][ T6213]  rpc_create_xprt+0x1c7/0xa90
[  227.194032][ T6213]  ? __pfx_rpc_create_xprt+0x10/0x10
[  227.194061][ T6213]  ? rcu_is_watching+0x15/0xb0
[  227.195137][ T6213]  ? trace_kmalloc+0x2a/0xf0
[  227.195162][ T6213]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  227.195186][ T6213]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  227.195208][ T6213]  ? xprt_create_transport+0x39b/0x5f0
[  227.195225][ T6213]  ? xprt_create_transport+0x39b/0x5f0
[  227.195243][ T6213]  ? kstrdup+0x81/0x100
[  227.195265][ T6213]  ? __asan_memcpy+0x40/0x70
[  227.195292][ T6213]  ? xprt_create_transport+0x438/0x5f0
[  227.195311][ T6213]  rpc_create+0x649/0x900
[  227.195336][ T6213]  ? __pfx_rpc_create+0x10/0x10
[  227.195388][ T6213]  ? __lock_acquire+0x683/0x2cf0
[  227.195414][ T6213]  rpcb_create_af_local+0x1c7/0x3c0
[  227.195431][ T6213]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  227.195466][ T6213]  ? do_raw_spin_unlock+0xf5/0x210
[  227.195489][ T6213]  rpcb_create_local+0x268/0x670
[  227.195508][ T6213]  ? __pfx_rpcb_create_local+0x10/0x10
[  227.195523][ T6213]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  227.195542][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.195568][ T6213]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  227.195586][ T6213]  ? __percpu_counter_init_many+0x35f/0x380
[  227.195614][ T6213]  ? __svc_create+0x88f/0x990
[  227.195640][ T6213]  svc_bind+0x1b4/0x230
[  227.195662][ T6213]  nfsd_create_serv+0x581/0x840
[  227.195684][ T6213]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  227.195702][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.195723][ T6213]  ? __pfx_nfsd_create_serv+0x10/0x10
[  227.195746][ T6213]  ? net_generic+0x1e/0x240
[  227.195766][ T6213]  ? net_generic+0x1e/0x240
[  227.195791][ T6213]  ? net_generic+0x1e/0x240
[  227.195818][ T6213]  nfsd_svc+0x189/0x780
[  227.195845][ T6213]  write_threads+0x3cd/0x5a0
[  227.195861][ T6213]  ? __might_fault+0xaf/0x130
[  227.195883][ T6213]  ? __pfx_write_threads+0x10/0x10
[  227.195914][ T6213]  ? _copy_from_user+0x94/0xb0
[  227.195933][ T6213]  ? simple_transaction_get+0x12d/0x160
[  227.195953][ T6213]  nfsctl_transaction_write+0x10f/0x160
[  227.195971][ T6213]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  227.195988][ T6213]  vfs_write+0x296/0xba0
[  227.196015][ T6213]  ? __pfx_vfs_write+0x10/0x10
[  227.196042][ T6213]  ? _raw_spin_unlock_irq+0x23/0x50
[  227.196059][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.196112][ T6213]  ksys_write+0x150/0x270
[  227.196135][ T6213]  ? __pfx_ksys_write+0x10/0x10
[  227.196159][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.196176][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.196193][ T6213]  do_syscall_64+0x174/0x580
[  227.196212][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.196228][ T6213]  ? clear_bhb_loop+0x70/0xc0
[  227.196247][ T6213]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.196263][ T6213] RIP: 0033:0x7f3343939df7
[  227.196280][ T6213] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  227.196294][ T6213] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  227.196313][ T6213] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  227.196325][ T6213] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  227.196335][ T6213] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  227.196345][ T6213] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  227.196355][ T6213] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbc8
[  227.196380][ T6213]  </TASK>
[  227.197129][ T6213] kobject: kobject_add_internal failed for xprt-24-local (error: -12 parent: switch-23)
[pid  6218] write(5, "0", 1)            = 1
[  227.401508][ T6213] FAULT_INJECTION: forcing a failure.
[  227.401508][ T6213] name failslab, interval 1, probability 5, space 0, times -1
[  227.407043][ T6213] CPU: 0 UID: 0 PID: 6213 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  227.407093][ T6213] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  227.407184][ T6213] Call Trace:
[  227.407193][ T6213]  <TASK>
[  227.407212][ T6213]  dump_stack_lvl+0xe8/0x150
[  227.407241][ T6213]  should_fail_ex+0x40c/0x560
[  227.407270][ T6213]  should_failslab+0xa8/0x100
[  227.407289][ T6213]  __kmalloc_node_track_caller_noprof+0x100/0x730
[  227.407315][ T6213]  ? __lock_acquire+0x683/0x2cf0
[  227.407346][ T6213]  ? __kernfs_new_node+0xa9/0x980
[  227.407365][ T6213]  ? __kernfs_new_node+0xa9/0x980
[  227.407390][ T6213]  kstrdup+0x42/0x100
[  227.407413][ T6213]  __kernfs_new_node+0xa9/0x980
[  227.407441][ T6213]  ? __pfx___kernfs_new_node+0x10/0x10
[  227.407462][ T6213]  ? kernfs_root+0x1c/0x230
[  227.407531][ T6213]  ? kernfs_root+0x1c/0x230
[  227.407549][ T6213]  ? kernfs_root+0x1c/0x230
[  227.407566][ T6213]  ? kernfs_root+0x1c/0x230
[  227.407641][ T6213]  kernfs_create_dir_ns+0xfe/0x230
[  227.407666][ T6213]  sysfs_create_dir_ns+0x12f/0x2a0
[  227.407687][ T6213]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  227.407709][ T6213]  ? do_raw_spin_unlock+0xf5/0x210
[  227.407732][ T6213]  kobject_add_internal+0x622/0xcd0
[  227.407761][ T6213]  kobject_init_and_add+0x12b/0x1a0
[  227.407789][ T6213]  ? __pfx_kobject_init_and_add+0x10/0x10
[  227.407812][ T6213]  ? __kmalloc_cache_noprof+0x150/0x660
[  227.407832][ T6213]  ? rpc_sysfs_client_setup+0x106/0x310
[  227.407852][ T6213]  ? rpc_sysfs_client_setup+0x106/0x310
[  227.407878][ T6213]  rpc_sysfs_client_setup+0x191/0x310
[  227.407903][ T6213]  ? __pfx_rpc_sysfs_client_setup+0x10/0x10
[  227.407925][ T6213]  ? rpc_net_ns+0x1e/0x230
[  227.407942][ T6213]  ? rpc_net_ns+0x1e/0x230
[  227.407956][ T6213]  ? rpc_net_ns+0x1e/0x230
[  227.407976][ T6213]  rpc_new_client+0x716/0xc50
[  227.408002][ T6213]  rpc_create_xprt+0x29f/0xa90
[  227.408019][ T6213]  ? __pfx_rpc_create_xprt+0x10/0x10
[  227.408077][ T6213]  ? rcu_is_watching+0x15/0xb0
[  227.408098][ T6213]  ? trace_kmalloc+0x2a/0xf0
[  227.408122][ T6213]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  227.408145][ T6213]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  227.408166][ T6213]  ? xprt_create_transport+0x39b/0x5f0
[  227.408183][ T6213]  ? xprt_create_transport+0x39b/0x5f0
[  227.408199][ T6213]  ? kstrdup+0x81/0x100
[  227.408222][ T6213]  ? __asan_memcpy+0x40/0x70
[  227.408304][ T6213]  ? xprt_create_transport+0x438/0x5f0
[  227.408324][ T6213]  rpc_create+0x649/0x900
[  227.408349][ T6213]  ? __pfx_rpc_create+0x10/0x10
[  227.408397][ T6213]  ? __lock_acquire+0x683/0x2cf0
[  227.408421][ T6213]  rpcb_create_af_local+0x1c7/0x3c0
[  227.408438][ T6213]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  227.408471][ T6213]  ? do_raw_spin_unlock+0xf5/0x210
[  227.408493][ T6213]  rpcb_create_local+0x268/0x670
[  227.408512][ T6213]  ? __pfx_rpcb_create_local+0x10/0x10
[  227.408526][ T6213]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  227.408543][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.408562][ T6213]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  227.408579][ T6213]  ? __percpu_counter_init_many+0x35f/0x380
[  227.408606][ T6213]  ? __svc_create+0x88f/0x990
[  227.408630][ T6213]  svc_bind+0x1b4/0x230
[  227.408649][ T6213]  nfsd_create_serv+0x581/0x840
[  227.408670][ T6213]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  227.408688][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.408709][ T6213]  ? __pfx_nfsd_create_serv+0x10/0x10
[  227.408731][ T6213]  ? net_generic+0x1e/0x240
[  227.408751][ T6213]  ? net_generic+0x1e/0x240
[  227.408777][ T6213]  ? net_generic+0x1e/0x240
[  227.408803][ T6213]  nfsd_svc+0x189/0x780
[  227.408829][ T6213]  write_threads+0x3cd/0x5a0
[  227.408842][ T6213]  ? __might_fault+0xaf/0x130
[  227.408863][ T6213]  ? __pfx_write_threads+0x10/0x10
[  227.408893][ T6213]  ? _copy_from_user+0x94/0xb0
[  227.408912][ T6213]  ? simple_transaction_get+0x12d/0x160
[  227.408931][ T6213]  nfsctl_transaction_write+0x10f/0x160
[  227.408949][ T6213]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  227.408966][ T6213]  vfs_write+0x296/0xba0
[  227.408992][ T6213]  ? __pfx_vfs_write+0x10/0x10
[  227.409018][ T6213]  ? _raw_spin_unlock_irq+0x23/0x50
[  227.409041][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.409091][ T6213]  ksys_write+0x150/0x270
[  227.409112][ T6213]  ? __pfx_ksys_write+0x10/0x10
[  227.409136][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.409153][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.409170][ T6213]  do_syscall_64+0x174/0x580
[  227.409188][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.409203][ T6213]  ? clear_bhb_loop+0x70/0xc0
[  227.409222][ T6213]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.409238][ T6213] RIP: 0033:0x7f3343939df7
[  227.409255][ T6213] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  227.409268][ T6213] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  227.409286][ T6213] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  227.409297][ T6213] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  227.409306][ T6213] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  227.409315][ T6213] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  227.409325][ T6213] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbc8
[  227.409348][ T6213]  </TASK>
[  227.620278][ T6213] kobject: kobject_add_internal failed for clnt-23 (error: -12 parent: rpc-clients)
[  227.625345][ T6213] FAULT_INJECTION: forcing a failure.
[  227.625345][ T6213] name failslab, interval 1, probability 5, space 0, times -1
[  227.631950][ T6213] CPU: 0 UID: 0 PID: 6213 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  227.631970][ T6213] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  227.631980][ T6213] Call Trace:
[  227.631986][ T6213]  <TASK>
[  227.631993][ T6213]  dump_stack_lvl+0xe8/0x150
[  227.632021][ T6213]  should_fail_ex+0x40c/0x560
[  227.632137][ T6213]  should_failslab+0xa8/0x100
[  227.632156][ T6213]  __kmalloc_noprof+0xfe/0x720
[  227.632176][ T6213]  ? trace_kmem_cache_alloc+0x29/0xe0
[  227.632196][ T6213]  ? security_sk_alloc+0x52/0x360
[  227.632211][ T6213]  ? security_sk_alloc+0x52/0x360
[  227.632231][ T6213]  security_sk_alloc+0x52/0x360
[  227.632267][ T6213]  sk_prot_alloc+0x101/0x210
[  227.632294][ T6213]  sk_alloc+0x3a/0x390
[  227.632317][ T6213]  unix_create1+0xb0/0x7c0
[  227.632336][ T6213]  ? _raw_spin_unlock_irq+0x2e/0x50
[  227.632352][ T6213]  ? pidfs_register_pid_gfp+0x16a/0x1c0
[  227.632372][ T6213]  unix_stream_connect+0x387/0xfd0
[  227.632400][ T6213]  kernel_connect+0x141/0x1c0
[  227.632418][ T6213]  ? __pfx_kernel_connect+0x10/0x10
[  227.632446][ T6213]  ? __local_bh_enable_ip+0xd0/0x130
[  227.632469][ T6213]  xs_local_connect+0x626/0x810
[  227.632490][ T6213]  ? __pfx_xs_local_connect+0x10/0x10
[  227.632511][ T6213]  ? do_raw_spin_unlock+0xf5/0x210
[pid  6218] close(5)                    = 0
[  227.632533][ T6213]  xprt_connect+0x613/0x850
[  227.632556][ T6213]  ? __pfx_call_connect+0x10/0x10
[  227.632575][ T6213]  __rpc_execute+0x526/0x1280
[  227.632605][ T6213]  ? __pfx___rpc_execute+0x10/0x10
[  227.632643][ T6213]  ? rpc_task_get_xprt+0x26/0x250
[  227.632659][ T6213]  ? rpc_make_runnable+0xae/0x1c0
[  227.632678][ T6213]  rpc_execute+0x1c1/0x390
[  227.632697][ T6213]  rpc_run_task+0x4a6/0x660
[  227.632715][ T6213]  rpc_create_xprt+0x533/0xa90
[  227.632730][ T6213]  ? __pfx_rpc_create_xprt+0x10/0x10
[  227.632757][ T6213]  ? rcu_is_watching+0x15/0xb0
[  227.632774][ T6213]  ? trace_kmalloc+0x2a/0xf0
[  227.632797][ T6213]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  227.632817][ T6213]  ? xprt_create_transport+0x39b/0x5f0
[  227.632841][ T6213]  ? xprt_create_transport+0x438/0x5f0
[  227.632859][ T6213]  rpc_create+0x649/0x900
[  227.632882][ T6213]  ? __pfx_rpc_create+0x10/0x10
[  227.632929][ T6213]  ? __lock_acquire+0x683/0x2cf0
[  227.632952][ T6213]  rpcb_create_af_local+0x1c7/0x3c0
[  227.632968][ T6213]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  227.633000][ T6213]  ? do_raw_spin_unlock+0xf5/0x210
[  227.633067][ T6213]  rpcb_create_local+0x268/0x670
[  227.633084][ T6213]  ? __pfx_rpcb_create_local+0x10/0x10
[  227.633098][ T6213]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  227.633114][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.633139][ T6213]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  227.633156][ T6213]  ? __percpu_counter_init_many+0x35f/0x380
[  227.633181][ T6213]  ? __svc_create+0x88f/0x990
[  227.633204][ T6213]  svc_bind+0x1b4/0x230
[  227.633224][ T6213]  nfsd_create_serv+0x581/0x840
[  227.633245][ T6213]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  227.633261][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.633282][ T6213]  ? __pfx_nfsd_create_serv+0x10/0x10
[  227.633301][ T6213]  ? net_generic+0x1e/0x240
[  227.633320][ T6213]  ? net_generic+0x1e/0x240
[  227.633343][ T6213]  ? net_generic+0x1e/0x240
[  227.633368][ T6213]  nfsd_svc+0x189/0x780
[  227.633392][ T6213]  write_threads+0x3cd/0x5a0
[  227.633406][ T6213]  ? __might_fault+0xaf/0x130
[  227.633426][ T6213]  ? __pfx_write_threads+0x10/0x10
[  227.633455][ T6213]  ? _copy_from_user+0x94/0xb0
[  227.633472][ T6213]  ? simple_transaction_get+0x12d/0x160
[  227.633490][ T6213]  nfsctl_transaction_write+0x10f/0x160
[  227.633506][ T6213]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  227.633522][ T6213]  vfs_write+0x296/0xba0
[  227.633546][ T6213]  ? __pfx_vfs_write+0x10/0x10
[  227.633570][ T6213]  ? _raw_spin_unlock_irq+0x23/0x50
[  227.633586][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.633608][ T6213]  ksys_write+0x150/0x270
[  227.633627][ T6213]  ? __pfx_ksys_write+0x10/0x10
[  227.633649][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.633664][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.633680][ T6213]  do_syscall_64+0x174/0x580
[  227.633697][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.633712][ T6213]  ? clear_bhb_loop+0x70/0xc0
[  227.633729][ T6213]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.633743][ T6213] RIP: 0033:0x7f3343939df7
[  227.633783][ T6213] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  227.633795][ T6213] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  227.633811][ T6213] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  227.633822][ T6213] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  227.633831][ T6213] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  227.633840][ T6213] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  227.633849][ T6213] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbc8
[  227.633873][ T6213]  </TASK>
[  227.634355][ T6213] xs_local_setup_socket: unhandled error (12) connecting to @/run/rpcbind.sock
[  227.862566][ T6213] FAULT_INJECTION: forcing a failure.
[  227.862566][ T6213] name failslab, interval 1, probability 5, space 0, times -1
[  227.867985][ T6213] CPU: 0 UID: 0 PID: 6213 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  227.868286][ T6213] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  227.868297][ T6213] Call Trace:
[  227.868305][ T6213]  <TASK>
[  227.868312][ T6213]  dump_stack_lvl+0xe8/0x150
[  227.868337][ T6213]  should_fail_ex+0x40c/0x560
[  227.868361][ T6213]  should_failslab+0xa8/0x100
[  227.868378][ T6213]  __kmalloc_noprof+0xfe/0x720
[  227.868400][ T6213]  ? kobject_get_path+0xc5/0x2f0
[  227.868420][ T6213]  ? kobject_get_path+0xc5/0x2f0
[  227.868443][ T6213]  kobject_get_path+0xc5/0x2f0
[  227.868466][ T6213]  kobject_uevent_env+0x29e/0x9e0
[  227.868487][ T6213]  xprt_switch_alloc+0x420/0x590
[  227.868508][ T6213]  rpc_create_xprt+0x1c7/0xa90
[  227.868525][ T6213]  ? __pfx_rpc_create_xprt+0x10/0x10
[  227.868551][ T6213]  ? rcu_is_watching+0x15/0xb0
[  227.868569][ T6213]  ? trace_kmalloc+0x2a/0xf0
[  227.868588][ T6213]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  227.868607][ T6213]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  227.868625][ T6213]  ? xprt_create_transport+0x39b/0x5f0
[  227.868639][ T6213]  ? xprt_create_transport+0x39b/0x5f0
[  227.868655][ T6213]  ? kstrdup+0x81/0x100
[  227.868742][ T6213]  ? __asan_memcpy+0x40/0x70
[  227.868765][ T6213]  ? xprt_create_transport+0x438/0x5f0
[  227.868783][ T6213]  rpc_create+0x649/0x900
[  227.868804][ T6213]  ? __pfx_rpc_create+0x10/0x10
[  227.868846][ T6213]  ? __lock_acquire+0x683/0x2cf0
[  227.868869][ T6213]  rpcb_create_af_local+0x1c7/0x3c0
[  227.868884][ T6213]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  227.868913][ T6213]  ? do_raw_spin_unlock+0xf5/0x210
[  227.868990][ T6213]  rpcb_create_local+0x28f/0x670
[  227.869034][ T6213]  ? __pfx_rpcb_create_local+0x10/0x10
[  227.869047][ T6213]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  227.869063][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.869080][ T6213]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  227.869095][ T6213]  ? __percpu_counter_init_many+0x35f/0x380
[  227.869126][ T6213]  ? __svc_create+0x88f/0x990
[  227.869147][ T6213]  svc_bind+0x1b4/0x230
[  227.869165][ T6213]  nfsd_create_serv+0x581/0x840
[  227.869185][ T6213]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  227.869201][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.869220][ T6213]  ? __pfx_nfsd_create_serv+0x10/0x10
[  227.869239][ T6213]  ? net_generic+0x1e/0x240
[  227.869256][ T6213]  ? net_generic+0x1e/0x240
[  227.869276][ T6213]  ? net_generic+0x1e/0x240
[  227.869299][ T6213]  nfsd_svc+0x189/0x780
[  227.869322][ T6213]  write_threads+0x3cd/0x5a0
[  227.869335][ T6213]  ? __might_fault+0xaf/0x130
[  227.869355][ T6213]  ? __pfx_write_threads+0x10/0x10
[  227.869382][ T6213]  ? _copy_from_user+0x94/0xb0
[  227.869399][ T6213]  ? simple_transaction_get+0x12d/0x160
[  227.869417][ T6213]  nfsctl_transaction_write+0x10f/0x160
[  227.869434][ T6213]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  227.869449][ T6213]  vfs_write+0x296/0xba0
[  227.869473][ T6213]  ? __pfx_vfs_write+0x10/0x10
[  227.869496][ T6213]  ? _raw_spin_unlock_irq+0x23/0x50
[  227.869511][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.869532][ T6213]  ksys_write+0x150/0x270
[  227.869551][ T6213]  ? __pfx_ksys_write+0x10/0x10
[  227.869571][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.869587][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.869602][ T6213]  do_syscall_64+0x174/0x580
[  227.869618][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.869632][ T6213]  ? clear_bhb_loop+0x70/0xc0
[  227.869648][ T6213]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.869662][ T6213] RIP: 0033:0x7f3343939df7
[  227.869679][ T6213] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  227.869691][ T6213] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  227.869708][ T6213] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  227.869719][ T6213] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  227.869727][ T6213] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  227.869736][ T6213] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  227.869745][ T6213] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbc8
[  227.869767][ T6213]  </TASK>
[  227.873058][ T6213] FAULT_INJECTION: forcing a failure.
[  227.873058][ T6213] name failslab, interval 1, probability 5, space 0, times -1
[pid  6218] write(4, "tcp 2049\n", 9 <unfinished ...>
[pid  6213] <... write resumed>)        = -1 ENOMEM (Cannot allocate memory)
[  228.071271][ T6213] CPU: 0 UID: 0 PID: 6213 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  228.071291][ T6213] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  228.071300][ T6213] Call Trace:
[  228.071308][ T6213]  <TASK>
[  228.071314][ T6213]  dump_stack_lvl+0xe8/0x150
[  228.071339][ T6213]  should_fail_ex+0x40c/0x560
[  228.071364][ T6213]  should_failslab+0xa8/0x100
[  228.071382][ T6213]  __kmalloc_cache_noprof+0xa8/0x660
[  228.071403][ T6213]  ? do_syscall_64+0x174/0x580
[  228.071423][ T6213]  ? xprt_switch_alloc+0x7a/0x590
[  228.071439][ T6213]  ? xprt_switch_alloc+0x7a/0x590
[  228.071460][ T6213]  xprt_switch_alloc+0x7a/0x590
[  228.071481][ T6213]  rpc_create_xprt+0x1c7/0xa90
[  228.071496][ T6213]  ? __pfx_rpc_create_xprt+0x10/0x10
[  228.071523][ T6213]  ? rcu_is_watching+0x15/0xb0
[  228.071539][ T6213]  ? trace_kmalloc+0x2a/0xf0
[  228.071559][ T6213]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  228.071578][ T6213]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  228.071597][ T6213]  ? xprt_create_transport+0x39b/0x5f0
[  228.071612][ T6213]  ? xprt_create_transport+0x39b/0x5f0
[  228.071628][ T6213]  ? kstrdup+0x81/0x100
[  228.071649][ T6213]  ? __asan_memcpy+0x40/0x70
[  228.071672][ T6213]  ? xprt_create_transport+0x438/0x5f0
[  228.071689][ T6213]  rpc_create+0x649/0x900
[  228.071712][ T6213]  ? __pfx_rpc_create+0x10/0x10
[  228.071771][ T6213]  rpcb_create_local+0x3ab/0x670
[  228.071790][ T6213]  ? __pfx_rpcb_create_local+0x10/0x10
[  228.071815][ T6213]  ? __svc_create+0x88f/0x990
[  228.071840][ T6213]  svc_bind+0x1b4/0x230
[  228.071861][ T6213]  nfsd_create_serv+0x581/0x840
[  228.071881][ T6213]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  228.071899][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  228.071921][ T6213]  ? __pfx_nfsd_create_serv+0x10/0x10
[  228.071940][ T6213]  ? net_generic+0x1e/0x240
[  228.071961][ T6213]  ? net_generic+0x1e/0x240
[  228.072023][ T6213]  ? net_generic+0x1e/0x240
[  228.072106][ T6213]  nfsd_svc+0x189/0x780
[  228.072128][ T6213]  write_threads+0x3cd/0x5a0
[  228.072141][ T6213]  ? __might_fault+0xaf/0x130
[  228.072167][ T6213]  ? __pfx_write_threads+0x10/0x10
[  228.072193][ T6213]  ? _copy_from_user+0x94/0xb0
[  228.072213][ T6213]  ? simple_transaction_get+0x12d/0x160
[  228.072231][ T6213]  nfsctl_transaction_write+0x10f/0x160
[  228.072247][ T6213]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  228.072261][ T6213]  vfs_write+0x296/0xba0
[  228.072284][ T6213]  ? __pfx_vfs_write+0x10/0x10
[  228.072307][ T6213]  ? _raw_spin_unlock_irq+0x23/0x50
[  228.072323][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  228.072346][ T6213]  ksys_write+0x150/0x270
[  228.072365][ T6213]  ? __pfx_ksys_write+0x10/0x10
[pid  6213] openat(AT_FDCWD, "/proc/self/make-it-fail", O_WRONLY) = 5
[pid  6213] write(5, "0", 1)            = 1
[pid  6213] close(5)                    = 0
[  228.072388][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.072403][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.072419][ T6213]  do_syscall_64+0x174/0x580
[  228.072437][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.072453][ T6213]  ? clear_bhb_loop+0x70/0xc0
[  228.072470][ T6213]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.072485][ T6213] RIP: 0033:0x7f3343939df7
[  228.072500][ T6213] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  228.072513][ T6213] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  228.072530][ T6213] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  228.072541][ T6213] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  228.072580][ T6213] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  228.072588][ T6213] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  228.072598][ T6213] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbc8
[  228.072620][ T6213]  </TASK>
[  228.073497][ T6019] FAULT_INJECTION: forcing a failure.
[  228.073497][ T6019] name failslab, interval 1, probability 5, space 0, times -1
[  228.242885][ T6019] CPU: 0 UID: 0 PID: 6019 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  228.242908][ T6019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  228.242917][ T6019] Call Trace:
[  228.242924][ T6019]  <TASK>
[  228.242931][ T6019]  dump_stack_lvl+0xe8/0x150
[  228.242957][ T6019]  should_fail_ex+0x40c/0x560
[  228.243014][ T6019]  should_failslab+0xa8/0x100
[  228.243031][ T6019]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  228.243052][ T6019]  ? __kernfs_new_node+0xe6/0x980
[  228.243069][ T6019]  ? __kernfs_new_node+0xe6/0x980
[  228.243099][ T6019]  __kernfs_new_node+0xe6/0x980
[  228.243123][ T6019]  ? __pfx___kernfs_new_node+0x10/0x10
[  228.243142][ T6019]  ? kernfs_root+0x1c/0x230
[  228.243163][ T6019]  ? kernfs_root+0x1c/0x230
[  228.243179][ T6019]  ? kernfs_root+0x1c/0x230
[  228.243194][ T6019]  ? kernfs_root+0x1c/0x230
[  228.243214][ T6019]  kernfs_new_node+0xea/0x140
[  228.243236][ T6019]  __kernfs_create_file+0x4b/0x2e0
[  228.243253][ T6019]  sysfs_add_file_mode_ns+0x237/0x300
[  228.243274][ T6019]  internal_create_group+0x679/0x1180
[  228.243300][ T6019]  ? kernfs_create_dir_ns+0x1d5/0x230
[  228.243323][ T6019]  ? __pfx_internal_create_group+0x10/0x10
[  228.243339][ T6019]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  228.243357][ T6019]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  228.243378][ T6019]  sysfs_create_groups+0x59/0x120
[  228.243399][ T6019]  kobject_add_internal+0x669/0xcd0
[  228.243425][ T6019]  kobject_init_and_add+0x12b/0x1a0
[  228.243449][ T6019]  ? __pfx_kobject_init_and_add+0x10/0x10
[  228.243468][ T6019]  ? __kmalloc_cache_noprof+0x150/0x660
[  228.243488][ T6019]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  228.243506][ T6019]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  228.243529][ T6019]  rpc_sysfs_xprt_switch_setup+0x169/0x2b0
[  228.243554][ T6019]  xprt_switch_alloc+0x238/0x590
[  228.243575][ T6019]  rpc_create_xprt+0x1c7/0xa90
[  228.243591][ T6019]  ? __pfx_rpc_create_xprt+0x10/0x10
[  228.243616][ T6019]  ? rcu_is_watching+0x15/0xb0
[  228.243633][ T6019]  ? trace_kmalloc+0x2a/0xf0
[  228.243652][ T6019]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  228.243673][ T6019]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  228.243690][ T6019]  ? xprt_create_transport+0x39b/0x5f0
[  228.243706][ T6019]  ? xprt_create_transport+0x39b/0x5f0
[  228.243722][ T6019]  ? kstrdup+0x81/0x100
[  228.243743][ T6019]  ? __asan_memcpy+0x40/0x70
[  228.243766][ T6019]  ? xprt_create_transport+0x438/0x5f0
[  228.243783][ T6019]  rpc_create+0x649/0x900
[  228.243805][ T6019]  ? __pfx_rpc_create+0x10/0x10
[  228.243848][ T6019]  ? __lock_acquire+0x683/0x2cf0
[  228.243871][ T6019]  rpcb_create_af_local+0x1c7/0x3c0
[  228.243886][ T6019]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  228.243916][ T6019]  ? do_raw_spin_unlock+0xf5/0x210
[  228.243937][ T6019]  rpcb_create_local+0x268/0x670
[  228.243955][ T6019]  ? __pfx_rpcb_create_local+0x10/0x10
[  228.244008][ T6019]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  228.244025][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  228.244042][ T6019]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  228.244056][ T6019]  ? __percpu_counter_init_many+0x35f/0x380
[  228.244088][ T6019]  ? __svc_create+0x88f/0x990
[  228.244110][ T6019]  svc_bind+0x1b4/0x230
[  228.244128][ T6019]  nfsd_create_serv+0x581/0x840
[  228.244148][ T6019]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  228.244163][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  228.244182][ T6019]  ? __pfx_nfsd_create_serv+0x10/0x10
[  228.244203][ T6019]  ? net_generic+0x1e/0x240
[  228.244220][ T6019]  ? net_generic+0x1e/0x240
[  228.244241][ T6019]  ? net_generic+0x1e/0x240
[  228.244264][ T6019]  nfsd_svc+0x189/0x780
[  228.244313][ T6019]  write_threads+0x3cd/0x5a0
[  228.244329][ T6019]  ? __might_fault+0xaf/0x130
[  228.244348][ T6019]  ? __pfx_write_threads+0x10/0x10
[  228.244374][ T6019]  ? _copy_from_user+0x94/0xb0
[  228.244392][ T6019]  ? simple_transaction_get+0x12d/0x160
[  228.244412][ T6019]  nfsctl_transaction_write+0x10f/0x160
[  228.244428][ T6019]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  228.244444][ T6019]  vfs_write+0x296/0xba0
[  228.244470][ T6019]  ? __pfx_vfs_write+0x10/0x10
[  228.244493][ T6019]  ? _raw_spin_unlock_irq+0x23/0x50
[  228.244508][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  228.244530][ T6019]  ksys_write+0x150/0x270
[  228.244547][ T6019]  ? __pfx_ksys_write+0x10/0x10
[  228.244567][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.244582][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.244596][ T6019]  do_syscall_64+0x174/0x580
[  228.244613][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.244627][ T6019]  ? clear_bhb_loop+0x70/0xc0
[  228.244644][ T6019]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.244659][ T6019] RIP: 0033:0x7f3343939df7
[  228.244675][ T6019] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  228.244688][ T6019] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  228.244705][ T6019] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  228.244716][ T6019] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  228.244725][ T6019] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  228.244734][ T6019] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  228.244743][ T6019] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d924
[  228.244765][ T6019]  </TASK>
[  228.244928][ T6019] kobject: kobject_add_internal failed for switch-23 (error: -12 parent: xprt-switches)
[  228.507446][ T6019] FAULT_INJECTION: forcing a failure.
[  228.507446][ T6019] name failslab, interval 1, probability 5, space 0, times -1
[  228.514872][ T6019] CPU: 0 UID: 0 PID: 6019 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  228.514894][ T6019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  228.514903][ T6019] Call Trace:
[  228.514911][ T6019]  <TASK>
[  228.514918][ T6019]  dump_stack_lvl+0xe8/0x150
[  228.514976][ T6019]  should_fail_ex+0x40c/0x560
[  228.515002][ T6019]  should_failslab+0xa8/0x100
[  228.515036][ T6019]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  228.515062][ T6019]  ? __kernfs_new_node+0xe6/0x980
[  228.515079][ T6019]  ? __kernfs_new_node+0xe6/0x980
[  228.515102][ T6019]  __kernfs_new_node+0xe6/0x980
[  228.515127][ T6019]  ? __pfx___kernfs_new_node+0x10/0x10
[  228.515145][ T6019]  ? kernfs_root+0x1c/0x230
[  228.515167][ T6019]  ? kernfs_root+0x1c/0x230
[  228.515182][ T6019]  ? kernfs_root+0x1c/0x230
[  228.515197][ T6019]  ? kernfs_root+0x1c/0x230
[  228.515216][ T6019]  kernfs_new_node+0xea/0x140
[  228.515237][ T6019]  __kernfs_create_file+0x4b/0x2e0
[  228.515252][ T6019]  sysfs_add_file_mode_ns+0x237/0x300
[  228.515273][ T6019]  internal_create_group+0x679/0x1180
[  228.515299][ T6019]  ? kernfs_create_dir_ns+0x1d5/0x230
[  228.515320][ T6019]  ? __pfx_internal_create_group+0x10/0x10
[  228.515336][ T6019]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  228.515356][ T6019]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  228.515375][ T6019]  sysfs_create_groups+0x59/0x120
[  228.515395][ T6019]  kobject_add_internal+0x669/0xcd0
[  228.515422][ T6019]  kobject_init_and_add+0x12b/0x1a0
[  228.515449][ T6019]  ? __pfx_kobject_init_and_add+0x10/0x10
[  228.515469][ T6019]  ? __kmalloc_cache_noprof+0x150/0x660
[  228.515487][ T6019]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  228.515508][ T6019]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  228.515533][ T6019]  rpc_sysfs_xprt_switch_setup+0x169/0x2b0
[  228.515556][ T6019]  xprt_switch_alloc+0x238/0x590
[  228.515577][ T6019]  rpc_create_xprt+0x1c7/0xa90
[  228.515594][ T6019]  ? __pfx_rpc_create_xprt+0x10/0x10
[  228.515619][ T6019]  ? rcu_is_watching+0x15/0xb0
[  228.515635][ T6019]  ? trace_kmalloc+0x2a/0xf0
[  228.515655][ T6019]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  228.515674][ T6019]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  228.515692][ T6019]  ? xprt_create_transport+0x39b/0x5f0
[  228.515707][ T6019]  ? xprt_create_transport+0x39b/0x5f0
[  228.515721][ T6019]  ? kstrdup+0x81/0x100
[  228.515742][ T6019]  ? __asan_memcpy+0x40/0x70
[  228.515764][ T6019]  ? xprt_create_transport+0x438/0x5f0
[  228.515782][ T6019]  rpc_create+0x649/0x900
[  228.515804][ T6019]  ? __pfx_rpc_create+0x10/0x10
[  228.515850][ T6019]  ? __lock_acquire+0x683/0x2cf0
[  228.515873][ T6019]  rpcb_create_af_local+0x1c7/0x3c0
[  228.515888][ T6019]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  228.515918][ T6019]  ? do_raw_spin_unlock+0xf5/0x210
[  228.515977][ T6019]  rpcb_create_local+0x28f/0x670
[  228.515994][ T6019]  ? __pfx_rpcb_create_local+0x10/0x10
[  228.516075][ T6019]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  228.516091][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  228.516109][ T6019]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  228.516123][ T6019]  ? __percpu_counter_init_many+0x35f/0x380
[  228.516147][ T6019]  ? __svc_create+0x88f/0x990
[  228.516170][ T6019]  svc_bind+0x1b4/0x230
[  228.516188][ T6019]  nfsd_create_serv+0x581/0x840
[  228.516210][ T6019]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  228.516226][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  228.516247][ T6019]  ? __pfx_nfsd_create_serv+0x10/0x10
[  228.516265][ T6019]  ? net_generic+0x1e/0x240
[  228.516283][ T6019]  ? net_generic+0x1e/0x240
[  228.516303][ T6019]  ? net_generic+0x1e/0x240
[  228.516325][ T6019]  nfsd_svc+0x189/0x780
[  228.516346][ T6019]  write_threads+0x3cd/0x5a0
[  228.516360][ T6019]  ? __might_fault+0xaf/0x130
[  228.516379][ T6019]  ? __pfx_write_threads+0x10/0x10
[  228.516405][ T6019]  ? _copy_from_user+0x94/0xb0
[  228.516423][ T6019]  ? simple_transaction_get+0x12d/0x160
[  228.516440][ T6019]  nfsctl_transaction_write+0x10f/0x160
[  228.516457][ T6019]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  228.516471][ T6019]  vfs_write+0x296/0xba0
[  228.516493][ T6019]  ? __pfx_vfs_write+0x10/0x10
[  228.516515][ T6019]  ? _raw_spin_unlock_irq+0x23/0x50
[  228.516530][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  228.516551][ T6019]  ksys_write+0x150/0x270
[  228.516570][ T6019]  ? __pfx_ksys_write+0x10/0x10
[  228.516590][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.516605][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.516619][ T6019]  do_syscall_64+0x174/0x580
[  228.516636][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.516650][ T6019]  ? clear_bhb_loop+0x70/0xc0
[  228.516667][ T6019]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.516681][ T6019] RIP: 0033:0x7f3343939df7
[  228.516696][ T6019] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  228.516710][ T6019] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  228.516726][ T6019] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  228.516737][ T6019] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  228.516747][ T6019] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  228.516755][ T6019] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  228.516764][ T6019] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d924
[  228.516786][ T6019]  </TASK>
[  228.517282][ T6019] kobject: kobject_add_internal failed for switch-23 (error: -12 parent: xprt-switches)
[  228.780084][ T6019] FAULT_INJECTION: forcing a failure.
[  228.780084][ T6019] name failslab, interval 1, probability 5, space 0, times -1
[  228.785178][ T6019] CPU: 0 UID: 0 PID: 6019 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  228.785199][ T6019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  228.785209][ T6019] Call Trace:
[  228.785217][ T6019]  <TASK>
[  228.785224][ T6019]  dump_stack_lvl+0xe8/0x150
[  228.785250][ T6019]  should_fail_ex+0x40c/0x560
[  228.785275][ T6019]  should_failslab+0xa8/0x100
[  228.785295][ T6019]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  228.785316][ T6019]  ? __kernfs_new_node+0xe6/0x980
[  228.785333][ T6019]  ? __kernfs_new_node+0xe6/0x980
[  228.785354][ T6019]  __kernfs_new_node+0xe6/0x980
[  228.785377][ T6019]  ? __pfx___kernfs_new_node+0x10/0x10
[  228.785395][ T6019]  ? kernfs_root+0x1c/0x230
[  228.785416][ T6019]  ? kernfs_root+0x1c/0x230
[  228.785432][ T6019]  ? kernfs_root+0x1c/0x230
[  228.785447][ T6019]  ? kernfs_root+0x1c/0x230
[  228.785467][ T6019]  kernfs_new_node+0xea/0x140
[  228.785489][ T6019]  __kernfs_create_file+0x4b/0x2e0
[  228.785506][ T6019]  sysfs_add_file_mode_ns+0x237/0x300
[  228.785528][ T6019]  internal_create_group+0x679/0x1180
[  228.785552][ T6019]  ? kernfs_create_dir_ns+0x1d5/0x230
[  228.785575][ T6019]  ? __pfx_internal_create_group+0x10/0x10
[  228.785603][ T6019]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  228.785620][ T6019]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  228.785640][ T6019]  sysfs_create_groups+0x59/0x120
[  228.785772][ T6019]  kobject_add_internal+0x669/0xcd0
[  228.785798][ T6019]  kobject_init_and_add+0x12b/0x1a0
[  228.785822][ T6019]  ? __pfx_kobject_init_and_add+0x10/0x10
[  228.785844][ T6019]  ? __kmalloc_cache_noprof+0x150/0x660
[  228.785864][ T6019]  ? rpc_sysfs_xprt_setup+0xa7/0x260
[  228.785882][ T6019]  ? rpc_sysfs_xprt_setup+0xa7/0x260
[  228.785935][ T6019]  rpc_sysfs_xprt_setup+0x132/0x260
[  228.785958][ T6019]  xprt_switch_alloc+0x420/0x590
[  228.785978][ T6019]  rpc_create_xprt+0x1c7/0xa90
[  228.785994][ T6019]  ? __pfx_rpc_create_xprt+0x10/0x10
[  228.786020][ T6019]  ? rcu_is_watching+0x15/0xb0
[  228.786036][ T6019]  ? trace_kmalloc+0x2a/0xf0
[  228.786056][ T6019]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  228.786075][ T6019]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  228.786093][ T6019]  ? xprt_create_transport+0x39b/0x5f0
[  228.786107][ T6019]  ? xprt_create_transport+0x39b/0x5f0
[  228.786120][ T6019]  ? kstrdup+0x81/0x100
[  228.786141][ T6019]  ? __asan_memcpy+0x40/0x70
[  228.786166][ T6019]  ? xprt_create_transport+0x438/0x5f0
[  228.786247][ T6019]  rpc_create+0x649/0x900
[  228.786269][ T6019]  ? __pfx_rpc_create+0x10/0x10
[  228.786378][ T6019]  rpcb_create_local+0x3ab/0x670
[  228.786472][ T6019]  ? __pfx_rpcb_create_local+0x10/0x10
[  228.786497][ T6019]  ? __svc_create+0x88f/0x990
[  228.786518][ T6019]  svc_bind+0x1b4/0x230
[  228.786536][ T6019]  nfsd_create_serv+0x581/0x840
[  228.786557][ T6019]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  228.786572][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  228.786602][ T6019]  ? __pfx_nfsd_create_serv+0x10/0x10
[  228.786623][ T6019]  ? net_generic+0x1e/0x240
[  228.786641][ T6019]  ? net_generic+0x1e/0x240
[  228.786661][ T6019]  ? net_generic+0x1e/0x240
[  228.786686][ T6019]  nfsd_svc+0x189/0x780
[  228.786709][ T6019]  write_threads+0x3cd/0x5a0
[  228.786722][ T6019]  ? __might_fault+0xaf/0x130
[  228.786741][ T6019]  ? __pfx_write_threads+0x10/0x10
[  228.786855][ T6019]  ? _copy_from_user+0x94/0xb0
[  228.786876][ T6019]  ? simple_transaction_get+0x12d/0x160
[  228.786893][ T6019]  nfsctl_transaction_write+0x10f/0x160
[  228.786938][ T6019]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  228.786954][ T6019]  vfs_write+0x296/0xba0
[  228.786978][ T6019]  ? __pfx_vfs_write+0x10/0x10
[  228.787001][ T6019]  ? _raw_spin_unlock_irq+0x23/0x50
[  228.787017][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  228.787038][ T6019]  ksys_write+0x150/0x270
[  228.787058][ T6019]  ? __pfx_ksys_write+0x10/0x10
[  228.787080][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.787095][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.787109][ T6019]  do_syscall_64+0x174/0x580
[  228.787126][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.787141][ T6019]  ? clear_bhb_loop+0x70/0xc0
[  228.787159][ T6019]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.787173][ T6019] RIP: 0033:0x7f3343939df7
[  228.787188][ T6019] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  228.787202][ T6019] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  228.787219][ T6019] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  228.787230][ T6019] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  228.787239][ T6019] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  228.787248][ T6019] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  228.787257][ T6019] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d924
[  228.787279][ T6019]  </TASK>
[  229.011468][ T6019] kobject: kobject_add_internal failed for xprt-23-tcp (error: -12 parent: switch-23)
[  229.016333][ T6019] FAULT_INJECTION: forcing a failure.
[  229.016333][ T6019] name failslab, interval 1, probability 5, space 0, times -1
[  229.021448][ T6019] CPU: 0 UID: 0 PID: 6019 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  229.021469][ T6019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  229.021478][ T6019] Call Trace:
[  229.021496][ T6019]  <TASK>
[  229.021502][ T6019]  dump_stack_lvl+0xe8/0x150
[  229.021528][ T6019]  should_fail_ex+0x40c/0x560
[  229.021552][ T6019]  should_failslab+0xa8/0x100
[  229.021569][ T6019]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  229.021590][ T6019]  ? __kernfs_new_node+0xe6/0x980
[  229.021609][ T6019]  ? __kernfs_new_node+0xe6/0x980
[  229.021631][ T6019]  __kernfs_new_node+0xe6/0x980
[  229.021656][ T6019]  ? __pfx___kernfs_new_node+0x10/0x10
[  229.021674][ T6019]  ? kernfs_root+0x1c/0x230
[  229.021695][ T6019]  ? kernfs_root+0x1c/0x230
[  229.021711][ T6019]  ? kernfs_root+0x1c/0x230
[  229.021726][ T6019]  ? kernfs_root+0x1c/0x230
[  229.021745][ T6019]  kernfs_new_node+0xea/0x140
[  229.021767][ T6019]  __kernfs_create_file+0x4b/0x2e0
[  229.021784][ T6019]  sysfs_add_file_mode_ns+0x237/0x300
[  229.021802][ T6019]  internal_create_group+0x679/0x1180
[  229.021823][ T6019]  ? kernfs_create_dir_ns+0x1d5/0x230
[  229.021843][ T6019]  ? __pfx_internal_create_group+0x10/0x10
[  229.021858][ T6019]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  229.021875][ T6019]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  229.022037][ T6019]  sysfs_create_groups+0x59/0x120
[  229.022057][ T6019]  kobject_add_internal+0x669/0xcd0
[  229.022083][ T6019]  kobject_init_and_add+0x12b/0x1a0
[  229.022106][ T6019]  ? __pfx_kobject_init_and_add+0x10/0x10
[  229.022125][ T6019]  ? __kmalloc_cache_noprof+0x150/0x660
[  229.022143][ T6019]  ? rpc_sysfs_client_setup+0x106/0x310
[  229.022161][ T6019]  ? rpc_sysfs_client_setup+0x106/0x310
[  229.022184][ T6019]  rpc_sysfs_client_setup+0x191/0x310
[  229.022201][ T6019]  ? rpc_net_ns+0x1e/0x230
[  229.022218][ T6019]  ? __pfx_rpc_sysfs_client_setup+0x10/0x10
[  229.022235][ T6019]  ? rpc_net_ns+0x1e/0x230
[  229.022249][ T6019]  ? rpc_net_ns+0x1e/0x230
[  229.022267][ T6019]  rpc_new_client+0x716/0xc50
[  229.022289][ T6019]  __rpc_clone_client+0x342/0x7a0
[  229.022305][ T6019]  rpc_bind_new_program+0x25c/0x530
[  229.022319][ T6019]  ? __pfx_rpc_create+0x10/0x10
[  229.022341][ T6019]  ? __pfx_rpc_bind_new_program+0x10/0x10
[  229.022391][ T6019]  rpcb_create_local+0x3ed/0x670
[  229.022409][ T6019]  ? __pfx_rpcb_create_local+0x10/0x10
[  229.022432][ T6019]  ? __svc_create+0x88f/0x990
[  229.022452][ T6019]  svc_bind+0x1b4/0x230
[  229.022470][ T6019]  nfsd_create_serv+0x581/0x840
[  229.022503][ T6019]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  229.022520][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  229.022542][ T6019]  ? __pfx_nfsd_create_serv+0x10/0x10
[  229.022561][ T6019]  ? net_generic+0x1e/0x240
[  229.022579][ T6019]  ? net_generic+0x1e/0x240
[  229.022598][ T6019]  ? net_generic+0x1e/0x240
[  229.022618][ T6019]  nfsd_svc+0x189/0x780
[  229.022641][ T6019]  write_threads+0x3cd/0x5a0
[  229.022654][ T6019]  ? __might_fault+0xaf/0x130
[  229.022672][ T6019]  ? __pfx_write_threads+0x10/0x10
[  229.022698][ T6019]  ? _copy_from_user+0x94/0xb0
[  229.022717][ T6019]  ? simple_transaction_get+0x12d/0x160
[  229.022735][ T6019]  nfsctl_transaction_write+0x10f/0x160
[  229.022752][ T6019]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  229.022766][ T6019]  vfs_write+0x296/0xba0
[  229.022790][ T6019]  ? __pfx_vfs_write+0x10/0x10
[  229.022813][ T6019]  ? _raw_spin_unlock_irq+0x23/0x50
[  229.022829][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  229.022850][ T6019]  ksys_write+0x150/0x270
[  229.022868][ T6019]  ? __pfx_ksys_write+0x10/0x10
[  229.022926][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.022942][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.022957][ T6019]  do_syscall_64+0x174/0x580
[  229.022973][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.022987][ T6019]  ? clear_bhb_loop+0x70/0xc0
[  229.023004][ T6019]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.023018][ T6019] RIP: 0033:0x7f3343939df7
[  229.023035][ T6019] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  229.023048][ T6019] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  229.023065][ T6019] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  229.023076][ T6019] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  229.023085][ T6019] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  229.023093][ T6019] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  229.023103][ T6019] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d924
[  229.023125][ T6019]  </TASK>
[  229.023227][ T6019] kobject: kobject_add_internal failed for clnt-24 (error: -12 parent: rpc-clients)
[  229.242936][ T6019] FAULT_INJECTION: forcing a failure.
[  229.242936][ T6019] name failslab, interval 1, probability 5, space 0, times -1
[  229.248585][ T6019] CPU: 0 UID: 0 PID: 6019 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  229.248607][ T6019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  229.248617][ T6019] Call Trace:
[  229.248624][ T6019]  <TASK>
[  229.248631][ T6019]  dump_stack_lvl+0xe8/0x150
[  229.248656][ T6019]  should_fail_ex+0x40c/0x560
[  229.248681][ T6019]  should_failslab+0xa8/0x100
[  229.248700][ T6019]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  229.248720][ T6019]  ? __pfx_rpcauth_refreshcred+0x10/0x10
[  229.248742][ T6019]  ? rpc_malloc+0xeb/0x260
[  229.248760][ T6019]  ? rpc_malloc+0xeb/0x260
[  229.248783][ T6019]  rpc_malloc+0xeb/0x260
[  229.248805][ T6019]  call_allocate+0x26d/0x680
[  229.248823][ T6019]  ? __pfx_call_allocate+0x10/0x10
[  229.248842][ T6019]  __rpc_execute+0x526/0x1280
[  229.248907][ T6019]  ? __pfx___rpc_execute+0x10/0x10
[  229.248927][ T6019]  ? rpc_task_get_xprt+0x26/0x250
[  229.248944][ T6019]  ? rpc_make_runnable+0xae/0x1c0
[  229.248963][ T6019]  rpc_execute+0x1c1/0x390
[  229.248981][ T6019]  rpc_run_task+0x4a6/0x660
[  229.248998][ T6019]  rpc_call_sync+0x10f/0x200
[  229.249012][ T6019]  ? __pfx_rpc_call_sync+0x10/0x10
[  229.249031][ T6019]  ? net_generic+0x1e/0x240
[  229.249045][ T6019]  ? net_generic+0x1e/0x240
[  229.249062][ T6019]  rpcb_register+0x2d0/0x530
[  229.249078][ T6019]  ? __pfx_rpcb_register+0x10/0x10
[  229.249090][ T6019]  ? net_generic+0x1e/0x240
[  229.249107][ T6019]  ? rpcb_create_local+0x4ee/0x670
[  229.249123][ T6019]  ? __pfx_rpcb_create_local+0x10/0x10
[  229.249145][ T6019]  svc_unregister+0x24d/0x780
[  229.249170][ T6019]  svc_bind+0x1e9/0x230
[  229.249190][ T6019]  nfsd_create_serv+0x581/0x840
[  229.249211][ T6019]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  229.249228][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  229.249250][ T6019]  ? __pfx_nfsd_create_serv+0x10/0x10
[  229.249270][ T6019]  ? net_generic+0x1e/0x240
[  229.249288][ T6019]  ? net_generic+0x1e/0x240
[  229.249309][ T6019]  ? net_generic+0x1e/0x240
[  229.249331][ T6019]  nfsd_svc+0x189/0x780
[  229.249354][ T6019]  write_threads+0x3cd/0x5a0
[  229.249368][ T6019]  ? __might_fault+0xaf/0x130
[  229.249387][ T6019]  ? __pfx_write_threads+0x10/0x10
[  229.249412][ T6019]  ? _copy_from_user+0x94/0xb0
[  229.249439][ T6019]  ? simple_transaction_get+0x12d/0x160
[  229.249456][ T6019]  nfsctl_transaction_write+0x10f/0x160
[  229.249471][ T6019]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  229.249486][ T6019]  vfs_write+0x296/0xba0
[  229.249510][ T6019]  ? __pfx_vfs_write+0x10/0x10
[  229.249534][ T6019]  ? _raw_spin_unlock_irq+0x23/0x50
[  229.249550][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  229.249573][ T6019]  ksys_write+0x150/0x270
[  229.249593][ T6019]  ? __pfx_ksys_write+0x10/0x10
[  229.249615][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.249630][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.249646][ T6019]  do_syscall_64+0x174/0x580
[  229.249664][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.249679][ T6019]  ? clear_bhb_loop+0x70/0xc0
[  229.249695][ T6019]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.249709][ T6019] RIP: 0033:0x7f3343939df7
[  229.249725][ T6019] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  229.249737][ T6019] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  229.249754][ T6019] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  229.249766][ T6019] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  229.249775][ T6019] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  229.249783][ T6019] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  229.249793][ T6019] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d924
[  229.249815][ T6019]  </TASK>
[  229.486110][ T6019] FAULT_INJECTION: forcing a failure.
[  229.486110][ T6019] name failslab, interval 1, probability 5, space 0, times -1
[  229.491438][ T6019] CPU: 0 UID: 0 PID: 6019 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  229.491460][ T6019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  229.491470][ T6019] Call Trace:
[  229.491477][ T6019]  <TASK>
[  229.491484][ T6019]  dump_stack_lvl+0xe8/0x150
[  229.491510][ T6019]  should_fail_ex+0x40c/0x560
[  229.491535][ T6019]  should_failslab+0xa8/0x100
[  229.491553][ T6019]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  229.491573][ T6019]  ? __kernfs_new_node+0xe6/0x980
[  229.491591][ T6019]  ? __kernfs_new_node+0xe6/0x980
[  229.491615][ T6019]  __kernfs_new_node+0xe6/0x980
[  229.491640][ T6019]  ? __pfx___kernfs_new_node+0x10/0x10
[  229.491659][ T6019]  ? kernfs_root+0x1c/0x230
[  229.491681][ T6019]  ? kernfs_root+0x1c/0x230
[  229.491698][ T6019]  ? kernfs_root+0x1c/0x230
[  229.491713][ T6019]  ? kernfs_root+0x1c/0x230
[  229.491734][ T6019]  kernfs_new_node+0xea/0x140
[  229.491756][ T6019]  __kernfs_create_file+0x4b/0x2e0
[  229.491773][ T6019]  sysfs_add_file_mode_ns+0x237/0x300
[  229.491794][ T6019]  internal_create_group+0x679/0x1180
[  229.491819][ T6019]  ? kernfs_create_dir_ns+0x1d5/0x230
[  229.491871][ T6019]  ? __pfx_internal_create_group+0x10/0x10
[  229.491888][ T6019]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  229.491907][ T6019]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  229.491935][ T6019]  sysfs_create_groups+0x59/0x120
[  229.491955][ T6019]  kobject_add_internal+0x669/0xcd0
[  229.491982][ T6019]  kobject_init_and_add+0x12b/0x1a0
[  229.492007][ T6019]  ? __pfx_kobject_init_and_add+0x10/0x10
[  229.492029][ T6019]  ? kernfs_remove_by_name_ns+0x101/0x140
[  229.492053][ T6019]  ? kernfs_remove_by_name_ns+0x101/0x140
[  229.492074][ T6019]  sysfs_slab_add+0x7b/0x260
[  229.492092][ T6019]  do_kmem_cache_create+0x8bf/0x970
[  229.492110][ T6019]  __kmem_cache_create_args+0x307/0x440
[  229.492132][ T6019]  nfsd_file_cache_init+0x197/0x530
[  229.492150][ T6019]  ? __pfx_nfsd_file_cache_init+0x10/0x10
[  229.492166][ T6019]  ? net_generic+0x1e/0x240
[  229.492190][ T6019]  ? net_generic+0x1e/0x240
[  229.492208][ T6019]  ? net_generic+0x1e/0x240
[  229.492224][ T6019]  ? net_generic+0x1e/0x240
[  229.492242][ T6019]  ? net_generic+0x1f4/0x240
[  229.492261][ T6019]  nfsd_svc+0x315/0x780
[  229.492285][ T6019]  write_threads+0x3cd/0x5a0
[  229.492298][ T6019]  ? __might_fault+0xaf/0x130
[  229.492318][ T6019]  ? __pfx_write_threads+0x10/0x10
[  229.492345][ T6019]  ? _copy_from_user+0x94/0xb0
[  229.492362][ T6019]  ? simple_transaction_get+0x12d/0x160
[  229.492380][ T6019]  nfsctl_transaction_write+0x10f/0x160
[  229.492396][ T6019]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  229.492412][ T6019]  vfs_write+0x296/0xba0
[  229.492435][ T6019]  ? __pfx_vfs_write+0x10/0x10
[  229.492461][ T6019]  ? _raw_spin_unlock_irq+0x23/0x50
[  229.492476][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  229.492500][ T6019]  ksys_write+0x150/0x270
[  229.492520][ T6019]  ? __pfx_ksys_write+0x10/0x10
[  229.492541][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.492556][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.492572][ T6019]  do_syscall_64+0x174/0x580
[  229.492589][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.492604][ T6019]  ? clear_bhb_loop+0x70/0xc0
[  229.492622][ T6019]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.492637][ T6019] RIP: 0033:0x7f3343939df7
[  229.492653][ T6019] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  229.492666][ T6019] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  229.492683][ T6019] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  229.492694][ T6019] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  229.492704][ T6019] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  229.492712][ T6019] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  229.492722][ T6019] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d924
[  229.492745][ T6019]  </TASK>
[  229.493541][ T6019] kobject: kobject_add_internal failed for nfsd_file (error: -12 parent: slab)
[  229.670669][ T6019] SLUB: Unable to add cache nfsd_file to sysfs
[  229.673678][ T6019] FAULT_INJECTION: forcing a failure.
[  229.673678][ T6019] name failslab, interval 1, probability 5, space 0, times -1
[  229.679864][ T6019] CPU: 0 UID: 0 PID: 6019 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  229.679885][ T6019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  229.679893][ T6019] Call Trace:
[  229.679900][ T6019]  <TASK>
[  229.679907][ T6019]  dump_stack_lvl+0xe8/0x150
[  229.679931][ T6019]  should_fail_ex+0x40c/0x560
[  229.679958][ T6019]  ? do_kmem_cache_create+0x877/0x970
[  229.679974][ T6019]  should_failslab+0xa8/0x100
[  229.679992][ T6019]  __kmalloc_flags_noprof+0x135/0x800
[  229.680014][ T6019]  ? __kmalloc_flags_noprof+0x35e/0x800
[  229.680031][ T6019]  ? do_kmem_cache_create+0x877/0x970
[  229.680044][ T6019]  ? do_kmem_cache_create+0x877/0x970
[  229.680063][ T6019]  do_kmem_cache_create+0x877/0x970
[  229.680080][ T6019]  __kmem_cache_create_args+0x307/0x440
[  229.680099][ T6019]  nfsd_file_cache_init+0x1d9/0x530
[  229.680118][ T6019]  ? __pfx_nfsd_file_cache_init+0x10/0x10
[  229.680133][ T6019]  ? net_generic+0x1e/0x240
[  229.680156][ T6019]  ? net_generic+0x1e/0x240
[  229.680173][ T6019]  ? net_generic+0x1e/0x240
[  229.680188][ T6019]  ? net_generic+0x1e/0x240
[  229.680206][ T6019]  ? net_generic+0x1f4/0x240
[  229.680222][ T6019]  nfsd_svc+0x315/0x780
[  229.680244][ T6019]  write_threads+0x3cd/0x5a0
[  229.680257][ T6019]  ? __might_fault+0xaf/0x130
[  229.680274][ T6019]  ? __pfx_write_threads+0x10/0x10
[  229.680300][ T6019]  ? _copy_from_user+0x94/0xb0
[  229.680318][ T6019]  ? simple_transaction_get+0x12d/0x160
[  229.680335][ T6019]  nfsctl_transaction_write+0x10f/0x160
[  229.680352][ T6019]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  229.680367][ T6019]  vfs_write+0x296/0xba0
[  229.680391][ T6019]  ? __pfx_vfs_write+0x10/0x10
[  229.680411][ T6019]  ? _raw_spin_unlock_irq+0x23/0x50
[  229.680426][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  229.680457][ T6019]  ksys_write+0x150/0x270
[  229.680476][ T6019]  ? __pfx_ksys_write+0x10/0x10
[  229.680498][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.680514][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.680529][ T6019]  do_syscall_64+0x174/0x580
[  229.680545][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.680559][ T6019]  ? clear_bhb_loop+0x70/0xc0
[  229.680576][ T6019]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.680590][ T6019] RIP: 0033:0x7f3343939df7
[  229.680604][ T6019] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  229.680616][ T6019] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  229.680632][ T6019] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  229.680642][ T6019] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  229.680651][ T6019] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  229.680660][ T6019] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  229.680669][ T6019] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d924
[  229.680692][ T6019]  </TASK>
[  229.680778][ T6019] __kmem_cache_create_args(nfsd_file_mark) failed with error -12
[  229.827581][ T6019] CPU: 0 UID: 0 PID: 6019 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  229.827603][ T6019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  229.827613][ T6019] Call Trace:
[  229.827667][ T6019]  <TASK>
[  229.827674][ T6019]  dump_stack_lvl+0xe8/0x150
[  229.827701][ T6019]  __kmem_cache_create_args+0x3d8/0x440
[  229.827724][ T6019]  nfsd_file_cache_init+0x1d9/0x530
[  229.827744][ T6019]  ? __pfx_nfsd_file_cache_init+0x10/0x10
[  229.827761][ T6019]  ? net_generic+0x1e/0x240
[  229.827786][ T6019]  ? net_generic+0x1e/0x240
[  229.827829][ T6019]  ? net_generic+0x1e/0x240
[  229.827845][ T6019]  ? net_generic+0x1e/0x240
[  229.827863][ T6019]  ? net_generic+0x1f4/0x240
[  229.827881][ T6019]  nfsd_svc+0x315/0x780
[  229.827903][ T6019]  write_threads+0x3cd/0x5a0
[  229.827927][ T6019]  ? __might_fault+0xaf/0x130
[  229.827946][ T6019]  ? __pfx_write_threads+0x10/0x10
[  229.827973][ T6019]  ? _copy_from_user+0x94/0xb0
[  229.828094][ T6019]  ? simple_transaction_get+0x12d/0x160
[  229.828113][ T6019]  nfsctl_transaction_write+0x10f/0x160
[  229.828128][ T6019]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  229.828143][ T6019]  vfs_write+0x296/0xba0
[  229.828165][ T6019]  ? __pfx_vfs_write+0x10/0x10
[  229.828188][ T6019]  ? _raw_spin_unlock_irq+0x23/0x50
[  229.828206][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  229.828225][ T6019]  ksys_write+0x150/0x270
[  229.828243][ T6019]  ? __pfx_ksys_write+0x10/0x10
[  229.828262][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.828275][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.828289][ T6019]  do_syscall_64+0x174/0x580
[  229.828306][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.828320][ T6019]  ? clear_bhb_loop+0x70/0xc0
[  229.828337][ T6019]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.828350][ T6019] RIP: 0033:0x7f3343939df7
[  229.828366][ T6019] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  229.828379][ T6019] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  229.828395][ T6019] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  229.828405][ T6019] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  229.828413][ T6019] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  229.828420][ T6019] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  229.828428][ T6019] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d924
[  229.828447][ T6019]  </TASK>
[  229.944131][ T6019] nfsd: unable to create nfsd_file_mark_slab
[  230.144303][ T6019] FAULT_INJECTION: forcing a failure.
[  230.144303][ T6019] name failslab, interval 1, probability 5, space 0, times -1
[  230.149678][ T6019] CPU: 0 UID: 0 PID: 6019 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  230.149699][ T6019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  230.149709][ T6019] Call Trace:
[  230.149717][ T6019]  <TASK>
[  230.149725][ T6019]  dump_stack_lvl+0xe8/0x150
[  230.149752][ T6019]  should_fail_ex+0x40c/0x560
[  230.149839][ T6019]  should_failslab+0xa8/0x100
[  230.149885][ T6019]  __kmalloc_cache_noprof+0xa8/0x660
[  230.149911][ T6019]  ? unx_lookup_cred+0x83/0x170
[  230.149923][ T6019]  ? unx_lookup_cred+0x83/0x170
[  230.149938][ T6019]  unx_lookup_cred+0x83/0x170
[  230.149954][ T6019]  rpcauth_refreshcred+0x63e/0xa20
[  230.149981][ T6019]  ? __pfx_rpcauth_refreshcred+0x10/0x10
[  230.150000][ T6019]  ? __pfx_do_raw_spin_lock+0x10/0x10
[  230.150026][ T6019]  ? __pfx_call_refresh+0x10/0x10
[  230.150044][ T6019]  ? __pfx_call_refresh+0x10/0x10
[  230.150062][ T6019]  __rpc_execute+0x526/0x1280
[  230.150093][ T6019]  ? __pfx___rpc_execute+0x10/0x10
[  230.150114][ T6019]  ? rpc_task_get_xprt+0x26/0x250
[  230.150130][ T6019]  ? rpc_make_runnable+0xae/0x1c0
[  230.150150][ T6019]  rpc_execute+0x1c1/0x390
[  230.150168][ T6019]  rpc_run_task+0x4a6/0x660
[  230.150185][ T6019]  rpc_call_sync+0x10f/0x200
[  230.150199][ T6019]  ? __pfx_rpc_call_sync+0x10/0x10
[  230.150220][ T6019]  ? net_generic+0x1e/0x240
[  230.150234][ T6019]  ? net_generic+0x1e/0x240
[  230.150251][ T6019]  rpcb_register+0x2d0/0x530
[  230.150267][ T6019]  ? __pfx_rpcb_register+0x10/0x10
[  230.150280][ T6019]  ? __lock_acquire+0x683/0x2cf0
[  230.150313][ T6019]  svc_unregister+0x24d/0x780
[  230.150338][ T6019]  svc_rpcb_cleanup+0x1d/0x30
[  230.150353][ T6019]  svc_xprt_destroy_all+0x6d3/0x730
[  230.150367][ T6019]  ? kfree+0x1c5/0x640
[  230.150382][ T6019]  ? rhashtable_free_and_destroy+0x4e0/0x540
[  230.150408][ T6019]  ? __pfx_svc_xprt_destroy_all+0x10/0x10
[  230.150426][ T6019]  ? do_raw_spin_unlock+0xf5/0x210
[  230.150447][ T6019]  nfsd_destroy_serv+0x1bf/0x4b0
[  230.150469][ T6019]  ? __pfx_nfsd_destroy_serv+0x10/0x10
[  230.150486][ T6019]  ? net_generic+0x1e/0x240
[  230.150507][ T6019]  nfsd_svc+0x540/0x780
[  230.150529][ T6019]  write_threads+0x3cd/0x5a0
[  230.150543][ T6019]  ? __might_fault+0xaf/0x130
[  230.150562][ T6019]  ? __pfx_write_threads+0x10/0x10
[  230.150588][ T6019]  ? _copy_from_user+0x94/0xb0
[  230.150605][ T6019]  ? simple_transaction_get+0x12d/0x160
[  230.150623][ T6019]  nfsctl_transaction_write+0x10f/0x160
[  230.150639][ T6019]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  230.150654][ T6019]  vfs_write+0x296/0xba0
[  230.150676][ T6019]  ? __pfx_vfs_write+0x10/0x10
[  230.150700][ T6019]  ? _raw_spin_unlock_irq+0x23/0x50
[  230.150716][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  230.150737][ T6019]  ksys_write+0x150/0x270
[  230.150756][ T6019]  ? __pfx_ksys_write+0x10/0x10
[  230.150817][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.150831][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.150845][ T6019]  do_syscall_64+0x174/0x580
[  230.150862][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.150886][ T6019]  ? clear_bhb_loop+0x70/0xc0
[  230.150903][ T6019]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.150916][ T6019] RIP: 0033:0x7f3343939df7
[  230.150931][ T6019] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  230.150944][ T6019] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  230.150960][ T6019] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  230.150970][ T6019] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  230.150979][ T6019] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  230.150987][ T6019] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  230.150997][ T6019] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d924
[  230.151019][ T6019]  </TASK>
[pid  6213] write(4, "tcp 2049\n", 9 <unfinished ...>
[pid  6019] <... write resumed>)        = -1 ENOMEM (Cannot allocate memory)
[  230.345846][ T6027] FAULT_INJECTION: forcing a failure.
[  230.345846][ T6027] name failslab, interval 1, probability 5, space 0, times -1
[pid  6019] openat(AT_FDCWD, "/proc/self/make-it-fail", O_WRONLY) = 5
[pid  6019] write(5, "0", 1)            = 1
[pid  6019] close(5)                    = 0
[  230.357994][ T6027] CPU: 0 UID: 0 PID: 6027 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  230.358015][ T6027] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  230.358024][ T6027] Call Trace:
[  230.358030][ T6027]  <TASK>
[  230.358037][ T6027]  dump_stack_lvl+0xe8/0x150
[  230.358062][ T6027]  should_fail_ex+0x40c/0x560
[  230.358089][ T6027]  should_failslab+0xa8/0x100
[  230.358107][ T6027]  __kmalloc_noprof+0xfe/0x720
[  230.358129][ T6027]  ? __svc_create+0x65c/0x990
[  230.358143][ T6027]  ? __svc_create+0x65c/0x990
[  230.358162][ T6027]  __svc_create+0x65c/0x990
[  230.358243][ T6027]  ? __pfx_nfsd+0x10/0x10
[  230.358263][ T6027]  svc_create_pooled+0x5ad/0x770
[  230.358278][ T6027]  ? __init_swait_queue_head+0xa8/0x150
[  230.358296][ T6027]  nfsd_create_serv+0x565/0x840
[  230.358313][ T6027]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  230.358329][ T6027]  ? lockdep_hardirqs_on+0x7a/0x110
[  230.358347][ T6027]  ? __pfx_nfsd_create_serv+0x10/0x10
[  230.358364][ T6027]  ? net_generic+0x1e/0x240
[  230.358380][ T6027]  ? net_generic+0x1e/0x240
[  230.358399][ T6027]  ? net_generic+0x1e/0x240
[  230.358420][ T6027]  nfsd_svc+0x189/0x780
[  230.358441][ T6027]  write_threads+0x3cd/0x5a0
[  230.358454][ T6027]  ? __might_fault+0xaf/0x130
[  230.358471][ T6027]  ? __pfx_write_threads+0x10/0x10
[  230.358496][ T6027]  ? _copy_from_user+0x94/0xb0
[  230.358512][ T6027]  ? simple_transaction_get+0x12d/0x160
[  230.358530][ T6027]  nfsctl_transaction_write+0x10f/0x160
[  230.358545][ T6027]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  230.358560][ T6027]  vfs_write+0x296/0xba0
[  230.358582][ T6027]  ? __pfx_vfs_write+0x10/0x10
[  230.358604][ T6027]  ? _raw_spin_unlock_irq+0x23/0x50
[  230.358618][ T6027]  ? lockdep_hardirqs_on+0x7a/0x110
[  230.358639][ T6027]  ksys_write+0x150/0x270
[  230.358658][ T6027]  ? __pfx_ksys_write+0x10/0x10
[  230.358680][ T6027]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.358696][ T6027]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.358712][ T6027]  do_syscall_64+0x174/0x580
[  230.358729][ T6027]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.358778][ T6027]  ? clear_bhb_loop+0x70/0xc0
[  230.358797][ T6027]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.358829][ T6027] RIP: 0033:0x7f3343939df7
[  230.358846][ T6027] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  230.358859][ T6027] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  230.358874][ T6027] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  230.358883][ T6027] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  230.358891][ T6027] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  230.358899][ T6027] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  230.358907][ T6027] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d93c
[  230.358927][ T6027]  </TASK>
[pid  6019] write(4, "tcp 2049\n", 9 <unfinished ...>
[pid  5972] <... write resumed>)        = 9
[  230.515705][ T6239] FAULT_INJECTION: forcing a failure.
[  230.515705][ T6239] name failslab, interval 1, probability 5, space 0, times -1
[  230.524804][ T6239] CPU: 0 UID: 0 PID: 6239 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  230.524828][ T6239] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  230.524848][ T6239] Call Trace:
[  230.524856][ T6239]  <TASK>
[  230.524864][ T6239]  dump_stack_lvl+0xe8/0x150
[  230.524892][ T6239]  should_fail_ex+0x40c/0x560
[  230.524921][ T6239]  should_failslab+0xa8/0x100
[  230.524941][ T6239]  __kmalloc_noprof+0xfe/0x720
[  230.524965][ T6239]  ? kobject_get_path+0xc5/0x2f0
[  230.524986][ T6239]  ? kobject_get_path+0xc5/0x2f0
[  230.525013][ T6239]  kobject_get_path+0xc5/0x2f0
[  230.525039][ T6239]  kobject_uevent_env+0x29e/0x9e0
[  230.525057][ T6239]  ? rpc_sysfs_xprt_switch_setup+0x1c6/0x2b0
[  230.525083][ T6239]  xprt_switch_alloc+0x238/0x590
[  230.525106][ T6239]  rpc_create_xprt+0x1c7/0xa90
[  230.525125][ T6239]  ? __pfx_rpc_create_xprt+0x10/0x10
[  230.525155][ T6239]  ? rcu_is_watching+0x15/0xb0
[  230.525173][ T6239]  ? trace_kmalloc+0x2a/0xf0
[  230.525197][ T6239]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  230.525220][ T6239]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  230.525242][ T6239]  ? xprt_create_transport+0x39b/0x5f0
[  230.525259][ T6239]  ? xprt_create_transport+0x39b/0x5f0
[  230.525276][ T6239]  ? kstrdup+0x81/0x100
[  230.525299][ T6239]  ? __asan_memcpy+0x40/0x70
[  230.525325][ T6239]  ? xprt_create_transport+0x438/0x5f0
[  230.525345][ T6239]  rpc_create+0x649/0x900
[pid  6027] <... write resumed>)        = -1 ENOMEM (Cannot allocate memory)
[  230.525370][ T6239]  ? __pfx_rpc_create+0x10/0x10
[pid  6027] openat(AT_FDCWD, "/proc/self/make-it-fail", O_WRONLY) = 5
[pid  6027] write(5, "0", 1)            = 1
[pid  6027] close(5)                    = 0
[  230.525421][ T6239]  ? __lock_acquire+0x683/0x2cf0
[  230.525447][ T6239]  rpcb_create_af_local+0x1c7/0x3c0
[  230.525464][ T6239]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  230.525499][ T6239]  ? do_raw_spin_unlock+0xf5/0x210
[  230.525523][ T6239]  rpcb_create_local+0x268/0x670
[  230.525542][ T6239]  ? __pfx_rpcb_create_local+0x10/0x10
[  230.525557][ T6239]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  230.525575][ T6239]  ? lockdep_hardirqs_on+0x7a/0x110
[  230.525595][ T6239]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  230.525612][ T6239]  ? __percpu_counter_init_many+0x35f/0x380
[  230.525640][ T6239]  ? __svc_create+0x88f/0x990
[  230.525666][ T6239]  svc_bind+0x1b4/0x230
[  230.525687][ T6239]  nfsd_create_serv+0x581/0x840
[  230.525709][ T6239]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  230.525757][ T6239]  ? lockdep_hardirqs_on+0x7a/0x110
[  230.525778][ T6239]  ? __pfx_nfsd_create_serv+0x10/0x10
[  230.525800][ T6239]  ? net_generic+0x1e/0x240
[  230.525821][ T6239]  ? net_generic+0x1e/0x240
[  230.525851][ T6239]  ? net_generic+0x1e/0x240
[  230.525878][ T6239]  nfsd_svc+0x189/0x780
[  230.525904][ T6239]  write_threads+0x3cd/0x5a0
[  230.525919][ T6239]  ? __might_fault+0xaf/0x130
[  230.525940][ T6239]  ? __pfx_write_threads+0x10/0x10
[  230.525970][ T6239]  ? _copy_from_user+0x94/0xb0
[  230.525989][ T6239]  ? simple_transaction_get+0x12d/0x160
[  230.526009][ T6239]  nfsctl_transaction_write+0x10f/0x160
[  230.526027][ T6239]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  230.526043][ T6239]  vfs_write+0x296/0xba0
[  230.526070][ T6239]  ? __pfx_vfs_write+0x10/0x10
[  230.526098][ T6239]  ? _raw_spin_unlock_irq+0x23/0x50
[  230.526113][ T6239]  ? lockdep_hardirqs_on+0x7a/0x110
[  230.526138][ T6239]  ksys_write+0x150/0x270
[  230.526160][ T6239]  ? __pfx_ksys_write+0x10/0x10
[  230.526184][ T6239]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.526201][ T6239]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.526218][ T6239]  do_syscall_64+0x174/0x580
[  230.526236][ T6239]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.526252][ T6239]  ? clear_bhb_loop+0x70/0xc0
[  230.526272][ T6239]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.526288][ T6239] RIP: 0033:0x7f3343939df7
[  230.526303][ T6239] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  230.526318][ T6239] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  230.526336][ T6239] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  230.526348][ T6239] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  230.526358][ T6239] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  230.526368][ T6239] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  230.526378][ T6239] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dc2c
[  230.526403][ T6239]  </TASK>
[  230.526471][ T6239] FAULT_INJECTION: forcing a failure.
[  230.526471][ T6239] name failslab, interval 1, probability 5, space 0, times -1
[  230.732303][ T6239] CPU: 0 UID: 0 PID: 6239 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  230.732326][ T6239] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  230.732336][ T6239] Call Trace:
[  230.732343][ T6239]  <TASK>
[  230.732350][ T6239]  dump_stack_lvl+0xe8/0x150
[  230.732379][ T6239]  should_fail_ex+0x40c/0x560
[  230.732407][ T6239]  should_failslab+0xa8/0x100
[  230.732427][ T6239]  __kmalloc_node_track_caller_noprof+0x100/0x730
[  230.732452][ T6239]  ? __lock_acquire+0x683/0x2cf0
[  230.732468][ T6239]  ? __kernfs_new_node+0xa9/0x980
[  230.732488][ T6239]  ? __kernfs_new_node+0xa9/0x980
[  230.732513][ T6239]  kstrdup+0x42/0x100
[  230.732538][ T6239]  __kernfs_new_node+0xa9/0x980
[  230.732565][ T6239]  ? __pfx___kernfs_new_node+0x10/0x10
[  230.732586][ T6239]  ? kernfs_root+0x1c/0x230
[  230.732610][ T6239]  ? kernfs_root+0x1c/0x230
[  230.732652][ T6239]  ? kernfs_root+0x1c/0x230
[  230.732669][ T6239]  ? kernfs_root+0x1c/0x230
[  230.732738][ T6239]  kernfs_create_dir_ns+0xfe/0x230
[  230.732765][ T6239]  sysfs_create_dir_ns+0x12f/0x2a0
[  230.732787][ T6239]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  230.732809][ T6239]  ? do_raw_spin_unlock+0xf5/0x210
[  230.732833][ T6239]  kobject_add_internal+0x622/0xcd0
[  230.732862][ T6239]  kobject_init_and_add+0x12b/0x1a0
[  230.732890][ T6239]  ? __pfx_kobject_init_and_add+0x10/0x10
[  230.732914][ T6239]  ? __kmalloc_cache_noprof+0x150/0x660
[  230.732936][ T6239]  ? rpc_sysfs_xprt_setup+0xa7/0x260

[host] Command execution timed out after 2m30s
]

best-expensive

map[Feedback:The reproduction attempt failed to trigger the bug because it relies on `failslab` to inject a failure into `percpu_counter_init()`. However, `percpu_counter_init()` allocates memory using the percpu allocator (`__alloc_percpu_gfp`), which does not always call into the slab allocator. It only performs a slab allocation when a new percpu chunk needs to be created. Since the percpu allocator likely had enough free space in existing chunks during the test, `failslab` never intercepted the allocation, and `percpu_counter_init()` always succeeded.

The root cause of the bug is in `__svc_create()` (in `net/sunrpc/svc.c`). It calls `percpu_counter_init()` for `sp_messages_arrived`, `sp_sockets_queued`, and `sp_threads_woken` but completely ignores their return values:
```c
		percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL);
		percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL);
		percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL);
```
If `percpu_counter_init()` fails (e.g., due to memory pressure or fault injection), it returns `-ENOMEM` and leaves the `counters` pointer inside the `percpu_counter` struct as `NULL`.

Later, when `svc_xprt_enqueue()` calls `percpu_counter_inc(&pool->sp_sockets_queued)`, it calls `percpu_counter_add_batch()`, which unconditionally dereferences the `counters` pointer via `this_cpu_read(*fbc->counters)`. Since the pointer is `NULL`, this results in a page fault at `NULL + per_cpu_offset`, which matches the crash signature `BUG: unable to handle kernel paging request in percpu_counter_add_batch`.

To fix this, `__svc_create()` must check the return values of `percpu_counter_init()` and properly unwind/handle the error if any of them fail. For example, it can call `svc_destroy(&serv)` and return `NULL`. `svc_destroy()` is safe to call on a partially initialized `serv` because `sv_pools` is zero-allocated and `percpu_counter_destroy()` safely returns if the `counters` pointer is `NULL`. ProbePassed:false TerminalError: TitleMatches:true]

You are a security researcher with deep Linux kernel background.
Analyze the results of running the generated program.

=== CRITICAL ENVIRONMENT & TARGET CLASSIFICATION ===
Set 'TerminalError' to a descriptive error message ONLY if:
1. The execution failed due to missing hardware device nodes, subsystems, kernel modules, or privilege limits
   that cannot be loaded, created, or bypassed by user-space C code edits in the VM guest.
2. The target source files or functions described in the bug description do not exist in the checked-out codebase,
   meaning the codebase version is mismatched and the target code is absent.

=== CRITICAL PROHIBITIONS ===
- Do NOT classify a run as a terminal failure or assume a bug is fixed based on git log entries, commit titles,
  or commit messages. Reproducibility can ONLY be determined by executing reproducer candidates in the VM.
- Do NOT suggest C code strategies, repairs, or namespace bypasses when setting 'TerminalError'.


=== PHASE 2: BUG REPRODUCTION (EVALUATION) ===
The executed program was a full reproducer candidate attempting to trigger the target bug/crash.
Use this to guide your classification and feedback:
1. If a crash was triggered (Reproduced is true):
   - Determine if the triggered crash matches the expected bug.
   - If you conclude they represent the same underlying bug (the same root cause)
     despite different titles, crash signatures, or call traces, set TitleMatches
     to true and provide a detailed, technical, and verbose explanation of the
     equivalence in the 'Feedback' field.
   - If they do not represent the same bug (a completely unrelated crash/collision),
     set TitleMatches to false and explain the collision in 'Feedback'.
   - If they match exactly, set TitleMatches to true and provide a brief confirmation in 'Feedback'.
2. If the execution was successful (exit 0) WITHOUT a crash (Reproduced is false):
   - The reproduction attempt failed to trigger the bug. Analyze the console/strace output
     to understand why the bug did not trigger (e.g., timing, input arguments, environment setup)
     and provide feedback on how to improve the reproducer logic to trigger the crash.

Critical Diagnostic Rule for Reproduction Failures:
If the reproduction attempt fails (e.g., a system call returns an error, or a
warning/error message appears in the console log), you MUST:
1. Identify the failing system call from the execution trace or strace output.
2. Identify any corresponding warning or error messages in the console log.
3. Immediately search the kernel source tree for the warning message strings or
   the code of the failing system call/subsystem to locate the validation logic.
4. Trace the kernel's validation logic to diagnose the exact constraint violation
   or input mismatch in the generated program.
5. Provide a technical diagnosis in the feedback explaining the exact kernel constraint that was violated and why.

Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Bug Description: BUG: unable to handle kernel paging request in percpu_counter_add_batch

BUG: unable to handle page fault for address: ffff88808c54a000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 1acd5067 P4D 1acd5067 PUD 0 
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5311 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:percpu_counter_add_batch+0x50/0x1d0 lib/percpu_counter.c:98
Code: f6 48 b7 fc 48 89 5c 24 10 48 83 c3 58 49 89 de 49 c1 ee 03 43 80 3c 3e 00 74 08 48 89 df e8 07 7d 26 fd 48 89 1c 24 48 8b 03 <65> 8b 28 41 89 ef 41 c1 ff 1f 49 c1 e7 20 4c 89 6c 24 08 4d 01 ef
RSP: 0018:ffffc9000dc47810 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888036dc4930 RCX: ffff888012f0ca80
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888036dc48d8
RBP: ffffc9000dc47908 R08: ffff888012c3e03f R09: 1ffff11002587c07
R10: dffffc0000000000 R11: ffffed1002587c08 R12: 0000000000000020
R13: 0000000000000001 R14: 1ffff11006db8926 R15: dffffc0000000000
FS:  00007f711d27e6c0(0000) GS:ffff88808c54a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88808c54a000 CR3: 000000001fde5000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 percpu_counter_add include/linux/percpu_counter.h:71 [inline]
 percpu_counter_inc include/linux/percpu_counter.h:267 [inline]
 svc_xprt_enqueue+0x2ee/0x8b0 net/sunrpc/svc_xprt.c:524
 svc_xprt_received+0x10f/0x150 net/sunrpc/svc_xprt.c:248
 svc_add_new_perm_xprt net/sunrpc/svc_xprt.c:260 [inline]
 _svc_xprt_create+0x3d8/0x600 net/sunrpc/svc_xprt.c:290
 svc_xprt_create_from_sa net/sunrpc/svc_xprt.c:332 [inline]
 svc_xprt_create+0x1aa/0x280 net/sunrpc/svc_xprt.c:387
 __write_ports_addxprt fs/nfsd/nfsctl.c:774 [inline]
 __write_ports fs/nfsd/nfsctl.c:808 [inline]
 write_ports+0x71a/0xd10 fs/nfsd/nfsctl.c:861
 nfsctl_transaction_write+0x10f/0x160 fs/nfsd/nfsctl.c:112
 vfs_write+0x296/0xba0 fs/read_write.c:685
 ksys_write+0x150/0x270 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f711c39e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f711d27dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f711c625fa0 RCX: 00007f711c39e0d9
RDX: 0000000000000005 RSI: 0000200000000300 RDI: 0000000000000004
RBP: 00007f711c435024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f711c626038 R14: 00007f711c625fa0 R15: 00007ffc740e4ce8
 </TASK>
Modules linked in:
CR2: ffff88808c54a000
---[ end trace 0000000000000000 ]---
RIP: 0010:percpu_counter_add_batch+0x50/0x1d0 lib/percpu_counter.c:98
Code: f6 48 b7 fc 48 89 5c 24 10 48 83 c3 58 49 89 de 49 c1 ee 03 43 80 3c 3e 00 74 08 48 89 df e8 07 7d 26 fd 48 89 1c 24 48 8b 03 <65> 8b 28 41 89 ef 41 c1 ff 1f 49 c1 e7 20 4c 89 6c 24 08 4d 01 ef
RSP: 0018:ffffc9000dc47810 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888036dc4930 RCX: ffff888012f0ca80
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888036dc48d8
RBP: ffffc9000dc47908 R08: ffff888012c3e03f R09: 1ffff11002587c07
R10: dffffc0000000000 R11: ffffed1002587c08 R12: 0000000000000020
R13: 0000000000000001 R14: 1ffff11006db8926 R15: dffffc0000000000
FS:  00007f711d27e6c0(0000) GS:ffff88808c54a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88808c54a000 CR3: 000000001fde5000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	f6 48 b7 fc          	testb  $0xfc,-0x49(%rax)
   4:	48 89 5c 24 10       	mov    %rbx,0x10(%rsp)
   9:	48 83 c3 58          	add    $0x58,%rbx
   d:	49 89 de             	mov    %rbx,%r14
  10:	49 c1 ee 03          	shr    $0x3,%r14
  14:	43 80 3c 3e 00       	cmpb   $0x0,(%r14,%r15,1)
  19:	74 08                	je     0x23
  1b:	48 89 df             	mov    %rbx,%rdi
  1e:	e8 07 7d 26 fd       	call   0xfd267d2a
  23:	48 89 1c 24          	mov    %rbx,(%rsp)
  27:	48 8b 03             	mov    (%rbx),%rax
* 2a:	65 8b 28             	mov    %gs:(%rax),%ebp <-- trapping instruction
  2d:	41 89 ef             	mov    %ebp,%r15d
  30:	41 c1 ff 1f          	sar    $0x1f,%r15d
  34:	49 c1 e7 20          	shl    $0x20,%r15
  38:	4c 89 6c 24 08       	mov    %r13,0x8(%rsp)
  3d:	4d 01 ef             	add    %r13,%r15

IsProbe: false
Reproduced: false
Console Output: [  269.423808][ T6052]  ? __pfx_vfs_write+0x10/0x10
[  269.423817][ T6052]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.423832][ T6052]  ? fput_close_sync+0x11f/0x240
[  269.423844][ T6052]  ksys_write+0x150/0x270
[  269.423856][ T6052]  ? __pfx_ksys_write+0x10/0x10
[  269.423870][ T6052]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  269.423880][ T6052]  do_syscall_64+0x174/0x580
[  269.423891][ T6052]  ? trace_irq_disable+0x3b/0x140
[  269.423900][ T6052]  ? clear_bhb_loop+0x70/0xc0
[  269.423910][ T6052]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  269.423918][ T6052] RIP: 0033:0x7f67c8dd3df7
[  269.423929][ T6052] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  269.423936][ T6052] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  269.423947][ T6052] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  269.423953][ T6052] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  269.423958][ T6052] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  269.423963][ T6052] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  269.423968][ T6052] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c9b4
[  269.423981][ T6052]  </TASK>
[  269.423999][ T6052] can't create link to switch in sysfs (-12)
[  269.565856][ T6052] FAULT_INJECTION: forcing a failure.
[  269.565856][ T6052] name failslab, interval 1, probability 5, space 0, times -1
[  269.569622][ T6052] CPU: 0 UID: 0 PID: 6052 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  269.569634][ T6052] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  269.569640][ T6052] Call Trace:
[  269.569644][ T6052]  <TASK>
[  269.569649][ T6052]  dump_stack_lvl+0xe8/0x150
[  269.569666][ T6052]  should_fail_ex+0x40c/0x560
[  269.569683][ T6052]  should_failslab+0xa8/0x100
[  269.569695][ T6052]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  269.569708][ T6052]  ? security_file_alloc+0x34/0x310
[  269.569718][ T6052]  ? security_file_alloc+0x34/0x310
[  269.569731][ T6052]  security_file_alloc+0x34/0x310
[  269.569742][ T6052]  init_file+0x90/0x2b0
[  269.569752][ T6052]  alloc_empty_file+0x74/0x1d0
[  269.569761][ T6052]  alloc_file_pseudo+0x115/0x1e0
[  269.569770][ T6052]  ? __pfx_alloc_file_pseudo+0x10/0x10
[  269.569779][ T6052]  ? __raw_spin_lock_init+0x45/0x100
[  269.569794][ T6052]  sock_alloc_file+0xb8/0x2e0
[  269.569807][ T6052]  xs_local_connect+0x179/0x810
[  269.569819][ T6052]  ? __pfx_xs_local_connect+0x10/0x10
[  269.569831][ T6052]  ? do_raw_spin_unlock+0xf5/0x210
[  269.569844][ T6052]  xprt_connect+0x613/0x850
[  269.569858][ T6052]  ? __pfx_call_connect+0x10/0x10
[  269.569870][ T6052]  __rpc_execute+0x526/0x1280
[  269.569889][ T6052]  ? __pfx___rpc_execute+0x10/0x10
[  269.569901][ T6052]  ? rpc_task_get_xprt+0x26/0x250
[  269.569912][ T6052]  ? rpc_make_runnable+0xae/0x1c0
[  269.569924][ T6052]  rpc_execute+0x1c1/0x390
[  269.569937][ T6052]  rpc_run_task+0x4a6/0x660
[  269.569947][ T6052]  rpc_create_xprt+0x533/0xa90
[  269.569957][ T6052]  ? __pfx_rpc_create_xprt+0x10/0x10
[  269.569974][ T6052]  ? rcu_is_watching+0x15/0xb0
[  269.569984][ T6052]  ? trace_kmalloc+0x2a/0xf0
[  269.570017][ T6052]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  269.570030][ T6052]  ? xprt_create_transport+0x39b/0x5f0
[  269.570045][ T6052]  ? xprt_create_transport+0x438/0x5f0
[  269.570055][ T6052]  rpc_create+0x649/0x900
[  269.570069][ T6052]  ? __pfx_rpc_create+0x10/0x10
[  269.570096][ T6052]  ? __lock_acquire+0x683/0x2cf0
[  269.570110][ T6052]  rpcb_create_af_local+0x1c7/0x3c0
[  269.570119][ T6052]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  269.570137][ T6052]  ? do_raw_spin_unlock+0xf5/0x210
[  269.570150][ T6052]  rpcb_create_local+0x268/0x670
[  269.570160][ T6052]  ? __pfx_rpcb_create_local+0x10/0x10
[  269.570168][ T6052]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  269.570183][ T6052]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.570194][ T6052]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  269.570203][ T6052]  ? __percpu_counter_init_many+0x35f/0x380
[  269.570217][ T6052]  ? __svc_create+0x88f/0x990
[  269.570231][ T6052]  svc_bind+0x1b4/0x230
[  269.570242][ T6052]  nfsd_create_serv+0x581/0x840
[  269.570255][ T6052]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  269.570265][ T6052]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.570277][ T6052]  ? __pfx_nfsd_create_serv+0x10/0x10
[  269.570289][ T6052]  ? net_generic+0x1e/0x240
[  269.570300][ T6052]  ? net_generic+0x1e/0x240
[  269.570314][ T6052]  ? net_generic+0x1e/0x240
[  269.570328][ T6052]  nfsd_svc+0x189/0x780
[  269.570343][ T6052]  write_threads+0x3cd/0x5a0
[  269.570351][ T6052]  ? __might_fault+0xaf/0x130
[  269.570362][ T6052]  ? __pfx_write_threads+0x10/0x10
[  269.570378][ T6052]  ? _copy_from_user+0x94/0xb0
[  269.570389][ T6052]  ? simple_transaction_get+0x12d/0x160
[  269.570400][ T6052]  nfsctl_transaction_write+0x10f/0x160
[  269.570409][ T6052]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  269.570418][ T6052]  vfs_write+0x296/0xba0
[  269.570432][ T6052]  ? __pfx_vfs_write+0x10/0x10
[  269.570442][ T6052]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.570457][ T6052]  ? fput_close_sync+0x11f/0x240
[  269.570469][ T6052]  ksys_write+0x150/0x270
[  269.570480][ T6052]  ? __pfx_ksys_write+0x10/0x10
[  269.570494][ T6052]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  269.570503][ T6052]  do_syscall_64+0x174/0x580
[  269.570514][ T6052]  ? trace_irq_disable+0x3b/0x140
[  269.570523][ T6052]  ? clear_bhb_loop+0x70/0xc0
[  269.570534][ T6052]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  269.570542][ T6052] RIP: 0033:0x7f67c8dd3df7
[  269.570552][ T6052] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  269.570559][ T6052] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  269.570569][ T6052] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  269.570575][ T6052] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003
[  269.570581][ T6052] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  269.570586][ T6052] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f67c8e0e192
[  269.570592][ T6052] R13: 00007f67c8e0e1b7 R14: 0000000000000000 R15: 000055557253c9b4
[  269.570604][ T6052]  </TASK>
[  269.571461][ T6052] FAULT_INJECTION: forcing a failure.
[  269.571461][ T6052] name failslab, interval 1, probability 5, space 0, times -1
[  269.718383][ T6052] CPU: 0 UID: 0 PID: 6052 Comm: syz-executor837 Not tainted syzkaller #1 PREEMPT(full) 
[  269.718396][ T6052] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  269.718403][ T6052] Call Trace:
[  269.718407][ T6052]  <TASK>
[  269.718411][ T6052]  dump_stack_lvl+0xe8/0x150
[  269.718428][ T6052]  should_fail_ex+0x40c/0x560
[  269.718445][ T6052]  should_failslab+0xa8/0x100
[  269.718456][ T6052]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  269.718469][ T6052]  ? __kernfs_new_node+0xe6/0x980
[  269.718481][ T6052]  ? __kernfs_new_node+0xe6/0x980
[  269.718495][ T6052]  __kernfs_new_node+0xe6/0x980
[  269.718511][ T6052]  ? __pfx___kernfs_new_node+0x10/0x10
[  269.718522][ T6052]  ? kernfs_root+0x1c/0x230
[  269.718535][ T6052]  ? kernfs_root+0x1c/0x230
[  269.718546][ T6052]  ? kernfs_root+0x1c/0x230
[  269.718555][ T6052]  ? kernfs_root+0x1c/0x230
[  269.718567][ T6052]  kernfs_new_node+0xea/0x140
[  269.718581][ T6052]  __kernfs_create_file+0x4b/0x2e0
[  269.718591][ T6052]  sysfs_add_file_mode_ns+0x237/0x300
[  269.718604][ T6052]  internal_create_group+0x679/0x1180
[  269.718619][ T6052]  ? kernfs_create_dir_ns+0x1d5/0x230
[  269.718634][ T6052]  ? __pfx_internal_create_group+0x10/0x10
[  269.718644][ T6052]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  269.718655][ T6052]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  269.718667][ T6052]  sysfs_create_groups+0x59/0x120
[  269.718679][ T6052]  kobject_add_internal+0x669/0xcd0
[  269.718713][ T6052]  kobject_init_and_add+0x12b/0x1a0
[  269.718730][ T6052]  ? __pfx_kobject_init_and_add+0x10/0x10
[  269.718743][ T6052]  ? __kmalloc_cache_noprof+0x150/0x660
[  269.718755][ T6052]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  269.718767][ T6052]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  269.718781][ T6052]  rpc_sysfs_xprt_switch_setup+0x169/0x2b0
[  269.718795][ T6052]  xprt_switch_alloc+0x238/0x590
[  269.718808][ T6052]  rpc_create_xprt+0x1c7/0xa90
[  269.718818][ T6052]  ? __pfx_rpc_create_xprt+0x10/0x10
[  269.718835][ T6052]  ? rcu_is_watching+0x15/0xb0
[  269.718846][ T6052]  ? trace_kmalloc+0x2a/0xf0
[  269.718859][ T6052]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  269.718872][ T6052]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  269.718884][ T6052]  ? xprt_create_transport+0x39b/0x5f0
[  269.718893][ T6052]  ? xprt_create_transport+0x39b/0x5f0
[  269.718902][ T6052]  ? kstrdup+0x81/0x100
[  269.718916][ T6052]  ? __asan_memcpy+0x40/0x70
[  269.718930][ T6052]  ? xprt_create_transport+0x438/0x5f0
[  269.718941][ T6052]  rpc_create+0x649/0x900
[  269.718955][ T6052]  ? __pfx_rpc_create+0x10/0x10
[  269.719001][ T6052]  ? __lock_acquire+0x683/0x2cf0
[  269.719016][ T6052]  rpcb_create_af_local+0x1c7/0x3c0
[  269.719026][ T6052]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  269.719044][ T6052]  ? do_raw_spin_unlock+0xf5/0x210
[  269.719057][ T6052]  rpcb_create_local+0x28f/0x670
[  269.719067][ T6052]  ? __pfx_rpcb_create_local+0x10/0x10
[  269.719075][ T6052]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  269.719085][ T6052]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.719096][ T6052]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  269.719105][ T6052]  ? __percpu_counter_init_many+0x35f/0x380
[  269.719120][ T6052]  ? __svc_create+0x88f/0x990
[  269.719133][ T6052]  svc_bind+0x1b4/0x230
[  269.719144][ T6052]  nfsd_create_serv+0x581/0x840
[  269.719162][ T6052]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  269.719171][ T6052]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.719184][ T6052]  ? __pfx_nfsd_create_serv+0x10/0x10
[  269.719196][ T6052]  ? net_generic+0x1e/0x240
[  269.719207][ T6052]  ? net_generic+0x1e/0x240
[  269.719221][ T6052]  ? net_generic+0x1e/0x240
[  269.719235][ T6052]  nfsd_svc+0x189/0x780
[  269.719249][ T6052]  write_threads+0x3cd/0x5a0
[  269.719258][ T6052]  ? __might_fault+0xaf/0x130
[  269.719270][ T6052]  ? __pfx_write_threads+0x10/0x10
[  269.719286][ T6052]  ? _copy_from_user+0x94/0xb0
[  269.719297][ T6052]  ? simple_transaction_get+0x12d/0x160
[  269.719308][ T6052]  nfsctl_transaction_write+0x10f/0x160
[  269.719317][ T6052]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  269.719326][ T6052]  vfs_write+0x296/0xba0
[  269.719341][ T6052]  ? __pfx_vfs_write+0x10/0x10
[  269.719351][ T6052]  ? lockdep_hardirqs_on+0x7a/0x110
[  269.719366][ T6052]  ? fput_close_sync+0x11f/0x240
[  269.719378][ T6052]  ksys_write+0x150/0x270
[  269.719390][ T6052]  ? __pfx_ksys_write+0x10/0x10
[  269.719404][ T6052]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  269.719413][ T6052]  do_syscall_64+0x174/0x580
[  269.719424][ T6052]  ? trace_irq_disable+0x3b/0x140
[  269.719433][ T6052]  ? clear_bhb_loop+0x70/0xc0
[  269.719444][ T6052]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  269.719452][ T6052] RIP: 0033:0x7f67c8dd3df7
[  269.719462][ T6052] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  269.719470][ T6052] RSP: 002b:00007ffc9caa0f70 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  269.719481][ T6052] RAX: ffffffffffffffda RBX: 000055557253a400 RCX: 00007f67c8dd3df7
[  269.719487][ T6052] RDX: 0000000000000002 RSI: 00007f67c8e0e1aa RDI: 0000000000000003

[host] Command execution timed out after 2m30s

Strace Output: [  224.711778][ T6218]  svc_bind+0x1b4/0x230
[  224.711799][ T6218]  nfsd_create_serv+0x581/0x840
[  224.711821][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  224.711837][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  224.711856][ T6218]  ? __pfx_nfsd_create_serv+0x10/0x10
[  224.711875][ T6218]  ? net_generic+0x1e/0x240
[  224.711923][ T6218]  ? net_generic+0x1e/0x240
[  224.711944][ T6218]  ? net_generic+0x1e/0x240
[  224.711976][ T6218]  nfsd_svc+0x189/0x780
[  224.711998][ T6218]  write_threads+0x3cd/0x5a0
[  224.712011][ T6218]  ? __might_fault+0xaf/0x130
[  224.712030][ T6218]  ? __pfx_write_threads+0x10/0x10
[  224.712056][ T6218]  ? _copy_from_user+0x94/0xb0
[  224.712074][ T6218]  ? simple_transaction_get+0x12d/0x160
[  224.712091][ T6218]  nfsctl_transaction_write+0x10f/0x160
[  224.712107][ T6218]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  224.712123][ T6218]  vfs_write+0x296/0xba0
[  224.712147][ T6218]  ? __pfx_vfs_write+0x10/0x10
[  224.712170][ T6218]  ? _raw_spin_unlock_irq+0x23/0x50
[  224.712185][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  224.712206][ T6218]  ksys_write+0x150/0x270
[  224.712226][ T6218]  ? __pfx_ksys_write+0x10/0x10
[  224.712248][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.712263][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.712278][ T6218]  do_syscall_64+0x174/0x580
[  224.712295][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.712310][ T6218]  ? clear_bhb_loop+0x70/0xc0
[  224.712328][ T6218]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.712377][ T6218] RIP: 0033:0x7f3343939df7
[  224.712393][ T6218] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  224.712405][ T6218] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  224.712421][ T6218] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  224.712431][ T6218] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  224.712440][ T6218] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  224.712448][ T6218] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  224.712457][ T6218] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbdc
[  224.712478][ T6218]  </TASK>
[  224.714576][ T6218] FAULT_INJECTION: forcing a failure.
[  224.714576][ T6218] name failslab, interval 1, probability 5, space 0, times -1
[  224.911935][ T6218] CPU: 0 UID: 0 PID: 6218 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  224.911957][ T6218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  224.911966][ T6218] Call Trace:
[  224.911973][ T6218]  <TASK>
[  224.911980][ T6218]  dump_stack_lvl+0xe8/0x150
[  224.912005][ T6218]  should_fail_ex+0x40c/0x560
[  224.912029][ T6218]  should_failslab+0xa8/0x100
[  224.912046][ T6218]  __kmalloc_noprof+0xfe/0x720
[  224.912066][ T6218]  ? trace_kmem_cache_alloc+0x29/0xe0
[  224.912085][ T6218]  ? security_sk_alloc+0x52/0x360
[  224.912100][ T6218]  ? security_sk_alloc+0x52/0x360
[  224.912119][ T6218]  security_sk_alloc+0x52/0x360
[  224.912137][ T6218]  sk_prot_alloc+0x101/0x210
[  224.912162][ T6218]  sk_alloc+0x3a/0x390
[  224.912201][ T6218]  unix_create1+0xb0/0x7c0
[  224.912225][ T6218]  unix_create+0x14c/0x1d0
[  224.912243][ T6218]  __sock_create+0x4b3/0x9d0
[  224.912267][ T6218]  xs_local_connect+0x144/0x810
[  224.912289][ T6218]  ? __pfx_xs_local_connect+0x10/0x10
[  224.912308][ T6218]  ? do_raw_spin_unlock+0xf5/0x210
[  224.912536][ T6218]  xprt_connect+0x613/0x850
[  224.912561][ T6218]  ? __pfx_call_connect+0x10/0x10
[  224.912580][ T6218]  __rpc_execute+0x526/0x1280
[  224.912611][ T6218]  ? __pfx___rpc_execute+0x10/0x10
[  224.912631][ T6218]  ? rpc_task_get_xprt+0x26/0x250
[  224.912650][ T6218]  ? rpc_make_runnable+0xae/0x1c0
[  224.912671][ T6218]  rpc_execute+0x1c1/0x390
[  224.912691][ T6218]  rpc_run_task+0x4a6/0x660
[  224.912708][ T6218]  rpc_create_xprt+0x533/0xa90
[  224.912723][ T6218]  ? __pfx_rpc_create_xprt+0x10/0x10
[  224.912749][ T6218]  ? rcu_is_watching+0x15/0xb0
[  224.912765][ T6218]  ? trace_kmalloc+0x2a/0xf0
[  224.912786][ T6218]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  224.912804][ T6218]  ? xprt_create_transport+0x39b/0x5f0
[  224.912829][ T6218]  ? xprt_create_transport+0x438/0x5f0
[  224.912847][ T6218]  rpc_create+0x649/0x900
[  224.912868][ T6218]  ? __pfx_rpc_create+0x10/0x10
[  224.912912][ T6218]  ? __lock_acquire+0x683/0x2cf0
[  224.912935][ T6218]  rpcb_create_af_local+0x1c7/0x3c0
[  224.912951][ T6218]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  224.912979][ T6218]  ? do_raw_spin_unlock+0xf5/0x210
[  224.913001][ T6218]  rpcb_create_local+0x268/0x670
[  224.913017][ T6218]  ? __pfx_rpcb_create_local+0x10/0x10
[  224.913031][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  224.913049][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  224.913067][ T6218]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  224.913083][ T6218]  ? __percpu_counter_init_many+0x35f/0x380
[  224.913138][ T6218]  ? __svc_create+0x88f/0x990
[  224.913163][ T6218]  svc_bind+0x1b4/0x230
[  224.913180][ T6218]  nfsd_create_serv+0x581/0x840
[  224.913200][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  224.913215][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  224.913237][ T6218]  ? __pfx_nfsd_create_serv+0x10/0x10
[  224.913255][ T6218]  ? net_generic+0x1e/0x240
[  224.913272][ T6218]  ? net_generic+0x1e/0x240
[  224.913307][ T6218]  ? net_generic+0x1e/0x240
[  224.913363][ T6218]  nfsd_svc+0x189/0x780
[  224.913394][ T6218]  write_threads+0x3cd/0x5a0
[  224.913409][ T6218]  ? __might_fault+0xaf/0x130
[  224.913428][ T6218]  ? __pfx_write_threads+0x10/0x10
[  224.913455][ T6218]  ? _copy_from_user+0x94/0xb0
[  224.913474][ T6218]  ? simple_transaction_get+0x12d/0x160
[  224.913493][ T6218]  nfsctl_transaction_write+0x10f/0x160
[  224.913509][ T6218]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  224.913524][ T6218]  vfs_write+0x296/0xba0
[  224.913547][ T6218]  ? __pfx_vfs_write+0x10/0x10
[  224.913570][ T6218]  ? _raw_spin_unlock_irq+0x23/0x50
[  224.913586][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  224.913606][ T6218]  ksys_write+0x150/0x270
[  224.913624][ T6218]  ? __pfx_ksys_write+0x10/0x10
[  224.913646][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.913662][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.913676][ T6218]  do_syscall_64+0x174/0x580
[  224.913693][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.913707][ T6218]  ? clear_bhb_loop+0x70/0xc0
[  224.913725][ T6218]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.913740][ T6218] RIP: 0033:0x7f3343939df7
[  224.913755][ T6218] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  224.913768][ T6218] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  224.913785][ T6218] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  224.913796][ T6218] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  224.913805][ T6218] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  224.913814][ T6218] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  224.913824][ T6218] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbdc
[  224.913846][ T6218]  </TASK>
[  225.188999][ T6218] FAULT_INJECTION: forcing a failure.
[  225.188999][ T6218] name failslab, interval 1, probability 5, space 0, times -1
[  225.195461][ T6218] CPU: 1 UID: 0 PID: 6218 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  225.195483][ T6218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  225.195494][ T6218] Call Trace:
[  225.195503][ T6218]  <TASK>
[  225.195511][ T6218]  dump_stack_lvl+0xe8/0x150
[  225.195539][ T6218]  should_fail_ex+0x40c/0x560
[  225.195566][ T6218]  should_failslab+0xa8/0x100
[  225.195586][ T6218]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  225.195609][ T6218]  ? security_file_alloc+0x34/0x310
[  225.195626][ T6218]  ? security_file_alloc+0x34/0x310
[  225.195649][ T6218]  security_file_alloc+0x34/0x310
[  225.195669][ T6218]  init_file+0x90/0x2b0
[  225.195687][ T6218]  alloc_empty_file+0x74/0x1d0
[  225.195703][ T6218]  alloc_file_pseudo+0x115/0x1e0
[  225.195722][ T6218]  ? __pfx_alloc_file_pseudo+0x10/0x10
[  225.195738][ T6218]  ? __raw_spin_lock_init+0x45/0x100
[  225.195764][ T6218]  sock_alloc_file+0xb8/0x2e0
[  225.195869][ T6218]  xs_local_connect+0x179/0x810
[  225.195909][ T6218]  ? __pfx_xs_local_connect+0x10/0x10
[  225.195930][ T6218]  ? do_raw_spin_unlock+0xf5/0x210
[  225.195956][ T6218]  xprt_connect+0x613/0x850
[  225.195979][ T6218]  ? __pfx_call_connect+0x10/0x10
[  225.196000][ T6218]  __rpc_execute+0x526/0x1280
[  225.196034][ T6218]  ? __pfx___rpc_execute+0x10/0x10
[  225.196055][ T6218]  ? rpc_task_get_xprt+0x26/0x250
[  225.196075][ T6218]  ? rpc_make_runnable+0xae/0x1c0
[  225.196098][ T6218]  rpc_execute+0x1c1/0x390
[  225.196121][ T6218]  rpc_run_task+0x4a6/0x660
[  225.196139][ T6218]  rpc_create_xprt+0x533/0xa90
[  225.196157][ T6218]  ? __pfx_rpc_create_xprt+0x10/0x10
[  225.196188][ T6218]  ? rcu_is_watching+0x15/0xb0
[  225.196207][ T6218]  ? trace_kmalloc+0x2a/0xf0
[  225.196233][ T6218]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  225.196253][ T6218]  ? xprt_create_transport+0x39b/0x5f0
[  225.196280][ T6218]  ? xprt_create_transport+0x438/0x5f0
[  225.198431][ T6218]  rpc_create+0x649/0x900
[  225.198458][ T6218]  ? __pfx_rpc_create+0x10/0x10
[  225.198508][ T6218]  ? __lock_acquire+0x683/0x2cf0
[  225.198534][ T6218]  rpcb_create_af_local+0x1c7/0x3c0
[  225.198551][ T6218]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  225.198585][ T6218]  ? do_raw_spin_unlock+0xf5/0x210
[  225.198609][ T6218]  rpcb_create_local+0x28f/0x670
[  225.198627][ T6218]  ? __pfx_rpcb_create_local+0x10/0x10
[  225.198642][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  225.198660][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.198679][ T6218]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  225.198696][ T6218]  ? __percpu_counter_init_many+0x35f/0x380
[  225.198724][ T6218]  ? __svc_create+0x88f/0x990
[  225.198749][ T6218]  svc_bind+0x1b4/0x230
[  225.198770][ T6218]  nfsd_create_serv+0x581/0x840
[  225.198790][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  225.198808][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.198829][ T6218]  ? __pfx_nfsd_create_serv+0x10/0x10
[  225.198851][ T6218]  ? net_generic+0x1e/0x240
[  225.198883][ T6218]  ? net_generic+0x1e/0x240
[  225.198906][ T6218]  ? net_generic+0x1e/0x240
[  225.198931][ T6218]  nfsd_svc+0x189/0x780
[  225.198956][ T6218]  write_threads+0x3cd/0x5a0
[  225.198971][ T6218]  ? __might_fault+0xaf/0x130
[  225.198993][ T6218]  ? __pfx_write_threads+0x10/0x10
[  225.199023][ T6218]  ? _copy_from_user+0x94/0xb0
[  225.199042][ T6218]  ? simple_transaction_get+0x12d/0x160
[  225.199061][ T6218]  nfsctl_transaction_write+0x10f/0x160
[  225.199079][ T6218]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  225.199095][ T6218]  vfs_write+0x296/0xba0
[  225.199122][ T6218]  ? __pfx_vfs_write+0x10/0x10
[  225.199281][ T6218]  ? _raw_spin_unlock_irq+0x23/0x50
[  225.199390][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.199417][ T6218]  ksys_write+0x150/0x270
[  225.199441][ T6218]  ? __pfx_ksys_write+0x10/0x10
[  225.199554][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.199577][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.199595][ T6218]  do_syscall_64+0x174/0x580
[  225.199615][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.199631][ T6218]  ? clear_bhb_loop+0x70/0xc0
[  225.199651][ T6218]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.199667][ T6218] RIP: 0033:0x7f3343939df7
[  225.199684][ T6218] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  225.199698][ T6218] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  225.199716][ T6218] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  225.199728][ T6218] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  225.199739][ T6218] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  225.199748][ T6218] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  225.199759][ T6218] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbdc
[  225.199783][ T6218]  </TASK>
[  225.433207][ T6218] FAULT_INJECTION: forcing a failure.
[  225.433207][ T6218] name failslab, interval 1, probability 5, space 0, times -1
[  225.476303][ T6218] CPU: 1 UID: 0 PID: 6218 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  225.476326][ T6218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  225.476335][ T6218] Call Trace:
[  225.476342][ T6218]  <TASK>
[  225.476350][ T6218]  dump_stack_lvl+0xe8/0x150
[  225.476378][ T6218]  should_fail_ex+0x40c/0x560
[  225.476402][ T6218]  should_failslab+0xa8/0x100
[  225.476419][ T6218]  __kmalloc_cache_noprof+0xa8/0x660
[  225.476443][ T6218]  ? kobject_uevent_env+0x289/0x9e0
[  225.476457][ T6218]  ? kobject_uevent_env+0x289/0x9e0
[  225.476474][ T6218]  kobject_uevent_env+0x289/0x9e0
[  225.476494][ T6218]  rpc_sysfs_xprt_switch_destroy+0x51/0x90
[  225.476516][ T6218]  xprt_switch_put+0x33d/0x3c0
[  225.476538][ T6218]  rpc_release_client+0x350/0x6a0
[  225.476559][ T6218]  rpc_shutdown_client+0x4c6/0x6c0
[  225.476576][ T6218]  ? __pfx_rpc_shutdown_client+0x10/0x10
[  225.476590][ T6218]  ? kmem_cache_free+0x182/0x650
[  225.476609][ T6218]  ? rpc_task_get_xprt+0x26/0x250
[  225.476627][ T6218]  ? __pfx_mempool_free_slab+0x10/0x10
[  225.476647][ T6218]  ? mempool_free+0xec/0x130
[  225.476666][ T6218]  ? __pfx_mempool_free+0x10/0x10
[  225.476683][ T6218]  ? put_rpccred+0x74/0x960
[  225.476704][ T6218]  ? rpc_final_put_task+0x1e4/0x220
[  225.476723][ T6218]  rpc_create_xprt+0x612/0xa90
[  225.476739][ T6218]  ? __pfx_rpc_create_xprt+0x10/0x10
[  225.476766][ T6218]  ? rcu_is_watching+0x15/0xb0
[  225.476785][ T6218]  ? trace_kmalloc+0x2a/0xf0
[  225.476808][ T6218]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  225.476827][ T6218]  ? xprt_create_transport+0x39b/0x5f0
[  225.476852][ T6218]  ? xprt_create_transport+0x438/0x5f0
[  225.476869][ T6218]  rpc_create+0x649/0x900
[  225.476892][ T6218]  ? __pfx_rpc_create+0x10/0x10
[  225.476934][ T6218]  ? __lock_acquire+0x683/0x2cf0
[  225.476955][ T6218]  rpcb_create_af_local+0x1c7/0x3c0
[  225.476982][ T6218]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  225.477011][ T6218]  ? do_raw_spin_unlock+0xf5/0x210
[  225.477033][ T6218]  rpcb_create_local+0x28f/0x670
[  225.477049][ T6218]  ? __pfx_rpcb_create_local+0x10/0x10
[  225.477063][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  225.477080][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.477097][ T6218]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  225.477113][ T6218]  ? __percpu_counter_init_many+0x35f/0x380
[  225.477137][ T6218]  ? __svc_create+0x88f/0x990
[  225.477159][ T6218]  svc_bind+0x1b4/0x230
[  225.477178][ T6218]  nfsd_create_serv+0x581/0x840
[  225.477198][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  225.477213][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.477233][ T6218]  ? __pfx_nfsd_create_serv+0x10/0x10
[  225.477287][ T6218]  ? net_generic+0x1e/0x240
[  225.477307][ T6218]  ? net_generic+0x1e/0x240
[  225.477329][ T6218]  ? net_generic+0x1e/0x240
[  225.477352][ T6218]  nfsd_svc+0x189/0x780
[  225.477376][ T6218]  write_threads+0x3cd/0x5a0
[  225.477389][ T6218]  ? __might_fault+0xaf/0x130
[  225.477409][ T6218]  ? __pfx_write_threads+0x10/0x10
[  225.477434][ T6218]  ? _copy_from_user+0x94/0xb0
[  225.477451][ T6218]  ? simple_transaction_get+0x12d/0x160
[  225.477469][ T6218]  nfsctl_transaction_write+0x10f/0x160
[  225.477484][ T6218]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  225.477500][ T6218]  vfs_write+0x296/0xba0
[  225.477524][ T6218]  ? __pfx_vfs_write+0x10/0x10
[  225.477546][ T6218]  ? _raw_spin_unlock_irq+0x23/0x50
[  225.477562][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.477584][ T6218]  ksys_write+0x150/0x270
[  225.477604][ T6218]  ? __pfx_ksys_write+0x10/0x10
[  225.477649][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.477666][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.477681][ T6218]  do_syscall_64+0x174/0x580
[  225.477699][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.477713][ T6218]  ? clear_bhb_loop+0x70/0xc0
[  225.477731][ T6218]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.477744][ T6218] RIP: 0033:0x7f3343939df7
[  225.477760][ T6218] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  225.477773][ T6218] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  225.477789][ T6218] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  225.477799][ T6218] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  225.477808][ T6218] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  225.477816][ T6218] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  225.477825][ T6218] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbdc
[  225.477846][ T6218]  </TASK>
[  225.703057][ T6218] FAULT_INJECTION: forcing a failure.
[  225.703057][ T6218] name failslab, interval 1, probability 5, space 0, times -1
[  225.708216][ T6218] CPU: 1 UID: 0 PID: 6218 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  225.708332][ T6218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  225.708341][ T6218] Call Trace:
[  225.708348][ T6218]  <TASK>
[  225.708354][ T6218]  dump_stack_lvl+0xe8/0x150
[  225.708376][ T6218]  should_fail_ex+0x40c/0x560
[  225.708397][ T6218]  should_failslab+0xa8/0x100
[  225.708413][ T6218]  __kmalloc_node_track_caller_noprof+0x100/0x730
[  225.708432][ T6218]  ? __pfx_snprintf+0x10/0x10
[  225.708444][ T6218]  ? xs_format_common_peer_ports+0x15c/0x320
[  225.708461][ T6218]  ? xs_format_common_peer_ports+0x15c/0x320
[  225.708480][ T6218]  kstrdup+0x42/0x100
[  225.708498][ T6218]  xs_format_common_peer_ports+0x15c/0x320
[  225.708515][ T6218]  ? __pfx_xs_format_common_peer_ports+0x10/0x10
[  225.708529][ T6218]  ? trace_kmalloc+0x2a/0xf0
[  225.708557][ T6218]  xs_format_peer_addresses+0x427/0x530
[  225.708571][ T6218]  ? __pfx_xs_format_peer_addresses+0x10/0x10
[  225.708594][ T6218]  ? timer_init_key+0x161/0x2c0
[  225.708613][ T6218]  xs_setup_tcp+0x751/0x920
[  225.708631][ T6218]  ? __pfx_xs_setup_tcp+0x10/0x10
[  225.708646][ T6218]  ? preempt_schedule_common+0x82/0xd0
[  225.708661][ T6218]  ? preempt_schedule_thunk+0x16/0x40
[  225.708678][ T6218]  xprt_create_transport+0x166/0x5f0
[  225.708692][ T6218]  rpc_create+0x4ff/0x900
[  225.708711][ T6218]  ? __pfx_rpc_create+0x10/0x10
[  225.708756][ T6218]  rpcb_create_local+0x3ab/0x670
[  225.708771][ T6218]  ? __pfx_rpcb_create_local+0x10/0x10
[  225.708790][ T6218]  ? __svc_create+0x88f/0x990
[  225.708809][ T6218]  svc_bind+0x1b4/0x230
[  225.708825][ T6218]  nfsd_create_serv+0x581/0x840
[  225.708843][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  225.708856][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.708875][ T6218]  ? __pfx_nfsd_create_serv+0x10/0x10
[  225.708892][ T6218]  ? net_generic+0x1e/0x240
[  225.708908][ T6218]  ? net_generic+0x1e/0x240
[  225.708927][ T6218]  ? net_generic+0x1e/0x240
[  225.708955][ T6218]  nfsd_svc+0x189/0x780
[  225.708976][ T6218]  write_threads+0x3cd/0x5a0
[  225.708988][ T6218]  ? __might_fault+0xaf/0x130
[  225.709005][ T6218]  ? __pfx_write_threads+0x10/0x10
[  225.709029][ T6218]  ? _copy_from_user+0x94/0xb0
[  225.709045][ T6218]  ? simple_transaction_get+0x12d/0x160
[  225.709060][ T6218]  nfsctl_transaction_write+0x10f/0x160
[  225.709075][ T6218]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  225.709088][ T6218]  vfs_write+0x296/0xba0
[  225.709109][ T6218]  ? __pfx_vfs_write+0x10/0x10
[  225.709129][ T6218]  ? _raw_spin_unlock_irq+0x23/0x50
[  225.709142][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.709161][ T6218]  ksys_write+0x150/0x270
[  225.709177][ T6218]  ? __pfx_ksys_write+0x10/0x10
[  225.709197][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.709210][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.709224][ T6218]  do_syscall_64+0x174/0x580
[  225.709276][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.709291][ T6218]  ? clear_bhb_loop+0x70/0xc0
[  225.709308][ T6218]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.709322][ T6218] RIP: 0033:0x7f3343939df7
[  225.709336][ T6218] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  225.709349][ T6218] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  225.709365][ T6218] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  225.709375][ T6218] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  225.709385][ T6218] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  225.709394][ T6218] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  225.709403][ T6218] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbdc
[  225.709425][ T6218]  </TASK>
[  225.709533][ T6218] FAULT_INJECTION: forcing a failure.
[  225.709533][ T6218] name failslab, interval 1, probability 5, space 0, times -1
[  225.888501][ T6218] CPU: 1 UID: 0 PID: 6218 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  225.888521][ T6218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  225.888530][ T6218] Call Trace:
[  225.888537][ T6218]  <TASK>
[  225.888544][ T6218]  dump_stack_lvl+0xe8/0x150
[  225.888569][ T6218]  should_fail_ex+0x40c/0x560
[  225.888596][ T6218]  should_failslab+0xa8/0x100
[  225.888614][ T6218]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  225.888634][ T6218]  ? kstrdup+0x81/0x100
[  225.888655][ T6218]  ? __kernfs_new_node+0xe6/0x980
[  225.888673][ T6218]  ? __kernfs_new_node+0xe6/0x980
[  225.888695][ T6218]  __kernfs_new_node+0xe6/0x980
[  225.888721][ T6218]  ? __pfx___kernfs_new_node+0x10/0x10
[  225.888740][ T6218]  ? kernfs_root+0x1c/0x230
[  225.888762][ T6218]  ? kernfs_root+0x1c/0x230
[  225.888779][ T6218]  ? kernfs_root+0x1c/0x230
[  225.888795][ T6218]  ? kernfs_root+0x1c/0x230
[  225.888816][ T6218]  kernfs_create_dir_ns+0xfe/0x230
[  225.888840][ T6218]  sysfs_create_dir_ns+0x12f/0x2a0
[  225.888861][ T6218]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  225.888882][ T6218]  ? do_raw_spin_unlock+0xf5/0x210
[  225.888904][ T6218]  kobject_add_internal+0x622/0xcd0
[  225.888930][ T6218]  kobject_init_and_add+0x12b/0x1a0
[  225.888955][ T6218]  ? __pfx_kobject_init_and_add+0x10/0x10
[  225.888975][ T6218]  ? __kmalloc_cache_noprof+0x150/0x660
[  225.888995][ T6218]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  225.889015][ T6218]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  225.889038][ T6218]  rpc_sysfs_xprt_switch_setup+0x169/0x2b0
[  225.889062][ T6218]  xprt_switch_alloc+0x238/0x590
[  225.889084][ T6218]  rpc_create_xprt+0x1c7/0xa90
[  225.889101][ T6218]  ? __pfx_rpc_create_xprt+0x10/0x10
[  225.889129][ T6218]  ? rcu_is_watching+0x15/0xb0
[  225.889146][ T6218]  ? trace_kmalloc+0x2a/0xf0
[  225.889168][ T6218]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  225.889190][ T6218]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  225.889244][ T6218]  ? xprt_create_transport+0x39b/0x5f0
[  225.889261][ T6218]  ? xprt_create_transport+0x39b/0x5f0
[  225.889276][ T6218]  ? kstrdup+0x81/0x100
[  225.889296][ T6218]  ? __asan_memcpy+0x40/0x70
[  225.889320][ T6218]  ? xprt_create_transport+0x438/0x5f0
[  225.889338][ T6218]  rpc_create+0x649/0x900
[  225.889360][ T6218]  ? __pfx_rpc_create+0x10/0x10
[  225.889414][ T6218]  rpcb_create_local+0x3ab/0x670
[  225.889441][ T6218]  ? __pfx_rpcb_create_local+0x10/0x10
[  225.889464][ T6218]  ? __svc_create+0x88f/0x990
[  225.889487][ T6218]  svc_bind+0x1b4/0x230
[  225.889504][ T6218]  nfsd_create_serv+0x581/0x840
[  225.889523][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  225.889538][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.889558][ T6218]  ? __pfx_nfsd_create_serv+0x10/0x10
[  225.889577][ T6218]  ? net_generic+0x1e/0x240
[  225.889611][ T6218]  ? net_generic+0x1e/0x240
[  225.889633][ T6218]  ? net_generic+0x1e/0x240
[  225.889657][ T6218]  nfsd_svc+0x189/0x780
[  225.889682][ T6218]  write_threads+0x3cd/0x5a0
[  225.889697][ T6218]  ? __might_fault+0xaf/0x130
[  225.889718][ T6218]  ? __pfx_write_threads+0x10/0x10
[  225.889745][ T6218]  ? _copy_from_user+0x94/0xb0
[  225.889762][ T6218]  ? simple_transaction_get+0x12d/0x160
[  225.889778][ T6218]  nfsctl_transaction_write+0x10f/0x160
[  225.889793][ T6218]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  225.889807][ T6218]  vfs_write+0x296/0xba0
[  225.889830][ T6218]  ? __pfx_vfs_write+0x10/0x10
[  225.889853][ T6218]  ? _raw_spin_unlock_irq+0x23/0x50
[  225.889869][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.889892][ T6218]  ksys_write+0x150/0x270
[  225.889911][ T6218]  ? __pfx_ksys_write+0x10/0x10
[  225.889933][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.889948][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.889963][ T6218]  do_syscall_64+0x174/0x580
[  225.889979][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.889994][ T6218]  ? clear_bhb_loop+0x70/0xc0
[  225.890011][ T6218]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.890025][ T6218] RIP: 0033:0x7f3343939df7
[  225.890040][ T6218] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  225.890053][ T6218] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  225.890069][ T6218] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  225.890079][ T6218] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  225.890088][ T6218] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  225.890095][ T6218] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  225.890104][ T6218] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbdc
[  225.890127][ T6218]  </TASK>
[  225.890158][ T6218] kobject: kobject_add_internal failed for switch-23 (error: -12 parent: xprt-switches)
[  226.100551][ T6218] FAULT_INJECTION: forcing a failure.
[  226.100551][ T6218] name failslab, interval 1, probability 5, space 0, times -1
[  226.105574][ T6218] CPU: 1 UID: 0 PID: 6218 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  226.105597][ T6218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  226.105607][ T6218] Call Trace:
[  226.105615][ T6218]  <TASK>
[  226.105622][ T6218]  dump_stack_lvl+0xe8/0x150
[  226.105648][ T6218]  should_fail_ex+0x40c/0x560
[  226.105674][ T6218]  should_failslab+0xa8/0x100
[  226.105692][ T6218]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  226.105713][ T6218]  ? rpc_new_task+0xf3/0x800
[  226.105743][ T6218]  ? rpc_new_task+0xf3/0x800
[  226.105766][ T6218]  rpc_new_task+0xf3/0x800
[  226.105787][ T6218]  ? rcu_is_watching+0x15/0xb0
[  226.105804][ T6218]  ? trace_rpc_clnt_new+0x84/0x200
[  226.105821][ T6218]  ? __pfx_rpc_new_task+0x10/0x10
[  226.105840][ T6218]  ? rpc_new_client+0x940/0xc50
[  226.105861][ T6218]  rpc_run_task+0x22/0x660
[  226.105880][ T6218]  rpc_bind_new_program+0x3ae/0x530
[  226.105895][ T6218]  ? __pfx_rpc_create+0x10/0x10
[  226.105916][ T6218]  ? __pfx_rpc_bind_new_program+0x10/0x10
[  226.105959][ T6218]  rpcb_create_local+0x3ed/0x670
[  226.105975][ T6218]  ? __pfx_rpcb_create_local+0x10/0x10
[  226.105997][ T6218]  ? __svc_create+0x88f/0x990
[  226.106021][ T6218]  svc_bind+0x1b4/0x230
[  226.106039][ T6218]  nfsd_create_serv+0x581/0x840
[  226.106059][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  226.106077][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  226.106095][ T6218]  ? __pfx_nfsd_create_serv+0x10/0x10
[  226.106113][ T6218]  ? net_generic+0x1e/0x240
[  226.106131][ T6218]  ? net_generic+0x1e/0x240
[  226.106153][ T6218]  ? net_generic+0x1e/0x240
[  226.106177][ T6218]  nfsd_svc+0x189/0x780
[  226.106240][ T6218]  write_threads+0x3cd/0x5a0
[  226.106254][ T6218]  ? __might_fault+0xaf/0x130
[  226.106273][ T6218]  ? __pfx_write_threads+0x10/0x10
[  226.106297][ T6218]  ? _copy_from_user+0x94/0xb0
[  226.106314][ T6218]  ? simple_transaction_get+0x12d/0x160
[  226.106391][ T6218]  nfsctl_transaction_write+0x10f/0x160
[  226.106409][ T6218]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  226.106423][ T6218]  vfs_write+0x296/0xba0
[  226.106447][ T6218]  ? __pfx_vfs_write+0x10/0x10
[  226.106470][ T6218]  ? _raw_spin_unlock_irq+0x23/0x50
[  226.106485][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  226.106509][ T6218]  ksys_write+0x150/0x270
[  226.106529][ T6218]  ? __pfx_ksys_write+0x10/0x10
[  226.106551][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.106566][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.106581][ T6218]  do_syscall_64+0x174/0x580
[  226.106597][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.106612][ T6218]  ? clear_bhb_loop+0x70/0xc0
[  226.106630][ T6218]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.106645][ T6218] RIP: 0033:0x7f3343939df7
[  226.106661][ T6218] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  226.106674][ T6218] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  226.106691][ T6218] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  226.106701][ T6218] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  226.106709][ T6218] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  226.106727][ T6218] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  226.106737][ T6218] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbdc
[  226.106759][ T6218]  </TASK>
[  226.309160][ T6218] FAULT_INJECTION: forcing a failure.
[  226.309160][ T6218] name failslab, interval 1, probability 5, space 0, times -1
[  226.325743][ T6218] CPU: 0 UID: 0 PID: 6218 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  226.325768][ T6218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  226.325778][ T6218] Call Trace:
[  226.325785][ T6218]  <TASK>
[  226.325826][ T6218]  dump_stack_lvl+0xe8/0x150
[  226.325855][ T6218]  should_fail_ex+0x40c/0x560
[  226.325883][ T6218]  should_failslab+0xa8/0x100
[  226.325902][ T6218]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  226.325921][ T6218]  ? kmem_cache_free+0x182/0x650
[  226.325943][ T6218]  ? rpc_new_task+0xf3/0x800
[  226.325961][ T6218]  ? rpc_new_task+0xf3/0x800
[  226.326007][ T6218]  rpc_new_task+0xf3/0x800
[  226.326020][ T6218]  ? __lock_acquire+0x683/0x2cf0
[  226.326034][ T6218]  ? __pfx_rpc_new_task+0x10/0x10
[  226.326094][ T6218]  rpc_run_task+0x22/0x660
[  226.326115][ T6218]  rpc_call_sync+0x10f/0x200
[  226.326198][ T6218]  ? __pfx_rpc_call_sync+0x10/0x10
[  226.326222][ T6218]  ? net_generic+0x1e/0x240
[  226.326237][ T6218]  ? net_generic+0x1e/0x240
[  226.326256][ T6218]  rpcb_register+0x2d0/0x530
[  226.326314][ T6218]  ? __pfx_rpcb_register+0x10/0x10
[  226.326327][ T6218]  ? net_generic+0x1e/0x240
[  226.326381][ T6218]  ? rpcb_create_local+0x4ee/0x670
[  226.326400][ T6218]  ? __pfx_rpcb_create_local+0x10/0x10
[  226.326458][ T6218]  svc_unregister+0x24d/0x780
[  226.326487][ T6218]  svc_bind+0x1e9/0x230
[  226.326572][ T6218]  nfsd_create_serv+0x581/0x840
[  226.326596][ T6218]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  226.326615][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  226.326672][ T6218]  ? __pfx_nfsd_create_serv+0x10/0x10
[  226.326727][ T6218]  ? net_generic+0x1e/0x240
[  226.326747][ T6218]  ? net_generic+0x1e/0x240
[  226.326839][ T6218]  ? net_generic+0x1e/0x240
[  226.326866][ T6218]  nfsd_svc+0x189/0x780
[  226.326925][ T6218]  write_threads+0x3cd/0x5a0
[  226.326974][ T6218]  ? __might_fault+0xaf/0x130
[  226.326996][ T6218]  ? __pfx_write_threads+0x10/0x10
[  226.327059][ T6218]  ? _copy_from_user+0x94/0xb0
[  226.327109][ T6218]  ? simple_transaction_get+0x12d/0x160
[  226.327130][ T6218]  nfsctl_transaction_write+0x10f/0x160
[  226.327147][ T6218]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  226.327200][ T6218]  vfs_write+0x296/0xba0
[  226.327228][ T6218]  ? __pfx_vfs_write+0x10/0x10
[  226.327305][ T6218]  ? _raw_spin_unlock_irq+0x23/0x50
[  226.327324][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  226.327383][ T6218]  ksys_write+0x150/0x270
[  226.327405][ T6218]  ? __pfx_ksys_write+0x10/0x10
[  226.327428][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.327480][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.327497][ T6218]  do_syscall_64+0x174/0x580
[  226.327515][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.327564][ T6218]  ? clear_bhb_loop+0x70/0xc0
[  226.327581][ T6218]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.327595][ T6218] RIP: 0033:0x7f3343939df7
[  226.327610][ T6218] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  226.327621][ T6218] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  226.327638][ T6218] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  226.327648][ T6218] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  226.327656][ T6218] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  226.327664][ T6218] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  226.327672][ T6218] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbdc
[  226.327693][ T6218]  </TASK>
[  226.500306][ T6218] FAULT_INJECTION: forcing a failure.
[  226.500306][ T6218] name failslab, interval 1, probability 5, space 0, times -1
[  226.507049][ T6218] CPU: 0 UID: 0 PID: 6218 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  226.507072][ T6218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  226.507081][ T6218] Call Trace:
[  226.507090][ T6218]  <TASK>
[  226.507097][ T6218]  dump_stack_lvl+0xe8/0x150
[  226.507124][ T6218]  should_fail_ex+0x40c/0x560
[  226.507177][ T6218]  should_failslab+0xa8/0x100
[  226.507197][ T6218]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  226.507218][ T6218]  ? __kernfs_new_node+0xe6/0x980
[  226.507237][ T6218]  ? __kernfs_new_node+0xe6/0x980
[  226.507262][ T6218]  __kernfs_new_node+0xe6/0x980
[  226.507287][ T6218]  ? __pfx___kernfs_new_node+0x10/0x10
[  226.507306][ T6218]  ? kernfs_root+0x1c/0x230
[  226.507327][ T6218]  ? kernfs_root+0x1c/0x230
[  226.507344][ T6218]  ? kernfs_root+0x1c/0x230
[  226.507358][ T6218]  ? kernfs_root+0x1c/0x230
[  226.507378][ T6218]  kernfs_new_node+0xea/0x140
[  226.507399][ T6218]  __kernfs_create_file+0x4b/0x2e0
[  226.507414][ T6218]  sysfs_add_file_mode_ns+0x237/0x300
[  226.507434][ T6218]  internal_create_group+0x679/0x1180
[  226.507457][ T6218]  ? kernfs_create_dir_ns+0x1d5/0x230
[  226.507568][ T6218]  ? __pfx_internal_create_group+0x10/0x10
[  226.507605][ T6218]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  226.507675][ T6218]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  226.507703][ T6218]  sysfs_create_groups+0x59/0x120
[  226.507722][ T6218]  kobject_add_internal+0x669/0xcd0
[  226.507753][ T6218]  kobject_init_and_add+0x12b/0x1a0
[  226.507777][ T6218]  ? __pfx_kobject_init_and_add+0x10/0x10
[  226.507797][ T6218]  ? kernfs_remove_by_name_ns+0x101/0x140
[  226.507820][ T6218]  ? kernfs_remove_by_name_ns+0x101/0x140
[  226.507842][ T6218]  sysfs_slab_add+0x7b/0x260
[  226.507859][ T6218]  do_kmem_cache_create+0x8bf/0x970
[  226.507897][ T6218]  __kmem_cache_create_args+0x307/0x440
[  226.507918][ T6218]  nfsd_file_cache_init+0x197/0x530
[  226.507938][ T6218]  ? __pfx_nfsd_file_cache_init+0x10/0x10
[  226.507955][ T6218]  ? net_generic+0x1e/0x240
[  226.507978][ T6218]  ? net_generic+0x1e/0x240
[  226.507995][ T6218]  ? net_generic+0x1e/0x240
[  226.508011][ T6218]  ? net_generic+0x1e/0x240
[  226.508062][ T6218]  ? net_generic+0x1f4/0x240
[  226.508101][ T6218]  nfsd_svc+0x315/0x780
[  226.508125][ T6218]  write_threads+0x3cd/0x5a0
[  226.508141][ T6218]  ? __might_fault+0xaf/0x130
[  226.508192][ T6218]  ? __pfx_write_threads+0x10/0x10
[  226.508218][ T6218]  ? _copy_from_user+0x94/0xb0
[  226.508235][ T6218]  ? simple_transaction_get+0x12d/0x160
[  226.508251][ T6218]  nfsctl_transaction_write+0x10f/0x160
[  226.508265][ T6218]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  226.508278][ T6218]  vfs_write+0x296/0xba0
[  226.508301][ T6218]  ? __pfx_vfs_write+0x10/0x10
[  226.508323][ T6218]  ? _raw_spin_unlock_irq+0x23/0x50
[  226.508439][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  226.508465][ T6218]  ksys_write+0x150/0x270
[  226.508484][ T6218]  ? __pfx_ksys_write+0x10/0x10
[  226.508505][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.508520][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.508533][ T6218]  do_syscall_64+0x174/0x580
[  226.508550][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.508565][ T6218]  ? clear_bhb_loop+0x70/0xc0
[  226.508582][ T6218]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.508595][ T6218] RIP: 0033:0x7f3343939df7
[  226.508610][ T6218] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  226.508624][ T6218] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  226.508639][ T6218] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  226.508651][ T6218] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  226.508659][ T6218] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  226.508668][ T6218] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  226.508677][ T6218] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbdc
[  226.508698][ T6218]  </TASK>
[  226.698035][ T6218] kobject: kobject_add_internal failed for nfsd_file (error: -12 parent: slab)
[  226.701487][ T6218] SLUB: Unable to add cache nfsd_file to sysfs
[  226.704489][ T6218] FAULT_INJECTION: forcing a failure.
[  226.704489][ T6218] name failslab, interval 1, probability 5, space 0, times -1
[  226.709683][ T6218] CPU: 0 UID: 0 PID: 6218 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  226.709704][ T6218] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  226.709714][ T6218] Call Trace:
[  226.709721][ T6218]  <TASK>
[  226.709729][ T6218]  dump_stack_lvl+0xe8/0x150
[  226.709756][ T6218]  should_fail_ex+0x40c/0x560
[  226.709785][ T6218]  should_failslab+0xa8/0x100
[  226.709805][ T6218]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  226.709828][ T6218]  ? __kernfs_new_node+0xe6/0x980
[  226.709846][ T6218]  ? __kernfs_new_node+0xe6/0x980
[  226.709872][ T6218]  __kernfs_new_node+0xe6/0x980
[  226.709896][ T6218]  ? __pfx___kernfs_new_node+0x10/0x10
[  226.709912][ T6218]  ? kernfs_root+0x1c/0x230
[  226.709931][ T6218]  ? kernfs_root+0x1c/0x230
[  226.709949][ T6218]  ? kernfs_root+0x1c/0x230
[  226.709966][ T6218]  ? kernfs_root+0x1c/0x230
[  226.709986][ T6218]  kernfs_new_node+0xea/0x140
[  226.710009][ T6218]  __kernfs_create_file+0x4b/0x2e0
[  226.710027][ T6218]  sysfs_add_file_mode_ns+0x237/0x300
[  226.710051][ T6218]  internal_create_group+0x679/0x1180
[  226.710079][ T6218]  ? kernfs_create_dir_ns+0x1d5/0x230
[  226.710102][ T6218]  ? __pfx_internal_create_group+0x10/0x10
[  226.710120][ T6218]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  226.711613][ T6218]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  226.711635][ T6218]  sysfs_create_groups+0x59/0x120
[  226.711656][ T6218]  kobject_add_internal+0x669/0xcd0
[  226.711684][ T6218]  kobject_init_and_add+0x12b/0x1a0
[  226.711709][ T6218]  ? __pfx_kobject_init_and_add+0x10/0x10
[  226.711731][ T6218]  ? kernfs_remove_by_name_ns+0x101/0x140
[  226.711753][ T6218]  ? kernfs_remove_by_name_ns+0x101/0x140
[  226.711775][ T6218]  sysfs_slab_add+0x7b/0x260
[  226.711793][ T6218]  do_kmem_cache_create+0x8bf/0x970
[  226.711814][ T6218]  __kmem_cache_create_args+0x307/0x440
[  226.711835][ T6218]  nfsd_file_cache_init+0x1d9/0x530
[  226.711855][ T6218]  ? __pfx_nfsd_file_cache_init+0x10/0x10
[  226.711872][ T6218]  ? net_generic+0x1e/0x240
[  226.711899][ T6218]  ? net_generic+0x1e/0x240
[  226.711917][ T6218]  ? net_generic+0x1e/0x240
[  226.711933][ T6218]  ? net_generic+0x1e/0x240
[  226.711952][ T6218]  ? net_generic+0x1f4/0x240
[  226.711972][ T6218]  nfsd_svc+0x315/0x780
[  226.711996][ T6218]  write_threads+0x3cd/0x5a0
[  226.712011][ T6218]  ? __might_fault+0xaf/0x130
[  226.712031][ T6218]  ? __pfx_write_threads+0x10/0x10
[  226.712059][ T6218]  ? _copy_from_user+0x94/0xb0
[  226.712077][ T6218]  ? simple_transaction_get+0x12d/0x160
[  226.712096][ T6218]  nfsctl_transaction_write+0x10f/0x160
[  226.712112][ T6218]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  226.712155][ T6218]  vfs_write+0x296/0xba0
[  226.712179][ T6218]  ? __pfx_vfs_write+0x10/0x10
[  226.712200][ T6218]  ? _raw_spin_unlock_irq+0x23/0x50
[  226.712216][ T6218]  ? lockdep_hardirqs_on+0x7a/0x110
[  226.712237][ T6218]  ksys_write+0x150/0x270
[  226.712257][ T6218]  ? __pfx_ksys_write+0x10/0x10
[  226.712280][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.712299][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.712316][ T6218]  do_syscall_64+0x174/0x580
[  226.712334][ T6218]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.712363][ T6218]  ? clear_bhb_loop+0x70/0xc0
[  226.712382][ T6218]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  226.712397][ T6218] RIP: 0033:0x7f3343939df7
[  226.712414][ T6218] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  226.712428][ T6218] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  226.712445][ T6218] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  226.712457][ T6218] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  226.712467][ T6218] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  226.712476][ T6218] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  226.712486][ T6218] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbdc
[  226.712511][ T6218]  </TASK>
[  226.712805][ T6218] kobject: kobject_add_internal failed for nfsd_file_mark (error: -12 parent: slab)
[  226.892952][ T6218] SLUB: Unable to add cache nfsd_file_mark to sysfs
[  226.895910][ T6218] NFSD: Failed to start, no listeners configured.
[pid  5924] write(4, "tcp 2049\n", 9 <unfinished ...>
[pid  6218] <... write resumed>)        = -1 EIO (Input/output error)
[  227.184062][ T6213] FAULT_INJECTION: forcing a failure.
[  227.184062][ T6213] name failslab, interval 1, probability 5, space 0, times -1
[pid  6218] openat(AT_FDCWD, "/proc/self/make-it-fail", O_WRONLY) = 5
[  227.193292][ T6213] CPU: 0 UID: 0 PID: 6213 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  227.193314][ T6213] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  227.193324][ T6213] Call Trace:
[  227.193331][ T6213]  <TASK>
[  227.193338][ T6213]  dump_stack_lvl+0xe8/0x150
[  227.193367][ T6213]  should_fail_ex+0x40c/0x560
[  227.193394][ T6213]  should_failslab+0xa8/0x100
[  227.193414][ T6213]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  227.193434][ T6213]  ? kstrdup+0x81/0x100
[  227.193457][ T6213]  ? __kernfs_new_node+0xe6/0x980
[  227.193475][ T6213]  ? __kernfs_new_node+0xe6/0x980
[  227.193500][ T6213]  __kernfs_new_node+0xe6/0x980
[  227.193548][ T6213]  ? __pfx___kernfs_new_node+0x10/0x10
[  227.193577][ T6213]  ? kernfs_root+0x1c/0x230
[  227.193600][ T6213]  ? kernfs_root+0x1c/0x230
[  227.193655][ T6213]  ? kernfs_root+0x1c/0x230
[  227.193672][ T6213]  ? kernfs_root+0x1c/0x230
[  227.193696][ T6213]  kernfs_create_dir_ns+0xfe/0x230
[  227.193723][ T6213]  sysfs_create_dir_ns+0x12f/0x2a0
[  227.193747][ T6213]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  227.193770][ T6213]  ? do_raw_spin_unlock+0xf5/0x210
[  227.193794][ T6213]  kobject_add_internal+0x622/0xcd0
[  227.193844][ T6213]  kobject_init_and_add+0x12b/0x1a0
[  227.193872][ T6213]  ? __pfx_kobject_init_and_add+0x10/0x10
[  227.193896][ T6213]  ? __kmalloc_cache_noprof+0x150/0x660
[  227.193918][ T6213]  ? rpc_sysfs_xprt_setup+0xa7/0x260
[  227.193939][ T6213]  ? rpc_sysfs_xprt_setup+0xa7/0x260
[  227.193965][ T6213]  rpc_sysfs_xprt_setup+0x132/0x260
[  227.193989][ T6213]  xprt_switch_alloc+0x420/0x590
[  227.194013][ T6213]  rpc_create_xprt+0x1c7/0xa90
[  227.194032][ T6213]  ? __pfx_rpc_create_xprt+0x10/0x10
[  227.194061][ T6213]  ? rcu_is_watching+0x15/0xb0
[  227.195137][ T6213]  ? trace_kmalloc+0x2a/0xf0
[  227.195162][ T6213]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  227.195186][ T6213]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  227.195208][ T6213]  ? xprt_create_transport+0x39b/0x5f0
[  227.195225][ T6213]  ? xprt_create_transport+0x39b/0x5f0
[  227.195243][ T6213]  ? kstrdup+0x81/0x100
[  227.195265][ T6213]  ? __asan_memcpy+0x40/0x70
[  227.195292][ T6213]  ? xprt_create_transport+0x438/0x5f0
[  227.195311][ T6213]  rpc_create+0x649/0x900
[  227.195336][ T6213]  ? __pfx_rpc_create+0x10/0x10
[  227.195388][ T6213]  ? __lock_acquire+0x683/0x2cf0
[  227.195414][ T6213]  rpcb_create_af_local+0x1c7/0x3c0
[  227.195431][ T6213]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  227.195466][ T6213]  ? do_raw_spin_unlock+0xf5/0x210
[  227.195489][ T6213]  rpcb_create_local+0x268/0x670
[  227.195508][ T6213]  ? __pfx_rpcb_create_local+0x10/0x10
[  227.195523][ T6213]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  227.195542][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.195568][ T6213]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  227.195586][ T6213]  ? __percpu_counter_init_many+0x35f/0x380
[  227.195614][ T6213]  ? __svc_create+0x88f/0x990
[  227.195640][ T6213]  svc_bind+0x1b4/0x230
[  227.195662][ T6213]  nfsd_create_serv+0x581/0x840
[  227.195684][ T6213]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  227.195702][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.195723][ T6213]  ? __pfx_nfsd_create_serv+0x10/0x10
[  227.195746][ T6213]  ? net_generic+0x1e/0x240
[  227.195766][ T6213]  ? net_generic+0x1e/0x240
[  227.195791][ T6213]  ? net_generic+0x1e/0x240
[  227.195818][ T6213]  nfsd_svc+0x189/0x780
[  227.195845][ T6213]  write_threads+0x3cd/0x5a0
[  227.195861][ T6213]  ? __might_fault+0xaf/0x130
[  227.195883][ T6213]  ? __pfx_write_threads+0x10/0x10
[  227.195914][ T6213]  ? _copy_from_user+0x94/0xb0
[  227.195933][ T6213]  ? simple_transaction_get+0x12d/0x160
[  227.195953][ T6213]  nfsctl_transaction_write+0x10f/0x160
[  227.195971][ T6213]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  227.195988][ T6213]  vfs_write+0x296/0xba0
[  227.196015][ T6213]  ? __pfx_vfs_write+0x10/0x10
[  227.196042][ T6213]  ? _raw_spin_unlock_irq+0x23/0x50
[  227.196059][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.196112][ T6213]  ksys_write+0x150/0x270
[  227.196135][ T6213]  ? __pfx_ksys_write+0x10/0x10
[  227.196159][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.196176][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.196193][ T6213]  do_syscall_64+0x174/0x580
[  227.196212][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.196228][ T6213]  ? clear_bhb_loop+0x70/0xc0
[  227.196247][ T6213]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.196263][ T6213] RIP: 0033:0x7f3343939df7
[  227.196280][ T6213] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  227.196294][ T6213] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  227.196313][ T6213] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  227.196325][ T6213] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  227.196335][ T6213] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  227.196345][ T6213] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  227.196355][ T6213] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbc8
[  227.196380][ T6213]  </TASK>
[  227.197129][ T6213] kobject: kobject_add_internal failed for xprt-24-local (error: -12 parent: switch-23)
[pid  6218] write(5, "0", 1)            = 1
[  227.401508][ T6213] FAULT_INJECTION: forcing a failure.
[  227.401508][ T6213] name failslab, interval 1, probability 5, space 0, times -1
[  227.407043][ T6213] CPU: 0 UID: 0 PID: 6213 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  227.407093][ T6213] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  227.407184][ T6213] Call Trace:
[  227.407193][ T6213]  <TASK>
[  227.407212][ T6213]  dump_stack_lvl+0xe8/0x150
[  227.407241][ T6213]  should_fail_ex+0x40c/0x560
[  227.407270][ T6213]  should_failslab+0xa8/0x100
[  227.407289][ T6213]  __kmalloc_node_track_caller_noprof+0x100/0x730
[  227.407315][ T6213]  ? __lock_acquire+0x683/0x2cf0
[  227.407346][ T6213]  ? __kernfs_new_node+0xa9/0x980
[  227.407365][ T6213]  ? __kernfs_new_node+0xa9/0x980
[  227.407390][ T6213]  kstrdup+0x42/0x100
[  227.407413][ T6213]  __kernfs_new_node+0xa9/0x980
[  227.407441][ T6213]  ? __pfx___kernfs_new_node+0x10/0x10
[  227.407462][ T6213]  ? kernfs_root+0x1c/0x230
[  227.407531][ T6213]  ? kernfs_root+0x1c/0x230
[  227.407549][ T6213]  ? kernfs_root+0x1c/0x230
[  227.407566][ T6213]  ? kernfs_root+0x1c/0x230
[  227.407641][ T6213]  kernfs_create_dir_ns+0xfe/0x230
[  227.407666][ T6213]  sysfs_create_dir_ns+0x12f/0x2a0
[  227.407687][ T6213]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  227.407709][ T6213]  ? do_raw_spin_unlock+0xf5/0x210
[  227.407732][ T6213]  kobject_add_internal+0x622/0xcd0
[  227.407761][ T6213]  kobject_init_and_add+0x12b/0x1a0
[  227.407789][ T6213]  ? __pfx_kobject_init_and_add+0x10/0x10
[  227.407812][ T6213]  ? __kmalloc_cache_noprof+0x150/0x660
[  227.407832][ T6213]  ? rpc_sysfs_client_setup+0x106/0x310
[  227.407852][ T6213]  ? rpc_sysfs_client_setup+0x106/0x310
[  227.407878][ T6213]  rpc_sysfs_client_setup+0x191/0x310
[  227.407903][ T6213]  ? __pfx_rpc_sysfs_client_setup+0x10/0x10
[  227.407925][ T6213]  ? rpc_net_ns+0x1e/0x230
[  227.407942][ T6213]  ? rpc_net_ns+0x1e/0x230
[  227.407956][ T6213]  ? rpc_net_ns+0x1e/0x230
[  227.407976][ T6213]  rpc_new_client+0x716/0xc50
[  227.408002][ T6213]  rpc_create_xprt+0x29f/0xa90
[  227.408019][ T6213]  ? __pfx_rpc_create_xprt+0x10/0x10
[  227.408077][ T6213]  ? rcu_is_watching+0x15/0xb0
[  227.408098][ T6213]  ? trace_kmalloc+0x2a/0xf0
[  227.408122][ T6213]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  227.408145][ T6213]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  227.408166][ T6213]  ? xprt_create_transport+0x39b/0x5f0
[  227.408183][ T6213]  ? xprt_create_transport+0x39b/0x5f0
[  227.408199][ T6213]  ? kstrdup+0x81/0x100
[  227.408222][ T6213]  ? __asan_memcpy+0x40/0x70
[  227.408304][ T6213]  ? xprt_create_transport+0x438/0x5f0
[  227.408324][ T6213]  rpc_create+0x649/0x900
[  227.408349][ T6213]  ? __pfx_rpc_create+0x10/0x10
[  227.408397][ T6213]  ? __lock_acquire+0x683/0x2cf0
[  227.408421][ T6213]  rpcb_create_af_local+0x1c7/0x3c0
[  227.408438][ T6213]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  227.408471][ T6213]  ? do_raw_spin_unlock+0xf5/0x210
[  227.408493][ T6213]  rpcb_create_local+0x268/0x670
[  227.408512][ T6213]  ? __pfx_rpcb_create_local+0x10/0x10
[  227.408526][ T6213]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  227.408543][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.408562][ T6213]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  227.408579][ T6213]  ? __percpu_counter_init_many+0x35f/0x380
[  227.408606][ T6213]  ? __svc_create+0x88f/0x990
[  227.408630][ T6213]  svc_bind+0x1b4/0x230
[  227.408649][ T6213]  nfsd_create_serv+0x581/0x840
[  227.408670][ T6213]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  227.408688][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.408709][ T6213]  ? __pfx_nfsd_create_serv+0x10/0x10
[  227.408731][ T6213]  ? net_generic+0x1e/0x240
[  227.408751][ T6213]  ? net_generic+0x1e/0x240
[  227.408777][ T6213]  ? net_generic+0x1e/0x240
[  227.408803][ T6213]  nfsd_svc+0x189/0x780
[  227.408829][ T6213]  write_threads+0x3cd/0x5a0
[  227.408842][ T6213]  ? __might_fault+0xaf/0x130
[  227.408863][ T6213]  ? __pfx_write_threads+0x10/0x10
[  227.408893][ T6213]  ? _copy_from_user+0x94/0xb0
[  227.408912][ T6213]  ? simple_transaction_get+0x12d/0x160
[  227.408931][ T6213]  nfsctl_transaction_write+0x10f/0x160
[  227.408949][ T6213]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  227.408966][ T6213]  vfs_write+0x296/0xba0
[  227.408992][ T6213]  ? __pfx_vfs_write+0x10/0x10
[  227.409018][ T6213]  ? _raw_spin_unlock_irq+0x23/0x50
[  227.409041][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.409091][ T6213]  ksys_write+0x150/0x270
[  227.409112][ T6213]  ? __pfx_ksys_write+0x10/0x10
[  227.409136][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.409153][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.409170][ T6213]  do_syscall_64+0x174/0x580
[  227.409188][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.409203][ T6213]  ? clear_bhb_loop+0x70/0xc0
[  227.409222][ T6213]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.409238][ T6213] RIP: 0033:0x7f3343939df7
[  227.409255][ T6213] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  227.409268][ T6213] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  227.409286][ T6213] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  227.409297][ T6213] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  227.409306][ T6213] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  227.409315][ T6213] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  227.409325][ T6213] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbc8
[  227.409348][ T6213]  </TASK>
[  227.620278][ T6213] kobject: kobject_add_internal failed for clnt-23 (error: -12 parent: rpc-clients)
[  227.625345][ T6213] FAULT_INJECTION: forcing a failure.
[  227.625345][ T6213] name failslab, interval 1, probability 5, space 0, times -1
[  227.631950][ T6213] CPU: 0 UID: 0 PID: 6213 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  227.631970][ T6213] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  227.631980][ T6213] Call Trace:
[  227.631986][ T6213]  <TASK>
[  227.631993][ T6213]  dump_stack_lvl+0xe8/0x150
[  227.632021][ T6213]  should_fail_ex+0x40c/0x560
[  227.632137][ T6213]  should_failslab+0xa8/0x100
[  227.632156][ T6213]  __kmalloc_noprof+0xfe/0x720
[  227.632176][ T6213]  ? trace_kmem_cache_alloc+0x29/0xe0
[  227.632196][ T6213]  ? security_sk_alloc+0x52/0x360
[  227.632211][ T6213]  ? security_sk_alloc+0x52/0x360
[  227.632231][ T6213]  security_sk_alloc+0x52/0x360
[  227.632267][ T6213]  sk_prot_alloc+0x101/0x210
[  227.632294][ T6213]  sk_alloc+0x3a/0x390
[  227.632317][ T6213]  unix_create1+0xb0/0x7c0
[  227.632336][ T6213]  ? _raw_spin_unlock_irq+0x2e/0x50
[  227.632352][ T6213]  ? pidfs_register_pid_gfp+0x16a/0x1c0
[  227.632372][ T6213]  unix_stream_connect+0x387/0xfd0
[  227.632400][ T6213]  kernel_connect+0x141/0x1c0
[  227.632418][ T6213]  ? __pfx_kernel_connect+0x10/0x10
[  227.632446][ T6213]  ? __local_bh_enable_ip+0xd0/0x130
[  227.632469][ T6213]  xs_local_connect+0x626/0x810
[  227.632490][ T6213]  ? __pfx_xs_local_connect+0x10/0x10
[  227.632511][ T6213]  ? do_raw_spin_unlock+0xf5/0x210
[pid  6218] close(5)                    = 0
[  227.632533][ T6213]  xprt_connect+0x613/0x850
[  227.632556][ T6213]  ? __pfx_call_connect+0x10/0x10
[  227.632575][ T6213]  __rpc_execute+0x526/0x1280
[  227.632605][ T6213]  ? __pfx___rpc_execute+0x10/0x10
[  227.632643][ T6213]  ? rpc_task_get_xprt+0x26/0x250
[  227.632659][ T6213]  ? rpc_make_runnable+0xae/0x1c0
[  227.632678][ T6213]  rpc_execute+0x1c1/0x390
[  227.632697][ T6213]  rpc_run_task+0x4a6/0x660
[  227.632715][ T6213]  rpc_create_xprt+0x533/0xa90
[  227.632730][ T6213]  ? __pfx_rpc_create_xprt+0x10/0x10
[  227.632757][ T6213]  ? rcu_is_watching+0x15/0xb0
[  227.632774][ T6213]  ? trace_kmalloc+0x2a/0xf0
[  227.632797][ T6213]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  227.632817][ T6213]  ? xprt_create_transport+0x39b/0x5f0
[  227.632841][ T6213]  ? xprt_create_transport+0x438/0x5f0
[  227.632859][ T6213]  rpc_create+0x649/0x900
[  227.632882][ T6213]  ? __pfx_rpc_create+0x10/0x10
[  227.632929][ T6213]  ? __lock_acquire+0x683/0x2cf0
[  227.632952][ T6213]  rpcb_create_af_local+0x1c7/0x3c0
[  227.632968][ T6213]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  227.633000][ T6213]  ? do_raw_spin_unlock+0xf5/0x210
[  227.633067][ T6213]  rpcb_create_local+0x268/0x670
[  227.633084][ T6213]  ? __pfx_rpcb_create_local+0x10/0x10
[  227.633098][ T6213]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  227.633114][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.633139][ T6213]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  227.633156][ T6213]  ? __percpu_counter_init_many+0x35f/0x380
[  227.633181][ T6213]  ? __svc_create+0x88f/0x990
[  227.633204][ T6213]  svc_bind+0x1b4/0x230
[  227.633224][ T6213]  nfsd_create_serv+0x581/0x840
[  227.633245][ T6213]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  227.633261][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.633282][ T6213]  ? __pfx_nfsd_create_serv+0x10/0x10
[  227.633301][ T6213]  ? net_generic+0x1e/0x240
[  227.633320][ T6213]  ? net_generic+0x1e/0x240
[  227.633343][ T6213]  ? net_generic+0x1e/0x240
[  227.633368][ T6213]  nfsd_svc+0x189/0x780
[  227.633392][ T6213]  write_threads+0x3cd/0x5a0
[  227.633406][ T6213]  ? __might_fault+0xaf/0x130
[  227.633426][ T6213]  ? __pfx_write_threads+0x10/0x10
[  227.633455][ T6213]  ? _copy_from_user+0x94/0xb0
[  227.633472][ T6213]  ? simple_transaction_get+0x12d/0x160
[  227.633490][ T6213]  nfsctl_transaction_write+0x10f/0x160
[  227.633506][ T6213]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  227.633522][ T6213]  vfs_write+0x296/0xba0
[  227.633546][ T6213]  ? __pfx_vfs_write+0x10/0x10
[  227.633570][ T6213]  ? _raw_spin_unlock_irq+0x23/0x50
[  227.633586][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.633608][ T6213]  ksys_write+0x150/0x270
[  227.633627][ T6213]  ? __pfx_ksys_write+0x10/0x10
[  227.633649][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.633664][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.633680][ T6213]  do_syscall_64+0x174/0x580
[  227.633697][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.633712][ T6213]  ? clear_bhb_loop+0x70/0xc0
[  227.633729][ T6213]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.633743][ T6213] RIP: 0033:0x7f3343939df7
[  227.633783][ T6213] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  227.633795][ T6213] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  227.633811][ T6213] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  227.633822][ T6213] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  227.633831][ T6213] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  227.633840][ T6213] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  227.633849][ T6213] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbc8
[  227.633873][ T6213]  </TASK>
[  227.634355][ T6213] xs_local_setup_socket: unhandled error (12) connecting to @/run/rpcbind.sock
[  227.862566][ T6213] FAULT_INJECTION: forcing a failure.
[  227.862566][ T6213] name failslab, interval 1, probability 5, space 0, times -1
[  227.867985][ T6213] CPU: 0 UID: 0 PID: 6213 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  227.868286][ T6213] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  227.868297][ T6213] Call Trace:
[  227.868305][ T6213]  <TASK>
[  227.868312][ T6213]  dump_stack_lvl+0xe8/0x150
[  227.868337][ T6213]  should_fail_ex+0x40c/0x560
[  227.868361][ T6213]  should_failslab+0xa8/0x100
[  227.868378][ T6213]  __kmalloc_noprof+0xfe/0x720
[  227.868400][ T6213]  ? kobject_get_path+0xc5/0x2f0
[  227.868420][ T6213]  ? kobject_get_path+0xc5/0x2f0
[  227.868443][ T6213]  kobject_get_path+0xc5/0x2f0
[  227.868466][ T6213]  kobject_uevent_env+0x29e/0x9e0
[  227.868487][ T6213]  xprt_switch_alloc+0x420/0x590
[  227.868508][ T6213]  rpc_create_xprt+0x1c7/0xa90
[  227.868525][ T6213]  ? __pfx_rpc_create_xprt+0x10/0x10
[  227.868551][ T6213]  ? rcu_is_watching+0x15/0xb0
[  227.868569][ T6213]  ? trace_kmalloc+0x2a/0xf0
[  227.868588][ T6213]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  227.868607][ T6213]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  227.868625][ T6213]  ? xprt_create_transport+0x39b/0x5f0
[  227.868639][ T6213]  ? xprt_create_transport+0x39b/0x5f0
[  227.868655][ T6213]  ? kstrdup+0x81/0x100
[  227.868742][ T6213]  ? __asan_memcpy+0x40/0x70
[  227.868765][ T6213]  ? xprt_create_transport+0x438/0x5f0
[  227.868783][ T6213]  rpc_create+0x649/0x900
[  227.868804][ T6213]  ? __pfx_rpc_create+0x10/0x10
[  227.868846][ T6213]  ? __lock_acquire+0x683/0x2cf0
[  227.868869][ T6213]  rpcb_create_af_local+0x1c7/0x3c0
[  227.868884][ T6213]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  227.868913][ T6213]  ? do_raw_spin_unlock+0xf5/0x210
[  227.868990][ T6213]  rpcb_create_local+0x28f/0x670
[  227.869034][ T6213]  ? __pfx_rpcb_create_local+0x10/0x10
[  227.869047][ T6213]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  227.869063][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.869080][ T6213]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  227.869095][ T6213]  ? __percpu_counter_init_many+0x35f/0x380
[  227.869126][ T6213]  ? __svc_create+0x88f/0x990
[  227.869147][ T6213]  svc_bind+0x1b4/0x230
[  227.869165][ T6213]  nfsd_create_serv+0x581/0x840
[  227.869185][ T6213]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  227.869201][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.869220][ T6213]  ? __pfx_nfsd_create_serv+0x10/0x10
[  227.869239][ T6213]  ? net_generic+0x1e/0x240
[  227.869256][ T6213]  ? net_generic+0x1e/0x240
[  227.869276][ T6213]  ? net_generic+0x1e/0x240
[  227.869299][ T6213]  nfsd_svc+0x189/0x780
[  227.869322][ T6213]  write_threads+0x3cd/0x5a0
[  227.869335][ T6213]  ? __might_fault+0xaf/0x130
[  227.869355][ T6213]  ? __pfx_write_threads+0x10/0x10
[  227.869382][ T6213]  ? _copy_from_user+0x94/0xb0
[  227.869399][ T6213]  ? simple_transaction_get+0x12d/0x160
[  227.869417][ T6213]  nfsctl_transaction_write+0x10f/0x160
[  227.869434][ T6213]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  227.869449][ T6213]  vfs_write+0x296/0xba0
[  227.869473][ T6213]  ? __pfx_vfs_write+0x10/0x10
[  227.869496][ T6213]  ? _raw_spin_unlock_irq+0x23/0x50
[  227.869511][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  227.869532][ T6213]  ksys_write+0x150/0x270
[  227.869551][ T6213]  ? __pfx_ksys_write+0x10/0x10
[  227.869571][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.869587][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.869602][ T6213]  do_syscall_64+0x174/0x580
[  227.869618][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.869632][ T6213]  ? clear_bhb_loop+0x70/0xc0
[  227.869648][ T6213]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  227.869662][ T6213] RIP: 0033:0x7f3343939df7
[  227.869679][ T6213] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  227.869691][ T6213] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  227.869708][ T6213] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  227.869719][ T6213] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  227.869727][ T6213] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  227.869736][ T6213] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  227.869745][ T6213] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbc8
[  227.869767][ T6213]  </TASK>
[  227.873058][ T6213] FAULT_INJECTION: forcing a failure.
[  227.873058][ T6213] name failslab, interval 1, probability 5, space 0, times -1
[pid  6218] write(4, "tcp 2049\n", 9 <unfinished ...>
[pid  6213] <... write resumed>)        = -1 ENOMEM (Cannot allocate memory)
[  228.071271][ T6213] CPU: 0 UID: 0 PID: 6213 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  228.071291][ T6213] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  228.071300][ T6213] Call Trace:
[  228.071308][ T6213]  <TASK>
[  228.071314][ T6213]  dump_stack_lvl+0xe8/0x150
[  228.071339][ T6213]  should_fail_ex+0x40c/0x560
[  228.071364][ T6213]  should_failslab+0xa8/0x100
[  228.071382][ T6213]  __kmalloc_cache_noprof+0xa8/0x660
[  228.071403][ T6213]  ? do_syscall_64+0x174/0x580
[  228.071423][ T6213]  ? xprt_switch_alloc+0x7a/0x590
[  228.071439][ T6213]  ? xprt_switch_alloc+0x7a/0x590
[  228.071460][ T6213]  xprt_switch_alloc+0x7a/0x590
[  228.071481][ T6213]  rpc_create_xprt+0x1c7/0xa90
[  228.071496][ T6213]  ? __pfx_rpc_create_xprt+0x10/0x10
[  228.071523][ T6213]  ? rcu_is_watching+0x15/0xb0
[  228.071539][ T6213]  ? trace_kmalloc+0x2a/0xf0
[  228.071559][ T6213]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  228.071578][ T6213]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  228.071597][ T6213]  ? xprt_create_transport+0x39b/0x5f0
[  228.071612][ T6213]  ? xprt_create_transport+0x39b/0x5f0
[  228.071628][ T6213]  ? kstrdup+0x81/0x100
[  228.071649][ T6213]  ? __asan_memcpy+0x40/0x70
[  228.071672][ T6213]  ? xprt_create_transport+0x438/0x5f0
[  228.071689][ T6213]  rpc_create+0x649/0x900
[  228.071712][ T6213]  ? __pfx_rpc_create+0x10/0x10
[  228.071771][ T6213]  rpcb_create_local+0x3ab/0x670
[  228.071790][ T6213]  ? __pfx_rpcb_create_local+0x10/0x10
[  228.071815][ T6213]  ? __svc_create+0x88f/0x990
[  228.071840][ T6213]  svc_bind+0x1b4/0x230
[  228.071861][ T6213]  nfsd_create_serv+0x581/0x840
[  228.071881][ T6213]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  228.071899][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  228.071921][ T6213]  ? __pfx_nfsd_create_serv+0x10/0x10
[  228.071940][ T6213]  ? net_generic+0x1e/0x240
[  228.071961][ T6213]  ? net_generic+0x1e/0x240
[  228.072023][ T6213]  ? net_generic+0x1e/0x240
[  228.072106][ T6213]  nfsd_svc+0x189/0x780
[  228.072128][ T6213]  write_threads+0x3cd/0x5a0
[  228.072141][ T6213]  ? __might_fault+0xaf/0x130
[  228.072167][ T6213]  ? __pfx_write_threads+0x10/0x10
[  228.072193][ T6213]  ? _copy_from_user+0x94/0xb0
[  228.072213][ T6213]  ? simple_transaction_get+0x12d/0x160
[  228.072231][ T6213]  nfsctl_transaction_write+0x10f/0x160
[  228.072247][ T6213]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  228.072261][ T6213]  vfs_write+0x296/0xba0
[  228.072284][ T6213]  ? __pfx_vfs_write+0x10/0x10
[  228.072307][ T6213]  ? _raw_spin_unlock_irq+0x23/0x50
[  228.072323][ T6213]  ? lockdep_hardirqs_on+0x7a/0x110
[  228.072346][ T6213]  ksys_write+0x150/0x270
[  228.072365][ T6213]  ? __pfx_ksys_write+0x10/0x10
[pid  6213] openat(AT_FDCWD, "/proc/self/make-it-fail", O_WRONLY) = 5
[pid  6213] write(5, "0", 1)            = 1
[pid  6213] close(5)                    = 0
[  228.072388][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.072403][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.072419][ T6213]  do_syscall_64+0x174/0x580
[  228.072437][ T6213]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.072453][ T6213]  ? clear_bhb_loop+0x70/0xc0
[  228.072470][ T6213]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.072485][ T6213] RIP: 0033:0x7f3343939df7
[  228.072500][ T6213] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  228.072513][ T6213] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  228.072530][ T6213] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  228.072541][ T6213] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  228.072580][ T6213] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  228.072588][ T6213] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  228.072598][ T6213] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dbc8
[  228.072620][ T6213]  </TASK>
[  228.073497][ T6019] FAULT_INJECTION: forcing a failure.
[  228.073497][ T6019] name failslab, interval 1, probability 5, space 0, times -1
[  228.242885][ T6019] CPU: 0 UID: 0 PID: 6019 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  228.242908][ T6019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  228.242917][ T6019] Call Trace:
[  228.242924][ T6019]  <TASK>
[  228.242931][ T6019]  dump_stack_lvl+0xe8/0x150
[  228.242957][ T6019]  should_fail_ex+0x40c/0x560
[  228.243014][ T6019]  should_failslab+0xa8/0x100
[  228.243031][ T6019]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  228.243052][ T6019]  ? __kernfs_new_node+0xe6/0x980
[  228.243069][ T6019]  ? __kernfs_new_node+0xe6/0x980
[  228.243099][ T6019]  __kernfs_new_node+0xe6/0x980
[  228.243123][ T6019]  ? __pfx___kernfs_new_node+0x10/0x10
[  228.243142][ T6019]  ? kernfs_root+0x1c/0x230
[  228.243163][ T6019]  ? kernfs_root+0x1c/0x230
[  228.243179][ T6019]  ? kernfs_root+0x1c/0x230
[  228.243194][ T6019]  ? kernfs_root+0x1c/0x230
[  228.243214][ T6019]  kernfs_new_node+0xea/0x140
[  228.243236][ T6019]  __kernfs_create_file+0x4b/0x2e0
[  228.243253][ T6019]  sysfs_add_file_mode_ns+0x237/0x300
[  228.243274][ T6019]  internal_create_group+0x679/0x1180
[  228.243300][ T6019]  ? kernfs_create_dir_ns+0x1d5/0x230
[  228.243323][ T6019]  ? __pfx_internal_create_group+0x10/0x10
[  228.243339][ T6019]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  228.243357][ T6019]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  228.243378][ T6019]  sysfs_create_groups+0x59/0x120
[  228.243399][ T6019]  kobject_add_internal+0x669/0xcd0
[  228.243425][ T6019]  kobject_init_and_add+0x12b/0x1a0
[  228.243449][ T6019]  ? __pfx_kobject_init_and_add+0x10/0x10
[  228.243468][ T6019]  ? __kmalloc_cache_noprof+0x150/0x660
[  228.243488][ T6019]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  228.243506][ T6019]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  228.243529][ T6019]  rpc_sysfs_xprt_switch_setup+0x169/0x2b0
[  228.243554][ T6019]  xprt_switch_alloc+0x238/0x590
[  228.243575][ T6019]  rpc_create_xprt+0x1c7/0xa90
[  228.243591][ T6019]  ? __pfx_rpc_create_xprt+0x10/0x10
[  228.243616][ T6019]  ? rcu_is_watching+0x15/0xb0
[  228.243633][ T6019]  ? trace_kmalloc+0x2a/0xf0
[  228.243652][ T6019]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  228.243673][ T6019]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  228.243690][ T6019]  ? xprt_create_transport+0x39b/0x5f0
[  228.243706][ T6019]  ? xprt_create_transport+0x39b/0x5f0
[  228.243722][ T6019]  ? kstrdup+0x81/0x100
[  228.243743][ T6019]  ? __asan_memcpy+0x40/0x70
[  228.243766][ T6019]  ? xprt_create_transport+0x438/0x5f0
[  228.243783][ T6019]  rpc_create+0x649/0x900
[  228.243805][ T6019]  ? __pfx_rpc_create+0x10/0x10
[  228.243848][ T6019]  ? __lock_acquire+0x683/0x2cf0
[  228.243871][ T6019]  rpcb_create_af_local+0x1c7/0x3c0
[  228.243886][ T6019]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  228.243916][ T6019]  ? do_raw_spin_unlock+0xf5/0x210
[  228.243937][ T6019]  rpcb_create_local+0x268/0x670
[  228.243955][ T6019]  ? __pfx_rpcb_create_local+0x10/0x10
[  228.244008][ T6019]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  228.244025][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  228.244042][ T6019]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  228.244056][ T6019]  ? __percpu_counter_init_many+0x35f/0x380
[  228.244088][ T6019]  ? __svc_create+0x88f/0x990
[  228.244110][ T6019]  svc_bind+0x1b4/0x230
[  228.244128][ T6019]  nfsd_create_serv+0x581/0x840
[  228.244148][ T6019]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  228.244163][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  228.244182][ T6019]  ? __pfx_nfsd_create_serv+0x10/0x10
[  228.244203][ T6019]  ? net_generic+0x1e/0x240
[  228.244220][ T6019]  ? net_generic+0x1e/0x240
[  228.244241][ T6019]  ? net_generic+0x1e/0x240
[  228.244264][ T6019]  nfsd_svc+0x189/0x780
[  228.244313][ T6019]  write_threads+0x3cd/0x5a0
[  228.244329][ T6019]  ? __might_fault+0xaf/0x130
[  228.244348][ T6019]  ? __pfx_write_threads+0x10/0x10
[  228.244374][ T6019]  ? _copy_from_user+0x94/0xb0
[  228.244392][ T6019]  ? simple_transaction_get+0x12d/0x160
[  228.244412][ T6019]  nfsctl_transaction_write+0x10f/0x160
[  228.244428][ T6019]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  228.244444][ T6019]  vfs_write+0x296/0xba0
[  228.244470][ T6019]  ? __pfx_vfs_write+0x10/0x10
[  228.244493][ T6019]  ? _raw_spin_unlock_irq+0x23/0x50
[  228.244508][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  228.244530][ T6019]  ksys_write+0x150/0x270
[  228.244547][ T6019]  ? __pfx_ksys_write+0x10/0x10
[  228.244567][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.244582][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.244596][ T6019]  do_syscall_64+0x174/0x580
[  228.244613][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.244627][ T6019]  ? clear_bhb_loop+0x70/0xc0
[  228.244644][ T6019]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.244659][ T6019] RIP: 0033:0x7f3343939df7
[  228.244675][ T6019] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  228.244688][ T6019] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  228.244705][ T6019] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  228.244716][ T6019] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  228.244725][ T6019] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  228.244734][ T6019] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  228.244743][ T6019] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d924
[  228.244765][ T6019]  </TASK>
[  228.244928][ T6019] kobject: kobject_add_internal failed for switch-23 (error: -12 parent: xprt-switches)
[  228.507446][ T6019] FAULT_INJECTION: forcing a failure.
[  228.507446][ T6019] name failslab, interval 1, probability 5, space 0, times -1
[  228.514872][ T6019] CPU: 0 UID: 0 PID: 6019 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  228.514894][ T6019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  228.514903][ T6019] Call Trace:
[  228.514911][ T6019]  <TASK>
[  228.514918][ T6019]  dump_stack_lvl+0xe8/0x150
[  228.514976][ T6019]  should_fail_ex+0x40c/0x560
[  228.515002][ T6019]  should_failslab+0xa8/0x100
[  228.515036][ T6019]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  228.515062][ T6019]  ? __kernfs_new_node+0xe6/0x980
[  228.515079][ T6019]  ? __kernfs_new_node+0xe6/0x980
[  228.515102][ T6019]  __kernfs_new_node+0xe6/0x980
[  228.515127][ T6019]  ? __pfx___kernfs_new_node+0x10/0x10
[  228.515145][ T6019]  ? kernfs_root+0x1c/0x230
[  228.515167][ T6019]  ? kernfs_root+0x1c/0x230
[  228.515182][ T6019]  ? kernfs_root+0x1c/0x230
[  228.515197][ T6019]  ? kernfs_root+0x1c/0x230
[  228.515216][ T6019]  kernfs_new_node+0xea/0x140
[  228.515237][ T6019]  __kernfs_create_file+0x4b/0x2e0
[  228.515252][ T6019]  sysfs_add_file_mode_ns+0x237/0x300
[  228.515273][ T6019]  internal_create_group+0x679/0x1180
[  228.515299][ T6019]  ? kernfs_create_dir_ns+0x1d5/0x230
[  228.515320][ T6019]  ? __pfx_internal_create_group+0x10/0x10
[  228.515336][ T6019]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  228.515356][ T6019]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  228.515375][ T6019]  sysfs_create_groups+0x59/0x120
[  228.515395][ T6019]  kobject_add_internal+0x669/0xcd0
[  228.515422][ T6019]  kobject_init_and_add+0x12b/0x1a0
[  228.515449][ T6019]  ? __pfx_kobject_init_and_add+0x10/0x10
[  228.515469][ T6019]  ? __kmalloc_cache_noprof+0x150/0x660
[  228.515487][ T6019]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  228.515508][ T6019]  ? rpc_sysfs_xprt_switch_setup+0xe2/0x2b0
[  228.515533][ T6019]  rpc_sysfs_xprt_switch_setup+0x169/0x2b0
[  228.515556][ T6019]  xprt_switch_alloc+0x238/0x590
[  228.515577][ T6019]  rpc_create_xprt+0x1c7/0xa90
[  228.515594][ T6019]  ? __pfx_rpc_create_xprt+0x10/0x10
[  228.515619][ T6019]  ? rcu_is_watching+0x15/0xb0
[  228.515635][ T6019]  ? trace_kmalloc+0x2a/0xf0
[  228.515655][ T6019]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  228.515674][ T6019]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  228.515692][ T6019]  ? xprt_create_transport+0x39b/0x5f0
[  228.515707][ T6019]  ? xprt_create_transport+0x39b/0x5f0
[  228.515721][ T6019]  ? kstrdup+0x81/0x100
[  228.515742][ T6019]  ? __asan_memcpy+0x40/0x70
[  228.515764][ T6019]  ? xprt_create_transport+0x438/0x5f0
[  228.515782][ T6019]  rpc_create+0x649/0x900
[  228.515804][ T6019]  ? __pfx_rpc_create+0x10/0x10
[  228.515850][ T6019]  ? __lock_acquire+0x683/0x2cf0
[  228.515873][ T6019]  rpcb_create_af_local+0x1c7/0x3c0
[  228.515888][ T6019]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  228.515918][ T6019]  ? do_raw_spin_unlock+0xf5/0x210
[  228.515977][ T6019]  rpcb_create_local+0x28f/0x670
[  228.515994][ T6019]  ? __pfx_rpcb_create_local+0x10/0x10
[  228.516075][ T6019]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  228.516091][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  228.516109][ T6019]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  228.516123][ T6019]  ? __percpu_counter_init_many+0x35f/0x380
[  228.516147][ T6019]  ? __svc_create+0x88f/0x990
[  228.516170][ T6019]  svc_bind+0x1b4/0x230
[  228.516188][ T6019]  nfsd_create_serv+0x581/0x840
[  228.516210][ T6019]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  228.516226][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  228.516247][ T6019]  ? __pfx_nfsd_create_serv+0x10/0x10
[  228.516265][ T6019]  ? net_generic+0x1e/0x240
[  228.516283][ T6019]  ? net_generic+0x1e/0x240
[  228.516303][ T6019]  ? net_generic+0x1e/0x240
[  228.516325][ T6019]  nfsd_svc+0x189/0x780
[  228.516346][ T6019]  write_threads+0x3cd/0x5a0
[  228.516360][ T6019]  ? __might_fault+0xaf/0x130
[  228.516379][ T6019]  ? __pfx_write_threads+0x10/0x10
[  228.516405][ T6019]  ? _copy_from_user+0x94/0xb0
[  228.516423][ T6019]  ? simple_transaction_get+0x12d/0x160
[  228.516440][ T6019]  nfsctl_transaction_write+0x10f/0x160
[  228.516457][ T6019]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  228.516471][ T6019]  vfs_write+0x296/0xba0
[  228.516493][ T6019]  ? __pfx_vfs_write+0x10/0x10
[  228.516515][ T6019]  ? _raw_spin_unlock_irq+0x23/0x50
[  228.516530][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  228.516551][ T6019]  ksys_write+0x150/0x270
[  228.516570][ T6019]  ? __pfx_ksys_write+0x10/0x10
[  228.516590][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.516605][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.516619][ T6019]  do_syscall_64+0x174/0x580
[  228.516636][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.516650][ T6019]  ? clear_bhb_loop+0x70/0xc0
[  228.516667][ T6019]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.516681][ T6019] RIP: 0033:0x7f3343939df7
[  228.516696][ T6019] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  228.516710][ T6019] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  228.516726][ T6019] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  228.516737][ T6019] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  228.516747][ T6019] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  228.516755][ T6019] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  228.516764][ T6019] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d924
[  228.516786][ T6019]  </TASK>
[  228.517282][ T6019] kobject: kobject_add_internal failed for switch-23 (error: -12 parent: xprt-switches)
[  228.780084][ T6019] FAULT_INJECTION: forcing a failure.
[  228.780084][ T6019] name failslab, interval 1, probability 5, space 0, times -1
[  228.785178][ T6019] CPU: 0 UID: 0 PID: 6019 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  228.785199][ T6019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  228.785209][ T6019] Call Trace:
[  228.785217][ T6019]  <TASK>
[  228.785224][ T6019]  dump_stack_lvl+0xe8/0x150
[  228.785250][ T6019]  should_fail_ex+0x40c/0x560
[  228.785275][ T6019]  should_failslab+0xa8/0x100
[  228.785295][ T6019]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  228.785316][ T6019]  ? __kernfs_new_node+0xe6/0x980
[  228.785333][ T6019]  ? __kernfs_new_node+0xe6/0x980
[  228.785354][ T6019]  __kernfs_new_node+0xe6/0x980
[  228.785377][ T6019]  ? __pfx___kernfs_new_node+0x10/0x10
[  228.785395][ T6019]  ? kernfs_root+0x1c/0x230
[  228.785416][ T6019]  ? kernfs_root+0x1c/0x230
[  228.785432][ T6019]  ? kernfs_root+0x1c/0x230
[  228.785447][ T6019]  ? kernfs_root+0x1c/0x230
[  228.785467][ T6019]  kernfs_new_node+0xea/0x140
[  228.785489][ T6019]  __kernfs_create_file+0x4b/0x2e0
[  228.785506][ T6019]  sysfs_add_file_mode_ns+0x237/0x300
[  228.785528][ T6019]  internal_create_group+0x679/0x1180
[  228.785552][ T6019]  ? kernfs_create_dir_ns+0x1d5/0x230
[  228.785575][ T6019]  ? __pfx_internal_create_group+0x10/0x10
[  228.785603][ T6019]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  228.785620][ T6019]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  228.785640][ T6019]  sysfs_create_groups+0x59/0x120
[  228.785772][ T6019]  kobject_add_internal+0x669/0xcd0
[  228.785798][ T6019]  kobject_init_and_add+0x12b/0x1a0
[  228.785822][ T6019]  ? __pfx_kobject_init_and_add+0x10/0x10
[  228.785844][ T6019]  ? __kmalloc_cache_noprof+0x150/0x660
[  228.785864][ T6019]  ? rpc_sysfs_xprt_setup+0xa7/0x260
[  228.785882][ T6019]  ? rpc_sysfs_xprt_setup+0xa7/0x260
[  228.785935][ T6019]  rpc_sysfs_xprt_setup+0x132/0x260
[  228.785958][ T6019]  xprt_switch_alloc+0x420/0x590
[  228.785978][ T6019]  rpc_create_xprt+0x1c7/0xa90
[  228.785994][ T6019]  ? __pfx_rpc_create_xprt+0x10/0x10
[  228.786020][ T6019]  ? rcu_is_watching+0x15/0xb0
[  228.786036][ T6019]  ? trace_kmalloc+0x2a/0xf0
[  228.786056][ T6019]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  228.786075][ T6019]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  228.786093][ T6019]  ? xprt_create_transport+0x39b/0x5f0
[  228.786107][ T6019]  ? xprt_create_transport+0x39b/0x5f0
[  228.786120][ T6019]  ? kstrdup+0x81/0x100
[  228.786141][ T6019]  ? __asan_memcpy+0x40/0x70
[  228.786166][ T6019]  ? xprt_create_transport+0x438/0x5f0
[  228.786247][ T6019]  rpc_create+0x649/0x900
[  228.786269][ T6019]  ? __pfx_rpc_create+0x10/0x10
[  228.786378][ T6019]  rpcb_create_local+0x3ab/0x670
[  228.786472][ T6019]  ? __pfx_rpcb_create_local+0x10/0x10
[  228.786497][ T6019]  ? __svc_create+0x88f/0x990
[  228.786518][ T6019]  svc_bind+0x1b4/0x230
[  228.786536][ T6019]  nfsd_create_serv+0x581/0x840
[  228.786557][ T6019]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  228.786572][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  228.786602][ T6019]  ? __pfx_nfsd_create_serv+0x10/0x10
[  228.786623][ T6019]  ? net_generic+0x1e/0x240
[  228.786641][ T6019]  ? net_generic+0x1e/0x240
[  228.786661][ T6019]  ? net_generic+0x1e/0x240
[  228.786686][ T6019]  nfsd_svc+0x189/0x780
[  228.786709][ T6019]  write_threads+0x3cd/0x5a0
[  228.786722][ T6019]  ? __might_fault+0xaf/0x130
[  228.786741][ T6019]  ? __pfx_write_threads+0x10/0x10
[  228.786855][ T6019]  ? _copy_from_user+0x94/0xb0
[  228.786876][ T6019]  ? simple_transaction_get+0x12d/0x160
[  228.786893][ T6019]  nfsctl_transaction_write+0x10f/0x160
[  228.786938][ T6019]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  228.786954][ T6019]  vfs_write+0x296/0xba0
[  228.786978][ T6019]  ? __pfx_vfs_write+0x10/0x10
[  228.787001][ T6019]  ? _raw_spin_unlock_irq+0x23/0x50
[  228.787017][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  228.787038][ T6019]  ksys_write+0x150/0x270
[  228.787058][ T6019]  ? __pfx_ksys_write+0x10/0x10
[  228.787080][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.787095][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.787109][ T6019]  do_syscall_64+0x174/0x580
[  228.787126][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.787141][ T6019]  ? clear_bhb_loop+0x70/0xc0
[  228.787159][ T6019]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  228.787173][ T6019] RIP: 0033:0x7f3343939df7
[  228.787188][ T6019] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  228.787202][ T6019] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  228.787219][ T6019] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  228.787230][ T6019] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  228.787239][ T6019] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  228.787248][ T6019] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  228.787257][ T6019] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d924
[  228.787279][ T6019]  </TASK>
[  229.011468][ T6019] kobject: kobject_add_internal failed for xprt-23-tcp (error: -12 parent: switch-23)
[  229.016333][ T6019] FAULT_INJECTION: forcing a failure.
[  229.016333][ T6019] name failslab, interval 1, probability 5, space 0, times -1
[  229.021448][ T6019] CPU: 0 UID: 0 PID: 6019 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  229.021469][ T6019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  229.021478][ T6019] Call Trace:
[  229.021496][ T6019]  <TASK>
[  229.021502][ T6019]  dump_stack_lvl+0xe8/0x150
[  229.021528][ T6019]  should_fail_ex+0x40c/0x560
[  229.021552][ T6019]  should_failslab+0xa8/0x100
[  229.021569][ T6019]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  229.021590][ T6019]  ? __kernfs_new_node+0xe6/0x980
[  229.021609][ T6019]  ? __kernfs_new_node+0xe6/0x980
[  229.021631][ T6019]  __kernfs_new_node+0xe6/0x980
[  229.021656][ T6019]  ? __pfx___kernfs_new_node+0x10/0x10
[  229.021674][ T6019]  ? kernfs_root+0x1c/0x230
[  229.021695][ T6019]  ? kernfs_root+0x1c/0x230
[  229.021711][ T6019]  ? kernfs_root+0x1c/0x230
[  229.021726][ T6019]  ? kernfs_root+0x1c/0x230
[  229.021745][ T6019]  kernfs_new_node+0xea/0x140
[  229.021767][ T6019]  __kernfs_create_file+0x4b/0x2e0
[  229.021784][ T6019]  sysfs_add_file_mode_ns+0x237/0x300
[  229.021802][ T6019]  internal_create_group+0x679/0x1180
[  229.021823][ T6019]  ? kernfs_create_dir_ns+0x1d5/0x230
[  229.021843][ T6019]  ? __pfx_internal_create_group+0x10/0x10
[  229.021858][ T6019]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  229.021875][ T6019]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  229.022037][ T6019]  sysfs_create_groups+0x59/0x120
[  229.022057][ T6019]  kobject_add_internal+0x669/0xcd0
[  229.022083][ T6019]  kobject_init_and_add+0x12b/0x1a0
[  229.022106][ T6019]  ? __pfx_kobject_init_and_add+0x10/0x10
[  229.022125][ T6019]  ? __kmalloc_cache_noprof+0x150/0x660
[  229.022143][ T6019]  ? rpc_sysfs_client_setup+0x106/0x310
[  229.022161][ T6019]  ? rpc_sysfs_client_setup+0x106/0x310
[  229.022184][ T6019]  rpc_sysfs_client_setup+0x191/0x310
[  229.022201][ T6019]  ? rpc_net_ns+0x1e/0x230
[  229.022218][ T6019]  ? __pfx_rpc_sysfs_client_setup+0x10/0x10
[  229.022235][ T6019]  ? rpc_net_ns+0x1e/0x230
[  229.022249][ T6019]  ? rpc_net_ns+0x1e/0x230
[  229.022267][ T6019]  rpc_new_client+0x716/0xc50
[  229.022289][ T6019]  __rpc_clone_client+0x342/0x7a0
[  229.022305][ T6019]  rpc_bind_new_program+0x25c/0x530
[  229.022319][ T6019]  ? __pfx_rpc_create+0x10/0x10
[  229.022341][ T6019]  ? __pfx_rpc_bind_new_program+0x10/0x10
[  229.022391][ T6019]  rpcb_create_local+0x3ed/0x670
[  229.022409][ T6019]  ? __pfx_rpcb_create_local+0x10/0x10
[  229.022432][ T6019]  ? __svc_create+0x88f/0x990
[  229.022452][ T6019]  svc_bind+0x1b4/0x230
[  229.022470][ T6019]  nfsd_create_serv+0x581/0x840
[  229.022503][ T6019]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  229.022520][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  229.022542][ T6019]  ? __pfx_nfsd_create_serv+0x10/0x10
[  229.022561][ T6019]  ? net_generic+0x1e/0x240
[  229.022579][ T6019]  ? net_generic+0x1e/0x240
[  229.022598][ T6019]  ? net_generic+0x1e/0x240
[  229.022618][ T6019]  nfsd_svc+0x189/0x780
[  229.022641][ T6019]  write_threads+0x3cd/0x5a0
[  229.022654][ T6019]  ? __might_fault+0xaf/0x130
[  229.022672][ T6019]  ? __pfx_write_threads+0x10/0x10
[  229.022698][ T6019]  ? _copy_from_user+0x94/0xb0
[  229.022717][ T6019]  ? simple_transaction_get+0x12d/0x160
[  229.022735][ T6019]  nfsctl_transaction_write+0x10f/0x160
[  229.022752][ T6019]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  229.022766][ T6019]  vfs_write+0x296/0xba0
[  229.022790][ T6019]  ? __pfx_vfs_write+0x10/0x10
[  229.022813][ T6019]  ? _raw_spin_unlock_irq+0x23/0x50
[  229.022829][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  229.022850][ T6019]  ksys_write+0x150/0x270
[  229.022868][ T6019]  ? __pfx_ksys_write+0x10/0x10
[  229.022926][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.022942][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.022957][ T6019]  do_syscall_64+0x174/0x580
[  229.022973][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.022987][ T6019]  ? clear_bhb_loop+0x70/0xc0
[  229.023004][ T6019]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.023018][ T6019] RIP: 0033:0x7f3343939df7
[  229.023035][ T6019] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  229.023048][ T6019] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  229.023065][ T6019] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  229.023076][ T6019] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  229.023085][ T6019] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  229.023093][ T6019] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  229.023103][ T6019] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d924
[  229.023125][ T6019]  </TASK>
[  229.023227][ T6019] kobject: kobject_add_internal failed for clnt-24 (error: -12 parent: rpc-clients)
[  229.242936][ T6019] FAULT_INJECTION: forcing a failure.
[  229.242936][ T6019] name failslab, interval 1, probability 5, space 0, times -1
[  229.248585][ T6019] CPU: 0 UID: 0 PID: 6019 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  229.248607][ T6019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  229.248617][ T6019] Call Trace:
[  229.248624][ T6019]  <TASK>
[  229.248631][ T6019]  dump_stack_lvl+0xe8/0x150
[  229.248656][ T6019]  should_fail_ex+0x40c/0x560
[  229.248681][ T6019]  should_failslab+0xa8/0x100
[  229.248700][ T6019]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  229.248720][ T6019]  ? __pfx_rpcauth_refreshcred+0x10/0x10
[  229.248742][ T6019]  ? rpc_malloc+0xeb/0x260
[  229.248760][ T6019]  ? rpc_malloc+0xeb/0x260
[  229.248783][ T6019]  rpc_malloc+0xeb/0x260
[  229.248805][ T6019]  call_allocate+0x26d/0x680
[  229.248823][ T6019]  ? __pfx_call_allocate+0x10/0x10
[  229.248842][ T6019]  __rpc_execute+0x526/0x1280
[  229.248907][ T6019]  ? __pfx___rpc_execute+0x10/0x10
[  229.248927][ T6019]  ? rpc_task_get_xprt+0x26/0x250
[  229.248944][ T6019]  ? rpc_make_runnable+0xae/0x1c0
[  229.248963][ T6019]  rpc_execute+0x1c1/0x390
[  229.248981][ T6019]  rpc_run_task+0x4a6/0x660
[  229.248998][ T6019]  rpc_call_sync+0x10f/0x200
[  229.249012][ T6019]  ? __pfx_rpc_call_sync+0x10/0x10
[  229.249031][ T6019]  ? net_generic+0x1e/0x240
[  229.249045][ T6019]  ? net_generic+0x1e/0x240
[  229.249062][ T6019]  rpcb_register+0x2d0/0x530
[  229.249078][ T6019]  ? __pfx_rpcb_register+0x10/0x10
[  229.249090][ T6019]  ? net_generic+0x1e/0x240
[  229.249107][ T6019]  ? rpcb_create_local+0x4ee/0x670
[  229.249123][ T6019]  ? __pfx_rpcb_create_local+0x10/0x10
[  229.249145][ T6019]  svc_unregister+0x24d/0x780
[  229.249170][ T6019]  svc_bind+0x1e9/0x230
[  229.249190][ T6019]  nfsd_create_serv+0x581/0x840
[  229.249211][ T6019]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  229.249228][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  229.249250][ T6019]  ? __pfx_nfsd_create_serv+0x10/0x10
[  229.249270][ T6019]  ? net_generic+0x1e/0x240
[  229.249288][ T6019]  ? net_generic+0x1e/0x240
[  229.249309][ T6019]  ? net_generic+0x1e/0x240
[  229.249331][ T6019]  nfsd_svc+0x189/0x780
[  229.249354][ T6019]  write_threads+0x3cd/0x5a0
[  229.249368][ T6019]  ? __might_fault+0xaf/0x130
[  229.249387][ T6019]  ? __pfx_write_threads+0x10/0x10
[  229.249412][ T6019]  ? _copy_from_user+0x94/0xb0
[  229.249439][ T6019]  ? simple_transaction_get+0x12d/0x160
[  229.249456][ T6019]  nfsctl_transaction_write+0x10f/0x160
[  229.249471][ T6019]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  229.249486][ T6019]  vfs_write+0x296/0xba0
[  229.249510][ T6019]  ? __pfx_vfs_write+0x10/0x10
[  229.249534][ T6019]  ? _raw_spin_unlock_irq+0x23/0x50
[  229.249550][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  229.249573][ T6019]  ksys_write+0x150/0x270
[  229.249593][ T6019]  ? __pfx_ksys_write+0x10/0x10
[  229.249615][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.249630][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.249646][ T6019]  do_syscall_64+0x174/0x580
[  229.249664][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.249679][ T6019]  ? clear_bhb_loop+0x70/0xc0
[  229.249695][ T6019]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.249709][ T6019] RIP: 0033:0x7f3343939df7
[  229.249725][ T6019] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  229.249737][ T6019] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  229.249754][ T6019] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  229.249766][ T6019] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  229.249775][ T6019] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  229.249783][ T6019] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  229.249793][ T6019] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d924
[  229.249815][ T6019]  </TASK>
[  229.486110][ T6019] FAULT_INJECTION: forcing a failure.
[  229.486110][ T6019] name failslab, interval 1, probability 5, space 0, times -1
[  229.491438][ T6019] CPU: 0 UID: 0 PID: 6019 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  229.491460][ T6019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  229.491470][ T6019] Call Trace:
[  229.491477][ T6019]  <TASK>
[  229.491484][ T6019]  dump_stack_lvl+0xe8/0x150
[  229.491510][ T6019]  should_fail_ex+0x40c/0x560
[  229.491535][ T6019]  should_failslab+0xa8/0x100
[  229.491553][ T6019]  kmem_cache_alloc_noprof+0xa6/0x5f0
[  229.491573][ T6019]  ? __kernfs_new_node+0xe6/0x980
[  229.491591][ T6019]  ? __kernfs_new_node+0xe6/0x980
[  229.491615][ T6019]  __kernfs_new_node+0xe6/0x980
[  229.491640][ T6019]  ? __pfx___kernfs_new_node+0x10/0x10
[  229.491659][ T6019]  ? kernfs_root+0x1c/0x230
[  229.491681][ T6019]  ? kernfs_root+0x1c/0x230
[  229.491698][ T6019]  ? kernfs_root+0x1c/0x230
[  229.491713][ T6019]  ? kernfs_root+0x1c/0x230
[  229.491734][ T6019]  kernfs_new_node+0xea/0x140
[  229.491756][ T6019]  __kernfs_create_file+0x4b/0x2e0
[  229.491773][ T6019]  sysfs_add_file_mode_ns+0x237/0x300
[  229.491794][ T6019]  internal_create_group+0x679/0x1180
[  229.491819][ T6019]  ? kernfs_create_dir_ns+0x1d5/0x230
[  229.491871][ T6019]  ? __pfx_internal_create_group+0x10/0x10
[  229.491888][ T6019]  ? sysfs_create_dir_ns+0x16a/0x2a0
[  229.491907][ T6019]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  229.491935][ T6019]  sysfs_create_groups+0x59/0x120
[  229.491955][ T6019]  kobject_add_internal+0x669/0xcd0
[  229.491982][ T6019]  kobject_init_and_add+0x12b/0x1a0
[  229.492007][ T6019]  ? __pfx_kobject_init_and_add+0x10/0x10
[  229.492029][ T6019]  ? kernfs_remove_by_name_ns+0x101/0x140
[  229.492053][ T6019]  ? kernfs_remove_by_name_ns+0x101/0x140
[  229.492074][ T6019]  sysfs_slab_add+0x7b/0x260
[  229.492092][ T6019]  do_kmem_cache_create+0x8bf/0x970
[  229.492110][ T6019]  __kmem_cache_create_args+0x307/0x440
[  229.492132][ T6019]  nfsd_file_cache_init+0x197/0x530
[  229.492150][ T6019]  ? __pfx_nfsd_file_cache_init+0x10/0x10
[  229.492166][ T6019]  ? net_generic+0x1e/0x240
[  229.492190][ T6019]  ? net_generic+0x1e/0x240
[  229.492208][ T6019]  ? net_generic+0x1e/0x240
[  229.492224][ T6019]  ? net_generic+0x1e/0x240
[  229.492242][ T6019]  ? net_generic+0x1f4/0x240
[  229.492261][ T6019]  nfsd_svc+0x315/0x780
[  229.492285][ T6019]  write_threads+0x3cd/0x5a0
[  229.492298][ T6019]  ? __might_fault+0xaf/0x130
[  229.492318][ T6019]  ? __pfx_write_threads+0x10/0x10
[  229.492345][ T6019]  ? _copy_from_user+0x94/0xb0
[  229.492362][ T6019]  ? simple_transaction_get+0x12d/0x160
[  229.492380][ T6019]  nfsctl_transaction_write+0x10f/0x160
[  229.492396][ T6019]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  229.492412][ T6019]  vfs_write+0x296/0xba0
[  229.492435][ T6019]  ? __pfx_vfs_write+0x10/0x10
[  229.492461][ T6019]  ? _raw_spin_unlock_irq+0x23/0x50
[  229.492476][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  229.492500][ T6019]  ksys_write+0x150/0x270
[  229.492520][ T6019]  ? __pfx_ksys_write+0x10/0x10
[  229.492541][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.492556][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.492572][ T6019]  do_syscall_64+0x174/0x580
[  229.492589][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.492604][ T6019]  ? clear_bhb_loop+0x70/0xc0
[  229.492622][ T6019]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.492637][ T6019] RIP: 0033:0x7f3343939df7
[  229.492653][ T6019] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  229.492666][ T6019] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  229.492683][ T6019] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  229.492694][ T6019] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  229.492704][ T6019] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  229.492712][ T6019] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  229.492722][ T6019] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d924
[  229.492745][ T6019]  </TASK>
[  229.493541][ T6019] kobject: kobject_add_internal failed for nfsd_file (error: -12 parent: slab)
[  229.670669][ T6019] SLUB: Unable to add cache nfsd_file to sysfs
[  229.673678][ T6019] FAULT_INJECTION: forcing a failure.
[  229.673678][ T6019] name failslab, interval 1, probability 5, space 0, times -1
[  229.679864][ T6019] CPU: 0 UID: 0 PID: 6019 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  229.679885][ T6019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  229.679893][ T6019] Call Trace:
[  229.679900][ T6019]  <TASK>
[  229.679907][ T6019]  dump_stack_lvl+0xe8/0x150
[  229.679931][ T6019]  should_fail_ex+0x40c/0x560
[  229.679958][ T6019]  ? do_kmem_cache_create+0x877/0x970
[  229.679974][ T6019]  should_failslab+0xa8/0x100
[  229.679992][ T6019]  __kmalloc_flags_noprof+0x135/0x800
[  229.680014][ T6019]  ? __kmalloc_flags_noprof+0x35e/0x800
[  229.680031][ T6019]  ? do_kmem_cache_create+0x877/0x970
[  229.680044][ T6019]  ? do_kmem_cache_create+0x877/0x970
[  229.680063][ T6019]  do_kmem_cache_create+0x877/0x970
[  229.680080][ T6019]  __kmem_cache_create_args+0x307/0x440
[  229.680099][ T6019]  nfsd_file_cache_init+0x1d9/0x530
[  229.680118][ T6019]  ? __pfx_nfsd_file_cache_init+0x10/0x10
[  229.680133][ T6019]  ? net_generic+0x1e/0x240
[  229.680156][ T6019]  ? net_generic+0x1e/0x240
[  229.680173][ T6019]  ? net_generic+0x1e/0x240
[  229.680188][ T6019]  ? net_generic+0x1e/0x240
[  229.680206][ T6019]  ? net_generic+0x1f4/0x240
[  229.680222][ T6019]  nfsd_svc+0x315/0x780
[  229.680244][ T6019]  write_threads+0x3cd/0x5a0
[  229.680257][ T6019]  ? __might_fault+0xaf/0x130
[  229.680274][ T6019]  ? __pfx_write_threads+0x10/0x10
[  229.680300][ T6019]  ? _copy_from_user+0x94/0xb0
[  229.680318][ T6019]  ? simple_transaction_get+0x12d/0x160
[  229.680335][ T6019]  nfsctl_transaction_write+0x10f/0x160
[  229.680352][ T6019]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  229.680367][ T6019]  vfs_write+0x296/0xba0
[  229.680391][ T6019]  ? __pfx_vfs_write+0x10/0x10
[  229.680411][ T6019]  ? _raw_spin_unlock_irq+0x23/0x50
[  229.680426][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  229.680457][ T6019]  ksys_write+0x150/0x270
[  229.680476][ T6019]  ? __pfx_ksys_write+0x10/0x10
[  229.680498][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.680514][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.680529][ T6019]  do_syscall_64+0x174/0x580
[  229.680545][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.680559][ T6019]  ? clear_bhb_loop+0x70/0xc0
[  229.680576][ T6019]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.680590][ T6019] RIP: 0033:0x7f3343939df7
[  229.680604][ T6019] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  229.680616][ T6019] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  229.680632][ T6019] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  229.680642][ T6019] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  229.680651][ T6019] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  229.680660][ T6019] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  229.680669][ T6019] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d924
[  229.680692][ T6019]  </TASK>
[  229.680778][ T6019] __kmem_cache_create_args(nfsd_file_mark) failed with error -12
[  229.827581][ T6019] CPU: 0 UID: 0 PID: 6019 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  229.827603][ T6019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  229.827613][ T6019] Call Trace:
[  229.827667][ T6019]  <TASK>
[  229.827674][ T6019]  dump_stack_lvl+0xe8/0x150
[  229.827701][ T6019]  __kmem_cache_create_args+0x3d8/0x440
[  229.827724][ T6019]  nfsd_file_cache_init+0x1d9/0x530
[  229.827744][ T6019]  ? __pfx_nfsd_file_cache_init+0x10/0x10
[  229.827761][ T6019]  ? net_generic+0x1e/0x240
[  229.827786][ T6019]  ? net_generic+0x1e/0x240
[  229.827829][ T6019]  ? net_generic+0x1e/0x240
[  229.827845][ T6019]  ? net_generic+0x1e/0x240
[  229.827863][ T6019]  ? net_generic+0x1f4/0x240
[  229.827881][ T6019]  nfsd_svc+0x315/0x780
[  229.827903][ T6019]  write_threads+0x3cd/0x5a0
[  229.827927][ T6019]  ? __might_fault+0xaf/0x130
[  229.827946][ T6019]  ? __pfx_write_threads+0x10/0x10
[  229.827973][ T6019]  ? _copy_from_user+0x94/0xb0
[  229.828094][ T6019]  ? simple_transaction_get+0x12d/0x160
[  229.828113][ T6019]  nfsctl_transaction_write+0x10f/0x160
[  229.828128][ T6019]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  229.828143][ T6019]  vfs_write+0x296/0xba0
[  229.828165][ T6019]  ? __pfx_vfs_write+0x10/0x10
[  229.828188][ T6019]  ? _raw_spin_unlock_irq+0x23/0x50
[  229.828206][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  229.828225][ T6019]  ksys_write+0x150/0x270
[  229.828243][ T6019]  ? __pfx_ksys_write+0x10/0x10
[  229.828262][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.828275][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.828289][ T6019]  do_syscall_64+0x174/0x580
[  229.828306][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.828320][ T6019]  ? clear_bhb_loop+0x70/0xc0
[  229.828337][ T6019]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  229.828350][ T6019] RIP: 0033:0x7f3343939df7
[  229.828366][ T6019] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  229.828379][ T6019] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  229.828395][ T6019] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  229.828405][ T6019] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  229.828413][ T6019] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  229.828420][ T6019] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  229.828428][ T6019] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d924
[  229.828447][ T6019]  </TASK>
[  229.944131][ T6019] nfsd: unable to create nfsd_file_mark_slab
[  230.144303][ T6019] FAULT_INJECTION: forcing a failure.
[  230.144303][ T6019] name failslab, interval 1, probability 5, space 0, times -1
[  230.149678][ T6019] CPU: 0 UID: 0 PID: 6019 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  230.149699][ T6019] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  230.149709][ T6019] Call Trace:
[  230.149717][ T6019]  <TASK>
[  230.149725][ T6019]  dump_stack_lvl+0xe8/0x150
[  230.149752][ T6019]  should_fail_ex+0x40c/0x560
[  230.149839][ T6019]  should_failslab+0xa8/0x100
[  230.149885][ T6019]  __kmalloc_cache_noprof+0xa8/0x660
[  230.149911][ T6019]  ? unx_lookup_cred+0x83/0x170
[  230.149923][ T6019]  ? unx_lookup_cred+0x83/0x170
[  230.149938][ T6019]  unx_lookup_cred+0x83/0x170
[  230.149954][ T6019]  rpcauth_refreshcred+0x63e/0xa20
[  230.149981][ T6019]  ? __pfx_rpcauth_refreshcred+0x10/0x10
[  230.150000][ T6019]  ? __pfx_do_raw_spin_lock+0x10/0x10
[  230.150026][ T6019]  ? __pfx_call_refresh+0x10/0x10
[  230.150044][ T6019]  ? __pfx_call_refresh+0x10/0x10
[  230.150062][ T6019]  __rpc_execute+0x526/0x1280
[  230.150093][ T6019]  ? __pfx___rpc_execute+0x10/0x10
[  230.150114][ T6019]  ? rpc_task_get_xprt+0x26/0x250
[  230.150130][ T6019]  ? rpc_make_runnable+0xae/0x1c0
[  230.150150][ T6019]  rpc_execute+0x1c1/0x390
[  230.150168][ T6019]  rpc_run_task+0x4a6/0x660
[  230.150185][ T6019]  rpc_call_sync+0x10f/0x200
[  230.150199][ T6019]  ? __pfx_rpc_call_sync+0x10/0x10
[  230.150220][ T6019]  ? net_generic+0x1e/0x240
[  230.150234][ T6019]  ? net_generic+0x1e/0x240
[  230.150251][ T6019]  rpcb_register+0x2d0/0x530
[  230.150267][ T6019]  ? __pfx_rpcb_register+0x10/0x10
[  230.150280][ T6019]  ? __lock_acquire+0x683/0x2cf0
[  230.150313][ T6019]  svc_unregister+0x24d/0x780
[  230.150338][ T6019]  svc_rpcb_cleanup+0x1d/0x30
[  230.150353][ T6019]  svc_xprt_destroy_all+0x6d3/0x730
[  230.150367][ T6019]  ? kfree+0x1c5/0x640
[  230.150382][ T6019]  ? rhashtable_free_and_destroy+0x4e0/0x540
[  230.150408][ T6019]  ? __pfx_svc_xprt_destroy_all+0x10/0x10
[  230.150426][ T6019]  ? do_raw_spin_unlock+0xf5/0x210
[  230.150447][ T6019]  nfsd_destroy_serv+0x1bf/0x4b0
[  230.150469][ T6019]  ? __pfx_nfsd_destroy_serv+0x10/0x10
[  230.150486][ T6019]  ? net_generic+0x1e/0x240
[  230.150507][ T6019]  nfsd_svc+0x540/0x780
[  230.150529][ T6019]  write_threads+0x3cd/0x5a0
[  230.150543][ T6019]  ? __might_fault+0xaf/0x130
[  230.150562][ T6019]  ? __pfx_write_threads+0x10/0x10
[  230.150588][ T6019]  ? _copy_from_user+0x94/0xb0
[  230.150605][ T6019]  ? simple_transaction_get+0x12d/0x160
[  230.150623][ T6019]  nfsctl_transaction_write+0x10f/0x160
[  230.150639][ T6019]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  230.150654][ T6019]  vfs_write+0x296/0xba0
[  230.150676][ T6019]  ? __pfx_vfs_write+0x10/0x10
[  230.150700][ T6019]  ? _raw_spin_unlock_irq+0x23/0x50
[  230.150716][ T6019]  ? lockdep_hardirqs_on+0x7a/0x110
[  230.150737][ T6019]  ksys_write+0x150/0x270
[  230.150756][ T6019]  ? __pfx_ksys_write+0x10/0x10
[  230.150817][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.150831][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.150845][ T6019]  do_syscall_64+0x174/0x580
[  230.150862][ T6019]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.150886][ T6019]  ? clear_bhb_loop+0x70/0xc0
[  230.150903][ T6019]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.150916][ T6019] RIP: 0033:0x7f3343939df7
[  230.150931][ T6019] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  230.150944][ T6019] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  230.150960][ T6019] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  230.150970][ T6019] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  230.150979][ T6019] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  230.150987][ T6019] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  230.150997][ T6019] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d924
[  230.151019][ T6019]  </TASK>
[pid  6213] write(4, "tcp 2049\n", 9 <unfinished ...>
[pid  6019] <... write resumed>)        = -1 ENOMEM (Cannot allocate memory)
[  230.345846][ T6027] FAULT_INJECTION: forcing a failure.
[  230.345846][ T6027] name failslab, interval 1, probability 5, space 0, times -1
[pid  6019] openat(AT_FDCWD, "/proc/self/make-it-fail", O_WRONLY) = 5
[pid  6019] write(5, "0", 1)            = 1
[pid  6019] close(5)                    = 0
[  230.357994][ T6027] CPU: 0 UID: 0 PID: 6027 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  230.358015][ T6027] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  230.358024][ T6027] Call Trace:
[  230.358030][ T6027]  <TASK>
[  230.358037][ T6027]  dump_stack_lvl+0xe8/0x150
[  230.358062][ T6027]  should_fail_ex+0x40c/0x560
[  230.358089][ T6027]  should_failslab+0xa8/0x100
[  230.358107][ T6027]  __kmalloc_noprof+0xfe/0x720
[  230.358129][ T6027]  ? __svc_create+0x65c/0x990
[  230.358143][ T6027]  ? __svc_create+0x65c/0x990
[  230.358162][ T6027]  __svc_create+0x65c/0x990
[  230.358243][ T6027]  ? __pfx_nfsd+0x10/0x10
[  230.358263][ T6027]  svc_create_pooled+0x5ad/0x770
[  230.358278][ T6027]  ? __init_swait_queue_head+0xa8/0x150
[  230.358296][ T6027]  nfsd_create_serv+0x565/0x840
[  230.358313][ T6027]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  230.358329][ T6027]  ? lockdep_hardirqs_on+0x7a/0x110
[  230.358347][ T6027]  ? __pfx_nfsd_create_serv+0x10/0x10
[  230.358364][ T6027]  ? net_generic+0x1e/0x240
[  230.358380][ T6027]  ? net_generic+0x1e/0x240
[  230.358399][ T6027]  ? net_generic+0x1e/0x240
[  230.358420][ T6027]  nfsd_svc+0x189/0x780
[  230.358441][ T6027]  write_threads+0x3cd/0x5a0
[  230.358454][ T6027]  ? __might_fault+0xaf/0x130
[  230.358471][ T6027]  ? __pfx_write_threads+0x10/0x10
[  230.358496][ T6027]  ? _copy_from_user+0x94/0xb0
[  230.358512][ T6027]  ? simple_transaction_get+0x12d/0x160
[  230.358530][ T6027]  nfsctl_transaction_write+0x10f/0x160
[  230.358545][ T6027]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  230.358560][ T6027]  vfs_write+0x296/0xba0
[  230.358582][ T6027]  ? __pfx_vfs_write+0x10/0x10
[  230.358604][ T6027]  ? _raw_spin_unlock_irq+0x23/0x50
[  230.358618][ T6027]  ? lockdep_hardirqs_on+0x7a/0x110
[  230.358639][ T6027]  ksys_write+0x150/0x270
[  230.358658][ T6027]  ? __pfx_ksys_write+0x10/0x10
[  230.358680][ T6027]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.358696][ T6027]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.358712][ T6027]  do_syscall_64+0x174/0x580
[  230.358729][ T6027]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.358778][ T6027]  ? clear_bhb_loop+0x70/0xc0
[  230.358797][ T6027]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.358829][ T6027] RIP: 0033:0x7f3343939df7
[  230.358846][ T6027] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  230.358859][ T6027] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  230.358874][ T6027] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  230.358883][ T6027] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  230.358891][ T6027] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  230.358899][ T6027] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  230.358907][ T6027] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7d93c
[  230.358927][ T6027]  </TASK>
[pid  6019] write(4, "tcp 2049\n", 9 <unfinished ...>
[pid  5972] <... write resumed>)        = 9
[  230.515705][ T6239] FAULT_INJECTION: forcing a failure.
[  230.515705][ T6239] name failslab, interval 1, probability 5, space 0, times -1
[  230.524804][ T6239] CPU: 0 UID: 0 PID: 6239 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  230.524828][ T6239] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  230.524848][ T6239] Call Trace:
[  230.524856][ T6239]  <TASK>
[  230.524864][ T6239]  dump_stack_lvl+0xe8/0x150
[  230.524892][ T6239]  should_fail_ex+0x40c/0x560
[  230.524921][ T6239]  should_failslab+0xa8/0x100
[  230.524941][ T6239]  __kmalloc_noprof+0xfe/0x720
[  230.524965][ T6239]  ? kobject_get_path+0xc5/0x2f0
[  230.524986][ T6239]  ? kobject_get_path+0xc5/0x2f0
[  230.525013][ T6239]  kobject_get_path+0xc5/0x2f0
[  230.525039][ T6239]  kobject_uevent_env+0x29e/0x9e0
[  230.525057][ T6239]  ? rpc_sysfs_xprt_switch_setup+0x1c6/0x2b0
[  230.525083][ T6239]  xprt_switch_alloc+0x238/0x590
[  230.525106][ T6239]  rpc_create_xprt+0x1c7/0xa90
[  230.525125][ T6239]  ? __pfx_rpc_create_xprt+0x10/0x10
[  230.525155][ T6239]  ? rcu_is_watching+0x15/0xb0
[  230.525173][ T6239]  ? trace_kmalloc+0x2a/0xf0
[  230.525197][ T6239]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
[  230.525220][ T6239]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  230.525242][ T6239]  ? xprt_create_transport+0x39b/0x5f0
[  230.525259][ T6239]  ? xprt_create_transport+0x39b/0x5f0
[  230.525276][ T6239]  ? kstrdup+0x81/0x100
[  230.525299][ T6239]  ? __asan_memcpy+0x40/0x70
[  230.525325][ T6239]  ? xprt_create_transport+0x438/0x5f0
[  230.525345][ T6239]  rpc_create+0x649/0x900
[pid  6027] <... write resumed>)        = -1 ENOMEM (Cannot allocate memory)
[  230.525370][ T6239]  ? __pfx_rpc_create+0x10/0x10
[pid  6027] openat(AT_FDCWD, "/proc/self/make-it-fail", O_WRONLY) = 5
[pid  6027] write(5, "0", 1)            = 1
[pid  6027] close(5)                    = 0
[  230.525421][ T6239]  ? __lock_acquire+0x683/0x2cf0
[  230.525447][ T6239]  rpcb_create_af_local+0x1c7/0x3c0
[  230.525464][ T6239]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  230.525499][ T6239]  ? do_raw_spin_unlock+0xf5/0x210
[  230.525523][ T6239]  rpcb_create_local+0x268/0x670
[  230.525542][ T6239]  ? __pfx_rpcb_create_local+0x10/0x10
[  230.525557][ T6239]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  230.525575][ T6239]  ? lockdep_hardirqs_on+0x7a/0x110
[  230.525595][ T6239]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  230.525612][ T6239]  ? __percpu_counter_init_many+0x35f/0x380
[  230.525640][ T6239]  ? __svc_create+0x88f/0x990
[  230.525666][ T6239]  svc_bind+0x1b4/0x230
[  230.525687][ T6239]  nfsd_create_serv+0x581/0x840
[  230.525709][ T6239]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  230.525757][ T6239]  ? lockdep_hardirqs_on+0x7a/0x110
[  230.525778][ T6239]  ? __pfx_nfsd_create_serv+0x10/0x10
[  230.525800][ T6239]  ? net_generic+0x1e/0x240
[  230.525821][ T6239]  ? net_generic+0x1e/0x240
[  230.525851][ T6239]  ? net_generic+0x1e/0x240
[  230.525878][ T6239]  nfsd_svc+0x189/0x780
[  230.525904][ T6239]  write_threads+0x3cd/0x5a0
[  230.525919][ T6239]  ? __might_fault+0xaf/0x130
[  230.525940][ T6239]  ? __pfx_write_threads+0x10/0x10
[  230.525970][ T6239]  ? _copy_from_user+0x94/0xb0
[  230.525989][ T6239]  ? simple_transaction_get+0x12d/0x160
[  230.526009][ T6239]  nfsctl_transaction_write+0x10f/0x160
[  230.526027][ T6239]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  230.526043][ T6239]  vfs_write+0x296/0xba0
[  230.526070][ T6239]  ? __pfx_vfs_write+0x10/0x10
[  230.526098][ T6239]  ? _raw_spin_unlock_irq+0x23/0x50
[  230.526113][ T6239]  ? lockdep_hardirqs_on+0x7a/0x110
[  230.526138][ T6239]  ksys_write+0x150/0x270
[  230.526160][ T6239]  ? __pfx_ksys_write+0x10/0x10
[  230.526184][ T6239]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.526201][ T6239]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.526218][ T6239]  do_syscall_64+0x174/0x580
[  230.526236][ T6239]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.526252][ T6239]  ? clear_bhb_loop+0x70/0xc0
[  230.526272][ T6239]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  230.526288][ T6239] RIP: 0033:0x7f3343939df7
[  230.526303][ T6239] Code: 48 89 fa 4c 89 df e8 98 1e 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[  230.526318][ T6239] RSP: 002b:00007ffd7b7fb6d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[  230.526336][ T6239] RAX: ffffffffffffffda RBX: 000055556af7b400 RCX: 00007f3343939df7
[  230.526348][ T6239] RDX: 0000000000000002 RSI: 00007f33439741aa RDI: 0000000000000003
[  230.526358][ T6239] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
[  230.526368][ T6239] R10: 0000000000000000 R11: 0000000000000202 R12: 00007f3343974192
[  230.526378][ T6239] R13: 00007f33439741b7 R14: 0000000000000000 R15: 000055556af7dc2c
[  230.526403][ T6239]  </TASK>
[  230.526471][ T6239] FAULT_INJECTION: forcing a failure.
[  230.526471][ T6239] name failslab, interval 1, probability 5, space 0, times -1
[  230.732303][ T6239] CPU: 0 UID: 0 PID: 6239 Comm: syz-executor165 Not tainted syzkaller #1 PREEMPT(full) 
[  230.732326][ T6239] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  230.732336][ T6239] Call Trace:
[  230.732343][ T6239]  <TASK>
[  230.732350][ T6239]  dump_stack_lvl+0xe8/0x150
[  230.732379][ T6239]  should_fail_ex+0x40c/0x560
[  230.732407][ T6239]  should_failslab+0xa8/0x100
[  230.732427][ T6239]  __kmalloc_node_track_caller_noprof+0x100/0x730
[  230.732452][ T6239]  ? __lock_acquire+0x683/0x2cf0
[  230.732468][ T6239]  ? __kernfs_new_node+0xa9/0x980
[  230.732488][ T6239]  ? __kernfs_new_node+0xa9/0x980
[  230.732513][ T6239]  kstrdup+0x42/0x100
[  230.732538][ T6239]  __kernfs_new_node+0xa9/0x980
[  230.732565][ T6239]  ? __pfx___kernfs_new_node+0x10/0x10
[  230.732586][ T6239]  ? kernfs_root+0x1c/0x230
[  230.732610][ T6239]  ? kernfs_root+0x1c/0x230
[  230.732652][ T6239]  ? kernfs_root+0x1c/0x230
[  230.732669][ T6239]  ? kernfs_root+0x1c/0x230
[  230.732738][ T6239]  kernfs_create_dir_ns+0xfe/0x230
[  230.732765][ T6239]  sysfs_create_dir_ns+0x12f/0x2a0
[  230.732787][ T6239]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  230.732809][ T6239]  ? do_raw_spin_unlock+0xf5/0x210
[  230.732833][ T6239]  kobject_add_internal+0x622/0xcd0
[  230.732862][ T6239]  kobject_init_and_add+0x12b/0x1a0
[  230.732890][ T6239]  ? __pfx_kobject_init_and_add+0x10/0x10
[  230.732914][ T6239]  ? __kmalloc_cache_noprof+0x150/0x660
[  230.732936][ T6239]  ? rpc_sysfs_xprt_setup+0xa7/0x260

[host] Command execution timed out after 2m30s

Crash Report: 

gemini-3.1-pro-preview

							input: 103560
							output: 23
							thoughts: 1117
						

**My Debugging Journey: Decoding the `percpu_counter` Kernel Crash**

Okay, so I've just received a bug report that's making my head spin a bit: "BUG: unable to handle kernel paging request in percpu_counter_add_batch". The immediate problem is a crash occurring specifically at `percpu_counter_add_batch+0x50/0x1d0` within `lib/percpu_counter.c:98`.

My first instinct is to dissect the trapping instruction itself. It's a `mov %gs:(%rax),%ebp`, and importantly, `%rax` is being loaded from `(%rbx)`. I need to figure out where `%rbx` is coming from. It turns out `%rbx` was saved earlier and is currently located at `0x10(%rsp)`.

I then dive into the disassembly to get a clearer picture of the execution flow leading up to the fault.

```
   0:	f6 48 b7 fc          	testb  $0xfc,-0x49(%rax)
   4:	48 89 5c 24 10       	mov    %rbx,0x10(%rsp)
   9:	48 83 c3 58          	add    $0x58,%rbx
   d:	49 89 de             	mov    %rbx,%r14
  10:	49 c1 ee 03          	shr    $0x3,%r14
  14:	43 80 3c 3e 00       	cmpb   $0x0,(%r14,%r15,1)
  19:	74 08                	je     0x23
  1b:	48 89 df             	mov    %rbx,%rdi
  1e:	e8 07 7d 26 fd       	call   0xfd267d2a
  23:	48 89 1c 24          	mov    %rbx,(%rsp)
  27:	48 8b 03             	mov    (%rbx),%rax
* 2a:	65 8b 28             	mov    %gs:(%rax),%ebp <-- trapping instruction
```

Looking at this, the `mov %gs:(%rax),%ebp` instruction, with `%rax` derived from `%rbx` which is then used to access memory relative to `%gs`, strongly suggests I'm dealing with a per-CPU data structure. My immediate thought is something along the lines of `this_cpu_ptr(fbc->counters)`.

Now, I recall that `percpu_counter_add_batch` takes a `struct percpu_counter *fbc` and an `amount`. The call stack shows that the crash is happening within `percpu_counter_add_batch`, which was called by `percpu_counter_add`, which was called by `percpu_counter_inc`, and ultimately, this chain originates from `svc_xprt_enqueue`.

Specifically, `svc_xprt_enqueue` makes a call to `percpu_counter_inc(&pool->sp_sockets_queued)`. This is where my suspicion starts to solidify. What if `pool` itself is NULL, or more critically, what if `pool->sp_sockets_queued` is uninitialized?

I then examine the `svc_xprt_enqueue` function itself:

```c
	struct svc_pool *pool = xprt->xpt_pool;
	...
	percpu_counter_inc(&pool->sp_sockets_queued);
```

This confirms my suspicion about the `pool` and its `sp_sockets_queued` member being the potential source of the problem.

However, the reproducer output provides a crucial clue: it's showing a significant amount of "FAULT_INJECTION: forcing a failure.", specifically mentioning `failslab`. This shifts my focus. Could it be that the `percpu_counter_init` for `sp_sockets_queued` *failed*?

If `percpu_counter_init` failed, how did the system handle that error? I need to investigate the initialization paths for these per-CPU counters. My next step would be to trace back to `svc_pool_map_alloc_arrays` or `svc_create_pooled` to see how `svc_pool` structures are allocated and how `sp_sockets_queued` is initialized. The critical question is: if `percpu_counter_init` returns an error, does the calling code properly check for and handle that failure, or does it proceed as if the per-CPU counter is valid, leading to this eventual crash when it's dereferenced? I'll be looking closely at `net/sunrpc/svc.c` and `net/sunrpc/svc_xprt.c` for this error handling logic.

log-in to see details

map[Name:sp_sockets_queued]

map[References:<nil> TruncatedOutput:false]

gemini-3.1-pro-preview

							input: 104709
							output: 19
							thoughts: 27
						

**My Thought Process on Locating `sp_sockets_queued`**

My immediate instinct, given the context of needing to understand network socket queuing behavior within the SunRPC service layer, was to pinpoint the exact definition of `sp_sockets_queued`. I knew that kernel headers, particularly those related to RPC, would be the most likely place to find such an identifier.

Therefore, my first action was to initiate a search. I specified the exact symbol I was looking for, `sp_sockets_queued`, and the precise file where I anticipated it would reside: `include/linux/sunrpc/svc.h`. This file name is not a guess; it directly points to the heart of the Linux SunRPC *service* implementation headers, which is precisely where one would expect to find data structures and function prototypes related to the server-side RPC mechanisms, including how it interacts with and manages its network sockets and the data queued on them. The `sp_` prefix strongly suggests it's a member or field within a structure related to the RPC *service*, and `sockets_queued` is quite descriptive of its purpose. This targeted search is the most efficient way to confirm the definition and understand its context.

map[Expression:sp_sockets_queued]

map[Output:include/linux/sunrpc/svc.h=36=struct svc_pool {
--
include/linux/sunrpc/svc.h-46-	struct percpu_counter	sp_messages_arrived;
include/linux/sunrpc/svc.h:47:	struct percpu_counter	sp_sockets_queued;
include/linux/sunrpc/svc.h-48-	struct percpu_counter	sp_threads_woken;
--
net/sunrpc/svc.c=483=__svc_create(struct svc_program *prog, int nprogs, struct svc_stat *stats,
--
net/sunrpc/svc.c-543-		percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL);
net/sunrpc/svc.c:544:		percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL);
net/sunrpc/svc.c-545-		percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL);
--
net/sunrpc/svc.c=601=svc_destroy(struct svc_serv **servp)
--
net/sunrpc/svc.c-627-		percpu_counter_destroy(&pool->sp_messages_arrived);
net/sunrpc/svc.c:628:		percpu_counter_destroy(&pool->sp_sockets_queued);
net/sunrpc/svc.c-629-		percpu_counter_destroy(&pool->sp_threads_woken);
--
net/sunrpc/svc_xprt.c=507=void svc_xprt_enqueue(struct svc_xprt *xprt)
--
net/sunrpc/svc_xprt.c-523-
net/sunrpc/svc_xprt.c:524:	percpu_counter_inc(&pool->sp_sockets_queued);
net/sunrpc/svc_xprt.c-525-	xprt->xpt_qtime = ktime_get();
--
net/sunrpc/svc_xprt.c=1554=static int svc_pool_stats_show(struct seq_file *m, void *p)
--
net/sunrpc/svc_xprt.c-1565-		   percpu_counter_sum_positive(&pool->sp_messages_arrived),
net/sunrpc/svc_xprt.c:1566:		   percpu_counter_sum_positive(&pool->sp_sockets_queued),
net/sunrpc/svc_xprt.c-1567-		   percpu_counter_sum_positive(&pool->sp_threads_woken));
]

gemini-3.1-pro-preview

							input: 105428
							output: 36
							thoughts: 153
						

**My Thoughts on the Potential `percpu_counter_init` Failure in SUNRPC Service Threads**

Okay, I'm looking at line 544 in `net/sunrpc/svc.c`, and it seems to be initializing a `pool` with a few `percpu_counter` objects: `sp_messages_arrived`, `sp_sockets_queued`, and `sp_threads_woken`. I'm using `percpu_counter_init` for each of these, with `GFP_KERNEL` for allocation.

However, my immediate thought, given my expertise, is that `percpu_counter_init` *can actually fail*. It returns an `int`, and the common failure case I expect to see here is `-ENOMEM` if the system is under memory pressure. The critical observation is that the code completely *ignores* this return value. This is concerning.

If `percpu_counter_init` fails, these counters won't be properly initialized. What are the implications of that? It could lead to incorrect accounting, potentially missed statistics, or even more insidious bugs down the line if other parts of the code *assume* these counters are valid and ready to go.

To understand the full picture, I need to trace this back. My next step is to examine the `__svc_create` function, also within `net/sunrpc/svc.c`, to see how this `pool` is created and where these counters are intended to be used. I suspect the error handling, or lack thereof, related to this initialization might be lurking there, or perhaps the assumption is that this specific allocation context guarantees success. I need to be sure.

map[ContextFile:net/sunrpc/svc.c Name:__svc_create]

map[SourceCode: 479:	/*
 480:	 * Create an RPC service
 481:	 */
 482:	static struct svc_serv *
 483:	__svc_create(struct svc_program *prog, int nprogs, struct svc_stat *stats,
 484:		     unsigned int bufsize, int npools, int (*threadfn)(void *data))
 485:	{
 486:		struct svc_serv	*serv;
 487:		unsigned int vers;
 488:		unsigned int xdrsize;
 489:		unsigned int i;
 490:	
 491:		if (!(serv = kzalloc_obj(*serv)))
 492:			return NULL;
 493:		serv->sv_name      = prog->pg_name;
 494:		serv->sv_programs  = prog;
 495:		serv->sv_nprogs    = nprogs;
 496:		serv->sv_stats     = stats;
 497:		if (bufsize > RPCSVC_MAXPAYLOAD)
 498:			bufsize = RPCSVC_MAXPAYLOAD;
 499:		serv->sv_max_payload = bufsize? bufsize : 4096;
 500:		serv->sv_max_mesg  = roundup(serv->sv_max_payload + PAGE_SIZE, PAGE_SIZE);
 501:		serv->sv_threadfn = threadfn;
 502:		xdrsize = 0;
 503:		for (i = 0; i < nprogs; i++) {
 504:			struct svc_program *progp = &prog[i];
 505:	
 506:			progp->pg_lovers = progp->pg_nvers-1;
 507:			for (vers = 0; vers < progp->pg_nvers ; vers++)
 508:				if (progp->pg_vers[vers]) {
 509:					progp->pg_hivers = vers;
 510:					if (progp->pg_lovers > vers)
 511:						progp->pg_lovers = vers;
 512:					if (progp->pg_vers[vers]->vs_xdrsize > xdrsize)
 513:						xdrsize = progp->pg_vers[vers]->vs_xdrsize;
 514:				}
 515:		}
 516:		serv->sv_xdrsize   = xdrsize;
 517:		INIT_LIST_HEAD(&serv->sv_tempsocks);
 518:		INIT_LIST_HEAD(&serv->sv_permsocks);
 519:		timer_setup(&serv->sv_temptimer, NULL, 0);
 520:		spin_lock_init(&serv->sv_lock);
 521:	
 522:		__svc_init_bc(serv);
 523:	
 524:		serv->sv_nrpools = npools;
 525:		serv->sv_pools =
 526:			kzalloc_objs(struct svc_pool, serv->sv_nrpools);
 527:		if (!serv->sv_pools) {
 528:			kfree(serv);
 529:			return NULL;
 530:		}
 531:	
 532:		for (i = 0; i < serv->sv_nrpools; i++) {
 533:			struct svc_pool *pool = &serv->sv_pools[i];
 534:	
 535:			dprintk("svc: initialising pool %u for %s\n",
 536:					i, serv->sv_name);
 537:	
 538:			pool->sp_id = i;
 539:			lwq_init(&pool->sp_xprts);
 540:			INIT_LIST_HEAD(&pool->sp_all_threads);
 541:			init_llist_head(&pool->sp_idle_threads);
 542:	
 543:			percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL);
 544:			percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL);
 545:			percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL);
 546:		}
 547:	
 548:		return serv;
 549:	}
 SourceFile:net/sunrpc/svc.c]

gemini-3.1-pro-preview

							input: 106810
							output: 40
							thoughts: 436
						

**The Peril of Unchecked Per-CPU Counter Initialization**

Ah, I've stumbled upon a critical issue, and it's one of those insidious bugs that hides in plain sight. It revolves around the `percpu_counter_init` function. My initial thought was that it simply returns an `int` that gets ignored, which seemed odd. The real problem, I've realized, is that if `percpu_counter_init` *fails*, it leaves the `percpu_counter` structure in a precarious state. Specifically, its `counters` pointer is left as NULL.

Then, when `percpu_counter_inc` (or indeed `percpu_counter_add_batch`) is invoked, it attempts to dereference this NULL pointer. This isn't just a simple NULL dereference; it's `this_cpu_ptr(NULL)` followed by adding the per-CPU offset, which effectively resolves to NULL. This is a recipe for disaster.

Let me re-examine the return value. Yes, `percpu_counter_init` *does* return an error code. And crucially, `percpu_counter_init` is a wrapper that maps to `percpu_counter_init_many`. Looking at the source for `__percpu_counter_init_many`, I see the allocation of the per-CPU counters:

```c
counters = __alloc_percpu_gfp(nr_counters * sizeof(*counters),
                              sizeof(*counters), gfp);
if (!counters) {
    fbc[0].count = amount;
    fbc[0].counters = NULL; // This is the key point!
    return -ENOMEM;
}
```

So, if the `counters` allocation fails, `fbc->counters` is explicitly set to NULL, and an error is returned. This confirms my suspicion.

Now, I need to see how `percpu_counter_add_batch` handles this situation. I'll pull up the code for that:

```c
void percpu_counter_add_batch(struct percpu_counter *fbc, s64 amount, s32 batch)
{
    s64 count;
    s32 *pcount;
    unsigned long flags;

    if (unlikely(!fbc->counters)) // Aha! There's the check.
        return; // But does this *truly* prevent the issue?
}
```

Wait a minute. It seems `percpu_counter_add_batch` *does* check for a NULL `fbc->counters` and returns early. My initial alarm bells were about dereferencing a NULL pointer *during* the add operation. However, if the function returns early, then the problem might be subtler. Let me dive deeper into `lib/percpu_counter.c` to verify the exact logic and ensure there isn't a path that still leads to a NULL dereference *before* this check, or if this check is sufficient.

map[ContextFile:lib/percpu_counter.c Name:percpu_counter_add_batch]

map[SourceCode:  88:	/*
  89:	 * Safety against interrupts is achieved in 2 ways:
  90:	 * 1. the fast path uses local cmpxchg (note: no lock prefix)
  91:	 * 2. the slow path operates with interrupts disabled
  92:	 */
  93:	void percpu_counter_add_batch(struct percpu_counter *fbc, s64 amount, s32 batch)
  94:	{
  95:		s64 count;
  96:		unsigned long flags;
  97:	
  98:		count = this_cpu_read(*fbc->counters);
  99:		do {
 100:			if (unlikely(abs(count + amount) >= batch)) {
 101:				raw_spin_lock_irqsave(&fbc->lock, flags);
 102:				/*
 103:				 * Note: by now we might have migrated to another CPU
 104:				 * or the value might have changed.
 105:				 */
 106:				count = __this_cpu_read(*fbc->counters);
 107:				fbc->count += count + amount;
 108:				__this_cpu_sub(*fbc->counters, count);
 109:				raw_spin_unlock_irqrestore(&fbc->lock, flags);
 110:				return;
 111:			}
 112:		} while (!this_cpu_try_cmpxchg(*fbc->counters, &count, count + amount));
 113:	}
 SourceFile:lib/percpu_counter.c]

gemini-3.1-pro-preview

							input: 107703
							output: 18
							thoughts: 1105
						

**My Thought Process Unraveling the `percpu_counter_add_batch` Crash**

It seems I've stumbled upon a rather subtle bug related to per-CPU counters. My initial observation is that the `percpu_counter_add_batch` function appears to lack a crucial NULL check. This is problematic because, in certain scenarios, `fbc->counters` could be NULL. If that happens, the line `this_cpu_read(*fbc->counters)` would attempt to dereference a NULL pointer. The subsequent addition with `per_cpu_offset` also raises concerns, as `per_cpu_offset` for CPU 0 can sometimes be zero or a very large value, potentially leading to an invalid memory access.

Looking at the crash trace provided, the exact instruction causing the fault is `mov %gs:(%rax),%ebp`. Here, `%rax` is set to `fbc->counters`. If `fbc->counters` is indeed NULL, then `%rax` becomes 0. This means the system is trying to access `%gs:0`. The trace also indicates that the base address of `%gs` is `ffff88808c54a000`. Therefore, the faulty access is to `ffff88808c54a000`, which is an invalid memory location, hence the page fault.

Tracing this back further, I've identified the root cause: the `__svc_create` function, specifically when fault injection is active, is not properly handling the return value of `percpu_counter_init`. When `failslab` fault injection is enabled, `percpu_counter_init` fails and returns an error code, `-ENOMEM`. However, `__svc_create` seems to ignore this failure, leaving `sp_sockets_queued.counters` as NULL. Later, when `svc_xprt_enqueue` is called, it attempts to increment this NULL counter via `percpu_counter_inc(&pool->sp_sockets_queued)`, leading directly to the observed crash.

To confirm this, I've reviewed the reproducer's output. It clearly shows `FAULT_INJECTION: forcing a failure.` messages, specifically targeting `failslab` with an interval of 1 and probability 5. This aligns perfectly with the scenario where `percpu_counter_init` would fail. The subsequent stack trace in the reproducer output, showing `__svc_create+0x65c/0x990` calling `__kmalloc_noprof`, further strengthens my hypothesis. I need to examine the exact code at `__svc_create+0x65c` to pinpoint where the `percpu_counter_init` result is being disregarded.

map[Expression:__svc_create]

map[Output:net/sunrpc/svc.c=482=static struct svc_serv *
net/sunrpc/svc.c:483:__svc_create(struct svc_program *prog, int nprogs, struct svc_stat *stats,
net/sunrpc/svc.c-484-	     unsigned int bufsize, int npools, int (*threadfn)(void *data))
--
net/sunrpc/svc.c=559=struct svc_serv *svc_create(struct svc_program *prog, unsigned int bufsize,
--
net/sunrpc/svc.c-561-{
net/sunrpc/svc.c:562:	return __svc_create(prog, 1, NULL, bufsize, 1, threadfn);
net/sunrpc/svc.c-563-}
--
net/sunrpc/svc.c=576=struct svc_serv *svc_create_pooled(struct svc_program *prog,
--
net/sunrpc/svc.c-584-
net/sunrpc/svc.c:585:	serv = __svc_create(prog, nprogs, stats, bufsize, npools, threadfn);
net/sunrpc/svc.c-586-	if (!serv)
]

gemini-3.1-pro-preview

							input: 109130
							output: 36
							thoughts: 107
						

**My Thought Process Unraveling `svc_create` Initialization**

Okay, so I'm digging into the `svc_create` function, trying to get a grip on its initialization sequence. My initial thought is to trace the memory allocation paths, specifically focusing on how the per-CPU counters and the service pools are set up.

Right off the bat, I notice that `__svc_create` – which is, of course, the core initialization routine I’m examining – doesn't directly handle all the per-CPU counter setup. It delegates that. I see it calls `percpu_counter_init`. That’s a good sign, it means there’s a dedicated abstraction for managing these counters.

But I can't stop there, I need to see what `percpu_counter_init` itself is doing. My trace leads me further down the rabbit hole to `__percpu_counter_init_many`. This function, as the name suggests, is likely handling the actual per-CPU allocation for multiple counters, or at least the underlying mechanism for it.

And here's where a crucial detail emerges: `__percpu_counter_init_many` doesn't use the generic `__kmalloc_noprof` for its per-CPU allocations. Instead, it’s calling `pcpu_alloc`. This is significant because `pcpu_alloc` is specifically designed for per-CPU data structures, and knowing this helps me understand the performance and memory management characteristics of these counters. It’s not just a general-purpose kernel allocation.

Now, pivoting to the other major component of `__svc_create`'s initialization: the service pools. I see that `__svc_create` also directly invokes `kzalloc_objs`. This function is responsible for allocating an array of `struct svc_pool` objects, and the number of these pools is determined by `serv->sv_nrpools`. This tells me that the service is designed to operate with a configurable number of worker pools, and `kzalloc_objs` is handling the contiguous memory allocation for this array.

So, in essence, my initial mental model is evolving. `__svc_create` acts as the orchestrator, initiating per-CPU counter setup via `percpu_counter_init` (which leverages `__percpu_counter_init_many` and `pcpu_alloc` for its underlying allocations), and simultaneously managing the creation of the service pools using `kzalloc_objs`. It's a multi-faceted initialization, with distinct strategies for different types of data structures. I'll need to keep this distinction in mind as I continue to analyze the rest of the code.

map[ContextFile:net/sunrpc/svc.c Name:__svc_create]

map[SourceCode: 479:	/*
 480:	 * Create an RPC service
 481:	 */
 482:	static struct svc_serv *
 483:	__svc_create(struct svc_program *prog, int nprogs, struct svc_stat *stats,
 484:		     unsigned int bufsize, int npools, int (*threadfn)(void *data))
 485:	{
 486:		struct svc_serv	*serv;
 487:		unsigned int vers;
 488:		unsigned int xdrsize;
 489:		unsigned int i;
 490:	
 491:		if (!(serv = kzalloc_obj(*serv)))
 492:			return NULL;
 493:		serv->sv_name      = prog->pg_name;
 494:		serv->sv_programs  = prog;
 495:		serv->sv_nprogs    = nprogs;
 496:		serv->sv_stats     = stats;
 497:		if (bufsize > RPCSVC_MAXPAYLOAD)
 498:			bufsize = RPCSVC_MAXPAYLOAD;
 499:		serv->sv_max_payload = bufsize? bufsize : 4096;
 500:		serv->sv_max_mesg  = roundup(serv->sv_max_payload + PAGE_SIZE, PAGE_SIZE);
 501:		serv->sv_threadfn = threadfn;
 502:		xdrsize = 0;
 503:		for (i = 0; i < nprogs; i++) {
 504:			struct svc_program *progp = &prog[i];
 505:	
 506:			progp->pg_lovers = progp->pg_nvers-1;
 507:			for (vers = 0; vers < progp->pg_nvers ; vers++)
 508:				if (progp->pg_vers[vers]) {
 509:					progp->pg_hivers = vers;
 510:					if (progp->pg_lovers > vers)
 511:						progp->pg_lovers = vers;
 512:					if (progp->pg_vers[vers]->vs_xdrsize > xdrsize)
 513:						xdrsize = progp->pg_vers[vers]->vs_xdrsize;
 514:				}
 515:		}
 516:		serv->sv_xdrsize   = xdrsize;
 517:		INIT_LIST_HEAD(&serv->sv_tempsocks);
 518:		INIT_LIST_HEAD(&serv->sv_permsocks);
 519:		timer_setup(&serv->sv_temptimer, NULL, 0);
 520:		spin_lock_init(&serv->sv_lock);
 521:	
 522:		__svc_init_bc(serv);
 523:	
 524:		serv->sv_nrpools = npools;
 525:		serv->sv_pools =
 526:			kzalloc_objs(struct svc_pool, serv->sv_nrpools);
 527:		if (!serv->sv_pools) {
 528:			kfree(serv);
 529:			return NULL;
 530:		}
 531:	
 532:		for (i = 0; i < serv->sv_nrpools; i++) {
 533:			struct svc_pool *pool = &serv->sv_pools[i];
 534:	
 535:			dprintk("svc: initialising pool %u for %s\n",
 536:					i, serv->sv_name);
 537:	
 538:			pool->sp_id = i;
 539:			lwq_init(&pool->sp_xprts);
 540:			INIT_LIST_HEAD(&pool->sp_all_threads);
 541:			init_llist_head(&pool->sp_idle_threads);
 542:	
 543:			percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL);
 544:			percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL);
 545:			percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL);
 546:		}
 547:	
 548:		return serv;
 549:	}
 SourceFile:net/sunrpc/svc.c]

gemini-3.1-pro-preview

							input: 110466
							output: 41
							thoughts: 173
						

**My Thought Process on Per-CPU Counter Allocation and Potential Issues**

Okay, so I'm digging into this stack trace, and the first thing that jumps out at me is this call sequence: `__svc_create` is directly invoking `__kmalloc_noprof`. That's a bit unexpected, and I'm immediately wondering about the context and implications of that specific allocation.

My immediate next thought is to trace the initialization path for per-CPU counters, as that seems to be the underlying mechanism at play here. I see that `percpu_counter_init` is involved, and it, in turn, calls `__percpu_counter_init_many`. This then leads me to `__alloc_percpu_gfp`. Now, my brain is starting to connect the dots, and I'm wondering if `__alloc_percpu_gfp` might, under certain conditions, ultimately result in a call to `kmalloc`. This is a critical junction because different allocation paths can have different properties and failure modes.

Then, a red flag goes up. I recall that `percpu_counter_init` is supposed to return `-ENOMEM` if it fails to allocate the necessary memory. However, the preceding function, `__svc_create`, doesn't seem to be checking this return value. This is a potential bug – a failure in per-CPU counter initialization could be silently ignored, leading to unpredictable behavior downstream. I'm mentally flagging this as a significant area of concern.

My analysis continues, and I notice another detail within `__percpu_counter_init_many`. It appears to also allocate a "lock class key" if `lockdep` is enabled. This is an interesting point, as it suggests that per-CPU counters have a dependency on the lock debugging infrastructure. While not necessarily a bug, it's a factor to consider in the overall complexity and potential interactions.

At this point, my instinct is to dive deep into the source code. I need to verify these assumptions and understand the exact logic. Therefore, my next step is to explicitly check the implementation of `__percpu_counter_init_many` within `lib/percpu_counter.c`. This is where I'll get the definitive answers about the allocation strategies, the handling of failures, and the interaction with `lockdep`.

map[ContextFile:lib/percpu_counter.c Name:__percpu_counter_init_many]

map[SourceCode: 188:	int __percpu_counter_init_many(struct percpu_counter *fbc, s64 amount,
 189:				       gfp_t gfp, u32 nr_counters,
 190:				       struct lock_class_key *key)
 191:	{
 192:		unsigned long flags __maybe_unused;
 193:		size_t counter_size;
 194:		s32 __percpu *counters;
 195:		u32 i;
 196:	
 197:		counter_size = ALIGN(sizeof(*counters), __alignof__(*counters));
 198:		counters = __alloc_percpu_gfp(nr_counters * counter_size,
 199:					      __alignof__(*counters), gfp);
 200:		if (!counters) {
 201:			fbc[0].counters = NULL;
 202:			return -ENOMEM;
 203:		}
 204:	
 205:		for (i = 0; i < nr_counters; i++) {
 206:			raw_spin_lock_init(&fbc[i].lock);
 207:			lockdep_set_class(&fbc[i].lock, key);
 208:	#ifdef CONFIG_HOTPLUG_CPU
 209:			INIT_LIST_HEAD(&fbc[i].list);
 210:	#endif
 211:			fbc[i].count = amount;
 212:			fbc[i].counters = (void __percpu *)counters + i * counter_size;
 213:	
 214:			debug_percpu_counter_activate(&fbc[i]);
 215:		}
 216:	
 217:	#ifdef CONFIG_HOTPLUG_CPU
 218:		spin_lock_irqsave(&percpu_counters_lock, flags);
 219:		for (i = 0; i < nr_counters; i++)
 220:			list_add(&fbc[i].list, &percpu_counters);
 221:		spin_unlock_irqrestore(&percpu_counters_lock, flags);
 222:	#endif
 223:		return 0;
 224:	}
 SourceFile:lib/percpu_counter.c]

gemini-3.1-pro-preview

							input: 111297
							output: 18
							thoughts: 418
						

**My Thought Process Unraveling the `percpu_counter` Crash**

Ah, I've been tracing this particularly nasty crash that's been popping up, and I think I've finally pieced together the sequence of events. It all hinges on a specific failure path within the per-CPU allocation mechanism.

My initial observation was that if `__alloc_percpu_gfp` fails – which it can, for instance, due to memory pressure or a fault injection as seen in the reproducer output – it correctly sets `fbc[0].counters` to `NULL` and returns a `-ENOMEM` error. This part seems like standard, robust error handling.

The critical flaw, however, appears immediately after. The `__svc_create` function, in its current implementation, completely *ignores* this `-ENOMEM` return value. It just plows ahead as if the per-CPU allocation *had* succeeded, and returns the `serv` object as though everything is perfectly fine. This is where the problem begins to brew.

Later in the execution flow, `svc_xprt_enqueue` gets invoked. This function, as part of its operations, attempts to increment a per-CPU counter using `percpu_counter_inc(&pool->sp_sockets_queued)`. This, in turn, calls `percpu_counter_add_batch`. And here's the direct point of failure: `percpu_counter_add_batch` attempts to read the per-CPU counter data via `this_cpu_read(*fbc->counters)`.

Because `__svc_create` so carelessly ignored the initial allocation failure, `fbc->counters` is still `NULL`. So, when `this_cpu_read` tries to dereference this `NULL` pointer, it predictably results in a page fault. The reproducer output confirms this, showing the fault occurring at `NULL + per_cpu_offset`, which is precisely what I would expect when dereferencing a null pointer in this context.

Looking at the reproducer output, I noticed something that initially seemed a bit confusing:

```
[  230.345846][ T6027] FAULT_INJECTION: forcing a failure.
[  230.345846][ T6027] name failslab, interval 1, probability 5, space 0, times -1
...
[  230.358107][ T6027]  __kmalloc_noprof+0xfe/0x720
[  230.358129][ T6027]  ? __svc_create+0x65c/0x990
[  230.358143][ T6027]  ? __svc_create+0x65c/0x990
[  230.358162][ T6027]  __svc_create+0x65c/0x990
```

The fault stack trace shows `__kmalloc_noprof` being called, and then `__svc_create` appearing right before it, even referencing `__svc_create+0x65c`. This made me pause and re-examine the `__svc_create` function. My follow-up investigation revealed that the call to `__kmalloc_noprof` at that specific offset (`+0x65c`) is indeed within the `__svc_create` function itself. This is where the initial per-CPU allocation would have happened if it hadn't been for the fault injection. So, the fault injection is happening *during* the attempt to allocate the per-CPU data within `__svc_create`, and the subsequent code path in `__svc_create` doesn't properly handle the failure of that internal allocation.

Therefore, my conclusion is: the problem isn't that `__svc_create` *doesn't* attempt to allocate the per-CPU memory, but rather that it doesn't handle the *failure* of that allocation correctly, leading to the `NULL` pointer dereference later on.

map[Expression:kzalloc_objs]

map[Output:
Full output is too long, showing 500 out of 13860 lines.
Use more precise expression if possible.

Documentation/process/coding-style.rst=938=The kernel provides the following general purpose memory allocators:
Documentation/process/coding-style.rst:939:kmalloc(), kzalloc(), kmalloc_objs(), kzalloc_objs(), vmalloc(), and
Documentation/process/coding-style.rst-940-vzalloc().  Please refer to the API documentation for further information
--
Documentation/process/coding-style.rst=964=The preferred form for allocating a zeroed array is the following:
--
Documentation/process/coding-style.rst-967-
Documentation/process/coding-style.rst:968:	p = kzalloc_objs(*p, n, ...);
Documentation/process/coding-style.rst-969-
--
Documentation/process/deprecated.rst=398=become, respectively::
--
Documentation/process/deprecated.rst-402-	ptr = kmalloc_objs(*ptr, count [, gfp] );
Documentation/process/deprecated.rst:403:	ptr = kzalloc_objs(*ptr, count [, gfp] );
Documentation/process/deprecated.rst-404-	ptr = kmalloc_flex(*ptr, flex_member, count [, gfp] );
--
arch/alpha/kernel/module.c=64=module_frob_arch_sections(Elf64_Ehdr *hdr, Elf64_Shdr *sechdrs,
--
arch/alpha/kernel/module.c-95-	nsyms = symtab->sh_size / sizeof(Elf64_Sym);
arch/alpha/kernel/module.c:96:	chains = kzalloc_objs(struct got_entry, nsyms);
arch/alpha/kernel/module.c-97-	if (!chains) {
--
arch/arm/kernel/vdso.c=169=static int __init vdso_init(void)
--
arch/arm/kernel/vdso.c-181-	/* Allocate the VDSO text pagelist */
arch/arm/kernel/vdso.c:182:	vdso_text_pagelist = kzalloc_objs(struct page *, text_pages);
arch/arm/kernel/vdso.c-183-	if (vdso_text_pagelist == NULL)
--
arch/arm/mach-footbridge/dc21285.c=261=int __init dc21285_setup(int nr, struct pci_sys_data *sys)
--
arch/arm/mach-footbridge/dc21285.c-264-
arch/arm/mach-footbridge/dc21285.c:265:	res = kzalloc_objs(struct resource, 2);
arch/arm/mach-footbridge/dc21285.c-266-	if (!res) {
--
arch/arm/mach-omap1/mcbsp.c=292=static void omap_mcbsp_register_board_cfg(struct resource *res, int res_count,
--
arch/arm/mach-omap1/mcbsp.c-296-
arch/arm/mach-omap1/mcbsp.c:297:	omap_mcbsp_devices = kzalloc_objs(struct platform_device *, size);
arch/arm/mach-omap1/mcbsp.c-298-	if (!omap_mcbsp_devices) {
--
arch/arm/mach-omap2/omap_device.c=131=static int omap_device_build_from_dt(struct platform_device *pdev)
--
arch/arm/mach-omap2/omap_device.c-158-
arch/arm/mach-omap2/omap_device.c:159:	hwmods = kzalloc_objs(struct omap_hwmod *, oh_cnt);
arch/arm/mach-omap2/omap_device.c-160-	if (!hwmods) {
--
arch/arm/mach-omap2/pm33xx-core.c=379=static int __init amx3_idle_init(struct device_node *cpu_node, int cpu)
--
arch/arm/mach-omap2/pm33xx-core.c-412-
arch/arm/mach-omap2/pm33xx-core.c:413:	idle_states = kzalloc_objs(*idle_states, state_count);
arch/arm/mach-omap2/pm33xx-core.c-414-	if (!idle_states)
--
arch/arm/mach-omap2/sr_device.c=30=static void __init sr_set_nvalues(struct omap_volt_data *volt_data,
--
arch/arm/mach-omap2/sr_device.c-41-
arch/arm/mach-omap2/sr_device.c:42:	nvalue_table = kzalloc_objs(*nvalue_table, count);
arch/arm/mach-omap2/sr_device.c-43-	if (!nvalue_table)
--
arch/arm/mach-versatile/spc.c=393=static int ve_spc_populate_opps(uint32_t cluster)
--
arch/arm/mach-versatile/spc.c-397-
arch/arm/mach-versatile/spc.c:398:	opps = kzalloc_objs(*opps, MAX_OPPS);
arch/arm/mach-versatile/spc.c-399-	if (!opps)
--
arch/arm/xen/enlighten.c=316=int __init arch_xen_unpopulated_init(struct resource **res)
--
arch/arm/xen/enlighten.c-343-
arch/arm/xen/enlighten.c:344:	regs = kzalloc_objs(*regs, nr_reg);
arch/arm/xen/enlighten.c-345-	if (!regs) {
--
arch/arm64/kernel/vdso.c=68=static int __init __vdso_init(enum vdso_abi abi)
--
arch/arm64/kernel/vdso.c-83-
arch/arm64/kernel/vdso.c:84:	vdso_pagelist = kzalloc_objs(struct page *, vdso_info[abi].vdso_pages);
arch/arm64/kernel/vdso.c-85-	if (vdso_pagelist == NULL)
--
arch/arm64/kvm/vgic/vgic-init.c=207=static int kvm_vgic_dist_init(struct kvm *kvm, unsigned int nr_spis)
--
arch/arm64/kvm/vgic/vgic-init.c-213-	dist->active_spis = (atomic_t)ATOMIC_INIT(0);
arch/arm64/kvm/vgic/vgic-init.c:214:	dist->spis = kzalloc_objs(struct vgic_irq, nr_spis, GFP_KERNEL_ACCOUNT);
arch/arm64/kvm/vgic/vgic-init.c-215-	if (!dist->spis)
--
arch/arm64/kvm/vgic/vgic-init.c=316=static int vgic_allocate_private_irqs_locked(struct kvm_vcpu *vcpu, u32 type)
--
arch/arm64/kvm/vgic/vgic-init.c-331-
arch/arm64/kvm/vgic/vgic-init.c:332:	vgic_cpu->private_irqs = kzalloc_objs(struct vgic_irq,
arch/arm64/kvm/vgic/vgic-init.c-333-					      num_private_irqs,
--
arch/arm64/kvm/vgic/vgic-irqfd.c=142=int kvm_vgic_setup_default_irq_routing(struct kvm *kvm)
--
arch/arm64/kvm/vgic/vgic-irqfd.c-148-
arch/arm64/kvm/vgic/vgic-irqfd.c:149:	entries = kzalloc_objs(*entries, nr, GFP_KERNEL_ACCOUNT);
arch/arm64/kvm/vgic/vgic-irqfd.c-150-	if (!entries)
--
arch/arm64/kvm/vgic/vgic-v4.c=242=int vgic_v4_init(struct kvm *kvm)
--
arch/arm64/kvm/vgic/vgic-v4.c-258-
arch/arm64/kvm/vgic/vgic-v4.c:259:	dist->its_vm.vpes = kzalloc_objs(*dist->its_vm.vpes, nr_vcpus,
arch/arm64/kvm/vgic/vgic-v4.c-260-					 GFP_KERNEL_ACCOUNT);
--
arch/csky/kernel/vdso.c=17=static int __init vdso_init(void)
--
arch/csky/kernel/vdso.c-22-	vdso_pagelist =
arch/csky/kernel/vdso.c:23:		kzalloc_objs(struct page *, vdso_pages);
arch/csky/kernel/vdso.c-24-	if (unlikely(vdso_pagelist == NULL)) {
--
arch/loongarch/kernel/vdso.c=45=static int __init init_vdso(void)
--
arch/loongarch/kernel/vdso.c-55-	vdso_info.code_mapping.pages =
arch/loongarch/kernel/vdso.c:56:		kzalloc_objs(struct page *, vdso_info.size / PAGE_SIZE);
arch/loongarch/kernel/vdso.c-57-
--
arch/loongarch/kvm/intc/pch_pic.c=410=static int kvm_setup_default_irq_routing(struct kvm *kvm)
--
arch/loongarch/kvm/intc/pch_pic.c-415-
arch/loongarch/kvm/intc/pch_pic.c:416:	entries = kzalloc_objs(*entries, nr);
arch/loongarch/kvm/intc/pch_pic.c-417-	if (!entries)
--
arch/mips/alchemy/common/clock.c=754=static int __init alchemy_clk_init_fgens(int ctype)
--
arch/mips/alchemy/common/clock.c-777-
arch/mips/alchemy/common/clock.c:778:	a = kzalloc_objs(*a, 6);
arch/mips/alchemy/common/clock.c-779-	if (!a)
--
arch/mips/alchemy/common/clock.c=960=static int __init alchemy_clk_setup_imux(int ctype)
--
arch/mips/alchemy/common/clock.c-998-
arch/mips/alchemy/common/clock.c:999:	a = kzalloc_objs(*a, 6);
arch/mips/alchemy/common/clock.c-1000-	if (!a)
--
arch/mips/alchemy/common/dbdma.c=1056=static int __init dbdma_setup(unsigned int irq, dbdev_tab_t *idtable)
--
arch/mips/alchemy/common/dbdma.c-1059-
arch/mips/alchemy/common/dbdma.c:1060:	dbdev_tab = kzalloc_objs(dbdev_tab_t, DBDEV_TAB_SIZE);
arch/mips/alchemy/common/dbdma.c-1061-	if (!dbdev_tab)
--
arch/mips/alchemy/common/platform.c=203=static int __init _new_usbres(struct resource **r, struct platform_device **d)
arch/mips/alchemy/common/platform.c-204-{
arch/mips/alchemy/common/platform.c:205:	*r = kzalloc_objs(struct resource, 2);
arch/mips/alchemy/common/platform.c-206-	if (!*r)
--
arch/mips/alchemy/devboards/platform.c=70=int __init db1x_register_pcmcia_socket(phys_addr_t pcmcia_attr_start,
--
arch/mips/alchemy/devboards/platform.c-91-
arch/mips/alchemy/devboards/platform.c:92:	sr = kzalloc_objs(struct resource, cnt);
arch/mips/alchemy/devboards/platform.c-93-	if (!sr)
--
arch/mips/alchemy/devboards/platform.c=154=int __init db1x_register_norflash(unsigned long size, int width,
--
arch/mips/alchemy/devboards/platform.c-166-	ret = -ENOMEM;
arch/mips/alchemy/devboards/platform.c:167:	parts = kzalloc_objs(struct mtd_partition, 5);
arch/mips/alchemy/devboards/platform.c-168-	if (!parts)
--
arch/mips/kernel/smp-cps.c=295=static void __init cps_prepare_cpus(unsigned int max_cpus)
--
arch/mips/kernel/smp-cps.c-343-	nclusters = mips_cps_numclusters();
arch/mips/kernel/smp-cps.c:344:	mips_cps_cluster_bootcfg = kzalloc_objs(*mips_cps_cluster_bootcfg,
arch/mips/kernel/smp-cps.c-345-						nclusters);
--
arch/mips/kernel/smp-cps.c-354-		ncores = mips_cps_numcores(cl);
arch/mips/kernel/smp-cps.c:355:		core_bootcfg = kzalloc_objs(*core_bootcfg, ncores);
arch/mips/kernel/smp-cps.c-356-		if (!core_bootcfg)
--
arch/mips/kernel/smp-cps.c-369-			core_vpes = core_vpe_count(cl, c);
arch/mips/kernel/smp-cps.c:370:			core_bootcfg[c].vpe_config = kzalloc_objs(*core_bootcfg[c].vpe_config,
arch/mips/kernel/smp-cps.c-371-								  core_vpes);
--
arch/parisc/kernel/vdso.c=99=static struct page ** __init vdso_setup_pages(void *start, void *end)
--
arch/parisc/kernel/vdso.c-104-
arch/parisc/kernel/vdso.c:105:	pagelist = kzalloc_objs(struct page *, pages + 1);
arch/parisc/kernel/vdso.c-106-	if (!pagelist)
--
arch/parisc/net/bpf_jit_core.c=44=struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_prog *prog)
--
arch/parisc/net/bpf_jit_core.c-71-	ctx->prog = prog;
arch/parisc/net/bpf_jit_core.c:72:	ctx->offset = kzalloc_objs(int, prog->len);
arch/parisc/net/bpf_jit_core.c-73-	if (!ctx->offset)
--
arch/powerpc/kernel/smp.c=1113=void __init smp_prepare_cpus(unsigned int max_cpus)
--
arch/powerpc/kernel/smp.c-1174-		 */
arch/powerpc/kernel/smp.c:1175:		chip_id_lookup_table = kzalloc_objs(int, idx);
arch/powerpc/kernel/smp.c-1176-		if (chip_id_lookup_table)
--
arch/powerpc/kernel/vdso.c=242=static struct page ** __init vdso_setup_pages(void *start, void *end)
--
arch/powerpc/kernel/vdso.c-247-
arch/powerpc/kernel/vdso.c:248:	pagelist = kzalloc_objs(struct page *, pages + 1);
arch/powerpc/kernel/vdso.c-249-	if (!pagelist)
--
arch/powerpc/kvm/e500_mmu.c=731=int kvm_vcpu_ioctl_config_tlb(struct kvm_vcpu *vcpu,
--
arch/powerpc/kvm/e500_mmu.c-794-
arch/powerpc/kvm/e500_mmu.c:795:	privs[0] = kzalloc_objs(*privs[0], params.tlb_sizes[0]);
arch/powerpc/kvm/e500_mmu.c-796-	if (!privs[0]) {
--
arch/powerpc/kvm/e500_mmu.c-800-
arch/powerpc/kvm/e500_mmu.c:801:	privs[1] = kzalloc_objs(*privs[1], params.tlb_sizes[1]);
arch/powerpc/kvm/e500_mmu.c-802-	if (!privs[1]) {
--
arch/powerpc/kvm/e500_mmu.c=898=int kvmppc_e500_tlb_init(struct kvmppc_vcpu_e500 *vcpu_e500)
--
arch/powerpc/kvm/e500_mmu.c-922-
arch/powerpc/kvm/e500_mmu.c:923:	vcpu_e500->gtlb_priv[0] = kzalloc_objs(struct tlbe_priv,
arch/powerpc/kvm/e500_mmu.c-924-					       vcpu_e500->gtlb_params[0].entries);
--
arch/powerpc/kvm/e500_mmu.c-927-
arch/powerpc/kvm/e500_mmu.c:928:	vcpu_e500->gtlb_priv[1] = kzalloc_objs(struct tlbe_priv,
arch/powerpc/kvm/e500_mmu.c-929-					       vcpu_e500->gtlb_params[1].entries);
--
arch/powerpc/mm/drmem.c=425=static void __init init_drmem_v1_lmbs(const __be32 *prop)
--
arch/powerpc/mm/drmem.c-432-
arch/powerpc/mm/drmem.c:433:	drmem_info->lmbs = kzalloc_objs(*lmb, drmem_info->n_lmbs);
arch/powerpc/mm/drmem.c-434-	if (!drmem_info->lmbs)
--
arch/powerpc/mm/drmem.c=441=static void __init init_drmem_v2_lmbs(const __be32 *prop)
--
arch/powerpc/mm/drmem.c-459-
arch/powerpc/mm/drmem.c:460:	drmem_info->lmbs = kzalloc_objs(*lmb, drmem_info->n_lmbs);
arch/powerpc/mm/drmem.c-461-	if (!drmem_info->lmbs)
--
arch/powerpc/perf/imc-pmu.c=221=static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu)
--
arch/powerpc/perf/imc-pmu.c-259-	/* Allocate memory for the events */
arch/powerpc/perf/imc-pmu.c:260:	pmu->events = kzalloc_objs(struct imc_events, ct);
arch/powerpc/perf/imc-pmu.c-261-	if (!pmu->events) {
--
arch/powerpc/perf/imc-pmu.c-290-	 */
arch/powerpc/perf/imc-pmu.c:291:	attrs = kzalloc_objs(struct attribute *, ((ct * 3) + 1));
arch/powerpc/perf/imc-pmu.c-292-	if (!attrs) {
--
arch/powerpc/perf/imc-pmu.c=1521=static int init_nest_pmu_ref(void)
--
arch/powerpc/perf/imc-pmu.c-1524-
arch/powerpc/perf/imc-pmu.c:1525:	nest_imc_refc = kzalloc_objs(*nest_imc_refc, num_possible_nodes());
arch/powerpc/perf/imc-pmu.c-1526-
--
arch/powerpc/perf/imc-pmu.c=1678=static int imc_mem_init(struct imc_pmu *pmu_ptr, struct device_node *parent,
--
arch/powerpc/perf/imc-pmu.c-1695-		if (!per_nest_pmu_arr) {
arch/powerpc/perf/imc-pmu.c:1696:			per_nest_pmu_arr = kzalloc_objs(struct imc_pmu *,
arch/powerpc/perf/imc-pmu.c-1697-							get_max_nest_dev() + 1);
--
arch/powerpc/perf/imc-pmu.c-1709-		nr_cores = DIV_ROUND_UP(num_possible_cpus(), threads_per_core);
arch/powerpc/perf/imc-pmu.c:1710:		pmu_ptr->mem_info = kzalloc_objs(struct imc_mem_info, nr_cores);
arch/powerpc/perf/imc-pmu.c-1711-
--
arch/powerpc/perf/imc-pmu.c-1714-
arch/powerpc/perf/imc-pmu.c:1715:		core_imc_refc = kzalloc_objs(struct imc_pmu_ref, nr_cores);
arch/powerpc/perf/imc-pmu.c-1716-
--
arch/powerpc/perf/imc-pmu.c-1747-		nr_cores = DIV_ROUND_UP(num_possible_cpus(), threads_per_core);
arch/powerpc/perf/imc-pmu.c:1748:		trace_imc_refc = kzalloc_objs(struct imc_pmu_ref, nr_cores);
arch/powerpc/perf/imc-pmu.c-1749-		if (!trace_imc_refc)
--
arch/powerpc/perf/vpa-dtl.c=508=static void *vpa_dtl_setup_aux(struct perf_event *event, void **pages,
--
arch/powerpc/perf/vpa-dtl.c-525-
arch/powerpc/perf/vpa-dtl.c:526:	pglist = kzalloc_objs(*pglist, nr_pages);
arch/powerpc/perf/vpa-dtl.c-527-	if (!pglist)
--
arch/powerpc/platforms/44x/pci.c=1307=static int __init ppc4xx_pciex_check_core_init(struct device_node *np)
--
arch/powerpc/platforms/44x/pci.c-1341-		ppc4xx_pciex_ports =
arch/powerpc/platforms/44x/pci.c:1342:		       kzalloc_objs(struct ppc4xx_pciex_port, count);
arch/powerpc/platforms/44x/pci.c-1343-		if (ppc4xx_pciex_ports) {
--
arch/powerpc/platforms/powernv/idle.c=1323=static int __init pnv_parse_cpuidle_dt(void)
--
arch/powerpc/platforms/powernv/idle.c-1339-
arch/powerpc/platforms/powernv/idle.c:1340:	pnv_idle_states = kzalloc_objs(*pnv_idle_states, nr_idle_states);
arch/powerpc/platforms/powernv/idle.c-1341-	temp_u32 = kcalloc(nr_idle_states, sizeof(u32),  GFP_KERNEL);
--
arch/powerpc/platforms/powernv/memtrace.c=131=static int memtrace_init_regions_runtime(u64 size)
--
arch/powerpc/platforms/powernv/memtrace.c-135-
arch/powerpc/platforms/powernv/memtrace.c:136:	memtrace_array = kzalloc_objs(struct memtrace_entry, num_online_nodes());
arch/powerpc/platforms/powernv/memtrace.c-137-	if (!memtrace_array) {
--
arch/powerpc/platforms/powernv/opal-async.c=246=int __init opal_async_comp_init(void)
--
arch/powerpc/platforms/powernv/opal-async.c-267-	opal_max_async_tokens = be32_to_cpup(async);
arch/powerpc/platforms/powernv/opal-async.c:268:	opal_async_tokens = kzalloc_objs(*opal_async_tokens,
arch/powerpc/platforms/powernv/opal-async.c-269-					 opal_max_async_tokens);
--
arch/powerpc/platforms/powernv/opal-imc.c=82=static int imc_get_mem_addr_nest(struct device_node *node,
--
arch/powerpc/platforms/powernv/opal-imc.c-110-
arch/powerpc/platforms/powernv/opal-imc.c:111:	pmu_ptr->mem_info = kzalloc_objs(*pmu_ptr->mem_info, nr_chips + 1);
arch/powerpc/platforms/powernv/opal-imc.c-112-	if (!pmu_ptr->mem_info)
--
arch/powerpc/platforms/powernv/opal-irqchip.c=174=int __init opal_event_init(void)
--
arch/powerpc/platforms/powernv/opal-irqchip.c-223-	/* Allocate an IRQ resources array */
arch/powerpc/platforms/powernv/opal-irqchip.c:224:	opal_irqs = kzalloc_objs(struct resource, opal_irq_count);
arch/powerpc/platforms/powernv/opal-irqchip.c-225-	if (WARN_ON(!opal_irqs)) {
--
arch/powerpc/platforms/powernv/opal-powercap.c=138=void __init opal_powercap_init(void)
--
arch/powerpc/platforms/powernv/opal-powercap.c-148-
arch/powerpc/platforms/powernv/opal-powercap.c:149:	pcaps = kzalloc_objs(*pcaps, of_get_child_count(powercap));
arch/powerpc/platforms/powernv/opal-powercap.c-150-	if (!pcaps)
--
arch/powerpc/platforms/powernv/opal-powercap.c-179-
arch/powerpc/platforms/powernv/opal-powercap.c:180:		pcaps[i].pattrs = kzalloc_objs(struct powercap_attr, j);
arch/powerpc/platforms/powernv/opal-powercap.c-181-		if (!pcaps[i].pattrs)
--
arch/powerpc/platforms/powernv/opal-powercap.c-183-
arch/powerpc/platforms/powernv/opal-powercap.c:184:		pcaps[i].pg.attrs = kzalloc_objs(struct attribute *, j + 1);
arch/powerpc/platforms/powernv/opal-powercap.c-185-		if (!pcaps[i].pg.attrs) {
--
arch/powerpc/platforms/powernv/opal-psr.c=119=void __init opal_psr_init(void)
--
arch/powerpc/platforms/powernv/opal-psr.c-130-
arch/powerpc/platforms/powernv/opal-psr.c:131:	psr_attrs = kzalloc_objs(*psr_attrs, of_get_child_count(psr));
arch/powerpc/platforms/powernv/opal-psr.c-132-	if (!psr_attrs)
--
arch/powerpc/platforms/powernv/opal-sensor-groups.c=160=void __init opal_sensor_groups_init(void)
--
arch/powerpc/platforms/powernv/opal-sensor-groups.c-170-
arch/powerpc/platforms/powernv/opal-sensor-groups.c:171:	sgs = kzalloc_objs(*sgs, of_get_child_count(sg));
arch/powerpc/platforms/powernv/opal-sensor-groups.c-172-	if (!sgs)
--
arch/powerpc/platforms/powernv/opal-sensor-groups.c-192-
arch/powerpc/platforms/powernv/opal-sensor-groups.c:193:		sgs[i].sgattrs = kzalloc_objs(*sgs[i].sgattrs, nr_attrs);
arch/powerpc/platforms/powernv/opal-sensor-groups.c-194-		if (!sgs[i].sgattrs)
--
arch/powerpc/platforms/powernv/opal-sensor-groups.c-196-
arch/powerpc/platforms/powernv/opal-sensor-groups.c:197:		sgs[i].sg.attrs = kzalloc_objs(*sgs[i].sg.attrs, nr_attrs + 1);
arch/powerpc/platforms/powernv/opal-sensor-groups.c-198-
--
arch/powerpc/platforms/powernv/opal-sysparam.c=143=void __init opal_sys_param_init(void)
--
arch/powerpc/platforms/powernv/opal-sysparam.c-224-
arch/powerpc/platforms/powernv/opal-sysparam.c:225:	attr = kzalloc_objs(*attr, count);
arch/powerpc/platforms/powernv/opal-sysparam.c-226-	if (!attr) {
--
arch/powerpc/platforms/pseries/papr_platform_attributes.c=233=static int __init papr_init(void)
--
arch/powerpc/platforms/pseries/papr_platform_attributes.c-295-
arch/powerpc/platforms/pseries/papr_platform_attributes.c:296:	papr_groups = kzalloc_objs(*papr_groups, num_attrs);
arch/powerpc/platforms/pseries/papr_platform_attributes.c-297-	if (!papr_groups)
--
arch/powerpc/platforms/pseries/papr_platform_attributes.c-313-	for (idx = 0; idx < num_attrs; idx++) {
arch/powerpc/platforms/pseries/papr_platform_attributes.c:314:		papr_groups[idx].pg.attrs = kzalloc_objs(*papr_groups[idx].pg.attrs,
arch/powerpc/platforms/pseries/papr_platform_attributes.c-315-							 KOBJ_MAX_ATTRS + 1);
--
arch/powerpc/sysdev/mpic.c=542=static void __init mpic_scan_ht_pics(struct mpic *mpic)
--
arch/powerpc/sysdev/mpic.c-549-	/* Allocate fixups array */
arch/powerpc/sysdev/mpic.c:550:	mpic->fixups = kzalloc_objs(*mpic->fixups, 128);
arch/powerpc/sysdev/mpic.c-551-	BUG_ON(mpic->fixups == NULL);
--
arch/powerpc/sysdev/mpic_msgr.c=167=static int mpic_msgr_probe(struct platform_device *dev)
--
arch/powerpc/sysdev/mpic_msgr.c-190-
arch/powerpc/sysdev/mpic_msgr.c:191:		mpic_msgrs = kzalloc_objs(*mpic_msgrs, mpic_msgr_count);
arch/powerpc/sysdev/mpic_msgr.c-192-		if (!mpic_msgrs) {
--
arch/powerpc/sysdev/xive/common.c=1119=static int __init xive_init_ipis(void)
--
arch/powerpc/sysdev/xive/common.c-1134-
arch/powerpc/sysdev/xive/common.c:1135:	xive_ipis = kzalloc_objs(*xive_ipis, nr_node_ids,
arch/powerpc/sysdev/xive/common.c-1136-				 GFP_KERNEL | __GFP_NOFAIL);
--
arch/riscv/kernel/tests/kprobes/test-kprobes.c=13=static void test_kprobe_riscv(struct kunit *test)
--
arch/riscv/kernel/tests/kprobes/test-kprobes.c-22-
arch/riscv/kernel/tests/kprobes/test-kprobes.c:23:	kp = kzalloc_objs(*kp, num_kprobe);
arch/riscv/kernel/tests/kprobes/test-kprobes.c-24-	KUNIT_EXPECT_TRUE(test, kp);
--
arch/riscv/kernel/unaligned_access_speed.c=149=static void __init check_unaligned_access_speed_all_cpus(void)
--
arch/riscv/kernel/unaligned_access_speed.c-152-	unsigned int cpu_count = num_possible_cpus();
arch/riscv/kernel/unaligned_access_speed.c:153:	struct page **bufs = kzalloc_objs(*bufs, cpu_count);
arch/riscv/kernel/unaligned_access_speed.c-154-
--
arch/riscv/kernel/vdso.c=44=static void __init __vdso_init(struct __vdso_info *vdso_info)
--
arch/riscv/kernel/vdso.c-57-
arch/riscv/kernel/vdso.c:58:	vdso_pagelist = kzalloc_objs(struct page *, vdso_info->vdso_pages);
arch/riscv/kernel/vdso.c-59-	if (vdso_pagelist == NULL)
--
arch/riscv/kvm/vcpu_sbi_fwft.c=374=static int kvm_sbi_ext_fwft_init(struct kvm_vcpu *vcpu)
--
arch/riscv/kvm/vcpu_sbi_fwft.c-380-
arch/riscv/kvm/vcpu_sbi_fwft.c:381:	fwft->configs = kzalloc_objs(struct kvm_sbi_fwft_config,
arch/riscv/kvm/vcpu_sbi_fwft.c-382-				     ARRAY_SIZE(features));
--
arch/riscv/kvm/vm.c=93=int kvm_riscv_setup_default_irq_routing(struct kvm *kvm, u32 lines)
--
arch/riscv/kvm/vm.c-97-
arch/riscv/kvm/vm.c:98:	ents = kzalloc_objs(*ents, lines);
arch/riscv/kvm/vm.c-99-	if (!ents)
--
arch/riscv/net/bpf_jit_comp64.c=1022=static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im,
--
arch/riscv/net/bpf_jit_comp64.c-1197-	if (fmod_ret->nr_nodes) {
arch/riscv/net/bpf_jit_comp64.c:1198:		branches_off = kzalloc_objs(int, fmod_ret->nr_nodes);
arch/riscv/net/bpf_jit_comp64.c-1199-		if (!branches_off)
--
arch/riscv/net/bpf_jit_core.c=44=struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_prog *prog)
--
arch/riscv/net/bpf_jit_core.c-74-	ctx->prog = prog;
arch/riscv/net/bpf_jit_core.c:75:	ctx->offset = kzalloc_objs(int, prog->len);
arch/riscv/net/bpf_jit_core.c-76-	if (!ctx->offset)
--
arch/s390/appldata/appldata_base.c=347=int appldata_register_ops(struct appldata_ops *ops)
--
arch/s390/appldata/appldata_base.c-351-
arch/s390/appldata/appldata_base.c:352:	ops->ctl_table = kzalloc_objs(struct ctl_table, 1);
arch/s390/appldata/appldata_base.c-353-	if (!ops->ctl_table)
--
arch/s390/include/asm/idals.h=88=static inline int set_normalized_cda(struct ccw1 *ccw, void *vaddr)
--
arch/s390/include/asm/idals.h-96-	if (nridaws > 0) {
arch/s390/include/asm/idals.h:97:		idal = kzalloc_objs(*idal, nridaws, GFP_ATOMIC | GFP_DMA);
arch/s390/include/asm/idals.h-98-		if (!idal)
--
arch/s390/kernel/cert_store.c=315=static int invalidate_keyring_keys(struct key *keyring)
--
arch/s390/kernel/cert_store.c-324-	num_keys = keyring_payload_len / sizeof(key_serial_t);
arch/s390/kernel/cert_store.c:325:	key_array = kzalloc_objs(key_serial_t, num_keys);
arch/s390/kernel/cert_store.c-326-	if (!key_array)
--
arch/s390/kernel/debug.c=307=static debug_info_t *debug_info_alloc(const char *name, int pages_per_area,
--
arch/s390/kernel/debug.c-316-		goto fail_malloc_rc;
arch/s390/kernel/debug.c:317:	rc->active_entries = kzalloc_objs(int, nr_areas);
arch/s390/kernel/debug.c-318-	if (!rc->active_entries)
arch/s390/kernel/debug.c-319-		goto fail_malloc_active_entries;
arch/s390/kernel/debug.c:320:	rc->active_pages = kzalloc_objs(int, nr_areas);
arch/s390/kernel/debug.c-321-	if (!rc->active_pages)
--
arch/s390/kernel/vdso.c=129=static struct page ** __init vdso_setup_pages(void *start, void *end)
--
arch/s390/kernel/vdso.c-134-
arch/s390/kernel/vdso.c:135:	pagelist = kzalloc_objs(struct page *, pages + 1);
arch/s390/kernel/vdso.c-136-	if (!pagelist)
--
arch/s390/kvm/pci.c=120=int kvm_s390_pci_aen_init(u8 nisc)
--
arch/s390/kvm/pci.c-128-	mutex_lock(&aift->aift_lock);
arch/s390/kvm/pci.c:129:	aift->kzdev = kzalloc_objs(struct kvm_zdev *, ZPCI_NR_DEVICES);
arch/s390/kvm/pci.c-130-	if (!aift->kzdev) {
--
arch/s390/pci/pci.c=1065=static int zpci_mem_init(void)
--
arch/s390/pci/pci.c-1076-
arch/s390/pci/pci.c:1077:	zpci_iomap_start = kzalloc_objs(*zpci_iomap_start, ZPCI_IOMAP_ENTRIES);
arch/s390/pci/pci.c-1078-	if (!zpci_iomap_start)
--
arch/s390/pci/pci_irq.c=552=static int __init zpci_directed_irq_init(void)
--
arch/s390/pci/pci_irq.c-565-
arch/s390/pci/pci_irq.c:566:	zpci_ibv = kzalloc_objs(*zpci_ibv, num_possible_cpus());
arch/s390/pci/pci_irq.c-567-	if (!zpci_ibv)
--
arch/s390/pci/pci_irq.c=590=static int __init zpci_floating_irq_init(void)
arch/s390/pci/pci_irq.c-591-{
arch/s390/pci/pci_irq.c:592:	zpci_ibv = kzalloc_objs(*zpci_ibv, ZPCI_NR_DEVICES);
arch/s390/pci/pci_irq.c-593-	if (!zpci_ibv)
--
arch/sh/drivers/dma/dmabrg.c=151=static int __init dmabrg_init(void)
--
arch/sh/drivers/dma/dmabrg.c-155-
arch/sh/drivers/dma/dmabrg.c:156:	dmabrg_handlers = kzalloc_objs(struct dmabrg_handler, 10);
arch/sh/drivers/dma/dmabrg.c-157-	if (!dmabrg_handlers)
--
arch/sh/drivers/pci/pcie-sh7786.c=545=static int __init sh7786_pcie_init(void)
--
arch/sh/drivers/pci/pcie-sh7786.c-560-
arch/sh/drivers/pci/pcie-sh7786.c:561:	sh7786_pcie_ports = kzalloc_objs(struct sh7786_pcie_port, nr_ports);
arch/sh/drivers/pci/pcie-sh7786.c-562-	if (unlikely(!sh7786_pcie_ports))
--
arch/sparc/kernel/sys_sparc_64.c=625=SYSCALL_DEFINE5(utrap_install, utrap_entry_t, type,
--
arch/sparc/kernel/sys_sparc_64.c-649-		current_thread_info()->utraps =
arch/sparc/kernel/sys_sparc_64.c:650:			kzalloc_objs(long, UT_TRAP_INSTRUCTION_31 + 1);
arch/sparc/kernel/sys_sparc_64.c-651-		if (!current_thread_info()->utraps)
--
arch/sparc/vdso/vma.c=46=static int __init init_vdso_image(const struct vdso_image *image,
--
arch/sparc/vdso/vma.c-60-
arch/sparc/vdso/vma.c:61:	cpp = kzalloc_objs(struct page *, cnpages);
arch/sparc/vdso/vma.c-62-	vdso_mapping->pages = cpp;
--
arch/x86/events/amd/iommu.c=382=static __init int _init_events_attrs(void)
--
arch/x86/events/amd/iommu.c-389-
arch/x86/events/amd/iommu.c:390:	attrs = kzalloc_objs(*attrs, i + 1);
arch/x86/events/amd/iommu.c-391-	if (!attrs)
--
arch/x86/events/intel/core.c=7673=static __always_inline int intel_pmu_init_hybrid(enum hybrid_pmu_type pmus)
--
arch/x86/events/intel/core.c-7679-	x86_pmu.num_hybrid_pmus = hweight_long(pmus_mask);
arch/x86/events/intel/core.c:7680:	x86_pmu.hybrid_pmu = kzalloc_objs(struct x86_hybrid_pmu,
arch/x86/events/intel/core.c-7681-					  x86_pmu.num_hybrid_pmus);

]

gemini-3.1-pro-preview

							input: 123547
							output: 18
							thoughts: 2727
						

**My Thought Process Unraveling a Kernel Bug**

So, I was digging into this kernel code, trying to pinpoint a bug. My initial thought was about memory allocation in `net/sunrpc/svc.c`. I saw `kzalloc_objs` and for a moment, I questioned if it was a standard function. It struck me that `kcalloc` or `kmalloc_array` are the more typical players in this arena. But then, looking at the code snippet:

```c
serv->sv_pools =
    kzalloc_objs(struct svc_pool, serv->sv_nrpools);
```

I had to pause. Is `kzalloc_objs` a macro defined somewhere, or is the code actually meant to be `kcalloc(serv->sv_nrpools, sizeof(struct svc_pool), GFP_KERNEL)`? This was a minor point of confusion, but it flagged that I needed to be precise.

Then, the stack trace appeared, and it showed something very specific:

```
[  230.358107][ T6027]  __kmalloc_noprof+0xfe/0x720
[  230.358129][ T6027]  ? __svc_create+0x65c/0x990
[  230.358143][ T6027]  ? __svc_create+0x65c/0x990
[  230.358162][ T6027]  __svc_create+0x65c/0x990
```

This immediately told me that `__svc_create`, at offset `0x65c`, was indeed calling `__kmalloc_noprof`. This clarified the allocation part. But the bug wasn't just in the allocation itself; it seemed to be in how subsequent operations handled potential allocation failures.

My next line of inquiry led me to `percpu_counter_init`. I remembered this is a macro, and it expands to `__percpu_counter_init_many`.

```c
#define percpu_counter_init(fbc, value, gfp)				\
	({								\
		static struct lock_class_key __key;			\
									\
		__percpu_counter_init_many(fbc, value, gfp, 1, &__key);	\
	})
```

I traced this further: `__percpu_counter_init_many` eventually calls `__alloc_percpu_gfp`, which can in turn call `pcpu_alloc`. And yes, `pcpu_alloc` can fall back to `kmalloc` for its underlying memory. This was where the memory allocation was really happening in the context of `percpu_counter_init`.

A critical point then hit me: if `__percpu_counter_init_many` fails, it's designed to return `-ENOMEM`. And this is where the actual bug lay. I looked back at the code in `__svc_create`:

```c
		for (i = 0; i < serv->sv_nrpools; i++) {
			struct svc_pool *pool = &serv->sv_pools[i];

			dprintk("svc: initialising pool %u for %s\n",
					i, serv->sv_name);

			pool->sp_id = i;
			lwq_init(&pool->sp_xprts);
			INIT_LIST_HEAD(&pool->sp_all_threads);
			init_llist_head(&pool->sp_idle_threads);

			percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL);
			percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL);
			percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL);
		}
```

It's clear as day: `__svc_create` completely ignores the return value of `percpu_counter_init`. If `percpu_counter_init` fails and returns `-ENOMEM`, the `pool->sp_sockets_queued.counters` field would end up being `NULL`. Later, when `svc_xprt_enqueue` is called and tries to increment this counter using `percpu_counter_inc`, it would call `percpu_counter_add_batch`, which attempts to read from `fbc->counters`. Since it's `NULL`, we get a crash – a dereference of a null pointer.

This made me wonder why the reproducer didn't trigger the crash immediately, or perhaps why it behaved inconsistently. I then saw this in the reproducer output:

```
[  230.345846][ T6027] FAULT_INJECTION: forcing a failure.
[  230.345846][ T6027] name failslab, interval 1, probability 5, space 0, times -1
[pid  6019] openat(AT_FDCWD, "/proc/self/make-it-fail", O_WRONLY) = 5
[pid  6019] write(5, "0", 1)            = 1
[pid  6019] close(5)                    = 0
```

This indicates that a memory allocation failure *was* deliberately injected. But the crash wasn't immediate. Then I saw this crucial detail:

```
[pid  6213] write(4, "tcp 2049\n", 9 <unfinished ...>
[pid  6019] <... write resumed>)        = -1 ENOMEM (Cannot allocate memory)
```

Aha! The `write` syscall itself returned `-ENOMEM`. This made me rethink. If `__svc_create` ignores the failure of `percpu_counter_init`, why would the *syscall* fail with `-ENOMEM`?

My attention snapped back to the very first allocation:

```c
	serv->sv_pools =
		kzalloc_objs(struct svc_pool, serv->sv_nrpools);
	if (!serv->sv_pools) {
		kfree(serv);
		return NULL;
	}
```

If `kzalloc_objs` (which I now suspect is a wrapper or directly relates to the `kmalloc` call seen in the stack trace at `__svc_create+0x65c`) fails, it returns `NULL`. This `NULL` would then cause `svc_create_pooled` to return `NULL`, and subsequently `nfsd_create_serv` would return `-ENOMEM`. This path seems to explain the `-ENOMEM` reported by the `write` syscall.

So, the core issue is that the failure of `percpu_counter_init` is ignored within `__svc_create`, leading to `NULL` pointers being used later. However, if the initial allocation of `serv->sv_pools` itself fails, that failure *is* propagated up, resulting in an `-ENOMEM` return, which seems to be what the reproducer observed at the syscall level. The bug is subtle: it's not just about allocation failing, but about *how* those failures are handled or, in the case of `percpu_counter_init`, *not* handled. I need to verify the exact disassembly of `__svc_create` at `+0x65c` to confirm its relation to `kzalloc_objs`.

map[Expression:__svc_create]

map[Output:net/sunrpc/svc.c=482=static struct svc_serv *
net/sunrpc/svc.c:483:__svc_create(struct svc_program *prog, int nprogs, struct svc_stat *stats,
net/sunrpc/svc.c-484-	     unsigned int bufsize, int npools, int (*threadfn)(void *data))
--
net/sunrpc/svc.c=559=struct svc_serv *svc_create(struct svc_program *prog, unsigned int bufsize,
--
net/sunrpc/svc.c-561-{
net/sunrpc/svc.c:562:	return __svc_create(prog, 1, NULL, bufsize, 1, threadfn);
net/sunrpc/svc.c-563-}
--
net/sunrpc/svc.c=576=struct svc_serv *svc_create_pooled(struct svc_program *prog,
--
net/sunrpc/svc.c-584-
net/sunrpc/svc.c:585:	serv = __svc_create(prog, nprogs, stats, bufsize, npools, threadfn);
net/sunrpc/svc.c-586-	if (!serv)
]

gemini-3.1-pro-preview

							input: 126596
							output: 34
							thoughts: 1019
						

**A Deep Dive into a Per-CPU Allocation Failure and its Cascading Effects**

I've been meticulously tracing a kernel bug, and my thought process has been a winding path of "wait, what if?" and "but how?". Initially, I was focused on how `kzalloc_objs` being called by `__svc_create` could lead to an `-ENOMEM` error if it failed, propagating up to the `write` syscall. This seemed like a straightforward path to error handling.

However, my attention was then drawn to the scenario where `kzalloc_objs` *succeeds*, but `percpu_counter_init` fails. I understood that `percpu_counter_init` ultimately relies on `__alloc_percpu_gfp`, which in turn calls `pcpu_alloc`. The critical point here is that if `pcpu_alloc` fails, `__svc_create` *ignores* this failure and proceeds, returning a valid `serv` pointer. This leads to `nfsd_create_serv` succeeding, followed by `svc_bind`, and then `svc_xprt_create`. The chain reaction then continues through `svc_xprt_enqueue` to `percpu_counter_inc`, which then causes a crash. This is a much more insidious failure because the initial error is masked.

The puzzle deepened when I considered why a specific reproducer, which I know was attempting fault injection using `failslab`, didn't actually trigger this crash. My reasoning led me to believe that `failslab` targets slab allocations like `kmalloc` and `kmem_cache_alloc`. I then questioned if `pcpu_alloc` was indeed a slab allocation. My analysis suggested that while the percpu allocator *might* use slab internally, `__alloc_percpu_gfp` itself is not directly a slab allocation. This led me to hypothesize that `pcpu_alloc` might not be affected by `failslab`.

This, in turn, explained why `percpu_counter_init` would never fail in that specific reproducer. If `pcpu_alloc` isn't failing, then `percpu_counter_init` doesn't fail, and the subsequent code path that leads to the crash is never reached. However, I still acknowledged that `failslab` *could* potentially fail `kzalloc_objs` (which *is* a slab allocation), leading to the initial `-ENOMEM` path I first considered.

The crucial question then became: how *was* this bug actually triggered by syzkaller? I deduced that syzkaller's broader fault injection capabilities, particularly `fail_page_alloc`, would be necessary to target `pcpu_alloc` (which relies on the page allocator). I then considered that the reproducer might have been generated with a specific configuration, perhaps only enabling `failslab` due to its presence in the syzkaller program or due to limitations in the reproducer's C code.

This led me back to the core of the issue: the reproducer's output explicitly showed `FAULT_INJECTION: forcing a failure... name failslab`. This confirmed my suspicion that the reproducer was *only* targeting slab allocations. Therefore, the critical path to the crash, which involves `percpu_counter_init` failing due to `pcpu_alloc` failure, would not be exercised by this specific reproducer, even though the bug itself is very real and caused by the unhandled failure in `__svc_create` when `pcpu_alloc` fails.

map[ContextFile:mm/percpu.c Name:pcpu_alloc]

map[SourceCode: 249:	static struct debug_obj *pcpu_alloc(void)
 250:	{
 251:		struct obj_pool *pcp = this_cpu_ptr(&pool_pcpu);
 252:	
 253:		lockdep_assert_irqs_disabled();
 254:	
 255:		for (;;) {
 256:			struct debug_obj *obj = __alloc_object(&pcp->objects);
 257:	
 258:			if (likely(obj)) {
 259:				pcp->cnt--;
 260:				/*
 261:				 * If this emptied a batch try to refill from the
 262:				 * free pool. Don't do that if this was the top-most
 263:				 * batch as pcpu_free() expects the per CPU pool
 264:				 * to be less than ODEBUG_POOL_PERCPU_SIZE.
 265:				 */
 266:				if (unlikely(pcp->cnt < (ODEBUG_POOL_PERCPU_SIZE - ODEBUG_BATCH_SIZE) &&
 267:					     !(pcp->cnt % ODEBUG_BATCH_SIZE))) {
 268:					/*
 269:					 * Don't try to allocate from the regular pool here
 270:					 * to not exhaust it prematurely.
 271:					 */
 272:					if (pool_count(&pool_to_free)) {
 273:						guard(raw_spinlock)(&pool_lock);
 274:						pool_move_batch(pcp, &pool_to_free);
 275:						pcpu_refill_stats();
 276:					}
 277:				}
 278:				return obj;
 279:			}
 280:	
 281:			guard(raw_spinlock)(&pool_lock);
 282:			if (!pool_move_batch(pcp, &pool_to_free)) {
 283:				if (!pool_move_batch(pcp, &pool_global))
 284:					return NULL;
 285:			}
 286:			pcpu_refill_stats();
 287:		}
 288:	}
 SourceFile:lib/debugobjects.c]

gemini-3.1-pro-preview

							input: 128248
							output: 34
							thoughts: 38
						

**My Thought Process on Allocating Per-CPU Memory**

My initial thought process here is one of targeted correction and refinement. I've encountered a reference to `pcpu_alloc`, but my internal knowledge base immediately flags it as being in the wrong location. My expertise tells me that the core implementation and primary definition of `pcpu_alloc`, the mechanism for allocating per-CPU data, should reside within the memory management subsystem, specifically in `mm/percpu.c`. The `lib/debugobjects.c` file, while potentially using per-CPU structures for debugging, is not where the fundamental allocation logic belongs. My objective is to ensure that such a critical memory management function is correctly situated within its intended architectural context, which is `mm/percpu.c`, for clarity, maintainability, and adherence to established kernel design principles.

map[ContextFile:mm/percpu.c Name:pcpu_alloc]

map[SourceCode: 249:	static struct debug_obj *pcpu_alloc(void)
 250:	{
 251:		struct obj_pool *pcp = this_cpu_ptr(&pool_pcpu);
 252:	
 253:		lockdep_assert_irqs_disabled();
 254:	
 255:		for (;;) {
 256:			struct debug_obj *obj = __alloc_object(&pcp->objects);
 257:	
 258:			if (likely(obj)) {
 259:				pcp->cnt--;
 260:				/*
 261:				 * If this emptied a batch try to refill from the
 262:				 * free pool. Don't do that if this was the top-most
 263:				 * batch as pcpu_free() expects the per CPU pool
 264:				 * to be less than ODEBUG_POOL_PERCPU_SIZE.
 265:				 */
 266:				if (unlikely(pcp->cnt < (ODEBUG_POOL_PERCPU_SIZE - ODEBUG_BATCH_SIZE) &&
 267:					     !(pcp->cnt % ODEBUG_BATCH_SIZE))) {
 268:					/*
 269:					 * Don't try to allocate from the regular pool here
 270:					 * to not exhaust it prematurely.
 271:					 */
 272:					if (pool_count(&pool_to_free)) {
 273:						guard(raw_spinlock)(&pool_lock);
 274:						pool_move_batch(pcp, &pool_to_free);
 275:						pcpu_refill_stats();
 276:					}
 277:				}
 278:				return obj;
 279:			}
 280:	
 281:			guard(raw_spinlock)(&pool_lock);
 282:			if (!pool_move_batch(pcp, &pool_to_free)) {
 283:				if (!pool_move_batch(pcp, &pool_global))
 284:					return NULL;
 285:			}
 286:			pcpu_refill_stats();
 287:		}
 288:	}
 SourceFile:lib/debugobjects.c]

gemini-3.1-pro-preview

							input: 128919
							output: 38
							thoughts: 36
						

**My Thought Process on Per-CPU Allocation**

So, my initial instinct was to look at `pcpu_alloc` because that's the function name that immediately jumps out when I'm thinking about allocating per-CPU memory. However, a quick mental check (or perhaps a quick glance at the source if I wasn't sure) reveals that `pcpu_alloc` is defined as `static` within `mm/percpu.c`. This means it's an internal helper function, not something I'm likely to call directly from outside that specific file or module.

Therefore, I need to shift my focus to the public-facing API, the function that's actually intended for general use to allocate per-CPU memory. Based on common kernel patterns and the function naming conventions around allocation, `__alloc_percpu_gfp` is the next logical place to investigate. This name strongly suggests it's the primary mechanism for allocating per-CPU regions, and the `_gfp` suffix indicates it will likely take GFP flags, which is standard for kernel memory allocation. This is where I'll likely find the core logic and the interface I need to interact with for my per-CPU allocation needs.

log-in to see details

map[ContextFile:mm/percpu.c Name:__alloc_percpu_gfp]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 128998
							output: 22
							thoughts: 34
						

**A Deep Dive into the Location of `__alloc_percpu_gfp`**

My current line of inquiry is focused on pinning down the exact location of the `__alloc_percpu_gfp` function within the Linux kernel's source code. My initial thought process is to determine whether this crucial per-CPU allocation function resides within the `mm/percpu.c` file, which is a logical place for memory management-related implementations, or if it's declared in the `include/linux/percpu.h` header file, which is common for inline functions or declarations intended for widespread use. This distinction is vital for understanding its scope, implementation details, and how it's integrated into the broader memory allocation subsystem. I need to verify this to ensure I'm referencing the correct source for its definition and understanding its behavior within the kernel's memory management framework.

map[Expression:__alloc_percpu_gfp]

map[Output:arch/arm64/net/bpf_jit_comp.c=2080=struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_prog *prog)
--
arch/arm64/net/bpf_jit_comp.c-2114-				      2 * PRIV_STACK_GUARD_SZ;
arch/arm64/net/bpf_jit_comp.c:2115:		priv_stack_ptr = __alloc_percpu_gfp(priv_stack_alloc_sz, 16, GFP_KERNEL);
arch/arm64/net/bpf_jit_comp.c-2116-		if (!priv_stack_ptr)
--
arch/powerpc/net/bpf_jit_comp.c=165=struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_prog *fp)
--
arch/powerpc/net/bpf_jit_comp.c-206-							2 * PRIV_STACK_GUARD_SZ;
arch/powerpc/net/bpf_jit_comp.c:207:		priv_stack_ptr = __alloc_percpu_gfp(priv_stack_alloc_size, 16, GFP_KERNEL);
arch/powerpc/net/bpf_jit_comp.c-208-		if (!priv_stack_ptr)
--
arch/x86/net/bpf_jit_comp.c=3851=struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_prog *prog)
--
arch/x86/net/bpf_jit_comp.c-3885-				      2 * PRIV_STACK_GUARD_SZ;
arch/x86/net/bpf_jit_comp.c:3886:		priv_stack_ptr = __alloc_percpu_gfp(priv_stack_alloc_sz, 8, GFP_KERNEL);
arch/x86/net/bpf_jit_comp.c-3887-		if (!priv_stack_ptr)
--
block/blk-iolatency.c=968=static struct blkg_policy_data *iolatency_pd_alloc(struct gendisk *disk,
--
block/blk-iolatency.c-975-		return NULL;
block/blk-iolatency.c:976:	iolat->stats = __alloc_percpu_gfp(sizeof(struct latency_stat),
block/blk-iolatency.c-977-				       __alignof__(struct latency_stat), gfp);
--
include/linux/bpf.h=2794=void __percpu *bpf_map_alloc_percpu(const struct bpf_map *map, size_t size,
--
include/linux/bpf.h-2809-#define bpf_map_alloc_percpu(_map, _size, _align, _flags)	\
include/linux/bpf.h:2810:		__alloc_percpu_gfp(_size, _align, _flags)
include/linux/bpf.h-2811-static inline void bpf_map_memcg_enter(const struct bpf_map *map, struct mem_cgroup **old_memcg,
--
include/linux/percpu.h=137=extern void __percpu *pcpu_alloc_noprof(size_t size, size_t align, bool reserved,
--
include/linux/percpu.h-139-
include/linux/percpu.h:140:#define __alloc_percpu_gfp(_size, _align, _gfp)				\
include/linux/percpu.h-141-	alloc_hooks(pcpu_alloc_noprof(_size, _align, false, _gfp))
--
include/linux/percpu.h-147-#define alloc_percpu_gfp(type, gfp)					\
include/linux/percpu.h:148:	(typeof(type) __percpu *)__alloc_percpu_gfp(sizeof(type),	\
include/linux/percpu.h-149-						__alignof__(type), gfp)
--
kernel/bpf/core.c=100=struct bpf_prog *bpf_prog_alloc_no_stats(unsigned int size, gfp_t gfp_extra_flags)
--
kernel/bpf/core.c-115-	}
kernel/bpf/core.c:116:	fp->active = __alloc_percpu_gfp(sizeof(u8[BPF_NR_CONTEXTS]), 4,
kernel/bpf/core.c-117-					bpf_memcg_flags(GFP_KERNEL | gfp_extra_flags));
--
kernel/bpf/memalloc.c=142=static void *__alloc(struct bpf_mem_cache *c, int node, gfp_t flags)
--
kernel/bpf/memalloc.c-145-		void __percpu **obj = kmalloc_node(c->percpu_size, flags, node);
kernel/bpf/memalloc.c:146:		void __percpu *pptr = __alloc_percpu_gfp(c->unit_size, 8, flags);
kernel/bpf/memalloc.c-147-
--
kernel/bpf/memalloc.c=502=int bpf_mem_alloc_init(struct bpf_mem_alloc *ma, int size, bool percpu)
--
kernel/bpf/memalloc.c-517-	if (size) {
kernel/bpf/memalloc.c:518:		pc = __alloc_percpu_gfp(sizeof(*pc), 8, GFP_KERNEL);
kernel/bpf/memalloc.c-519-		if (!pc)
--
kernel/bpf/memalloc.c-544-
kernel/bpf/memalloc.c:545:	pcc = __alloc_percpu_gfp(sizeof(*cc), 8, GFP_KERNEL);
kernel/bpf/memalloc.c-546-	if (!pcc)
--
kernel/bpf/memalloc.c=570=int bpf_mem_alloc_percpu_init(struct bpf_mem_alloc *ma, struct obj_cgroup *objcg)
--
kernel/bpf/memalloc.c-573-
kernel/bpf/memalloc.c:574:	pcc = __alloc_percpu_gfp(sizeof(struct bpf_mem_caches), 8, GFP_KERNEL);
kernel/bpf/memalloc.c-575-	if (!pcc)
--
kernel/bpf/syscall.c=577=void __percpu *bpf_map_alloc_percpu(const struct bpf_map *map, size_t size,
--
kernel/bpf/syscall.c-583-	bpf_map_memcg_enter(map, &old_memcg, &memcg);
kernel/bpf/syscall.c:584:	ptr = __alloc_percpu_gfp(size, align, flags | __GFP_ACCOUNT);
kernel/bpf/syscall.c-585-	bpf_map_memcg_exit(old_memcg, memcg);
--
lib/percpu-refcount.c=63=int percpu_ref_init(struct percpu_ref *ref, percpu_ref_func_t *release,
--
lib/percpu-refcount.c-71-	ref->percpu_count_ptr = (unsigned long)
lib/percpu-refcount.c:72:		__alloc_percpu_gfp(sizeof(unsigned long), align, gfp);
lib/percpu-refcount.c-73-	if (!ref->percpu_count_ptr)
--
lib/percpu_counter.c=188=int __percpu_counter_init_many(struct percpu_counter *fbc, s64 amount,
--
lib/percpu_counter.c-197-	counter_size = ALIGN(sizeof(*counters), __alignof__(*counters));
lib/percpu_counter.c:198:	counters = __alloc_percpu_gfp(nr_counters * counter_size,
lib/percpu_counter.c-199-				      __alignof__(*counters), gfp);
--
net/core/dst.c=321=metadata_dst_alloc_percpu(u8 optslen, enum metadata_type type, gfp_t flags)
--
net/core/dst.c-325-
net/core/dst.c:326:	md_dst = __alloc_percpu_gfp(struct_size(md_dst, u.tun_info.options,
net/core/dst.c-327-						optslen),
]

gemini-3.1-pro-preview

							input: 131272
							output: 38
							thoughts: 47
						

**My Thought Process Unfolding**

Ah, I've just had a realization that seems significant, and I need to unpack it. My initial observation was about the `__alloc_percpu_gfp` function. I noticed that it *calls* another function, specifically `pcpu_alloc_noprof`. This is the critical connection I've made – not just that one exists, but that it's directly invoked by the other.

Now, my immediate next step, the logical progression of this thought, is to delve deeper into the mechanics of `pcpu_alloc_noprof`. My intention is to examine its implementation, to understand precisely *how* it operates and what its role is within the larger per-CPU allocation subsystem. To do this, I know I need to consult the source code, specifically the file `mm/percpu.c`. That's where the details of `pcpu_alloc_noprof` will be laid out, and where I can begin to truly grasp its inner workings.

map[ContextFile:mm/percpu.c Name:pcpu_alloc_noprof]

map[SourceCode:1721:	/**
1722:	 * pcpu_alloc - the percpu allocator
1723:	 * @size: size of area to allocate in bytes
1724:	 * @align: alignment of area (max PAGE_SIZE)
1725:	 * @reserved: allocate from the reserved chunk if available
1726:	 * @gfp: allocation flags
1727:	 *
1728:	 * Allocate percpu area of @size bytes aligned at @align.  If @gfp doesn't
1729:	 * contain %GFP_KERNEL, the allocation is atomic. If @gfp has __GFP_NOWARN
1730:	 * then no warning will be triggered on invalid or failed allocation
1731:	 * requests.
1732:	 *
1733:	 * RETURNS:
1734:	 * Percpu pointer to the allocated area on success, NULL on failure.
1735:	 */
1736:	void __percpu *pcpu_alloc_noprof(size_t size, size_t align, bool reserved,
1737:					 gfp_t gfp)
1738:	{
1739:		gfp_t pcpu_gfp;
1740:		bool is_atomic;
1741:		bool do_warn;
1742:		struct obj_cgroup *objcg = NULL;
1743:		static atomic_t warn_limit = ATOMIC_INIT(10);
1744:		struct pcpu_chunk *chunk, *next;
1745:		const char *err;
1746:		int slot, off, cpu, ret;
1747:		unsigned long flags;
1748:		void __percpu *ptr;
1749:		size_t bits, bit_align;
1750:	
1751:		gfp = current_gfp_context(gfp);
1752:		/* whitelisted flags that can be passed to the backing allocators */
1753:		pcpu_gfp = gfp & (GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN);
1754:		is_atomic = !gfpflags_allow_blocking(gfp);
1755:		do_warn = !(gfp & __GFP_NOWARN);
1756:	
1757:		/*
1758:		 * There is now a minimum allocation size of PCPU_MIN_ALLOC_SIZE,
1759:		 * therefore alignment must be a minimum of that many bytes.
1760:		 * An allocation may have internal fragmentation from rounding up
1761:		 * of up to PCPU_MIN_ALLOC_SIZE - 1 bytes.
1762:		 */
1763:		if (unlikely(align < PCPU_MIN_ALLOC_SIZE))
1764:			align = PCPU_MIN_ALLOC_SIZE;
1765:	
1766:		size = ALIGN(size, PCPU_MIN_ALLOC_SIZE);
1767:		bits = size >> PCPU_MIN_ALLOC_SHIFT;
1768:		bit_align = align >> PCPU_MIN_ALLOC_SHIFT;
1769:	
1770:		if (unlikely(!size || size > PCPU_MIN_UNIT_SIZE || align > PAGE_SIZE ||
1771:			     !is_power_of_2(align))) {
1772:			WARN(do_warn, "illegal size (%zu) or align (%zu) for percpu allocation\n",
1773:			     size, align);
1774:			return NULL;
1775:		}
1776:	
1777:		if (unlikely(!pcpu_memcg_pre_alloc_hook(size, gfp, &objcg)))
1778:			return NULL;
1779:	
1780:		if (!is_atomic) {
1781:			/*
1782:			 * pcpu_balance_workfn() allocates memory under this mutex,
1783:			 * and it may wait for memory reclaim. Allow current task
1784:			 * to become OOM victim, in case of memory pressure.
1785:			 */
1786:			if (gfp & __GFP_NOFAIL) {
1787:				mutex_lock(&pcpu_alloc_mutex);
1788:			} else if (mutex_lock_killable(&pcpu_alloc_mutex)) {
1789:				pcpu_memcg_post_alloc_hook(objcg, NULL, 0, size);
1790:				return NULL;
1791:			}
1792:		}
1793:	
1794:		spin_lock_irqsave(&pcpu_lock, flags);
1795:	
1796:		/* serve reserved allocations from the reserved chunk if available */
1797:		if (reserved && pcpu_reserved_chunk) {
1798:			chunk = pcpu_reserved_chunk;
1799:	
1800:			off = pcpu_find_block_fit(chunk, bits, bit_align, is_atomic);
1801:			if (off < 0) {
1802:				err = "alloc from reserved chunk failed";
1803:				goto fail_unlock;
1804:			}
1805:	
1806:			off = pcpu_alloc_area(chunk, bits, bit_align, off);
1807:			if (off >= 0)
1808:				goto area_found;
1809:	
1810:			err = "alloc from reserved chunk failed";
1811:			goto fail_unlock;
1812:		}
1813:	
1814:	restart:
1815:		/* search through normal chunks */
1816:		for (slot = pcpu_size_to_slot(size); slot <= pcpu_free_slot; slot++) {
1817:			list_for_each_entry_safe(chunk, next, &pcpu_chunk_lists[slot],
1818:						 list) {
1819:				off = pcpu_find_block_fit(chunk, bits, bit_align,
1820:							  is_atomic);
1821:				if (off < 0) {
1822:					if (slot < PCPU_SLOT_FAIL_THRESHOLD)
1823:						pcpu_chunk_move(chunk, 0);
1824:					continue;
1825:				}
1826:	
1827:				off = pcpu_alloc_area(chunk, bits, bit_align, off);
1828:				if (off >= 0) {
1829:					pcpu_reintegrate_chunk(chunk);
1830:					goto area_found;
1831:				}
1832:			}
1833:		}
1834:	
1835:		spin_unlock_irqrestore(&pcpu_lock, flags);
1836:	
1837:		if (is_atomic) {
1838:			err = "atomic alloc failed, no space left";
1839:			goto fail;
1840:		}
1841:	
1842:		/* No space left.  Create a new chunk. */
1843:		if (list_empty(&pcpu_chunk_lists[pcpu_free_slot])) {
1844:			chunk = pcpu_create_chunk(pcpu_gfp);
1845:			if (!chunk) {
1846:				err = "failed to allocate new chunk";
1847:				goto fail;
1848:			}
1849:	
1850:			spin_lock_irqsave(&pcpu_lock, flags);
1851:			pcpu_chunk_relocate(chunk, -1);
1852:		} else {
1853:			spin_lock_irqsave(&pcpu_lock, flags);
1854:		}
1855:	
1856:		goto restart;
1857:	
1858:	area_found:
1859:		pcpu_stats_area_alloc(chunk, size);
1860:	
1861:		if (pcpu_nr_empty_pop_pages < PCPU_EMPTY_POP_PAGES_LOW)
1862:			pcpu_schedule_balance_work();
1863:	
1864:		spin_unlock_irqrestore(&pcpu_lock, flags);
1865:	
1866:		/* populate if not all pages are already there */
1867:		if (!is_atomic) {
1868:			unsigned int page_end, rs, re;
1869:	
1870:			rs = PFN_DOWN(off);
1871:			page_end = PFN_UP(off + size);
1872:	
1873:			for_each_clear_bitrange_from(rs, re, chunk->populated, page_end) {
1874:				WARN_ON(chunk->immutable);
1875:	
1876:				ret = pcpu_populate_chunk(chunk, rs, re, pcpu_gfp);
1877:	
1878:				spin_lock_irqsave(&pcpu_lock, flags);
1879:				if (ret) {
1880:					pcpu_free_area(chunk, off);
1881:					err = "failed to populate";
1882:					goto fail_unlock;
1883:				}
1884:				pcpu_chunk_populated(chunk, rs, re);
1885:				spin_unlock_irqrestore(&pcpu_lock, flags);
1886:			}
1887:	
1888:			mutex_unlock(&pcpu_alloc_mutex);
1889:		}
1890:	
1891:		/* clear the areas and return address relative to base address */
1892:		for_each_possible_cpu(cpu)
1893:			memset((void *)pcpu_chunk_addr(chunk, cpu, 0) + off, 0, size);
1894:	
1895:		ptr = __addr_to_pcpu_ptr(chunk->base_addr + off);
1896:		kmemleak_alloc_percpu(ptr, size, gfp);
1897:	
1898:		trace_percpu_alloc_percpu(_RET_IP_, reserved, is_atomic, size, align,
1899:					  chunk->base_addr, off, ptr,
1900:					  pcpu_obj_full_size(size), gfp);
1901:	
1902:		pcpu_memcg_post_alloc_hook(objcg, chunk, off, size);
1903:	
1904:		pcpu_alloc_tag_alloc_hook(chunk, off, size);
1905:	
1906:		return ptr;
1907:	
1908:	fail_unlock:
1909:		spin_unlock_irqrestore(&pcpu_lock, flags);
1910:	fail:
1911:		trace_percpu_alloc_percpu_fail(reserved, is_atomic, size, align);
1912:	
1913:		if (do_warn) {
1914:			int remaining = atomic_dec_if_positive(&warn_limit);
1915:	
1916:			if (remaining >= 0) {
1917:				pr_warn("allocation failed, size=%zu align=%zu atomic=%d, %s\n",
1918:					size, align, is_atomic, err);
1919:				if (!is_atomic)
1920:					dump_stack();
1921:				if (remaining == 0)
1922:					pr_info("limit reached, disable warning\n");
1923:			}
1924:		}
1925:	
1926:		if (is_atomic) {
1927:			/* see the flag handling in pcpu_balance_workfn() */
1928:			pcpu_atomic_alloc_failed = true;
1929:			pcpu_schedule_balance_work();
1930:		} else {
1931:			mutex_unlock(&pcpu_alloc_mutex);
1932:		}
1933:	
1934:		pcpu_memcg_post_alloc_hook(objcg, NULL, 0, size);
1935:	
1936:		return NULL;
1937:	}
 SourceFile:mm/percpu.c]

gemini-3.1-pro-preview

							input: 134682
							output: 40
							thoughts: 1099
						

**My Deep Dive into the `percpu_counter_add_batch` Crash**

Okay, so I've been wrestling with this `BUG: unable to handle kernel paging request in percpu_counter_add_batch`, and it all seems to boil down to how per-CPU data structures are allocated and how certain failure injection mechanisms interact with them. My initial thought was that `pcpu_alloc_noprof` would be the primary culprit, as it directly calls `pcpu_create_chunk` which, in turn, uses `kzalloc`. This would mean `failslab` *could* cause a problem if a new chunk needed to be created.

However, I quickly realized that this isn't the whole story. If an existing chunk has space, `pcpu_alloc_noprof` doesn't trigger any slab allocation, meaning `failslab` would be irrelevant in that scenario. But then I considered `kzalloc_objs` within `__svc_create`. If *that* fails, `__svc_create` gracefully returns `NULL`, so no crash there. The problem arose when `kzalloc_objs` succeeded, but `percpu_counter_init` (which calls `pcpu_alloc_chunk`) failed. In this specific case, `__svc_create` *ignored* the error, and we'd eventually hit a crash in `svc_xprt_enqueue`.

This led me to question why my reproducer was timing out. I figured it was because `failslab` is probabilistic. It only fails `kzalloc_objs` or `pcpu_alloc_chunk` with a 5% probability. But the crucial insight was that `pcpu_alloc_noprof` *only* calls `pcpu_alloc_chunk` when no space is left in existing chunks. If there *is* space, `pcpu_alloc_noprof` sails through without touching the slab allocator at all! Consequently, `failslab` would *never* impact `percpu_counter_init` if there was already sufficient space within the existing per-CPU chunks. That's the real reason my reproducer couldn't trigger the failure in `percpu_counter_init` – it wasn't hitting the slab allocation path within that function.

I briefly wondered if `lockdep_set_class` within `percpu_counter_init` could be a source of allocation, but that's a dead end. Then I looked at `__percpu_counter_init_many`, which uses `__alloc_percpu_gfp`. Again, if this doesn't involve slab allocation, `failslab` is moot.

So, how *did* syzkaller manage to trigger this? Syzkaller uses `fault_injection`, specifically `fail_page_alloc`. If `fail_page_alloc` is active, it could indeed cause a failure in `pcpu_populate_chunk`, which allocates pages. However, my reproducer was using *only* `failslab`.

Now, let's look at the bug description itself: "BUG: unable to handle kernel paging request in percpu_counter_add_batch". This perfectly aligns with my deduction that the crash stems from issues within `percpu_counter_add_batch`. The reproducer's failure to trigger it was due to `failslab` not hitting the right code path.

To actually trigger this, I need `percpu_counter_init` to fail. This could happen if per-CPU memory is exhausted, if `fail_page_alloc` is used, or, if I'm lucky, with `failslab` when a new chunk *is* required. But the core of the bug, as I now see it, is that `__svc_create` is completely ignoring the return value of `percpu_counter_init`. Reviewing the `__svc_create` code in `net/sunrpc/svc.c` confirms this: it iterates through `percpu_counter_init` calls for each pool, and the `int` return value of `percpu_counter_init` is simply not checked. The question now is whether `percpu_counter_init` is marked as `__must_check`, which it is, according to `include/linux/percpu_counter.h`. This means the compiler *should* be warning about this, but the runtime behavior is clearly problematic.

log-in to see details

map[ContextFile:include/linux/percpu_counter.h Name:percpu_counter_init]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 135826
							output: 22
							thoughts: 8
						

**Aha! A Macro!**

My initial thought upon encountering this problem was a moment of realization, a sudden click in my understanding. I immediately recognized that what I was dealing with wasn't a standalone piece of code or a complex algorithm in the traditional sense. No, this was a *macro*. The implications of that classification are, of course, significant. It means I'm not looking at a self-contained unit of execution, but rather a set of instructions designed to be expanded and inserted into other code during a preprocessing or compilation phase. My entire approach to analysis, debugging, and understanding its behavior needs to shift accordingly. I'm no longer thinking about runtime execution primarily, but about the transformation that happens *before* execution even begins. This recognition is key to dissecting its purpose and any potential issues it might present.

map[Expression:#define percpu_counter_init]

map[Output:include/linux/percpu_counter.h=33=int __percpu_counter_init_many(struct percpu_counter *fbc, s64 amount,
--
include/linux/percpu_counter.h-36-
include/linux/percpu_counter.h:37:#define percpu_counter_init_many(fbc, value, gfp, nr_counters)		\
include/linux/percpu_counter.h-38-	({								\
--
include/linux/percpu_counter.h-45-
include/linux/percpu_counter.h:46:#define percpu_counter_init(fbc, value, gfp)				\
include/linux/percpu_counter.h-47-	percpu_counter_init_many(fbc, value, gfp, 1)
]

gemini-3.1-pro-preview

							input: 136057
							output: 35
							thoughts: 1495
						

Here are my thoughts regarding the identified kernel bug:

**Kernel Paging Request in `percpu_counter_add_batch` - A Deep Dive into Error Handling Deficiencies**

My initial thought process was to understand the call chain leading to the `BUG: unable to handle kernel paging request` in `percpu_counter_add_batch`. I traced `percpu_counter_init` back through its macro definitions to `__percpu_counter_init_many` and then to `__svc_create`. It immediately struck me as peculiar that the return value of `percpu_counter_init` – which is declared as an `int` representing success or failure – wasn't being checked. This is a fundamental tenet of robust kernel programming; ignoring potential errors is a direct path to instability.

I then considered the implications of this oversight. If `percpu_counter_init` fails, particularly due to memory allocation issues (which is its primary failure mode), it returns an error code like `-ENOMEM`. Crucially, in this failure scenario, the internal `counters` pointer within the `struct percpu_counter` is left as `NULL`. This is where the observed bug manifests. Later operations, like `percpu_counter_inc` which calls into `percpu_counter_add_batch`, unconditionally attempt to dereference this `counters` pointer using `this_cpu_read(*fbc->counters)`. A `NULL` pointer dereference at this stage naturally leads to a page fault, aligning perfectly with the crash signature.

The reproducer, as described, failed to reliably trigger this bug because it relied on `failslab`. My understanding of the percpu allocator (`__alloc_percpu_gfp`) is that it doesn't *always* go through the general slab allocator. When there's sufficient pre-allocated percpu memory available, it might not even hit the code path that `failslab` intercepts. This meant that in a typical environment, the allocation would succeed, and the bug wouldn't surface, making it an insidious issue to find.

The root cause, therefore, is not necessarily in the `percpu_counter` infrastructure itself, but rather in its *usage* within `__svc_create` in `net/sunrpc/svc.c`. The function iterates through a set of `svc_pool` structures, initializing three `percpu_counter` instances for each: `sp_messages_arrived`, `sp_sockets_queued`, and `sp_threads_woken`. The critical flaw is that `__svc_create` completely ignores the return values of these `percpu_counter_init` calls.

My next step was to consider the fix. The obvious solution is to introduce error checking. If any of the `percpu_counter_init` calls fail, the function needs to perform proper error handling. This would involve cleaning up any resources that were successfully allocated up to that point and returning an error to the caller.

I specifically looked at the `percpu_counter_destroy` function. My concern was whether it was safe to call `destroy` on a `struct percpu_counter` that had failed initialization (meaning its `counters` pointer would be `NULL`). Upon reviewing `percpu_counter_destroy_many`, I found that it includes a check: `if (unlikely(!fbc[0].counters)) return;`. This is excellent; it means calling `destroy` on an uninitialized or partially initialized `percpu_counter` is safe and does nothing, which simplifies the cleanup logic considerably.

Finally, I examined the context of `__svc_create` and its error handling path. The code allocates `serv->sv_pools` using `kzalloc_objs`, which zeroes the memory. This means that before any `percpu_counter_init` calls, `sp_messages_arrived.counters` (and the others) will inherently be `NULL`. Consequently, if an `init` fails, and we then attempt to destroy the pool structure, calling `percpu_counter_destroy` on the already-initialized counters will be a no-op, and `kfree(serv->sv_pools)` will handle the memory. The `svc_destroy(&serv)` call, which also iterates through and calls `percpu_counter_destroy` on each pool's counters, appears to be the correct mechanism for unwinding the state. So, the corrected logic would look something like this:

```c
if (percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL) ||
    percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL) ||
    percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL)) {
    svc_destroy(&serv); // Assumes svc_destroy correctly handles partially initialized serv
    return NULL; // Or appropriate error return
}
```

This leads me to the conclusion that the primary vulnerability lies in the `__svc_create` function's negligence in handling the return values of `percpu_counter_init`, which directly causes the subsequent `NULL` pointer dereference and kernel panic.

map[ContextFile:net/sunrpc/svc.c Name:svc_destroy]

map[SourceCode: 596:	/*
 597:	 * Destroy an RPC service. Should be called with appropriate locking to
 598:	 * protect sv_permsocks and sv_tempsocks.
 599:	 */
 600:	void
 601:	svc_destroy(struct svc_serv **servp)
 602:	{
 603:		struct svc_serv *serv = *servp;
 604:		unsigned int i;
 605:	
 606:		*servp = NULL;
 607:	
 608:		dprintk("svc: svc_destroy(%s)\n", serv->sv_programs->pg_name);
 609:		timer_shutdown_sync(&serv->sv_temptimer);
 610:	
 611:		/*
 612:		 * Remaining transports at this point are not expected.
 613:		 */
 614:		WARN_ONCE(!list_empty(&serv->sv_permsocks),
 615:			  "SVC: permsocks remain for %s\n", serv->sv_programs->pg_name);
 616:		WARN_ONCE(!list_empty(&serv->sv_tempsocks),
 617:			  "SVC: tempsocks remain for %s\n", serv->sv_programs->pg_name);
 618:	
 619:		cache_clean_deferred(serv);
 620:	
 621:		if (serv->sv_is_pooled)
 622:			svc_pool_map_put();
 623:	
 624:		for (i = 0; i < serv->sv_nrpools; i++) {
 625:			struct svc_pool *pool = &serv->sv_pools[i];
 626:	
 627:			percpu_counter_destroy(&pool->sp_messages_arrived);
 628:			percpu_counter_destroy(&pool->sp_sockets_queued);
 629:			percpu_counter_destroy(&pool->sp_threads_woken);
 630:		}
 631:		kfree(serv->sv_pools);
 632:		kfree(serv);
 633:	}
 SourceFile:net/sunrpc/svc.c]

gemini-3.1-pro-preview

							input: 138178
							output: 37
							thoughts: 75
						

**My Thought Process Regarding `svc_destroy` and Related Operations**

Ah, I've just been contemplating the safety of calling `svc_destroy` on a `serv` structure that might not be fully initialized. My initial assessment is that, yes, it appears to be perfectly safe. My reasoning hinges on a couple of key points: Firstly, I recall that the `sv_pools` field within the `serv` structure is guaranteed to be zeroed out during initialization. This means even if the `serv` isn't completely set up, this crucial pointer will be null, preventing any dereferencing of invalid memory. Secondly, and equally importantly, I'm confident that `percpu_counter_destroy` is designed to gracefully handle `NULL` counters. This robust behavior means that if the `serv` structure hasn't reached the point where its per-CPU counters are allocated and initialized, calling `percpu_counter_destroy` on them will simply do nothing, which is precisely the desired outcome for safety.

However, a flicker of doubt just crossed my mind. I noticed that `cache_clean_deferred(serv)` is also called as part of the `svc_destroy` sequence. This has made me pause and consider: is *that* call also safe in the context of a partially initialized `serv`? To address this, I'm now embarking on a deeper dive to scrutinize the implementation details of `cache_clean_deferred` itself. I need to be absolutely certain that its internal logic doesn't assume a fully initialized `serv` structure, particularly concerning any data structures or state it might interact with.

map[ContextFile:net/sunrpc/svc.c Name:cache_clean_deferred]

map[SourceCode: 774:	void cache_clean_deferred(void *owner)
 775:	{
 776:		struct cache_deferred_req *dreq, *tmp;
 777:		LIST_HEAD(pending);
 778:	
 779:		spin_lock(&cache_defer_lock);
 780:	
 781:		list_for_each_entry_safe(dreq, tmp, &cache_defer_list, recent) {
 782:			if (dreq->owner == owner) {
 783:				__unhash_deferred_req(dreq);
 784:				list_add(&dreq->recent, &pending);
 785:			}
 786:		}
 787:		spin_unlock(&cache_defer_lock);
 788:	
 789:		while (!list_empty(&pending)) {
 790:			dreq = list_entry(pending.next, struct cache_deferred_req, recent);
 791:			list_del_init(&dreq->recent);
 792:			dreq->revisit(dreq, 1);
 793:		}
 794:	}
 SourceFile:net/sunrpc/cache.c]

gemini-3.1-pro-preview

							input: 138613
							output: 40
							thoughts: 176
						

**My Thought Process Regarding `svc_destroy` Safety**

Okay, so I'm looking at the call to `cache_clean_deferred` within `svc_destroy`. My initial thought is that this should be perfectly safe. The function `cache_clean_deferred` operates by scanning a global list for entries that match a specific `owner` identifier, which in this context is `serv`. Since `serv` was *just* allocated before this point, it stands to reason that there wouldn't be any existing entries in that global list associated with this newly created `serv` instance. Therefore, the search will effectively yield nothing, making the operation benign.

Now, I need to consider the conditional call to `svc_pool_map_put()`. This function is only invoked if `serv->sv_is_pooled` is true. I'm tracing back where this flag is set. My understanding is that within `__svc_create`, `serv->sv_is_pooled` is *not* initialized to true. Instead, it's set to true later, specifically in the `svc_create_pooled` function, and this happens *after* `__svc_create` has completed its execution. Consequently, at the point where `svc_destroy` is called, `serv->sv_is_pooled` will definitively be false. This means `svc_pool_map_put()` will not be executed. With both `cache_clean_deferred` and `svc_pool_map_put()` safely out of the picture, the subsequent call to `svc_destroy(&serv)` appears to be entirely safe.

Finally, as a matter of thoroughness, I'll perform a quick verification to ensure that `percpu_counter_destroy` correctly handles a `NULL` pointer input, just in case there's any edge case I'm overlooking.

map[ContextFile:lib/percpu_counter.c Name:percpu_counter_destroy_many]

map[SourceCode: 227:	void percpu_counter_destroy_many(struct percpu_counter *fbc, u32 nr_counters)
 228:	{
 229:		unsigned long flags __maybe_unused;
 230:		u32 i;
 231:	
 232:		if (WARN_ON_ONCE(!fbc))
 233:			return;
 234:	
 235:		if (!fbc[0].counters)
 236:			return;
 237:	
 238:		for (i = 0; i < nr_counters; i++)
 239:			debug_percpu_counter_deactivate(&fbc[i]);
 240:	
 241:	#ifdef CONFIG_HOTPLUG_CPU
 242:		spin_lock_irqsave(&percpu_counters_lock, flags);
 243:		for (i = 0; i < nr_counters; i++)
 244:			list_del(&fbc[i].list);
 245:		spin_unlock_irqrestore(&percpu_counters_lock, flags);
 246:	#endif
 247:	
 248:		free_percpu(fbc[0].counters);
 249:	
 250:		for (i = 0; i < nr_counters; i++)
 251:			fbc[i].counters = NULL;
 252:	}
 SourceFile:lib/percpu_counter.c]

gemini-3.1-pro-preview

							input: 139225
							output: 35
							thoughts: 520
						

**A Deep Dive into the Per-CPU Counter Bug and its Resolution**

I've been wrestling with a particularly thorny kernel bug, and after some significant digging, I believe I've finally pinned down the root cause and a robust solution. It all started with a reproducer that, frustratingly, failed to trigger the issue. My initial thought was that the reproducer was flawed, but the reality turned out to be more nuanced.

The reproducer relied on `failslab` to inject a failure into `percpu_counter_init`. My first instinct was to check if `percpu_counter_init` itself was robust against such failures, and I found this snippet:

```c
	if (!fbc[0].counters)
		return;
```

This check, at the very beginning of `percpu_counter_destroy`, appears to completely safeguard against a `NULL` `counters` pointer. So, at least *destroying* a potentially uninitialized counter is safe.

However, the reproducer's failure to trigger the bug wasn't due to `percpu_counter_destroy`'s safety. It was because `percpu_counter_init` allocates memory using the per-cpu allocator (`__alloc_percpu_gfp`). This allocator doesn't *always* engage the slab allocator. It only does so when a brand new per-cpu chunk needs to be provisioned. In this particular scenario, the per-cpu allocator likely had sufficient free space within its existing chunks. Consequently, `failslab` never got a chance to intercept the allocation, and `percpu_counter_init` silently succeeded, masking the underlying problem.

The true culprit lies deeper, specifically within `__svc_create()` in `net/sunrpc/svc.c`. This function initiates the creation of several per-cpu counters: `sp_messages_arrived`, `sp_sockets_queued`, and `sp_threads_woken`. The critical oversight here is that `__svc_create()` completely disregards the return values from `percpu_counter_init()`.

If `percpu_counter_init()` were to fail – perhaps due to memory pressure or, as the reproducer intended, fault injection – it would return `-ENOMEM`. Crucially, upon failure, it leaves the `counters` pointer within the `percpu_counter` struct set to `NULL`.

The problem then cascades. Later, when `svc_xprt_enqueue()` attempts to increment a counter using `percpu_counter_inc(&pool->sp_sockets_queued)`, it internally calls `percpu_counter_add_batch()`. This function unconditionally dereferences the `counters` pointer via `this_cpu_read(*fbc->counters)`. When this pointer is `NULL`, the inevitable outcome is a page fault at `NULL + per_cpu_offset`. This exact scenario matches the observed crash signature: `BUG: unable to handle kernel paging request in percpu_counter_add_batch`.

My proposed fix is straightforward yet essential: `__svc_create()` *must* be modified to diligently check the return values from each `percpu_counter_init()` call. If any of these initializations fail, the function needs to perform a proper unwind of the partially created service. This could involve calling `svc_destroy(&serv)` and then returning `NULL` to signal the failure to the caller. The good news is that `svc_destroy()` is designed to be safe even when called on a partially initialized `serv` structure. This is because `sv_pools` is zero-allocated, and `percpu_counter_destroy()` itself gracefully handles a `NULL` `counters` pointer by simply returning without action.

As a final step in my due diligence, I've initiated a search to identify any other instances where `percpu_counter_init` might be called without its return value being properly examined. This ensures we address the potential for similar vulnerabilities across the codebase.

map[Expression:percpu_counter_init\([^,]+, [^,]+, [^)]+\);]

map[Output:block/bfq-cgroup.c=19=static int bfq_stat_init(struct bfq_stat *stat, gfp_t gfp)
--
block/bfq-cgroup.c-22-
block/bfq-cgroup.c:23:	ret = percpu_counter_init(&stat->cpu_cnt, 0, gfp);
block/bfq-cgroup.c-24-	if (ret)
--
drivers/md/dm-crypt.c=3179=static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
--
drivers/md/dm-crypt.c-3217-
drivers/md/dm-crypt.c:3218:	ret = percpu_counter_init(&cc->n_allocated_pages, 0, GFP_KERNEL);
drivers/md/dm-crypt.c-3219-	if (ret < 0)
--
fs/btrfs/disk-io.c=2922=static int init_mount_fs_info(struct btrfs_fs_info *fs_info, struct super_block *sb)
--
fs/btrfs/disk-io.c-2930-
fs/btrfs/disk-io.c:2931:	ret = percpu_counter_init(&fs_info->ordered_bytes, 0, GFP_KERNEL);
fs/btrfs/disk-io.c-2932-	if (ret)
--
fs/btrfs/disk-io.c-2934-
fs/btrfs/disk-io.c:2935:	ret = percpu_counter_init(&fs_info->evictable_extent_maps, 0, GFP_KERNEL);
fs/btrfs/disk-io.c-2936-	if (ret)
--
fs/btrfs/disk-io.c-2938-
fs/btrfs/disk-io.c:2939:	ret = percpu_counter_init(&fs_info->dirty_metadata_bytes, 0, GFP_KERNEL);
fs/btrfs/disk-io.c-2940-	if (ret)
--
fs/btrfs/disk-io.c-2942-
fs/btrfs/disk-io.c:2943:	ret = percpu_counter_init(&fs_info->stats_read_blocks, 0, GFP_KERNEL);
fs/btrfs/disk-io.c-2944-	if (ret)
--
fs/btrfs/disk-io.c-2949-
fs/btrfs/disk-io.c:2950:	ret = percpu_counter_init(&fs_info->delalloc_bytes, 0, GFP_KERNEL);
fs/btrfs/disk-io.c-2951-	if (ret)
--
fs/ceph/metric.c=407=int ceph_metric_init(struct ceph_client_metric *m)
--
fs/ceph/metric.c-415-	atomic64_set(&m->total_dentries, 0);
fs/ceph/metric.c:416:	ret = percpu_counter_init(&m->d_lease_hit, 0, GFP_KERNEL);
fs/ceph/metric.c-417-	if (ret)
--
fs/ceph/metric.c-419-
fs/ceph/metric.c:420:	ret = percpu_counter_init(&m->d_lease_mis, 0, GFP_KERNEL);
fs/ceph/metric.c-421-	if (ret)
--
fs/ceph/metric.c-424-	atomic64_set(&m->total_caps, 0);
fs/ceph/metric.c:425:	ret = percpu_counter_init(&m->i_caps_hit, 0, GFP_KERNEL);
fs/ceph/metric.c-426-	if (ret)
--
fs/ceph/metric.c-428-
fs/ceph/metric.c:429:	ret = percpu_counter_init(&m->i_caps_mis, 0, GFP_KERNEL);
fs/ceph/metric.c-430-	if (ret)
--
fs/ceph/metric.c-447-	atomic64_set(&m->opened_files, 0);
fs/ceph/metric.c:448:	ret = percpu_counter_init(&m->opened_inodes, 0, GFP_KERNEL);
fs/ceph/metric.c-449-	if (ret)
fs/ceph/metric.c-450-		goto err_opened_inodes;
fs/ceph/metric.c:451:	ret = percpu_counter_init(&m->total_inodes, 0, GFP_KERNEL);
fs/ceph/metric.c-452-	if (ret)
--
fs/ext4/extents_status.c=1832=int ext4_es_register_shrinker(struct ext4_sb_info *sbi)
--
fs/ext4/extents_status.c-1851-	sbi->s_es_stats.es_stats_max_scan_time = 0;
fs/ext4/extents_status.c:1852:	err = percpu_counter_init(&sbi->s_es_stats.es_stats_all_cnt, 0, GFP_KERNEL);
fs/ext4/extents_status.c-1853-	if (err)
fs/ext4/extents_status.c-1854-		goto err2;
fs/ext4/extents_status.c:1855:	err = percpu_counter_init(&sbi->s_es_stats.es_stats_shk_cnt, 0, GFP_KERNEL);
fs/ext4/extents_status.c-1856-	if (err)
--
fs/f2fs/super.c=4419=static int init_percpu_info(struct f2fs_sb_info *sbi)
--
fs/f2fs/super.c-4422-
fs/f2fs/super.c:4423:	err = percpu_counter_init(&sbi->alloc_valid_block_count, 0, GFP_KERNEL);
fs/f2fs/super.c-4424-	if (err)
--
fs/f2fs/super.c-4426-
fs/f2fs/super.c:4427:	err = percpu_counter_init(&sbi->rf_node_block_count, 0, GFP_KERNEL);
fs/f2fs/super.c-4428-	if (err)
--
fs/file_table.c=632=void __init files_init(void)
--
fs/file_table.c-649-
fs/file_table.c:650:	percpu_counter_init(&nr_files, 0, GFP_KERNEL);
fs/file_table.c-651-}
--
fs/smb/server/proc.c=109=void ksmbd_proc_init(void)
--
fs/smb/server/proc.c-121-	for (i = 0; i < ARRAY_SIZE(ksmbd_counters.counters); i++) {
fs/smb/server/proc.c:122:		retval = percpu_counter_init(&ksmbd_counters.counters[i], 0, GFP_KERNEL);
fs/smb/server/proc.c-123-		if (retval)
--
fs/xfs/xfs_super.c=1161=xfs_init_percpu_counters(
--
fs/xfs/xfs_super.c-1166-
fs/xfs/xfs_super.c:1167:	error = percpu_counter_init(&mp->m_icount, 0, GFP_KERNEL);
fs/xfs/xfs_super.c-1168-	if (error)
--
fs/xfs/xfs_super.c-1170-
fs/xfs/xfs_super.c:1171:	error = percpu_counter_init(&mp->m_ifree, 0, GFP_KERNEL);
fs/xfs/xfs_super.c-1172-	if (error)
--
fs/xfs/xfs_super.c-1174-
fs/xfs/xfs_super.c:1175:	error = percpu_counter_init(&mp->m_delalloc_blks, 0, GFP_KERNEL);
fs/xfs/xfs_super.c-1176-	if (error)
--
fs/xfs/xfs_super.c-1178-
fs/xfs/xfs_super.c:1179:	error = percpu_counter_init(&mp->m_delalloc_rtextents, 0, GFP_KERNEL);
fs/xfs/xfs_super.c-1180-	if (error)
--
include/net/dst_ops.h=63=static inline int dst_entries_init(struct dst_ops *dst)
include/net/dst_ops.h-64-{
include/net/dst_ops.h:65:	return percpu_counter_init(&dst->pcpuc_entries, 0, GFP_KERNEL);
include/net/dst_ops.h-66-}
--
io_uring/tctx.c=82=__cold struct io_uring_task *io_uring_alloc_task_context(struct task_struct *task,
--
io_uring/tctx.c-91-
io_uring/tctx.c:92:	ret = percpu_counter_init(&tctx->inflight, 0, GFP_KERNEL);
io_uring/tctx.c-93-	if (unlikely(ret)) {
--
ipc/msg.c=1306=int msg_init_ns(struct ipc_namespace *ns)
--
ipc/msg.c-1313-
ipc/msg.c:1314:	ret = percpu_counter_init(&ns->percpu_msg_bytes, 0, GFP_KERNEL);
ipc/msg.c-1315-	if (ret)
ipc/msg.c-1316-		goto fail_msg_bytes;
ipc/msg.c:1317:	ret = percpu_counter_init(&ns->percpu_msg_hdrs, 0, GFP_KERNEL);
ipc/msg.c-1318-	if (ret)
--
kernel/bpf/hashtab.c=545=static struct bpf_map *htab_map_alloc(union bpf_attr *attr)
--
kernel/bpf/hashtab.c-632-	if (htab->use_percpu_counter) {
kernel/bpf/hashtab.c:633:		err = percpu_counter_init(&htab->pcount, 0, GFP_KERNEL);
kernel/bpf/hashtab.c-634-		if (err)
--
kernel/user.c=141=static int user_epoll_alloc(struct user_struct *up)
--
kernel/user.c-143-#ifdef CONFIG_EPOLL
kernel/user.c:144:	return percpu_counter_init(&up->epoll_watches, 0, GFP_KERNEL);
kernel/user.c-145-#else
--
lib/flex_proportions.c=38=int fprop_global_init(struct fprop_global *p, gfp_t gfp)
--
lib/flex_proportions.c-43-	/* Use 1 to avoid dealing with periods with 0 events... */
lib/flex_proportions.c:44:	err = percpu_counter_init(&p->events, 1, gfp);
lib/flex_proportions.c-45-	if (err)
--
lib/flex_proportions.c=92=int fprop_local_init_percpu(struct fprop_local_percpu *pl, gfp_t gfp)
--
lib/flex_proportions.c-95-
lib/flex_proportions.c:96:	err = percpu_counter_init(&pl->events, 0, gfp);
lib/flex_proportions.c-97-	if (err)
--
mm/mmap.c=1567=void __init mmap_init(void)
--
mm/mmap.c-1570-
mm/mmap.c:1571:	ret = percpu_counter_init(&vm_committed_as, 0, GFP_KERNEL);
mm/mmap.c-1572-	VM_BUG_ON(ret);
--
mm/nommu.c=422=void __init mmap_init(void)
--
mm/nommu.c-425-
mm/nommu.c:426:	ret = percpu_counter_init(&vm_committed_as, 0, GFP_KERNEL);
mm/nommu.c-427-	VM_BUG_ON(ret);
--
net/ipv4/tcp.c=5283=void __init tcp_init(void)
--
net/ipv4/tcp.c-5294-
net/ipv4/tcp.c:5295:	percpu_counter_init(&tcp_sockets_allocated, 0, GFP_KERNEL);
net/ipv4/tcp.c-5296-
--
net/sctp/protocol.c=1476=static __init int sctp_init(void)
--
net/sctp/protocol.c-1499-
net/sctp/protocol.c:1500:	status = percpu_counter_init(&sctp_sockets_allocated, 0, GFP_KERNEL);
net/sctp/protocol.c-1501-	if (status)
--
net/sunrpc/svc.c=483=__svc_create(struct svc_program *prog, int nprogs, struct svc_stat *stats,
--
net/sunrpc/svc.c-542-
net/sunrpc/svc.c:543:		percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL);
net/sunrpc/svc.c:544:		percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL);
net/sunrpc/svc.c:545:		percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL);
net/sunrpc/svc.c-546-	}
--
net/sunrpc/xprtrdma/svc_rdma.c=227=static int svc_rdma_proc_init(void)
--
net/sunrpc/xprtrdma/svc_rdma.c-233-
net/sunrpc/xprtrdma/svc_rdma.c:234:	rc = percpu_counter_init(&svcrdma_stat_read, 0, GFP_KERNEL);
net/sunrpc/xprtrdma/svc_rdma.c-235-	if (rc)
net/sunrpc/xprtrdma/svc_rdma.c-236-		goto err;
net/sunrpc/xprtrdma/svc_rdma.c:237:	rc = percpu_counter_init(&svcrdma_stat_recv, 0, GFP_KERNEL);
net/sunrpc/xprtrdma/svc_rdma.c-238-	if (rc)
net/sunrpc/xprtrdma/svc_rdma.c-239-		goto err_read;
net/sunrpc/xprtrdma/svc_rdma.c:240:	rc = percpu_counter_init(&svcrdma_stat_sq_starve, 0, GFP_KERNEL);
net/sunrpc/xprtrdma/svc_rdma.c-241-	if (rc)
net/sunrpc/xprtrdma/svc_rdma.c-242-		goto err_recv;
net/sunrpc/xprtrdma/svc_rdma.c:243:	rc = percpu_counter_init(&svcrdma_stat_write, 0, GFP_KERNEL);
net/sunrpc/xprtrdma/svc_rdma.c-244-	if (rc)
]

gemini-3.1-pro-preview

							input: 143943
							output: 568
							thoughts: 808
						

**My Thought Process Regarding the Kernel Crash and its Resolution**

I've been delving into a kernel crash scenario, and my analysis has led me to a clear understanding of the problem and its solution. It appears that a seemingly innocuous oversight in how certain per-CPU counters are initialized is leading to critical failures.

Initially, I noticed that even core components like `net/ipv4/tcp.c` and `fs/file_table.c` initialize per-CPU counters (`tcp_sockets_allocated` and `nr_files`, respectively) within `__init` functions. My initial thought was that these might also be ignoring return values, but then I realized that `__init` functions are called during boot. If they fail, the system would likely panic anyway, or the failure might simply not be handled because it's a one-time initialization. This is fundamentally different from the situation I'm investigating.

The real issue lies with `__svc_create()` in `net/sunrpc/svc.c`. This function is designed to be called dynamically, specifically when an NFS server is started – for instance, by writing to `/proc/fs/nfsd/portlist`. This dynamic nature means it can absolutely fail due to memory pressure or fault injection. The critical flaw is that `__svc_create()` calls `percpu_counter_init()` for several counters (`sp_messages_arrived`, `sp_sockets_queued`, and `sp_threads_woken`) but then completely disregards the return values. If `percpu_counter_init()` encounters an issue and returns `-ENOMEM`, it leaves the `counters` pointer within the `percpu_counter` structure as `NULL`.

This `NULL` pointer then becomes the direct cause of a kernel crash. Later, when `svc_xprt_enqueue()` attempts to increment one of these counters (e.g., `percpu_counter_inc(&pool->sp_sockets_queued)`), it calls `percpu_counter_add_batch()`. This function unconditionally tries to dereference the `counters` pointer using `this_cpu_read(*fbc->counters)`. Since the pointer is `NULL`, this leads to a page fault at `NULL + per_cpu_offset`, manifesting as the `BUG: unable to handle kernel paging request in percpu_counter_add_batch` error I've observed.

My reproducer was designed to trigger this by using `failslab` to inject a failure into `percpu_counter_init`. However, it failed to do so because `percpu_counter_init` relies on the per-CPU allocator, which doesn't always invoke the slab allocator. It only does so when a new per-CPU chunk needs to be created. In my specific test environment, the per-CPU allocator likely had sufficient free space within existing chunks, so `failslab` never had an opportunity to intercept an allocation, and `percpu_counter_init` always succeeded. This explains why the reproducer didn't trigger the bug, even though the underlying vulnerability is present. I confirmed that `percpu_counter_init` *can* fail via `failslab` if `pcpu_alloc_chunk` is invoked, as it uses `kzalloc` which is slab-based, but this is conditional on chunk exhaustion.

The fix is straightforward: `__svc_create()` must be modified to check the return values of `percpu_counter_init()`. If any of these initializations fail, the function needs to perform a proper cleanup and error handling. A good approach would be to call `svc_destroy(&serv)` to tear down any partially initialized server structures and then return `NULL` to indicate failure. Importantly, `svc_destroy()` is designed to be safe even on a partially initialized `serv` because `sv_pools` is zero-initialized, and `percpu_counter_destroy()` gracefully handles `NULL` pointers for its `counters`.

Given that the crash signature directly matches the bug report, even though my initial reproducer failed to trigger it, I'm confident in my findings. I will mark `TitleMatches` as true, and `Reproduced` as false, with a clear explanation of why the reproducer didn't work and what the actual root cause is. I'm now ready to proceed with applying the fix and confirming its effectiveness.

map[Feedback:The reproduction attempt failed to trigger the bug because it relies on `failslab` to inject a failure into `percpu_counter_init()`. However, `percpu_counter_init()` allocates memory using the percpu allocator (`__alloc_percpu_gfp`), which does not always call into the slab allocator. It only performs a slab allocation when a new percpu chunk needs to be created. Since the percpu allocator likely had enough free space in existing chunks during the test, `failslab` never intercepted the allocation, and `percpu_counter_init()` always succeeded.

The root cause of the bug is in `__svc_create()` (in `net/sunrpc/svc.c`). It calls `percpu_counter_init()` for `sp_messages_arrived`, `sp_sockets_queued`, and `sp_threads_woken` but completely ignores their return values:
```c
		percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL);
		percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL);
		percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL);
```
If `percpu_counter_init()` fails (e.g., due to memory pressure or fault injection), it returns `-ENOMEM` and leaves the `counters` pointer inside the `percpu_counter` struct as `NULL`.

Later, when `svc_xprt_enqueue()` calls `percpu_counter_inc(&pool->sp_sockets_queued)`, it calls `percpu_counter_add_batch()`, which unconditionally dereferences the `counters` pointer via `this_cpu_read(*fbc->counters)`. Since the pointer is `NULL`, this results in a page fault at `NULL + per_cpu_offset`, which matches the crash signature `BUG: unable to handle kernel paging request in percpu_counter_add_batch`.

To fix this, `__svc_create()` must check the return values of `percpu_counter_init()` and properly unwind/handle the error if any of them fail. For example, it can call `svc_destroy(&serv)` and return `NULL`. `svc_destroy()` is safe to call on a partially initialized `serv` because `sv_pools` is zero-allocated and `percpu_counter_destroy()` safely returns if the `counters` pointer is `NULL`. ProbePassed:false TerminalError: TitleMatches:true]

map[Feedback:The reproduction attempt failed to trigger the bug because it relies on `failslab` to inject a failure into `percpu_counter_init()`. However, `percpu_counter_init()` allocates memory using the percpu allocator (`__alloc_percpu_gfp`), which does not always call into the slab allocator. It only performs a slab allocation when a new percpu chunk needs to be created. Since the percpu allocator likely had enough free space in existing chunks during the test, `failslab` never intercepted the allocation, and `percpu_counter_init()` always succeeded.

The root cause of the bug is in `__svc_create()` (in `net/sunrpc/svc.c`). It calls `percpu_counter_init()` for `sp_messages_arrived`, `sp_sockets_queued`, and `sp_threads_woken` but completely ignores their return values:
```c
		percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL);
		percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL);
		percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL);
```
If `percpu_counter_init()` fails (e.g., due to memory pressure or fault injection), it returns `-ENOMEM` and leaves the `counters` pointer inside the `percpu_counter` struct as `NULL`.

Later, when `svc_xprt_enqueue()` calls `percpu_counter_inc(&pool->sp_sockets_queued)`, it calls `percpu_counter_add_batch()`, which unconditionally dereferences the `counters` pointer via `this_cpu_read(*fbc->counters)`. Since the pointer is `NULL`, this results in a page fault at `NULL + per_cpu_offset`, which matches the crash signature `BUG: unable to handle kernel paging request in percpu_counter_add_batch`.

To fix this, `__svc_create()` must check the return values of `percpu_counter_init()` and properly unwind/handle the error if any of them fail. For example, it can call `svc_destroy(&serv)` and return `NULL`. `svc_destroy()` is safe to call on a partially initialized `serv` because `sv_pools` is zero-allocated and `percpu_counter_destroy()` safely returns if the `counters` pointer is `NULL`. ProbePassed:false TerminalError: TitleMatches:true]

map[CapabilitiesVerified:true ContinueSignal:continue EquivalenceAnalysis: OracleFeedback:The reproduction attempt failed to trigger the bug because it relies on `failslab` to inject a failure into `percpu_counter_init()`. However, `percpu_counter_init()` allocates memory using the percpu allocator (`__alloc_percpu_gfp`), which does not always call into the slab allocator. It only performs a slab allocation when a new percpu chunk needs to be created. Since the percpu allocator likely had enough free space in existing chunks during the test, `failslab` never intercepted the allocation, and `percpu_counter_init()` always succeeded.

The root cause of the bug is in `__svc_create()` (in `net/sunrpc/svc.c`). It calls `percpu_counter_init()` for `sp_messages_arrived`, `sp_sockets_queued`, and `sp_threads_woken` but completely ignores their return values:
```c
		percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL);
		percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL);
		percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL);
```
If `percpu_counter_init()` fails (e.g., due to memory pressure or fault injection), it returns `-ENOMEM` and leaves the `counters` pointer inside the `percpu_counter` struct as `NULL`.

Later, when `svc_xprt_enqueue()` calls `percpu_counter_inc(&pool->sp_sockets_queued)`, it calls `percpu_counter_add_batch()`, which unconditionally dereferences the `counters` pointer via `this_cpu_read(*fbc->counters)`. Since the pointer is `NULL`, this results in a page fault at `NULL + per_cpu_offset`, which matches the crash signature `BUG: unable to handle kernel paging request in percpu_counter_add_batch`.

To fix this, `__svc_create()` must check the return values of `percpu_counter_init()` and properly unwind/handle the error if any of them fail. For example, it can call `svc_destroy(&serv)` and return `NULL`. `svc_destroy()` is safe to call on a partially initialized `serv` because `sv_pools` is zero-allocated and `percpu_counter_destroy()` safely returns if the `counters` pointer is `NULL`. ReproC: Reproduced:false ReproducedBugTitle: ReproducedCrashReport:]

map[OracleFeedback:The reproduction attempt failed to trigger the bug because it relies on `failslab` to inject a failure into `percpu_counter_init()`. However, `percpu_counter_init()` allocates memory using the percpu allocator (`__alloc_percpu_gfp`), which does not always call into the slab allocator. It only performs a slab allocation when a new percpu chunk needs to be created. Since the percpu allocator likely had enough free space in existing chunks during the test, `failslab` never intercepted the allocation, and `percpu_counter_init()` always succeeded.

The root cause of the bug is in `__svc_create()` (in `net/sunrpc/svc.c`). It calls `percpu_counter_init()` for `sp_messages_arrived`, `sp_sockets_queued`, and `sp_threads_woken` but completely ignores their return values:
```c
		percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL);
		percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL);
		percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL);
```
If `percpu_counter_init()` fails (e.g., due to memory pressure or fault injection), it returns `-ENOMEM` and leaves the `counters` pointer inside the `percpu_counter` struct as `NULL`.

Later, when `svc_xprt_enqueue()` calls `percpu_counter_inc(&pool->sp_sockets_queued)`, it calls `percpu_counter_add_batch()`, which unconditionally dereferences the `counters` pointer via `this_cpu_read(*fbc->counters)`. Since the pointer is `NULL`, this results in a page fault at `NULL + per_cpu_offset`, which matches the crash signature `BUG: unable to handle kernel paging request in percpu_counter_add_batch`.

To fix this, `__svc_create()` must check the return values of `percpu_counter_init()` and properly unwind/handle the error if any of them fail. For example, it can call `svc_destroy(&serv)` and return `NULL`. `svc_destroy()` is safe to call on a partially initialized `serv` because `sv_pools` is zero-allocated and `percpu_counter_destroy()` safely returns if the `counters` pointer is `NULL`.]

best-expensive

You are an expert in Linux kernel debugging.
Refine the reproduction strategy based on feedback from previous attempts.
Analyze the technical diagnosis provided in the oracle feedback and translate it into concrete,
step-by-step instructions for the repro-generator on how to modify the code structure, alignments,
offsets, or parameters of the candidate program.

=== TOOL SELECTION GUIDELINES ===
- Prefer codesearch-definition-source and codesearch-struct-layout first for symbol lookups.
- Fall back to read-file or grepper for macros, headers, or if symbol lookup fails.

=== CRITICAL PROHIBITIONS ===
- Do NOT repeat searches for the same symbols or files. Use information you have already gathered.
- Do NOT write long explanations. Keep your reasoning short and focused on actionable changes.
- Do NOT assume a bug is fixed based on git commit history.
- If you are stuck, try a different approach or proceed to generate a candidate reproducer.
Prefer calling several tools at the same time to save round-trips.

Bug Description: BUG: unable to handle kernel paging request in percpu_counter_add_batch

BUG: unable to handle page fault for address: ffff88808c54a000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 1acd5067 P4D 1acd5067 PUD 0 
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5311 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:percpu_counter_add_batch+0x50/0x1d0 lib/percpu_counter.c:98
Code: f6 48 b7 fc 48 89 5c 24 10 48 83 c3 58 49 89 de 49 c1 ee 03 43 80 3c 3e 00 74 08 48 89 df e8 07 7d 26 fd 48 89 1c 24 48 8b 03 <65> 8b 28 41 89 ef 41 c1 ff 1f 49 c1 e7 20 4c 89 6c 24 08 4d 01 ef
RSP: 0018:ffffc9000dc47810 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888036dc4930 RCX: ffff888012f0ca80
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888036dc48d8
RBP: ffffc9000dc47908 R08: ffff888012c3e03f R09: 1ffff11002587c07
R10: dffffc0000000000 R11: ffffed1002587c08 R12: 0000000000000020
R13: 0000000000000001 R14: 1ffff11006db8926 R15: dffffc0000000000
FS:  00007f711d27e6c0(0000) GS:ffff88808c54a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88808c54a000 CR3: 000000001fde5000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 percpu_counter_add include/linux/percpu_counter.h:71 [inline]
 percpu_counter_inc include/linux/percpu_counter.h:267 [inline]
 svc_xprt_enqueue+0x2ee/0x8b0 net/sunrpc/svc_xprt.c:524
 svc_xprt_received+0x10f/0x150 net/sunrpc/svc_xprt.c:248
 svc_add_new_perm_xprt net/sunrpc/svc_xprt.c:260 [inline]
 _svc_xprt_create+0x3d8/0x600 net/sunrpc/svc_xprt.c:290
 svc_xprt_create_from_sa net/sunrpc/svc_xprt.c:332 [inline]
 svc_xprt_create+0x1aa/0x280 net/sunrpc/svc_xprt.c:387
 __write_ports_addxprt fs/nfsd/nfsctl.c:774 [inline]
 __write_ports fs/nfsd/nfsctl.c:808 [inline]
 write_ports+0x71a/0xd10 fs/nfsd/nfsctl.c:861
 nfsctl_transaction_write+0x10f/0x160 fs/nfsd/nfsctl.c:112
 vfs_write+0x296/0xba0 fs/read_write.c:685
 ksys_write+0x150/0x270 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f711c39e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f711d27dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f711c625fa0 RCX: 00007f711c39e0d9
RDX: 0000000000000005 RSI: 0000200000000300 RDI: 0000000000000004
RBP: 00007f711c435024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f711c626038 R14: 00007f711c625fa0 R15: 00007ffc740e4ce8
 </TASK>
Modules linked in:
CR2: ffff88808c54a000
---[ end trace 0000000000000000 ]---
RIP: 0010:percpu_counter_add_batch+0x50/0x1d0 lib/percpu_counter.c:98
Code: f6 48 b7 fc 48 89 5c 24 10 48 83 c3 58 49 89 de 49 c1 ee 03 43 80 3c 3e 00 74 08 48 89 df e8 07 7d 26 fd 48 89 1c 24 48 8b 03 <65> 8b 28 41 89 ef 41 c1 ff 1f 49 c1 e7 20 4c 89 6c 24 08 4d 01 ef
RSP: 0018:ffffc9000dc47810 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888036dc4930 RCX: ffff888012f0ca80
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888036dc48d8
RBP: ffffc9000dc47908 R08: ffff888012c3e03f R09: 1ffff11002587c07
R10: dffffc0000000000 R11: ffffed1002587c08 R12: 0000000000000020
R13: 0000000000000001 R14: 1ffff11006db8926 R15: dffffc0000000000
FS:  00007f711d27e6c0(0000) GS:ffff88808c54a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88808c54a000 CR3: 000000001fde5000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	f6 48 b7 fc          	testb  $0xfc,-0x49(%rax)
   4:	48 89 5c 24 10       	mov    %rbx,0x10(%rsp)
   9:	48 83 c3 58          	add    $0x58,%rbx
   d:	49 89 de             	mov    %rbx,%r14
  10:	49 c1 ee 03          	shr    $0x3,%r14
  14:	43 80 3c 3e 00       	cmpb   $0x0,(%r14,%r15,1)
  19:	74 08                	je     0x23
  1b:	48 89 df             	mov    %rbx,%rdi
  1e:	e8 07 7d 26 fd       	call   0xfd267d2a
  23:	48 89 1c 24          	mov    %rbx,(%rsp)
  27:	48 8b 03             	mov    (%rbx),%rax
* 2a:	65 8b 28             	mov    %gs:(%rax),%ebp <-- trapping instruction
  2d:	41 89 ef             	mov    %ebp,%r15d
  30:	41 c1 ff 1f          	sar    $0x1f,%r15d
  34:	49 c1 e7 20          	shl    $0x20,%r15
  38:	4c 89 6c 24 08       	mov    %r13,0x8(%rsp)
  3d:	4d 01 ef             	add    %r13,%r15

Current Strategy: ```c
#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <sys/socket.h>

void write_file(const char *path, const char *val) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        write(fd, val, strlen(val));
        close(fd);
    }
}

void bring_lo_up() {
    int fd = socket(AF_INET, SOCK_DGRAM, 0);
    if (fd >= 0) {
        struct ifreq ifr;
        strcpy(ifr.ifr_name, "lo");
        if (ioctl(fd, SIOCGIFFLAGS, &ifr) == 0) {
            ifr.ifr_flags |= IFF_UP | IFF_RUNNING;
            ioctl(fd, SIOCSIFFLAGS, &ifr);
        }
        close(fd);
    }
}

int main() {
    // Ensure debugfs is mounted to access fault injection interfaces
    mount("debugfs", "/sys/kernel/debug", "debugfs", 0, NULL);

    // Setup fault injection for slab allocations
    write_file("/sys/kernel/debug/failslab/probability", "5");
    write_file("/sys/kernel/debug/failslab/times", "-1");
    write_file("/sys/kernel/debug/failslab/task-filter", "Y");
    write_file("/sys/kernel/debug/failslab/ignore-gfp-wait", "N");

    // Setup fault injection for page allocations (in case percpu uses alloc_pages)
    write_file("/sys/kernel/debug/fail_page_alloc/probability", "5");
    write_file("/sys/kernel/debug/fail_page_alloc/times", "-1");
    write_file("/sys/kernel/debug/fail_page_alloc/task-filter", "Y");
    write_file("/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", "N");

    mkdir("/tmp/nfsd", 0777);

    // Loop to hit the exact allocation race where percpu_counter_init fails
    for (int i = 0; i < 5000; i++) {
        pid_t pid = fork();
        if (pid == 0) {
            // Isolate network and mount namespaces for a fresh nfsd state
            if (unshare(CLONE_NEWNET | CLONE_NEWNS) == 0) {
                bring_lo_up();
                if (mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL) == 0) {
                    int fd = open("/tmp/nfsd/portlist", O_WRONLY);
                    if (fd >= 0) {
                        // Enable fault injection ONLY for the write syscall
                        // to avoid failing unshare, mount, or open.
                        write_file("/proc/self/make-it-fail", "1");
                        
                        // Trigger __write_ports_addxprt -> nfsd_create_serv -> __svc_create
                        write(fd, "tcp 2049", 8);
                        
                        write_file("/proc/self/make-it-fail", "0");
                        close(fd);
                    }
                }
            }
            exit(0);
        }
        waitpid(pid, NULL, 0);
    }
    
    return 0;
}
```
Feedback: The reproduction attempt failed to trigger the bug because it relies on `failslab` to inject a failure into `percpu_counter_init()`. However, `percpu_counter_init()` allocates memory using the percpu allocator (`__alloc_percpu_gfp`), which does not always call into the slab allocator. It only performs a slab allocation when a new percpu chunk needs to be created. Since the percpu allocator likely had enough free space in existing chunks during the test, `failslab` never intercepted the allocation, and `percpu_counter_init()` always succeeded.

The root cause of the bug is in `__svc_create()` (in `net/sunrpc/svc.c`). It calls `percpu_counter_init()` for `sp_messages_arrived`, `sp_sockets_queued`, and `sp_threads_woken` but completely ignores their return values:
```c
		percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL);
		percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL);
		percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL);
```
If `percpu_counter_init()` fails (e.g., due to memory pressure or fault injection), it returns `-ENOMEM` and leaves the `counters` pointer inside the `percpu_counter` struct as `NULL`.

Later, when `svc_xprt_enqueue()` calls `percpu_counter_inc(&pool->sp_sockets_queued)`, it calls `percpu_counter_add_batch()`, which unconditionally dereferences the `counters` pointer via `this_cpu_read(*fbc->counters)`. Since the pointer is `NULL`, this results in a page fault at `NULL + per_cpu_offset`, which matches the crash signature `BUG: unable to handle kernel paging request in percpu_counter_add_batch`.

To fix this, `__svc_create()` must check the return values of `percpu_counter_init()` and properly unwind/handle the error if any of them fail. For example, it can call `svc_destroy(&serv)` and return `NULL`. `svc_destroy()` is safe to call on a partially initialized `serv` because `sv_pools` is zero-allocated and `percpu_counter_destroy()` safely returns if the `counters` pointer is `NULL`.

An analysis of the feedback reveals that `percpu_counter_init()` uses the percpu allocator (`__alloc_percpu_gfp`), which only performs slab or page allocations when a **new percpu chunk** needs to be created. If there is enough free space in the existing chunks, the allocation succeeds without calling into the slab/page allocators, meaning `failslab` and `fail_page_alloc` will never intercept it.

To reliably trigger the bug, we must exhaust the free space in the existing percpu chunks so that `percpu_counter_init()` is forced to create a new chunk. We can achieve this by running a background thread that continuously allocates percpu memory using BPF maps (`BPF_MAP_TYPE_PERCPU_ARRAY`). 

Crucially, the background thread will **not** have fault injection enabled, allowing it to successfully create new chunks and fill them up. Meanwhile, the main thread will repeatedly trigger the vulnerable `write_ports_addxprt` syscall with fault injection enabled. When the main thread happens to call `percpu_counter_init()` exactly when a new chunk is needed, the fault injection will intercept the chunk creation and fail it, returning `-ENOMEM`. `__svc_create()` will ignore this error, and the subsequent `svc_xprt_enqueue()` will crash when dereferencing the uninitialized counter.

Here is the refined C reproducer:

```c
#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <sys/socket.h>
#include <linux/bpf.h>
#include <sys/syscall.h>
#include <pthread.h>
#include <sys/resource.h>

void write_file(const char *path, const char *val) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        write(fd, val, strlen(val));
        close(fd);
    }
}

void bring_lo_up() {
    int fd = socket(AF_INET, SOCK_DGRAM, 0);
    if (fd >= 0) {
        struct ifreq ifr;
        strcpy(ifr.ifr_name, "lo");
        if (ioctl(fd, SIOCGIFFLAGS, &ifr) == 0) {
            ifr.ifr_flags |= IFF_UP | IFF_RUNNING;
            ioctl(fd, SIOCSIFFLAGS, &ifr);
        }
        close(fd);
    }
}

void *filler_thread(void *arg) {
    union bpf_attr attr;
    memset(&attr, 0, sizeof(attr));
    attr.map_type = BPF_MAP_TYPE_PERCPU_ARRAY;
    attr.key_size = 4;
    attr.value_size = 32768; // 32KB percpu allocation per map
    attr.max_entries = 1;

    // Allocate percpu memory to exhaust existing chunks.
    // This thread does NOT have fault injection enabled, so it will successfully
    // create new chunks and fill them up, forcing the main thread to eventually
    // need a new chunk when it calls percpu_counter_init().
    for (int i = 0; i < 5000; i++) {
        syscall(__NR_bpf, BPF_MAP_CREATE, &attr, sizeof(attr));
        usleep(2000); // 2ms delay to interleave with the main thread
    }
    return NULL;
}

int main() {
    // Increase limits to allow creating many BPF maps
    struct rlimit rl;
    rl.rlim_cur = 65535;
    rl.rlim_max = 65535;
    setrlimit(RLIMIT_NOFILE, &rl);
    
    rl.rlim_cur = RLIM_INFINITY;
    rl.rlim_max = RLIM_INFINITY;
    setrlimit(RLIMIT_MEMLOCK, &rl);

    // Ensure debugfs is mounted to access fault injection interfaces
    mount("debugfs", "/sys/kernel/debug", "debugfs", 0, NULL);

    // Setup fault injection for slab allocations
    write_file("/sys/kernel/debug/failslab/probability", "5");
    write_file("/sys/kernel/debug/failslab/times", "-1");
    write_file("/sys/kernel/debug/failslab/task-filter", "Y");
    write_file("/sys/kernel/debug/failslab/ignore-gfp-wait", "N");

    // Setup fault injection for page allocations (in case percpu uses alloc_pages)
    write_file("/sys/kernel/debug/fail_page_alloc/probability", "5");
    write_file("/sys/kernel/debug/fail_page_alloc/times", "-1");
    write_file("/sys/kernel/debug/fail_page_alloc/task-filter", "Y");
    write_file("/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", "N");

    mkdir("/tmp/nfsd", 0777);

    pthread_t tid;
    pthread_create(&tid, NULL, filler_thread, NULL);

    // Loop to hit the exact allocation race where percpu_counter_init fails
    for (int i = 0; i < 5000; i++) {
        pid_t pid = fork();
        if (pid == 0) {
            // Isolate network and mount namespaces for a fresh nfsd state
            if (unshare(CLONE_NEWNET | CLONE_NEWNS) == 0) {
                bring_lo_up();
                if (mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL) == 0) {
                    int fd = open("/tmp/nfsd/portlist", O_WRONLY);
                    if (fd >= 0) {
                        // Enable fault injection ONLY for the write syscall
                        // to avoid failing unshare, mount, or open.
                        write_file("/proc/self/make-it-fail", "1");
                        
                        // Trigger __write_ports_addxprt -> nfsd_create_serv -> __svc_create
                        write(fd, "tcp 2049", 8);
                        
                        write_file("/proc/self/make-it-fail", "0");
                        close(fd);
                    }
                }
            }
            exit(0);
        }
        waitpid(pid, NULL, 0);
    }
    
    return 0;
}
```

gemini-3.1-pro-preview

							input: 6978
							output: 30
							thoughts: 319
						

**Refining My Reproduction Strategy: A Deep Dive into Per-CPU Allocation Failures**

My immediate priority is to refine our reproduction strategy for the per-CPU allocation failures, directly addressing the feedback we've received. The core issue, as I understand it, is that our previous attempts using `failslab` were unsuccessful because `percpu_counter_init`, the function in question, doesn't reliably utilize the slab allocator. Instead, it employs `__alloc_percpu_gfp`, which, critically, doesn't *always* funnel through the slab path. This is a key distinction and the crux of why `failslab` wasn't triggering the desired behavior.

My thought process then shifts to understanding *how* per-CPU allocations fail in the first place. The feedback implies that `percpu_counter_init` itself is where the allocation occurs, and I need to find a way to induce a failure at that specific point. My initial thought was to revisit `fail_page_alloc`. We had tried this before, but perhaps it wasn't aggressive enough, or the per-CPU allocator simply didn't require fresh pages that would have been intercepted by `fail_page_alloc` during our previous testing.

I then considered more general memory exhaustion scenarios. Could simply depleting the system's memory lead to a failure within `percpu_counter_init`? This is a possibility, but it feels less precise than I'd like for targeted reproduction.

My mind then gravitated towards more sophisticated fault injection techniques. I began contemplating the use of BPF (Berkeley Packet Filter) to directly inject an error. The target locations for this injection would be within `percpu_counter_init` itself, or perhaps at the lower-level allocation functions it calls, such as `__alloc_percpu_gfp` or even the more fundamental `pcpu_alloc`. This seems like a promising avenue for granular control.

However, I then had a crucial realization, stemming from my knowledge of syzkaller and its fault injection capabilities. I recalled that syzkaller *does* have a mechanism to trigger these kinds of failures. It intercepts specific hooks: `should_failslab` and `should_fail_alloc_page`. The question then became: if `percpu_counter_init` doesn't consistently use the slab allocator, and our previous `fail_page_alloc` wasn't sufficient, how did syzkaller manage to trigger failures in this scenario?

This led me to a more precise understanding of syzkaller's approach. It's not just about injecting errors into generic allocation functions; it's about leveraging its `FAULT_INJECTION` framework. This framework specifically hooks into the `should_failslab` and `should_fail_alloc_page` checks. My current understanding is that `percpu_counter_init` ultimately relies on `__alloc_percpu_gfp`. Therefore, to accurately reproduce this, I need to go back and examine the precise code flow of `percpu_counter_init` to pinpoint where and how its memory allocation is managed, and how syzkaller's fault injection, which relies on those specific hooks, might be interacting with this process. This deeper dive is essential to refine our strategy effectively.

log-in to see details

map[ContextFile: Name:percpu_counter_init]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 7332
							output: 36
							thoughts: 17
						

**My Thought Process Regarding `percpu_counter_init`**

Ah, the initial flicker of curiosity, followed by a moment of slight confusion, regarding the nature of `percpu_counter_init`. My mind immediately jumps to its functional role: it's how we set up these per-CPU counters, a crucial mechanism for efficient per-processor accounting in the kernel. But then, a more granular question surfaces: is this a standard, straightforward function call, or something more… *syntactic*? Is it a macro, designed to expand at compile time with some inline code, or an inline function, hinting at a similar compile-time optimization but with a more structured, function-like definition? This distinction, while seemingly subtle to an outsider, carries significant weight for someone deeply embedded in kernel development. It speaks to the underlying implementation strategy, the potential for performance gains through avoiding function call overhead, and even how one might debug or trace its execution. So, yes, that's where my thoughts began – a precise inquiry into the "how" behind initializing these fundamental per-CPU counters.

map[Expression:percpu_counter_init PathPrefix:include/linux/percpu_counter.h]

map[Output:include/linux/percpu_counter.h=31=extern int percpu_counter_batch;
include/linux/percpu_counter.h-32-
include/linux/percpu_counter.h:33:int __percpu_counter_init_many(struct percpu_counter *fbc, s64 amount,
include/linux/percpu_counter.h-34-			       gfp_t gfp, u32 nr_counters,
--
include/linux/percpu_counter.h-36-
include/linux/percpu_counter.h:37:#define percpu_counter_init_many(fbc, value, gfp, nr_counters)		\
include/linux/percpu_counter.h-38-	({								\
--
include/linux/percpu_counter.h-40-									\
include/linux/percpu_counter.h:41:		__percpu_counter_init_many(fbc, value, gfp, nr_counters,\
include/linux/percpu_counter.h-42-					   &__key);			\
--
include/linux/percpu_counter.h-45-
include/linux/percpu_counter.h:46:#define percpu_counter_init(fbc, value, gfp)				\
include/linux/percpu_counter.h:47:	percpu_counter_init_many(fbc, value, gfp, 1)
include/linux/percpu_counter.h-48-
--
include/linux/percpu_counter.h=118=static inline s64 percpu_counter_read_positive(struct percpu_counter *fbc)
--
include/linux/percpu_counter.h-127-
include/linux/percpu_counter.h:128:static inline bool percpu_counter_initialized(struct percpu_counter *fbc)
include/linux/percpu_counter.h-129-{
--
include/linux/percpu_counter.h=135=struct percpu_counter {
--
include/linux/percpu_counter.h-138-
include/linux/percpu_counter.h:139:static inline int percpu_counter_init_many(struct percpu_counter *fbc,
include/linux/percpu_counter.h-140-					   s64 amount, gfp_t gfp,
--
include/linux/percpu_counter.h-150-
include/linux/percpu_counter.h:151:static inline int percpu_counter_init(struct percpu_counter *fbc, s64 amount,
include/linux/percpu_counter.h-152-				      gfp_t gfp)
include/linux/percpu_counter.h-153-{
include/linux/percpu_counter.h:154:	return percpu_counter_init_many(fbc, amount, gfp, 1);
include/linux/percpu_counter.h-155-}
--
include/linux/percpu_counter.h=250=static inline s64 percpu_counter_sum(struct percpu_counter *fbc)
--
include/linux/percpu_counter.h-254-
include/linux/percpu_counter.h:255:static inline bool percpu_counter_initialized(struct percpu_counter *fbc)
include/linux/percpu_counter.h-256-{
]

gemini-3.1-pro-preview

							input: 8227
							output: 33
							thoughts: 18
						

**My Thought Process Regarding `__percpu_counter_init_many`**

Alright, so I've been digging into this code, and it's become clear to me that the function I'm really focused on, the one that's central to my current line of inquiry regarding per-CPU counters, is actually `__percpu_counter_init_many`. This isn't just a minor detail; it's the precise entry point that handles the initialization of multiple per-CPU counters, which is a crucial step in setting up this particular mechanism. Understanding this function's internals and its role in the broader system is key to grasping how these counters are managed and accessed efficiently across different CPUs.

map[ContextFile: Name:__percpu_counter_init_many]

map[SourceCode: 188:	int __percpu_counter_init_many(struct percpu_counter *fbc, s64 amount,
 189:				       gfp_t gfp, u32 nr_counters,
 190:				       struct lock_class_key *key)
 191:	{
 192:		unsigned long flags __maybe_unused;
 193:		size_t counter_size;
 194:		s32 __percpu *counters;
 195:		u32 i;
 196:	
 197:		counter_size = ALIGN(sizeof(*counters), __alignof__(*counters));
 198:		counters = __alloc_percpu_gfp(nr_counters * counter_size,
 199:					      __alignof__(*counters), gfp);
 200:		if (!counters) {
 201:			fbc[0].counters = NULL;
 202:			return -ENOMEM;
 203:		}
 204:	
 205:		for (i = 0; i < nr_counters; i++) {
 206:			raw_spin_lock_init(&fbc[i].lock);
 207:			lockdep_set_class(&fbc[i].lock, key);
 208:	#ifdef CONFIG_HOTPLUG_CPU
 209:			INIT_LIST_HEAD(&fbc[i].list);
 210:	#endif
 211:			fbc[i].count = amount;
 212:			fbc[i].counters = (void __percpu *)counters + i * counter_size;
 213:	
 214:			debug_percpu_counter_activate(&fbc[i]);
 215:		}
 216:	
 217:	#ifdef CONFIG_HOTPLUG_CPU
 218:		spin_lock_irqsave(&percpu_counters_lock, flags);
 219:		for (i = 0; i < nr_counters; i++)
 220:			list_add(&fbc[i].list, &percpu_counters);
 221:		spin_unlock_irqrestore(&percpu_counters_lock, flags);
 222:	#endif
 223:		return 0;
 224:	}
 SourceFile:lib/percpu_counter.c]

gemini-3.1-pro-preview

							input: 8895
							output: 28
							thoughts: 106
						

**My Thought Process Regarding Per-CPU Allocation Failures**

My immediate focus is on understanding how `__alloc_percpu_gfp` can fail. I know that if it fails, it signals this by returning `-ENOMEM`. The crucial question then becomes: under what conditions can this allocation function be made to fail?

As I delve deeper, I recall the capabilities of syzkaller's fault injection mechanisms. My thought process leads me to consider how these tools might be leveraged. Specifically, I remember that syzkaller can inject faults into functions like `should_failslab` and `should_fail_alloc_page`. These are prime candidates for inducing allocation failures.

However, a critical realization dawns on me: `__alloc_percpu_gfp` doesn't directly call the slab or page allocation routines that syzkaller's fault injection targets. Instead, I remember that `__alloc_percpu_gfp` itself calls into `pcpu_alloc`. This means my initial thought about directly injecting faults into `should_failslab` or `should_fail_alloc_page` to cause `__alloc_percpu_gfp` to fail might be indirect. The actual failure point for `__alloc_percpu_gfp` is likely *within* or *as a consequence of* the operations performed by `pcpu_alloc`. Therefore, to achieve the desired `-ENOMEM` return from `__alloc_percpu_gfp`, I need to focus on how `pcpu_alloc` might fail, or how faults injected into underlying memory allocation primitives could propagate their failure through `pcpu_alloc` and ultimately to `__alloc_percpu_gfp`.

map[ContextFile: Name:pcpu_alloc]

map[SourceCode: 249:	static struct debug_obj *pcpu_alloc(void)
 250:	{
 251:		struct obj_pool *pcp = this_cpu_ptr(&pool_pcpu);
 252:	
 253:		lockdep_assert_irqs_disabled();
 254:	
 255:		for (;;) {
 256:			struct debug_obj *obj = __alloc_object(&pcp->objects);
 257:	
 258:			if (likely(obj)) {
 259:				pcp->cnt--;
 260:				/*
 261:				 * If this emptied a batch try to refill from the
 262:				 * free pool. Don't do that if this was the top-most
 263:				 * batch as pcpu_free() expects the per CPU pool
 264:				 * to be less than ODEBUG_POOL_PERCPU_SIZE.
 265:				 */
 266:				if (unlikely(pcp->cnt < (ODEBUG_POOL_PERCPU_SIZE - ODEBUG_BATCH_SIZE) &&
 267:					     !(pcp->cnt % ODEBUG_BATCH_SIZE))) {
 268:					/*
 269:					 * Don't try to allocate from the regular pool here
 270:					 * to not exhaust it prematurely.
 271:					 */
 272:					if (pool_count(&pool_to_free)) {
 273:						guard(raw_spinlock)(&pool_lock);
 274:						pool_move_batch(pcp, &pool_to_free);
 275:						pcpu_refill_stats();
 276:					}
 277:				}
 278:				return obj;
 279:			}
 280:	
 281:			guard(raw_spinlock)(&pool_lock);
 282:			if (!pool_move_batch(pcp, &pool_to_free)) {
 283:				if (!pool_move_batch(pcp, &pool_global))
 284:					return NULL;
 285:			}
 286:			pcpu_refill_stats();
 287:		}
 288:	}
 SourceFile:lib/debugobjects.c]

gemini-3.1-pro-preview

							input: 9628
							output: 32
							thoughts: 22
						

**My Thought Process Regarding `__alloc_percpu_gfp`**

Ah, so I'm realizing that when I'm thinking about allocating per-CPU memory, specifically using the `__alloc_percpu_gfp` function, I need to mentally flag its location within the kernel's source tree. My immediate recall, or perhaps a quick mental lookup, tells me that this particular function resides in the `mm/percpu.c` file. This is a crucial detail for me as an expert, as understanding the precise location of core memory management functions helps me reason about dependencies, potential optimizations, and the overall architecture of the kernel's per-CPU allocation mechanisms. Knowing it's in `mm/percpu.c` immediately contextualizes it within the broader memory management subsystem, rather than, say, a scheduler-specific or device-driver-specific allocation routine. This precision in pinpointing the source file is fundamental to my ability to analyze and understand the kernel's behavior at a deep level.

log-in to see details

map[ContextFile: Name:__alloc_percpu_gfp]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 9687
							output: 34
							thoughts: 15
						

**My Thought Process on Analyzing `__alloc_percpu_gfp`**

Alright, so my initial impulse, when faced with a need to dig into memory allocation, specifically for per-CPU data, is to head straight for the source code and use `grep`. My immediate target is the function `__alloc_percpu_gfp`. This is the core of what I'm interested in – how the kernel handles allocating memory that's specifically meant to be unique for each CPU core.

I'm assuming, given my expertise, that this function is likely a foundational piece. It's not just some arbitrary helper; it's probably the entry point or a critical path for establishing per-CPU data structures. Therefore, understanding its implementation is key to grasping the mechanisms behind per-CPU memory management in this particular kernel context.

My goal in grepping for this specific function is multifaceted:

1.  **Locate its Definition:** I need to find exactly *where* in the kernel source tree this function is defined. This tells me the relevant file(s) and module(s) I need to focus on.
2.  **Understand its Signature and Parameters:** Once I find it, I'll examine its function signature. The `_gfp` suffix strongly suggests it takes GFP (Get Free Page) flags as an argument, which is crucial for determining the allocation context and constraints. Understanding these flags will tell me about the *how* of the allocation – whether it can sleep, whether it needs to be atomic, etc.
3.  **Trace its Callers:** Beyond just finding the definition, I'll want to see *who* is calling `__alloc_percpu_gfp`. This reveals the higher-level abstractions or specific subsystems that rely on per-CPU allocation. It helps me understand the *why* and *when* this function is invoked in real-world kernel operations. Are there specific drivers, core kernel subsystems, or experimental features that are using it?
4.  **Follow its Internals:** The most critical part will be diving into the function's body. I need to see the actual logic it employs. Does it interact with the slab allocator? Does it directly call page allocator functions? Does it involve special per-CPU memory regions or zones? This is where I'll find the nitty-gritty details of how per-CPU memory is carved out and managed.
5.  **Identify Potential Bottlenecks or Optimizations:** By understanding the implementation, I can begin to reason about performance. Are there any locking mechanisms that could be contention points? Are there any obvious inefficiencies? Can the allocation strategy be improved?

Essentially, grepping for `__alloc_percpu_gfp` is my starting point to deconstruct the per-CPU memory allocation process. It's the initial step in a deeper dive to understand the kernel's strategy for providing data that's efficient and contextually relevant for each individual CPU. I'm expecting to find a well-defined interface that abstracts away the complexities of memory management, allowing other parts of the kernel to easily leverage per-CPU data.

log-in to see details

map[Expression:__alloc_percpu_gfp PathPrefix:mm/percpu.c]

map[Output:]

gemini-3.1-pro-preview

							input: 9734
							output: 36
							thoughts: 26
						

**My Thought Process on Examining `__alloc_percpu_gfp`**

Alright, so my initial impulse is to dive right into the source code and see exactly what this `__alloc_percpu_gfp` function is doing. My primary target for this investigation is `include/linux/percpu.h`, as that's where I expect to find its definition or at least its declaration. My goal here is to understand the underlying mechanics of how per-CPU memory is being allocated, particularly in the context of GFP flags, which implies a certain level of control over memory allocation behavior, perhaps for performance or specific resource management needs. I'm looking for the granular details of the allocation process – what data structures are involved, what memory regions are being considered, and how the GFP flags are being interpreted and utilized within this specific per-CPU allocation context. This feels like a crucial piece of the puzzle for understanding the intricacies of the kernel's memory management for per-CPU data.

map[Expression:__alloc_percpu_gfp PathPrefix:include/linux/percpu.h]

map[Output:include/linux/percpu.h=137=extern void __percpu *pcpu_alloc_noprof(size_t size, size_t align, bool reserved,
--
include/linux/percpu.h-139-
include/linux/percpu.h:140:#define __alloc_percpu_gfp(_size, _align, _gfp)				\
include/linux/percpu.h-141-	alloc_hooks(pcpu_alloc_noprof(_size, _align, false, _gfp))
--
include/linux/percpu.h-147-#define alloc_percpu_gfp(type, gfp)					\
include/linux/percpu.h:148:	(typeof(type) __percpu *)__alloc_percpu_gfp(sizeof(type),	\
include/linux/percpu.h-149-						__alignof__(type), gfp)
]

gemini-3.1-pro-preview

							input: 10019
							output: 32
							thoughts: 13
						

**My Thought Process on `pcpu_alloc_noprof`**

Ah, so the execution flow has just led me to this point: the invocation of `pcpu_alloc_noprof`. This tells me that the system is in a state where it needs to allocate resources related to per-CPU data structures, and importantly, it's doing so without engaging any profiling instrumentation. This is a critical detail. When I see `_noprof` appended to a function name, my immediate assumption is that performance is paramount in this particular code path. Profiling, while invaluable for understanding overall system behavior and identifying bottlenecks, incurs overhead. Therefore, by excluding it here, the developers are signaling that this allocation is likely part of a core, performance-sensitive operation where even a minor performance hit is unacceptable, or perhaps it's in a context where profiling is either impossible or already handled elsewhere.

My next step is to consider *why* this allocation is happening. Per-CPU data is designed to reduce contention by giving each CPU its own private copy of a data structure. This avoids the need for locking when multiple CPUs want to access that data. So, `pcpu_alloc_noprof` is very likely setting up the underlying memory or data structures for one of these per-CPU variables. The "alloc" part is straightforward – it's about obtaining memory. The "pcpu" part confirms its per-CPU nature.

Given that I'm an expert in this domain, I'd also be thinking about the implications of this allocation. What kind of data is being stored per-CPU? Is it for counters, state information, temporary buffers, or something else entirely? The context in which `pcpu_alloc_noprof` is called would be my next area of investigation. Is this during system initialization, interrupt handling, or a specific kernel subsystem's operation? Each of these scenarios would color my understanding of the allocation's purpose and potential impact.

Furthermore, the absence of profiling suggests that this allocation might be a recurring one or part of a high-frequency operation. If it were a one-time setup, the overhead of profiling might be less of a concern. Its exclusion here leads me to suspect it's being called repeatedly or in a very tight loop. This also makes me curious about the memory management strategies employed. Is it allocating a fixed-size chunk for each CPU, or is it dynamically resizing based on some criteria? The `_noprof` suffix further emphasizes that the underlying memory allocator itself, if called indirectly, is likely also optimized for speed and minimizing overhead, perhaps even sacrificing some error-checking or debugging features that might be present in a profiled version.

In essence, encountering `pcpu_alloc_noprof` triggers a cascade of thoughts for me: performance sensitivity, the nature of per-CPU data, the context of its use, and the potential for high-frequency invocation. It's a clear indicator that I'm looking at a foundational piece of the system's efficiency.

map[ContextFile: Name:pcpu_alloc_noprof]

map[SourceCode:1721:	/**
1722:	 * pcpu_alloc - the percpu allocator
1723:	 * @size: size of area to allocate in bytes
1724:	 * @align: alignment of area (max PAGE_SIZE)
1725:	 * @reserved: allocate from the reserved chunk if available
1726:	 * @gfp: allocation flags
1727:	 *
1728:	 * Allocate percpu area of @size bytes aligned at @align.  If @gfp doesn't
1729:	 * contain %GFP_KERNEL, the allocation is atomic. If @gfp has __GFP_NOWARN
1730:	 * then no warning will be triggered on invalid or failed allocation
1731:	 * requests.
1732:	 *
1733:	 * RETURNS:
1734:	 * Percpu pointer to the allocated area on success, NULL on failure.
1735:	 */
1736:	void __percpu *pcpu_alloc_noprof(size_t size, size_t align, bool reserved,
1737:					 gfp_t gfp)
1738:	{
1739:		gfp_t pcpu_gfp;
1740:		bool is_atomic;
1741:		bool do_warn;
1742:		struct obj_cgroup *objcg = NULL;
1743:		static atomic_t warn_limit = ATOMIC_INIT(10);
1744:		struct pcpu_chunk *chunk, *next;
1745:		const char *err;
1746:		int slot, off, cpu, ret;
1747:		unsigned long flags;
1748:		void __percpu *ptr;
1749:		size_t bits, bit_align;
1750:	
1751:		gfp = current_gfp_context(gfp);
1752:		/* whitelisted flags that can be passed to the backing allocators */
1753:		pcpu_gfp = gfp & (GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN);
1754:		is_atomic = !gfpflags_allow_blocking(gfp);
1755:		do_warn = !(gfp & __GFP_NOWARN);
1756:	
1757:		/*
1758:		 * There is now a minimum allocation size of PCPU_MIN_ALLOC_SIZE,
1759:		 * therefore alignment must be a minimum of that many bytes.
1760:		 * An allocation may have internal fragmentation from rounding up
1761:		 * of up to PCPU_MIN_ALLOC_SIZE - 1 bytes.
1762:		 */
1763:		if (unlikely(align < PCPU_MIN_ALLOC_SIZE))
1764:			align = PCPU_MIN_ALLOC_SIZE;
1765:	
1766:		size = ALIGN(size, PCPU_MIN_ALLOC_SIZE);
1767:		bits = size >> PCPU_MIN_ALLOC_SHIFT;
1768:		bit_align = align >> PCPU_MIN_ALLOC_SHIFT;
1769:	
1770:		if (unlikely(!size || size > PCPU_MIN_UNIT_SIZE || align > PAGE_SIZE ||
1771:			     !is_power_of_2(align))) {
1772:			WARN(do_warn, "illegal size (%zu) or align (%zu) for percpu allocation\n",
1773:			     size, align);
1774:			return NULL;
1775:		}
1776:	
1777:		if (unlikely(!pcpu_memcg_pre_alloc_hook(size, gfp, &objcg)))
1778:			return NULL;
1779:	
1780:		if (!is_atomic) {
1781:			/*
1782:			 * pcpu_balance_workfn() allocates memory under this mutex,
1783:			 * and it may wait for memory reclaim. Allow current task
1784:			 * to become OOM victim, in case of memory pressure.
1785:			 */
1786:			if (gfp & __GFP_NOFAIL) {
1787:				mutex_lock(&pcpu_alloc_mutex);
1788:			} else if (mutex_lock_killable(&pcpu_alloc_mutex)) {
1789:				pcpu_memcg_post_alloc_hook(objcg, NULL, 0, size);
1790:				return NULL;
1791:			}
1792:		}
1793:	
1794:		spin_lock_irqsave(&pcpu_lock, flags);
1795:	
1796:		/* serve reserved allocations from the reserved chunk if available */
1797:		if (reserved && pcpu_reserved_chunk) {
1798:			chunk = pcpu_reserved_chunk;
1799:	
1800:			off = pcpu_find_block_fit(chunk, bits, bit_align, is_atomic);
1801:			if (off < 0) {
1802:				err = "alloc from reserved chunk failed";
1803:				goto fail_unlock;
1804:			}
1805:	
1806:			off = pcpu_alloc_area(chunk, bits, bit_align, off);
1807:			if (off >= 0)
1808:				goto area_found;
1809:	
1810:			err = "alloc from reserved chunk failed";
1811:			goto fail_unlock;
1812:		}
1813:	
1814:	restart:
1815:		/* search through normal chunks */
1816:		for (slot = pcpu_size_to_slot(size); slot <= pcpu_free_slot; slot++) {
1817:			list_for_each_entry_safe(chunk, next, &pcpu_chunk_lists[slot],
1818:						 list) {
1819:				off = pcpu_find_block_fit(chunk, bits, bit_align,
1820:							  is_atomic);
1821:				if (off < 0) {
1822:					if (slot < PCPU_SLOT_FAIL_THRESHOLD)
1823:						pcpu_chunk_move(chunk, 0);
1824:					continue;
1825:				}
1826:	
1827:				off = pcpu_alloc_area(chunk, bits, bit_align, off);
1828:				if (off >= 0) {
1829:					pcpu_reintegrate_chunk(chunk);
1830:					goto area_found;
1831:				}
1832:			}
1833:		}
1834:	
1835:		spin_unlock_irqrestore(&pcpu_lock, flags);
1836:	
1837:		if (is_atomic) {
1838:			err = "atomic alloc failed, no space left";
1839:			goto fail;
1840:		}
1841:	
1842:		/* No space left.  Create a new chunk. */
1843:		if (list_empty(&pcpu_chunk_lists[pcpu_free_slot])) {
1844:			chunk = pcpu_create_chunk(pcpu_gfp);
1845:			if (!chunk) {
1846:				err = "failed to allocate new chunk";
1847:				goto fail;
1848:			}
1849:	
1850:			spin_lock_irqsave(&pcpu_lock, flags);
1851:			pcpu_chunk_relocate(chunk, -1);
1852:		} else {
1853:			spin_lock_irqsave(&pcpu_lock, flags);
1854:		}
1855:	
1856:		goto restart;
1857:	
1858:	area_found:
1859:		pcpu_stats_area_alloc(chunk, size);
1860:	
1861:		if (pcpu_nr_empty_pop_pages < PCPU_EMPTY_POP_PAGES_LOW)
1862:			pcpu_schedule_balance_work();
1863:	
1864:		spin_unlock_irqrestore(&pcpu_lock, flags);
1865:	
1866:		/* populate if not all pages are already there */
1867:		if (!is_atomic) {
1868:			unsigned int page_end, rs, re;
1869:	
1870:			rs = PFN_DOWN(off);
1871:			page_end = PFN_UP(off + size);
1872:	
1873:			for_each_clear_bitrange_from(rs, re, chunk->populated, page_end) {
1874:				WARN_ON(chunk->immutable);
1875:	
1876:				ret = pcpu_populate_chunk(chunk, rs, re, pcpu_gfp);
1877:	
1878:				spin_lock_irqsave(&pcpu_lock, flags);
1879:				if (ret) {
1880:					pcpu_free_area(chunk, off);
1881:					err = "failed to populate";
1882:					goto fail_unlock;
1883:				}
1884:				pcpu_chunk_populated(chunk, rs, re);
1885:				spin_unlock_irqrestore(&pcpu_lock, flags);
1886:			}
1887:	
1888:			mutex_unlock(&pcpu_alloc_mutex);
1889:		}
1890:	
1891:		/* clear the areas and return address relative to base address */
1892:		for_each_possible_cpu(cpu)
1893:			memset((void *)pcpu_chunk_addr(chunk, cpu, 0) + off, 0, size);
1894:	
1895:		ptr = __addr_to_pcpu_ptr(chunk->base_addr + off);
1896:		kmemleak_alloc_percpu(ptr, size, gfp);
1897:	
1898:		trace_percpu_alloc_percpu(_RET_IP_, reserved, is_atomic, size, align,
1899:					  chunk->base_addr, off, ptr,
1900:					  pcpu_obj_full_size(size), gfp);
1901:	
1902:		pcpu_memcg_post_alloc_hook(objcg, chunk, off, size);
1903:	
1904:		pcpu_alloc_tag_alloc_hook(chunk, off, size);
1905:	
1906:		return ptr;
1907:	
1908:	fail_unlock:
1909:		spin_unlock_irqrestore(&pcpu_lock, flags);
1910:	fail:
1911:		trace_percpu_alloc_percpu_fail(reserved, is_atomic, size, align);
1912:	
1913:		if (do_warn) {
1914:			int remaining = atomic_dec_if_positive(&warn_limit);
1915:	
1916:			if (remaining >= 0) {
1917:				pr_warn("allocation failed, size=%zu align=%zu atomic=%d, %s\n",
1918:					size, align, is_atomic, err);
1919:				if (!is_atomic)
1920:					dump_stack();
1921:				if (remaining == 0)
1922:					pr_info("limit reached, disable warning\n");
1923:			}
1924:		}
1925:	
1926:		if (is_atomic) {
1927:			/* see the flag handling in pcpu_balance_workfn() */
1928:			pcpu_atomic_alloc_failed = true;
1929:			pcpu_schedule_balance_work();
1930:		} else {
1931:			mutex_unlock(&pcpu_alloc_mutex);
1932:		}
1933:	
1934:		pcpu_memcg_post_alloc_hook(objcg, NULL, 0, size);
1935:	
1936:		return NULL;
1937:	}
 SourceFile:mm/percpu.c]

gemini-3.1-pro-preview

							input: 13389
							output: 35
							thoughts: 648
						

**My Thought Process on Exhausting Per-CPU Memory Allocation**

My primary goal here is to figure out how to make `pcpu_alloc_noprof` fail. I know it first tries to find free chunks, and only if there aren't any does it call `pcpu_create_chunk`. This immediately raises a question: how can I force this allocation to fail?

I initially considered `fail_page_alloc`. The thought was that if `pcpu_create_chunk` is called, and `fail_page_alloc` is active, then `pcpu_create_chunk` might fail. However, I recall feedback indicating that this isn't always effective because the per-CPU allocator often has enough pre-allocated free space, preventing `pcpu_create_chunk` from being invoked in the first place. So, `failslab` (which `fail_page_alloc` relies on indirectly for some scenarios) wouldn't even get a chance to intervene.

Then I noticed `pcpu_alloc_noprof` calls `pcpu_memcg_pre_alloc_hook(size, gfp, &objcg)`. If *that* fails, `pcpu_alloc_noprof` returns NULL, which is exactly what I'm looking for – a failure point. This sparked two avenues of thought:

1.  **Memory Cgroups:** Could I use memory cgroups to restrict memory usage and force `pcpu_memcg_pre_alloc_hook` to fail? This seems like a plausible approach.
2.  **Exhaustion:** Alternatively, can I just overwhelm the per-CPU allocator by allocating a massive amount of per-CPU memory?

The second option, exhaustion, led me to ponder how one could achieve this from user space. My mind immediately went to things that tend to consume significant amounts of per-CPU resources:

*   Creating a large number of network namespaces.
*   Instantiating numerous `nfsd` instances.
*   Creating many BPF maps.

The BPF maps, specifically `BPF_MAP_TYPE_PERCPU_ARRAY` or `BPF_MAP_TYPE_PERCPU_HASH`, stood out as particularly promising. These map types are designed to allocate per-CPU memory. My strategy would be to create a map with a large value size and a substantial number of entries to see how much per-CPU memory I could consume. I started thinking about the limits: `pcpu_alloc_noprof` has a size limit (`size > PCPU_MIN_UNIT_SIZE`), but I could circumvent that by creating *many* such maps.

However, I paused again. Could BPF maps themselves be limited by things like memcg or `rlimit`? This might make the exhaustion approach less direct or require careful tuning of those limits as well.

This brings me back to fault injection. Is there a simpler, more direct way to inject a fault into `pcpu_alloc_noprof` itself? I re-examined the code flow:

*   `pcpu_alloc_noprof` doesn't directly use `should_failslab`.
*   It *does* call `pcpu_create_chunk`, which in turn uses `pcpu_alloc_pages` and then `alloc_pages`. So, `should_fail_alloc_page` could potentially come into play *if* `pcpu_create_chunk` is called.

This reinforces the earlier realization: if there's already free space in existing chunks, `pcpu_create_chunk` is skipped, and `fail_page_alloc` won't help directly at that stage. Therefore, my most robust strategy seems to be:

1.  **First, exhaust the *existing* free space** within the per-CPU allocator.
2.  **Then, use `fail_page_alloc`** to prevent any new chunks from being created when `pcpu_create_chunk` is finally forced to be called.

Alternatively, the pure exhaustion approach – allocating so much per-CPU memory that the allocator eventually fails on its own – still seems viable, with BPF maps being a strong candidate for that. I need to keep the `pcpu_memcg_pre_alloc_hook` in mind as another potential failure point that might be easier to trigger than full exhaustion, possibly through memory cgroups.

map[ContextFile: Name:pcpu_memcg_pre_alloc_hook]

map[SourceCode:1616:	static bool pcpu_memcg_pre_alloc_hook(size_t size, gfp_t gfp,
1617:					      struct obj_cgroup **objcgp)
1618:	{
1619:		struct obj_cgroup *objcg;
1620:	
1621:		if (!memcg_kmem_online() || !(gfp & __GFP_ACCOUNT))
1622:			return true;
1623:	
1624:		objcg = current_obj_cgroup();
1625:		if (!objcg || obj_cgroup_is_root(objcg))
1626:			return true;
1627:	
1628:		if (obj_cgroup_charge(objcg, gfp, pcpu_obj_full_size(size)))
1629:			return false;
1630:	
1631:		*objcgp = objcg;
1632:		return true;
1633:	}
 SourceFile:mm/percpu.c]

gemini-3.1-pro-preview

							input: 14346
							output: 28
							thoughts: 55
						

**My Thought Process**

Alright, so I'm tracing a flow here. My immediate thought is about resource accounting, specifically how memory usage is tracked. I know that if the `gfp & __GFP_ACCOUNT` flag is set during an allocation, it signifies that this allocation should be charged to a memory control group (memcg). This is a critical piece of information for understanding resource limits and accounting in the kernel.

Now, I need to figure out if a particular function, `percpu_counter_init`, which is called within `__svc_create`, is indeed using this `__GFP_ACCOUNT` flag. My hypothesis is that it *might* be, and to confirm or deny this, I need to dive into the implementation of `__svc_create`. That's my next step: examining the source code for `__svc_create` to see the context in which `percpu_counter_init` is invoked and what GFP flags are being passed along. This will tell me whether or not that specific initialization is subject to memcg accounting.

map[ContextFile: Name:__svc_create]

map[SourceCode: 479:	/*
 480:	 * Create an RPC service
 481:	 */
 482:	static struct svc_serv *
 483:	__svc_create(struct svc_program *prog, int nprogs, struct svc_stat *stats,
 484:		     unsigned int bufsize, int npools, int (*threadfn)(void *data))
 485:	{
 486:		struct svc_serv	*serv;
 487:		unsigned int vers;
 488:		unsigned int xdrsize;
 489:		unsigned int i;
 490:	
 491:		if (!(serv = kzalloc_obj(*serv)))
 492:			return NULL;
 493:		serv->sv_name      = prog->pg_name;
 494:		serv->sv_programs  = prog;
 495:		serv->sv_nprogs    = nprogs;
 496:		serv->sv_stats     = stats;
 497:		if (bufsize > RPCSVC_MAXPAYLOAD)
 498:			bufsize = RPCSVC_MAXPAYLOAD;
 499:		serv->sv_max_payload = bufsize? bufsize : 4096;
 500:		serv->sv_max_mesg  = roundup(serv->sv_max_payload + PAGE_SIZE, PAGE_SIZE);
 501:		serv->sv_threadfn = threadfn;
 502:		xdrsize = 0;
 503:		for (i = 0; i < nprogs; i++) {
 504:			struct svc_program *progp = &prog[i];
 505:	
 506:			progp->pg_lovers = progp->pg_nvers-1;
 507:			for (vers = 0; vers < progp->pg_nvers ; vers++)
 508:				if (progp->pg_vers[vers]) {
 509:					progp->pg_hivers = vers;
 510:					if (progp->pg_lovers > vers)
 511:						progp->pg_lovers = vers;
 512:					if (progp->pg_vers[vers]->vs_xdrsize > xdrsize)
 513:						xdrsize = progp->pg_vers[vers]->vs_xdrsize;
 514:				}
 515:		}
 516:		serv->sv_xdrsize   = xdrsize;
 517:		INIT_LIST_HEAD(&serv->sv_tempsocks);
 518:		INIT_LIST_HEAD(&serv->sv_permsocks);
 519:		timer_setup(&serv->sv_temptimer, NULL, 0);
 520:		spin_lock_init(&serv->sv_lock);
 521:	
 522:		__svc_init_bc(serv);
 523:	
 524:		serv->sv_nrpools = npools;
 525:		serv->sv_pools =
 526:			kzalloc_objs(struct svc_pool, serv->sv_nrpools);
 527:		if (!serv->sv_pools) {
 528:			kfree(serv);
 529:			return NULL;
 530:		}
 531:	
 532:		for (i = 0; i < serv->sv_nrpools; i++) {
 533:			struct svc_pool *pool = &serv->sv_pools[i];
 534:	
 535:			dprintk("svc: initialising pool %u for %s\n",
 536:					i, serv->sv_name);
 537:	
 538:			pool->sp_id = i;
 539:			lwq_init(&pool->sp_xprts);
 540:			INIT_LIST_HEAD(&pool->sp_all_threads);
 541:			init_llist_head(&pool->sp_idle_threads);
 542:	
 543:			percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL);
 544:			percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL);
 545:			percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL);
 546:		}
 547:	
 548:		return serv;
 549:	}
 SourceFile:net/sunrpc/svc.c]

gemini-3.1-pro-preview

							input: 15622
							output: 29
							thoughts: 99
						

**My Thought Process Regarding `percpu_counter_init` and Memory Control Groups**

Ah, I see the problem. My initial assessment of `percpu_counter_init` was that it utilizes `GFP_KERNEL` for its memory allocations. The crucial point here, and where I might have initially overlooked something, is that it **explicitly does not use `__GFP_ACCOUNT`**. This has a direct implication for my attempts to leverage memory control groups (memcg).

Because `__GFP_ACCOUNT` is absent, the `pcpu_memcg_pre_alloc_hook` will simply return `true`. This means the hook won't effectively intercept or prevent the allocation at the memcg level. In simpler terms, I can't use memcg to *fail* this specific allocation as I might have hoped or intended.

This leads me to a critical question: if memcg isn't the mechanism causing failures here, how did syzkaller manage to trigger the issue in the first place? Syzkaller is known for its sophisticated fuzzing techniques, and it often relies on more direct methods of introducing failures.

My next step, therefore, is to investigate syzkaller's methodology. I recall that syzkaller frequently employs **fault injection**. This makes me wonder if `pcpu_alloc_noprof` – the underlying allocation function in this context – has any specific fault injection hooks that syzkaller might be targeting. I need to delve into the code and examine if such hooks exist and how they are being leveraged by syzkaller to induce the observed behavior. That's where the real key to understanding this bug likely lies.

log-in to see details

map[Expression:should_fail PathPrefix:mm/percpu.c]

map[Output:]

gemini-3.1-pro-preview

							input: 15748
							output: 30
							thoughts: 45
						

**My Thought Process Regarding `should_failslab` and Per-CPU Allocation**

I've been examining the per-CPU allocation mechanisms, specifically within `mm/percpu.c`. My immediate thought was about the `should_failslab` flag. It struck me as odd because I couldn't find any direct usage of this flag within `mm/percpu.c` itself. This immediately raised a red flag in my mind, prompting me to investigate further.

My next step was to trace the call chain related to per-CPU allocations. I recalled, or rather, I followed the logic, that `pcpu_alloc_noprof` is a key function in this process. I then realized that `pcpu_alloc_noprof`, in turn, invokes `pcpu_create_chunk`. It's within the context of this `pcpu_create_chunk` function, or perhaps in the broader allocation and management logic that `pcpu_create_chunk` is part of, that the `should_failslab` flag's purpose and integration might be revealed. This is where I'm focusing my current analysis – understanding how `should_failslab` influences or is intended to influence the chunk creation and allocation lifecycle within the per-CPU subsystem.

map[ContextFile: Name:pcpu_create_chunk]

map[SourceCode: 333:	static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp)
 334:	{
 335:		struct pcpu_chunk *chunk;
 336:		struct vm_struct **vms;
 337:	
 338:		chunk = pcpu_alloc_chunk(gfp);
 339:		if (!chunk)
 340:			return NULL;
 341:	
 342:		vms = pcpu_get_vm_areas(pcpu_group_offsets, pcpu_group_sizes,
 343:					pcpu_nr_groups, pcpu_atom_size);
 344:		if (!vms) {
 345:			pcpu_free_chunk(chunk);
 346:			return NULL;
 347:		}
 348:	
 349:		chunk->data = vms;
 350:		chunk->base_addr = vms[0]->addr - pcpu_group_offsets[0];
 351:	
 352:		pcpu_stats_chunk_alloc();
 353:		trace_percpu_create_chunk(chunk->base_addr);
 354:	
 355:		return chunk;
 356:	}
 SourceFile:mm/percpu-vm.c]

gemini-3.1-pro-preview

							input: 16175
							output: 30
							thoughts: 16
						

**My Thought Process on `pcpu_alloc_chunk`**

When I see `pcpu_alloc_chunk`, my immediate thought is about memory allocation. Specifically, I'm wondering about the underlying mechanism it's using. Is it employing `kzalloc` or something functionally equivalent? My intuition leans towards `kzalloc` because it's the standard, zeroing allocator in the kernel, which is generally desirable for performance data structures to avoid uninitialized memory issues. However, I also consider that there might be performance-sensitive reasons for using a different allocation strategy. For instance, if the chunk is always immediately filled with valid data, a non-zeroing allocator might offer a slight speed advantage. So, I'm essentially questioning the trade-offs being made: safety and simplicity versus potential micro-optimizations.

map[ContextFile: Name:pcpu_alloc_chunk]

map[SourceCode:1431:	static struct pcpu_chunk *pcpu_alloc_chunk(gfp_t gfp)
1432:	{
1433:		struct pcpu_chunk *chunk;
1434:		int region_bits;
1435:	
1436:		chunk = pcpu_mem_zalloc(pcpu_chunk_struct_size, gfp);
1437:		if (!chunk)
1438:			return NULL;
1439:	
1440:		INIT_LIST_HEAD(&chunk->list);
1441:		chunk->nr_pages = pcpu_unit_pages;
1442:		region_bits = pcpu_chunk_map_bits(chunk);
1443:	
1444:		chunk->alloc_map = pcpu_mem_zalloc(BITS_TO_LONGS(region_bits) *
1445:						   sizeof(chunk->alloc_map[0]), gfp);
1446:		if (!chunk->alloc_map)
1447:			goto alloc_map_fail;
1448:	
1449:		chunk->bound_map = pcpu_mem_zalloc(BITS_TO_LONGS(region_bits + 1) *
1450:						   sizeof(chunk->bound_map[0]), gfp);
1451:		if (!chunk->bound_map)
1452:			goto bound_map_fail;
1453:	
1454:		chunk->md_blocks = pcpu_mem_zalloc(pcpu_chunk_nr_blocks(chunk) *
1455:						   sizeof(chunk->md_blocks[0]), gfp);
1456:		if (!chunk->md_blocks)
1457:			goto md_blocks_fail;
1458:	
1459:	#ifdef NEED_PCPUOBJ_EXT
1460:		if (need_pcpuobj_ext()) {
1461:			chunk->obj_exts =
1462:				pcpu_mem_zalloc(pcpu_chunk_map_bits(chunk) *
1463:						sizeof(struct pcpuobj_ext), gfp);
1464:			if (!chunk->obj_exts)
1465:				goto objcg_fail;
1466:		}
1467:	#endif
1468:	
1469:		pcpu_init_md_blocks(chunk);
1470:	
1471:		/* init metadata */
1472:		chunk->free_bytes = chunk->nr_pages * PAGE_SIZE;
1473:	
1474:		return chunk;
1475:	
1476:	#ifdef NEED_PCPUOBJ_EXT
1477:	objcg_fail:
1478:		pcpu_mem_free(chunk->md_blocks);
1479:	#endif
1480:	md_blocks_fail:
1481:		pcpu_mem_free(chunk->bound_map);
1482:	bound_map_fail:
1483:		pcpu_mem_free(chunk->alloc_map);
1484:	alloc_map_fail:
1485:		pcpu_mem_free(chunk);
1486:	
1487:		return NULL;
1488:	}
 SourceFile:mm/percpu.c]

gemini-3.1-pro-preview

							input: 17103
							output: 31
							thoughts: 19
						

**My Thought Process Regarding `pcpu_mem_zalloc`**

Alright, so when I encounter `pcpu_mem_zalloc` in the code, my immediate understanding is that it's a function designed for allocating memory for per-CPU data. And the core of its implementation, the actual memory acquisition, is delegated to one of two fundamental kernel memory allocation functions: either `kzalloc` or `vmalloc`.

This tells me a few things right off the bat. Firstly, `pcpu_mem_zalloc` itself isn't performing a complex memory allocation strategy from scratch. It's a higher-level abstraction, likely providing the per-CPU management layer on top of these well-established allocators.

The choice between `kzalloc` and `vmalloc` is significant. `kzalloc` typically utilizes the slab allocator, which is optimized for frequently allocated and freed small-to-medium sized objects. It tends to be faster and more memory-efficient for such use cases due to its pre-initialized caches. On the other hand, `vmalloc` is used for allocating larger, contiguous blocks of memory that may not be physically contiguous. It maps virtual addresses to available physical pages, offering flexibility when physical memory fragmentation is an issue or for very large allocations.

Therefore, my inference is that `pcpu_mem_zalloc` is intelligently deciding which of these two allocators to use based on the size of the requested per-CPU allocation or perhaps other internal heuristics. It's abstracting away this decision from the caller, simplifying the interface for managing per-CPU data structures. My expectation would be that for typical, small per-CPU data, `kzalloc` is the more probable path, while for larger per-CPU structures, `vmalloc` might be employed. This is a common pattern in kernel development: using specialized functions to manage specific data paradigms (like per-CPU) while relying on robust, underlying primitives for the actual resource management.

map[ContextFile: Name:pcpu_mem_zalloc]

map[SourceCode: 491:	/**
 492:	 * pcpu_mem_zalloc - allocate memory
 493:	 * @size: bytes to allocate
 494:	 * @gfp: allocation flags
 495:	 *
 496:	 * Allocate @size bytes.  If @size is smaller than PAGE_SIZE,
 497:	 * kzalloc() is used; otherwise, the equivalent of vzalloc() is used.
 498:	 * This is to facilitate passing through whitelisted flags.  The
 499:	 * returned memory is always zeroed.
 500:	 *
 501:	 * RETURNS:
 502:	 * Pointer to the allocated area on success, NULL on failure.
 503:	 */
 504:	static void *pcpu_mem_zalloc(size_t size, gfp_t gfp)
 505:	{
 506:		if (WARN_ON_ONCE(!slab_is_available()))
 507:			return NULL;
 508:	
 509:		if (size <= PAGE_SIZE)
 510:			return kzalloc(size, gfp);
 511:		else
 512:			return __vmalloc(size, gfp | __GFP_ZERO);
 513:	}
 SourceFile:mm/percpu.c]

gemini-3.1-pro-preview

							input: 17500
							output: 33
							thoughts: 399
						

**My Thought Process Regarding Per-CPU Memory Allocation Failures**

My investigation into the `pcpu_mem_zalloc` function has revealed an interesting nuance concerning fault injection. Initially, I understood that `pcpu_mem_zalloc` would either utilize `kzalloc` or `__vmalloc`. Consequently, I reasoned that `failslab` could intercept allocations made via `kzalloc`, and `fail_page_alloc` could intercept those from `__vmalloc`.

However, upon deeper examination, particularly referencing feedback about `pcpu_alloc_noprof`, I realized this initial assumption is incomplete. The crucial insight here is that `pcpu_alloc_noprof` *only* invokes `pcpu_create_chunk` when there's an absence of free space within existing per-CPU chunks. If there *is* available space, `pcpu_alloc_noprof` simply allocates from a current chunk and returns.

This means that the `failslab` or `fail_page_alloc` mechanisms, as I initially conceived them, would *not* be triggered in this scenario because no new slab or page allocation is actually performed.

Therefore, to reliably induce a failure within `percpu_counter_init`, I've identified two primary avenues:

1.  **Exhausting Existing Per-CPU Chunks:** My first strategy is to force the system into a state where it *must* call `pcpu_create_chunk`. This can be achieved by consuming all available free space within existing per-CPU chunks. Once `pcpu_create_chunk` is called, I can then leverage `failslab` or `fail_page_alloc` to inject failures at that point.

2.  **Exploring Alternative Failure Vectors:** The second approach is to seek entirely different mechanisms to cause `percpu_counter_init` to fail.

Reflecting on syzkaller's observed behavior, it employs `FAULT_INJECTION` and operates without specific knowledge of per-CPU chunk management. This raises the possibility that syzkaller's failures were either due to concurrent processes that *did* exhaust per-CPU memory, or simply a random hit on `pcpu_create_chunk` during its natural invocation.

To ensure reproducibility, my plan is to combine these insights. I intend to proactively exhaust existing per-CPU memory by allocating a substantial amount. Following this, with fault injection enabled, I will then trigger the bug.

A key question then arises: how can I, from userspace, allocate a significant volume of per-CPU memory? My current hypothesis is that BPF maps, specifically those of type `BPF_MAP_TYPE_PERCPU_ARRAY`, are the ideal candidates for this purpose, as they are known to allocate per-CPU memory. I will need to investigate the `bpf_map_alloc_percpu` function to confirm this approach.

map[ContextFile: Name:bpf_map_alloc_percpu]

map[SourceCode: 577:	void __percpu *bpf_map_alloc_percpu(const struct bpf_map *map, size_t size,
 578:					    size_t align, gfp_t flags)
 579:	{
 580:		struct mem_cgroup *memcg, *old_memcg;
 581:		void __percpu *ptr;
 582:	
 583:		bpf_map_memcg_enter(map, &old_memcg, &memcg);
 584:		ptr = __alloc_percpu_gfp(size, align, flags | __GFP_ACCOUNT);
 585:		bpf_map_memcg_exit(old_memcg, memcg);
 586:	
 587:		return ptr;
 588:	}
 SourceFile:kernel/bpf/syscall.c]

gemini-3.1-pro-preview

							input: 18157
							output: 29
							thoughts: 88
						

**My Thought Process Regarding BPF Per-CPU Array Allocation**

My initial thought is that the `bpf_map_alloc_percpu` function, as its name suggests, likely orchestrates the allocation of per-CPU memory. I'm hypothesizing that it acts as a wrapper or a direct caller to `__alloc_percpu_gfp` for this purpose. This makes sense because BPF maps are fundamental building blocks, and efficient per-CPU data structures are crucial for high-performance BPF programs.

Building on this, I'm considering the practical implications. I envision being able to instantiate a `BPF_MAP_TYPE_PERCPU_ARRAY` map. My expectation is that I can configure this map with a substantial `value_size` and a large number of `max_entries`. The per-CPU nature implies that each of these entries would have its own dedicated memory space, replicated across all available CPUs.

However, a crucial question immediately arises in my mind: does `BPF_MAP_TYPE_PERCPU_ARRAY` actually allocate per-CPU memory *for each individual entry*? This is a critical distinction. My initial assumption was that the map structure itself would be per-CPU, but the question is whether each *element within* that map is also per-CPU. To resolve this, I need to dive deeper into the kernel's implementation. My next step is to examine the `array_map_alloc` function, as this is the likely place where the detailed allocation logic for array-type maps resides, and it will confirm or deny my hypothesis about per-entry per-CPU allocation.

map[ContextFile: Name:array_map_alloc]

map[SourceCode:  84:	static struct bpf_map *array_map_alloc(union bpf_attr *attr)
  85:	{
  86:		bool percpu = attr->map_type == BPF_MAP_TYPE_PERCPU_ARRAY;
  87:		int numa_node = bpf_map_attr_numa_node(attr);
  88:		u32 elem_size, index_mask, max_entries;
  89:		bool bypass_spec_v1 = bpf_bypass_spec_v1(NULL);
  90:		u64 array_size, mask64;
  91:		struct bpf_array *array;
  92:	
  93:		elem_size = round_up(attr->value_size, 8);
  94:	
  95:		max_entries = attr->max_entries;
  96:	
  97:		/* On 32 bit archs roundup_pow_of_two() with max_entries that has
  98:		 * upper most bit set in u32 space is undefined behavior due to
  99:		 * resulting 1U << 32, so do it manually here in u64 space.
 100:		 */
 101:		mask64 = fls_long(max_entries - 1);
 102:		mask64 = 1ULL << mask64;
 103:		mask64 -= 1;
 104:	
 105:		index_mask = mask64;
 106:		if (!bypass_spec_v1) {
 107:			/* round up array size to nearest power of 2,
 108:			 * since cpu will speculate within index_mask limits
 109:			 */
 110:			max_entries = index_mask + 1;
 111:			/* Check for overflows. */
 112:			if (max_entries < attr->max_entries)
 113:				return ERR_PTR(-E2BIG);
 114:		}
 115:	
 116:		array_size = sizeof(*array);
 117:		if (percpu) {
 118:			array_size += (u64) max_entries * sizeof(void *);
 119:		} else {
 120:			/* rely on vmalloc() to return page-aligned memory and
 121:			 * ensure array->value is exactly page-aligned
 122:			 */
 123:			if (attr->map_flags & BPF_F_MMAPABLE) {
 124:				array_size = PAGE_ALIGN(array_size);
 125:				array_size += PAGE_ALIGN((u64) max_entries * elem_size);
 126:			} else {
 127:				array_size += (u64) max_entries * elem_size;
 128:			}
 129:		}
 130:	
 131:		/* allocate all map elements and zero-initialize them */
 132:		if (attr->map_flags & BPF_F_MMAPABLE) {
 133:			void *data;
 134:	
 135:			/* kmalloc'ed memory can't be mmap'ed, use explicit vmalloc */
 136:			data = bpf_map_area_mmapable_alloc(array_size, numa_node);
 137:			if (!data)
 138:				return ERR_PTR(-ENOMEM);
 139:			array = data + PAGE_ALIGN(sizeof(struct bpf_array))
 140:				- offsetof(struct bpf_array, value);
 141:		} else {
 142:			array = bpf_map_area_alloc(array_size, numa_node);
 143:		}
 144:		if (!array)
 145:			return ERR_PTR(-ENOMEM);
 146:		array->index_mask = index_mask;
 147:		array->map.bypass_spec_v1 = bypass_spec_v1;
 148:	
 149:		/* copy mandatory map attributes */
 150:		bpf_map_init_from_attr(&array->map, attr);
 151:		array->elem_size = elem_size;
 152:	
 153:		if (percpu && bpf_array_alloc_percpu(array)) {
 154:			bpf_map_area_free(array);
 155:			return ERR_PTR(-ENOMEM);
 156:		}
 157:	
 158:		return &array->map;
 159:	}
 SourceFile:kernel/bpf/arraymap.c]

gemini-3.1-pro-preview

							input: 19510
							output: 33
							thoughts: 16
						

**My Thought Process Regarding `bpf_array_alloc_percpu`**

Ah, I see the function `bpf_array_alloc_percpu` here. My immediate understanding is that this is about memory allocation, specifically for per-CPU data structures within the BPF (Berkeley Packet Filter) context. Given my expertise, I recognize that managing memory efficiently, and especially per-CPU memory, is a critical aspect of high-performance BPF programs. Per-CPU allocation is a well-established technique to avoid synchronization overhead when multiple CPUs might concurrently access the same data. Instead of locking mechanisms, each CPU gets its own private copy, drastically reducing contention and improving scalability. Therefore, when I encounter a function with this naming convention, my mind immediately goes to how it facilitates this efficient, contention-free access pattern for BPF data. I'm thinking about the underlying mechanisms that might be involved – how it maps to the kernel's per-CPU allocator, the potential size constraints, and how a BPF program would typically interact with such allocated memory.

map[ContextFile: Name:bpf_array_alloc_percpu]

map[SourceCode:  33:	static int bpf_array_alloc_percpu(struct bpf_array *array)
  34:	{
  35:		void __percpu *ptr;
  36:		int i;
  37:	
  38:		for (i = 0; i < array->map.max_entries; i++) {
  39:			ptr = bpf_map_alloc_percpu(&array->map, array->elem_size, 8,
  40:						   GFP_USER | __GFP_NOWARN);
  41:			if (!ptr) {
  42:				bpf_array_free_percpu(array);
  43:				return -ENOMEM;
  44:			}
  45:			array->pptrs[i] = ptr;
  46:			cond_resched();
  47:		}
  48:	
  49:		return 0;
  50:	}
 SourceFile:kernel/bpf/arraymap.c]

gemini-3.1-pro-preview

							input: 19811
							output: 29
							thoughts: 1997
						

**My Thought Process on Exploiting Percpu Memory Exhaustion**

I've been exploring a potential vulnerability related to percpu memory allocation, and my thought process has evolved through several stages as I've uncovered the nuances.

Initially, my focus was on how `BPF_MAP_TYPE_PERCPU_ARRAY` maps are implemented. I realized that each entry in such a map allocates `array->elem_size` (which is the `value_size`) percpu memory. My immediate thought was, "Okay, if I can create a `BPF_MAP_TYPE_PERCPU_ARRAY` with a large `value_size` and many `max_entries`, I can consume a lot of percpu memory."

However, I quickly hit some constraints. I remembered that `value_size` has limitations. Specifically, `PCUP_MIN_ALLOC_SIZE` is 4 bytes, but more importantly, `PCPU_MIN_UNIT_SIZE` is 32KB. I checked the `pcpu_alloc_noprof` function and confirmed that it checks if the requested size `size > PCPU_MIN_UNIT_SIZE`. This means my `value_size` is effectively capped at 32KB (32768 bytes). "So, I can set `value_size` to 32768 and `max_entries` to a large number," I mused. "If I create many such maps, I'll exhaust percpu memory."

I then considered how this memory is allocated. I noted that `bpf_map_alloc_percpu` uses `GFP_USER | __GFP_NOWARN | __GFP_ACCOUNT`. This led me to think about memory control groups (memcgs). If the allocation hits a memcg limit, it will fail. But I reasoned that if I run it in the root memcg or without memcg limits, this particular failure mode wouldn't be my primary concern.

My main goal became triggering an `-ENOMEM` error. If percpu memory is exhausted, `bpf_array_alloc_percpu` will fail and return `-ENOMEM`. This seemed like the path to triggering the bug.

Then, I encountered a crucial detail: "if percpu memory is completely exhausted, `percpu_counter_init` in `__svc_create` will also fail!" This was exactly what I wanted! I realized that any percpu allocation would fail if the memory was completely gone. So, my strategy refined to: exhaust percpu memory, and *then* trigger `__write_ports_addxprt`.

But there was a twist. If percpu memory is exhausted, `__svc_create` calls `percpu_counter_init`, which *ignores the return value*! This was incredibly convenient. It meant that even if `percpu_counter_init` failed due to memory exhaustion, `__svc_create` would continue, and subsequently `svc_xprt_enqueue` would crash. "This is perfect! We don't even need fault injection for this part!" I thought.

This led me to question the limits. "How much percpu memory can we actually allocate?" I considered that the total percpu memory is limited by `vmalloc` space or physical memory. Percpu memory is allocated using `pcpu_create_chunk`, which in turn uses `vmalloc` or `kzalloc`. If I allocate too much, I might trigger the OOM killer. I recalled that `pcpu_alloc_noprof` keeps creating chunks until `pcpu_create_chunk` fails. Each chunk allocates `pcpu_unit_pages` per CPU. For two CPUs, a chunk could be around 128KB. Allocating 1GB would consume 1GB of RAM, which is feasible on typical Syzkaller VMs with 2GB or 4GB of RAM.

However, the idea of simply exhausting physical memory felt inefficient and risky. "Is there a better way?" I asked myself. Then, the concept of fault injection came to mind. "If we use `fail_page_alloc` to fail `pcpu_create_chunk`, we don't need to exhaust physical memory!" This seemed much more precise.

At this point, I recalled feedback that stated: "Since the percpu allocator likely had enough free space in existing chunks during the test, `failslab` never intercepted the allocation, and `percpu_counter_init()` always succeeded." This was a critical piece of information. It meant I couldn't just enable fault injection immediately. I needed to exhaust the *existing free space* in the percpu allocator *first*, and *then* use fault injection to prevent new chunks from being created.

"How much free space is there usually?" I speculated, "Usually a few megabytes at most." So, my refined plan was to first allocate, say, 10MB of percpu memory using BPF maps. This would exhaust the existing free chunks and force `pcpu_alloc_noprof` to call `pcpu_create_chunk`. Then, if I enabled `fail_page_alloc`, `pcpu_create_chunk` would fail!

I dug deeper into the allocation mechanism. `pcpu_create_chunk` calls `pcpu_alloc_chunk`, which uses `pcpu_mem_zalloc`. `pcpu_mem_zalloc` uses `kzalloc` for smaller sizes and `__vmalloc` for larger ones. `pcpu_chunk_struct_size` is small, so it uses `kzalloc`. `chunk->alloc_map` also uses `kzalloc`. `vms = pcpu_get_vm_areas` uses `kzalloc` and `alloc_vmap_area`. Finally, `pcpu_populate_chunk` uses `alloc_pages`. This confirmed that both `fail_page_alloc` (for `alloc_pages`) and `failslab` (for `kzalloc`) would be effective.

My strategy became clearer:
1. Enable `failslab` and `fail_page_alloc` with a high probability (e.g., 100%), and crucially, restricted to the current task (`task-filter=Y`).
2. Allocate percpu memory using BPF maps until it fails.

However, a new concern arose: "Wait, if I enable fault injection *before* allocating BPF maps, the BPF map allocation itself will fail immediately! I won't have a chance to exhaust the existing free space!" This was a critical realization.

The correct sequence had to be:
1. Do *not* enable fault injection yet.
2. Allocate BPF maps to exhaust the existing percpu free space.

But then, "How do I know when existing free space is exhausted *without* fault injection causing it to fail?" If I don't enable fault injection, the BPF map allocations will simply cause new chunks to be created, consuming more memory. This is where I felt stuck: how to exhaust free space *without* creating a new chunk?

I realized I was overthinking the "without creating a new chunk" part. I *couldn't* prevent new chunks from being created directly from userspace if there was free memory. The kernel handles that transparently. But I *could* use fault injection to *fail* the creation of those new chunks *after* the existing free space was gone.

So, the improved sequence became:
1. Enable fault injection for the current task.
2. Allocate a lot of percpu memory using BPF maps.
3. If fault injection is enabled, the BPF map allocation will try to allocate percpu memory.
4. If there's free space in existing chunks, it will succeed.
5. If there's *no* free space, it will attempt to create a new chunk.
6. This new chunk creation will FAIL due to fault injection!
7. The BPF map creation will then return an error (like `-ENOMEM`).

At this point, I've achieved my goal: "I KNOW that there is no free space in existing chunks, AND new chunks cannot be created!"

Then, I would trigger the vulnerable code path: `write_ports_addxprt`.
1. `__svc_create` will call `percpu_counter_init`.
2. `percpu_counter_init` will try to allocate percpu memory.
3. It will fail for the exact same reason (new chunk creation fails due to fault injection)!
4. `__svc_create` ignores the error and continues.
5. `svc_xprt_enqueue` is called and crashes!

"This is brilliant!" I exclaimed. The fault injection would prevent any *new* allocations, and if the existing free space was already consumed by my BPF maps, the vulnerable code path would hit the same roadblock.

I then ran through the exact steps mentally:
1. Set up fault injection (`failslab` and `fail_page_alloc`) specifically for the current task.
2. Create BPF maps (`BPF_MAP_TYPE_PERCPU_ARRAY`) repeatedly, with a small `value_size` (e.g., 32 bytes) and `max_entries=1`. Each map uses a small chunk of percpu memory.
3. Due to fault injection, when the percpu allocator runs out of free space in existing chunks and tries to create a new chunk, that creation will fail.
4. The BPF map creation will then return an error.
5. As soon as a BPF map creation fails, I know percpu memory is exhausted for this task because it can't create new chunks.
6. Trigger the vulnerable code path: `write_ports_addxprt`.
7. `__svc_create` calls `percpu_counter_init`.
8. `percpu_counter_init` fails to allocate percpu memory for the same reason.
9. `__svc_create` ignores the error and proceeds.
10. `svc_xprt_enqueue` is called and crashes.

Finally, I posed a crucial self-doubt: "Wait, is there any flaw in this logic? What if the BPF map creation fails because of `failslab` on the BPF map struct itself, rather than the percpu allocation? If the BPF map struct allocation fails, we might stop creating maps prematurely, while there is still percpu free space!" This led me to check `array_map_alloc` to ensure the percpu allocation is the point of failure.

map[ContextFile: Name:array_map_alloc]

map[SourceCode:  84:	static struct bpf_map *array_map_alloc(union bpf_attr *attr)
  85:	{
  86:		bool percpu = attr->map_type == BPF_MAP_TYPE_PERCPU_ARRAY;
  87:		int numa_node = bpf_map_attr_numa_node(attr);
  88:		u32 elem_size, index_mask, max_entries;
  89:		bool bypass_spec_v1 = bpf_bypass_spec_v1(NULL);
  90:		u64 array_size, mask64;
  91:		struct bpf_array *array;
  92:	
  93:		elem_size = round_up(attr->value_size, 8);
  94:	
  95:		max_entries = attr->max_entries;
  96:	
  97:		/* On 32 bit archs roundup_pow_of_two() with max_entries that has
  98:		 * upper most bit set in u32 space is undefined behavior due to
  99:		 * resulting 1U << 32, so do it manually here in u64 space.
 100:		 */
 101:		mask64 = fls_long(max_entries - 1);
 102:		mask64 = 1ULL << mask64;
 103:		mask64 -= 1;
 104:	
 105:		index_mask = mask64;
 106:		if (!bypass_spec_v1) {
 107:			/* round up array size to nearest power of 2,
 108:			 * since cpu will speculate within index_mask limits
 109:			 */
 110:			max_entries = index_mask + 1;
 111:			/* Check for overflows. */
 112:			if (max_entries < attr->max_entries)
 113:				return ERR_PTR(-E2BIG);
 114:		}
 115:	
 116:		array_size = sizeof(*array);
 117:		if (percpu) {
 118:			array_size += (u64) max_entries * sizeof(void *);
 119:		} else {
 120:			/* rely on vmalloc() to return page-aligned memory and
 121:			 * ensure array->value is exactly page-aligned
 122:			 */
 123:			if (attr->map_flags & BPF_F_MMAPABLE) {
 124:				array_size = PAGE_ALIGN(array_size);
 125:				array_size += PAGE_ALIGN((u64) max_entries * elem_size);
 126:			} else {
 127:				array_size += (u64) max_entries * elem_size;
 128:			}
 129:		}
 130:	
 131:		/* allocate all map elements and zero-initialize them */
 132:		if (attr->map_flags & BPF_F_MMAPABLE) {
 133:			void *data;
 134:	
 135:			/* kmalloc'ed memory can't be mmap'ed, use explicit vmalloc */
 136:			data = bpf_map_area_mmapable_alloc(array_size, numa_node);
 137:			if (!data)
 138:				return ERR_PTR(-ENOMEM);
 139:			array = data + PAGE_ALIGN(sizeof(struct bpf_array))
 140:				- offsetof(struct bpf_array, value);
 141:		} else {
 142:			array = bpf_map_area_alloc(array_size, numa_node);
 143:		}
 144:		if (!array)
 145:			return ERR_PTR(-ENOMEM);
 146:		array->index_mask = index_mask;
 147:		array->map.bypass_spec_v1 = bypass_spec_v1;
 148:	
 149:		/* copy mandatory map attributes */
 150:		bpf_map_init_from_attr(&array->map, attr);
 151:		array->elem_size = elem_size;
 152:	
 153:		if (percpu && bpf_array_alloc_percpu(array)) {
 154:			bpf_map_area_free(array);
 155:			return ERR_PTR(-ENOMEM);
 156:		}
 157:	
 158:		return &array->map;
 159:	}
 SourceFile:kernel/bpf/arraymap.c]

gemini-3.1-pro-preview

							input: 23073
							output: 28
							thoughts: 5192
						

**The Path to Uncovering a Subtle Memory Exhaustion Bug**

I've been wrestling with a rather intricate kernel bug related to per-CPU memory allocation and fault injection. The core of the problem lies in how BPF maps, specifically `BPF_MAP_TYPE_PERCPU_ARRAY`, interact with the kernel's memory allocation mechanisms when faults are intentionally injected. My initial thoughts were focused on `bpf_map_area_alloc`, which uses either `vmalloc` or `kmalloc`. I figured that if I could inject faults during BPF map creation, I might trigger an error.

My first instinct was to simply disable fault injection for BPF map creation. This seemed like a straightforward way to avoid potential failures. However, I quickly realized that this approach wouldn't lead to the desired outcome. If fault injection wasn't active during BPF map creation, the per-CPU allocator would simply create new chunks as needed. This would prevent me from ever exhausting per-CPU memory unless I hit system-wide limits like exhausting all physical memory or `vmalloc` space, which is far from the specific bug I was trying to find. This led me to question if there was a way to exhaust per-CPU memory *without* relying on fault injection.

I considered deliberately allocating a massive amount of per-CPU memory, but that seemed inefficient and potentially unstable, risking a full system OOM. Then, I thought about a more targeted approach: what if I injected faults *only* into `pcpu_create_chunk`? This sounded promising, but the challenge was filtering fault injection to a specific function. Standard tools like `failslab` or `fail_page_alloc` don't easily allow filtering by function name from userspace, unless I were to use BPF itself to hook into `should_failslab` and filter by stack trace. But the tool I was working with, syzkaller, doesn't use BPF for fault injection; it relies on the simpler `/proc/self/make-it-fail` interface.

This brought me back to syzkaller. If syzkaller triggered this bug, how did it do it? It simply sets `/proc/self/make-it-fail` to 1 and then executes a syscall. The specific syscall involved was a `write` to `/tmp/nfsd/portlist`. During this syscall, `__svc_create` is called, which in turn calls `kzalloc_objs` for `serv->sv_pools` and then `percpu_counter_init`. If `percpu_counter_init` succeeds, it returns 0; otherwise, it returns `-ENOMEM`.

I was puzzled: if syzkaller was just executing the syscall with fault injection enabled, why would `percpu_counter_init` fail? The answer, I deduced, was likely that syzkaller executes *many* syscalls concurrently. It's plausible that the per-CPU allocator, at a specific moment, ran out of free space in its existing chunks, triggering a call to `pcpu_create_chunk`, which then hit the fault injection. This led me to believe that by simply running the syscall in a loop with fault injection enabled, I would eventually hit the scenario where the per-CPU allocator needed a new chunk, and that allocation would fail.

However, my previous attempt with a loop like this failed. The feedback indicated: "Since the percpu allocator likely had enough free space in existing chunks during the test, `failslab` never intercepted the allocation, and `percpu_counter_init()` always succeeded." Why wasn't the free space exhausted? I realized that `percpu_counter_init` allocates a relatively small amount of memory (e.g., 4 bytes per CPU). My loop iterations, each forking a process, executing the syscall, and then exiting, meant that the per-CPU memory was being *freed* when the child process terminated. This freed space would restore the chunk, preventing exhaustion.

This was the crucial insight: to exhaust a per-CPU chunk, I needed to allocate per-CPU memory and *not free it*. How could I achieve this? Creating BPF maps and keeping their file descriptors open was the key. This would prevent the per-CPU memory from being reclaimed. If I could keep BPF maps open, the per-CPU memory wouldn't be freed, and the chunks would eventually fill up.

I then considered a new strategy: if I enabled fault injection *first*, and *then* created BPF maps in a loop, would that work? I worried that if `bpf_create_map` failed due to fault injection, it would likely fail during the allocation of the map structure itself, not the per-CPU memory, meaning I still wouldn't have exhausted the per-CPU chunk.

I needed a way to allocate per-CPU memory that could be controlled and *accumulated*. The `BPF_MAP_TYPE_PERCPU_ARRAY` seemed ideal. I could create maps with a specific `value_size` to precisely control how much per-CPU memory each map consumed. For instance, a map with `value_size = 32768` would allocate 32KB of per-CPU memory. Since per-CPU chunks are typically 64KB or 128KB, just a few such maps could fill up a chunk. The next allocation would then require a new chunk. If I enabled fault injection just before that *next* allocation, it would fail.

The challenge remained: how to know exactly when the chunk was full? I realized I didn't need to know *exactly*. The strategy evolved:
1. I could iteratively create BPF maps.
2. In each iteration, I could create a growing number of BPF maps of a controlled size (e.g., 32KB).
3. At some point, one of these iterations would naturally fill the current per-CPU chunk, causing the next allocation to require a new one.
4. If I enabled fault injection *during* the process of filling the chunk, the allocation of a *new* chunk would be intercepted and fail.

However, this still felt a bit too race-condition-dependent. The true breakthrough came when I considered a dual-threaded approach.

*   **Thread 1 (the Filler):** This thread would continuously allocate small per-CPU memory chunks using BPF maps (e.g., `value_size = 8` bytes). Crucially, it would keep these maps open, preventing the memory from being freed. This would slowly and steadily fill up the existing per-CPU chunks.
*   **Thread 2 (the Trigger):** This thread would repeatedly execute the vulnerable syscall (`write` to `/tmp/nfsd/portlist`) while fault injection was enabled.

The logic here is that Thread 1 is gradually exhausting the available space in the current per-CPU chunks. Eventually, Thread 2 will trigger `percpu_counter_init` at precisely the moment when the current chunk is full and a new chunk is required. Because fault injection is active, the call to `pcpu_create_chunk` within `percpu_counter_init` will be intercepted and fail. This dual-threaded strategy seemed robust because it directly addressed the exhaustion of the *current* chunk and then relied on fault injection to prevent the allocation of a *new* one. I also had to ensure that the fault injection was applied to the correct task by setting `task-filter=Y` for `failslab` and `fail_page_alloc`. This approach felt like the most promising path to reliably reproduce the bug.

map[ContextFile: Name:__svc_create]

map[SourceCode: 479:	/*
 480:	 * Create an RPC service
 481:	 */
 482:	static struct svc_serv *
 483:	__svc_create(struct svc_program *prog, int nprogs, struct svc_stat *stats,
 484:		     unsigned int bufsize, int npools, int (*threadfn)(void *data))
 485:	{
 486:		struct svc_serv	*serv;
 487:		unsigned int vers;
 488:		unsigned int xdrsize;
 489:		unsigned int i;
 490:	
 491:		if (!(serv = kzalloc_obj(*serv)))
 492:			return NULL;
 493:		serv->sv_name      = prog->pg_name;
 494:		serv->sv_programs  = prog;
 495:		serv->sv_nprogs    = nprogs;
 496:		serv->sv_stats     = stats;
 497:		if (bufsize > RPCSVC_MAXPAYLOAD)
 498:			bufsize = RPCSVC_MAXPAYLOAD;
 499:		serv->sv_max_payload = bufsize? bufsize : 4096;
 500:		serv->sv_max_mesg  = roundup(serv->sv_max_payload + PAGE_SIZE, PAGE_SIZE);
 501:		serv->sv_threadfn = threadfn;
 502:		xdrsize = 0;
 503:		for (i = 0; i < nprogs; i++) {
 504:			struct svc_program *progp = &prog[i];
 505:	
 506:			progp->pg_lovers = progp->pg_nvers-1;
 507:			for (vers = 0; vers < progp->pg_nvers ; vers++)
 508:				if (progp->pg_vers[vers]) {
 509:					progp->pg_hivers = vers;
 510:					if (progp->pg_lovers > vers)
 511:						progp->pg_lovers = vers;
 512:					if (progp->pg_vers[vers]->vs_xdrsize > xdrsize)
 513:						xdrsize = progp->pg_vers[vers]->vs_xdrsize;
 514:				}
 515:		}
 516:		serv->sv_xdrsize   = xdrsize;
 517:		INIT_LIST_HEAD(&serv->sv_tempsocks);
 518:		INIT_LIST_HEAD(&serv->sv_permsocks);
 519:		timer_setup(&serv->sv_temptimer, NULL, 0);
 520:		spin_lock_init(&serv->sv_lock);
 521:	
 522:		__svc_init_bc(serv);
 523:	
 524:		serv->sv_nrpools = npools;
 525:		serv->sv_pools =
 526:			kzalloc_objs(struct svc_pool, serv->sv_nrpools);
 527:		if (!serv->sv_pools) {
 528:			kfree(serv);
 529:			return NULL;
 530:		}
 531:	
 532:		for (i = 0; i < serv->sv_nrpools; i++) {
 533:			struct svc_pool *pool = &serv->sv_pools[i];
 534:	
 535:			dprintk("svc: initialising pool %u for %s\n",
 536:					i, serv->sv_name);
 537:	
 538:			pool->sp_id = i;
 539:			lwq_init(&pool->sp_xprts);
 540:			INIT_LIST_HEAD(&pool->sp_all_threads);
 541:			init_llist_head(&pool->sp_idle_threads);
 542:	
 543:			percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL);
 544:			percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL);
 545:			percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL);
 546:		}
 547:	
 548:		return serv;
 549:	}
 SourceFile:net/sunrpc/svc.c]

gemini-3.1-pro-preview

							input: 29486
							output: 33
							thoughts: 3492
						

**Understanding the PerCPU Allocation Race**

I've been digging into this potential kernel bug, and I think I've finally pieced together how to reliably trigger it. It all hinges on a race condition within the per-CPU memory allocation mechanisms, specifically when `percpu_counter_init` needs to allocate new memory chunks.

My initial thought was about how `__svc_create` calls `kzalloc_obj` and `kzalloc_objs`. If fault injection is enabled and these `kzalloc` calls fail *before* `percpu_counter_init` is even invoked, then `__svc_create` will simply return `NULL`, and the bug won't manifest. This is precisely why I realized the need for a low fault injection probability (like 1% or 5%) combined with a high number of iterations. A 5% probability means `kzalloc_obj` and `kzalloc_objs` have a 95% chance of succeeding independently.

Then I started thinking about `percpu_counter_init` itself. It only allocates memory if it actually *needs* a new chunk. If it doesn't need one, it won't call `kzalloc` or `alloc_pages`, and therefore, it won't fail. But if it *does* need a new chunk, it calls `pcpu_create_chunk`, which in turn calls `pcpu_alloc_chunk` (using `kzalloc`), `pcpu_get_vm_areas` (also `kzalloc`), and `pcpu_populate_chunk` (using `alloc_pages`). This means that when `percpu_counter_init` needs a new chunk, it's making *multiple* allocations. If *any* of these allocations fail, the entire `percpu_counter_init` call fails, returning `-ENOMEM`. This is exactly the scenario I'm trying to hit.

So, with a 5% probability and many iterations, I'm aiming for the sequence where the initial `kzalloc` calls for the service structure and its pools succeed, but then `percpu_counter_init` is triggered, requires a new chunk, and one of its subsequent allocations fails.

The crucial insight came when considering how to *force* `percpu_counter_init` to need a new chunk under fault injection conditions. If one thread is constantly allocating BPF maps, it will naturally trigger new chunk creations. However, if this "filler" thread doesn't have `make-it-fail` enabled, it will successfully create and fill its chunks. Then, when my "bug-triggering" thread runs, it will attempt its allocations. If *it* happens to need a new chunk (which is more likely if the filler thread has been busy), and *it* has `make-it-fail` set, then its allocation attempt for that new chunk will fail. This is the perfect interleaving: the filler thread keeps the system busy, consuming memory and filling existing chunks, while my target thread tries to get new chunks under fault injection.

I did have a concern about the filler thread potentially causing an Out-Of-Memory (OOM) condition before my target thread could hit the bug. To mitigate this, I decided to limit the filler thread's activity. Initially, I considered a delay (`usleep`), but realized that might slow down chunk filling. Then I thought about stopping after a certain number of maps. I settled on having the filler thread allocate a fixed number of maps (e.g., 10,000) with an 8KB value size, which should consume a reasonable amount of memory without necessarily OOMing the system. Meanwhile, my target thread will also run its loop of 10,000 iterations. The key is that the filler thread has a small delay (`usleep(1000)`) to allow the target thread to interleave its operations.

I also double-checked that `BPF_MAP_TYPE_PERCPU_ARRAY` creation, which requires `CAP_SYS_ADMIN` and `CAP_BPF`, would succeed given the syzkaller environment. I also made sure to use `memset` to properly initialize the `bpf_attr` structure, ensuring no unexpected bits are set.

Finally, I reviewed the probability calculation. With 5% fault injection, the chance of the initial ~5 allocations succeeding and the 6th failing (when a new chunk is needed) is about 3.8%, which is very good, especially over 10,000 iterations. I also considered that other parts of the syscall chain (like `vfs_write`) might fail, but that's fine as long as we keep retrying. The core idea is to create a scenario where the system is actively allocating per-CPU memory, fault injection is enabled for the target process, and the target process attempts to allocate a *new* per-CPU chunk, which is the point where the bug is exposed.

map[ContextFile: Name:__write_ports_addxprt]

map[SourceCode: 750:	/*
 751:	 * A transport listener is added by writing its transport name and
 752:	 * a port number.
 753:	 */
 754:	static ssize_t __write_ports_addxprt(char *buf, struct net *net, const struct cred *cred)
 755:	{
 756:		char transport[16];
 757:		struct svc_xprt *xprt;
 758:		int port, err;
 759:		struct nfsd_net *nn = net_generic(net, nfsd_net_id);
 760:		struct svc_serv *serv;
 761:	
 762:		if (sscanf(buf, "%15s %5u", transport, &port) != 2)
 763:			return -EINVAL;
 764:	
 765:		if (port < 1 || port > USHRT_MAX)
 766:			return -EINVAL;
 767:		trace_nfsd_ctl_ports_addxprt(net, transport, port);
 768:	
 769:		err = nfsd_create_serv(net);
 770:		if (err != 0)
 771:			return err;
 772:	
 773:		serv = nn->nfsd_serv;
 774:		err = svc_xprt_create(serv, transport, net,
 775:				      PF_INET, port, SVC_SOCK_ANONYMOUS, cred);
 776:		if (err < 0)
 777:			goto out_err;
 778:	
 779:		err = svc_xprt_create(serv, transport, net,
 780:				      PF_INET6, port, SVC_SOCK_ANONYMOUS, cred);
 781:		if (err < 0 && err != -EAFNOSUPPORT)
 782:			goto out_close;
 783:	
 784:		return 0;
 785:	out_close:
 786:		xprt = svc_find_xprt(serv, transport, net, PF_INET, port);
 787:		if (xprt != NULL) {
 788:			svc_xprt_close(xprt);
 789:			svc_xprt_put(xprt);
 790:		}
 791:	out_err:
 792:		if (!serv->sv_nrthreads && list_empty(&nn->nfsd_serv->sv_permsocks))
 793:			nfsd_destroy_serv(net);
 794:	
 795:		return err;
 796:	}
 SourceFile:fs/nfsd/nfsctl.c]

gemini-3.1-pro-preview

							input: 33770
							output: 31
							thoughts: 15
						

**My Thought Process Regarding NFS Daemon Initialization**

Ah, yes, it all begins with `nfsd_create_serv`. That's the initial function call, the very first step in establishing the NFS daemon's server-side presence. I understand that this function is responsible for setting up the core server structure, allocating necessary resources, and preparing the environment for handling subsequent NFS requests. It's the foundational piece of the NFS server's operation, without which nothing else can proceed.

map[ContextFile: Name:nfsd_create_serv]

map[SourceCode: 596:	int nfsd_create_serv(struct net *net)
 597:	{
 598:		int error;
 599:		struct nfsd_net *nn = net_generic(net, nfsd_net_id);
 600:		struct svc_serv *serv;
 601:	
 602:		WARN_ON(!mutex_is_locked(&nfsd_mutex));
 603:		if (nn->nfsd_serv)
 604:			return 0;
 605:	
 606:		error = percpu_ref_init(&nn->nfsd_net_ref, nfsd_net_free,
 607:					0, GFP_KERNEL);
 608:		if (error)
 609:			return error;
 610:		init_completion(&nn->nfsd_net_free_done);
 611:		init_completion(&nn->nfsd_net_confirm_done);
 612:	
 613:		if (nfsd_max_blksize == 0)
 614:			nfsd_max_blksize = nfsd_get_default_max_blksize();
 615:		nfsd_reset_versions(nn);
 616:		serv = svc_create_pooled(nfsd_programs, ARRAY_SIZE(nfsd_programs),
 617:					 &nn->nfsd_svcstats,
 618:					 nfsd_max_blksize, nfsd);
 619:		if (serv == NULL) {
 620:			percpu_ref_exit(&nn->nfsd_net_ref);
 621:			return -ENOMEM;
 622:		}
 623:	
 624:		error = svc_bind(serv, net);
 625:		if (error < 0) {
 626:			svc_destroy(&serv);
 627:			percpu_ref_exit(&nn->nfsd_net_ref);
 628:			return error;
 629:		}
 630:		spin_lock(&nfsd_notifier_lock);
 631:		nn->nfsd_serv = serv;
 632:		spin_unlock(&nfsd_notifier_lock);
 633:	
 634:		/* check if the notifier is already set */
 635:		if (atomic_inc_return(&nfsd_notifier_refcount) == 1) {
 636:			register_inetaddr_notifier(&nfsd_inetaddr_notifier);
 637:	#if IS_ENABLED(CONFIG_IPV6)
 638:			register_inet6addr_notifier(&nfsd_inet6addr_notifier);
 639:	#endif
 640:		}
 641:		nfsd_reset_write_verifier(nn);
 642:		return 0;
 643:	}
 SourceFile:fs/nfsd/nfssvc.c]

gemini-3.1-pro-preview

							input: 34615
							output: 30
							thoughts: 237
						

**My Thought Process Unraveling the NFS Daemon Creation Failure**

My investigation into this NFS daemon creation failure has led me down a specific path of code execution, and I think I've pinpointed the critical divergence. Initially, I was tracing the flow from `svc_create_pooled`, which I know calls `__svc_create`. My expectation was that if `__svc_create` failed, specifically if it returned `NULL` (likely due to a memory allocation issue), then `nfsd_create_serv` would correctly propagate that failure by returning `-ENOMEM`.

However, my deeper dive revealed a crucial detail: `__svc_create` itself, in a rather unusual turn, *ignores* the return value of `percpu_counter_init`. This means that even if `percpu_counter_init` encounters an issue, `__svc_create` proceeds to return the `serv` structure regardless. Consequently, `nfsd_create_serv` would incorrectly report success. This success then leads to a subsequent call to `svc_xprt_create`, which, as we've observed, subsequently crashes. This sequence of events strongly supports my current analysis of the problem.

But then, a new thought occurred, a potential nuance I'd overlooked. I remembered that `nfsd_create_serv` *also* calls `percpu_ref_init(&nn->nfsd_net_ref, ...)`. And my understanding is that `percpu_ref_init`, much like `percpu_counter_init`, is also responsible for allocating per-CPU memory. This is the key insight: if `percpu_ref_init` *itself* fails, it would return `-ENOMEM`. In such a scenario, `nfsd_create_serv` would return `-ENOMEM`, and the problematic `__svc_create` would *never even be called*.

This means that a failure in per-CPU memory allocation, specifically within `percpu_ref_init`, could potentially occur *before* the flawed `percpu_counter_init` within `__svc_create` even gets a chance to execute. This is a critical distinction for understanding the exact point of failure. I need to re-examine the behavior and return values of `percpu_ref_init` to confirm this hypothesis.

map[ContextFile: Name:percpu_ref_init]

map[SourceCode:  48:	/**
  49:	 * percpu_ref_init - initialize a percpu refcount
  50:	 * @ref: percpu_ref to initialize
  51:	 * @release: function which will be called when refcount hits 0
  52:	 * @flags: PERCPU_REF_INIT_* flags
  53:	 * @gfp: allocation mask to use
  54:	 *
  55:	 * Initializes @ref.  @ref starts out in percpu mode with a refcount of 1 unless
  56:	 * @flags contains PERCPU_REF_INIT_ATOMIC or PERCPU_REF_INIT_DEAD.  These flags
  57:	 * change the start state to atomic with the latter setting the initial refcount
  58:	 * to 0.  See the definitions of PERCPU_REF_INIT_* flags for flag behaviors.
  59:	 *
  60:	 * Note that @release must not sleep - it may potentially be called from RCU
  61:	 * callback context by percpu_ref_kill().
  62:	 */
  63:	int percpu_ref_init(struct percpu_ref *ref, percpu_ref_func_t *release,
  64:			    unsigned int flags, gfp_t gfp)
  65:	{
  66:		size_t align = max_t(size_t, 1 << __PERCPU_REF_FLAG_BITS,
  67:				     __alignof__(unsigned long));
  68:		unsigned long start_count = 0;
  69:		struct percpu_ref_data *data;
  70:	
  71:		ref->percpu_count_ptr = (unsigned long)
  72:			__alloc_percpu_gfp(sizeof(unsigned long), align, gfp);
  73:		if (!ref->percpu_count_ptr)
  74:			return -ENOMEM;
  75:	
  76:		data = kzalloc_obj(*ref->data, gfp);
  77:		if (!data) {
  78:			free_percpu((void __percpu *)ref->percpu_count_ptr);
  79:			ref->percpu_count_ptr = 0;
  80:			return -ENOMEM;
  81:		}
  82:	
  83:		data->force_atomic = flags & PERCPU_REF_INIT_ATOMIC;
  84:		data->allow_reinit = flags & PERCPU_REF_ALLOW_REINIT;
  85:	
  86:		if (flags & (PERCPU_REF_INIT_ATOMIC | PERCPU_REF_INIT_DEAD)) {
  87:			ref->percpu_count_ptr |= __PERCPU_REF_ATOMIC;
  88:			data->allow_reinit = true;
  89:		} else {
  90:			start_count += PERCPU_COUNT_BIAS;
  91:		}
  92:	
  93:		if (flags & PERCPU_REF_INIT_DEAD)
  94:			ref->percpu_count_ptr |= __PERCPU_REF_DEAD;
  95:		else
  96:			start_count++;
  97:	
  98:		atomic_long_set(&data->count, start_count);
  99:	
 100:		data->release = release;
 101:		data->confirm_switch = NULL;
 102:		data->ref = ref;
 103:		ref->data = data;
 104:		return 0;
 105:	}
 SourceFile:lib/percpu-refcount.c]

gemini-3.1-pro-preview

							input: 35809
							output: 56
							thoughts: 4158
						

**My Thought Process for Triggering the Per-CPU Allocation Bug**

Okay, let's walk through how I've arrived at this solution, step-by-step, as I was piecing together the puzzle to trigger this specific per-CPU allocation bug.

Initially, I'm looking at `percpu_ref_init` and its reliance on `__alloc_percpu_gfp`. My immediate thought is: if I can inject a fault into `percpu_ref_init` *during the `nfsd_create_serv` call*, then `nfsd_create_serv` will correctly return `-ENOMEM`, and the bug won't manifest. This tells me that simply having *any* fault injection isn't enough; I need to be precise about *when* it happens.

This leads me to the critical realization that the *probability* of fault injection is key. If the probability is too high, I'll get failures in `percpu_ref_init` too often, and I'll never reach the state where `percpu_counter_init` encounters the problem. I need a *low probability*, say 5%, to allow most allocations to succeed initially.

Now, here's where the race condition becomes apparent. If `percpu_ref_init` needs to allocate a new chunk of per-CPU memory and *that specific allocation fails* due to my 5% fault injection, the overall `percpu_ref_init` call might fail. But, if it *succeeds*, it might consume the *last available space* within its current chunk. This is the crucial setup.

The beauty of running many iterations (like 10000) comes into play here. I anticipate that through sheer repetition, `percpu_ref_init` will often succeed (either because it doesn't need a new chunk or the new chunk allocation succeeds), but it might leave the current chunk nearly full. Then, when `percpu_counter_init` subsequently tries to allocate, it *will definitely need a new chunk*. And *that's* when my 5% fault injection comes into play again. Since fault injection is enabled, there's a 5% chance that this *new chunk creation for `percpu_counter_init` will fail*. This precise interleaving of successes and failures, driven by the low probability and the iterative nature of the process, is exactly what I need to expose the bug.

To ensure fault injection is active for the right parts of the system, I verify the configuration for `task-filter`. Yes, setting `/sys/kernel/debug/failslab/task-filter` to `"Y"` is correct. I also need to enable it for the specific process that will trigger the bug, which is done with `write_file("/proc/self/make-it-fail", "1");`.

Next, I need to build the actual C program to orchestrate this. I start with the core components: setting up fault injection for both slab and page allocations (just in case `percpu` uses `alloc_pages`), creating a directory for `nfsd`, and then I need a way to keep the system busy allocating per-CPU memory *without* the fault injection interfering with the main bug trigger. This is where the `filler_thread` comes in. It repeatedly creates BPF maps of type `BPF_MAP_TYPE_PERCPU_ARRAY`.

This leads to a critical refinement: resource limits. My `filler_thread` creates BPF maps, and each map consumes a file descriptor. If the default `RLIMIT_NOFILE` (usually 1024) is hit, the `bpf()` syscall will fail with `-EMFILE`, and my filler thread will stop allocating per-CPU memory. This would starve the bug trigger. Therefore, I absolutely *must* increase `RLIMIT_NOFILE` to a much higher value (like 65535) using `setrlimit`. Similarly, I consider `RLIMIT_MEMLOCK` to ensure that the kernel can allocate the memory for these per-CPU arrays and BPF maps, setting it to `RLIM_INFINITY`.

I then adjust the `value_size` for the BPF maps in the filler thread to 32KB. This is a trade-off: a larger size means fewer file descriptors are needed for a given amount of memory, which is good. However, I've already addressed `RLIMIT_NOFILE`, so the primary goal is just to saturate per-CPU memory without *completely* exhausting it in a way that would prevent new allocations. The 32KB size, with 5000 iterations, allocates a substantial amount of per-CPU memory (around 160MB), which is sufficient to create pressure. The small delay (`usleep(2000)`) in the filler thread is also important to pace its allocation activity relative to the main bug-triggering thread.

Now, for the main bug trigger: I use `fork()` to create a child process. This child process is crucial for isolating the environment. It uses `unshare(CLONE_NEWNET | CLONE_NEWNS)` to get fresh network and mount namespaces. This ensures that any existing `nfsd` instances or network configurations don't interfere. I also bring up the `lo` interface and mount `nfsd` to simulate the environment where `nfsd_create_serv` would be called.

The `write_file("/proc/self/make-it-fail", "1");` command is strategically placed *just before* the `write` call that triggers `nfsd_create_serv`. This ensures that fault injection is enabled *only* for the critical allocation path within the `nfsd` setup, not for the earlier steps like `unshare`, `mount`, or `open`. After the `write`, I immediately disable it with `write_file("/proc/self/make-it-fail", "0");`.

I also consider the possibility that if per-CPU memory becomes *completely* exhausted, `percpu_ref_init` itself would fail. This would prevent `nfsd_create_serv` from ever being called, and thus the bug wouldn't trigger. My `filler_thread` *doesn't* have `make-it-fail` enabled, so it will happily create new per-CPU chunks when needed, preventing complete exhaustion. It just fills up the *existing* chunks, creating the pressure that allows `percpu_counter_init` to hit the problematic allocation scenario when it's forced to request a new chunk under fault injection.

The timing of the filler thread and the main loop is also considered. The filler thread allocates at a rate that should keep the system busy filling per-CPU memory without necessarily exhausting it before the main thread gets a chance to run its scenario multiple times.

Finally, I re-evaluate the probability. A 5% chance for fault injection seems appropriate. It's low enough to allow the successful path to often complete, but high enough that when the specific race condition occurs (where `percpu_ref_init` fills up a chunk, and `percpu_counter_init` needs a new one), there's a reasonable chance of failure at that critical juncture. The 5000 iterations provide ample opportunities to hit this exact sequence of events.

In essence, my strategy relies on creating a controlled environment where:
1.  A background process continuously allocates per-CPU memory, creating pressure.
2.  A main process attempts to trigger a specific `nfsd` allocation path.
3.  A low-probability fault injection is strategically enabled *only* for the critical allocation within that path.
4.  Resource limits are adjusted to prevent premature failure of the setup.

This carefully orchestrated sequence, driven by repetition and precise timing, is how I aim to expose the per-CPU allocation bug.

map[Question:Is there any issue with using BPF_MAP_TYPE_PERCPU_ARRAY to allocate percpu memory in a loop to exhaust percpu chunks, while another thread runs a syscall with fault injection enabled?]

map[Answer:Using `BPF_MAP_TYPE_PERCPU_ARRAY` in a loop to allocate percpu memory and exhaust percpu chunks while another thread executes a syscall with fault injection enabled leads to several system-wide issues and testing flakiness, although `BPF_MAP_TYPE_PERCPU_ARRAY` itself handles allocation failures gracefully without internal memory leaks.

### 1. BPF Map Memory Handling (Internal Correctness)
- When creating a `BPF_MAP_TYPE_PERCPU_ARRAY` map, the kernel calls `bpf_array_alloc_percpu()` (`kernel/bpf/arraymap.c`), allocating percpu memory for each entry via `bpf_map_alloc_percpu()` with flags `GFP_USER | __GFP_NOWARN | __GFP_ACCOUNT`.
- If percpu memory or chunk creation fails (returning `NULL`), `bpf_array_alloc_percpu()` calls `bpf_array_free_percpu()` to free all previously allocated array slots for that map and returns `-ENOMEM`.
- The map allocation path then frees the `struct bpf_array` via `bpf_map_area_free()` and returns `-ENOMEM` to userspace.
- Thus, the BPF map allocator itself cleans up properly on failure and does not leak memory or crash directly.

### 2. Global Percpu Memory Starvation (System-Wide Denial of Service)
- Percpu memory is a finite, globally shared kernel resource backed by specific kernel virtual address space regions (`vmalloc` region) and physical pages.
- Exhausting percpu chunks in a loop starves the entire kernel of percpu memory.
- Any other thread or subsystem in the kernel attempting to allocate percpu memory (e.g., creating sockets, cgroups, perf events, netfilter, tracing structures) will fail with `-ENOMEM`.
- Kernel subsystems or syscall paths that assume percpu allocations will always succeed (or fail to handle percpu allocation failure gracefully) may trigger `WARN_ON`s, kernel crashes, or broken states.

### 3. Interference with Fault Injection and Syscall Testing
- Thread B running a syscall with fault injection enabled (e.g., via `/proc/self/fail-nth`, `FAIL_SLAB`, or `FAIL_PAGE_ALLOC`) relies on fault injection to deterministically test syscall error recovery paths.
- Global percpu exhaustion introduces uncontrollable, non-deterministic allocation failures across arbitrary kernel paths in Thread B's syscall execution.
- This creates cascading failures in unrelated kernel routines and error-handling cleanup paths, making fault injection testing unreliable and causing false-positive kernel warnings or crashes.

### 4. Severe Lock Contention (`pcpu_alloc_mutex` and `pcpu_lock`)
- Creating percpu chunks (`pcpu_create_chunk()`) requires acquiring the global `pcpu_alloc_mutex` and `pcpu_lock` (`mm/percpu.c`).
- Allocating percpu memory in a tight loop to exhaust chunks subjects `pcpu_alloc_mutex` to extreme lock contention, blocking or introducing severe latency for any other kernel thread trying to allocate or free percpu memory.

### 5. Dmesg Warning Log Pressure
- While BPF percpu map allocations pass `__GFP_NOWARN` to avoid kernel log spam when map creation fails, other kernel subsystems allocating percpu memory without `__GFP_NOWARN` will log `pr_warn("allocation failed...")` and dump kernel stack traces to `dmesg` once percpu chunks are exhausted.]

good-balanced

map[Answer:Using `BPF_MAP_TYPE_PERCPU_ARRAY` in a loop to allocate percpu memory and exhaust percpu chunks while another thread executes a syscall with fault injection enabled leads to several system-wide issues and testing flakiness, although `BPF_MAP_TYPE_PERCPU_ARRAY` itself handles allocation failures gracefully without internal memory leaks.

### 1. BPF Map Memory Handling (Internal Correctness)
- When creating a `BPF_MAP_TYPE_PERCPU_ARRAY` map, the kernel calls `bpf_array_alloc_percpu()` (`kernel/bpf/arraymap.c`), allocating percpu memory for each entry via `bpf_map_alloc_percpu()` with flags `GFP_USER | __GFP_NOWARN | __GFP_ACCOUNT`.
- If percpu memory or chunk creation fails (returning `NULL`), `bpf_array_alloc_percpu()` calls `bpf_array_free_percpu()` to free all previously allocated array slots for that map and returns `-ENOMEM`.
- The map allocation path then frees the `struct bpf_array` via `bpf_map_area_free()` and returns `-ENOMEM` to userspace.
- Thus, the BPF map allocator itself cleans up properly on failure and does not leak memory or crash directly.

### 2. Global Percpu Memory Starvation (System-Wide Denial of Service)
- Percpu memory is a finite, globally shared kernel resource backed by specific kernel virtual address space regions (`vmalloc` region) and physical pages.
- Exhausting percpu chunks in a loop starves the entire kernel of percpu memory.
- Any other thread or subsystem in the kernel attempting to allocate percpu memory (e.g., creating sockets, cgroups, perf events, netfilter, tracing structures) will fail with `-ENOMEM`.
- Kernel subsystems or syscall paths that assume percpu allocations will always succeed (or fail to handle percpu allocation failure gracefully) may trigger `WARN_ON`s, kernel crashes, or broken states.

### 3. Interference with Fault Injection and Syscall Testing
- Thread B running a syscall with fault injection enabled (e.g., via `/proc/self/fail-nth`, `FAIL_SLAB`, or `FAIL_PAGE_ALLOC`) relies on fault injection to deterministically test syscall error recovery paths.
- Global percpu exhaustion introduces uncontrollable, non-deterministic allocation failures across arbitrary kernel paths in Thread B's syscall execution.
- This creates cascading failures in unrelated kernel routines and error-handling cleanup paths, making fault injection testing unreliable and causing false-positive kernel warnings or crashes.

### 4. Severe Lock Contention (`pcpu_alloc_mutex` and `pcpu_lock`)
- Creating percpu chunks (`pcpu_create_chunk()`) requires acquiring the global `pcpu_alloc_mutex` and `pcpu_lock` (`mm/percpu.c`).
- Allocating percpu memory in a tight loop to exhaust chunks subjects `pcpu_alloc_mutex` to extreme lock contention, blocking or introducing severe latency for any other kernel thread trying to allocate or free percpu memory.

### 5. Dmesg Warning Log Pressure
- While BPF percpu map allocations pass `__GFP_NOWARN` to avoid kernel log spam when map creation fails, other kernel subsystems allocating percpu memory without `__GFP_NOWARN` will log `pr_warn("allocation failed...")` and dump kernel stack traces to `dmesg` once percpu chunks are exhausted.]

You are a capable Linux kernel developer tasked with researching complex questions
about kernel source code. You will be given a concrete question, and need to provide
a concrete answer.
Use tools extensively while researching the question. Don't make assumptions,
or rely on your previous knowledge about the kernel source code, use available tools
to access the actual source code.
Use all available sources of information:
 - kernel source code
 - documentation in the Documentation dir in the source tree

Do not guess file names or file paths and attempt to read them without
verifying their existence first using content search or directory listing tools.
If a file, symbol, or directory is not found via content search (grepper) or
directory listing (codesearch-dir-index), treat it as completely absent.
Do not attempt to guess alternative names, extensions, or directories.

Tool Selection Guidelines:
1. For C functions, structs, and variables: Prefer codesearch-definition-source
   or codesearch-struct-layout FIRST to retrieve clean, exact definitions
   without line-number guessing.
2. If symbol lookup fails (e.g., preprocessor macros, macro-generated code, or
   disabled #ifdef branches), fall back to read-file or grepper.
3. For file headers, #include directives, preprocessor macro definitions, and
   non-C files (Kconfig, Makefiles, docs): Use read-file or grepper directly.

Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Is there any issue with using BPF_MAP_TYPE_PERCPU_ARRAY to allocate percpu memory in a loop to exhaust percpu chunks, while another thread runs a syscall with fault injection enabled?

gemini-3.6-flash

							input: 2261
							output: 25
							thoughts: 239
						

**My Thought Process Regarding BPF_MAP_TYPE_PERCPU_ARRAY and Fault Injection**

Okay, so the core of the question is whether there are any inherent problems with a specific scenario: using `BPF_MAP_TYPE_PERCPU_ARRAY` to aggressively allocate per-CPU memory (essentially trying to exhaust available per-CPU chunks) while, concurrently, another thread is running a system call with fault injection enabled. My goal is to thoroughly investigate this potential interaction.

To tackle this, I need to approach it systematically. I'm thinking about digging into the kernel's behavior in several key areas. My primary line of inquiry will be to look for any documented kernel issues, commit messages, code comments, bug reports (especially from syzbot, given its focus on fuzzing and kernel stability), or direct code behavior observations that touch upon the following:

*   The intricacies of `BPF_MAP_TYPE_PERCPU_ARRAY` itself, how it manages per-CPU memory.
*   The general mechanics of per-CPU memory allocation within the kernel, specifically functions like `pcpu_alloc`.
*   The concept of "per-CPU chunks" – what happens when these are depleted or under pressure.
*   The impact of fault injection on memory allocation mechanisms.
*   Any observed failures, warnings, out-of-memory (OOM) conditions, lockdep issues, panics, kernel BUGs, use-after-free vulnerabilities, or similar kernel maladies that might arise from memory allocation stress.
*   Crucially, I need to look for any direct evidence of per-CPU allocation behaving unexpectedly or failing when fault injection is active, or when per-CPU chunks are being aggressively consumed.

To execute this search, I'm planning to leverage powerful tools. I'll likely use `grepper` or kernel codesearch capabilities to quickly scan the kernel source code and related documentation. My search terms will be broad initially, but then I'll refine them. I'll start by looking for `BPF_MAP_TYPE_PERCPU_ARRAY` and how it's handled during BPF map creation, updates, and allocations. I'll also be looking for broader terms like "percpu allocation" and "fault injection." The goal is to understand the internal workings of per-CPU map allocation within the BPF subsystem and see how it interacts with the kernel's memory management and error handling, particularly under simulated stress.

map[Expression:BPF_MAP_TYPE_PERCPU_ARRAY]

map[Output:
Full output is too long, showing 500 out of 506 lines.
Use more precise expression if possible.

Documentation/bpf/drgn.rst=42=List BPF maps::
--
Documentation/bpf/drgn.rst-46-        4050: BPF_MAP_TYPE_STACK_TRACE         stack_traces
Documentation/bpf/drgn.rst:47:        4069: BPF_MAP_TYPE_PERCPU_ARRAY        ned_dctcp_cntr
Documentation/bpf/drgn.rst-48-
--
Documentation/bpf/map_array.rst-4-================================================
Documentation/bpf/map_array.rst:5:BPF_MAP_TYPE_ARRAY and BPF_MAP_TYPE_PERCPU_ARRAY
Documentation/bpf/map_array.rst-6-================================================
--
Documentation/bpf/map_array.rst-9-   - ``BPF_MAP_TYPE_ARRAY`` was introduced in kernel version 3.19
Documentation/bpf/map_array.rst:10:   - ``BPF_MAP_TYPE_PERCPU_ARRAY`` was introduced in version 4.6
Documentation/bpf/map_array.rst-11-
Documentation/bpf/map_array.rst:12:``BPF_MAP_TYPE_ARRAY`` and ``BPF_MAP_TYPE_PERCPU_ARRAY`` provide generic array
Documentation/bpf/map_array.rst-13-storage. The key type is an unsigned 32-bit integer (4 bytes) and the map is
--
Documentation/bpf/map_array.rst=15=creation time. All array elements are pre-allocated and zero initialized when
Documentation/bpf/map_array.rst:16:created. ``BPF_MAP_TYPE_PERCPU_ARRAY`` uses a different memory region for each
Documentation/bpf/map_array.rst-17-CPU whereas ``BPF_MAP_TYPE_ARRAY`` uses the same memory region. The value
Documentation/bpf/map_array.rst=18=stored can be of any size for ``BPF_MAP_TYPE_ARRAY`` and not more than
Documentation/bpf/map_array.rst:19:``PCPU_MIN_UNIT_SIZE`` (32 kB) for ``BPF_MAP_TYPE_PERCPU_ARRAY``. All
Documentation/bpf/map_array.rst-20-array elements are aligned to 8 bytes.
--
Documentation/bpf/map_array.rst=68=across different CPUs. To restrict storage to a single CPU, you may use a
Documentation/bpf/map_array.rst:69:``BPF_MAP_TYPE_PERCPU_ARRAY``.
Documentation/bpf/map_array.rst-70-
Documentation/bpf/map_array.rst:71:When using a ``BPF_MAP_TYPE_PERCPU_ARRAY`` the ``bpf_map_update_elem()`` and
Documentation/bpf/map_array.rst-72-``bpf_map_lookup_elem()`` helpers automatically access the slot for the current
--
Documentation/bpf/map_array.rst=188=This snippet shows how to retrieve an element value from an array.
--
Documentation/bpf/map_array.rst-207-
Documentation/bpf/map_array.rst:208:BPF_MAP_TYPE_PERCPU_ARRAY
Documentation/bpf/map_array.rst-209-~~~~~~~~~~~~~~~~~~~~~~~~~
--
Documentation/bpf/map_array.rst=256=Semantics
--
Documentation/bpf/map_array.rst-258-
Documentation/bpf/map_array.rst:259:As shown in the example above, when accessing a ``BPF_MAP_TYPE_PERCPU_ARRAY``
Documentation/bpf/map_array.rst-260-in userspace, each value is an array with ``ncpus`` elements.
--
Documentation/bpf/map_cpumap.rst=102=The following code snippet shows how to declare a ``BPF_MAP_TYPE_CPUMAP`` called
--
Documentation/bpf/map_cpumap.rst-121-    struct {
Documentation/bpf/map_cpumap.rst:122:        __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
Documentation/bpf/map_cpumap.rst-123-        __type(key, __u32);
--
include/linux/bpf.h=4172=static inline bool bpf_map_supports_cpu_flags(enum bpf_map_type map_type)
--
include/linux/bpf.h-4174-	switch (map_type) {
include/linux/bpf.h:4175:	case BPF_MAP_TYPE_PERCPU_ARRAY:
include/linux/bpf.h-4176-	case BPF_MAP_TYPE_PERCPU_HASH:
--
include/linux/bpf_types.h=87=BPF_MAP_TYPE(BPF_MAP_TYPE_ARRAY, array_map_ops)
include/linux/bpf_types.h:88:BPF_MAP_TYPE(BPF_MAP_TYPE_PERCPU_ARRAY, percpu_array_map_ops)
include/linux/bpf_types.h-89-BPF_MAP_TYPE(BPF_MAP_TYPE_PROG_ARRAY, prog_array_map_ops)
--
include/uapi/linux/bpf.h=1000=enum bpf_map_type {
--
include/uapi/linux/bpf.h-1006-	BPF_MAP_TYPE_PERCPU_HASH,
include/uapi/linux/bpf.h:1007:	BPF_MAP_TYPE_PERCPU_ARRAY,
include/uapi/linux/bpf.h-1008-	BPF_MAP_TYPE_STACK_TRACE,
--
include/uapi/linux/bpf.h=1527=union bpf_attr {
--
include/uapi/linux/bpf.h-1991- * 		Flag value **BPF_NOEXIST** cannot be used for maps of types
include/uapi/linux/bpf.h:1992: * 		**BPF_MAP_TYPE_ARRAY** or **BPF_MAP_TYPE_PERCPU_ARRAY**  (all
include/uapi/linux/bpf.h-1993- * 		elements always exist), the helper would return an error.
--
include/uapi/linux/bpf.h-5259- *		BPF_MAP_TYPE_LRU_HASH, BPF_MAP_TYPE_LRU_PERCPU_HASH,
include/uapi/linux/bpf.h:5260: *		BPF_MAP_TYPE_ARRAY, BPF_MAP_TYPE_PERCPU_ARRAY
include/uapi/linux/bpf.h-5261- *
--
kernel/bpf/arraymap.c=53=int array_map_alloc_check(union bpf_attr *attr)
kernel/bpf/arraymap.c-54-{
kernel/bpf/arraymap.c:55:	bool percpu = attr->map_type == BPF_MAP_TYPE_PERCPU_ARRAY;
kernel/bpf/arraymap.c-56-	int numa_node = bpf_map_attr_numa_node(attr);
--
kernel/bpf/arraymap.c=84=static struct bpf_map *array_map_alloc(union bpf_attr *attr)
kernel/bpf/arraymap.c-85-{
kernel/bpf/arraymap.c:86:	bool percpu = attr->map_type == BPF_MAP_TYPE_PERCPU_ARRAY;
kernel/bpf/arraymap.c-87-	int numa_node = bpf_map_attr_numa_node(attr);
--
kernel/bpf/arraymap.c=361=static long array_map_update_elem(struct bpf_map *map, void *key, void *value,
--
kernel/bpf/arraymap.c-383-
kernel/bpf/arraymap.c:384:	if (array->map.map_type == BPF_MAP_TYPE_PERCPU_ARRAY) {
kernel/bpf/arraymap.c-385-		val = this_cpu_ptr(array->pptrs[index & array->index_mask]);
--
kernel/bpf/arraymap.c=474=static void array_map_free(struct bpf_map *map)
--
kernel/bpf/arraymap.c-479-	if (!IS_ERR_OR_NULL(map->record)) {
kernel/bpf/arraymap.c:480:		if (array->map.map_type == BPF_MAP_TYPE_PERCPU_ARRAY) {
kernel/bpf/arraymap.c-481-			for (i = 0; i < array->map.max_entries; i++) {
--
kernel/bpf/arraymap.c-495-
kernel/bpf/arraymap.c:496:	if (array->map.map_type == BPF_MAP_TYPE_PERCPU_ARRAY)
kernel/bpf/arraymap.c-497-		bpf_array_free_percpu(array);
--
kernel/bpf/arraymap.c=696=static int bpf_iter_init_array_map(void *priv_data,
--
kernel/bpf/arraymap.c-704-
kernel/bpf/arraymap.c:705:	if (map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY) {
kernel/bpf/arraymap.c-706-		buf_size = array->elem_size * num_possible_cpus();
--
kernel/bpf/arraymap.c=745=static long bpf_for_each_array_elem(struct bpf_map *map, bpf_callback_t callback_fn,
--
kernel/bpf/arraymap.c-758-
kernel/bpf/arraymap.c:759:	is_percpu = map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY;
kernel/bpf/arraymap.c-760-	array = container_of(map, struct bpf_array, map);
--
kernel/bpf/arraymap.c=778=static u64 array_map_mem_usage(const struct bpf_map *map)
--
kernel/bpf/arraymap.c-780-	struct bpf_array *array = container_of(map, struct bpf_array, map);
kernel/bpf/arraymap.c:781:	bool percpu = map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY;
kernel/bpf/arraymap.c-782-	u32 elem_size = array->elem_size;
--
kernel/bpf/map_iter.c=100=static int bpf_iter_attach_map(struct bpf_prog *prog,
--
kernel/bpf/map_iter.c-121-	    map->map_type == BPF_MAP_TYPE_LRU_PERCPU_HASH ||
kernel/bpf/map_iter.c:122:	    map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY)
kernel/bpf/map_iter.c-123-		is_percpu = true;
--
kernel/bpf/syscall.c=138=static u32 bpf_map_value_size(const struct bpf_map *map, u64 flags)
--
kernel/bpf/syscall.c-143-		 map->map_type == BPF_MAP_TYPE_LRU_PERCPU_HASH ||
kernel/bpf/syscall.c:144:		 map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY ||
kernel/bpf/syscall.c-145-		 map->map_type == BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE)
--
kernel/bpf/syscall.c=251=static int bpf_map_update_value(struct bpf_map *map, struct file *map_file,
--
kernel/bpf/syscall.c-274-		err = bpf_percpu_hash_update(map, key, value, flags);
kernel/bpf/syscall.c:275:	} else if (map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY) {
kernel/bpf/syscall.c-276-		err = bpf_percpu_array_update(map, key, value, flags);
--
kernel/bpf/syscall.c=309=static int bpf_map_copy_value(struct bpf_map *map, void *key, void *value,
--
kernel/bpf/syscall.c-321-		err = bpf_percpu_hash_copy(map, key, value, flags);
kernel/bpf/syscall.c:322:	} else if (map->map_type == BPF_MAP_TYPE_PERCPU_ARRAY) {
kernel/bpf/syscall.c-323-		err = bpf_percpu_array_copy(map, key, value, flags);
--
kernel/bpf/syscall.c=1244=static int map_check_btf(struct bpf_map *map, struct bpf_token *token,
--
kernel/bpf/syscall.c-1320-				    map->map_type != BPF_MAP_TYPE_ARRAY &&
kernel/bpf/syscall.c:1321:				    map->map_type != BPF_MAP_TYPE_PERCPU_ARRAY &&
kernel/bpf/syscall.c-1322-				    map->map_type != BPF_MAP_TYPE_SK_STORAGE &&
--
kernel/bpf/syscall.c=1371=static int map_create_alloc(union bpf_attr *attr, bpfptr_t uattr, struct bpf_verifier_log *log,
--
kernel/bpf/syscall.c-1475-	case BPF_MAP_TYPE_ARRAY:
kernel/bpf/syscall.c:1476:	case BPF_MAP_TYPE_PERCPU_ARRAY:
kernel/bpf/syscall.c-1477-	case BPF_MAP_TYPE_PROG_ARRAY:
--
kernel/bpf/verifier.c=8497=static int check_map_func_compatibility(struct bpf_verifier_env *env,
--
kernel/bpf/verifier.c-8713-	case BPF_FUNC_map_lookup_percpu_elem:
kernel/bpf/verifier.c:8714:		if (map->map_type != BPF_MAP_TYPE_PERCPU_ARRAY &&
kernel/bpf/verifier.c-8715-		    map->map_type != BPF_MAP_TYPE_PERCPU_HASH &&
--
kernel/bpf/verifier.c=10103=static bool can_elide_value_nullness(const struct bpf_map *map)
--
kernel/bpf/verifier.c-10109-	case BPF_MAP_TYPE_ARRAY:
kernel/bpf/verifier.c:10110:	case BPF_MAP_TYPE_PERCPU_ARRAY:
kernel/bpf/verifier.c-10111-		return true;
--
kernel/bpf/verifier.c=17736=static int check_map_prog_compatibility(struct bpf_verifier_env *env,
--
kernel/bpf/verifier.c-17786-		case BPF_MAP_TYPE_PERCPU_HASH:
kernel/bpf/verifier.c:17787:		case BPF_MAP_TYPE_PERCPU_ARRAY:
kernel/bpf/verifier.c-17788-		case BPF_MAP_TYPE_LRU_PERCPU_HASH:
--
samples/bpf/tracex3.bpf.c=50=struct {
samples/bpf/tracex3.bpf.c:51:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
samples/bpf/tracex3.bpf.c-52-	__uint(key_size, sizeof(u32));
--
samples/bpf/xdp_tx_iptunnel_kern.c=22=struct {
samples/bpf/xdp_tx_iptunnel_kern.c:23:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
samples/bpf/xdp_tx_iptunnel_kern.c-24-	__type(key, __u32);
--
tools/bpf/bpftool/map.c=26=static bool map_is_per_cpu(__u32 type)
--
tools/bpf/bpftool/map.c-28-	return type == BPF_MAP_TYPE_PERCPU_HASH ||
tools/bpf/bpftool/map.c:29:	       type == BPF_MAP_TYPE_PERCPU_ARRAY ||
tools/bpf/bpftool/map.c-30-	       type == BPF_MAP_TYPE_LRU_PERCPU_HASH ||
--
tools/bpf/bpftool/skeleton/profiler.bpf.c=21=struct {
tools/bpf/bpftool/skeleton/profiler.bpf.c:22:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/bpf/bpftool/skeleton/profiler.bpf.c-23-	__uint(key_size, sizeof(u32));
--
tools/bpf/bpftool/skeleton/profiler.bpf.c=28=struct {
tools/bpf/bpftool/skeleton/profiler.bpf.c:29:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/bpf/bpftool/skeleton/profiler.bpf.c-30-	__uint(key_size, sizeof(u32));
--
tools/bpf/bpftool/skeleton/profiler.bpf.c=35=struct {
tools/bpf/bpftool/skeleton/profiler.bpf.c:36:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/bpf/bpftool/skeleton/profiler.bpf.c-37-	__uint(key_size, sizeof(u32));
--
tools/include/uapi/linux/bpf.h=1000=enum bpf_map_type {
--
tools/include/uapi/linux/bpf.h-1006-	BPF_MAP_TYPE_PERCPU_HASH,
tools/include/uapi/linux/bpf.h:1007:	BPF_MAP_TYPE_PERCPU_ARRAY,
tools/include/uapi/linux/bpf.h-1008-	BPF_MAP_TYPE_STACK_TRACE,
--
tools/include/uapi/linux/bpf.h=1527=union bpf_attr {
--
tools/include/uapi/linux/bpf.h-1991- * 		Flag value **BPF_NOEXIST** cannot be used for maps of types
tools/include/uapi/linux/bpf.h:1992: * 		**BPF_MAP_TYPE_ARRAY** or **BPF_MAP_TYPE_PERCPU_ARRAY**  (all
tools/include/uapi/linux/bpf.h-1993- * 		elements always exist), the helper would return an error.
--
tools/include/uapi/linux/bpf.h-5259- *		BPF_MAP_TYPE_LRU_HASH, BPF_MAP_TYPE_LRU_PERCPU_HASH,
tools/include/uapi/linux/bpf.h:5260: *		BPF_MAP_TYPE_ARRAY, BPF_MAP_TYPE_PERCPU_ARRAY
tools/include/uapi/linux/bpf.h-5261- *
--
tools/lib/bpf/libbpf.c=163=static const char * const map_type_name[] = {
--
tools/lib/bpf/libbpf.c-169-	[BPF_MAP_TYPE_PERCPU_HASH]		= "percpu_hash",
tools/lib/bpf/libbpf.c:170:	[BPF_MAP_TYPE_PERCPU_ARRAY]		= "percpu_array",
tools/lib/bpf/libbpf.c-171-	[BPF_MAP_TYPE_STACK_TRACE]		= "stack_trace",
--
tools/lib/bpf/libbpf.c=11193=static int validate_map_op(const struct bpf_map *map, size_t key_sz,
--
tools/lib/bpf/libbpf.c-11213-	switch (map->def.type) {
tools/lib/bpf/libbpf.c:11214:	case BPF_MAP_TYPE_PERCPU_ARRAY:
tools/lib/bpf/libbpf.c-11215-	case BPF_MAP_TYPE_PERCPU_HASH:
--
tools/lib/bpf/libbpf_probes.c=292=static int probe_map_create(enum bpf_map_type map_type)
--
tools/lib/bpf/libbpf_probes.c-365-	case BPF_MAP_TYPE_PERCPU_HASH:
tools/lib/bpf/libbpf_probes.c:366:	case BPF_MAP_TYPE_PERCPU_ARRAY:
tools/lib/bpf/libbpf_probes.c-367-	case BPF_MAP_TYPE_CGROUP_ARRAY:
--
tools/perf/util/bpf_counter.c=286=static int bpf_program_profiler__read(struct evsel *evsel)
tools/perf/util/bpf_counter.c-287-{
tools/perf/util/bpf_counter.c:288:	// BPF_MAP_TYPE_PERCPU_ARRAY uses /sys/devices/system/cpu/possible
tools/perf/util/bpf_counter.c-289-	// Sometimes possible > online, like on a Ryzen 3900X that has 24
--
tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c=123=struct augmented_args_tmp {
tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c:124:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c-125-	__type(key, int);
--
tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c=142=struct beauty_payload_enter_map {
tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c:143:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/perf/util/bpf_skel/augmented_raw_syscalls.bpf.c-144-	__type(key, int);
--
tools/perf/util/bpf_skel/bperf_cgroup.bpf.c=30=struct {
tools/perf/util/bpf_skel/bperf_cgroup.bpf.c:31:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/perf/util/bpf_skel/bperf_cgroup.bpf.c-32-	__uint(key_size, sizeof(__u32));
--
tools/perf/util/bpf_skel/bperf_cgroup.bpf.c=38=struct {
tools/perf/util/bpf_skel/bperf_cgroup.bpf.c:39:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/perf/util/bpf_skel/bperf_cgroup.bpf.c-40-	__uint(key_size, sizeof(__u32));
--
tools/perf/util/bpf_skel/bperf_follower.bpf.c=10=struct {
tools/perf/util/bpf_skel/bperf_follower.bpf.c:11:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/perf/util/bpf_skel/bperf_follower.bpf.c-12-	__uint(key_size, sizeof(__u32));
--
tools/perf/util/bpf_skel/bperf_follower.bpf.c=17=struct {
tools/perf/util/bpf_skel/bperf_follower.bpf.c:18:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/perf/util/bpf_skel/bperf_follower.bpf.c-19-	__uint(key_size, sizeof(__u32));
--
tools/perf/util/bpf_skel/bperf_leader.bpf.c=14=struct {
tools/perf/util/bpf_skel/bperf_leader.bpf.c:15:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/perf/util/bpf_skel/bperf_leader.bpf.c-16-	__uint(key_size, sizeof(__u32));
--
tools/perf/util/bpf_skel/bperf_leader.bpf.c=21=struct {
tools/perf/util/bpf_skel/bperf_leader.bpf.c:22:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/perf/util/bpf_skel/bperf_leader.bpf.c-23-	__uint(key_size, sizeof(__u32));
--
tools/perf/util/bpf_skel/bpf_prog_profiler.bpf.c=15=struct {
tools/perf/util/bpf_skel/bpf_prog_profiler.bpf.c:16:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/perf/util/bpf_skel/bpf_prog_profiler.bpf.c-17-	__uint(key_size, sizeof(__u32));
--
tools/perf/util/bpf_skel/bpf_prog_profiler.bpf.c=23=struct {
tools/perf/util/bpf_skel/bpf_prog_profiler.bpf.c:24:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/perf/util/bpf_skel/bpf_prog_profiler.bpf.c-25-	__uint(key_size, sizeof(__u32));
--
tools/perf/util/bpf_skel/func_latency.bpf.c=31=struct {
tools/perf/util/bpf_skel/func_latency.bpf.c:32:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/perf/util/bpf_skel/func_latency.bpf.c-33-	__uint(key_size, sizeof(__u32));
--
tools/perf/util/bpf_skel/lock_contention.bpf.c=37=struct {
tools/perf/util/bpf_skel/lock_contention.bpf.c:38:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/perf/util/bpf_skel/lock_contention.bpf.c-39-	__uint(key_size, sizeof(__u32));
--
tools/perf/util/bpf_skel/lock_contention.bpf.c=77=struct {
tools/perf/util/bpf_skel/lock_contention.bpf.c:78:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/perf/util/bpf_skel/lock_contention.bpf.c-79-	__uint(key_size, sizeof(__u32));
--
tools/perf/util/bpf_skel/off_cpu.bpf.c=62=struct {
tools/perf/util/bpf_skel/off_cpu.bpf.c:63:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/perf/util/bpf_skel/off_cpu.bpf.c-64-	__uint(key_size, sizeof(__u32));
--
tools/sched_ext/scx_cpu0.bpf.c=29=struct {
tools/sched_ext/scx_cpu0.bpf.c:30:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/sched_ext/scx_cpu0.bpf.c-31-	__uint(key_size, sizeof(u32));
--
tools/sched_ext/scx_flatcg.bpf.c=66=struct {
tools/sched_ext/scx_flatcg.bpf.c:67:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/sched_ext/scx_flatcg.bpf.c-68-	__type(key, u32);
--
tools/sched_ext/scx_flatcg.bpf.c=87=struct {
tools/sched_ext/scx_flatcg.bpf.c:88:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/sched_ext/scx_flatcg.bpf.c-89-	__type(key, u32);
--
tools/sched_ext/scx_simple.bpf.c=41=struct {
tools/sched_ext/scx_simple.bpf.c:42:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/sched_ext/scx_simple.bpf.c-43-	__uint(key_size, sizeof(u32));
--
tools/testing/selftests/bpf/map_tests/array_map_batch_ops.c=70=static void __test_map_lookup_and_update_batch(bool is_pcpu)
--
tools/testing/selftests/bpf/map_tests/array_map_batch_ops.c-82-
tools/testing/selftests/bpf/map_tests/array_map_batch_ops.c:83:	map_fd = bpf_map_create(is_pcpu ? BPF_MAP_TYPE_PERCPU_ARRAY : BPF_MAP_TYPE_ARRAY,
tools/testing/selftests/bpf/map_tests/array_map_batch_ops.c-84-				"array_map", sizeof(int), sizeof(__s64), max_entries, NULL);
--
tools/testing/selftests/bpf/map_tests/map_percpu_stats.c=460=static void map_percpu_stats_map_value_size(void)
--
tools/testing/selftests/bpf/map_tests/map_percpu_stats.c-464-	struct bpf_map_create_opts opts = { .sz = sizeof(opts) };
tools/testing/selftests/bpf/map_tests/map_percpu_stats.c:465:	enum bpf_map_type map_types[] = { BPF_MAP_TYPE_PERCPU_ARRAY,
tools/testing/selftests/bpf/map_tests/map_percpu_stats.c-466-					  BPF_MAP_TYPE_PERCPU_HASH,
--
tools/testing/selftests/bpf/prog_tests/btf.c=5295=static struct btf_pprint_test_meta {
--
tools/testing/selftests/bpf/prog_tests/btf.c-5331-	.descr = "BTF pretty print percpu array",
tools/testing/selftests/bpf/prog_tests/btf.c:5332:	.map_type = BPF_MAP_TYPE_PERCPU_ARRAY,
tools/testing/selftests/bpf/prog_tests/btf.c-5333-	.map_name = "pprint_test_percpu_array",
--
tools/testing/selftests/bpf/prog_tests/map_btf.c=8=static void do_test_normal_map_btf(void)
--
tools/testing/selftests/bpf/prog_tests/map_btf.c-29-	for (i = 0; i < ARRAY_SIZE(map_fd_arr); i++)
tools/testing/selftests/bpf/prog_tests/map_btf.c:30:		map_fd_arr[i] = bpf_map_create(BPF_MAP_TYPE_PERCPU_ARRAY, NULL, 4, 4, 256, NULL);
tools/testing/selftests/bpf/prog_tests/map_btf.c-31-
--
tools/testing/selftests/bpf/prog_tests/percpu_alloc.c=338=static void test_percpu_array_cpu_flag(void)
tools/testing/selftests/bpf/prog_tests/percpu_alloc.c-339-{
tools/testing/selftests/bpf/prog_tests/percpu_alloc.c:340:	test_percpu_map_cpu_flag(BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/prog_tests/percpu_alloc.c-341-}
--
tools/testing/selftests/bpf/prog_tests/percpu_array_inner_map.c=9=void test_percpu_array_inner_map(void)
--
tools/testing/selftests/bpf/prog_tests/percpu_array_inner_map.c-15-	/* Create template: percpu array with 8 entries */
tools/testing/selftests/bpf/prog_tests/percpu_array_inner_map.c:16:	tmpl_fd = bpf_map_create(BPF_MAP_TYPE_PERCPU_ARRAY, "tmpl",
tools/testing/selftests/bpf/prog_tests/percpu_array_inner_map.c-17-				 sizeof(int), sizeof(long), 8, NULL);
--
tools/testing/selftests/bpf/prog_tests/percpu_array_inner_map.c-33-	/* Replacement with same max_entries should succeed */
tools/testing/selftests/bpf/prog_tests/percpu_array_inner_map.c:34:	good_fd = bpf_map_create(BPF_MAP_TYPE_PERCPU_ARRAY, "good",
tools/testing/selftests/bpf/prog_tests/percpu_array_inner_map.c-35-				 sizeof(int), sizeof(long), 8, NULL);
--
tools/testing/selftests/bpf/prog_tests/percpu_array_inner_map.c-43-	/* Replacement with fewer max_entries must fail */
tools/testing/selftests/bpf/prog_tests/percpu_array_inner_map.c:44:	bad_fd = bpf_map_create(BPF_MAP_TYPE_PERCPU_ARRAY, "bad",
tools/testing/selftests/bpf/prog_tests/percpu_array_inner_map.c-45-				sizeof(int), sizeof(long), 2, NULL);
--
tools/testing/selftests/bpf/progs/bpf_iter_bpf_percpu_array_map.c=9=struct {
tools/testing/selftests/bpf/progs/bpf_iter_bpf_percpu_array_map.c:10:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/bpf_iter_bpf_percpu_array_map.c-11-	__uint(max_entries, 3);
--
tools/testing/selftests/bpf/progs/for_each_array_map_elem.c=15=struct {
tools/testing/selftests/bpf/progs/for_each_array_map_elem.c:16:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/for_each_array_map_elem.c-17-	__uint(max_entries, 1);
--
tools/testing/selftests/bpf/progs/lsm.c=35=struct {
tools/testing/selftests/bpf/progs/lsm.c:36:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/lsm.c-37-	__uint(max_entries, 1);
--
tools/testing/selftests/bpf/progs/map_kptr.c=19=struct pcpu_array_map {
tools/testing/selftests/bpf/progs/map_kptr.c:20:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/map_kptr.c-21-	__type(key, int);
--
tools/testing/selftests/bpf/progs/map_ptr_kern.c=223=struct {
tools/testing/selftests/bpf/progs/map_ptr_kern.c:224:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/map_ptr_kern.c-225-	__uint(max_entries, MAX_ENTRIES);
--
tools/testing/selftests/bpf/progs/map_ptr_kern.c=686=int cg_skb(void *ctx)
--
tools/testing/selftests/bpf/progs/map_ptr_kern.c-692-	VERIFY_TYPE(BPF_MAP_TYPE_PERCPU_HASH, check_percpu_hash);
tools/testing/selftests/bpf/progs/map_ptr_kern.c:693:	VERIFY_TYPE(BPF_MAP_TYPE_PERCPU_ARRAY, check_percpu_array);
tools/testing/selftests/bpf/progs/map_ptr_kern.c-694-	VERIFY_TYPE(BPF_MAP_TYPE_STACK_TRACE, check_stack_trace);
--
tools/testing/selftests/bpf/progs/netif_receive_skb.c=27=struct {
tools/testing/selftests/bpf/progs/netif_receive_skb.c:28:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/netif_receive_skb.c-29-	__uint(max_entries, 1);
--
tools/testing/selftests/bpf/progs/percpu_alloc_array.c=190=struct {
tools/testing/selftests/bpf/progs/percpu_alloc_array.c:191:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/percpu_alloc_array.c-192-	__uint(max_entries, 2);
--
tools/testing/selftests/bpf/progs/perf_event_stackmap.c=18=struct {
tools/testing/selftests/bpf/progs/perf_event_stackmap.c:19:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/perf_event_stackmap.c-20-	__uint(max_entries, 1);
--
tools/testing/selftests/bpf/progs/profiler.inc.h=82=struct {
tools/testing/selftests/bpf/progs/profiler.inc.h:83:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/profiler.inc.h-84-	__uint(max_entries, 1);
--
tools/testing/selftests/bpf/progs/profiler.inc.h=102=struct {
tools/testing/selftests/bpf/progs/profiler.inc.h:103:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/profiler.inc.h-104-	__uint(max_entries, profiler_bpf_max_function_id);
--
tools/testing/selftests/bpf/progs/strobemeta.h=232=struct {
tools/testing/selftests/bpf/progs/strobemeta.h:233:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/strobemeta.h-234-	__uint(max_entries, 1);
--
tools/testing/selftests/bpf/progs/strobemeta.h=239=struct {
tools/testing/selftests/bpf/progs/strobemeta.h:240:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/strobemeta.h-241-	__uint(max_entries, STROBE_MAX_CFGS);
--
tools/testing/selftests/bpf/progs/test_cls_redirect.c=366=struct {
tools/testing/selftests/bpf/progs/test_cls_redirect.c:367:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/test_cls_redirect.c-368-	__uint(max_entries, 1);
--
tools/testing/selftests/bpf/progs/test_cls_redirect_dynptr.c=260=struct {
tools/testing/selftests/bpf/progs/test_cls_redirect_dynptr.c:261:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/test_cls_redirect_dynptr.c-262-	__uint(max_entries, 1);
--
tools/testing/selftests/bpf/progs/test_get_stack_rawtp.c=25=struct {
tools/testing/selftests/bpf/progs/test_get_stack_rawtp.c:26:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/test_get_stack_rawtp.c-27-	__uint(max_entries, 1);
--
tools/testing/selftests/bpf/progs/test_get_stack_rawtp.c=50=struct {
tools/testing/selftests/bpf/progs/test_get_stack_rawtp.c:51:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/test_get_stack_rawtp.c-52-	__uint(max_entries, 1);
--
tools/testing/selftests/bpf/progs/test_hash_large_key.c=15=struct {
tools/testing/selftests/bpf/progs/test_hash_large_key.c:16:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/test_hash_large_key.c-17-	__uint(max_entries, 1);
--
tools/testing/selftests/bpf/progs/test_l4lb.c=191=struct {
tools/testing/selftests/bpf/progs/test_l4lb.c:192:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/test_l4lb.c-193-	__uint(max_entries, MAX_VIPS);
--
tools/testing/selftests/bpf/progs/test_l4lb_noinline.c=187=struct {
tools/testing/selftests/bpf/progs/test_l4lb_noinline.c:188:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/test_l4lb_noinline.c-189-	__uint(max_entries, MAX_VIPS);
--
tools/testing/selftests/bpf/progs/test_l4lb_noinline_dynptr.c=189=struct {
tools/testing/selftests/bpf/progs/test_l4lb_noinline_dynptr.c:190:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/test_l4lb_noinline_dynptr.c-191-	__uint(max_entries, MAX_VIPS);
--
tools/testing/selftests/bpf/progs/test_map_lookup_percpu_elem.c=13=struct {
tools/testing/selftests/bpf/progs/test_map_lookup_percpu_elem.c:14:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/test_map_lookup_percpu_elem.c-15-	__uint(max_entries, 1);
--
tools/testing/selftests/bpf/progs/test_unpriv_bpf_disabled.c=22=struct {
tools/testing/selftests/bpf/progs/test_unpriv_bpf_disabled.c:23:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/test_unpriv_bpf_disabled.c-24-	__uint(max_entries, 1);
--
tools/testing/selftests/bpf/progs/test_xdp.c=24=struct {
tools/testing/selftests/bpf/progs/test_xdp.c:25:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/test_xdp.c-26-	__uint(max_entries, 256);
--
tools/testing/selftests/bpf/progs/test_xdp_dynptr.c=27=struct {
tools/testing/selftests/bpf/progs/test_xdp_dynptr.c:28:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/test_xdp_dynptr.c-29-	__uint(max_entries, 256);
--
tools/testing/selftests/bpf/progs/test_xdp_loop.c=20=struct {
tools/testing/selftests/bpf/progs/test_xdp_loop.c:21:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/test_xdp_loop.c-22-	__uint(max_entries, 256);
--
tools/testing/selftests/bpf/progs/test_xdp_noinline.c=197=struct {
tools/testing/selftests/bpf/progs/test_xdp_noinline.c:198:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/test_xdp_noinline.c-199-	__uint(max_entries, 515);
--
tools/testing/selftests/bpf/progs/trigger_bench.c=33=struct {
tools/testing/selftests/bpf/progs/trigger_bench.c:34:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/trigger_bench.c-35-	 __uint(max_entries, 1);
--
tools/testing/selftests/bpf/progs/verifier_array_access.c=31=struct {
tools/testing/selftests/bpf/progs/verifier_array_access.c:32:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/verifier_array_access.c-33-	__uint(max_entries, 2);
--
tools/testing/selftests/bpf/progs/xdp_lb_bench.c=133=struct {
tools/testing/selftests/bpf/progs/xdp_lb_bench.c:134:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/xdp_lb_bench.c-135-	__uint(max_entries, STATS_SIZE);
--
tools/testing/selftests/bpf/progs/xdp_lb_bench.c=140=struct {
tools/testing/selftests/bpf/progs/xdp_lb_bench.c:141:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/xdp_lb_bench.c-142-	__uint(max_entries, MAX_REALS);
--
tools/testing/selftests/bpf/progs/xdp_lb_bench.c=161=struct {
tools/testing/selftests/bpf/progs/xdp_lb_bench.c:162:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/xdp_lb_bench.c-163-	__uint(max_entries, MAX_REALS);
--
tools/testing/selftests/bpf/test_loader.c=1057=static bool is_unpriv_capable_map(struct bpf_map *map)
--
tools/testing/selftests/bpf/test_loader.c-1074-	case BPF_MAP_TYPE_CGROUP_ARRAY:
tools/testing/selftests/bpf/test_loader.c:1075:	case BPF_MAP_TYPE_PERCPU_ARRAY:
tools/testing/selftests/bpf/test_loader.c-1076-	case BPF_MAP_TYPE_USER_RINGBUF:
--
tools/testing/selftests/bpf/test_maps.c=422=static void test_arraymap_percpu(unsigned int task, void *data)
--
tools/testing/selftests/bpf/test_maps.c-427-
tools/testing/selftests/bpf/test_maps.c:428:	fd = bpf_map_create(BPF_MAP_TYPE_PERCPU_ARRAY, NULL, sizeof(key),
tools/testing/selftests/bpf/test_maps.c-429-			    sizeof(bpf_percpu(values, 0)), 2, NULL);
--
tools/testing/selftests/bpf/test_maps.c=481=static void test_arraymap_percpu_many_keys(void)
--
tools/testing/selftests/bpf/test_maps.c-490-
tools/testing/selftests/bpf/test_maps.c:491:	fd = bpf_map_create(BPF_MAP_TYPE_PERCPU_ARRAY, NULL, sizeof(key),
tools/testing/selftests/bpf/test_maps.c-492-			    sizeof(bpf_percpu(values, 0)), nr_keys, NULL);
--
tools/tracing/rtla/src/timerlat.bpf.c=17=struct {

]

gemini-3.6-flash

							input: 15858
							output: 38
							thoughts: 115
						

**My Thought Process on `BPF_MAP_TYPE_PERCPU_ARRAY` Allocation**

Right, so the core of my curiosity here lies in understanding the nitty-gritty of how `BPF_MAP_TYPE_PERCPU_ARRAY` gets instantiated within the kernel. My immediate instinct is to dive straight into the source code where the allocation logic resides. Specifically, I'm looking at `kernel/bpf/arraymap.c`, and within that, the `array_map_alloc` function is my first port of call. I anticipate this function will be the entry point for creating these array-like BPF map structures.

Concurrently, I know that the underlying mechanism for per-CPU memory allocation isn't something BPF invents from scratch. It has to rely on the kernel's general-purpose per-CPU memory management routines. So, I'll also be mentally (or literally, if needed) navigating towards the relevant sections in the kernel's memory management subsystem, likely in `mm/percpu.c` or a similar file, to understand how the kernel carves out and manages this per-CPU memory.

My strategy is to first get a firm grasp on the specific BPF map allocation function, `array_map_alloc`, and also the closely related `bpf_array_alloc_percpu` within `kernel/bpf/arraymap.c`. I'll likely be employing tools like `codesearch-definition-source` to quickly jump to the definition of `array_map_alloc` or, if that's not direct enough, I'll resort to a good old `read-file` operation to peruse the source code. This methodical approach will allow me to trace the allocation path, identify how per-CPU regions are requested from the kernel, and ultimately understand the mechanics behind `BPF_MAP_TYPE_PERCPU_ARRAY`'s existence in memory.

map[ContextFile:kernel/bpf/arraymap.c Name:array_map_alloc]

map[SourceCode:  84:	static struct bpf_map *array_map_alloc(union bpf_attr *attr)
  85:	{
  86:		bool percpu = attr->map_type == BPF_MAP_TYPE_PERCPU_ARRAY;
  87:		int numa_node = bpf_map_attr_numa_node(attr);
  88:		u32 elem_size, index_mask, max_entries;
  89:		bool bypass_spec_v1 = bpf_bypass_spec_v1(NULL);
  90:		u64 array_size, mask64;
  91:		struct bpf_array *array;
  92:	
  93:		elem_size = round_up(attr->value_size, 8);
  94:	
  95:		max_entries = attr->max_entries;
  96:	
  97:		/* On 32 bit archs roundup_pow_of_two() with max_entries that has
  98:		 * upper most bit set in u32 space is undefined behavior due to
  99:		 * resulting 1U << 32, so do it manually here in u64 space.
 100:		 */
 101:		mask64 = fls_long(max_entries - 1);
 102:		mask64 = 1ULL << mask64;
 103:		mask64 -= 1;
 104:	
 105:		index_mask = mask64;
 106:		if (!bypass_spec_v1) {
 107:			/* round up array size to nearest power of 2,
 108:			 * since cpu will speculate within index_mask limits
 109:			 */
 110:			max_entries = index_mask + 1;
 111:			/* Check for overflows. */
 112:			if (max_entries < attr->max_entries)
 113:				return ERR_PTR(-E2BIG);
 114:		}
 115:	
 116:		array_size = sizeof(*array);
 117:		if (percpu) {
 118:			array_size += (u64) max_entries * sizeof(void *);
 119:		} else {
 120:			/* rely on vmalloc() to return page-aligned memory and
 121:			 * ensure array->value is exactly page-aligned
 122:			 */
 123:			if (attr->map_flags & BPF_F_MMAPABLE) {
 124:				array_size = PAGE_ALIGN(array_size);
 125:				array_size += PAGE_ALIGN((u64) max_entries * elem_size);
 126:			} else {
 127:				array_size += (u64) max_entries * elem_size;
 128:			}
 129:		}
 130:	
 131:		/* allocate all map elements and zero-initialize them */
 132:		if (attr->map_flags & BPF_F_MMAPABLE) {
 133:			void *data;
 134:	
 135:			/* kmalloc'ed memory can't be mmap'ed, use explicit vmalloc */
 136:			data = bpf_map_area_mmapable_alloc(array_size, numa_node);
 137:			if (!data)
 138:				return ERR_PTR(-ENOMEM);
 139:			array = data + PAGE_ALIGN(sizeof(struct bpf_array))
 140:				- offsetof(struct bpf_array, value);
 141:		} else {
 142:			array = bpf_map_area_alloc(array_size, numa_node);
 143:		}
 144:		if (!array)
 145:			return ERR_PTR(-ENOMEM);
 146:		array->index_mask = index_mask;
 147:		array->map.bypass_spec_v1 = bypass_spec_v1;
 148:	
 149:		/* copy mandatory map attributes */
 150:		bpf_map_init_from_attr(&array->map, attr);
 151:		array->elem_size = elem_size;
 152:	
 153:		if (percpu && bpf_array_alloc_percpu(array)) {
 154:			bpf_map_area_free(array);
 155:			return ERR_PTR(-ENOMEM);
 156:		}
 157:	
 158:		return &array->map;
 159:	}
 SourceFile:kernel/bpf/arraymap.c]

gemini-3.6-flash

							input: 17247
							output: 42
							thoughts: 41
						

**My Thought Process Regarding `bpf_array_alloc_percpu`**

Alright, I need to get a solid understanding of this `bpf_array_alloc_percpu` function. My first instinct is to go straight to the source, so I'm thinking about using a tool like `codesearch-definition-source`. If that doesn't immediately give me what I need, or if I want to cross-reference, I'll broaden my search and just look for instances of `bpf_array_alloc_percpu` across the codebase. This will likely lead me to where it's defined and how it's being used, which is crucial for grasping its functionality and any potential implications.

map[ContextFile:kernel/bpf/arraymap.c Name:bpf_array_alloc_percpu]

map[SourceCode:  33:	static int bpf_array_alloc_percpu(struct bpf_array *array)
  34:	{
  35:		void __percpu *ptr;
  36:		int i;
  37:	
  38:		for (i = 0; i < array->map.max_entries; i++) {
  39:			ptr = bpf_map_alloc_percpu(&array->map, array->elem_size, 8,
  40:						   GFP_USER | __GFP_NOWARN);
  41:			if (!ptr) {
  42:				bpf_array_free_percpu(array);
  43:				return -ENOMEM;
  44:			}
  45:			array->pptrs[i] = ptr;
  46:			cond_resched();
  47:		}
  48:	
  49:		return 0;
  50:	}
 SourceFile:kernel/bpf/arraymap.c]

gemini-3.6-flash

							input: 17582
							output: 42
							thoughts: 248
						

**A Deep Dive into Potential Per-CPU Allocation Pitfalls**

As I examine the `bpf_array_alloc_percpu` function, my attention is immediately drawn to the loop responsible for allocating per-CPU entries for the BPF array. I see the standard pattern: iterate through `max_entries`, attempt to allocate memory for each element using `bpf_map_alloc_percpu`, and store the resulting pointer.

However, a moment of scrutiny reveals a critical detail. My thought process immediately flags the error handling path: `if (!ptr)`. When an allocation fails – which is certainly a possibility, especially under memory pressure – the code executes `bpf_array_free_percpu(array)` before returning `-ENOMEM`.

This triggers a cascade of further inquiry in my mind. My immediate question becomes: "What exactly *does* `bpf_array_free_percpu` do when invoked in this specific error scenario?" I need to understand its behavior when called *after* some, but not necessarily *all*, per-CPU allocations have succeeded. This leads me to dive into the source code for `bpf_array_free_percpu` in `kernel/bpf/arraymap.c`. I'm specifically looking for whether it correctly cleans up any partially allocated per-CPU entries or if there's a potential for resource leaks if an allocation fails mid-loop. My expert intuition suggests this is a common area for subtle bugs, and I need to be absolutely certain of its robustness.

map[ContextFile:kernel/bpf/arraymap.c Name:bpf_array_free_percpu]

map[SourceCode:  23:	static void bpf_array_free_percpu(struct bpf_array *array)
  24:	{
  25:		int i;
  26:	
  27:		for (i = 0; i < array->map.max_entries; i++) {
  28:			free_percpu(array->pptrs[i]);
  29:			cond_resched();
  30:		}
  31:	}
 SourceFile:kernel/bpf/arraymap.c]

gemini-3.6-flash

							input: 18001
							output: 41
							thoughts: 328
						

**My Thought Process Regarding `bpf_array_free_percpu`**

Okay, hold on a second. Before I get too far into this, I need to pause and carefully examine what's happening with `array->pptrs[i]` within the `bpf_array_free_percpu` function. My primary concern here is ensuring we're not dereferencing invalid pointers or causing any memory corruption.

My immediate question is about the initial state of `array->pptrs` when the `array` itself is allocated. Specifically, when it's allocated by functions like `bpf_map_area_alloc` or `bpf_map_area_mmapable_alloc`, what exactly is in `array->pptrs`? Is it zeroed out by default? Or is it left uninitialized? This is crucial because if it's not zeroed, and `bpf_map_area_alloc` is using underlying allocators like `kvzalloc`, `vzalloc`, or `kzalloc` (or even `bpf_map_alloc_mmapable_alloc`), I need to know if those functions guarantee zeroing.

Then, there's the critical scenario: what if the allocation of a per-CPU pointer fails at a specific index `i`? Let's say `ptr = bpf_map_alloc_percpu(...)` returns an error or NULL for the element at index `i`. In this situation, `array->pptrs[i]` might not have been assigned a valid value. It could still hold garbage, or if the entire `array` structure was zeroed during its allocation, it might be NULL. However, if `bpf_map_area_alloc` *doesn't* zero the memory, and the allocation for `array->pptrs[i]` failed *before* any assignment, then `array->pptrs[i]` could be uninitialized, which is a dangerous state.

I'm also considering the loop within `bpf_array_free_percpu`. Does it iterate up to `array->map.max_entries`? If so, and if an allocation failed at some `i`, and `array->pptrs[i]` wasn't properly handled, we could end up trying to free something that was never allocated.

Now, I recall that in the Linux kernel, calling `free_percpu(NULL)` is generally safe and harmless. This is a good piece of knowledge. However, it doesn't entirely alleviate my concern if `array->pptrs[i]` is uninitialized rather than explicitly NULL. The question of whether `array->pptrs` is guaranteed to be zeroed upon allocation is still paramount.

Therefore, to definitively answer these questions and ensure the robustness of `bpf_array_free_percpu`, my next step is to dive into the definition of `bpf_map_area_alloc` and understand precisely how it handles the initialization of `array->pptrs`. I need to see the exact memory allocation and zeroing behavior there.

map[ContextFile:kernel/bpf/arraymap.c Name:bpf_map_area_alloc]

map[SourceCode: 410:	void *bpf_map_area_alloc(u64 size, int numa_node)
 411:	{
 412:		return __bpf_map_area_alloc(size, numa_node, false);
 413:	}
 SourceFile:kernel/bpf/syscall.c]

gemini-3.6-flash

							input: 18451
							output: 41
							thoughts: 15
						

**My Thought Process Regarding `__bpf_map_area_alloc`**

Alright, my immediate priority is to scrutinize the `__bpf_map_area_alloc` function. I need to understand precisely how it handles memory allocation for BPF maps. My focus will be on its internal mechanisms, specifically:

*   **Allocation Strategy:** What underlying allocator is it using? Is it a standard kernel allocator like `kmalloc` or `vmalloc`, or something more specialized for BPF? This is crucial for understanding potential performance characteristics and limitations.
*   **Error Handling:** How does it deal with allocation failures? I'll be looking for robust error checking and appropriate return values to ensure that downstream operations don't proceed with invalid memory pointers.
*   **Sizing and Alignment:** What are the assumptions it makes regarding the size and alignment of map areas? Are there any specific requirements for BPF map data structures that this function enforces?
*   **Context and Scope:** Under what conditions can `__bpf_map_area_alloc` be called? Is it restricted to certain contexts (e.g., module loading, map creation) or can it be invoked more broadly? This will inform how it fits into the overall BPF map lifecycle.
*   **Potential Optimizations/Bottlenecks:** Are there any obvious areas where this allocation could become a performance bottleneck, especially under high concurrency or for very large maps? Conversely, are there any clever optimizations I should be aware of?
*   **Security Implications:** Does the allocation process introduce any potential security vulnerabilities, such as race conditions or improper memory sanitization?

By thoroughly examining these aspects of `__bpf_map_area_alloc`, I aim to gain a deep and comprehensive understanding of its role and behavior within the BPF subsystem, which is essential for my work as an expert in this domain.

map[ContextFile:kernel/bpf/syscall.c Name:__bpf_map_area_alloc]

map[SourceCode: 369:	/* Please, do not use this function outside from the map creation path
 370:	 * (e.g. in map update path) without taking care of setting the active
 371:	 * memory cgroup (see at bpf_map_kmalloc_node() for example).
 372:	 */
 373:	static void *__bpf_map_area_alloc(u64 size, int numa_node, bool mmapable)
 374:	{
 375:		/* We really just want to fail instead of triggering OOM killer
 376:		 * under memory pressure, therefore we set __GFP_NORETRY to kmalloc,
 377:		 * which is used for lower order allocation requests.
 378:		 *
 379:		 * It has been observed that higher order allocation requests done by
 380:		 * vmalloc with __GFP_NORETRY being set might fail due to not trying
 381:		 * to reclaim memory from the page cache, thus we set
 382:		 * __GFP_RETRY_MAYFAIL to avoid such situations.
 383:		 */
 384:	
 385:		gfp_t gfp = bpf_memcg_flags(__GFP_NOWARN | __GFP_ZERO);
 386:		unsigned int flags = 0;
 387:		unsigned long align = 1;
 388:		void *area;
 389:	
 390:		if (size >= SIZE_MAX)
 391:			return NULL;
 392:	
 393:		/* kmalloc()'ed memory can't be mmap()'ed */
 394:		if (mmapable) {
 395:			BUG_ON(!PAGE_ALIGNED(size));
 396:			align = SHMLBA;
 397:			flags = VM_USERMAP;
 398:		} else if (size <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER)) {
 399:			area = kmalloc_node(size, gfp | GFP_USER | __GFP_NORETRY,
 400:					    numa_node);
 401:			if (area != NULL)
 402:				return area;
 403:		}
 404:	
 405:		return __vmalloc_node_range(size, align, VMALLOC_START, VMALLOC_END,
 406:				gfp | GFP_KERNEL | __GFP_RETRY_MAYFAIL, PAGE_KERNEL,
 407:				flags, numa_node, __builtin_return_address(0));
 408:	}
 SourceFile:kernel/bpf/syscall.c]

gemini-3.6-flash

							input: 19195
							output: 33
							thoughts: 231
						

**My Thought Process Regarding PerCPU Memory Allocation and Fault Injection with BPF**

Right, so my initial observation is that `__bpf_map_area_alloc` is using `__GFP_ZERO`. This means that any array allocated through it is going to be zero-initialized. That's a good, solid starting point.

However, this immediately triggers a chain of questions in my mind, especially concerning the interplay of percpu memory, fault injection, and specifically, `BPF_MAP_TYPE_PERCPU_ARRAY`. My primary concern is: does this zero-initialization, coupled with the potential for fault injection into percpu allocations, create a subtle bug or race condition? I need to explore if there are any edge cases where this might go wrong.

To get to the bottom of this, I know I need to dig into the kernel's history and current state. My immediate thought is to cast a wide net through various sources. I'm thinking about checking kernel git commits for any related changes or bug fixes. Simultaneously, I'll be looking at syzkaller issues, as that's an invaluable source for finding kernel bugs, especially those related to memory management and error handling. I also need to scan the Linux Kernel Mailing List (LKML) discussions; often, the nuances of complex interactions like this are debated there. Of course, direct examination of the kernel code itself is paramount.

My search terms are going to be quite specific. I'm looking for anything related to:
*   Fault injection in general.
*   Percpu memory allocations, particularly the mechanics of `pcpu_alloc`.
*   The concept of "pcpu chunks" – how percpu data is physically laid out.
*   The specific `BPF_MAP_TYPE_PERCPU_ARRAY` type.
*   Scenarios of percpu exhaustion, which could be a trigger for fault injection to become relevant.

To facilitate this deep dive, I'll be leveraging `git grep` and general grepper tools across the kernel source tree. I'm not just looking for simple mentions; I'm trying to find the *context* where these components interact.

More specifically, I'll refine my searches to include terms like:
*   `pcpu_alloc` and `fault_injection`.
*   Direct references to fault injection mechanisms like `FAIL_PAGE_ALLOC`, `FAIL_SLAB`, and crucially, `FAIL_PERCPU` (if it exists or similar concepts).
*   Any reported issues or discussions around problems with `pcpu_alloc` or the handling of `percpu` chunks, especially in the context of allocation failures.

Finally, I'll narrow my focus to the core percpu allocation code itself. I'll be doing targeted `git grep` operations within `mm/percpu.c` and relevant header files in `include/linux/` that deal with percpu management and potential error paths. I'm specifically looking for any code that might interact with the fault injection framework and how it handles `pcpu` allocations, or conversely, how `pcpu` allocations might be susceptible to faults.

map[Expression:pcpu.*fault|fault.*pcpu|percpu.*fault|fault.*percpu]

map[Output:arch/x86/mm/cpu_entry_area.c=167=static void __init percpu_setup_exception_stacks(unsigned int cpu)
--
arch/x86/mm/cpu_entry_area.c-170-
arch/x86/mm/cpu_entry_area.c:171:	cea_map_percpu_pages(&cea->doublefault_stack,
arch/x86/mm/cpu_entry_area.c-172-			     &per_cpu(doublefault_stack, cpu), 1, PAGE_KERNEL);
--
fs/xfs/xfs_mount.c=1639=xfs_clear_incompat_log_features(
--
fs/xfs/xfs_mount.c-1673- * counter update (i.e. batching).  Each change to delayed allocation
fs/xfs/xfs_mount.c:1674: * reservations can change can easily exceed the default percpu counter
fs/xfs/xfs_mount.c-1675- * batching, so we use a larger batch factor here.
--
mm/percpu.c-112-#ifdef CONFIG_SMP
mm/percpu.c:113:/* default addr <-> pcpu_ptr mapping, override in asm/percpu.h if necessary */
mm/percpu.c-114-#ifndef __addr_to_pcpu_ptr
--
tools/testing/selftests/bpf/progs/map_ptr_kern.c=213=static inline int check_percpu_hash(void)
--
tools/testing/selftests/bpf/progs/map_ptr_kern.c-217-
tools/testing/selftests/bpf/progs/map_ptr_kern.c:218:	VERIFY(check_default(&percpu_hash->map, map));
tools/testing/selftests/bpf/progs/map_ptr_kern.c-219-
--
tools/testing/selftests/bpf/progs/map_ptr_kern.c=230=static inline int check_percpu_array(void)
--
tools/testing/selftests/bpf/progs/map_ptr_kern.c-234-
tools/testing/selftests/bpf/progs/map_ptr_kern.c:235:	VERIFY(check_default(&percpu_array->map, map));
tools/testing/selftests/bpf/progs/map_ptr_kern.c-236-
--
tools/testing/selftests/bpf/progs/map_ptr_kern.c=304=static inline int check_lru_percpu_hash(void)
--
tools/testing/selftests/bpf/progs/map_ptr_kern.c-308-
tools/testing/selftests/bpf/progs/map_ptr_kern.c:309:	VERIFY(check_default(&lru_percpu_hash->map, map));
tools/testing/selftests/bpf/progs/map_ptr_kern.c-310-
--
tools/testing/selftests/mm/test_vmalloc.sh=14=NUM_CPUS=`grep -c ^processor /proc/cpuinfo`
tools/testing/selftests/mm/test_vmalloc.sh-15-
tools/testing/selftests/mm/test_vmalloc.sh:16:# Default number of times we allocate percpu objects:
tools/testing/selftests/mm/test_vmalloc.sh-17-NR_PCPU_OBJECTS=35000
]

gemini-3.6-flash

							input: 20358
							output: 34
							thoughts: 187
						

**My Thought Process on Per-CPU Allocation and Fault Injection**

My current focus is on understanding the intricate workings of per-CPU memory allocation, specifically within the context of the Linux kernel. I'm particularly interested in how `BPF_MAP_TYPE_PERCPU_ARRAY` interacts with the underlying per-CPU chunking mechanisms. My immediate goal is to investigate the behavior of these systems when faced with resource constraints, such as the exhaustion of available per-CPU chunks.

To achieve this, I've formulated a search strategy targeting keywords that are likely to reveal critical paths and potential failure modes. This includes terms like "percpu chunks," "exhaust," and variations of memory allocation functions such as `pcpu_alloc`, `pcpu_create_chunk`, and `pcpu_alloc_first_chunk`. My aim is to identify any scenarios where these allocations might fail or behave unexpectedly.

A crucial aspect of my investigation involves simulating failure conditions to understand the system's resilience and error handling. Therefore, I'm also looking for evidence of "fault injection" techniques, specifically those related to memory allocation, which would likely be indicated by keywords like `should_failslab` and `should_fail_alloc_page`. This will allow me to probe how the kernel responds to out-of-memory conditions or other allocation failures within the per-CPU subsystem.

To delve deeper into the implementation details, I intend to meticulously examine the `mm/percpu.c` source file. My approach will be to specifically search for the `pcpu_alloc` function within this file, using tools like `codesearch-definition-source` or `read-file` to gain direct access to its code. By studying `pcpu_alloc`, I expect to gain clarity on the entire allocation process, including how new per-CPU chunks are created, what logic governs their exhaustion, and the precise mechanisms employed when fault injection is active. I want to understand the full lifecycle of `pcpu_alloc` – its successes, its failures, and the subsequent actions taken by the kernel.

map[ContextFile:mm/percpu.c Name:pcpu_alloc]

map[SourceCode: 249:	static struct debug_obj *pcpu_alloc(void)
 250:	{
 251:		struct obj_pool *pcp = this_cpu_ptr(&pool_pcpu);
 252:	
 253:		lockdep_assert_irqs_disabled();
 254:	
 255:		for (;;) {
 256:			struct debug_obj *obj = __alloc_object(&pcp->objects);
 257:	
 258:			if (likely(obj)) {
 259:				pcp->cnt--;
 260:				/*
 261:				 * If this emptied a batch try to refill from the
 262:				 * free pool. Don't do that if this was the top-most
 263:				 * batch as pcpu_free() expects the per CPU pool
 264:				 * to be less than ODEBUG_POOL_PERCPU_SIZE.
 265:				 */
 266:				if (unlikely(pcp->cnt < (ODEBUG_POOL_PERCPU_SIZE - ODEBUG_BATCH_SIZE) &&
 267:					     !(pcp->cnt % ODEBUG_BATCH_SIZE))) {
 268:					/*
 269:					 * Don't try to allocate from the regular pool here
 270:					 * to not exhaust it prematurely.
 271:					 */
 272:					if (pool_count(&pool_to_free)) {
 273:						guard(raw_spinlock)(&pool_lock);
 274:						pool_move_batch(pcp, &pool_to_free);
 275:						pcpu_refill_stats();
 276:					}
 277:				}
 278:				return obj;
 279:			}
 280:	
 281:			guard(raw_spinlock)(&pool_lock);
 282:			if (!pool_move_batch(pcp, &pool_to_free)) {
 283:				if (!pool_move_batch(pcp, &pool_global))
 284:					return NULL;
 285:			}
 286:			pcpu_refill_stats();
 287:		}
 288:	}
 SourceFile:lib/debugobjects.c]

gemini-3.6-flash

							input: 21178
							output: 31
							thoughts: 65
						

**The Percpu Allocation Dilemma**

My mind is currently grappling with a specific detail in the codebase. I've just realized that a function named `pcpu_alloc`, which I found in `lib/debugobjects.c`, was flagged not due to any intrinsic problem with its logic or implementation, but rather because of a simple name collision. This means there's likely another function with the exact same name elsewhere in the system. My immediate next step is to pinpoint the *original* or *intended* `pcpu_alloc` function. My hypothesis is that the one in `mm/percpu.c` is the true source, and I need to confirm this. Therefore, I'm going to perform a targeted search within `mm/percpu.c` specifically for the identifier `pcpu_alloc` to locate its definition and understand its context. This will be crucial to resolving the naming conflict and ensuring the correct function is being referenced and utilized.

log-in to see details

map[Expression:pcpu_alloc\( PathPrefix:mm/percpu.c]

map[Output:]

gemini-3.6-flash

							input: 21272
							output: 42
							thoughts: 28
						

**My Thought Process on Optimizing Per-CPU Allocations**

Here I am, diving into the core of memory management, specifically how we handle per-CPU data structures. My immediate instinct is to find the heart of per-CPU allocation logic. I know that `pcpu_alloc` or `__alloc_percpu` are likely candidates for the functions responsible for this, and given their importance, I'd expect to find them within the `mm/percpu.c` file. This is where the kernel's memory management routines for per-CPU allocations are most likely to reside, so that's where I'm directing my search. I'm looking to understand the mechanics of how memory is carved out and managed for each individual processor, aiming to identify any potential inefficiencies or areas ripe for optimization.

map[Expression:alloc_percpu|pcpu_alloc|pcpu_create_chunk PathPrefix:mm/percpu.c]

map[Output:mm/percpu.c=171=DEFINE_SPINLOCK(pcpu_lock);	/* all internal data structures */
mm/percpu.c:172:static DEFINE_MUTEX(pcpu_alloc_mutex);	/* chunk create/destroy, [de]pop, map ext */
mm/percpu.c-173-
--
mm/percpu.c=630=static void pcpu_block_update(struct pcpu_block_md *block, int start, int end)
--
mm/percpu.c-702- * Finding the final allocation spot first goes through pcpu_find_block_fit()
mm/percpu.c:703: * to find a block that can hold the allocation and then pcpu_alloc_area()
mm/percpu.c-704- * where a scan is used.  When allocations require specific alignments,
--
mm/percpu.c=1161=static unsigned long pcpu_find_zero_area(unsigned long *map,
--
mm/percpu.c-1197-/**
mm/percpu.c:1198: * pcpu_alloc_area - allocates an area from a pcpu_chunk
mm/percpu.c-1199- * @chunk: chunk of interest
--
mm/percpu.c-1215- */
mm/percpu.c:1216:static int pcpu_alloc_area(struct pcpu_chunk *chunk, int alloc_bits,
mm/percpu.c-1217-			   size_t align, int start)
--
mm/percpu.c=1325=static void pcpu_init_md_blocks(struct pcpu_chunk *chunk)
--
mm/percpu.c-1338-/**
mm/percpu.c:1339: * pcpu_alloc_first_chunk - creates chunks that serve the first chunk
mm/percpu.c-1340- * @tmp_addr: the start of the region served
--
mm/percpu.c-1350- */
mm/percpu.c:1351:static struct pcpu_chunk * __init pcpu_alloc_first_chunk(unsigned long tmp_addr,
mm/percpu.c-1352-							 int map_size)
--
mm/percpu.c-1430-
mm/percpu.c:1431:static struct pcpu_chunk *pcpu_alloc_chunk(gfp_t gfp)
mm/percpu.c-1432-{
--
mm/percpu.c=1537=static void pcpu_chunk_depopulated(struct pcpu_chunk *chunk,
--
mm/percpu.c-1561- * pcpu_post_unmap_tlb_flush	- flush tlb for the specified range of a chunk
mm/percpu.c:1562: * pcpu_create_chunk		- create a new chunk
mm/percpu.c-1563- * pcpu_destroy_chunk		- destroy a chunk, always preceded by full depop
--
mm/percpu.c=1571=static void pcpu_post_unmap_tlb_flush(struct pcpu_chunk *chunk,
mm/percpu.c-1572-				      int page_start, int page_end);
mm/percpu.c:1573:static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp);
mm/percpu.c-1574-static void pcpu_destroy_chunk(struct pcpu_chunk *chunk);
mm/percpu.c=1575=static struct page *pcpu_addr_to_page(void *addr);
mm/percpu.c:1576:static int __init pcpu_verify_alloc_info(const struct pcpu_alloc_info *ai);
mm/percpu.c-1577-
--
mm/percpu.c=1690=static void pcpu_memcg_free_hook(struct pcpu_chunk *chunk, int off, size_t size)
--
mm/percpu.c-1695-#ifdef CONFIG_MEM_ALLOC_PROFILING
mm/percpu.c:1696:static void pcpu_alloc_tag_alloc_hook(struct pcpu_chunk *chunk, int off,
mm/percpu.c-1697-				      size_t size)
--
mm/percpu.c-1704-
mm/percpu.c:1705:static void pcpu_alloc_tag_free_hook(struct pcpu_chunk *chunk, int off, size_t size)
mm/percpu.c-1706-{
--
mm/percpu.c-1710-#else
mm/percpu.c:1711:static void pcpu_alloc_tag_alloc_hook(struct pcpu_chunk *chunk, int off,
mm/percpu.c-1712-				      size_t size)
--
mm/percpu.c-1715-
mm/percpu.c:1716:static void pcpu_alloc_tag_free_hook(struct pcpu_chunk *chunk, int off, size_t size)
mm/percpu.c-1717-{
--
mm/percpu.c-1721-/**
mm/percpu.c:1722: * pcpu_alloc - the percpu allocator
mm/percpu.c-1723- * @size: size of area to allocate in bytes
--
mm/percpu.c-1735- */
mm/percpu.c:1736:void __percpu *pcpu_alloc_noprof(size_t size, size_t align, bool reserved,
mm/percpu.c-1737-				 gfp_t gfp)
--
mm/percpu.c-1786-		if (gfp & __GFP_NOFAIL) {
mm/percpu.c:1787:			mutex_lock(&pcpu_alloc_mutex);
mm/percpu.c:1788:		} else if (mutex_lock_killable(&pcpu_alloc_mutex)) {
mm/percpu.c-1789-			pcpu_memcg_post_alloc_hook(objcg, NULL, 0, size);
--
mm/percpu.c-1805-
mm/percpu.c:1806:		off = pcpu_alloc_area(chunk, bits, bit_align, off);
mm/percpu.c-1807-		if (off >= 0)
--
mm/percpu.c-1826-
mm/percpu.c:1827:			off = pcpu_alloc_area(chunk, bits, bit_align, off);
mm/percpu.c-1828-			if (off >= 0) {
--
mm/percpu.c-1843-	if (list_empty(&pcpu_chunk_lists[pcpu_free_slot])) {
mm/percpu.c:1844:		chunk = pcpu_create_chunk(pcpu_gfp);
mm/percpu.c-1845-		if (!chunk) {
--
mm/percpu.c-1887-
mm/percpu.c:1888:		mutex_unlock(&pcpu_alloc_mutex);
mm/percpu.c-1889-	}
--
mm/percpu.c-1895-	ptr = __addr_to_pcpu_ptr(chunk->base_addr + off);
mm/percpu.c:1896:	kmemleak_alloc_percpu(ptr, size, gfp);
mm/percpu.c-1897-
mm/percpu.c:1898:	trace_percpu_alloc_percpu(_RET_IP_, reserved, is_atomic, size, align,
mm/percpu.c-1899-				  chunk->base_addr, off, ptr,
--
mm/percpu.c-1903-
mm/percpu.c:1904:	pcpu_alloc_tag_alloc_hook(chunk, off, size);
mm/percpu.c-1905-
--
mm/percpu.c-1910-fail:
mm/percpu.c:1911:	trace_percpu_alloc_percpu_fail(reserved, is_atomic, size, align);
mm/percpu.c-1912-
--
mm/percpu.c-1930-	} else {
mm/percpu.c:1931:		mutex_unlock(&pcpu_alloc_mutex);
mm/percpu.c-1932-	}
--
mm/percpu.c-1937-}
mm/percpu.c:1938:EXPORT_SYMBOL_GPL(pcpu_alloc_noprof);
mm/percpu.c-1939-
--
mm/percpu.c=2005=static void pcpu_balance_populated(void)
--
mm/percpu.c-2049-
mm/percpu.c:2050:		/* @chunk can't go away while pcpu_alloc_mutex is held */
mm/percpu.c-2051-		for_each_clear_bitrange(rs, re, chunk->populated, chunk->nr_pages) {
--
mm/percpu.c-2072-		spin_unlock_irq(&pcpu_lock);
mm/percpu.c:2073:		chunk = pcpu_create_chunk(gfp);
mm/percpu.c-2074-		cond_resched();
--
mm/percpu.c=2196=static void pcpu_balance_workfn(struct work_struct *work)
--
mm/percpu.c-2204-	 *
mm/percpu.c:2205:	 * Enforce GFP_NOIO allocations because we have pcpu_alloc users
mm/percpu.c-2206-	 * constrained to GFP_NOIO/NOFS contexts and they could form lock
mm/percpu.c:2207:	 * dependency through pcpu_alloc_mutex
mm/percpu.c-2208-	 */
mm/percpu.c-2209-	unsigned int flags = memalloc_noio_save();
mm/percpu.c:2210:	mutex_lock(&pcpu_alloc_mutex);
mm/percpu.c-2211-	spin_lock_irq(&pcpu_lock);
--
mm/percpu.c-2218-	spin_unlock_irq(&pcpu_lock);
mm/percpu.c:2219:	mutex_unlock(&pcpu_alloc_mutex);
mm/percpu.c-2220-	memalloc_noio_restore(flags);
--
mm/percpu.c=2232=void free_percpu(void __percpu *ptr)
--
mm/percpu.c-2258-
mm/percpu.c:2259:	pcpu_alloc_tag_free_hook(chunk, off, size);
mm/percpu.c-2260-
--
mm/percpu.c=2354=phys_addr_t per_cpu_ptr_to_phys(void *addr)
--
mm/percpu.c-2398-/**
mm/percpu.c:2399: * pcpu_alloc_alloc_info - allocate percpu allocation info
mm/percpu.c-2400- * @nr_groups: the number of groups
--
mm/percpu.c-2409- * RETURNS:
mm/percpu.c:2410: * Pointer to the allocated pcpu_alloc_info on success, NULL on
mm/percpu.c-2411- * failure.
mm/percpu.c-2412- */
mm/percpu.c:2413:struct pcpu_alloc_info * __init pcpu_alloc_alloc_info(int nr_groups,
mm/percpu.c-2414-						      int nr_units)
mm/percpu.c-2415-{
mm/percpu.c:2416:	struct pcpu_alloc_info *ai;
mm/percpu.c-2417-	size_t base_size, ai_size;
--
mm/percpu.c-2443- * pcpu_free_alloc_info - free percpu allocation info
mm/percpu.c:2444: * @ai: pcpu_alloc_info to free
mm/percpu.c-2445- *
mm/percpu.c:2446: * Free @ai which was allocated by pcpu_alloc_alloc_info().
mm/percpu.c-2447- */
mm/percpu.c:2448:void __init pcpu_free_alloc_info(struct pcpu_alloc_info *ai)
mm/percpu.c-2449-{
--
mm/percpu.c-2453-/**
mm/percpu.c:2454: * pcpu_dump_alloc_info - print out information about pcpu_alloc_info
mm/percpu.c-2455- * @lvl: loglevel
--
mm/percpu.c=2460=static void pcpu_dump_alloc_info(const char *lvl,
mm/percpu.c:2461:				 const struct pcpu_alloc_info *ai)
mm/percpu.c-2462-{
--
mm/percpu.c-2511- * pcpu_setup_first_chunk - initialize the first percpu chunk
mm/percpu.c:2512: * @ai: pcpu_alloc_info describing how to percpu area is shaped
mm/percpu.c-2513- * @base_addr: mapped address
--
mm/percpu.c-2563- */
mm/percpu.c:2564:void __init pcpu_setup_first_chunk(const struct pcpu_alloc_info *ai,
mm/percpu.c-2565-				   void *base_addr)
--
mm/percpu.c-2716-	if (ai->reserved_size)
mm/percpu.c:2717:		pcpu_reserved_chunk = pcpu_alloc_first_chunk(tmp_addr,
mm/percpu.c-2718-						ai->reserved_size);
mm/percpu.c-2719-	tmp_addr = (unsigned long)base_addr + static_size + ai->reserved_size;
mm/percpu.c:2720:	pcpu_first_chunk = pcpu_alloc_first_chunk(tmp_addr, dyn_size);
mm/percpu.c-2721-
--
mm/percpu.c=2765=early_param("percpu_alloc", percpu_alloc_setup);
--
mm/percpu.c-2804- */
mm/percpu.c:2805:static struct pcpu_alloc_info * __init __flatten pcpu_build_alloc_info(
mm/percpu.c-2806-				size_t reserved_size, size_t dyn_size,
--
mm/percpu.c-2818-	unsigned int cpu, tcpu;
mm/percpu.c:2819:	struct pcpu_alloc_info *ai;
mm/percpu.c-2820-	unsigned int *cpu_map;
--
mm/percpu.c-2908-
mm/percpu.c:2909:	ai = pcpu_alloc_alloc_info(nr_groups, nr_units);
mm/percpu.c-2910-	if (!ai)
--
mm/percpu.c=3016=int __init pcpu_embed_first_chunk(size_t reserved_size, size_t dyn_size,
--
mm/percpu.c-3022-	void **areas = NULL;
mm/percpu.c:3023:	struct pcpu_alloc_info *ai;
mm/percpu.c-3024-	size_t size_sum, areas_size;
--
mm/percpu.c=3194=int __init pcpu_page_first_chunk(size_t reserved_size, pcpu_fc_cpu_to_node_fn_t cpu_to_nd_fn)
--
mm/percpu.c-3196-	static struct vm_struct vm;
mm/percpu.c:3197:	struct pcpu_alloc_info *ai;
mm/percpu.c-3198-	char psize_str[16];
--
mm/percpu.c=3334=void __init setup_per_cpu_areas(void)
--
mm/percpu.c-3338-					 PERCPU_DYNAMIC_RESERVE));
mm/percpu.c:3339:	struct pcpu_alloc_info *ai;
mm/percpu.c-3340-	void *fc;
mm/percpu.c-3341-
mm/percpu.c:3342:	ai = pcpu_alloc_alloc_info(1, 1);
mm/percpu.c-3343-	fc = memblock_alloc_from(unit_size, PAGE_SIZE, __pa(MAX_DMA_ADDRESS));
]

gemini-3.6-flash

							input: 25709
							output: 36
							thoughts: 68
						

**My Per-CPU Allocation Exploration**

Alright, I've decided to dive into the heart of per-CPU memory management in the kernel. My immediate focus is on understanding how per-CPU data is allocated and structured. To do that, I've pinpointed two key functions in `mm/percpu.c`: `pcpu_alloc_noprof` and `pcpu_create_chunk`. I'm specifically interested in the mechanics of these functions, how they carve out and manage these special per-CPU memory regions. To get a clear view, I'm going to use the `read-file` command to examine the source code. I'll be looking at the section around line 1736, which I suspect will shed light on `pcpu_alloc_noprof`, and then jump to line 1840, where I anticipate finding the implementation details of `pcpu_create_chunk`. My goal here is to get a granular understanding of the allocation strategy and the underlying chunk management.

map[File:mm/percpu.c FirstLine:1736 LineCount:100]

map[Contents:1736:	void __percpu *pcpu_alloc_noprof(size_t size, size_t align, bool reserved,
1737:					 gfp_t gfp)
1738:	{
1739:		gfp_t pcpu_gfp;
1740:		bool is_atomic;
1741:		bool do_warn;
1742:		struct obj_cgroup *objcg = NULL;
1743:		static atomic_t warn_limit = ATOMIC_INIT(10);
1744:		struct pcpu_chunk *chunk, *next;
1745:		const char *err;
1746:		int slot, off, cpu, ret;
1747:		unsigned long flags;
1748:		void __percpu *ptr;
1749:		size_t bits, bit_align;
1750:	
1751:		gfp = current_gfp_context(gfp);
1752:		/* whitelisted flags that can be passed to the backing allocators */
1753:		pcpu_gfp = gfp & (GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN);
1754:		is_atomic = !gfpflags_allow_blocking(gfp);
1755:		do_warn = !(gfp & __GFP_NOWARN);
1756:	
1757:		/*
1758:		 * There is now a minimum allocation size of PCPU_MIN_ALLOC_SIZE,
1759:		 * therefore alignment must be a minimum of that many bytes.
1760:		 * An allocation may have internal fragmentation from rounding up
1761:		 * of up to PCPU_MIN_ALLOC_SIZE - 1 bytes.
1762:		 */
1763:		if (unlikely(align < PCPU_MIN_ALLOC_SIZE))
1764:			align = PCPU_MIN_ALLOC_SIZE;
1765:	
1766:		size = ALIGN(size, PCPU_MIN_ALLOC_SIZE);
1767:		bits = size >> PCPU_MIN_ALLOC_SHIFT;
1768:		bit_align = align >> PCPU_MIN_ALLOC_SHIFT;
1769:	
1770:		if (unlikely(!size || size > PCPU_MIN_UNIT_SIZE || align > PAGE_SIZE ||
1771:			     !is_power_of_2(align))) {
1772:			WARN(do_warn, "illegal size (%zu) or align (%zu) for percpu allocation\n",
1773:			     size, align);
1774:			return NULL;
1775:		}
1776:	
1777:		if (unlikely(!pcpu_memcg_pre_alloc_hook(size, gfp, &objcg)))
1778:			return NULL;
1779:	
1780:		if (!is_atomic) {
1781:			/*
1782:			 * pcpu_balance_workfn() allocates memory under this mutex,
1783:			 * and it may wait for memory reclaim. Allow current task
1784:			 * to become OOM victim, in case of memory pressure.
1785:			 */
1786:			if (gfp & __GFP_NOFAIL) {
1787:				mutex_lock(&pcpu_alloc_mutex);
1788:			} else if (mutex_lock_killable(&pcpu_alloc_mutex)) {
1789:				pcpu_memcg_post_alloc_hook(objcg, NULL, 0, size);
1790:				return NULL;
1791:			}
1792:		}
1793:	
1794:		spin_lock_irqsave(&pcpu_lock, flags);
1795:	
1796:		/* serve reserved allocations from the reserved chunk if available */
1797:		if (reserved && pcpu_reserved_chunk) {
1798:			chunk = pcpu_reserved_chunk;
1799:	
1800:			off = pcpu_find_block_fit(chunk, bits, bit_align, is_atomic);
1801:			if (off < 0) {
1802:				err = "alloc from reserved chunk failed";
1803:				goto fail_unlock;
1804:			}
1805:	
1806:			off = pcpu_alloc_area(chunk, bits, bit_align, off);
1807:			if (off >= 0)
1808:				goto area_found;
1809:	
1810:			err = "alloc from reserved chunk failed";
1811:			goto fail_unlock;
1812:		}
1813:	
1814:	restart:
1815:		/* search through normal chunks */
1816:		for (slot = pcpu_size_to_slot(size); slot <= pcpu_free_slot; slot++) {
1817:			list_for_each_entry_safe(chunk, next, &pcpu_chunk_lists[slot],
1818:						 list) {
1819:				off = pcpu_find_block_fit(chunk, bits, bit_align,
1820:							  is_atomic);
1821:				if (off < 0) {
1822:					if (slot < PCPU_SLOT_FAIL_THRESHOLD)
1823:						pcpu_chunk_move(chunk, 0);
1824:					continue;
1825:				}
1826:	
1827:				off = pcpu_alloc_area(chunk, bits, bit_align, off);
1828:				if (off >= 0) {
1829:					pcpu_reintegrate_chunk(chunk);
1830:					goto area_found;
1831:				}
1832:			}
1833:		}
1834:	
1835:		spin_unlock_irqrestore(&pcpu_lock, flags);
]

gemini-3.6-flash

							input: 27389
							output: 36
							thoughts: 25
						

**A Deep Dive into `mm/percpu.c`: Tracing the Per-CPU Data Allocation Flow**

Alright, let's dive into this section of `mm/percpu.c`, specifically lines 1836 through 1940. My focus here is to understand the mechanics of how per-CPU data is allocated and managed within the kernel. I'm assuming, given my expertise, that the underlying principles of memory management and system architecture are already well-understood. What I'm looking for is the granular detail of *this specific* implementation.

My initial scan of the code is to get a lay of the land. I'm looking for the entry points, the core functions, and how they interact. I see functions that are likely related to allocating and freeing per-CPU areas, and others that seem to handle the registration and de-registration of per-CPU data structures. The presence of macros and inline functions suggests a focus on performance, which is critical in the kernel. I'm anticipating that the code will be dealing with potential race conditions and ensuring that each CPU gets its own distinct memory region.

As I trace the execution flow, I'm paying close attention to the data structures involved. I'm trying to identify how the kernel keeps track of all the per-CPU allocations. What are the key data descriptors? How is the memory for these structures organized? Is it contiguous? Is it managed by the standard page allocator, or is there a specialized allocator at play here? I'm also looking for how the system handles the lifetime of these per-CPU areas – from their creation to their eventual destruction, particularly during module unloading or system shutdown.

I'm particularly interested in the locking mechanisms. Per-CPU data is designed to avoid locks for data access *within* a CPU's local copy, but the management *of* these allocations likely involves locks. I need to understand what mutexes, spinlocks, or other synchronization primitives are used and where. How does the kernel ensure atomicity when allocating or deallocating these shared resources? Are there any potential deadlocks or performance bottlenecks I can identify based on the locking strategy?

Another critical aspect I'm examining is how the system handles NUMA (Non-Uniform Memory Access) architectures. Per-CPU data is inherently sensitive to memory locality. I'm looking for any code that explicitly considers NUMA nodes when allocating per-CPU memory. Does it try to allocate memory on the local node for each CPU? How does it handle cases where a NUMA node might have limited resources?

I'm also thinking about the implications of this code for other parts of the kernel. How do other subsystems interact with these per-CPU allocation functions? Are there common patterns or best practices that are enforced by this API? Understanding these interactions will give me a broader perspective on the role of per-CPU data in the kernel's overall design.

Finally, I'll be looking for any error handling mechanisms. What happens if an allocation fails? How are these failures propagated? Are there graceful fallback mechanisms, or is it an unrecoverable error? This is essential for understanding the robustness of the per-CPU allocation system. By thoroughly dissecting these lines, I aim to build a comprehensive mental model of the per-CPU data allocation lifecycle as implemented in this specific kernel version.

map[File:mm/percpu.c FirstLine:1836 LineCount:100]

map[Contents:1836:	
1837:		if (is_atomic) {
1838:			err = "atomic alloc failed, no space left";
1839:			goto fail;
1840:		}
1841:	
1842:		/* No space left.  Create a new chunk. */
1843:		if (list_empty(&pcpu_chunk_lists[pcpu_free_slot])) {
1844:			chunk = pcpu_create_chunk(pcpu_gfp);
1845:			if (!chunk) {
1846:				err = "failed to allocate new chunk";
1847:				goto fail;
1848:			}
1849:	
1850:			spin_lock_irqsave(&pcpu_lock, flags);
1851:			pcpu_chunk_relocate(chunk, -1);
1852:		} else {
1853:			spin_lock_irqsave(&pcpu_lock, flags);
1854:		}
1855:	
1856:		goto restart;
1857:	
1858:	area_found:
1859:		pcpu_stats_area_alloc(chunk, size);
1860:	
1861:		if (pcpu_nr_empty_pop_pages < PCPU_EMPTY_POP_PAGES_LOW)
1862:			pcpu_schedule_balance_work();
1863:	
1864:		spin_unlock_irqrestore(&pcpu_lock, flags);
1865:	
1866:		/* populate if not all pages are already there */
1867:		if (!is_atomic) {
1868:			unsigned int page_end, rs, re;
1869:	
1870:			rs = PFN_DOWN(off);
1871:			page_end = PFN_UP(off + size);
1872:	
1873:			for_each_clear_bitrange_from(rs, re, chunk->populated, page_end) {
1874:				WARN_ON(chunk->immutable);
1875:	
1876:				ret = pcpu_populate_chunk(chunk, rs, re, pcpu_gfp);
1877:	
1878:				spin_lock_irqsave(&pcpu_lock, flags);
1879:				if (ret) {
1880:					pcpu_free_area(chunk, off);
1881:					err = "failed to populate";
1882:					goto fail_unlock;
1883:				}
1884:				pcpu_chunk_populated(chunk, rs, re);
1885:				spin_unlock_irqrestore(&pcpu_lock, flags);
1886:			}
1887:	
1888:			mutex_unlock(&pcpu_alloc_mutex);
1889:		}
1890:	
1891:		/* clear the areas and return address relative to base address */
1892:		for_each_possible_cpu(cpu)
1893:			memset((void *)pcpu_chunk_addr(chunk, cpu, 0) + off, 0, size);
1894:	
1895:		ptr = __addr_to_pcpu_ptr(chunk->base_addr + off);
1896:		kmemleak_alloc_percpu(ptr, size, gfp);
1897:	
1898:		trace_percpu_alloc_percpu(_RET_IP_, reserved, is_atomic, size, align,
1899:					  chunk->base_addr, off, ptr,
1900:					  pcpu_obj_full_size(size), gfp);
1901:	
1902:		pcpu_memcg_post_alloc_hook(objcg, chunk, off, size);
1903:	
1904:		pcpu_alloc_tag_alloc_hook(chunk, off, size);
1905:	
1906:		return ptr;
1907:	
1908:	fail_unlock:
1909:		spin_unlock_irqrestore(&pcpu_lock, flags);
1910:	fail:
1911:		trace_percpu_alloc_percpu_fail(reserved, is_atomic, size, align);
1912:	
1913:		if (do_warn) {
1914:			int remaining = atomic_dec_if_positive(&warn_limit);
1915:	
1916:			if (remaining >= 0) {
1917:				pr_warn("allocation failed, size=%zu align=%zu atomic=%d, %s\n",
1918:					size, align, is_atomic, err);
1919:				if (!is_atomic)
1920:					dump_stack();
1921:				if (remaining == 0)
1922:					pr_info("limit reached, disable warning\n");
1923:			}
1924:		}
1925:	
1926:		if (is_atomic) {
1927:			/* see the flag handling in pcpu_balance_workfn() */
1928:			pcpu_atomic_alloc_failed = true;
1929:			pcpu_schedule_balance_work();
1930:		} else {
1931:			mutex_unlock(&pcpu_alloc_mutex);
1932:		}
1933:	
1934:		pcpu_memcg_post_alloc_hook(objcg, NULL, 0, size);
1935:	
]

gemini-3.6-flash

							input: 28928
							output: 42
							thoughts: 290
						

**A Deep Dive into Allocation Warning Logic and Potential Inconsistencies**

As I'm analyzing this code, my initial focus is on lines 1913-1925. I'm particularly interested in how allocation failures are being reported and whether there are any safeguards in place to prevent excessive warnings. This block of code, which appears to handle warnings when allocations fail, seems to be controlled by a `do_warn` flag. It decrements a `warn_limit` atomically and only proceeds with the warning if the `remaining` count is non-negative. If `remaining` hits zero, it triggers an informational message indicating the limit has been reached and warnings will be disabled. The logic here suggests a mechanism to cap the number of warnings, which is generally a good practice to avoid overwhelming logs.

However, a thought immediately strikes me as I consider this warning mechanism. I'm recalling that `bpf_array_alloc_percpu` is a function that likely utilizes memory allocation. I'm looking at its call site:

```c
ptr = bpf_map_alloc_percpu(&array->map, array->elem_size, 8, GFP_USER | __GFP_NOWARN);
```

My immediate concern is the `__GFP_NOWARN` flag passed here. This flag explicitly tells the underlying memory allocation functions *not* to issue warnings about allocation failures. This seems to directly contradict the intention of the warning logic I was just examining. If `bpf_map_alloc_percpu` is consistently using `__GFP_NOWARN`, then the `pr_warn` and `pr_info` calls within the `if (do_warn)` block in lines 1913-1925 might never actually be reached for allocations initiated by `bpf_map_alloc_percpu`.

This raises a crucial question: where is `bpf_map_alloc_percpu` defined? I need to trace this function's definition to understand its complete behavior and how it interacts with memory allocation and the potential warning system. I'll use `codesearch-definition-source` to find its definition and investigate if there's an intentional bypass of the warning mechanism or if this is a potential oversight. I'm suspecting that the allocation attempts within `bpf_map_alloc_percpu` might be happening in a way that *silences* the very warnings I'm trying to analyze, leading to a potential gap in error reporting or a misunderstanding of how these failures are truly being handled.

map[ContextFile:kernel/bpf/arraymap.c Name:bpf_map_alloc_percpu]

map[SourceCode: 577:	void __percpu *bpf_map_alloc_percpu(const struct bpf_map *map, size_t size,
 578:					    size_t align, gfp_t flags)
 579:	{
 580:		struct mem_cgroup *memcg, *old_memcg;
 581:		void __percpu *ptr;
 582:	
 583:		bpf_map_memcg_enter(map, &old_memcg, &memcg);
 584:		ptr = __alloc_percpu_gfp(size, align, flags | __GFP_ACCOUNT);
 585:		bpf_map_memcg_exit(old_memcg, memcg);
 586:	
 587:		return ptr;
 588:	}
 SourceFile:kernel/bpf/syscall.c]

gemini-3.6-flash

							input: 29485
							output: 37
							thoughts: 485
						

**My Thought Process Regarding Per-CPU BPF Map Allocation Failures and Fault Injection**

When I looked at the `bpf_map_alloc_percpu` function, I noticed it uses `GFP_USER | __GFP_NOWARN | __GFP_ACCOUNT` flags for memory allocation. This immediately triggered a question: what does the `__GFP_NOWARN` flag actually do in this context? I traced it down to `__alloc_percpu_gfp`, where the `do_warn` variable is calculated as `!(gfp & __GFP_NOWARN)`. Since `__GFP_NOWARN` is indeed set, `do_warn` will be false for these per-CPU array allocations, meaning no immediate warning will be printed on allocation failure.

This led me to a more critical concern: what happens when these per-CPU allocations *do* fail? Specifically, what happens when the underlying per-CPU chunks are exhausted, or when fault injection is active? The `__GFP_NOWARN` flag, while suppressing warnings, doesn't prevent failures.

My mind immediately turned to the kernel's fault injection mechanisms. I started listing the various fault injection frameworks and capabilities I'm aware of: `FAIL_PAGE_ALLOC`, `FAIL_SLAB`, `FAIL_FUTEX`, `FAIL_MAKE_REQUEST`, `FAIL_MEMCG`, `SHOULD_FAIL_ALLOC_PAGE`, and also the more general function error injection (`FAIL_FUNCTION` / `ALLOW_ERROR_INJECTION`).

The crucial question then became: which of these fault injection targets are relevant to per-CPU allocations? I brainstormed the functions involved in per-CPU memory management: `pcpu_alloc`, `pcpu_create_chunk`, and `pcpu_populate_chunk`. I also considered the lower-level memory allocators that these might rely on, such as `vmalloc`, `kmalloc_node`, and `alloc_pages`. I also recalled functions like `should_failslab` which could potentially interfere.

Furthermore, I considered the various interfaces through which fault injection can be enabled: `/sys/kernel/debug/fail_...`, netlink, `/proc/self/fail-nth`, `prctl` with `FAULTH_INJ`, and syscall fault injection. Any of these could potentially trigger a failure during a per-CPU allocation.

Given this complexity and the potential for subtle interactions, my next step was to confirm these assumptions and explore existing knowledge. I decided a comprehensive search was necessary. My planned approach involved using keywords like `BPF_MAP_TYPE_PERCPU_ARRAY`, `percpu`, `fault injection`, `exhaust`, `pcpu`, and `chunk` across various kernel resources. I would look through the kernel mailing list archives for discussions, check syzkaller bug reports for observed failures, review commit messages for changes related to fault injection or per-CPU allocation handling, consult the kernel documentation for any relevant notes, and examine issue trackers.

Finally, to get a practical overview, I planned to use a tool like `grepper` to efficiently search commit messages, code comments, syzbot reports, relevant test cases, and documentation specifically looking for any connections between `BPF_MAP_TYPE_PERCPU_ARRAY`, per-CPU exhaustion, or fault injection scenarios. This systematic approach would help me understand how these components interact and what potential failure modes exist.

log-in to see details

map[Expression:PERCPU_ARRAY.*fault|fault.*PERCPU_ARRAY|percpu.*exhaust|exhaust.*percpu]

map[Output:]

gemini-3.6-flash

							input: 30009
							output: 31
							thoughts: 59
						

**My Thought Process on Refining the Search Strategy**

Initially, my thought was to cast a wider net, exploring the possibility of finding relevant information within Git commit logs or comments, or even within the kernel's test suites. This felt like a reasonable first step to catch any potentially overlooked context. However, I quickly realized that simply broadening the scope might lead to an overwhelming amount of noise.

A more targeted approach seemed necessary. I then pivoted to a more specific keyword search, focusing on terms that I anticipate would be indicative of the area I'm investigating: "percpu" (which points to per-CPU data structures, a common area for performance or memory management concerns), and a set of related terms like "fault injection" (suggesting error handling or robustness testing), "exhaust" (implying resource depletion scenarios), or "chunk" (which could relate to memory allocation or data segmentation).

Crucially, I decided to constrain these targeted keywords to specific directories within the kernel source tree. I reasoned that `Documentation/` would likely contain explanations and design documents, `kernel/` is a broad area but might hold core kernel logic related to these concepts, and `mm/` is the most promising directory for memory management-specific details, which seems highly relevant given the terms I've chosen. This strategic narrowing of the search space, combining specific keywords with targeted directory locations, felt like a much more efficient and likely to yield pertinent results.

map[Expression:percpu.*chunk|chunk.*percpu PathPrefix:mm/]

map[Output:mm/percpu-km.c-2-/*
mm/percpu-km.c:3: * mm/percpu-km.c - kernel memory based chunk allocation
mm/percpu-km.c-4- *
--
mm/percpu-km.c-25- *   kernel memory block using alloc_pages(), memory will be wasted if
mm/percpu-km.c:26: *   chunk size is not aligned.  percpu-km code will whine about it.
mm/percpu-km.c-27- */
--
mm/percpu-km.c-29-#if defined(CONFIG_SMP) && defined(CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK)
mm/percpu-km.c:30:#error "contiguous percpu allocation is incompatible with paged first chunk"
mm/percpu-km.c-31-#endif
--
mm/percpu-km.c=53=static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp)
--
mm/percpu-km.c-81-	pcpu_stats_chunk_alloc();
mm/percpu-km.c:82:	trace_percpu_create_chunk(chunk->base_addr);
mm/percpu-km.c-83-
--
mm/percpu-km.c=87=static void pcpu_destroy_chunk(struct pcpu_chunk *chunk)
--
mm/percpu-km.c-94-	pcpu_stats_chunk_dealloc();
mm/percpu-km.c:95:	trace_percpu_destroy_chunk(chunk->base_addr);
mm/percpu-km.c-96-
--
mm/percpu-stats.c-6- *
mm/percpu-stats.c:7: * Prints statistics about the percpu allocator and backing chunks.
mm/percpu-stats.c-8- */
--
mm/percpu-vm.c-2-/*
mm/percpu-vm.c:3: * mm/percpu-vm.c - vmalloc area based chunk allocation
mm/percpu-vm.c-4- *
--
mm/percpu-vm.c=333=static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp)
--
mm/percpu-vm.c-352-	pcpu_stats_chunk_alloc();
mm/percpu-vm.c:353:	trace_percpu_create_chunk(chunk->base_addr);
mm/percpu-vm.c-354-
--
mm/percpu-vm.c=358=static void pcpu_destroy_chunk(struct pcpu_chunk *chunk)
--
mm/percpu-vm.c-363-	pcpu_stats_chunk_dealloc();
mm/percpu-vm.c:364:	trace_percpu_destroy_chunk(chunk->base_addr);
mm/percpu-vm.c-365-
--
mm/percpu-vm.c=376=static int __init pcpu_verify_alloc_info(const struct pcpu_alloc_info *ai)
--
mm/percpu-vm.c-385- *
mm/percpu-vm.c:386: * This is the entry point for percpu reclaim.  If a chunk qualifies, it is then
mm/percpu-vm.c-387- * isolated and managed in separate lists at the back of pcpu_slot: sidelined
--
mm/percpu.c-64- *
mm/percpu.c:65: * - use pcpu_setup_first_chunk() during percpu area initialization to
mm/percpu.c:66: *   setup the first chunk containing the kernel static percpu area
mm/percpu.c-67- */
--
mm/percpu.c=2232=void free_percpu(void __percpu *ptr)
--
mm/percpu.c-2280-
mm/percpu.c:2281:	trace_percpu_free_percpu(chunk->base_addr, off, ptr);
mm/percpu.c-2282-
--
mm/percpu.c=2326=bool is_kernel_percpu_address(unsigned long addr)
--
mm/percpu.c-2339- *
mm/percpu.c:2340: * percpu allocator has special setup for the first chunk, which currently
mm/percpu.c-2341- * supports either embedding in linear address space or vmalloc mapping,
--
mm/percpu.c-2345- * The addr can be translated simply without checking if it falls into the
mm/percpu.c:2346: * first chunk. But the current code reflects better how percpu allocator
mm/percpu.c-2347- * actually works, and the verification can discover both bugs in percpu
--
mm/percpu.c=2460=static void pcpu_dump_alloc_info(const char *lvl,
--
mm/percpu.c-2510-/**
mm/percpu.c:2511: * pcpu_setup_first_chunk - initialize the first percpu chunk
mm/percpu.c-2512- * @ai: pcpu_alloc_info describing how to percpu area is shaped
--
mm/percpu.c-2514- *
mm/percpu.c:2515: * Initialize the first percpu chunk which contains the kernel static
mm/percpu.c-2516- * percpu area.  This function is to be called from arch percpu area
--
mm/percpu.c-2519- * @ai contains all information necessary to initialize the first
mm/percpu.c:2520: * chunk and prime the dynamic percpu allocator.
mm/percpu.c-2521- *
--
mm/percpu.c=2564=void __init pcpu_setup_first_chunk(const struct pcpu_alloc_info *ai,
--
mm/percpu.c-2728-	pcpu_stats_chunk_alloc();
mm/percpu.c:2729:	trace_percpu_create_chunk(base_addr);
mm/percpu.c-2730-
--
mm/percpu.c=2765=early_param("percpu_alloc", percpu_alloc_setup);
--
mm/percpu.c-2767-/*
mm/percpu.c:2768: * pcpu_embed_first_chunk() is used by the generic percpu setup.
mm/percpu.c-2769- * Build it if needed by the arch config or the generic setup is going
--
mm/percpu.c=2978=static void __init pcpu_fc_free(void *ptr, size_t size)
--
mm/percpu.c-2985-/**
mm/percpu.c:2986: * pcpu_embed_first_chunk - embed the first percpu chunk into bootmem
mm/percpu.c-2987- * @reserved_size: the size of reserved percpu area in bytes
--
mm/percpu.c-2992- *
mm/percpu.c:2993: * This is a helper to ease setting up embedded first percpu chunk and
mm/percpu.c-2994- * can be called where pcpu_setup_first_chunk() is expected.
]

gemini-3.6-flash

							input: 31934
							output: 38
							thoughts: 648
						

**My Thought Process Regarding Per-CPU Array Allocation and Fault Injection**

I've been presented with a scenario involving `BPF_MAP_TYPE_PERCPU_ARRAY` and fault injection, and my primary goal is to dissect this to understand any potential interactions or issues. I'll break down the question into its core components to analyze them individually and then consider their interplay.

First, I recognize that `BPF_MAP_TYPE_PERCPU_ARRAY` is designed for allocating memory that is distinct for each CPU. This is a fundamental characteristic I need to keep in mind.

Second, the question mentions "allocating in a loop to exhaust percpu chunks." This immediately makes me think about the allocation mechanism for per-CPU memory. How does the kernel manage these per-CPU allocations, and what happens when the available space within a per-CPU chunk is consumed? My thought here is to investigate the underlying allocation routines.

Third, the presence of "another thread runs a syscall with fault injection enabled" is a critical variable. Fault injection is designed to simulate memory errors, and its impact on memory allocation and access is something I need to carefully consider, especially in the context of per-CPU allocations.

So, the core question boils down to: "What could go wrong when I'm aggressively trying to fill up per-CPU memory regions using `BPF_MAP_TYPE_PERCPU_ARRAY`, *while* the system is simultaneously being stressed with simulated memory faults via fault injection on another thread?"

To answer this, I need to understand the mechanics of `BPF_MAP_TYPE_PERCPU_ARRAY`'s per-CPU allocation. I've already looked at the BPF layer, specifically `bpf_array_alloc_percpu`. This function iterates and calls `bpf_map_alloc_percpu` for each entry.

Now, the real work begins with `bpf_map_alloc_percpu`, which ultimately leads to the per-CPU subsystem in the kernel. I need to follow this path. My next step is to examine how the kernel's per-CPU allocator (`pcpu_alloc` is the likely candidate here) operates. I'm particularly interested in what happens when it needs to create *new* per-CPU chunks because existing ones are full.

Specifically, I'm looking at `pcpu_alloc` and its logic for finding space. If normal chunks are exhausted, it resorts to `pcpu_create_chunk`. This is where the actual memory for a new per-CPU chunk is requested from the general memory management system.

Therefore, the critical juncture for potential issues is within `pcpu_create_chunk`. This function is responsible for allocating the underlying memory for a new per-CPU chunk. If fault injection is active system-wide or specifically targeting the memory allocation paths, then the `pcpu_create_chunk` call itself could fail.

My reasoning is that if fault injection is enabled, it can cause the underlying memory allocation functions (`kmalloc`, `vmalloc`, or similar memory-allocating kernel primitives) called by `pcpu_create_chunk` to return an error (e.g., NULL or an error code). If this happens, the per-CPU allocator cannot create the necessary chunk, which in turn would lead to `bpf_map_alloc_percpu` failing, and consequently, the `BPF_MAP_TYPE_PERCPU_ARRAY` allocation would fail with an out-of-memory error (`-ENOMEM`). This would directly impact the BPF program trying to set up its per-CPU array.

In essence, the aggressive per-CPU allocation in a loop might be pushing the per-CPU allocator to its limits, making it more likely to hit a scenario where a new chunk needs to be created. If fault injection is concurrently active, it can then sabotage this critical step of creating a new chunk, leading to the observed allocation failure. This is the critical interaction I've identified.

map[ContextFile:mm/percpu-vm.c Name:pcpu_create_chunk]

map[SourceCode: 333:	static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp)
 334:	{
 335:		struct pcpu_chunk *chunk;
 336:		struct vm_struct **vms;
 337:	
 338:		chunk = pcpu_alloc_chunk(gfp);
 339:		if (!chunk)
 340:			return NULL;
 341:	
 342:		vms = pcpu_get_vm_areas(pcpu_group_offsets, pcpu_group_sizes,
 343:					pcpu_nr_groups, pcpu_atom_size);
 344:		if (!vms) {
 345:			pcpu_free_chunk(chunk);
 346:			return NULL;
 347:		}
 348:	
 349:		chunk->data = vms;
 350:		chunk->base_addr = vms[0]->addr - pcpu_group_offsets[0];
 351:	
 352:		pcpu_stats_chunk_alloc();
 353:		trace_percpu_create_chunk(chunk->base_addr);
 354:	
 355:		return chunk;
 356:	}
 SourceFile:mm/percpu-vm.c]

gemini-3.6-flash

							input: 32972
							output: 40
							thoughts: 44
						

**My Thought Process on `pcpu_get_vm_areas`**

Alright, so I'm digging into some code, and a specific function, `pcpu_get_vm_areas`, has caught my eye. My immediate instinct is to understand exactly what this function is doing. It's not enough to just see it called; I need to trace its logic. Therefore, my first concrete action is to initiate a search for `pcpu_get_vm_areas` throughout the codebase. This will allow me to locate its definition and any places where it's being invoked, which is the crucial first step in dissecting its purpose and behavior.

map[ContextFile:mm/percpu-vm.c Name:pcpu_get_vm_areas]

map[SourceCode:4965:	/**
4966:	 * pcpu_get_vm_areas - allocate vmalloc areas for percpu allocator
4967:	 * @offsets: array containing offset of each area
4968:	 * @sizes: array containing size of each area
4969:	 * @nr_vms: the number of areas to allocate
4970:	 * @align: alignment, all entries in @offsets and @sizes must be aligned to this
4971:	 *
4972:	 * Returns: kmalloc'd vm_struct pointer array pointing to allocated
4973:	 *	    vm_structs on success, %NULL on failure
4974:	 *
4975:	 * Percpu allocator wants to use congruent vm areas so that it can
4976:	 * maintain the offsets among percpu areas.  This function allocates
4977:	 * congruent vmalloc areas for it with GFP_KERNEL.  These areas tend to
4978:	 * be scattered pretty far, distance between two areas easily going up
4979:	 * to gigabytes.  To avoid interacting with regular vmallocs, these
4980:	 * areas are allocated from top.
4981:	 *
4982:	 * Despite its complicated look, this allocator is rather simple. It
4983:	 * does everything top-down and scans free blocks from the end looking
4984:	 * for matching base. While scanning, if any of the areas do not fit the
4985:	 * base address is pulled down to fit the area. Scanning is repeated till
4986:	 * all the areas fit and then all necessary data structures are inserted
4987:	 * and the result is returned.
4988:	 */
4989:	struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets,
4990:					     const size_t *sizes, int nr_vms,
4991:					     size_t align)
4992:	{
4993:		const unsigned long vmalloc_start = ALIGN(VMALLOC_START, align);
4994:		const unsigned long vmalloc_end = VMALLOC_END & ~(align - 1);
4995:		struct vmap_area **vas, *va;
4996:		struct vm_struct **vms;
4997:		int area, area2, last_area, term_area;
4998:		unsigned long base, start, size, end, last_end, orig_start, orig_end;
4999:		bool purged = false;
5000:	
5001:		/* verify parameters and allocate data structures */
5002:		BUG_ON(offset_in_page(align) || !is_power_of_2(align));
5003:		for (last_area = 0, area = 0; area < nr_vms; area++) {
5004:			start = offsets[area];
5005:			end = start + sizes[area];
5006:	
5007:			/* is everything aligned properly? */
5008:			BUG_ON(!IS_ALIGNED(offsets[area], align));
5009:			BUG_ON(!IS_ALIGNED(sizes[area], align));
5010:	
5011:			/* detect the area with the highest address */
5012:			if (start > offsets[last_area])
5013:				last_area = area;
5014:	
5015:			for (area2 = area + 1; area2 < nr_vms; area2++) {
5016:				unsigned long start2 = offsets[area2];
5017:				unsigned long end2 = start2 + sizes[area2];
5018:	
5019:				BUG_ON(start2 < end && start < end2);
5020:			}
5021:		}
5022:		last_end = offsets[last_area] + sizes[last_area];
5023:	
5024:		if (vmalloc_end - vmalloc_start < last_end) {
5025:			WARN_ON(true);
5026:			return NULL;
5027:		}
5028:	
5029:		vms = kzalloc_objs(vms[0], nr_vms);
5030:		vas = kzalloc_objs(vas[0], nr_vms);
5031:		if (!vas || !vms)
5032:			goto err_free2;
5033:	
5034:		for (area = 0; area < nr_vms; area++) {
5035:			vas[area] = kmem_cache_zalloc(vmap_area_cachep, GFP_KERNEL);
5036:			vms[area] = kzalloc_obj(struct vm_struct);
5037:			if (!vas[area] || !vms[area])
5038:				goto err_free;
5039:		}
5040:	retry:
5041:		spin_lock(&free_vmap_area_lock);
5042:	
5043:		/* start scanning - we scan from the top, begin with the last area */
5044:		area = term_area = last_area;
5045:		start = offsets[area];
5046:		end = start + sizes[area];
5047:	
5048:		va = pvm_find_va_enclose_addr(vmalloc_end);
5049:		base = pvm_determine_end_from_reverse(&va, align) - end;
5050:	
5051:		while (true) {
5052:			/*
5053:			 * base might have underflowed, add last_end before
5054:			 * comparing.
5055:			 */
5056:			if (base + last_end < vmalloc_start + last_end)
5057:				goto overflow;
5058:	
5059:			/*
5060:			 * Fitting base has not been found.
5061:			 */
5062:			if (va == NULL)
5063:				goto overflow;
5064:	
5065:			/*
5066:			 * If required width exceeds current VA block, move
5067:			 * base downwards and then recheck.
5068:			 */
5069:			if (base + end > va->va_end) {
5070:				base = pvm_determine_end_from_reverse(&va, align) - end;
5071:				term_area = area;
5072:				continue;
5073:			}
5074:	
5075:			/*
5076:			 * If this VA does not fit, move base downwards and recheck.
5077:			 */
5078:			if (base + start < va->va_start) {
5079:				va = node_to_va(rb_prev(&va->rb_node));
5080:				base = pvm_determine_end_from_reverse(&va, align) - end;
5081:				term_area = area;
5082:				continue;
5083:			}
5084:	
5085:			/*
5086:			 * This area fits, move on to the previous one.  If
5087:			 * the previous one is the terminal one, we're done.
5088:			 */
5089:			area = (area + nr_vms - 1) % nr_vms;
5090:			if (area == term_area)
5091:				break;
5092:	
5093:			start = offsets[area];
5094:			end = start + sizes[area];
5095:			va = pvm_find_va_enclose_addr(base + end);
5096:		}
5097:	
5098:		/* we've found a fitting base, insert all va's */
5099:		for (area = 0; area < nr_vms; area++) {
5100:			int ret;
5101:	
5102:			start = base + offsets[area];
5103:			size = sizes[area];
5104:	
5105:			va = pvm_find_va_enclose_addr(start);
5106:			if (WARN_ON_ONCE(va == NULL))
5107:				/* It is a BUG(), but trigger recovery instead. */
5108:				goto recovery;
5109:	
5110:			ret = va_clip(&free_vmap_area_root,
5111:				&free_vmap_area_list, va, start, size);
5112:			if (WARN_ON_ONCE(unlikely(ret)))
5113:				/* It is a BUG(), but trigger recovery instead. */
5114:				goto recovery;
5115:	
5116:			/* Allocated area. */
5117:			va = vas[area];
5118:			va->va_start = start;
5119:			va->va_end = start + size;
5120:		}
5121:	
5122:		spin_unlock(&free_vmap_area_lock);
5123:	
5124:		/* populate the kasan shadow space */
5125:		for (area = 0; area < nr_vms; area++) {
5126:			if (kasan_populate_vmalloc(vas[area]->va_start, sizes[area], GFP_KERNEL))
5127:				goto err_free_shadow;
5128:		}
5129:	
5130:		/* insert all vm's */
5131:		for (area = 0; area < nr_vms; area++) {
5132:			struct vmap_node *vn = addr_to_node(vas[area]->va_start);
5133:	
5134:			spin_lock(&vn->busy.lock);
5135:			insert_vmap_area(vas[area], &vn->busy.root, &vn->busy.head);
5136:			setup_vmalloc_vm(vms[area], vas[area], VM_ALLOC,
5137:					 pcpu_get_vm_areas);
5138:			spin_unlock(&vn->busy.lock);
5139:		}
5140:	
5141:		/*
5142:		 * Mark allocated areas as accessible. Do it now as a best-effort
5143:		 * approach, as they can be mapped outside of vmalloc code.
5144:		 * With hardware tag-based KASAN, marking is skipped for
5145:		 * non-VM_ALLOC mappings, see __kasan_unpoison_vmalloc().
5146:		 */
5147:		kasan_unpoison_vmap_areas(vms, nr_vms, KASAN_VMALLOC_PROT_NORMAL);
5148:	
5149:		kfree(vas);
5150:		return vms;
5151:	
5152:	recovery:
5153:		/*
5154:		 * Remove previously allocated areas. There is no
5155:		 * need in removing these areas from the busy tree,
5156:		 * because they are inserted only on the final step
5157:		 * and when pcpu_get_vm_areas() is success.
5158:		 */
5159:		while (area--) {
5160:			orig_start = vas[area]->va_start;
5161:			orig_end = vas[area]->va_end;
5162:			va = merge_or_add_vmap_area_augment(vas[area], &free_vmap_area_root,
5163:					&free_vmap_area_list);
5164:			if (va)
5165:				kasan_release_vmalloc(orig_start, orig_end,
5166:					va->va_start, va->va_end,
5167:					KASAN_VMALLOC_PAGE_RANGE | KASAN_VMALLOC_TLB_FLUSH);
5168:			vas[area] = NULL;
5169:		}
5170:	
5171:	overflow:
5172:		spin_unlock(&free_vmap_area_lock);
5173:		if (!purged) {
5174:			reclaim_and_purge_vmap_areas();
5175:			purged = true;
5176:	
5177:			/* Before "retry", check if we recover. */
5178:			for (area = 0; area < nr_vms; area++) {
5179:				if (vas[area])
5180:					continue;
5181:	
5182:				vas[area] = kmem_cache_zalloc(
5183:					vmap_area_cachep, GFP_KERNEL);
5184:				if (!vas[area])
5185:					goto err_free;
5186:			}
5187:	
5188:			goto retry;
5189:		}
5190:	
5191:	err_free:
5192:		for (area = 0; area < nr_vms; area++) {
5193:			if (vas[area])
5194:				kmem_cache_free(vmap_area_cachep, vas[area]);
5195:	
5196:			kfree(vms[area]);
5197:		}
5198:	err_free2:
5199:		kfree(vas);
5200:		kfree(vms);
5201:		return NULL;
5202:	
5203:	err_free_shadow:
5204:		spin_lock(&free_vmap_area_lock);
5205:		/*
5206:		 * We release all the vmalloc shadows, even the ones for regions that
5207:		 * hadn't been successfully added. This relies on kasan_release_vmalloc
5208:		 * being able to tolerate this case.
5209:		 */
5210:		for (area = 0; area < nr_vms; area++) {
5211:			orig_start = vas[area]->va_start;
5212:			orig_end = vas[area]->va_end;
5213:			va = merge_or_add_vmap_area_augment(vas[area], &free_vmap_area_root,
5214:					&free_vmap_area_list);
5215:			if (va)
5216:				kasan_release_vmalloc(orig_start, orig_end,
5217:					va->va_start, va->va_end,
5218:					KASAN_VMALLOC_PAGE_RANGE | KASAN_VMALLOC_TLB_FLUSH);
5219:			vas[area] = NULL;
5220:			kfree(vms[area]);
5221:		}
5222:		spin_unlock(&free_vmap_area_lock);
5223:		kfree(vas);
5224:		kfree(vms);
5225:		return NULL;
5226:	}
 SourceFile:mm/vmalloc.c]

gemini-3.6-flash

							input: 37138
							output: 29
							thoughts: 2749
						

**My Thoughts on BPF PERCPU Array Allocation and Fault Injection**

Okay, I've been digging into the intricacies of per-CPU (percpu) memory allocation within the kernel, specifically focusing on how `BPF_MAP_TYPE_PERCPU_ARRAY` interacts with system-wide resource exhaustion and fault injection. My thought process has been a journey of observation, dissection, and questioning.

Initially, I found myself examining the `pcpu_get_vm_areas` function. Lines 5024-5027 (`if (vmalloc_end - vmalloc_start < last_end) { WARN_ON(true); return NULL; }`) and line 5106 (`va = pvm_find_va_enclose_addr(start); if (WARN_ON_ONCE(va == NULL)) goto recovery; ret = va_clip(&free_vmap_area_root, &free_vmap_area_list, va, start, size); if (WARN_ON_ONCE(unlikely(ret))) goto recovery;`) caught my eye. These sections deal with checks and recovery mechanisms related to the virtual memory areas used for percpu allocations, particularly when the available space is constrained. This immediately made me wonder about scenarios where these constraints might be hit.

This led me to revisit `pcpu_alloc_noprof`. I wanted to understand precisely what happens when percpu chunks are exhausted or when allocation attempts fail. I noted that if `pcpu_create_chunk` fails (which can happen due to fault injection or simply running out of vmalloc space/percpu memory), it returns `NULL`. The subsequent `goto fail;` block reveals the error handling: a message is logged, and importantly, a warning is printed *only if `do_warn` is true*.

This "do_warn" flag became a critical point of investigation when I looked at `bpf_array_alloc_percpu`. The call site within `bpf_array_alloc_percpu` is: `ptr = bpf_map_alloc_percpu(&array->map, array->elem_size, 8, GFP_USER | __GFP_NOWARN);`. The presence of `__GFP_NOWARN` here is significant – it means `do_warn` will be false when `bpf_map_alloc_percpu` is called from `bpf_array_alloc_percpu`. Therefore, the `pr_warn` in `pcpu_alloc_noprof` is *not* triggered for `bpf_array_alloc_percpu` allocations.

My next thought was: "Okay, so BPF array allocations don't trigger the general warning, but what about *other* callers in the kernel that might use percpu allocation without `__GFP_NOWARN`?" This led to the core of the user's question: what happens if thread 1 is busy allocating `BPF_MAP_TYPE_PERCPU_ARRAY` maps in a loop, exhausting the system's percpu resources, while thread 2 runs a syscall with fault injection enabled?

I then dove into the allocation logic for `BPF_MAP_TYPE_PERCPU_ARRAY` itself. In `kernel/bpf/arraymap.c`, I saw `if (percpu && bpf_array_alloc_percpu(array)) { ... return ERR_PTR(-ENOMEM); }`. If `bpf_array_alloc_percpu` fails, it returns `-ENOMEM`. Inside `bpf_array_alloc_percpu`, the loop iterates through `array->map.max_entries`. If `bpf_map_alloc_percpu` fails for an element (say, at index `i`), the code calls `bpf_array_free_percpu(array)`. My analysis of `bpf_array_free_percpu` showed that it iterates from `0` to `max_entries - 1`, freeing already allocated percpu pointers. Crucially, since the `array` structure was zero-initialized by `__bpf_map_area_alloc`, any `array->pptrs[j]` where `j >= i` will be `NULL`, and `free_percpu(NULL)` is a no-op. This confirmed that the cleanup on partial allocation failure within `bpf_array_alloc_percpu` is safe and clean.

This realization led me to re-read the question very carefully. If the cleanup is safe, what *is* the potential issue? Is it simply that allocations will fail with `-ENOMEM`, or is there something more insidious? I started considering the interaction:

*   **Thread A (Exhausting percpu):** Allocates `BPF_MAP_TYPE_PERCPU_ARRAY` maps in a loop. Each map creation involves multiple calls to `bpf_map_alloc_percpu`. As these calls succeed, they consume percpu chunks. Eventually, `pcpu_create_chunk` will fail or `pcpu_get_vm_areas` will detect insufficient space. This causes `bpf_map_alloc_percpu` to return `NULL`, leading to `bpf_array_alloc_percpu` returning `-ENOMEM`, and ultimately, the map creation syscall returning `-ENOMEM`. This process, while consuming resources, seems to fail gracefully.
*   **Thread B (Fault Injection):** Runs a syscall. Fault injection can cause various memory allocations (page allocation, slab allocation, etc.) within that syscall to fail.

The crucial question for me became: does fault injection, when enabled during a syscall, somehow interfere with or corrupt the *ongoing* percpu allocation attempts by Thread A, or vice-versa, leading to a state where percpu resources, once exhausted, cannot be reclaimed, or where the system becomes unstable?

My current hypothesis is that the two scenarios are largely independent in terms of direct corruption, but the *combination* is important.
1.  **Resource Exhaustion:** Thread A effectively tries to deplete the kernel's percpu allocation pool. This isn't a bug in BPF itself, but a consequence of heavy usage.
2.  **Fault Injection:** Thread B's fault injection will cause its own syscall's allocations to fail. The `__GFP_NOWARN` flag on BPF allocations means that while BPF might be consuming resources, it's not loudly complaining. If fault injection happens to target a critical part of the percpu allocator itself *while* Thread A is operating, or if the exhaustion caused by Thread A makes allocations fail more frequently for Thread B (even without explicit fault injection *on percpu*), the system might exhibit OOM-like behavior or cascading failures.

I've been thinking about searching for interactions between fault injection mechanisms (`fail_nth`, `FAIL_SLAB`, etc.) and percpu allocation paths (`mm/percpu.c`, `mm/vmalloc.c`), or specifically looking for any reported bugs or discussions on LKML involving `BPF_MAP_TYPE_PERCPU_ARRAY` exhaustion and fault injection. The absence of a clear "bug" in the direct code path for BPF map allocation when encountering failure suggests the issue might be in the *systemic* behavior or in how fault injection might indirectly impact critical kernel subsystems that the percpu allocator relies on, or vice-versa. The question is designed to probe whether this combined scenario creates a "worst-case" situation that leads to a denial of service, a kernel panic, a deadlock, or some other undesirable system state, rather than a simple `-ENOMEM` return.

map[Expression:should_fail|fault_inject PathPrefix:mm/]

map[Output:mm/fail_page_alloc.c=24=__setup("fail_page_alloc=", setup_fail_page_alloc);
mm/fail_page_alloc.c-25-
mm/fail_page_alloc.c:26:bool should_fail_alloc_page(gfp_t gfp_mask, unsigned int order)
mm/fail_page_alloc.c-27-{
--
mm/fail_page_alloc.c-39-
mm/fail_page_alloc.c:40:	/* See comment in __should_failslab() */
mm/fail_page_alloc.c-41-	if (gfp_mask & __GFP_NOWARN)
--
mm/fail_page_alloc.c-43-
mm/fail_page_alloc.c:44:	return should_fail_ex(&fail_page_alloc.attr, 1 << order, flags);
mm/fail_page_alloc.c-45-}
mm/fail_page_alloc.c:46:ALLOW_ERROR_INJECTION(should_fail_alloc_page, TRUE);
mm/fail_page_alloc.c-47-
--
mm/failslab.c=9=static struct {
--
mm/failslab.c-18-
mm/failslab.c:19:int should_failslab(struct kmem_cache *s, gfp_t gfpflags)
mm/failslab.c-20-{
--
mm/failslab.c-45-
mm/failslab.c:46:	return should_fail_ex(&failslab.attr, s->object_size, flags) ? -ENOMEM : 0;
mm/failslab.c-47-}
mm/failslab.c:48:ALLOW_ERROR_INJECTION(should_failslab, ERRNO);
mm/failslab.c-49-
--
mm/mempool.c=487=int mempool_alloc_bulk_noprof(struct mempool *pool, void **elems,
--
mm/mempool.c-500-	 */
mm/mempool.c:501:	if (should_fail_ex(&fail_mempool_alloc_bulk, 1, FAULT_NOWARN)) {
mm/mempool.c-502-		pr_info("forcing mempool usage for %pS\n",
--
mm/mempool.c=545=void *mempool_alloc_noprof(struct mempool *pool, gfp_t gfp_mask)
--
mm/mempool.c-553-repeat_alloc:
mm/mempool.c:554:	if (should_fail_ex(&fail_mempool_alloc, 1, FAULT_NOWARN)) {
mm/mempool.c-555-		pr_info("forcing mempool usage for %pS\n",
--
mm/page_alloc.c=5026=static inline bool prepare_alloc_pages(gfp_t gfp_mask, unsigned int order,
--
mm/page_alloc.c-5050-	/*
mm/page_alloc.c:5051:	 * Don't invoke should_fail logic, since it may call
mm/page_alloc.c-5052-	 * get_random_u32() and printk() which need to spin_lock.
--
mm/page_alloc.c-5054-	if (!(*alloc_flags & ALLOC_TRYLOCK) &&
mm/page_alloc.c:5055:	    should_fail_alloc_page(gfp_mask, order))
mm/page_alloc.c-5056-		return false;
--
mm/slub.c=4533=struct kmem_cache *slab_pre_alloc_hook(struct kmem_cache *s, gfp_t flags)
--
mm/slub.c-4538-
mm/slub.c:4539:	if (unlikely(should_failslab(s, flags)))
mm/slub.c-4540-		return NULL;
--
mm/slub.c=5364=static void *__kmalloc_nolock_noprof(DECL_TOKEN_PARAMS(size, token), gfp_t gfp_flags,
--
mm/slub.c-5415-	 * Do not call slab_alloc_node(), since trylock mode isn't
mm/slub.c:5416:	 * compatible with slab_pre_alloc_hook/should_failslab and
mm/slub.c-5417-	 * kfence_alloc. Hence call __slab_alloc_node() (at most twice)
]

gemini-3.6-flash

							input: 41067
							output: 32
							thoughts: 91
						

**My Thought Process on Failpage Allocation**

Okay, so I'm looking at `mm/fail_page_alloc.c`, and the first thing that catches my eye is this `if` condition: `if (gfp_mask & __GFP_NOWARN)`. My immediate reaction is a bit of a "hold on a second!" because that `__GFP_NOWARN` flag suggests that we're potentially *not* issuing a warning under certain conditions related to page allocation failure.

Given that this is a file specifically designed to *introduce* page allocation failures for testing purposes, the presence of a mechanism to *suppress* warnings feels like a critical detail to understand. Why would we have a failure mechanism, but then a way to make it quieter? It's not immediately obvious.

So, my next step is to trace this. The comment immediately after the `if` statement points to `__should_failslab()`. This is a strong clue. It implies that the decision of *whether* to inject a failure, and consequently whether to honor the `__GFP_NOWARN` flag, is made in that function.

Therefore, to fully grasp the implications of this `__GFP_NOWARN` check, I need to dive into the logic of `__should_failslab()`. The most direct way to do that is to look at its definition. The file name `mm/failslab.c` (or potentially `__should_failslab` if it were in a different file, but the comment suggests `mm/failslab.c` is the place to look) is the obvious next destination. I need to understand the conditions under which `__should_failslab` returns true (indicating a failure should be injected) and how it interacts with the `gfp_mask` and specifically the `__GFP_NOWARN` bit. This will tell me if this `if` statement is actually preventing a warning from being issued, or if it's part of a more complex decision tree about *when* to fail and *how* to report that failure.

map[File:mm/failslab.c FirstLine:1 LineCount:50]

map[Contents:   1:	// SPDX-License-Identifier: GPL-2.0
   2:	#include <linux/fault-inject.h>
   3:	#include <linux/error-injection.h>
   4:	#include <linux/debugfs.h>
   5:	#include <linux/slab.h>
   6:	#include <linux/mm.h>
   7:	#include "slab.h"
   8:	
   9:	static struct {
  10:		struct fault_attr attr;
  11:		bool ignore_gfp_reclaim;
  12:		bool cache_filter;
  13:	} failslab = {
  14:		.attr = FAULT_ATTR_INITIALIZER,
  15:		.ignore_gfp_reclaim = true,
  16:		.cache_filter = false,
  17:	};
  18:	
  19:	int should_failslab(struct kmem_cache *s, gfp_t gfpflags)
  20:	{
  21:		int flags = 0;
  22:	
  23:		/* No fault-injection for bootstrap cache */
  24:		if (unlikely(s == kmem_cache))
  25:			return 0;
  26:	
  27:		if (gfpflags & __GFP_NOFAIL)
  28:			return 0;
  29:	
  30:		if (failslab.ignore_gfp_reclaim &&
  31:				(gfpflags & __GFP_DIRECT_RECLAIM))
  32:			return 0;
  33:	
  34:		if (failslab.cache_filter && !(s->flags & SLAB_FAILSLAB))
  35:			return 0;
  36:	
  37:		/*
  38:		 * In some cases, it expects to specify __GFP_NOWARN
  39:		 * to avoid printing any information(not just a warning),
  40:		 * thus avoiding deadlocks. See commit 6b9dbedbe349 for
  41:		 * details.
  42:		 */
  43:		if (gfpflags & __GFP_NOWARN)
  44:			flags |= FAULT_NOWARN;
  45:	
  46:		return should_fail_ex(&failslab.attr, s->object_size, flags) ? -ENOMEM : 0;
  47:	}
  48:	ALLOW_ERROR_INJECTION(should_failslab, ERRNO);
  49:	
  50:	static int __init setup_failslab(char *str)
]

gemini-3.6-flash

							input: 41858
							output: 32
							thoughts: 372
						

**My Thought Process on the Per-CPU Array and Fault Injection Scenario**

Okay, I need to really unpack this query about `BPF_MAP_TYPE_PERCPU_ARRAY`, per-CPU memory exhaustion in a loop, and fault injection during a syscall. My first instinct is to immediately dive into the specific commit `6b9dbedbe349` mentioned in `mm/failslab.c`. That feels like a concrete starting point, so I'll be looking for that commit hash, or anything closely related, to understand its context.

As I'm searching for commit details, I'm also going to cast a wider net. I'll look for commit messages that might mention `6b9dbedbe349`, or perhaps terms like "fault injection" or "percpu." This could provide valuable context about *why* that commit exists and what problems it might be trying to address. I'm thinking about tools like `grepper` for searching repository files, or even just a standard `git log` to sift through commit history. I'll also keep in mind that `grepper` is more for file content, so I might need to look for comments *within* files that reference specific commits or documentation related to these concepts.

Now, before I get too deep into the technical weeds, I need to pause and really re-read the *exact* question being asked. It's crucial to understand the *intent* behind this specific scenario. The user is asking: "Is there any issue with using `BPF_MAP_TYPE_PERCPU_ARRAY` to allocate percpu memory in a loop to exhaust percpu chunks, while another thread runs a syscall with fault injection enabled?"

This is a very specific setup. Why would someone ask this? It makes me wonder if this is a known stress test scenario that's been explored in the Linux kernel community. I'm thinking about things like:
*   Has this specific combination of actions been tested by tools like `syzkaller` or within the kernel's selftests?
*   Is this related to a previously reported kernel bug, a CVE, or a specific kernel warning or panic that has been observed?
*   Is the core concern about whether exhausting per-CPU memory under fault injection can lead to system instability – like a crash, lockup, deadlock, memory leak, or even just an unexpected `WARNING` message?

To answer this, I'll start by looking for concrete evidence. I'll specifically search within `tools/testing/selftests/` and the kernel's core directories (`kernel/` and `mm/`) for any existing selftests or `syzkaller` reproducer files that mention `BPF_MAP_TYPE_PERCPU_ARRAY` or scenarios involving per-CPU exhaustion. I'll broaden that search to all files within `tools/testing/selftests/` looking for `PERCPU_ARRAY` or just `percpu` to see if any related tests exist. This direct evidence will be key to understanding if this is a known edge case or a potential vulnerability.

map[Expression:PERCPU_ARRAY PathPrefix:tools/testing/selftests/]

map[Output:tools/testing/selftests/bpf/map_tests/array_map_batch_ops.c=70=static void __test_map_lookup_and_update_batch(bool is_pcpu)
--
tools/testing/selftests/bpf/map_tests/array_map_batch_ops.c-82-
tools/testing/selftests/bpf/map_tests/array_map_batch_ops.c:83:	map_fd = bpf_map_create(is_pcpu ? BPF_MAP_TYPE_PERCPU_ARRAY : BPF_MAP_TYPE_ARRAY,
tools/testing/selftests/bpf/map_tests/array_map_batch_ops.c-84-				"array_map", sizeof(int), sizeof(__s64), max_entries, NULL);
--
tools/testing/selftests/bpf/map_tests/map_percpu_stats.c=460=static void map_percpu_stats_map_value_size(void)
--
tools/testing/selftests/bpf/map_tests/map_percpu_stats.c-464-	struct bpf_map_create_opts opts = { .sz = sizeof(opts) };
tools/testing/selftests/bpf/map_tests/map_percpu_stats.c:465:	enum bpf_map_type map_types[] = { BPF_MAP_TYPE_PERCPU_ARRAY,
tools/testing/selftests/bpf/map_tests/map_percpu_stats.c-466-					  BPF_MAP_TYPE_PERCPU_HASH,
--
tools/testing/selftests/bpf/prog_tests/btf.c=5295=static struct btf_pprint_test_meta {
--
tools/testing/selftests/bpf/prog_tests/btf.c-5331-	.descr = "BTF pretty print percpu array",
tools/testing/selftests/bpf/prog_tests/btf.c:5332:	.map_type = BPF_MAP_TYPE_PERCPU_ARRAY,
tools/testing/selftests/bpf/prog_tests/btf.c-5333-	.map_name = "pprint_test_percpu_array",
--
tools/testing/selftests/bpf/prog_tests/map_btf.c=8=static void do_test_normal_map_btf(void)
--
tools/testing/selftests/bpf/prog_tests/map_btf.c-29-	for (i = 0; i < ARRAY_SIZE(map_fd_arr); i++)
tools/testing/selftests/bpf/prog_tests/map_btf.c:30:		map_fd_arr[i] = bpf_map_create(BPF_MAP_TYPE_PERCPU_ARRAY, NULL, 4, 4, 256, NULL);
tools/testing/selftests/bpf/prog_tests/map_btf.c-31-
--
tools/testing/selftests/bpf/prog_tests/percpu_alloc.c=338=static void test_percpu_array_cpu_flag(void)
tools/testing/selftests/bpf/prog_tests/percpu_alloc.c-339-{
tools/testing/selftests/bpf/prog_tests/percpu_alloc.c:340:	test_percpu_map_cpu_flag(BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/prog_tests/percpu_alloc.c-341-}
--
tools/testing/selftests/bpf/prog_tests/percpu_array_inner_map.c=9=void test_percpu_array_inner_map(void)
--
tools/testing/selftests/bpf/prog_tests/percpu_array_inner_map.c-15-	/* Create template: percpu array with 8 entries */
tools/testing/selftests/bpf/prog_tests/percpu_array_inner_map.c:16:	tmpl_fd = bpf_map_create(BPF_MAP_TYPE_PERCPU_ARRAY, "tmpl",
tools/testing/selftests/bpf/prog_tests/percpu_array_inner_map.c-17-				 sizeof(int), sizeof(long), 8, NULL);
--
tools/testing/selftests/bpf/prog_tests/percpu_array_inner_map.c-33-	/* Replacement with same max_entries should succeed */
tools/testing/selftests/bpf/prog_tests/percpu_array_inner_map.c:34:	good_fd = bpf_map_create(BPF_MAP_TYPE_PERCPU_ARRAY, "good",
tools/testing/selftests/bpf/prog_tests/percpu_array_inner_map.c-35-				 sizeof(int), sizeof(long), 8, NULL);
--
tools/testing/selftests/bpf/prog_tests/percpu_array_inner_map.c-43-	/* Replacement with fewer max_entries must fail */
tools/testing/selftests/bpf/prog_tests/percpu_array_inner_map.c:44:	bad_fd = bpf_map_create(BPF_MAP_TYPE_PERCPU_ARRAY, "bad",
tools/testing/selftests/bpf/prog_tests/percpu_array_inner_map.c-45-				sizeof(int), sizeof(long), 2, NULL);
--
tools/testing/selftests/bpf/progs/bpf_iter_bpf_percpu_array_map.c=9=struct {
tools/testing/selftests/bpf/progs/bpf_iter_bpf_percpu_array_map.c:10:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/bpf_iter_bpf_percpu_array_map.c-11-	__uint(max_entries, 3);
--
tools/testing/selftests/bpf/progs/for_each_array_map_elem.c=15=struct {
tools/testing/selftests/bpf/progs/for_each_array_map_elem.c:16:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/for_each_array_map_elem.c-17-	__uint(max_entries, 1);
--
tools/testing/selftests/bpf/progs/lsm.c=35=struct {
tools/testing/selftests/bpf/progs/lsm.c:36:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/lsm.c-37-	__uint(max_entries, 1);
--
tools/testing/selftests/bpf/progs/map_kptr.c=19=struct pcpu_array_map {
tools/testing/selftests/bpf/progs/map_kptr.c:20:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/map_kptr.c-21-	__type(key, int);
--
tools/testing/selftests/bpf/progs/map_ptr_kern.c=223=struct {
tools/testing/selftests/bpf/progs/map_ptr_kern.c:224:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/map_ptr_kern.c-225-	__uint(max_entries, MAX_ENTRIES);
--
tools/testing/selftests/bpf/progs/map_ptr_kern.c=686=int cg_skb(void *ctx)
--
tools/testing/selftests/bpf/progs/map_ptr_kern.c-692-	VERIFY_TYPE(BPF_MAP_TYPE_PERCPU_HASH, check_percpu_hash);
tools/testing/selftests/bpf/progs/map_ptr_kern.c:693:	VERIFY_TYPE(BPF_MAP_TYPE_PERCPU_ARRAY, check_percpu_array);
tools/testing/selftests/bpf/progs/map_ptr_kern.c-694-	VERIFY_TYPE(BPF_MAP_TYPE_STACK_TRACE, check_stack_trace);
--
tools/testing/selftests/bpf/progs/netif_receive_skb.c=27=struct {
tools/testing/selftests/bpf/progs/netif_receive_skb.c:28:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/netif_receive_skb.c-29-	__uint(max_entries, 1);
--
tools/testing/selftests/bpf/progs/percpu_alloc_array.c=190=struct {
tools/testing/selftests/bpf/progs/percpu_alloc_array.c:191:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/percpu_alloc_array.c-192-	__uint(max_entries, 2);
--
tools/testing/selftests/bpf/progs/perf_event_stackmap.c=18=struct {
tools/testing/selftests/bpf/progs/perf_event_stackmap.c:19:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/perf_event_stackmap.c-20-	__uint(max_entries, 1);
--
tools/testing/selftests/bpf/progs/profiler.inc.h=82=struct {
tools/testing/selftests/bpf/progs/profiler.inc.h:83:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/profiler.inc.h-84-	__uint(max_entries, 1);
--
tools/testing/selftests/bpf/progs/profiler.inc.h=102=struct {
tools/testing/selftests/bpf/progs/profiler.inc.h:103:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/profiler.inc.h-104-	__uint(max_entries, profiler_bpf_max_function_id);
--
tools/testing/selftests/bpf/progs/strobemeta.h=232=struct {
tools/testing/selftests/bpf/progs/strobemeta.h:233:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/strobemeta.h-234-	__uint(max_entries, 1);
--
tools/testing/selftests/bpf/progs/strobemeta.h=239=struct {
tools/testing/selftests/bpf/progs/strobemeta.h:240:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/strobemeta.h-241-	__uint(max_entries, STROBE_MAX_CFGS);
--
tools/testing/selftests/bpf/progs/test_cls_redirect.c=366=struct {
tools/testing/selftests/bpf/progs/test_cls_redirect.c:367:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/test_cls_redirect.c-368-	__uint(max_entries, 1);
--
tools/testing/selftests/bpf/progs/test_cls_redirect_dynptr.c=260=struct {
tools/testing/selftests/bpf/progs/test_cls_redirect_dynptr.c:261:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/test_cls_redirect_dynptr.c-262-	__uint(max_entries, 1);
--
tools/testing/selftests/bpf/progs/test_get_stack_rawtp.c=25=struct {
tools/testing/selftests/bpf/progs/test_get_stack_rawtp.c:26:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/test_get_stack_rawtp.c-27-	__uint(max_entries, 1);
--
tools/testing/selftests/bpf/progs/test_get_stack_rawtp.c=50=struct {
tools/testing/selftests/bpf/progs/test_get_stack_rawtp.c:51:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/test_get_stack_rawtp.c-52-	__uint(max_entries, 1);
--
tools/testing/selftests/bpf/progs/test_hash_large_key.c=15=struct {
tools/testing/selftests/bpf/progs/test_hash_large_key.c:16:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/test_hash_large_key.c-17-	__uint(max_entries, 1);
--
tools/testing/selftests/bpf/progs/test_l4lb.c=191=struct {
tools/testing/selftests/bpf/progs/test_l4lb.c:192:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/test_l4lb.c-193-	__uint(max_entries, MAX_VIPS);
--
tools/testing/selftests/bpf/progs/test_l4lb_noinline.c=187=struct {
tools/testing/selftests/bpf/progs/test_l4lb_noinline.c:188:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/test_l4lb_noinline.c-189-	__uint(max_entries, MAX_VIPS);
--
tools/testing/selftests/bpf/progs/test_l4lb_noinline_dynptr.c=189=struct {
tools/testing/selftests/bpf/progs/test_l4lb_noinline_dynptr.c:190:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/test_l4lb_noinline_dynptr.c-191-	__uint(max_entries, MAX_VIPS);
--
tools/testing/selftests/bpf/progs/test_map_lookup_percpu_elem.c=13=struct {
tools/testing/selftests/bpf/progs/test_map_lookup_percpu_elem.c:14:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/test_map_lookup_percpu_elem.c-15-	__uint(max_entries, 1);
--
tools/testing/selftests/bpf/progs/test_unpriv_bpf_disabled.c=22=struct {
tools/testing/selftests/bpf/progs/test_unpriv_bpf_disabled.c:23:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/test_unpriv_bpf_disabled.c-24-	__uint(max_entries, 1);
--
tools/testing/selftests/bpf/progs/test_xdp.c=24=struct {
tools/testing/selftests/bpf/progs/test_xdp.c:25:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/test_xdp.c-26-	__uint(max_entries, 256);
--
tools/testing/selftests/bpf/progs/test_xdp_dynptr.c=27=struct {
tools/testing/selftests/bpf/progs/test_xdp_dynptr.c:28:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/test_xdp_dynptr.c-29-	__uint(max_entries, 256);
--
tools/testing/selftests/bpf/progs/test_xdp_loop.c=20=struct {
tools/testing/selftests/bpf/progs/test_xdp_loop.c:21:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/test_xdp_loop.c-22-	__uint(max_entries, 256);
--
tools/testing/selftests/bpf/progs/test_xdp_noinline.c=197=struct {
tools/testing/selftests/bpf/progs/test_xdp_noinline.c:198:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/test_xdp_noinline.c-199-	__uint(max_entries, 515);
--
tools/testing/selftests/bpf/progs/trigger_bench.c=33=struct {
tools/testing/selftests/bpf/progs/trigger_bench.c:34:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/trigger_bench.c-35-	 __uint(max_entries, 1);
--
tools/testing/selftests/bpf/progs/verifier_array_access.c=31=struct {
tools/testing/selftests/bpf/progs/verifier_array_access.c:32:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/verifier_array_access.c-33-	__uint(max_entries, 2);
--
tools/testing/selftests/bpf/progs/xdp_lb_bench.c=133=struct {
tools/testing/selftests/bpf/progs/xdp_lb_bench.c:134:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/xdp_lb_bench.c-135-	__uint(max_entries, STATS_SIZE);
--
tools/testing/selftests/bpf/progs/xdp_lb_bench.c=140=struct {
tools/testing/selftests/bpf/progs/xdp_lb_bench.c:141:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/xdp_lb_bench.c-142-	__uint(max_entries, MAX_REALS);
--
tools/testing/selftests/bpf/progs/xdp_lb_bench.c=161=struct {
tools/testing/selftests/bpf/progs/xdp_lb_bench.c:162:	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
tools/testing/selftests/bpf/progs/xdp_lb_bench.c-163-	__uint(max_entries, MAX_REALS);
--
tools/testing/selftests/bpf/test_loader.c=1057=static bool is_unpriv_capable_map(struct bpf_map *map)
--
tools/testing/selftests/bpf/test_loader.c-1074-	case BPF_MAP_TYPE_CGROUP_ARRAY:
tools/testing/selftests/bpf/test_loader.c:1075:	case BPF_MAP_TYPE_PERCPU_ARRAY:
tools/testing/selftests/bpf/test_loader.c-1076-	case BPF_MAP_TYPE_USER_RINGBUF:
--
tools/testing/selftests/bpf/test_maps.c=422=static void test_arraymap_percpu(unsigned int task, void *data)
--
tools/testing/selftests/bpf/test_maps.c-427-
tools/testing/selftests/bpf/test_maps.c:428:	fd = bpf_map_create(BPF_MAP_TYPE_PERCPU_ARRAY, NULL, sizeof(key),
tools/testing/selftests/bpf/test_maps.c-429-			    sizeof(bpf_percpu(values, 0)), 2, NULL);
--
tools/testing/selftests/bpf/test_maps.c=481=static void test_arraymap_percpu_many_keys(void)
--
tools/testing/selftests/bpf/test_maps.c-490-
tools/testing/selftests/bpf/test_maps.c:491:	fd = bpf_map_create(BPF_MAP_TYPE_PERCPU_ARRAY, NULL, sizeof(key),
tools/testing/selftests/bpf/test_maps.c-492-			    sizeof(bpf_percpu(values, 0)), nr_keys, NULL);
]

gemini-3.6-flash

							input: 47954
							output: 32
							thoughts: 1764
						

**My Thoughts on PerCPU Memory Exhaustion and Fault Injection Interactions**

Okay, so I'm really digging into what happens when the kernel's per-CPU memory pool gets completely tapped out, or conversely, when these per-CPU chunks are being allocated or freed.

First off, I'm looking at the synchronization mechanisms involved. I'm checking out `pcpu_alloc_mutex` and `pcpu_lock`. My initial dive into `pcpu_alloc_noprof()` shows this block:

```c
		if (!is_atomic) {
			if (gfp & __GFP_NOFAIL) {
				mutex_lock(&pcpu_alloc_mutex);
			} else if (mutex_lock_killable(&pcpu_alloc_mutex)) {
				pcpu_memcg_post_alloc_hook(objcg, NULL, 0, size);
				return NULL;
			}
		}
```

And then, when I look at how BPF maps, specifically `bpf_array_alloc_percpu()`, are handling per-CPU allocations:

```c
	for (i = 0; i < array->map.max_entries; i++) {
		ptr = bpf_map_alloc_percpu(&array->map, array->elem_size, 8,
					   GFP_USER | __GFP_NOWARN);
		if (!ptr) {
			bpf_array_free_percpu(array);
			return -ENOMEM;
		}
		array->pptrs[i] = ptr;
		cond_resched();
	}
```

I'm noticing a pattern here: `bpf_map_alloc_percpu` is called in a loop, iterating through `max_entries`. Each iteration of this loop calls `pcpu_alloc_noprof()`. This means for every single entry in the BPF per-CPU array, the `pcpu_alloc_mutex` is acquired, a chunk is potentially allocated or populated, and then the mutex is released. Crucially, `cond_resched()` is called between allocations.

So, the logical question becomes: what exactly happens if the per-CPU memory runs out?

1.  The `pcpu_alloc_noprof()` function will inevitably fail either to create a new per-CPU chunk (because `pcpu_create_chunk()` returns `NULL`) or to populate an existing one (returning an error).
2.  This failure manifests as `pcpu_alloc_noprof()` returning `NULL`.
3.  The `bpf_array_alloc_percpu()` function sees this `!ptr` condition, triggers `bpf_array_free_percpu(array)` to clean up what it has allocated so far, and then returns `-ENOMEM`.
4.  `bpf_array_free_percpu` then iterates through the `pptrs` it managed to allocate (from `array->pptrs[0]` up to `max_entries - 1`) and calls `free_percpu()` for each.
5.  `free_percpu()` handles the actual deallocation of the per-CPU memory.
6.  Finally, the outer `array_map_alloc()` function, seeing the `-ENOMEM` from its per-CPU allocation attempt, proceeds to free the BPF map structure itself via `bpf_map_area_free(array)` and returns `ERR_PTR(-ENOMEM)` to the caller.

Now, I'm thinking about a more aggressive scenario. What if a thread, let's call it Thread A, is stuck in a tight loop attempting to create per-CPU BPF arrays?

Thread A:
`while (1) { bpf_map_create(BPF_MAP_TYPE_PERCPU_ARRAY, ...); }`

Eventually, Thread A is going to hit some limit. It could be the file descriptor limit (`RLIMIT_NOFILE`), a memory limit like `RLIMIT_MEMLOCK` or a cgroup memory limit, or, more directly, it will exhaust the per-CPU memory pool. If Thread A isn't careful about closing file descriptors, `bpf_map_create` will fail with `-EMFILE` or `-ENFILE` once it runs out of fds. However, if Thread A *is* closing fds or if it's simply allocating maps until the per-CPU memory is exhausted, then `bpf_map_create` will ultimately fail with `-ENOMEM`.

This brings me to a more complex interaction. What if there's another thread, Thread B, that's executing a syscall and has fault injection enabled?

Thread B:
Fault injection (e.g., using `FAIL_SLAB`, `FAIL_PAGE_ALLOC`, or `/proc/self/fail-nth`) is designed to inject allocation failures into the syscall Thread B is running. When a fault injection point is hit within Thread B's syscall, that syscall is expected to handle the allocation failure gracefully, typically by returning an error code like `-ENOMEM`.

The critical question forming in my mind is: is there any potential issue or interaction between Thread A (which is actively depleting the per-CPU memory by creating BPF per-CPU arrays in a loop) and Thread B (which is running a syscall with fault injection active)?

Let me try to identify potential issues:

1.  **System Stability**: Are we looking at any kernel warnings, deadlocks, memory leaks, use-after-free bugs, unhandled errors, or denial-of-service vulnerabilities?
2.  **System-Wide Impact**: What happens to *other* parts of the kernel when the per-CPU chunks or memory are exhausted? This is key: per-CPU memory is a system-wide, shared resource!
    If a process, regardless of privilege level, exhausts the per-CPU memory by allocating BPF per-CPU array maps:
    *   Any *other* kernel subsystem or syscall that attempts to allocate per-CPU memory for its own purposes (e.g., when creating sockets, opening files, during netfilter operations, managing cgroups, using perf events, kernel threads, tracing mechanisms, etc.) will also fail. This failure occurs *unless* those subsystems explicitly use `__GFP_NOWARN` or are designed to tolerate per-CPU allocation failures.
    *   If a kernel subsystem *does* call `alloc_percpu()` without `__GFP_NOWARN`, the `pcpu_alloc_noprof()` function will print a `pr_warn("allocation failed...")` message and trigger a `dump_stack()`. This is a strong indicator of a problem.
    *   What if a kernel subsystem calls `alloc_percpu()` in a code path where failure isn't properly handled? Or if `__GFP_NOFAIL` is used (though `pcpu_alloc` with `__GFP_NOFAIL` seems to have its own complexities, as we'll see)? Or what if fault injection in Thread B *causes* a failure within Thread B's *own* error-handling path for a per-CPU allocation?

This brings me back to the `__GFP_NOFAIL` flag. I need to be certain: can `alloc_percpu()` with `__GFP_NOFAIL` lead to a deadlock or an infinite loop, or does `pcpu_alloc` have specific handling for it?

Looking back at `pcpu_alloc_noprof()` in `mm/percpu.c`, I see this relevant section:

```c
		if (!is_atomic) {
			if (gfp & __GFP_NOFAIL) {
				mutex_lock(&pcpu_alloc_mutex);
			} else if (mutex_lock_killable(&pcpu_alloc_mutex)) {
				pcpu_memcg_post_alloc_hook(objcg, NULL, 0, size);
				return NULL;
			}
		}
```

But what if `pcpu_create_chunk` itself fails *even when `gfp & __GFP_NOFAIL` is in effect*? The code at line 1845 in `mm/percpu.c` clarifies this:

```c
		if (list_empty(&pcpu_chunk_lists[pcpu_free_slot])) {
			chunk = pcpu_create_chunk(pcpu_gfp);
			if (!chunk) {
				err = "failed to allocate new chunk";
				goto fail; // This 'goto fail' happens regardless of __GFP_NOFAIL
			}
```

This is a critical observation: if `pcpu_create_chunk()` returns `NULL`, the code jumps to `goto fail;`. This means `pcpu_alloc_noprof()` will return `NULL`, even if `__GFP_NOFAIL` was originally passed. The `__GFP_NOFAIL` flag doesn't make it magically succeed if the underlying allocation mechanism (like creating a new chunk) fails completely.

Now, about fault injection. What's its intended purpose in kernel testing?
Fault injection, through mechanisms like `fail-nth`, `failslab`, and `fail_page_alloc`, is primarily used by fuzzing tools like Syzkaller to rigorously test the *error recovery paths* within syscalls.

So, the scenario is: Syzkaller or a similar test runner is triggering fault injection on a syscall. Simultaneously, another thread is actively depleting the per-CPU chunks or the overall per-CPU memory. Why might this be an issue, or why might it *not* be an issue?

My next step is to search for any existing Syzkaller reports or kernel commits that specifically link "BPF_MAP_TYPE_PERCPU_ARRAY," "percpu chunks," and "fault injection." I'll be looking for any mention of interactions or problems arising from these conditions occurring together. I'll use tools like `grepper` to search for the keywords "percpu chunks," "BPF_MAP_TYPE_PERCPU_ARRAY," and "fault injection" across relevant kernel codebases, documentation, and commit logs. I'll also broaden my search to include terms like `fail-nth`, `fault injection`, or simply `fault` within code files or commit messages where they might be discussed in relation to these concepts.

log-in to see details

map[Expression:fault.*inject|inject.*fault PathPrefix:kernel/bpf/]

map[Output:]

gemini-3.6-flash

							input: 49748
							output: 41
							thoughts: 556
						

Here are my thoughts as I've been digging into this:

**My Thought Process on Investigating `bpf_array_alloc_percpu` and Related Memory Allocation**

Initially, I was looking for something specific in `kernel/bpf/`. I performed an initial search, but it yielded no direct matches for what I was after. This meant I had to broaden my search. My next step was to look for occurrences of the term "fail" within specific files that seemed relevant: `kernel/bpf/arraymap.c` and `kernel/bpf/syscall.c`. I figured that if there was an issue, it would likely be handled or logged in one of these places.

After that, I decided to dive directly into `kernel/bpf/arraymap.c`. My goal here was to get a feel for the code, looking for any comments that might explain unusual logic or potential pitfalls, and to understand the flow of operations.

Specifically, I wanted to re-examine the functions `array_map_alloc` and `bpf_array_alloc_percpu`. These seemed like prime candidates for where memory allocation issues might occur.

Then, I had a moment of insight. I decided to focus my attention more closely on `bpf_array_alloc_percpu` within `kernel/bpf/arraymap.c`. I looked at the provided snippet:

```c
static int bpf_array_alloc_percpu(struct bpf_array *array)
{
	void __percpu *ptr;
	int i;

	for (i = 0; i < array->map.max_entries; i++) {
		ptr = bpf_map_alloc_percpu(&array->map, array->elem_size, 8,
					   GFP_USER | __GFP_NOWARN);
		if (!ptr) {
			bpf_array_free_percpu(array);
			return -ENOMEM;
		}
		array->pptrs[i] = ptr;
		cond_resched();
	}

	return 0;
}
```

As I reviewed this, a question immediately popped into my mind: is there something I'm missing with `array->pptrs` or perhaps related to memory cgroups (memcg) or other resource controls? The allocation itself seems straightforward, but the context of how `pptrs` is managed and what `bpf_map_alloc_percpu` might be doing internally felt crucial.

This led me to investigate `bpf_map_alloc_percpu`. Here's what I saw:

```c
void __percpu *bpf_map_alloc_percpu(const struct bpf_map *map, size_t size,
				    size_t align, gfp_t flags)
{
	struct mem_cgroup *memcg, *old_memcg;
	void __percpu *ptr;

	bpf_map_memcg_enter(map, &old_memcg, &memcg);
	ptr = __alloc_percpu_gfp(size, align, flags | __GFP_ACCOUNT);
	bpf_map_memcg_exit(old_memcg, memcg);

	return ptr;
}
```

And that's where the real intrigue kicked in! Looking at the calls to `bpf_map_memcg_enter` and `bpf_map_memcg_exit`, I realized I needed to understand exactly what these functions were doing, especially in relation to memory cgroups. My next logical step was to find their definitions, which I suspected would be in `kernel/bpf/syscall.c`, to fully grasp their behavior.

map[ContextFile:kernel/bpf/syscall.c Name:bpf_map_memcg_enter]

map[SourceCode: 512:	void bpf_map_memcg_enter(const struct bpf_map *map, struct mem_cgroup **old_memcg,
 513:				 struct mem_cgroup **new_memcg)
 514:	{
 515:		*new_memcg = bpf_map_get_memcg(map);
 516:		*old_memcg = set_active_memcg(*new_memcg);
 517:	}
 SourceFile:kernel/bpf/syscall.c]

gemini-3.6-flash

							input: 50478
							output: 41
							thoughts: 27
						

**My Thought Process Regarding BPF Map Memory Control Group Interactions**

As someone deeply entrenched in the intricacies of the Linux kernel, particularly the BPF subsystem, my immediate inclination when encountering a new feature or a potential area of investigation is to dive into the relevant source code. In this instance, I'm specifically interested in understanding how BPF maps interact with memory control groups (memcg). This is a critical area, as it dictates resource allocation and limits, which are paramount for stability and performance in containerized environments and beyond.

Therefore, my first step is to locate and meticulously examine the functions `bpf_map_get_memcg` and `bpf_map_memcg_exit`. My intention is to dissect their implementation details. I need to understand precisely what these functions do, how they are called, and what their return values signify.

Specifically, for `bpf_map_get_memcg`, I'm looking to answer:

*   What is the exact mechanism by which this function retrieves the memory control group associated with a BPF map?
*   Does it rely on internal BPF map structures, or does it query the broader kernel memcg infrastructure?
*   What are the potential failure scenarios, and how are they handled?
*   Are there any performance implications associated with calling this function, particularly in hot paths?

Similarly, for `bpf_map_memcg_exit`, my focus is on:

*   How does this function manage the detachment or cleanup of a BPF map's association with a memory control group?
*   What happens to the memory resources previously managed by this map within that memcg when this function is invoked?
*   Is this function typically called during map destruction, memcg destruction, or some other lifecycle event?
*   Are there any race conditions or concurrency issues I need to be aware of regarding its usage, especially in conjunction with other BPF operations or memcg events?

By thoroughly analyzing these two functions, I aim to build a comprehensive understanding of the BPF map's memory control group lifecycle and management. This knowledge will be instrumental in identifying potential optimizations, debugging issues related to memory accounting for BPF, and potentially contributing to enhancements in this area. It's about tracing the flow of memory ownership and accountability from the BPF map all the way down to the kernel's resource management framework.

map[ContextFile:kernel/bpf/syscall.c Name:bpf_map_memcg_exit]

map[SourceCode: 519:	void bpf_map_memcg_exit(struct mem_cgroup *old_memcg,
 520:				struct mem_cgroup *new_memcg)
 521:	{
 522:		set_active_memcg(old_memcg);
 523:		mem_cgroup_put(new_memcg);
 524:	}
 SourceFile:kernel/bpf/syscall.c]

gemini-3.6-flash

							input: 50658
							output: 41
							thoughts: 15
						

**My Thought Process on `bpf_map_get_memcg`**

Alright, so my initial instinct is to dive into the `bpf_map_get_memcg` function. I need to understand exactly what it's doing, what its purpose is within the broader BPF ecosystem, and its implications for memory control group (memcg) interactions. My immediate concern is how it’s implemented, what data structures it accesses, and what guarantees or limitations it provides. I'm assuming, given the name, it's a mechanism for BPF programs to directly query or interact with the memory cgroup information associated with a particular map. This immediately brings to mind questions about security, efficiency, and potential race conditions. Is this a read-only operation? Can it be used to modify memcg behavior? What are the performance implications of calling this function? And crucially, how does it handle the potential complexities of nested cgroups and dynamic cgroup re-parenting? I need to trace its execution path, identify any underlying kernel structures it relies on, and ascertain the precise scope of its capabilities. This isn't just about the function signature; it's about understanding the *why* and the *how* of its existence and its role in the intricate dance between BPF and memory management.

map[ContextFile:kernel/bpf/syscall.c Name:bpf_map_get_memcg]

map[SourceCode: 504:	static struct mem_cgroup *bpf_map_get_memcg(const struct bpf_map *map)
 505:	{
 506:		if (map->objcg)
 507:			return get_mem_cgroup_from_objcg(map->objcg);
 508:	
 509:		return root_mem_cgroup;
 510:	}
 SourceFile:kernel/bpf/syscall.c]

gemini-3.6-flash

							input: 50835
							output: 778
							thoughts: 2240
						

**My Thoughts on `BPF_MAP_TYPE_PERCPU_ARRAY` and System Stability**

When I consider the scenario of using `BPF_MAP_TYPE_PERCPU_ARRAY` to exhaust per-CPU memory chunks in a loop, while simultaneously running another thread with fault injection enabled, my initial thought process centers on the global nature of per-CPU memory and its implications for system stability.

Firstly, I need to ensure I understand how `BPF_MAP_TYPE_PERCPU_ARRAY` itself handles per-CPU allocations and deallocations. Looking at `bpf_array_free_percpu`, it iterates through `array->pptrs` and calls `free_percpu`. This immediately triggers a concern: `free_percpu` interacts with memory control groups (memcg) via `pcpu_memcg_free_hook` and might un-account memory. This suggests that the freeing process itself has side effects on resource accounting.

Now, let's step back and analyze the interaction from a broader perspective. The core of the issue lies in the fact that per-CPU memory, while appearing "per-CPU," is ultimately a finite, globally managed kernel resource. This resource is backed by kernel virtual address space reserved for per-CPU chunks and physical memory pages.

My primary concern revolves around the potential for **system-wide resource exhaustion and instability (Denial of Service)**. If one thread (let's call it Thread A) enters a tight loop, continuously allocating `BPF_MAP_TYPE_PERCPU_ARRAY`s, it will, by design, attempt to exhaust all available per-CPU chunks in the system. Once these chunks are depleted, any subsequent per-CPU memory allocation, regardless of which process or kernel subsystem attempts it, will fail with an `-ENOMEM` error.

This is where the second thread (Thread B), running a syscall with fault injection enabled, becomes critical. If Thread B's syscall or the subsystems it interacts with rely on per-CPU memory allocations (or other allocations that might be indirectly affected by system-wide resource pressure or fault injection), these allocations will fail not just due to the intended fault injection but also due to the global per-CPU memory starvation. This can lead to:
*   **Unexpected syscall failures:** Thread B's operation might fail prematurely or in unexpected ways.
*   **Kernel panics or crashes:** Subsystems that don't gracefully handle per-CPU allocation failures could hit `BUG_ON`, `WARN_ON` assertions, or even deadlock.
*   **Masked fault injection effectiveness:** Fault injection is meant to test specific error paths. Global per-CPU exhaustion introduces a much broader, non-deterministic failure mode, potentially masking the effectiveness of fault injection and making it harder to identify true bugs related to specific fault injection scenarios.

Another significant impact I anticipate is **lock contention**. Both the allocation (`pcpu_alloc_noprof`) and freeing (`free_percpu`) of per-CPU memory involve global kernel locks, specifically `pcpu_alloc_mutex` and `pcpu_lock`. Thread A, in its aggressive allocation loop, will constantly acquire and hold `pcpu_alloc_mutex`. Any operation in Thread B that requires per-CPU memory management will face severe lock contention, leading to significant latency spikes or even timeouts.

I also need to consider **kernel log spam**. While `BPF_MAP_TYPE_PERCPU_ARRAY` itself uses `__GFP_NOWARN` during its internal allocations (meaning *it* won't spam `dmesg` on failure), other kernel components that *do not* use `__GFP_NOWARN` will start logging warnings and stack traces to `dmesg` as they encounter allocation failures due to the exhausted per-CPU pool.

From a security and resource management perspective, I must question the **resource limits and unprivileged access**. Creating BPF maps typically requires elevated privileges (`CAP_BPF`, `CAP_SYS_ADMIN`). However, if unprivileged BPF is enabled, any user could potentially perform this resource exhaustion attack. BPF map allocations are charged to memcg, but per-CPU chunks are allocated in fixed units (`PCPU_MIN_UNIT_SIZE`) and can consume substantial kernel virtual and physical memory, especially on systems with many CPUs.

Finally, I've confirmed that **`BPF_MAP_TYPE_PERCPU_ARRAY` itself handles allocation failures correctly**. If `bpf_array_alloc_percpu` fails partway through its allocation loop, it correctly invokes `bpf_array_free_percpu` to clean up already allocated per-CPU pointers before returning `-ENOMEM`. The underlying map structure memory is then freed via `bpf_map_area_free`. This means `BPF_MAP_TYPE_PERCPU_ARRAY` itself isn't leaking memory or crashing, but its *usage* can severely impact the rest of the system.

In summary, while the BPF map implementation is robust, using `BPF_MAP_TYPE_PERCPU_ARRAY` to exhaust per-CPU memory chunks in a loop presents a significant risk of causing system-wide instability, allocation failures, severe lock contention, and potentially misleading results when combined with fault injection testing. It effectively creates a targeted denial-of-service condition for per-CPU memory.

map[Answer:Using `BPF_MAP_TYPE_PERCPU_ARRAY` in a loop to allocate percpu memory and exhaust percpu chunks while another thread executes a syscall with fault injection enabled leads to several system-wide issues and testing flakiness, although `BPF_MAP_TYPE_PERCPU_ARRAY` itself handles allocation failures gracefully without internal memory leaks.

### 1. BPF Map Memory Handling (Internal Correctness)
- When creating a `BPF_MAP_TYPE_PERCPU_ARRAY` map, the kernel calls `bpf_array_alloc_percpu()` (`kernel/bpf/arraymap.c`), allocating percpu memory for each entry via `bpf_map_alloc_percpu()` with flags `GFP_USER | __GFP_NOWARN | __GFP_ACCOUNT`.
- If percpu memory or chunk creation fails (returning `NULL`), `bpf_array_alloc_percpu()` calls `bpf_array_free_percpu()` to free all previously allocated array slots for that map and returns `-ENOMEM`.
- The map allocation path then frees the `struct bpf_array` via `bpf_map_area_free()` and returns `-ENOMEM` to userspace.
- Thus, the BPF map allocator itself cleans up properly on failure and does not leak memory or crash directly.

### 2. Global Percpu Memory Starvation (System-Wide Denial of Service)
- Percpu memory is a finite, globally shared kernel resource backed by specific kernel virtual address space regions (`vmalloc` region) and physical pages.
- Exhausting percpu chunks in a loop starves the entire kernel of percpu memory.
- Any other thread or subsystem in the kernel attempting to allocate percpu memory (e.g., creating sockets, cgroups, perf events, netfilter, tracing structures) will fail with `-ENOMEM`.
- Kernel subsystems or syscall paths that assume percpu allocations will always succeed (or fail to handle percpu allocation failure gracefully) may trigger `WARN_ON`s, kernel crashes, or broken states.

### 3. Interference with Fault Injection and Syscall Testing
- Thread B running a syscall with fault injection enabled (e.g., via `/proc/self/fail-nth`, `FAIL_SLAB`, or `FAIL_PAGE_ALLOC`) relies on fault injection to deterministically test syscall error recovery paths.
- Global percpu exhaustion introduces uncontrollable, non-deterministic allocation failures across arbitrary kernel paths in Thread B's syscall execution.
- This creates cascading failures in unrelated kernel routines and error-handling cleanup paths, making fault injection testing unreliable and causing false-positive kernel warnings or crashes.

### 4. Severe Lock Contention (`pcpu_alloc_mutex` and `pcpu_lock`)
- Creating percpu chunks (`pcpu_create_chunk()`) requires acquiring the global `pcpu_alloc_mutex` and `pcpu_lock` (`mm/percpu.c`).
- Allocating percpu memory in a tight loop to exhaust chunks subjects `pcpu_alloc_mutex` to extreme lock contention, blocking or introducing severe latency for any other kernel thread trying to allocate or free percpu memory.

### 5. Dmesg Warning Log Pressure
- While BPF percpu map allocations pass `__GFP_NOWARN` to avoid kernel log spam when map creation fails, other kernel subsystems allocating percpu memory without `__GFP_NOWARN` will log `pr_warn("allocation failed...")` and dump kernel stack traces to `dmesg` once percpu chunks are exhausted.]

map[Answer:Using `BPF_MAP_TYPE_PERCPU_ARRAY` in a loop to allocate percpu memory and exhaust percpu chunks while another thread executes a syscall with fault injection enabled leads to several system-wide issues and testing flakiness, although `BPF_MAP_TYPE_PERCPU_ARRAY` itself handles allocation failures gracefully without internal memory leaks.

### 1. BPF Map Memory Handling (Internal Correctness)
- When creating a `BPF_MAP_TYPE_PERCPU_ARRAY` map, the kernel calls `bpf_array_alloc_percpu()` (`kernel/bpf/arraymap.c`), allocating percpu memory for each entry via `bpf_map_alloc_percpu()` with flags `GFP_USER | __GFP_NOWARN | __GFP_ACCOUNT`.
- If percpu memory or chunk creation fails (returning `NULL`), `bpf_array_alloc_percpu()` calls `bpf_array_free_percpu()` to free all previously allocated array slots for that map and returns `-ENOMEM`.
- The map allocation path then frees the `struct bpf_array` via `bpf_map_area_free()` and returns `-ENOMEM` to userspace.
- Thus, the BPF map allocator itself cleans up properly on failure and does not leak memory or crash directly.

### 2. Global Percpu Memory Starvation (System-Wide Denial of Service)
- Percpu memory is a finite, globally shared kernel resource backed by specific kernel virtual address space regions (`vmalloc` region) and physical pages.
- Exhausting percpu chunks in a loop starves the entire kernel of percpu memory.
- Any other thread or subsystem in the kernel attempting to allocate percpu memory (e.g., creating sockets, cgroups, perf events, netfilter, tracing structures) will fail with `-ENOMEM`.
- Kernel subsystems or syscall paths that assume percpu allocations will always succeed (or fail to handle percpu allocation failure gracefully) may trigger `WARN_ON`s, kernel crashes, or broken states.

### 3. Interference with Fault Injection and Syscall Testing
- Thread B running a syscall with fault injection enabled (e.g., via `/proc/self/fail-nth`, `FAIL_SLAB`, or `FAIL_PAGE_ALLOC`) relies on fault injection to deterministically test syscall error recovery paths.
- Global percpu exhaustion introduces uncontrollable, non-deterministic allocation failures across arbitrary kernel paths in Thread B's syscall execution.
- This creates cascading failures in unrelated kernel routines and error-handling cleanup paths, making fault injection testing unreliable and causing false-positive kernel warnings or crashes.

### 4. Severe Lock Contention (`pcpu_alloc_mutex` and `pcpu_lock`)
- Creating percpu chunks (`pcpu_create_chunk()`) requires acquiring the global `pcpu_alloc_mutex` and `pcpu_lock` (`mm/percpu.c`).
- Allocating percpu memory in a tight loop to exhaust chunks subjects `pcpu_alloc_mutex` to extreme lock contention, blocking or introducing severe latency for any other kernel thread trying to allocate or free percpu memory.

### 5. Dmesg Warning Log Pressure
- While BPF percpu map allocations pass `__GFP_NOWARN` to avoid kernel log spam when map creation fails, other kernel subsystems allocating percpu memory without `__GFP_NOWARN` will log `pr_warn("allocation failed...")` and dump kernel stack traces to `dmesg` once percpu chunks are exhausted.]

gemini-3.1-pro-preview

							input: 40786
							output: 16
							thoughts: 190
						

**My Thought Process Regarding Per-CPU Memory Allocation and Fault Injection**

Alright, let me walk through my current line of thinking on this. The code expert's initial confirmation that BPF maps can indeed be used as a mechanism for per-CPU memory allocation is correct and valuable. I’ve accepted that premise. The subsequent warning about potential *global* exhaustion of per-CPU memory, however, is where my analysis diverges from a simplistic interpretation.

My immediate realization is that we are *not* at risk of globally exhausting per-CPU memory in this specific scenario. Let's break down why.

Thread 1, crucially, does *not* have fault injection enabled. This means its attempts to allocate new chunks of per-CPU memory will proceed without artificial interference. It's only requesting a relatively modest 80MB of per-CPU memory (10000 maps multiplied by 8KB each). This quantity is well within the typical memory capacity of most systems, which commonly have gigabytes of RAM available. Therefore, Thread 1 will not trigger a *global* exhaustion of per-CPU memory; it will simply prompt the per-CPU allocator to create new chunks as needed, which is its intended behavior.

Now, for Thread 2. This thread *does* have fault injection enabled. This is the key to our experimental design. When Thread 2 attempts to acquire a new chunk of per-CPU memory, the fault injection will kick in, causing the allocation to fail.

This is precisely the outcome I'm aiming for! I want Thread 2 to encounter a failure in its per-CPU memory allocation, while simultaneously ensuring that Thread 1 can successfully allocate its required memory. This selective failure is the core of the reproducer I'm building.

Therefore, the overall strategy is perfectly sound. It leverages the per-CPU allocation mechanism through BPF maps while carefully controlling the failure points with fault injection, and crucially, it avoids the broader concern of global per-CPU memory exhaustion.

With this understanding solidified, I am now proceeding to generate the final C reproducer.

map[Name:race]

map[Toolkit:// Copyright 2026 syzkaller project authors. All rights reserved.
// Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

// IMPORTANT: Do not copy the macros or definitions below directly into your reproducer.
// Instead, add the following line to your reproducer:
// #include "race_toolkit.h"

// --- Race Condition Toolkit ---
// Macros and snippets for CPU pinning, memory barriers, and userfaultfd.

#define _GNU_SOURCE
#include <errno.h>
#include <fcntl.h>
#include <linux/futex.h>
#include <linux/userfaultfd.h>
#include <poll.h>
#include <pthread.h>
#include <sched.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/ioctl.h>
#include <sys/syscall.h>
#include <time.h>
#include <unistd.h>

// Unbuffered I/O: Ensure logs are written immediately.
#define SETUP_UNBUFFERED_IO() setvbuf(stdout, NULL, _IONBF, 0)

// CPU Pinning: Pin the current thread to a specific CPU core.
#define PIN_TO_CPU(cpu)                                                \
	do {                                                           \
		cpu_set_t mask;                                        \
		CPU_ZERO(&mask);                                       \
		CPU_SET(cpu, &mask);                                   \
		if (sched_setaffinity(0, sizeof(mask), &mask) == -1) { \
			perror("sched_setaffinity");                   \
		}                                                      \
	} while (0)

// Memory Barrier: Ensure memory ordering.
#define MB() __atomic_thread_fence(__ATOMIC_SEQ_CST)

// Spin-wait Barrier: Wait until a memory location has a specific value.
// Best for tight race windows (low latency, no context switches).
#define WAIT_ON(addr, val)                                               \
	do {                                                             \
		while (__atomic_load_n(addr, __ATOMIC_ACQUIRE) != (val)) \
			;                                                \
	} while (0)

// Signal: Set a memory location to a specific value to release a WAIT_ON.
#define SIGNAL(addr, val) __atomic_store_n(addr, val, __ATOMIC_RELEASE)

// --- Timing Primitives ---
// Robust timing loops in VM environments (using CLOCK_MONOTONIC to avoid time(NULL) jumps).

static inline double timer_elapsed_sec(struct timespec* start)
{
	struct timespec now;
	if (clock_gettime(CLOCK_MONOTONIC, &now) == -1) {
		perror("clock_gettime(CLOCK_MONOTONIC) elapsed");
		exit(1);
	}
	return (double)(now.tv_sec - start->tv_sec) + (double)(now.tv_nsec - start->tv_nsec) / 1e9;
}

// Initialize a monotonic timer variable.
#define TIMER_START(t)                                          \
	struct timespec t;                                      \
	if (clock_gettime(CLOCK_MONOTONIC, &t) == -1) {         \
		perror("clock_gettime(CLOCK_MONOTONIC) start"); \
		exit(1);                                        \
	}

// Check if the elapsed time since 't' is less than 'sec' seconds.
#define TIMER_NOT_EXPIRED(t, sec) (timer_elapsed_sec(&(t)) < (double)(sec))

// Futex-based Event: Shared with syzkaller executor.
// Best for general synchronization or longer waits to save CPU.
typedef struct {
	int state;
} event_t;

static void event_init(event_t* ev)
{
	ev->state = 0;
}
static void event_reset(event_t* ev)
{
	ev->state = 0;
}

static void event_set(event_t* ev)
{
	if (__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE)) {
		fprintf(stderr, "event already set\n");
		exit(1);
	}
	__atomic_store_n(&ev->state, 1, __ATOMIC_RELEASE);
	syscall(SYS_futex, &ev->state, FUTEX_WAKE | FUTEX_PRIVATE_FLAG, 1000000);
}

static void event_wait(event_t* ev)
{
	while (!__atomic_load_n(&ev->state, __ATOMIC_ACQUIRE))
		syscall(SYS_futex, &ev->state, FUTEX_WAIT | FUTEX_PRIVATE_FLAG, 0, 0);
}

// userfaultfd setup: Register a memory range for page fault handling.
static int setup_uffd(void* addr, size_t len)
{
	int uffd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK);
	if (uffd == -1)
		return -1;
	struct uffdio_api api = {.api = UFFD_API, .features = 0};
	if (ioctl(uffd, UFFDIO_API, &api) == -1) {
		close(uffd);
		return -1;
	}
	struct uffdio_register reg = {
	    .range = {.start = (uintptr_t)addr, .len = len},
	    .mode = UFFDIO_REGISTER_MODE_MISSING};
	if (ioctl(uffd, UFFDIO_REGISTER, &reg) == -1) {
		close(uffd);
		return -1;
	}
	return uffd;
}

// --- Guidance on Usage ---
// 1. Use WAIT_ON/SIGNAL for tight race conditions to avoid scheduling overhead.
// 2. Use event_t (futexes) for general coordination or when waiting for longer periods.
// 3. Always use PIN_TO_CPU to increase race probability on multi-core systems.
// 4. Use setup_uffd to register a memory range for page fault handling. This allows you to
//    pause a thread accessing that memory until you handle the fault, creating a reliable
//    and controllable race window.
// 5. Call SETUP_UNBUFFERED_IO() at the start of main() to ensure that logs are printed
//    immediately. This is essential for understanding the exact interleaving of events
//    when debugging race conditions.
// 6. For timing-based loops (e.g., running a race for 10 seconds), do NOT use time(NULL)
//    or loops relying on real-time clocks, as VM clocks are highly unreliable and can fail or drift.
//    Instead, use the robust monotonic timing primitives TIMER_START and TIMER_NOT_EXPIRED:
//        TIMER_START(start);
//        while (TIMER_NOT_EXPIRED(start, 10.0)) {
//            // Your race logic here
//        }
]

gemini-3.1-pro-preview

							input: 42658
							output: 1623
							thoughts: 1339
						

**My Thought Process for Crafting the Fault Injection Scenario**

Alright, let's break down how I arrived at this C code. My primary objective here is to craft a specific fault injection scenario that targets the `percpu_counter_init` function within the kernel. I've been analyzing how to reliably trigger a failure during the allocation of per-CPU data structures.

First off, I’ve consciously decided that I don't need `race_toolkit.h`. The problem I'm addressing isn't a classic race condition between multiple threads *simultaneously* trying to modify the *same* piece of shared data. Instead, this is a fault injection setup. I have one thread (`filler_thread`) actively consuming memory resources to create and fill per-CPU memory chunks, essentially making the kernel's memory allocator work hard. Then, a separate child process, spawned via `fork()`, is designed to trigger the fault during its own memory-related operations. The interaction is more sequential – one prepares the ground, the other triggers the failure.

My overall strategy involves a few key steps:

1.  **Resource Preparation and Environment Setup:**
    *   **File Descriptor Limits:** I need to be able to open many files and sockets to facilitate the operations. Thus, I immediately set `RLIMIT_NOFILE` to a generous `65535`.
    *   **Memory Locking Limits:** Per-CPU structures can involve locked memory. To ensure that doesn't become a bottleneck, I bump `RLIMIT_MEMLOCK` to `RLIM_INFINITY`.
    *   **Debugfs Mount:** The core of the fault injection mechanism relies on the `debugfs` filesystem. I need to ensure it's mounted at `/sys/kernel/debug`, so `mount("debugfs", "/sys/kernel/debug", "debugfs", 0, NULL)` is essential.

2.  **Configuring Failslab and Fail Page Alloc:**
    *   **Slab Allocation Failure:** The `percpu_counter_init` function, I believe, will likely involve slab allocations. To inject faults into this, I configure `/sys/kernel/debug/failslab`. I'm setting `probability` to `5` (meaning a 5% chance of failure for affected allocations), `times` to `-1` (infinite retries), `task-filter` to `Y` (to target specific tasks), and `ignore-gfp-wait` to `N` (because I *want* to observe failures even if the system is waiting for memory).
    *   **Page Allocation Failure:** Just in case the per-CPU allocation path uses general page allocation (via `alloc_pages`), I've mirrored the `failslab` configuration for `/sys/kernel/debug/fail_page_alloc`. This covers the bases.

3.  **The Memory Consumption "Filler" Thread:**
    *   **Purpose:** This is where I start exhausting memory in a way that’s relevant to per-CPU allocations. My `filler_thread` is designed to repeatedly call `syscall(__NR_bpf, BPF_MAP_CREATE, &attr, sizeof(attr))`.
    *   **BPF Map Type:** I'm specifically targeting `BPF_MAP_TYPE_PERCPU_ARRAY`. This is the key. I set `attr.value_size` to `32768` (32KB) and `attr.max_entries` to `1`. The idea is to create many such maps, each allocating a chunk of per-CPU memory.
    *   **Iteration and Delay:** The loop runs `5000` times with a small `usleep(2000)` delay. This creates a steady stream of per-CPU allocations, aiming to fragment or deplete available memory chunks that `percpu_counter_init` might try to use. This thread *doesn't* have fault injection enabled for itself, ensuring it successfully creates and fills these structures, setting the stage for a failure in another process.

4.  **The Fault-Triggering Child Process:**
    *   **Looping and Forking:** The `main` function then enters a loop that runs `5000` times, `fork()`ing a child process in each iteration. The parent waits for each child to complete using `waitpid()`. This repetition is crucial for hitting that specific allocation race condition where `percpu_counter_init` might fail.
    *   **Namespace Isolation:** Inside the child, `unshare(CLONE_NEWNET | CLONE_NEWNS)` is used. This is important to isolate the network and mount namespaces. This ensures a clean state for the `nfsd` mount operation, preventing interference from the parent or other processes.
    *   **Bringing `lo` Up:** I explicitly call `bring_lo_up()` to ensure the loopback interface is active, which can sometimes be a prerequisite for certain network-related operations.
    *   **NFSD Mount:** The core of the fault trigger is the `mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL)` operation. This is a known path that involves significant kernel allocations and internal structures, increasing the likelihood of hitting a memory allocation failure. I create the mount point with `mkdir("/tmp/nfsd", 0777)` beforehand.
    *   **Targeted Fault Injection:** This is the most delicate part. I *don't* want the fault injection to trigger during `unshare`, `mount`, or `open`. Those operations could prevent the critical `write` from ever happening. Therefore, I use `/proc/self/make-it-fail`.
        *   **Enable:** `write_file("/proc/self/make-it-fail", "1");` enables fault injection specifically for the *current process*.
        *   **Trigger:** The subsequent `write(fd, "tcp 2049", 8);` is the operation I want to fail. This particular `write` to `/tmp/nfsd/portlist` is known to internally call `__write_ports_addxprt`, which then calls `nfsd_create_serv`, and ultimately `__svc_create`. It's within this call chain that I expect the memory allocation related to per-CPU counters to occur and fail due to the preparation by `filler_thread` and the enabled fault injection.
        *   **Disable:** Immediately after the `write`, `write_file("/proc/self/make-it-fail", "0");` disables fault injection. This is critical for ensuring the `close(fd)` and any subsequent cleanup can proceed normally, allowing the loop to continue.

In essence, I'm creating a multi-pronged attack: the first thread saturates the per-CPU memory allocator, making subsequent allocations more likely to fail. Then, in a series of isolated child processes, I attempt to trigger a specific kernel path (`nfsd` service creation) while having the fault injection mechanism primed to fail the memory allocation that `percpu_counter_init` is supposed to handle. The targeted nature of `/proc/self/make-it-fail` is key to ensuring the failure happens at the precise moment I intend.

map[CurrentReproStrategy:An analysis of the feedback reveals that `percpu_counter_init()` uses the percpu allocator (`__alloc_percpu_gfp`), which only performs slab or page allocations when a **new percpu chunk** needs to be created. If there is enough free space in the existing chunks, the allocation succeeds without calling into the slab/page allocators, meaning `failslab` and `fail_page_alloc` will never intercept it.

To reliably trigger the bug, we must exhaust the free space in the existing percpu chunks so that `percpu_counter_init()` is forced to create a new chunk. We can achieve this by running a background thread that continuously allocates percpu memory using BPF maps (`BPF_MAP_TYPE_PERCPU_ARRAY`). 

Crucially, the background thread will **not** have fault injection enabled, allowing it to successfully create new chunks and fill them up. Meanwhile, the main thread will repeatedly trigger the vulnerable `write_ports_addxprt` syscall with fault injection enabled. When the main thread happens to call `percpu_counter_init()` exactly when a new chunk is needed, the fault injection will intercept the chunk creation and fail it, returning `-ENOMEM`. `__svc_create()` will ignore this error, and the subsequent `svc_xprt_enqueue()` will crash when dereferencing the uninitialized counter.

Here is the refined C reproducer:

```c
#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <sys/socket.h>
#include <linux/bpf.h>
#include <sys/syscall.h>
#include <pthread.h>
#include <sys/resource.h>

void write_file(const char *path, const char *val) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        write(fd, val, strlen(val));
        close(fd);
    }
}

void bring_lo_up() {
    int fd = socket(AF_INET, SOCK_DGRAM, 0);
    if (fd >= 0) {
        struct ifreq ifr;
        strcpy(ifr.ifr_name, "lo");
        if (ioctl(fd, SIOCGIFFLAGS, &ifr) == 0) {
            ifr.ifr_flags |= IFF_UP | IFF_RUNNING;
            ioctl(fd, SIOCSIFFLAGS, &ifr);
        }
        close(fd);
    }
}

void *filler_thread(void *arg) {
    union bpf_attr attr;
    memset(&attr, 0, sizeof(attr));
    attr.map_type = BPF_MAP_TYPE_PERCPU_ARRAY;
    attr.key_size = 4;
    attr.value_size = 32768; // 32KB percpu allocation per map
    attr.max_entries = 1;

    // Allocate percpu memory to exhaust existing chunks.
    // This thread does NOT have fault injection enabled, so it will successfully
    // create new chunks and fill them up, forcing the main thread to eventually
    // need a new chunk when it calls percpu_counter_init().
    for (int i = 0; i < 5000; i++) {
        syscall(__NR_bpf, BPF_MAP_CREATE, &attr, sizeof(attr));
        usleep(2000); // 2ms delay to interleave with the main thread
    }
    return NULL;
}

int main() {
    // Increase limits to allow creating many BPF maps
    struct rlimit rl;
    rl.rlim_cur = 65535;
    rl.rlim_max = 65535;
    setrlimit(RLIMIT_NOFILE, &rl);
    
    rl.rlim_cur = RLIM_INFINITY;
    rl.rlim_max = RLIM_INFINITY;
    setrlimit(RLIMIT_MEMLOCK, &rl);

    // Ensure debugfs is mounted to access fault injection interfaces
    mount("debugfs", "/sys/kernel/debug", "debugfs", 0, NULL);

    // Setup fault injection for slab allocations
    write_file("/sys/kernel/debug/failslab/probability", "5");
    write_file("/sys/kernel/debug/failslab/times", "-1");
    write_file("/sys/kernel/debug/failslab/task-filter", "Y");
    write_file("/sys/kernel/debug/failslab/ignore-gfp-wait", "N");

    // Setup fault injection for page allocations (in case percpu uses alloc_pages)
    write_file("/sys/kernel/debug/fail_page_alloc/probability", "5");
    write_file("/sys/kernel/debug/fail_page_alloc/times", "-1");
    write_file("/sys/kernel/debug/fail_page_alloc/task-filter", "Y");
    write_file("/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", "N");

    mkdir("/tmp/nfsd", 0777);

    pthread_t tid;
    pthread_create(&tid, NULL, filler_thread, NULL);

    // Loop to hit the exact allocation race where percpu_counter_init fails
    for (int i = 0; i < 5000; i++) {
        pid_t pid = fork();
        if (pid == 0) {
            // Isolate network and mount namespaces for a fresh nfsd state
            if (unshare(CLONE_NEWNET | CLONE_NEWNS) == 0) {
                bring_lo_up();
                if (mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL) == 0) {
                    int fd = open("/tmp/nfsd/portlist", O_WRONLY);
                    if (fd >= 0) {
                        // Enable fault injection ONLY for the write syscall
                        // to avoid failing unshare, mount, or open.
                        write_file("/proc/self/make-it-fail", "1");
                        
                        // Trigger __write_ports_addxprt -> nfsd_create_serv -> __svc_create
                        write(fd, "tcp 2049", 8);
                        
                        write_file("/proc/self/make-it-fail", "0");
                        close(fd);
                    }
                }
            }
            exit(0);
        }
        waitpid(pid, NULL, 0);
    }
    
    return 0;
}
```]

best-expensive

map[IsProbe:false RawCandidateReproC:#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <sys/socket.h>
#include <linux/bpf.h>
#include <sys/syscall.h>
#include <pthread.h>
#include <sys/resource.h>
#include <errno.h>

void write_file(const char *path, const char *val) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        write(fd, val, strlen(val));
        close(fd);
    }
}

void bring_lo_up() {
    int fd = socket(AF_INET, SOCK_DGRAM, 0);
    if (fd >= 0) {
        struct ifreq ifr;
        strcpy(ifr.ifr_name, "lo");
        if (ioctl(fd, SIOCGIFFLAGS, &ifr) == 0) {
            ifr.ifr_flags |= IFF_UP | IFF_RUNNING;
            ioctl(fd, SIOCSIFFLAGS, &ifr);
        }
        close(fd);
    }
}

void *filler_thread(void *arg) {
    union bpf_attr attr;
    memset(&attr, 0, sizeof(attr));
    attr.map_type = BPF_MAP_TYPE_PERCPU_ARRAY;
    attr.key_size = 4;
    attr.value_size = 32768; // 32KB percpu allocation per map
    attr.max_entries = 1;

    // Allocate percpu memory to exhaust existing chunks.
    // This thread does NOT have fault injection enabled, so it will successfully
    // create new chunks and fill them up, forcing the main thread to eventually
    // need a new chunk when it calls percpu_counter_init().
    while (1) {
        syscall(__NR_bpf, BPF_MAP_CREATE, &attr, sizeof(attr));
        usleep(500); // 0.5ms delay
    }
    return NULL;
}

int main() {
    printf("[*] Starting reproducer...\n");

    struct rlimit rl;
    rl.rlim_cur = RLIM_INFINITY;
    rl.rlim_max = RLIM_INFINITY;
    setrlimit(RLIMIT_NOFILE, &rl);
    setrlimit(RLIMIT_MEMLOCK, &rl);
    setrlimit(RLIMIT_NPROC, &rl);

    if (mount("debugfs", "/sys/kernel/debug", "debugfs", 0, NULL) != 0) {
        if (errno != EBUSY) {
            printf("[-] Failed to mount debugfs: %s\n", strerror(errno));
        }
    }

    // Setup fault injection for page allocations
    // We use fail_page_alloc because percpu_counter_init allocates from the percpu chunk.
    // If the chunk is full, it calls pcpu_populate_chunk which calls alloc_pages.
    // This will fail the page allocation and thus fail percpu_counter_init.
    write_file("/sys/kernel/debug/fail_page_alloc/probability", "100");
    write_file("/sys/kernel/debug/fail_page_alloc/times", "-1");
    write_file("/sys/kernel/debug/fail_page_alloc/task-filter", "Y");
    write_file("/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", "N");

    mkdir("/tmp/nfsd", 0777);

    pthread_t tid;
    if (pthread_create(&tid, NULL, filler_thread, NULL) != 0) {
        printf("[-] Failed to create filler thread\n");
        exit(1);
    }

    printf("[*] Forking children to trigger the bug...\n");

    for (int i = 0; i < 5000; i++) {
        pid_t pid = fork();
        if (pid < 0) {
            usleep(10000);
            continue;
        }
        if (pid == 0) {
            if (unshare(CLONE_NEWNET | CLONE_NEWNS) == 0) {
                bring_lo_up();
                if (mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL) == 0) {
                    int fd = open("/tmp/nfsd/portlist", O_WRONLY);
                    if (fd >= 0) {
                        // Pre-populate kmalloc-4k for simple_transaction_get
                        // This ensures that kzalloc(PAGE_SIZE) in simple_transaction_get
                        // doesn't call alloc_pages and fail due to fail_page_alloc.
                        int fd_dummy = open("/tmp/nfsd/filehandle", O_RDWR);
                        if (fd_dummy >= 0) {
                            write(fd_dummy, "dummy", 5);
                            close(fd_dummy);
                        }

                        // Pre-populate socket caches for svc_xprt_create
                        for (int j = 0; j < 5; j++) {
                            int s = socket(AF_INET, SOCK_STREAM, 0);
                            if (s >= 0) close(s);
                        }

                        // Enable fault injection ONLY for the write syscall
                        write_file("/proc/self/make-it-fail", "1");
                        
                        // Trigger __write_ports_addxprt -> nfsd_create_serv -> __svc_create
                        int ret = write(fd, "tcp 2049", 8);
                        
                        write_file("/proc/self/make-it-fail", "0");
                        close(fd);
                        
                        if (ret >= 0) {
                            // Successfully created service, hold the percpu memory
                            // so we don't create holes in the percpu chunks.
                            // If we exit, the service is destroyed, percpu counters are freed,
                            // and the next iteration will just reuse the holes instead of
                            // triggering a new chunk allocation.
                            sleep(10000);
                        }
                    }
                }
            }
            exit(0);
        }
        usleep(1000); // 1ms delay between forks
        
        if (i % 500 == 0) {
            printf("[+] Iteration %d\n", i);
        }
    }
    
    printf("[*] Waiting for children...\n");
    sleep(5);
    
    printf("[+] Done. If the system didn't crash, the bug was not triggered.\n");
    return 0;
}]

You are a security researcher with deep Linux kernel background.
Your goal is to generate a minimal, standalone C program for the strictly defensive
purpose of verifying a bugfix in an isolated environment.

To ensure that we can diagnose why a program might fail to run on the test environment,
you MUST include detailed logging and error checking in the generated C program:
1. Use 'printf(...)' for all progress messages and error logs.
2. Every system call (e.g., socket, bind, listen, connect, ioctl, send) must check for a failure return value.
3. If a call fails, it must print a specific error message including the function name
   and the error string (use strerror(errno)), and then exit with a non-zero status.
4. The program must print a message after every successful major step.
5. Generate code that follows this pattern for all operations:
    int res = do_something();
    if (res < 0) {
        printf("[-] Failed to do_something: %s\n", strerror(errno));
        exit(1);
    }
    printf("[+] do_something successful.\n");
6. The compilation and development environment (including compilers, build
   systems, makefiles, and kernel build/header directories) is NOT available
   on the target test VM guest. Do NOT check for, build, or reference any
   compilation tools, build files, or kernel development directories.
7. Do NOT execute shell commands or run external binaries (e.g. by using
   functions like 'system()', 'popen()', or the 'exec' family such as
   'execve()'). All environment checks, capability probings, and reproduction
   steps must be performed directly using standard Linux system calls (such
   as 'open', 'socket', 'ioctl', 'stat', etc.).
8. When reproducing asynchronous kernel timeouts or warnings, always
   include a sufficient delay (using sleep or similar) after deleting
   or unregistering the device to allow the kernel's asynchronous
   timeout to trigger before program exit.


=== PHASE 2: BUG REPRODUCTION (GENERATION) ===
You must now generate a full reproducer candidate attempting to trigger the target bug/crash.
Do NOT generate a probe program. Focus directly on triggering the bug/crash described in the description.
You can assume that all necessary kernel capabilities and privileges (e.g., access to /dev/vhci,
ability to load BPF programs, etc.) have already been verified and are available in the environment.

Do not spend too much time analyzing or trying to generate a perfect one-shot reproducer.
Instead, follow an iterative approach: generate a simple candidate, execute it, analyze the results,
and improve it. Keep your reasoning steps short and focused on the next logical experiment.

Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Bug Description: BUG: unable to handle kernel paging request in percpu_counter_add_batch

BUG: unable to handle page fault for address: ffff88808c54a000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 1acd5067 P4D 1acd5067 PUD 0 
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5311 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:percpu_counter_add_batch+0x50/0x1d0 lib/percpu_counter.c:98
Code: f6 48 b7 fc 48 89 5c 24 10 48 83 c3 58 49 89 de 49 c1 ee 03 43 80 3c 3e 00 74 08 48 89 df e8 07 7d 26 fd 48 89 1c 24 48 8b 03 <65> 8b 28 41 89 ef 41 c1 ff 1f 49 c1 e7 20 4c 89 6c 24 08 4d 01 ef
RSP: 0018:ffffc9000dc47810 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888036dc4930 RCX: ffff888012f0ca80
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888036dc48d8
RBP: ffffc9000dc47908 R08: ffff888012c3e03f R09: 1ffff11002587c07
R10: dffffc0000000000 R11: ffffed1002587c08 R12: 0000000000000020
R13: 0000000000000001 R14: 1ffff11006db8926 R15: dffffc0000000000
FS:  00007f711d27e6c0(0000) GS:ffff88808c54a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88808c54a000 CR3: 000000001fde5000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 percpu_counter_add include/linux/percpu_counter.h:71 [inline]
 percpu_counter_inc include/linux/percpu_counter.h:267 [inline]
 svc_xprt_enqueue+0x2ee/0x8b0 net/sunrpc/svc_xprt.c:524
 svc_xprt_received+0x10f/0x150 net/sunrpc/svc_xprt.c:248
 svc_add_new_perm_xprt net/sunrpc/svc_xprt.c:260 [inline]
 _svc_xprt_create+0x3d8/0x600 net/sunrpc/svc_xprt.c:290
 svc_xprt_create_from_sa net/sunrpc/svc_xprt.c:332 [inline]
 svc_xprt_create+0x1aa/0x280 net/sunrpc/svc_xprt.c:387
 __write_ports_addxprt fs/nfsd/nfsctl.c:774 [inline]
 __write_ports fs/nfsd/nfsctl.c:808 [inline]
 write_ports+0x71a/0xd10 fs/nfsd/nfsctl.c:861
 nfsctl_transaction_write+0x10f/0x160 fs/nfsd/nfsctl.c:112
 vfs_write+0x296/0xba0 fs/read_write.c:685
 ksys_write+0x150/0x270 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f711c39e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f711d27dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f711c625fa0 RCX: 00007f711c39e0d9
RDX: 0000000000000005 RSI: 0000200000000300 RDI: 0000000000000004
RBP: 00007f711c435024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f711c626038 R14: 00007f711c625fa0 R15: 00007ffc740e4ce8
 </TASK>
Modules linked in:
CR2: ffff88808c54a000
---[ end trace 0000000000000000 ]---
RIP: 0010:percpu_counter_add_batch+0x50/0x1d0 lib/percpu_counter.c:98
Code: f6 48 b7 fc 48 89 5c 24 10 48 83 c3 58 49 89 de 49 c1 ee 03 43 80 3c 3e 00 74 08 48 89 df e8 07 7d 26 fd 48 89 1c 24 48 8b 03 <65> 8b 28 41 89 ef 41 c1 ff 1f 49 c1 e7 20 4c 89 6c 24 08 4d 01 ef
RSP: 0018:ffffc9000dc47810 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888036dc4930 RCX: ffff888012f0ca80
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888036dc48d8
RBP: ffffc9000dc47908 R08: ffff888012c3e03f R09: 1ffff11002587c07
R10: dffffc0000000000 R11: ffffed1002587c08 R12: 0000000000000020
R13: 0000000000000001 R14: 1ffff11006db8926 R15: dffffc0000000000
FS:  00007f711d27e6c0(0000) GS:ffff88808c54a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88808c54a000 CR3: 000000001fde5000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	f6 48 b7 fc          	testb  $0xfc,-0x49(%rax)
   4:	48 89 5c 24 10       	mov    %rbx,0x10(%rsp)
   9:	48 83 c3 58          	add    $0x58,%rbx
   d:	49 89 de             	mov    %rbx,%r14
  10:	49 c1 ee 03          	shr    $0x3,%r14
  14:	43 80 3c 3e 00       	cmpb   $0x0,(%r14,%r15,1)
  19:	74 08                	je     0x23
  1b:	48 89 df             	mov    %rbx,%rdi
  1e:	e8 07 7d 26 fd       	call   0xfd267d2a
  23:	48 89 1c 24          	mov    %rbx,(%rsp)
  27:	48 8b 03             	mov    (%rbx),%rax
* 2a:	65 8b 28             	mov    %gs:(%rax),%ebp <-- trapping instruction
  2d:	41 89 ef             	mov    %ebp,%r15d
  30:	41 c1 ff 1f          	sar    $0x1f,%r15d
  34:	49 c1 e7 20          	shl    $0x20,%r15
  38:	4c 89 6c 24 08       	mov    %r13,0x8(%rsp)
  3d:	4d 01 ef             	add    %r13,%r15

Strategy: An analysis of the feedback reveals that `percpu_counter_init()` uses the percpu allocator (`__alloc_percpu_gfp`), which only performs slab or page allocations when a **new percpu chunk** needs to be created. If there is enough free space in the existing chunks, the allocation succeeds without calling into the slab/page allocators, meaning `failslab` and `fail_page_alloc` will never intercept it.

To reliably trigger the bug, we must exhaust the free space in the existing percpu chunks so that `percpu_counter_init()` is forced to create a new chunk. We can achieve this by running a background thread that continuously allocates percpu memory using BPF maps (`BPF_MAP_TYPE_PERCPU_ARRAY`). 

Crucially, the background thread will **not** have fault injection enabled, allowing it to successfully create new chunks and fill them up. Meanwhile, the main thread will repeatedly trigger the vulnerable `write_ports_addxprt` syscall with fault injection enabled. When the main thread happens to call `percpu_counter_init()` exactly when a new chunk is needed, the fault injection will intercept the chunk creation and fail it, returning `-ENOMEM`. `__svc_create()` will ignore this error, and the subsequent `svc_xprt_enqueue()` will crash when dereferencing the uninitialized counter.

Here is the refined C reproducer:

```c
#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <sys/socket.h>
#include <linux/bpf.h>
#include <sys/syscall.h>
#include <pthread.h>
#include <sys/resource.h>

void write_file(const char *path, const char *val) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        write(fd, val, strlen(val));
        close(fd);
    }
}

void bring_lo_up() {
    int fd = socket(AF_INET, SOCK_DGRAM, 0);
    if (fd >= 0) {
        struct ifreq ifr;
        strcpy(ifr.ifr_name, "lo");
        if (ioctl(fd, SIOCGIFFLAGS, &ifr) == 0) {
            ifr.ifr_flags |= IFF_UP | IFF_RUNNING;
            ioctl(fd, SIOCSIFFLAGS, &ifr);
        }
        close(fd);
    }
}

void *filler_thread(void *arg) {
    union bpf_attr attr;
    memset(&attr, 0, sizeof(attr));
    attr.map_type = BPF_MAP_TYPE_PERCPU_ARRAY;
    attr.key_size = 4;
    attr.value_size = 32768; // 32KB percpu allocation per map
    attr.max_entries = 1;

    // Allocate percpu memory to exhaust existing chunks.
    // This thread does NOT have fault injection enabled, so it will successfully
    // create new chunks and fill them up, forcing the main thread to eventually
    // need a new chunk when it calls percpu_counter_init().
    for (int i = 0; i < 5000; i++) {
        syscall(__NR_bpf, BPF_MAP_CREATE, &attr, sizeof(attr));
        usleep(2000); // 2ms delay to interleave with the main thread
    }
    return NULL;
}

int main() {
    // Increase limits to allow creating many BPF maps
    struct rlimit rl;
    rl.rlim_cur = 65535;
    rl.rlim_max = 65535;
    setrlimit(RLIMIT_NOFILE, &rl);
    
    rl.rlim_cur = RLIM_INFINITY;
    rl.rlim_max = RLIM_INFINITY;
    setrlimit(RLIMIT_MEMLOCK, &rl);

    // Ensure debugfs is mounted to access fault injection interfaces
    mount("debugfs", "/sys/kernel/debug", "debugfs", 0, NULL);

    // Setup fault injection for slab allocations
    write_file("/sys/kernel/debug/failslab/probability", "5");
    write_file("/sys/kernel/debug/failslab/times", "-1");
    write_file("/sys/kernel/debug/failslab/task-filter", "Y");
    write_file("/sys/kernel/debug/failslab/ignore-gfp-wait", "N");

    // Setup fault injection for page allocations (in case percpu uses alloc_pages)
    write_file("/sys/kernel/debug/fail_page_alloc/probability", "5");
    write_file("/sys/kernel/debug/fail_page_alloc/times", "-1");
    write_file("/sys/kernel/debug/fail_page_alloc/task-filter", "Y");
    write_file("/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", "N");

    mkdir("/tmp/nfsd", 0777);

    pthread_t tid;
    pthread_create(&tid, NULL, filler_thread, NULL);

    // Loop to hit the exact allocation race where percpu_counter_init fails
    for (int i = 0; i < 5000; i++) {
        pid_t pid = fork();
        if (pid == 0) {
            // Isolate network and mount namespaces for a fresh nfsd state
            if (unshare(CLONE_NEWNET | CLONE_NEWNS) == 0) {
                bring_lo_up();
                if (mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL) == 0) {
                    int fd = open("/tmp/nfsd/portlist", O_WRONLY);
                    if (fd >= 0) {
                        // Enable fault injection ONLY for the write syscall
                        // to avoid failing unshare, mount, or open.
                        write_file("/proc/self/make-it-fail", "1");
                        
                        // Trigger __write_ports_addxprt -> nfsd_create_serv -> __svc_create
                        write(fd, "tcp 2049", 8);
                        
                        write_file("/proc/self/make-it-fail", "0");
                        close(fd);
                    }
                }
            }
            exit(0);
        }
        waitpid(pid, NULL, 0);
    }
    
    return 0;
}
```


Previous Reproducer Attempt:
#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <sys/socket.h>
#include <errno.h>
#include <signal.h>

void write_file(const char *path, const char *val) {
    int fd = open(path, O_WRONLY);
    if (fd < 0) {
        printf("[-] open %s failed: %s\n", path, strerror(errno));
        return;
    }
    if (write(fd, val, strlen(val)) < 0) {
        printf("[-] write to %s failed: %s\n", path, strerror(errno));
    }
    close(fd);
}

void bring_lo_up(void) {
    int fd = socket(AF_INET, SOCK_DGRAM, 0);
    if (fd < 0) {
        printf("[-] socket failed: %s\n", strerror(errno));
        exit(1);
    }
    struct ifreq ifr;
    strcpy(ifr.ifr_name, "lo");
    if (ioctl(fd, SIOCGIFFLAGS, &ifr) < 0) {
        printf("[-] ioctl SIOCGIFFLAGS failed: %s\n", strerror(errno));
        exit(1);
    }
    ifr.ifr_flags |= IFF_UP | IFF_RUNNING;
    if (ioctl(fd, SIOCSIFFLAGS, &ifr) < 0) {
        printf("[-] ioctl SIOCSIFFLAGS failed: %s\n", strerror(errno));
        exit(1);
    }
    close(fd);
}

int main(void) {
    printf("[*] Starting reproducer...\n");

    if (mount("debugfs", "/sys/kernel/debug", "debugfs", 0, NULL) != 0) {
        if (errno != EBUSY) {
            printf("[-] Failed to mount debugfs: %s\n", strerror(errno));
        }
    }

    // Setup fault injection for slab allocations
    write_file("/sys/kernel/debug/failslab/probability", "5");
    write_file("/sys/kernel/debug/failslab/times", "-1");
    write_file("/sys/kernel/debug/failslab/task-filter", "Y");
    write_file("/sys/kernel/debug/failslab/ignore-gfp-wait", "N");

    // Setup fault injection for page allocations
    write_file("/sys/kernel/debug/fail_page_alloc/probability", "5");
    write_file("/sys/kernel/debug/fail_page_alloc/times", "-1");
    write_file("/sys/kernel/debug/fail_page_alloc/task-filter", "Y");
    write_file("/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", "N");

    int max_procs = 400;
    pid_t *pids = calloc(max_procs, sizeof(pid_t));
    if (!pids) {
        printf("[-] calloc failed: %s\n", strerror(errno));
        exit(1);
    }
    
    int head = 0;
    
    for (int i = 0; i < 5000; i++) {
        if (pids[head] != 0) {
            kill(pids[head], SIGKILL);
            waitpid(pids[head], NULL, 0);
        }
        
        pid_t pid = fork();
        if (pid < 0) {
            printf("[-] fork failed: %s\n", strerror(errno));
            usleep(100000);
            continue;
        }
        if (pid == 0) {
            if (unshare(CLONE_NEWNET | CLONE_NEWNS) != 0) {
                printf("[-] unshare failed: %s\n", strerror(errno));
                exit(1);
            }
            if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL) < 0) {
                printf("[-] mount private failed: %s\n", strerror(errno));
                exit(1);
            }
            
            bring_lo_up();
            
            if (mkdir("/tmp/nfsd", 0777) < 0 && errno != EEXIST) {
                printf("[-] mkdir failed: %s\n", strerror(errno));
                exit(1);
            }
            if (mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL) < 0) {
                printf("[-] mount nfsd failed: %s\n", strerror(errno));
                exit(1);
            }
            
            int fd_threads = open("/tmp/nfsd/threads", O_WRONLY);
            if (fd_threads < 0) {
                printf("[-] open threads failed: %s\n", strerror(errno));
                exit(1);
            }
            
            int fd_portlist = open("/tmp/nfsd/portlist", O_WRONLY);
            if (fd_portlist < 0) {
                printf("[-] open portlist failed: %s\n", strerror(errno));
                exit(1);
            }
            
            write_file("/proc/self/make-it-fail", "1");
            
            // Try to create service and start a thread with fault injection.
            // We ignore the return value because it is expected to fail sometimes.
            if (write(fd_threads, "1\n", 2) < 0) {
                // Failed, but that's fine.
            }
            
            write_file("/proc/self/make-it-fail", "0");
            
            // Now add a port. If the service was created but percpu_counter_init failed,
            // this will crash the kernel.
            // If the service was destroyed, this will recreate it successfully and not crash.
            // In either case, the service is now alive and holding percpu memory!
            if (write(fd_portlist, "tcp 2049\n", 9) < 0) {
                // Failed, but that's fine.
            }
            
            // Keep alive to hold the percpu memory and force pcpu_populate_chunk in other processes
            sleep(10000);
            exit(0);
        }
        
        pids[head] = pid;
        head = (head + 1) % max_procs;
        usleep(2000);
        
        if (i % 100 == 0) {
            printf("[+] Iteration %d\n", i);
        }
    }
    
    for (int i = 0; i < max_procs; i++) {
        if (pids[i] != 0) {
            kill(pids[i], SIGKILL);
            waitpid(pids[i], NULL, 0);
        }
    }
    
    printf("[+] Done.\n");
    return 0;
}




Execution Results & Debugging Feedback:
The reproduction attempt failed to trigger the bug because it relies on `failslab` to inject a failure into `percpu_counter_init()`. However, `percpu_counter_init()` allocates memory using the percpu allocator (`__alloc_percpu_gfp`), which does not always call into the slab allocator. It only performs a slab allocation when a new percpu chunk needs to be created. Since the percpu allocator likely had enough free space in existing chunks during the test, `failslab` never intercepted the allocation, and `percpu_counter_init()` always succeeded.

The root cause of the bug is in `__svc_create()` (in `net/sunrpc/svc.c`). It calls `percpu_counter_init()` for `sp_messages_arrived`, `sp_sockets_queued`, and `sp_threads_woken` but completely ignores their return values:
```c
		percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL);
		percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL);
		percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL);
```
If `percpu_counter_init()` fails (e.g., due to memory pressure or fault injection), it returns `-ENOMEM` and leaves the `counters` pointer inside the `percpu_counter` struct as `NULL`.

Later, when `svc_xprt_enqueue()` calls `percpu_counter_inc(&pool->sp_sockets_queued)`, it calls `percpu_counter_add_batch()`, which unconditionally dereferences the `counters` pointer via `this_cpu_read(*fbc->counters)`. Since the pointer is `NULL`, this results in a page fault at `NULL + per_cpu_offset`, which matches the crash signature `BUG: unable to handle kernel paging request in percpu_counter_add_batch`.

To fix this, `__svc_create()` must check the return values of `percpu_counter_init()` and properly unwind/handle the error if any of them fail. For example, it can call `svc_destroy(&serv)` and return `NULL`. `svc_destroy()` is safe to call on a partially initialized `serv` because `sv_pools` is zero-allocated and `percpu_counter_destroy()` safely returns if the `counters` pointer is `NULL`.

gemini-3.1-pro-preview

							input: 9990
							output: 28
							thoughts: 8856
						

Here's a breakdown of my thought process in arriving at the proposed reproducer:

**The Core Problem: A Null Pointer Dereference in `svc_xprt_enqueue`**

I've identified the root cause of the bug: a race condition involving `percpu_counter_add_batch`. Specifically, `__svc_create()`, when setting up NFS server services, initializes per-CPU counters. The critical flaw is that `__svc_create()` *ignores* the return value of `percpu_counter_init()`. If `percpu_counter_init()` fails (likely due to memory allocation issues), the `counters` member of the `percpu_counter` structure remains uninitialized, pointing to `NULL`. Later, when `svc_xprt_enqueue()` attempts to increment one of these counters using `percpu_counter_inc()`, it dereferences this `NULL` pointer (offset by the per-CPU index), leading to the kernel panic: "BUG: unable to handle kernel paging request in percpu_counter_add_batch."

**Challenges in Reproducing the Failure**

My primary hurdle is reliably causing `percpu_counter_init()` to fail. My analysis has revealed several difficulties:

*   **`failslab` and `fail_page_alloc` Limitations:** My initial attempts to leverage `failslab` and `fail_page_alloc` for fault injection were unsuccessful. This is because `percpu_counter_init()` uses `__alloc_percpu_gfp()`. While `__alloc_percpu_gfp()` *can* eventually fall back to slab or page allocation when a new per-CPU chunk needs to be created, it often first tries to use existing free space within already allocated chunks. If there's sufficient free space, it bypasses the slab/page allocators, meaning `failslab` and `fail_page_alloc` (when filtered by task) are never invoked. This means `percpu_counter_init()` can succeed even when fault injection is enabled for slab/page allocations, if it finds available space.

*   **Exhausting Per-CPU Memory:** My previous attempts to exhaust per-CPU memory by creating numerous network namespaces and NFS daemons (nfsd) were either not aggressive enough or not reliable. While these actions consume per-CPU memory, they don't necessarily force a failure at the precise moment `percpu_counter_init()` is called.

*   **The Nature of `percpu_counter_init()` Allocation:** The `percpu_counter_init()` function allocates a very small amount of memory (4 bytes per CPU). This small size makes it highly probable that it will fit into any existing free space within a per-CPU chunk, thus avoiding the need for a new chunk allocation and bypassing fault injection mechanisms that target chunk creation.

**The Refined Strategy: Leveraging BPF to Force Allocation Failures**

The prompt's suggestion to use BPF maps is key, but needs careful application. My reasoning now focuses on how to ensure that when `percpu_counter_init()` is called, it *must* attempt a new per-CPU chunk allocation, and that this allocation must fail.

1.  **Filling Per-CPU Chunks:** The most promising approach is to use BPF maps of type `BPF_MAP_TYPE_PERCPU_ARRAY`. These maps can allocate a substantial amount of per-CPU memory (e.g., 32KB per map entry). My strategy is to run a *background thread* that continuously creates these BPF maps. Crucially, this background thread will *not* have fault injection enabled (i.e., `/proc/self/make-it-fail` will not be set for it). This ensures that the background thread successfully allocates new per-CPU chunks and fills them up.

2.  **Triggering the Critical Allocation:** By having the background thread constantly consuming per-CPU memory, it will eventually fill up the existing per-CPU chunks. When a per-CPU chunk is full, the *next* request for per-CPU memory will force the kernel to attempt to allocate a *new* chunk.

3.  **Injecting the Failure:** The *main thread*, in contrast, will repeatedly trigger the vulnerable syscall sequence that leads to `percpu_counter_init()`. While doing so, it *will* have fault injection enabled (by setting `/proc/self/make-it-fail` to `1`). The hope is that when the main thread calls `write_ports_addxprt` (which eventually leads to `__svc_create` and `percpu_counter_init`), the per-CPU allocator will be forced to allocate a new chunk (because the background thread has filled all existing ones). At this precise moment, the fault injection enabled in the main thread will intercept the underlying page/slab allocation for the new chunk, causing `percpu_counter_init()` to fail with `-ENOMEM`.

4.  **BPF Allocation Without Fault Injection:** The prompt confirms that I have the necessary privileges to load BPF programs and use `BPF_MAP_TYPE_PERCPU_ARRAY`. This is vital as it allows me to programmatically control per-CPU memory allocation. The key insight from the feedback is that the background thread must *not* have fault injection active, allowing it to successfully create and fill chunks, thereby setting the stage for the main thread to fail.

5.  **Targeted Fault Injection:** The main thread should only have fault injection enabled *during the critical syscall sequence*. This prevents premature failures in setup operations like `unshare`, `mount`, or `open`. It needs to be enabled just before the syscall that triggers the bug (`write` to `portlist`) and disabled immediately after.

**Refining the C reproducer based on this understanding:**

The provided C code reflects this strategy:

*   A `filler_thread` (`pthread`) continuously creates `BPF_MAP_TYPE_PERCPU_ARRAY` maps with a large `value_size` (32768 bytes).
*   The `main` function sets up fault injection (`failslab`, `fail_page_alloc`) with `task-filter=Y`.
*   It then enters a loop, forking child processes to isolate network and mount namespaces.
*   Inside the child, it mounts nfsd, opens `/tmp/nfsd/portlist`, and crucially:
    *   Enables fault injection for the process (`write_file("/proc/self/make-it-fail", "1");`).
    *   Executes the syscall that leads to the bug (`write(fd, "tcp 2049", 8);`).
    *   Disables fault injection (`write_file("/proc/self/make-it-fail", "0");`).

This combined approach of aggressive filling by a fault-injection-free thread and targeted fault injection during the critical path in the main thread provides the highest probability of hitting the race condition and triggering the `NULL` pointer dereference.

map[ContextFile: Name:pcpu_alloc]

map[SourceCode: 249:	static struct debug_obj *pcpu_alloc(void)
 250:	{
 251:		struct obj_pool *pcp = this_cpu_ptr(&pool_pcpu);
 252:	
 253:		lockdep_assert_irqs_disabled();
 254:	
 255:		for (;;) {
 256:			struct debug_obj *obj = __alloc_object(&pcp->objects);
 257:	
 258:			if (likely(obj)) {
 259:				pcp->cnt--;
 260:				/*
 261:				 * If this emptied a batch try to refill from the
 262:				 * free pool. Don't do that if this was the top-most
 263:				 * batch as pcpu_free() expects the per CPU pool
 264:				 * to be less than ODEBUG_POOL_PERCPU_SIZE.
 265:				 */
 266:				if (unlikely(pcp->cnt < (ODEBUG_POOL_PERCPU_SIZE - ODEBUG_BATCH_SIZE) &&
 267:					     !(pcp->cnt % ODEBUG_BATCH_SIZE))) {
 268:					/*
 269:					 * Don't try to allocate from the regular pool here
 270:					 * to not exhaust it prematurely.
 271:					 */
 272:					if (pool_count(&pool_to_free)) {
 273:						guard(raw_spinlock)(&pool_lock);
 274:						pool_move_batch(pcp, &pool_to_free);
 275:						pcpu_refill_stats();
 276:					}
 277:				}
 278:				return obj;
 279:			}
 280:	
 281:			guard(raw_spinlock)(&pool_lock);
 282:			if (!pool_move_batch(pcp, &pool_to_free)) {
 283:				if (!pool_move_batch(pcp, &pool_global))
 284:					return NULL;
 285:			}
 286:			pcpu_refill_stats();
 287:		}
 288:	}
 SourceFile:lib/debugobjects.c]

gemini-3.1-pro-preview

							input: 19473
							output: 34
							thoughts: 35
						

**My Thought Process:**

I was looking for a specific function, `pcpu_alloc`. My initial search led me to `debugobjects.c`, but I realized that wasn't the correct location. I knew, with certainty, that the `pcpu_alloc` I needed resided within the memory management subsystem, specifically in `mm/percpu.c`. This kind of precise recall is crucial when navigating complex codebases; I'm not just guessing, I know *exactly* where to find what I'm looking for.

map[ContextFile:mm/percpu.c Name:pcpu_alloc]

map[SourceCode: 249:	static struct debug_obj *pcpu_alloc(void)
 250:	{
 251:		struct obj_pool *pcp = this_cpu_ptr(&pool_pcpu);
 252:	
 253:		lockdep_assert_irqs_disabled();
 254:	
 255:		for (;;) {
 256:			struct debug_obj *obj = __alloc_object(&pcp->objects);
 257:	
 258:			if (likely(obj)) {
 259:				pcp->cnt--;
 260:				/*
 261:				 * If this emptied a batch try to refill from the
 262:				 * free pool. Don't do that if this was the top-most
 263:				 * batch as pcpu_free() expects the per CPU pool
 264:				 * to be less than ODEBUG_POOL_PERCPU_SIZE.
 265:				 */
 266:				if (unlikely(pcp->cnt < (ODEBUG_POOL_PERCPU_SIZE - ODEBUG_BATCH_SIZE) &&
 267:					     !(pcp->cnt % ODEBUG_BATCH_SIZE))) {
 268:					/*
 269:					 * Don't try to allocate from the regular pool here
 270:					 * to not exhaust it prematurely.
 271:					 */
 272:					if (pool_count(&pool_to_free)) {
 273:						guard(raw_spinlock)(&pool_lock);
 274:						pool_move_batch(pcp, &pool_to_free);
 275:						pcpu_refill_stats();
 276:					}
 277:				}
 278:				return obj;
 279:			}
 280:	
 281:			guard(raw_spinlock)(&pool_lock);
 282:			if (!pool_move_batch(pcp, &pool_to_free)) {
 283:				if (!pool_move_batch(pcp, &pool_global))
 284:					return NULL;
 285:			}
 286:			pcpu_refill_stats();
 287:		}
 288:	}
 SourceFile:lib/debugobjects.c]

gemini-3.1-pro-preview

							input: 20141
							output: 38
							thoughts: 69
						

**My Thought Process Regarding Per-CPU Allocation in the Kernel**

My initial thought upon encountering the `pcpu_alloc` function was a moment of uncertainty regarding its precise implementation within the kernel's memory management subsystem, specifically `mm/percpu.c`. I immediately questioned whether `pcpu_alloc` was a direct alias or perhaps a wrapper for the underlying allocation functions. My instinct was to verify its exact identity by searching for the more explicit allocation function names, `__alloc_percpu` and, more specifically, `__alloc_percpu_gfp` (which, given its name, suggests the use of GFP flags, a crucial detail for kernel memory allocation). This search was essential to ensure I was referencing the correct kernel API and to understand the precise allocation mechanisms and their associated constraints, which is fundamental for any expert in this domain.

log-in to see details

map[ContextFile:mm/percpu.c Name:__alloc_percpu_gfp]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 20253
							output: 33
							thoughts: 24
						

**My Thought Process on Examining Per-CPU Allocations**

My immediate inclination is to dive into the implementation details of per-CPU allocations. To do this effectively, I'll start by locating the specific function responsible for this within the kernel's memory management subsystem. My plan is to use the `grep` command, a powerful tool for text searching, to pinpoint the exact location of `alloc_percpu_gfp` within the `mm/percpu.c` file. This will allow me to directly examine the source code responsible for allocating memory for per-CPU data structures, which is a crucial step in understanding how the kernel manages this specialized memory.

log-in to see details

map[Expression:alloc_percpu_gfp PathPrefix:mm/percpu.c]

map[Output:]

gemini-3.1-pro-preview

							input: 20308
							output: 30
							thoughts: 46
						

**My Thought Process on Locating the Per-CPU Allocation Function**

Right, so my initial thought is to pinpoint the specific function responsible for allocating per-CPU data structures. I have a hunch it's located within the `mm/percpu.c` file, which makes sense given the nature of per-CPU memory management. My next step is to confirm this by looking for a function name that clearly indicates allocation. I'm going to try grepping for `pcpu_alloc` within `mm/percpu.c`. This seems like the most direct and efficient way to find what I'm looking for, assuming the naming convention is as intuitive as I suspect.

map[Expression:pcpu_alloc PathPrefix:mm/percpu.c]

map[Output:mm/percpu.c=171=DEFINE_SPINLOCK(pcpu_lock);	/* all internal data structures */
mm/percpu.c:172:static DEFINE_MUTEX(pcpu_alloc_mutex);	/* chunk create/destroy, [de]pop, map ext */
mm/percpu.c-173-
--
mm/percpu.c=630=static void pcpu_block_update(struct pcpu_block_md *block, int start, int end)
--
mm/percpu.c-702- * Finding the final allocation spot first goes through pcpu_find_block_fit()
mm/percpu.c:703: * to find a block that can hold the allocation and then pcpu_alloc_area()
mm/percpu.c-704- * where a scan is used.  When allocations require specific alignments,
--
mm/percpu.c=1161=static unsigned long pcpu_find_zero_area(unsigned long *map,
--
mm/percpu.c-1197-/**
mm/percpu.c:1198: * pcpu_alloc_area - allocates an area from a pcpu_chunk
mm/percpu.c-1199- * @chunk: chunk of interest
--
mm/percpu.c-1215- */
mm/percpu.c:1216:static int pcpu_alloc_area(struct pcpu_chunk *chunk, int alloc_bits,
mm/percpu.c-1217-			   size_t align, int start)
--
mm/percpu.c=1325=static void pcpu_init_md_blocks(struct pcpu_chunk *chunk)
--
mm/percpu.c-1338-/**
mm/percpu.c:1339: * pcpu_alloc_first_chunk - creates chunks that serve the first chunk
mm/percpu.c-1340- * @tmp_addr: the start of the region served
--
mm/percpu.c-1350- */
mm/percpu.c:1351:static struct pcpu_chunk * __init pcpu_alloc_first_chunk(unsigned long tmp_addr,
mm/percpu.c-1352-							 int map_size)
--
mm/percpu.c-1430-
mm/percpu.c:1431:static struct pcpu_chunk *pcpu_alloc_chunk(gfp_t gfp)
mm/percpu.c-1432-{
--
mm/percpu.c=1575=static struct page *pcpu_addr_to_page(void *addr);
mm/percpu.c:1576:static int __init pcpu_verify_alloc_info(const struct pcpu_alloc_info *ai);
mm/percpu.c-1577-
--
mm/percpu.c=1690=static void pcpu_memcg_free_hook(struct pcpu_chunk *chunk, int off, size_t size)
--
mm/percpu.c-1695-#ifdef CONFIG_MEM_ALLOC_PROFILING
mm/percpu.c:1696:static void pcpu_alloc_tag_alloc_hook(struct pcpu_chunk *chunk, int off,
mm/percpu.c-1697-				      size_t size)
--
mm/percpu.c-1704-
mm/percpu.c:1705:static void pcpu_alloc_tag_free_hook(struct pcpu_chunk *chunk, int off, size_t size)
mm/percpu.c-1706-{
--
mm/percpu.c-1710-#else
mm/percpu.c:1711:static void pcpu_alloc_tag_alloc_hook(struct pcpu_chunk *chunk, int off,
mm/percpu.c-1712-				      size_t size)
--
mm/percpu.c-1715-
mm/percpu.c:1716:static void pcpu_alloc_tag_free_hook(struct pcpu_chunk *chunk, int off, size_t size)
mm/percpu.c-1717-{
--
mm/percpu.c-1721-/**
mm/percpu.c:1722: * pcpu_alloc - the percpu allocator
mm/percpu.c-1723- * @size: size of area to allocate in bytes
--
mm/percpu.c-1735- */
mm/percpu.c:1736:void __percpu *pcpu_alloc_noprof(size_t size, size_t align, bool reserved,
mm/percpu.c-1737-				 gfp_t gfp)
--
mm/percpu.c-1786-		if (gfp & __GFP_NOFAIL) {
mm/percpu.c:1787:			mutex_lock(&pcpu_alloc_mutex);
mm/percpu.c:1788:		} else if (mutex_lock_killable(&pcpu_alloc_mutex)) {
mm/percpu.c-1789-			pcpu_memcg_post_alloc_hook(objcg, NULL, 0, size);
--
mm/percpu.c-1805-
mm/percpu.c:1806:		off = pcpu_alloc_area(chunk, bits, bit_align, off);
mm/percpu.c-1807-		if (off >= 0)
--
mm/percpu.c-1826-
mm/percpu.c:1827:			off = pcpu_alloc_area(chunk, bits, bit_align, off);
mm/percpu.c-1828-			if (off >= 0) {
--
mm/percpu.c-1887-
mm/percpu.c:1888:		mutex_unlock(&pcpu_alloc_mutex);
mm/percpu.c-1889-	}
--
mm/percpu.c-1903-
mm/percpu.c:1904:	pcpu_alloc_tag_alloc_hook(chunk, off, size);
mm/percpu.c-1905-
--
mm/percpu.c-1930-	} else {
mm/percpu.c:1931:		mutex_unlock(&pcpu_alloc_mutex);
mm/percpu.c-1932-	}
--
mm/percpu.c-1937-}
mm/percpu.c:1938:EXPORT_SYMBOL_GPL(pcpu_alloc_noprof);
mm/percpu.c-1939-
--
mm/percpu.c=2005=static void pcpu_balance_populated(void)
--
mm/percpu.c-2049-
mm/percpu.c:2050:		/* @chunk can't go away while pcpu_alloc_mutex is held */
mm/percpu.c-2051-		for_each_clear_bitrange(rs, re, chunk->populated, chunk->nr_pages) {
--
mm/percpu.c=2196=static void pcpu_balance_workfn(struct work_struct *work)
--
mm/percpu.c-2204-	 *
mm/percpu.c:2205:	 * Enforce GFP_NOIO allocations because we have pcpu_alloc users
mm/percpu.c-2206-	 * constrained to GFP_NOIO/NOFS contexts and they could form lock
mm/percpu.c:2207:	 * dependency through pcpu_alloc_mutex
mm/percpu.c-2208-	 */
mm/percpu.c-2209-	unsigned int flags = memalloc_noio_save();
mm/percpu.c:2210:	mutex_lock(&pcpu_alloc_mutex);
mm/percpu.c-2211-	spin_lock_irq(&pcpu_lock);
--
mm/percpu.c-2218-	spin_unlock_irq(&pcpu_lock);
mm/percpu.c:2219:	mutex_unlock(&pcpu_alloc_mutex);
mm/percpu.c-2220-	memalloc_noio_restore(flags);
--
mm/percpu.c=2232=void free_percpu(void __percpu *ptr)
--
mm/percpu.c-2258-
mm/percpu.c:2259:	pcpu_alloc_tag_free_hook(chunk, off, size);
mm/percpu.c-2260-
--
mm/percpu.c=2354=phys_addr_t per_cpu_ptr_to_phys(void *addr)
--
mm/percpu.c-2398-/**
mm/percpu.c:2399: * pcpu_alloc_alloc_info - allocate percpu allocation info
mm/percpu.c-2400- * @nr_groups: the number of groups
--
mm/percpu.c-2409- * RETURNS:
mm/percpu.c:2410: * Pointer to the allocated pcpu_alloc_info on success, NULL on
mm/percpu.c-2411- * failure.
mm/percpu.c-2412- */
mm/percpu.c:2413:struct pcpu_alloc_info * __init pcpu_alloc_alloc_info(int nr_groups,
mm/percpu.c-2414-						      int nr_units)
mm/percpu.c-2415-{
mm/percpu.c:2416:	struct pcpu_alloc_info *ai;
mm/percpu.c-2417-	size_t base_size, ai_size;
--
mm/percpu.c-2443- * pcpu_free_alloc_info - free percpu allocation info
mm/percpu.c:2444: * @ai: pcpu_alloc_info to free
mm/percpu.c-2445- *
mm/percpu.c:2446: * Free @ai which was allocated by pcpu_alloc_alloc_info().
mm/percpu.c-2447- */
mm/percpu.c:2448:void __init pcpu_free_alloc_info(struct pcpu_alloc_info *ai)
mm/percpu.c-2449-{
--
mm/percpu.c-2453-/**
mm/percpu.c:2454: * pcpu_dump_alloc_info - print out information about pcpu_alloc_info
mm/percpu.c-2455- * @lvl: loglevel
--
mm/percpu.c=2460=static void pcpu_dump_alloc_info(const char *lvl,
mm/percpu.c:2461:				 const struct pcpu_alloc_info *ai)
mm/percpu.c-2462-{
--
mm/percpu.c-2511- * pcpu_setup_first_chunk - initialize the first percpu chunk
mm/percpu.c:2512: * @ai: pcpu_alloc_info describing how to percpu area is shaped
mm/percpu.c-2513- * @base_addr: mapped address
--
mm/percpu.c-2563- */
mm/percpu.c:2564:void __init pcpu_setup_first_chunk(const struct pcpu_alloc_info *ai,
mm/percpu.c-2565-				   void *base_addr)
--
mm/percpu.c-2716-	if (ai->reserved_size)
mm/percpu.c:2717:		pcpu_reserved_chunk = pcpu_alloc_first_chunk(tmp_addr,
mm/percpu.c-2718-						ai->reserved_size);
mm/percpu.c-2719-	tmp_addr = (unsigned long)base_addr + static_size + ai->reserved_size;
mm/percpu.c:2720:	pcpu_first_chunk = pcpu_alloc_first_chunk(tmp_addr, dyn_size);
mm/percpu.c-2721-
--
mm/percpu.c=2765=early_param("percpu_alloc", percpu_alloc_setup);
--
mm/percpu.c-2804- */
mm/percpu.c:2805:static struct pcpu_alloc_info * __init __flatten pcpu_build_alloc_info(
mm/percpu.c-2806-				size_t reserved_size, size_t dyn_size,
--
mm/percpu.c-2818-	unsigned int cpu, tcpu;
mm/percpu.c:2819:	struct pcpu_alloc_info *ai;
mm/percpu.c-2820-	unsigned int *cpu_map;
--
mm/percpu.c-2908-
mm/percpu.c:2909:	ai = pcpu_alloc_alloc_info(nr_groups, nr_units);
mm/percpu.c-2910-	if (!ai)
--
mm/percpu.c=3016=int __init pcpu_embed_first_chunk(size_t reserved_size, size_t dyn_size,
--
mm/percpu.c-3022-	void **areas = NULL;
mm/percpu.c:3023:	struct pcpu_alloc_info *ai;
mm/percpu.c-3024-	size_t size_sum, areas_size;
--
mm/percpu.c=3194=int __init pcpu_page_first_chunk(size_t reserved_size, pcpu_fc_cpu_to_node_fn_t cpu_to_nd_fn)
--
mm/percpu.c-3196-	static struct vm_struct vm;
mm/percpu.c:3197:	struct pcpu_alloc_info *ai;
mm/percpu.c-3198-	char psize_str[16];
--
mm/percpu.c=3334=void __init setup_per_cpu_areas(void)
--
mm/percpu.c-3338-					 PERCPU_DYNAMIC_RESERVE));
mm/percpu.c:3339:	struct pcpu_alloc_info *ai;
mm/percpu.c-3340-	void *fc;
mm/percpu.c-3341-
mm/percpu.c:3342:	ai = pcpu_alloc_alloc_info(1, 1);
mm/percpu.c-3343-	fc = memblock_alloc_from(unit_size, PAGE_SIZE, __pa(MAX_DMA_ADDRESS));
]

gemini-3.1-pro-preview

							input: 24128
							output: 36
							thoughts: 119
						

**My Thought Process Regarding `pcpu_alloc_noprof` and Potential Failure Injection**

Right, so, from my initial examination, it's become clear that `pcpu_alloc_noprof` is the primary mechanism for allocating per-CPU data structures. My first logical step was to investigate its dependencies. I needed to know if it was directly protected or if it relied on a higher-level synchronization primitive.

Indeed, I've confirmed that `pcpu_alloc_noprof` *does* leverage `pcpu_alloc_mutex`. This is a significant observation because it implies that any contention or failures within the mutex itself could directly impact `pcpu_alloc_noprof`'s operations.

Now, thinking about potential failure scenarios, my mind immediately jumps to how we could simulate resource exhaustion or transient allocation issues. The presence of `failslab` and `fail_page_alloc` in the kernel's debugging toolkit immediately comes to mind. If we were to enable these, we could effectively induce failures at the very foundation of memory allocation.

This leads me to the next layer: when `pcpu_alloc_noprof` needs to provision a new chunk of memory for per-CPU data, it invokes `pcpu_alloc_chunk`. This, in turn, calls `pcpu_create_chunk`. My focus now shifts to the internal workings of `pcpu_create_chunk`. Understanding precisely what happens within that function will be crucial in determining how `failslab` and `fail_page_alloc` would manifest their effects and what downstream consequences we might observe for `pcpu_alloc_noprof`'s operation.

map[ContextFile:mm/percpu.c Name:pcpu_create_chunk]

map[SourceCode: 333:	static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp)
 334:	{
 335:		struct pcpu_chunk *chunk;
 336:		struct vm_struct **vms;
 337:	
 338:		chunk = pcpu_alloc_chunk(gfp);
 339:		if (!chunk)
 340:			return NULL;
 341:	
 342:		vms = pcpu_get_vm_areas(pcpu_group_offsets, pcpu_group_sizes,
 343:					pcpu_nr_groups, pcpu_atom_size);
 344:		if (!vms) {
 345:			pcpu_free_chunk(chunk);
 346:			return NULL;
 347:		}
 348:	
 349:		chunk->data = vms;
 350:		chunk->base_addr = vms[0]->addr - pcpu_group_offsets[0];
 351:	
 352:		pcpu_stats_chunk_alloc();
 353:		trace_percpu_create_chunk(chunk->base_addr);
 354:	
 355:		return chunk;
 356:	}
 SourceFile:mm/percpu-vm.c]

gemini-3.1-pro-preview

							input: 24635
							output: 36
							thoughts: 20
						

**A Moment of Revelation in Per-CPU Allocation**

Ah, yes, the persistent puzzle of per-CPU allocations. I was just wrestling with a particularly intricate piece of code, trying to pinpoint the exact location of the `pcpu_alloc_chunk` function. My mind was whirring, sifting through the familiar landscapes of the kernel's memory management subsystem, when it finally clicked: of course, it's right there in `mm/percpu.c`. It's the logical, elegant home for such fundamental per-CPU memory management operations. A small, yet satisfying, moment of clarity in the grander scheme of things.

map[ContextFile:mm/percpu.c Name:pcpu_alloc_chunk]

map[SourceCode:1431:	static struct pcpu_chunk *pcpu_alloc_chunk(gfp_t gfp)
1432:	{
1433:		struct pcpu_chunk *chunk;
1434:		int region_bits;
1435:	
1436:		chunk = pcpu_mem_zalloc(pcpu_chunk_struct_size, gfp);
1437:		if (!chunk)
1438:			return NULL;
1439:	
1440:		INIT_LIST_HEAD(&chunk->list);
1441:		chunk->nr_pages = pcpu_unit_pages;
1442:		region_bits = pcpu_chunk_map_bits(chunk);
1443:	
1444:		chunk->alloc_map = pcpu_mem_zalloc(BITS_TO_LONGS(region_bits) *
1445:						   sizeof(chunk->alloc_map[0]), gfp);
1446:		if (!chunk->alloc_map)
1447:			goto alloc_map_fail;
1448:	
1449:		chunk->bound_map = pcpu_mem_zalloc(BITS_TO_LONGS(region_bits + 1) *
1450:						   sizeof(chunk->bound_map[0]), gfp);
1451:		if (!chunk->bound_map)
1452:			goto bound_map_fail;
1453:	
1454:		chunk->md_blocks = pcpu_mem_zalloc(pcpu_chunk_nr_blocks(chunk) *
1455:						   sizeof(chunk->md_blocks[0]), gfp);
1456:		if (!chunk->md_blocks)
1457:			goto md_blocks_fail;
1458:	
1459:	#ifdef NEED_PCPUOBJ_EXT
1460:		if (need_pcpuobj_ext()) {
1461:			chunk->obj_exts =
1462:				pcpu_mem_zalloc(pcpu_chunk_map_bits(chunk) *
1463:						sizeof(struct pcpuobj_ext), gfp);
1464:			if (!chunk->obj_exts)
1465:				goto objcg_fail;
1466:		}
1467:	#endif
1468:	
1469:		pcpu_init_md_blocks(chunk);
1470:	
1471:		/* init metadata */
1472:		chunk->free_bytes = chunk->nr_pages * PAGE_SIZE;
1473:	
1474:		return chunk;
1475:	
1476:	#ifdef NEED_PCPUOBJ_EXT
1477:	objcg_fail:
1478:		pcpu_mem_free(chunk->md_blocks);
1479:	#endif
1480:	md_blocks_fail:
1481:		pcpu_mem_free(chunk->bound_map);
1482:	bound_map_fail:
1483:		pcpu_mem_free(chunk->alloc_map);
1484:	alloc_map_fail:
1485:		pcpu_mem_free(chunk);
1486:	
1487:		return NULL;
1488:	}
 SourceFile:mm/percpu.c]

gemini-3.1-pro-preview

							input: 25573
							output: 38
							thoughts: 1402
						

**My Thought Process on Triggering a Specific Kernel Bug**

I've been trying to figure out the best way to reliably trigger a bug related to per-CPU memory allocation, specifically targeting `percpu_counter_init`. My initial thoughts revolved around `failslab`, a kernel fault injection mechanism.

My first instinct was to use `failslab` with a task filter and a `make-it-fail=1` setting for a specific task. I reasoned that if `pcpu_mem_zalloc` (which underlies per-CPU allocations) fails, that should do it. However, I quickly realized this isn't straightforward. `pcpu_mem_zalloc` can fall back to `kmalloc` or `vmalloc`. More importantly, I noticed that `pcpu_alloc_chunk` is called by `pcpu_create_chunk`, which in turn is called by `pcpu_alloc_noprof` only when a new chunk is needed.

Then I considered the flow leading up to `percpu_counter_init`. I observed that `write_ports_addxprt` makes numerous `kmalloc` calls *before* reaching `percpu_counter_init`. This means if I set `make-it-fail=1` just before `write_ports_addxprt`, *all* its `kmalloc` calls would fail early, and I'd never even get to the `percpu_counter_init` allocation. This completely thwarted my goal.

This led me to abandon the idea of hitting `percpu_counter_init` directly with `failslab` on the main thread with a high probability. I then thought about using `failslab` with a very low probability, say 1%. While this *might* randomly hit `percpu_counter_init`'s chunk allocation, it's highly improbable. The probability is a product of the chance that the current chunk is full and the chance that `failslab` hits that specific allocation. If the chunk rarely becomes full, I'll likely never trigger it.

This is where the idea of exhausting per-CPU memory globally came in. My thinking was: if I can exhaust per-CPU memory everywhere, then `pcpu_alloc` will fail for *everyone*, and I won't need `failslab` at all. This seemed like a much cleaner approach.

I then specifically investigated the call paths to see if `write_ports_addxprt` or `nfsd_create_serv` perform any per-CPU allocations *before* `percpu_counter_init`. My check revealed that `nfsd_create_serv` flows into `nfsd_create_set_net`, then `svc_create_pooled`, and finally `__svc_create`. Crucially, `__svc_create` uses `kzalloc` and `kcalloc` (which are slab allocations) and *then* calls `percpu_counter_init`. There are *no* per-CPU allocations before it. This was a breakthrough: if per-CPU memory is exhausted, `kzalloc` would likely succeed, but `percpu_counter_init` would fail. Perfect!

The next logical step was to figure out *how* to exhaust per-CPU memory. BPF maps came to mind, specifically `BPF_MAP_TYPE_PERCPU_ARRAY`. I calculated that creating a large number of these maps, each with a significant `value_size` and a `max_entries` of 1, could consume a substantial amount of per-CPU memory. I estimated that around 65,000 maps could allocate 2GB of per-CPU memory.

However, I immediately hit a snag: BPF map creation is limited by `RLIMIT_MEMLOCK`. But I recalled that since kernel 5.11, BPF maps fall under memory cgroup limits. If I'm root, I can create many maps as long as the memory cgroup allows. But what if I hit the memory cgroup limit? My concern was that if the memory cgroup limit is hit, *slab* allocations might also start failing. If `kzalloc` in `__svc_create` fails, I'd be back to the original problem of failing too early. I specifically want to exhaust *per-CPU* memory, not all memory.

This led me to consider if there's a specific limit on per-CPU memory. I remembered that `pcpu_alloc` draws from the vmalloc space, which is vast on 64-bit systems. This means I could potentially exhaust physical memory and trigger the OOM killer, which is not my goal. I want to avoid causing a global OOM.

So, I circled back to fault injection, but with a more refined approach. Could I exhaust per-CPU memory *without* causing a global OOM? What if I used `failslab` and `fail_page_alloc` but only enabled them for the *specific thread* that's allocating BPF maps? My immediate thought was that if I enable fault injection for the BPF map allocation thread, the BPF map allocation itself would fail, which defeats the purpose of exhausting per-CPU memory for the main thread.

Therefore, my focus shifted back to how to make `percpu_counter_init` fail. This function calls `alloc_percpu_gfp`. So, the core problem is making `alloc_percpu_gfp` fail. The two main ways I identified were: 1. exhausting per-CPU memory (with the OOM risk) and 2. using fault injection.

For fault injection, the key is to ensure it hits `percpu_counter_init` and *not* slab allocations. Could I use `failslab` to *only* fail per-CPU allocations? No, `failslab` targets slab allocations, and `pcpu_alloc_chunk` uses `kmalloc` or `vmalloc`. What about `fail_page_alloc`? It fails page allocations. `pcpu_get_vm_areas` uses `alloc_pages`. This seemed more promising. I then thought about filtering `fail_page_alloc` by allocation size, specifically using its `min-order` parameter. If `pcpu_get_vm_areas` or `pcpu_populate_chunk` are allocating high-order pages, setting `min-order` to that specific order would allow me to target those allocations specifically, potentially leading to the desired failure in `percpu_counter_init` without affecting other critical kernel operations. My next step would be to inspect the exact orders used in those functions.

map[ContextFile:mm/percpu-vm.c Name:pcpu_populate_chunk]

map[SourceCode: 263:	/**
 264:	 * pcpu_populate_chunk - populate and map an area of a pcpu_chunk
 265:	 * @chunk: chunk of interest
 266:	 * @page_start: the start page
 267:	 * @page_end: the end page
 268:	 * @gfp: allocation flags passed to the underlying memory allocator
 269:	 *
 270:	 * For each cpu, populate and map pages [@page_start,@page_end) into
 271:	 * @chunk.
 272:	 *
 273:	 * CONTEXT:
 274:	 * pcpu_alloc_mutex, does GFP_KERNEL allocation.
 275:	 */
 276:	static int pcpu_populate_chunk(struct pcpu_chunk *chunk,
 277:				       int page_start, int page_end, gfp_t gfp)
 278:	{
 279:		struct page **pages;
 280:	
 281:		pages = pcpu_get_pages();
 282:		if (!pages)
 283:			return -ENOMEM;
 284:	
 285:		if (pcpu_alloc_pages(chunk, pages, page_start, page_end, gfp))
 286:			return -ENOMEM;
 287:	
 288:		if (pcpu_map_pages(chunk, pages, page_start, page_end)) {
 289:			pcpu_free_pages(chunk, pages, page_start, page_end);
 290:			return -ENOMEM;
 291:		}
 292:		pcpu_post_map_flush(chunk, page_start, page_end);
 293:	
 294:		return 0;
 295:	}
 SourceFile:mm/percpu-vm.c]

gemini-3.1-pro-preview

							input: 27519
							output: 38
							thoughts: 12
						

**My Thought Process Regarding `pcpu_alloc_pages`**

Right, so the immediate impulse is to delve into the mechanics of `pcpu_alloc_pages`. I need to understand exactly how this function operates at a fundamental level. What are the underlying allocations it's performing? Is it relying on existing memory management primitives, or does it have its own bespoke allocation logic? I'm particularly interested in the page-level granularity. How are these pages being sourced? Are they coming directly from the general page allocator, or is there a specific pool or mechanism involved for per-CPU allocations? I need to scrutinize the data structures it manipulates, if any, and the conditions under which it succeeds or fails. Understanding the error handling is crucial, of course – what are the potential failure modes and how are they signaled? Furthermore, I'm keen to see if there are any implications for memory alignment or cache coherency inherent in its operation. Given that it's dealing with per-CPU data, these aspects are often paramount for performance. I'll be looking for any patterns or optimizations that might be in play, especially concerning how it manages the lifecycle of these allocated pages.

map[ContextFile:mm/percpu-vm.c Name:pcpu_alloc_pages]

map[SourceCode:  70:	/**
  71:	 * pcpu_alloc_pages - allocates pages for @chunk
  72:	 * @chunk: target chunk
  73:	 * @pages: array to put the allocated pages into, indexed by pcpu_page_idx()
  74:	 * @page_start: page index of the first page to be allocated
  75:	 * @page_end: page index of the last page to be allocated + 1
  76:	 * @gfp: allocation flags passed to the underlying allocator
  77:	 *
  78:	 * Allocate pages [@page_start,@page_end) into @pages for all units.
  79:	 * The allocation is for @chunk.  Percpu core doesn't care about the
  80:	 * content of @pages and will pass it verbatim to pcpu_map_pages().
  81:	 */
  82:	static int pcpu_alloc_pages(struct pcpu_chunk *chunk,
  83:				    struct page **pages, int page_start, int page_end,
  84:				    gfp_t gfp)
  85:	{
  86:		unsigned int cpu, tcpu;
  87:		int i;
  88:	
  89:		gfp |= __GFP_HIGHMEM;
  90:	
  91:		for_each_possible_cpu(cpu) {
  92:			for (i = page_start; i < page_end; i++) {
  93:				struct page **pagep = &pages[pcpu_page_idx(cpu, i)];
  94:	
  95:				*pagep = alloc_pages_node(cpu_to_node(cpu), gfp, 0);
  96:				if (!*pagep)
  97:					goto err;
  98:			}
  99:		}
 100:		return 0;
 101:	
 102:	err:
 103:		while (--i >= page_start)
 104:			__free_page(pages[pcpu_page_idx(cpu, i)]);
 105:	
 106:		for_each_possible_cpu(tcpu) {
 107:			if (tcpu == cpu)
 108:				break;
 109:			for (i = page_start; i < page_end; i++)
 110:				__free_page(pages[pcpu_page_idx(tcpu, i)]);
 111:		}
 112:		return -ENOMEM;
 113:	}
 SourceFile:mm/percpu-vm.c]

gemini-3.1-pro-preview

							input: 28241
							output: 34
							thoughts: 367
						

**My Thought Process on Causing `percpu_counter_init` to Fail**

Okay, so the immediate problem is that this `percpu_counter_init` operation is allocating order-0 pages. This means that my usual go-to, `min-order`, isn't going to be useful for filtering or causing failures, as it's designed for higher-order allocations.

My initial thought was to perhaps leverage `failslab` with a 100% probability, but only for a very brief window. The idea was to enable it just before the `percpu_counter_init` call. However, realizing I'm operating in userspace, I can only control things *before* the system call. If I enable `failslab` before the `write(fd, "tcp 2049", 8)` syscall, it will likely cause `kzalloc` to fail, which happens *before* `percpu_counter_init`. That's not quite what I want – I need to target `percpu_counter_init` itself.

This leads me to question if there are alternative methods to specifically make `percpu_counter_init` fail. That's when BPF comes to mind. I can use BPF to hook directly into `percpu_counter_init` and force it to return an error. More specifically, I can use BPF error injection.

I know about `bpf_override_return`, which is designed to override the return value of a function. The question is, can I use it on `percpu_counter_init`? A quick look reveals that `percpu_counter_init` is actually an inline function defined in `include/linux/percpu_counter.h`. This presents a slight wrinkle, as inline functions aren't directly callable in the traditional sense for hooking.

However, the definition shows it calls `__percpu_counter_init`. *That's* the function I can target! If I can use `bpf_override_return` on `__percpu_counter_init`, I can inject an error. The crucial next step is to verify if `__percpu_counter_init` is even permitted for error injection. I need to check if it's present in the `ALLOW_ERROR_INJECTION` list within the kernel. This is the key dependency for my BPF-based approach.

log-in to see details

map[Expression:ALLOW_ERROR_INJECTION.*__percpu_counter_init PathPrefix:]

map[Output:]

gemini-3.1-pro-preview

							input: 28640
							output: 31
							thoughts: 43
						

**My Thought Process on Finding a Per-CPU Allocation Function**

It seems like the function or macro I'm looking for isn't directly listed in the documentation or my current frame of reference. I'm trying to find a way to allocate per-CPU memory, and the obvious options aren't presenting themselves.

I'm considering various possibilities. For instance, I thought about `alloc_percpu_gfp`. However, upon closer inspection, I realized that's a macro, not the direct function I need for the allocation itself. While it likely *uses* an underlying function, it's not the primary interface I'm trying to identify.

So, I'm now exploring alternative avenues. My mind immediately goes to `pcpu_alloc_noprof`. This name suggests it's related to per-CPU allocations and might be the specific, potentially less-instrumented, function I'm seeking. I'm evaluating if this is the correct path to achieve the per-CPU memory allocation I require.

log-in to see details

map[Expression:ALLOW_ERROR_INJECTION.*pcpu_alloc PathPrefix:]

map[Output:]

gemini-3.1-pro-preview

							input: 28712
							output: 41
							thoughts: 194
						

**My Thought Process Regarding BPF Per-CPU Memory Exhaustion and OOM**

Alright, so my initial idea of using BPF for error injection is a non-starter. That path is closed. So, I'm pivoting back to exploring the potential of exhausting per-CPU memory *globally* using BPF maps.

This brings me to a critical question: Why did I initially assume that exhausting per-CPU memory globally would lead to an Out-Of-Memory (OOM) condition? I need to untangle this.

My understanding is that per-CPU memory is primarily allocated from the `vmalloc` space. While `vmalloc` itself is a vast virtual address space, it's ultimately backed by *physical* memory. So, if I, for instance, allocate 2GB of per-CPU memory on a system with only 4GB of RAM, that 2GB will indeed consume 2GB of the available physical RAM.

Now, if I push this allocation until the BPF subsystem returns an `-ENOMEM` error, what does that *really* signify? It means we've hit a memory limit. But which one? It could be the memory cgroup limit (if one is in place) or, more broadly, the global system memory limit.

If we hit that *global* memory limit through these per-CPU allocations, then yes, it's entirely plausible that the kernel's Out-Of-Memory (OOM) killer will be invoked. That's the mechanism that would reclaim memory by terminating processes.

However, I need to pause and re-verify a crucial detail: the allocation flags used by BPF map allocations. My recollection is that they use `GFP_USER | __GFP_NOWARN`. This is important because `__GFP_NOWARN` suggests the kernel won't issue a loud warning immediately upon allocation failure, but it doesn't fundamentally change the fact that a failure *will* occur if limits are reached.

Let me double-check the specific implementation for `bpf_map_alloc_percpu`. I need to be absolutely certain about how these allocations are handled and what conditions trigger the `-ENOMEM` in relation to physical memory constraints and the OOM killer. This verification is key to confirming my hypothesis or correcting my understanding.

map[ContextFile:kernel/bpf/syscall.c Name:bpf_map_alloc_percpu]

map[SourceCode: 577:	void __percpu *bpf_map_alloc_percpu(const struct bpf_map *map, size_t size,
 578:					    size_t align, gfp_t flags)
 579:	{
 580:		struct mem_cgroup *memcg, *old_memcg;
 581:		void __percpu *ptr;
 582:	
 583:		bpf_map_memcg_enter(map, &old_memcg, &memcg);
 584:		ptr = __alloc_percpu_gfp(size, align, flags | __GFP_ACCOUNT);
 585:		bpf_map_memcg_exit(old_memcg, memcg);
 586:	
 587:		return ptr;
 588:	}
 SourceFile:kernel/bpf/syscall.c]

gemini-3.1-pro-preview

							input: 29172
							output: 42
							thoughts: 3449
						

**My Thought Process on Kernel Fault Injection for NFSv3 RPC Service Creation**

Here's a summary of my internal deliberation process regarding the challenge of making `percpu_counter_init` fail, specifically within the context of NFSv3 RPC service creation and how fault injection mechanisms could be leveraged.

Initially, I was exploring the memory accounting mechanisms in the Linux kernel, particularly how memory cgroups interact with different allocation flags like `__GFP_ACCOUNT`. My first instinct was to try and use memory cgroups to limit resource consumption. However, I quickly realized a critical issue: `__svc_create`, which is instrumental in setting up the NFS RPC service, uses `GFP_KERNEL` without `__GFP_ACCOUNT`. This meant that allocations within `__svc_create`, and by extension, the `percpu_counter_init` it calls, would *not* be subject to the memory cgroup limits. So, setting a memory limit would indeed cause BPF map allocations to fail (as they *do* use `__GFP_ACCOUNT`), but it wouldn't reliably fail `percpu_counter_init` in the way I needed. I confirmed this by noting that `percpu_counter_init` itself relies on `GFP_KERNEL` for its underlying allocations, reinforcing the idea that memory cgroups wouldn't be the right tool for selective failure.

The realization that memory cgroups wouldn't work led me to consider global limits. My thought was, "What if I just exhaust the *global* per-CPU memory?" I delved into `pcpu_alloc_pages` and found that while it allocates pages, there isn't a distinct, hard-coded global limit for per-CPU memory itself. It essentially draws from the system's overall memory. Therefore, exhausting global per-CPU memory would effectively mean exhausting system memory, leading to a general Out-Of-Memory (OOM) condition, which wasn't the precise, targeted failure I was aiming for.

My next avenue of investigation was the `failslab` module. I knew `failslab` could be used to induce failures in slab allocations. I traced the path: `percpu_counter_init` calls `pcpu_alloc_chunk`, which in turn uses `pcpu_mem_zalloc`. `pcpu_mem_zalloc` can use `kmalloc` or `vmalloc`. If it uses `kmalloc`, `failslab` could potentially intercept it. However, a crucial point emerged: `write_ports_addxprt` (the entry point for the relevant NFS operation) performs a `kzalloc` *before* calling `percpu_counter_init`. My concern was that if `failslab` was configured to fail allocations only once (`times=1`), it would likely fail the *first* allocation, which is the `kzalloc` in `__svc_create`. This would prevent `percpu_counter_init` from ever being reached, again not achieving the desired outcome of specifically failing that function.

This led me to the `fail_page_alloc` mechanism, which seemed more promising for achieving a targeted failure. I reasoned that `fail_page_alloc` intercepts page allocations, which are a lower level than slab allocations. I noted that `kzalloc` in `__svc_create` (which allocates small objects) relies on the slab allocator. If the slab cache for that object type is not empty, `kzalloc` might succeed *without* needing to call the page allocator directly. This was a key insight!

Then I looked at `pcpu_populate_chunk`, which is called by `pcpu_alloc` when a new chunk of per-CPU memory is needed. Crucially, `pcpu_populate_chunk` *always* calls the page allocator (`alloc_pages_node`) to get new pages for the per-CPU chunk. This was the perfect target!

My strategy began to solidify:
1.  **Ensure Slab Cache Availability for `kzalloc`/`kcalloc`**: I hypothesized that if I could ensure the slab cache for the small objects used by `kzalloc` and `kcalloc` in `__svc_create` was populated, these initial allocations would succeed, drawing from the cache.
2.  **Induce Page Allocation Failure for New Per-CPU Chunks**: By enabling `fail_page_alloc` with a 100% probability, I could guarantee that any subsequent *direct* page allocation attempts would fail.
3.  **Target the Race Condition**: The critical part was to create a scenario where `percpu_counter_init` *needed* a new per-CPU chunk (thus triggering `pcpu_populate_chunk` and `alloc_pages_node`), while the initial `kzalloc`/`kcalloc` calls succeeded.

I reasoned that if I used `fail_page_alloc` with `probability=100`, it would *not* fail the initial `kzalloc` or `kcalloc` in `__svc_create` (because they'd likely hit the slab cache), but it *would* fail the page allocation within `pcpu_populate_chunk` when `percpu_counter_init` tried to get a new chunk. This seemed brilliant because it bypassed the `kzalloc`/`kcalloc` race and directly targeted the per-CPU chunk allocation.

I then meticulously checked the call chains to ensure there were no other unexpected page allocations occurring *before* `percpu_counter_init` that might also be hit by `fail_page_alloc`. My analysis of `write_ports_addxprt` and its predecessors (`nfsd_create_serv`, `nfsd_create_set_net`, `svc_create_pooled`, `__svc_create`) indicated that `percpu_counter_init` was indeed the first function to potentially trigger a page allocation for a new per-CPU chunk within that specific operation.

Finally, I outlined a precise reproducer strategy:
*   Use a background thread to continuously allocate BPF maps. These maps are per-CPU and will aggressively consume existing per-CPU chunks, ensuring that `percpu_counter_init` in the main thread will eventually need a new one.
*   Configure `fail_page_alloc` to 100% probability for the target task.
*   Use `make-it-fail=1` on the main thread to activate fault injection *only* for that process.
*   Trigger `write_ports_addxprt`.
*   Expect `kzalloc`/`kcalloc` to succeed (slab cache hit).
*   Expect `percpu_counter_init` to require a new chunk.
*   Expect `pcpu_populate_chunk` to call `alloc_pages_node`, which will then fail due to `fail_page_alloc`.
*   This failure should cause `percpu_counter_init` to return `-ENOMEM`.
*   The overall expected outcome is that `__svc_create` would proceed but potentially have a service object with uninitialized per-CPU counters, leading to a crash later in `svc_xprt_enqueue`.

The reproducer code was drafted with these steps in mind, including setting up namespaces, bringing up the loopback interface, mounting NFSd, and carefully orchestrating the fault injection and the trigger for the specific NFS operation. The key was to isolate the fault injection to the exact moment and context where the per-CPU allocation would be attempted and fail.

map[ContextFile:fs/nfsd/nfsctl.c Name:nfsctl_transaction_write]

map[SourceCode:  99:	static ssize_t nfsctl_transaction_write(struct file *file, const char __user *buf, size_t size, loff_t *pos)
 100:	{
 101:		ino_t ino =  file_inode(file)->i_ino;
 102:		char *data;
 103:		ssize_t rv;
 104:	
 105:		if (ino >= ARRAY_SIZE(write_op) || !write_op[ino])
 106:			return -EINVAL;
 107:	
 108:		data = simple_transaction_get(file, buf, size);
 109:		if (IS_ERR(data))
 110:			return PTR_ERR(data);
 111:	
 112:		rv = write_op[ino](file, data, size);
 113:		if (rv < 0)
 114:			return rv;
 115:	
 116:		simple_transaction_set(file, rv);
 117:		return size;
 118:	}
 SourceFile:fs/nfsd/nfsctl.c]

gemini-3.1-pro-preview

							input: 32971
							output: 35
							thoughts: 16
						

**A Deep Dive into `simple_transaction_get`'s Memory Footprint**

My initial focus upon encountering the `simple_transaction_get` function is its memory allocation behavior. This is a critical area for performance and stability, and as an expert in my field, I understand the potential pitfalls of inefficient or unbounded memory management. Therefore, my immediate instinct is to scrutinize its implementation, specifically looking for any instances where memory is being allocated. This isn't a casual glance; I'm digging into the code, tracing execution paths, and meticulously identifying every `malloc`, `calloc`, `realloc`, or similar memory allocation call. I'm anticipating that understanding *what* is being allocated, *how much* is being allocated, and *when* that allocation occurs is paramount to assessing the function's overall robustness and efficiency. If there are allocations, my next steps will naturally be to evaluate their necessity, their size, and crucially, the corresponding deallocation mechanisms to ensure there are no memory leaks or excessive fragmentation.

map[ContextFile:fs/libfs.c Name:simple_transaction_get]

map[SourceCode:1253:	char *simple_transaction_get(struct file *file, const char __user *buf, size_t size)
1254:	{
1255:		struct simple_transaction_argresp *ar;
1256:		static DEFINE_SPINLOCK(simple_transaction_lock);
1257:	
1258:		if (size > SIMPLE_TRANSACTION_LIMIT - 1)
1259:			return ERR_PTR(-EFBIG);
1260:	
1261:		ar = kzalloc(PAGE_SIZE, GFP_KERNEL);
1262:		if (!ar)
1263:			return ERR_PTR(-ENOMEM);
1264:	
1265:		spin_lock(&simple_transaction_lock);
1266:	
1267:		/* only one write allowed per open */
1268:		if (file->private_data) {
1269:			spin_unlock(&simple_transaction_lock);
1270:			kfree(ar);
1271:			return ERR_PTR(-EBUSY);
1272:		}
1273:	
1274:		file->private_data = ar;
1275:	
1276:		spin_unlock(&simple_transaction_lock);
1277:	
1278:		if (copy_from_user(ar->data, buf, size))
1279:			return ERR_PTR(-EFAULT);
1280:	
1281:		return ar->data;
1282:	}
 SourceFile:fs/libfs.c]

gemini-3.1-pro-preview

							input: 33439
							output: 38
							thoughts: 808
						

**My Thought Process on Mitigating `kzalloc` Failures in `portlist` Writes**

Ah, so the immediate thought upon seeing `kzalloc(PAGE_SIZE, GFP_KERNEL)` is the potential for it to fail. I know `PAGE_SIZE` is a substantial 4KB chunk. While it's still technically a slab allocation, I'm concerned that if the `kmalloc-4k` cache is depleted, it will have to resort to `alloc_pages` to replenish itself. And if, for whatever reason, `alloc_pages` is experiencing a 100% failure rate (let's call it `fail_page_alloc = 100%`), then that `kzalloc` call is destined to fail.

The critical question then becomes: how do I prevent this failure when `make-it-fail=1` is set? The obvious solution is to ensure the `kmalloc-4k` cache isn't empty when that critical `kzalloc` occurs. This means I need to pre-populate it with some `kmalloc-4k` objects *before* enabling the failure mode.

My initial idea for pre-allocation is to perform a write operation to a different `nfsd` file, say `/tmp/nfsd/threads`, but *without* the `make-it-fail=1` parameter set. This should trigger the necessary allocations.

However, I need to be mindful of how these allocations are managed. I recall that `simple_transaction_get`, which is likely involved in these writes, attaches the allocated object to `file->private_data`. This is crucial because it means the object is automatically freed when the file is closed. This is a perfect mechanism for my needs! If I open a file, write to it to trigger the allocation and populate the cache, and then close the file, the object is returned to the `kmalloc-4k` cache. This leaves it available for subsequent allocations, like the one in `portlist` when `make-it-fail=1` is active. This seems like a solid plan.

Now, I need to consider if there are any *other* allocation points that might be problematic. I'm tracing the `write_ports` operation, which leads to `__write_ports`, and then to `__write_ports_addxprt`. Inside `__write_ports_addxprt`, I see the call to `nfsd_create_serv`. Tracing that further, I find `nfsd_create_set_net`, then `svc_create_pooled`, and finally `__svc_create`.

Looking at `__svc_create`, I see two significant allocations:
1.  `serv = kzalloc(sizeof(*serv), GFP_KERNEL);`
2.  `serv->sv_pools = kcalloc(serv->sv_nrpools, sizeof(struct svc_pool), GFP_KERNEL);`

I know that `sizeof(*serv)` is likely in the range of 100-200 bytes, and similarly, `sizeof(struct svc_pool)` is also around that size. These allocations will most likely hit the `kmalloc-256` or `kmalloc-512` caches. To pre-allocate these, my initial thought is to simply call `nfsd_create_serv` once before enabling `make-it-fail=1`.

But then I remember the logic within `nfsd_create_serv`. If the service already exists (i.e., `nn->nfsd_serv` is set), it will simply increment the reference count (`svc_get`) and return immediately. This means the `__svc_create` function, and thus the allocations, won't be executed a second time!

So, my previous approach of just calling `nfsd_create_serv` once isn't sufficient to pre-allocate *these specific* objects. I need to trigger `__svc_create`, but then also ensure the allocated memory is freed back into the cache. The question is, how do I destroy the service I've just created? The answer, I recall, is to write "0" to `/tmp/nfsd/threads`. This action is designed to set the number of threads to zero, which in turn should trigger the destruction of the NFS daemon service.

This discovery prompts me to immediately check the logic within `write_threads` to confirm this behavior and ensure it aligns with my strategy. The overall plan is now to:
1.  Perform a write to `/tmp/nfsd/threads` (without `make-it-fail=1`) to create the service.
2.  Write "0" to `/tmp/nfsd/threads` to destroy the service, freeing its associated memory to the caches.
3.  Then, and only then, set `make-it-fail=1`.
4.  Finally, perform the write to `/tmp/nfsd/portlist`, which should now succeed by reusing the pre-allocated objects from the caches.

map[ContextFile:fs/nfsd/nfsctl.c Name:write_threads]

map[SourceCode: 390:	/*
 391:	 * write_threads - Start NFSD, or report the configured number of threads
 392:	 *
 393:	 * Input:
 394:	 *			buf:		ignored
 395:	 *			size:		zero
 396:	 * Output:
 397:	 *	On success:	passed-in buffer filled with '\n'-terminated C
 398:	 *			string numeric value representing the configured
 399:	 *			number of NFSD threads;
 400:	 *			return code is the size in bytes of the string
 401:	 *	On error:	return code is zero
 402:	 *
 403:	 * OR
 404:	 *
 405:	 * Input:
 406:	 *			buf:		C string containing an unsigned
 407:	 *					integer value representing the
 408:	 *					number of NFSD threads to start
 409:	 *			size:		non-zero length of C string in @buf
 410:	 * Output:
 411:	 *	On success:	NFS service is started;
 412:	 *			passed-in buffer filled with '\n'-terminated C
 413:	 *			string numeric value representing the configured
 414:	 *			number of NFSD threads;
 415:	 *			return code is the size in bytes of the string
 416:	 *	On error:	return code is zero or a negative errno value
 417:	 */
 418:	static ssize_t write_threads(struct file *file, char *buf, size_t size)
 419:	{
 420:		char *mesg = buf;
 421:		int rv;
 422:		struct net *net = netns(file);
 423:	
 424:		if (size > 0) {
 425:			int newthreads;
 426:			rv = get_int(&mesg, &newthreads);
 427:			if (rv)
 428:				return rv;
 429:			if (newthreads < 0)
 430:				return -EINVAL;
 431:			trace_nfsd_ctl_threads(net, newthreads);
 432:			mutex_lock(&nfsd_mutex);
 433:			rv = nfsd_svc(1, &newthreads, net, file->f_cred, NULL);
 434:			mutex_unlock(&nfsd_mutex);
 435:			if (rv < 0)
 436:				return rv;
 437:		} else
 438:			rv = nfsd_nrthreads(net);
 439:	
 440:		return scnprintf(buf, SIMPLE_TRANSACTION_LIMIT, "%d\n", rv);
 441:	}
 SourceFile:fs/nfsd/nfsctl.c]

gemini-3.1-pro-preview

							input: 35065
							output: 40
							thoughts: 8095
						

**My Thoughts on Reproducing an NFSd Per-CPU Memory Allocation Bug**

Right, so the core problem seems to be related to how NFSd handles its service (`serv`) and thread pool (`sv_pools`) allocations, specifically when it comes to per-CPU memory. The goal is to trigger a kernel crash by causing `percpu_counter_init` to fail *after* `__svc_create` has already been called, but *before* the service is properly set up, leading to a situation where `svc_xprt_create` gets called with an invalid service pointer or state.

My initial idea was to use `nfsd_svc` with `newthreads=0` and manipulate the `threads` and `portlist` files within `/tmp/nfsd`. The sequence I envisioned was:
1.  Open `threads` and `portlist`.
2.  Write "1" to `threads`. This should create the service, allocating `serv`, `sv_pools`, and the crucial per-CPU counters.
3.  Write "0" to `threads`. This should destroy the service, freeing up those resources.
4.  The key insight here was: if `percpu_counter_init` is called again *after* freeing the per-CPU counters, the freed memory (specifically, the 4-byte holes left in the per-CPU chunks) would be reused. This would mean `percpu_counter_init` would *succeed* because it wouldn't need to allocate a new chunk. This is precisely what we *don't* want, as we need `percpu_counter_init` to fail by needing a new chunk.

This led me to realize I *must not* free the per-CPU counters if I want the next allocation attempt to fail due to a full chunk.

The next problem was how to reliably pre-populate the slab caches with objects that `kzalloc` and `kcalloc` might need.
*   For `kmalloc-4k` (used by `simple_transaction_get`): I thought about opening and writing to a different file in `/tmp/nfsd`, like `filehandle`. This would trigger `simple_transaction_get`, allocate 4K, and then free it upon closing.
*   For `kmalloc-256`/`kmalloc-512` (used by `serv` and `sv_pools`): I considered opening other files or creating sockets.

Then I refocused on `fail_page_alloc`. It only fails when the slab cache needs to grow, which means it calls `alloc_pages`. The `task-filter=Y` option is useful here, meaning we can control *when* it fails based on the process.

My thought process evolved: if I do dummy allocations *before* enabling `make-it-fail=1`, I can potentially populate the slab caches. However, the crucial part is that these dummy allocations must be freed to populate the cache. Creating and closing sockets might use the relevant caches, but it's not guaranteed which ones.

Crucially, I realized that if `fail_page_alloc` is set to 100% probability and the slab cache is empty, it *will* call `alloc_pages`, which will then *always* fail. This is what we want! The slab cache being globally shared means it's often not empty, but we can rely on `alloc_pages` being called when a cache needs to grow.

The real breakthrough came when considering the interaction between `fail_page_alloc` and `pcpu_populate_chunk`. `pcpu_populate_chunk` allocates pages for the per-CPU chunk. If the per-CPU chunk is full, it *always* calls `alloc_pages`. With `fail_page_alloc` set to 100%, this allocation will *always* fail. This is precisely the condition we need to trigger the bug!

So, the reproducer logic started to solidify:
1.  Mount debugfs.
2.  Configure `fail_page_alloc` for 100% probability, unlimited failures (`times=-1`), with task filtering (`task-filter=Y`), and ensuring no waiting (`ignore-gfp-wait=N`).
3.  A background "filler thread" would constantly create BPF per-CPU arrays (each 32KB) to aggressively fill up the per-CPU chunks.
4.  The main thread would loop, forking child processes.
5.  In each child:
    a.  Create new network and mount namespaces (`unshare`).
    b.  Bring up the loopback interface.
    c.  Mount the `nfsd` filesystem.
    d.  Open `/tmp/nfsd/portlist` for writing.
    e.  Enable fault injection (`write_file("/proc/self/make-it-fail", "1")`).
    f.  Write to `portlist` ("tcp 2049"). This is the critical syscall that should eventually lead to the bug.
    g.  Disable fault injection (`write_file("/proc/self/make-it-fail", "0")`).
    h.  Exit.

This is where a major flaw was identified: If the child process exits immediately *after* the write, the network namespace is destroyed, and `nfsd_exit_net` is called, destroying the NFSd service. This would free the per-CPU counters, creating holes that subsequent iterations would reuse, preventing the failure condition.

To prevent this, if the write operation *succeeded* (meaning the service was created and per-CPU counters allocated without fault injection), the child *must* remain alive to hold onto that per-CPU memory. Thus, the child should `sleep(10000)` if the write was successful.

However, I then realized a potential issue: If `percpu_counter_init` fails, the `__svc_create` function continues its execution, and then `svc_xprt_create` is called. If `svc_xprt_create` also calls `alloc_pages` and it fails (due to the `fail_page_alloc` settings), it will then call `nfsd_destroy_serv`, which frees the per-CPU memory, creating holes. This would prevent the bug from being reliably triggered.

This led me back to the core requirement: we need `percpu_counter_init` to fail *after* `__svc_create` has succeeded, and we *must not* free the per-CPU memory afterward.

The ultimate strategy that emerged was:
1.  **Background Filler Thread**: Create a thread that continuously allocates large per-CPU arrays (32KB each) using `BPF_MAP_CREATE`. This aggressively fills up the per-CPU chunks, ensuring that when our child process tries to allocate per-CPU memory, it's very likely to require a new chunk.
2.  **Main Loop (Forking Children)**: Loop many times (e.g., 5000). In each iteration, fork a child process.
3.  **Child Process Logic**:
    *   Set up the necessary namespaces and mount points.
    *   Open `/tmp/nfsd/portlist`.
    *   **Crucially**, enable fault injection (`make-it-fail=1`) *only* before the `write` syscall to `portlist`.
    *   Execute the `write` syscall.
        *   If `kzalloc` (for `serv`) or `kcalloc` (for `sv_pools`) fails due to the slab cache being empty (and thus `alloc_pages` is called, which is now failing), `write` returns `-ENOMEM`. The child sees `ret < 0`, exits, and importantly, *no per-CPU memory was allocated*, so no holes are created.
        *   If `kzalloc` and `kcalloc` succeed, but `percpu_counter_init` (which calls `alloc_percpu`) fails because `pcpu_populate_chunk` needs a new page and `fail_page_alloc` intercepts it, then `__svc_create` will return an error, but the kernel crash happens *later* in `svc_xprt_create` because it will try to use the (invalid) service pointer.
        *   If *everything succeeds* (`write` returns `> 0`), it means the service was created and per-CPU memory was allocated without triggering the critical failure. In this scenario, the child *must* remain alive (`sleep(10000)`) to hold onto the allocated per-CPU memory and prevent the creation of holes.

The key is that `fail_page_alloc` being at 100% probability will ensure that any attempt to allocate a *new* per-CPU chunk (via `pcpu_populate_chunk`) will fail. Combined with the aggressive filling of chunks by the background thread, we maximize the chances of hitting this condition. And by having the child sleep if successful, we ensure no holes are created, maintaining the pressure on the per-CPU allocator. We also increase process limits to allow many sleeping children.

This thought process, refining the interaction between fault injection, allocator behavior, and process lifecycle, seems to lead to a robust reproducer for the intended bug.

map[ContextFile:fs/nfsd/nfsd.h Name:nfsd_svc]

map[SourceCode: 739:	/**
 740:	 * nfsd_svc: start up or shut down the nfsd server
 741:	 * @n: number of array members in @nthreads
 742:	 * @nthreads: array of thread counts for each pool
 743:	 * @net: network namespace to operate within
 744:	 * @cred: credentials to use for xprt creation
 745:	 * @scope: server scope value (defaults to nodename)
 746:	 *
 747:	 * Adjust the number of threads in each pool and return the new
 748:	 * total number of threads in the service.
 749:	 */
 750:	int
 751:	nfsd_svc(int n, int *nthreads, struct net *net, const struct cred *cred, const char *scope)
 752:	{
 753:		int	error;
 754:		struct nfsd_net *nn = net_generic(net, nfsd_net_id);
 755:		struct svc_serv *serv;
 756:	
 757:		lockdep_assert_held(&nfsd_mutex);
 758:	
 759:		dprintk("nfsd: creating service\n");
 760:	
 761:		strscpy(nn->nfsd_name, scope ? scope : utsname()->nodename,
 762:			sizeof(nn->nfsd_name));
 763:	
 764:		error = nfsd_create_serv(net);
 765:		if (error)
 766:			goto out;
 767:		serv = nn->nfsd_serv;
 768:	
 769:		error = nfsd_startup_net(net, cred);
 770:		if (error)
 771:			goto out_put;
 772:		error = nfsd_set_nrthreads(n, nthreads, net);
 773:		if (error)
 774:			goto out_put;
 775:		error = serv->sv_nrthreads;
 776:	out_put:
 777:		if (serv->sv_nrthreads == 0)
 778:			nfsd_destroy_serv(net);
 779:	out:
 780:		return error;
 781:	}
 SourceFile:fs/nfsd/nfssvc.c]

gemini-3.1-pro-preview

							input: 43858
							output: 42
							thoughts: 166
						

**My Thought Process on `write_threads` and `percpu_counter_inc`**

Okay, let's trace this. My immediate thought when considering the impact of `write_threads` leads me to its interaction with `nfsd_create_serv`, which in turn invokes `__svc_create`. This seems to be the primary entry point for setting up NFS server operations. Following that, the next logical step in my mind is `nfsd_startup_net`.

Now, here's where a critical question arises: does `nfsd_startup_net` directly trigger a `percpu_counter_inc`? I'm questioning this because `percpu_counter_inc` is something I associate with active transport operations, specifically when a packet arrives or a transport is established.

My initial intuition suggests that `percpu_counter_inc` isn't called directly by `nfsd_startup_net`. Instead, I recall that this counter increment happens within `svc_xprt_enqueue`. This function, as I understand it, is the mechanism that signals a transport has received data or has been newly added to the system.

Then, I have to pause and reconsider. If `write_threads` is being used, it doesn't inherently add a new transport unless there are already default transports configured. This is a key detail. But then, a lightbulb goes off: doesn't `nfsd_startup_net` actually *create* those default transports? This is the crucial connection I need to verify. So, my next immediate action is to dive into the implementation details of `nfsd_startup_net` to confirm if this is indeed the case, and if so, how it indirectly leads to the `percpu_counter_inc` call.

map[ContextFile:fs/nfsd/nfssvc.c Name:nfsd_startup_net]

map[SourceCode: 344:	/*
 345:	 * Crank up a set of per-namespace resources for a new NFSD instance,
 346:	 * including lockd, a duplicate reply cache, an open file cache
 347:	 * instance, and a cache of NFSv4 state objects.
 348:	 */
 349:	static int nfsd_startup_net(struct net *net, const struct cred *cred)
 350:	{
 351:		struct nfsd_net *nn = net_generic(net, nfsd_net_id);
 352:		int ret;
 353:	
 354:		if (nn->nfsd_net_up)
 355:			return 0;
 356:	
 357:		ret = nfsd_startup_generic();
 358:		if (ret)
 359:			return ret;
 360:	
 361:		if (list_empty(&nn->nfsd_serv->sv_permsocks)) {
 362:			pr_warn("NFSD: Failed to start, no listeners configured.\n");
 363:			ret = -EIO;
 364:			goto out_socks;
 365:		}
 366:	
 367:		if (nfsd_needs_lockd(nn) && !nn->lockd_up) {
 368:			ret = lockd_up(net, cred);
 369:			if (ret)
 370:				goto out_socks;
 371:			nn->lockd_up = true;
 372:		}
 373:	
 374:		ret = nfsd_file_cache_start_net(net);
 375:		if (ret)
 376:			goto out_lockd;
 377:	
 378:		ret = nfsd_reply_cache_init(nn);
 379:		if (ret)
 380:			goto out_filecache;
 381:	
 382:	#ifdef CONFIG_NFSD_V4_2_INTER_SSC
 383:		nfsd4_ssc_init_umount_work(nn);
 384:	#endif
 385:		ret = nfs4_state_start_net(net);
 386:		if (ret)
 387:			goto out_reply_cache;
 388:	
 389:		nn->nfsd_net_up = true;
 390:		return 0;
 391:	
 392:	out_reply_cache:
 393:		nfsd_reply_cache_shutdown(nn);
 394:	out_filecache:
 395:		nfsd_file_cache_shutdown_net(net);
 396:	out_lockd:
 397:		if (nn->lockd_up) {
 398:			lockd_down(net);
 399:			nn->lockd_up = false;
 400:		}
 401:	out_socks:
 402:		nfsd_shutdown_generic();
 403:		return ret;
 404:	}
 SourceFile:fs/nfsd/nfssvc.c]

gemini-3.1-pro-preview

							input: 44945
							output: 44
							thoughts: 4063
						

**The Path to a Reproducible Kernel Crash: A Deep Dive into NFSv4 Thread Management and Memory Allocation Quirks**

My thought process began with analyzing the NFS server startup logic, specifically `nfsd_startup_net`. I noticed a critical condition: if the list of permitted sockets (`sv_permsocks`) was empty, the function would return an I/O error (`-EIO`). This immediately flagged a potential issue. Following the execution flow, I saw that `nfsd_svc` would then proceed to an exit path (`out_put`). With `sv_nrthreads` being zero, this would lead to `nfsd_destroy_serv(net)`. The implication was stark: attempting to write threads without an established transport would invariably result in the destruction of the entire NFS service, creating undesirable "holes" in the system.

This led me to the immediate conclusion that `write_ports_addxprt` *must* be used to add a transport, as this is what keeps the service alive. However, my investigation didn't stop there. `write_ports_addxprt` relies on `svc_xprt_create`, and I recalled that `svc_xprt_create` is susceptible to failures if `fail_page_alloc` is enabled. Since `fail_page_alloc` set to 100% (`100`) means `svc_xprt_create` *will* fail, this presented a new roadblock. A failing `svc_xprt_create` would, in turn, lead to the destruction of the NFS service, defeating the purpose of adding a transport.

The question then became: how can `svc_xprt_create` succeed when `fail_page_alloc` is at 100%? It clearly needs pages, and if page allocation is failing, it's a non-starter. My initial thought was to disable `fail_page_alloc` *before* `svc_xprt_create` is called. But this is not feasible, as it's a kernel-level setting.

This is where a shift in thinking occurred. Instead of focusing on *disabling* the page allocation failure, I considered alternative ways to *circumvent* it. I pondered using BPF to exhaust per-CPU memory globally, entirely bypassing the `fail_page_alloc` mechanism. My reasoning was that if per-CPU memory is exhausted globally, `percpu_counter_init` would fail.

I then dug deeper into the behavior of `__svc_create`. I knew `kzalloc` within `__svc_create` uses slab memory, not directly affected by page allocation failures. The crucial part was `svc_xprt_create`, which allocates a socket. This socket allocation uses both slab and page memory. If I *only* exhaust per-CPU memory, page memory would still be available. Therefore, `svc_xprt_create` *should* succeed.

However, I anticipated a potential complication: if `percpu_counter_init` fails (as expected), `__svc_create` would ignore this failure. Then, `svc_xprt_create` would run and succeed because page memory is available. The problem, I predicted, would then shift to `svc_xprt_enqueue`, which would crash! This seemed like the "perfect solution" – no need for `fail_page_alloc`, just global per-CPU memory exhaustion via BPF maps.

My concerns then turned to the practicalities of exhausting per-CPU memory. Would this cause an Out-Of-Memory (OOM) condition? I calculated the potential memory usage. A per-CPU chunk can be large (256KB or 2MB). While `VMALLOC_TOTAL` is vast, physical memory is finite. Allocating gigabytes of per-CPU memory could indeed lead to OOM. If our process is killed by the OOM killer, the BPF maps and per-CPU memory would be freed.

But then I realized a more nuanced approach. What if I could catch the `-ENOMEM` return from the `bpf` syscall? This would indicate per-CPU memory exhaustion *without* necessarily triggering a full OOM. If `bpf` returns `-ENOMEM`, I could immediately call `write_ports_addxprt`.

However, I revisited the concern: if `bpf` returns `-ENOMEM` due to an impending OOM, then `kzalloc` or `svc_xprt_create` might *also* fail due to OOM, preventing the bug from being triggered. The critical question became: is there a way to exhaust per-CPU memory *without* causing a system-wide OOM?

I considered resource limits. `RLIMIT_MEMLOCK` came to mind, but kernel versions 5.11 and later use memory cgroups for BPF maps, rendering `RLIMIT_MEMLOCK` ineffective for this purpose. My next thought was memory cgroups. If I set a memory cgroup limit, say 100MB, the `bpf` syscall would fail when hitting that limit. But `__svc_create` uses `GFP_KERNEL` without `__GFP_ACCOUNT`, meaning it wouldn't be constrained by our memcg. This would lead to `percpu_counter_init` succeeding, as it would draw from the global, unexhausted per-CPU pool. So, memcg wouldn't work for this specific scenario.

I started to re-examine the limits on per-CPU memory. `pcpu_alloc` has a check: `if (unlikely(size > PCPU_MIN_ALLOC_SIZE)) return NULL;`. `PCPU_MIN_ALLOC_SIZE` is 32KB. I questioned if `bpf_map_alloc_percpu` could allocate more than this. It's limited to 32KB for per-CPU maps.

This led me to a new revelation: what if I *do* use `fail_page_alloc`, but only enable it for the `write` syscall, and critically, rely on the fact that `svc_xprt_create` *might not need pages* if slab caches are already populated? I delved into the socket allocation process. `sock_create_kern` -> `inet_create` -> `sk_alloc`. `sk_alloc` uses `kmem_cache_alloc` (slab). If slab caches have free objects, page allocation is bypassed. What about socket buffers? They are allocated on demand. Therefore, `svc_xprt_create` *could* succeed without needing `alloc_pages` if slab caches are pre-populated.

This was the missing piece! If I pre-populate the slab caches *before* enabling `make-it-fail=1`, then `svc_xprt_create` would succeed. Simultaneously, `percpu_counter_init` would still need a new per-CPU chunk (because the filler thread would have filled existing ones), and thus would call `alloc_pages`, which would fail. This creates the perfect storm: `svc_xprt_create` succeeds due to pre-populated slabs, while `percpu_counter_init` fails due to the page allocation fault. Finally, `svc_xprt_enqueue` would crash.

The refinement process involved identifying exactly *what* needed pre-population:
1.  `kmalloc-256` for `serv` and `sv_pools`: This could be assumed to have some noise, but explicit population might be better.
2.  `sock_inode_cache`, `tcp_sock`, `kmalloc-1k` for `svc_tcp_sock`: Creating and closing a TCP socket would populate these.
3.  `kmalloc-4k` for `simple_transaction_get`: Opening, writing to, and closing `/tmp/nfsd/filehandle` would address this.

With this understanding, I constructed the reproducer. The logic was to:
*   Enable `fail_page_alloc` at 100%.
*   Start a background thread to continuously create BPF per-CPU maps, consuming per-CPU memory chunks.
*   In each child process:
    *   Mount NFS.
    *   Pre-populate relevant slab caches by performing dummy I/O operations (like opening and writing to `/tmp/nfsd/filehandle`) and creating/closing TCP sockets.
    *   Enable `make-it-fail` for the `write` syscall.
    *   Trigger the `write` operation to `/tmp/nfsd/portlist` to initiate `__write_ports_addxprt`. This would lead to `__svc_create`.
    *   `__svc_create` would attempt `percpu_counter_init` (which fails due to page allocation fault) and then `svc_xprt_create`.
    *   `svc_xprt_create` would succeed because the slab caches were pre-populated, and it wouldn't need to call `alloc_pages`.
    *   The bug would then manifest in `svc_xprt_enqueue`, causing a crash.
    *   Crucially, the `make-it-fail` flag is disabled *after* the `write` to ensure subsequent operations don't also fail.
    *   The child process is designed to hold onto per-CPU memory for a duration, preventing holes from being immediately filled by other processes.

This entire thought process was a journey of understanding the intricate dependencies between different kernel subsystems – NFS, memory management, slab allocation, per-CPU structures, and fault injection mechanisms. The key was to find a scenario where a failing component (`percpu_counter_init` due to page faults) *didn't* stop a subsequent, critical component (`svc_xprt_create`) from succeeding, thus exposing the ultimate crash in `svc_xprt_enqueue`.

log-in to see details

map[ContextFile:fs/nfsd/nfsctl.c Name:__write_ports_delxprt]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 49057
							output: 39
							thoughts: 10
						

**My Thought Process Regarding `__write_ports`**

My immediate focus is to scrutinize the `__write_ports` function. I'm diving into its implementation to understand precisely how it's handling the writing of data to the ports. My expectation is to find a robust and efficient mechanism, given the critical nature of port operations. I'll be looking for clarity in its logic, considering potential edge cases and error handling, and assessing its overall performance characteristics. Essentially, I'm aiming to get a comprehensive grasp of its inner workings to ensure it meets the required standards for its intended use.

map[ContextFile:fs/nfsd/nfsctl.c Name:__write_ports]

map[SourceCode: 798:	static ssize_t __write_ports(struct file *file, char *buf, size_t size,
 799:				     struct net *net)
 800:	{
 801:		if (size == 0)
 802:			return __write_ports_names(buf, net);
 803:	
 804:		if (isdigit(buf[0]))
 805:			return __write_ports_addfd(buf, net, file->f_cred);
 806:	
 807:		if (isalpha(buf[0]))
 808:			return __write_ports_addxprt(buf, net, file->f_cred);
 809:	
 810:		return -EINVAL;
 811:	}
 SourceFile:fs/nfsd/nfsctl.c]

gemini-3.1-pro-preview

							input: 49329
							output: 1692
							thoughts: 242
						

**My Thought Process Regarding Transport Deletion and Slab Cache Exploitation**

Alright, so I was digging into the `__write_ports` function and realized a critical limitation: it doesn't actually support deleting transports. This immediately triggered a mental alarm – if I can't delete them, how do I manage or remove them from the system when needed? My initial thought went to the `portlist`, but I quickly confirmed that deleting a transport isn't directly supported through that interface either.

This deadlock in my thinking led me to examine the underlying memory management. I recalled that `svc_tcp_sock` objects are allocated from a slab cache. This was a key insight. If a slab cache isn't empty, it simply reuses existing objects. Given that `svc_tcp_sock` is a moderately sized structure, around 1-2KB, I deduced it would be using general-purpose slab caches like `kmalloc-1k` or `kmalloc-2k`.

The implication here is significant: if I can pre-populate these specific slab caches with dummy objects, I can influence how subsequent allocations behave. My next question became: how do I achieve these dummy allocations of 1-2KB? I brainstormed several common kernel operations that involve memory allocation of that size, such as calling `socket()`, `setsockopt()`, or even `send()`.

However, I then refined this thought. The `kmalloc-1k` and `kmalloc-2k` caches are incredibly busy and widely used throughout the kernel. It's almost a certainty that they will already have a substantial number of free objects readily available. This means my concern about needing to aggressively pre-populate them might be overstated. The system is likely to have these caches sufficiently populated already, making the exploit more achievable without extensive manual priming.

With this understanding solidified, I turned my attention to the reproducer. After a thorough review, I'm confident in its robustness and accuracy. I'll proceed with outputting it.

map[IsProbe:false RawCandidateReproC:#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <sys/socket.h>
#include <linux/bpf.h>
#include <sys/syscall.h>
#include <pthread.h>
#include <sys/resource.h>
#include <errno.h>

void write_file(const char *path, const char *val) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        write(fd, val, strlen(val));
        close(fd);
    }
}

void bring_lo_up() {
    int fd = socket(AF_INET, SOCK_DGRAM, 0);
    if (fd >= 0) {
        struct ifreq ifr;
        strcpy(ifr.ifr_name, "lo");
        if (ioctl(fd, SIOCGIFFLAGS, &ifr) == 0) {
            ifr.ifr_flags |= IFF_UP | IFF_RUNNING;
            ioctl(fd, SIOCSIFFLAGS, &ifr);
        }
        close(fd);
    }
}

void *filler_thread(void *arg) {
    union bpf_attr attr;
    memset(&attr, 0, sizeof(attr));
    attr.map_type = BPF_MAP_TYPE_PERCPU_ARRAY;
    attr.key_size = 4;
    attr.value_size = 32768; // 32KB percpu allocation per map
    attr.max_entries = 1;

    // Allocate percpu memory to exhaust existing chunks.
    // This thread does NOT have fault injection enabled, so it will successfully
    // create new chunks and fill them up, forcing the main thread to eventually
    // need a new chunk when it calls percpu_counter_init().
    while (1) {
        syscall(__NR_bpf, BPF_MAP_CREATE, &attr, sizeof(attr));
        usleep(500); // 0.5ms delay
    }
    return NULL;
}

int main() {
    printf("[*] Starting reproducer...\n");

    struct rlimit rl;
    rl.rlim_cur = RLIM_INFINITY;
    rl.rlim_max = RLIM_INFINITY;
    setrlimit(RLIMIT_NOFILE, &rl);
    setrlimit(RLIMIT_MEMLOCK, &rl);
    setrlimit(RLIMIT_NPROC, &rl);

    if (mount("debugfs", "/sys/kernel/debug", "debugfs", 0, NULL) != 0) {
        if (errno != EBUSY) {
            printf("[-] Failed to mount debugfs: %s\n", strerror(errno));
        }
    }

    // Setup fault injection for page allocations
    // We use fail_page_alloc because percpu_counter_init allocates from the percpu chunk.
    // If the chunk is full, it calls pcpu_populate_chunk which calls alloc_pages.
    // This will fail the page allocation and thus fail percpu_counter_init.
    write_file("/sys/kernel/debug/fail_page_alloc/probability", "100");
    write_file("/sys/kernel/debug/fail_page_alloc/times", "-1");
    write_file("/sys/kernel/debug/fail_page_alloc/task-filter", "Y");
    write_file("/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", "N");

    mkdir("/tmp/nfsd", 0777);

    pthread_t tid;
    if (pthread_create(&tid, NULL, filler_thread, NULL) != 0) {
        printf("[-] Failed to create filler thread\n");
        exit(1);
    }

    printf("[*] Forking children to trigger the bug...\n");

    for (int i = 0; i < 5000; i++) {
        pid_t pid = fork();
        if (pid < 0) {
            usleep(10000);
            continue;
        }
        if (pid == 0) {
            if (unshare(CLONE_NEWNET | CLONE_NEWNS) == 0) {
                bring_lo_up();
                if (mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL) == 0) {
                    int fd = open("/tmp/nfsd/portlist", O_WRONLY);
                    if (fd >= 0) {
                        // Pre-populate kmalloc-4k for simple_transaction_get
                        // This ensures that kzalloc(PAGE_SIZE) in simple_transaction_get
                        // doesn't call alloc_pages and fail due to fail_page_alloc.
                        int fd_dummy = open("/tmp/nfsd/filehandle", O_RDWR);
                        if (fd_dummy >= 0) {
                            write(fd_dummy, "dummy", 5);
                            close(fd_dummy);
                        }

                        // Pre-populate socket caches for svc_xprt_create
                        for (int j = 0; j < 5; j++) {
                            int s = socket(AF_INET, SOCK_STREAM, 0);
                            if (s >= 0) close(s);
                        }

                        // Enable fault injection ONLY for the write syscall
                        write_file("/proc/self/make-it-fail", "1");
                        
                        // Trigger __write_ports_addxprt -> nfsd_create_serv -> __svc_create
                        int ret = write(fd, "tcp 2049", 8);
                        
                        write_file("/proc/self/make-it-fail", "0");
                        close(fd);
                        
                        if (ret >= 0) {
                            // Successfully created service, hold the percpu memory
                            // so we don't create holes in the percpu chunks.
                            // If we exit, the service is destroyed, percpu counters are freed,
                            // and the next iteration will just reuse the holes instead of
                            // triggering a new chunk allocation.
                            sleep(10000);
                        }
                    }
                }
            }
            exit(0);
        }
        usleep(1000); // 1ms delay between forks
        
        if (i % 500 == 0) {
            printf("[+] Iteration %d\n", i);
        }
    }
    
    printf("[*] Waiting for children...\n");
    sleep(5);
    
    printf("[+] Done. If the system didn't crash, the bug was not triggered.\n");
    return 0;
}]

map[IsProbe:false RawCandidateReproC:#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <sys/socket.h>
#include <linux/bpf.h>
#include <sys/syscall.h>
#include <pthread.h>
#include <sys/resource.h>
#include <errno.h>

void write_file(const char *path, const char *val) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        write(fd, val, strlen(val));
        close(fd);
    }
}

void bring_lo_up() {
    int fd = socket(AF_INET, SOCK_DGRAM, 0);
    if (fd >= 0) {
        struct ifreq ifr;
        strcpy(ifr.ifr_name, "lo");
        if (ioctl(fd, SIOCGIFFLAGS, &ifr) == 0) {
            ifr.ifr_flags |= IFF_UP | IFF_RUNNING;
            ioctl(fd, SIOCSIFFLAGS, &ifr);
        }
        close(fd);
    }
}

void *filler_thread(void *arg) {
    union bpf_attr attr;
    memset(&attr, 0, sizeof(attr));
    attr.map_type = BPF_MAP_TYPE_PERCPU_ARRAY;
    attr.key_size = 4;
    attr.value_size = 32768; // 32KB percpu allocation per map
    attr.max_entries = 1;

    // Allocate percpu memory to exhaust existing chunks.
    // This thread does NOT have fault injection enabled, so it will successfully
    // create new chunks and fill them up, forcing the main thread to eventually
    // need a new chunk when it calls percpu_counter_init().
    while (1) {
        syscall(__NR_bpf, BPF_MAP_CREATE, &attr, sizeof(attr));
        usleep(500); // 0.5ms delay
    }
    return NULL;
}

int main() {
    printf("[*] Starting reproducer...\n");

    struct rlimit rl;
    rl.rlim_cur = RLIM_INFINITY;
    rl.rlim_max = RLIM_INFINITY;
    setrlimit(RLIMIT_NOFILE, &rl);
    setrlimit(RLIMIT_MEMLOCK, &rl);
    setrlimit(RLIMIT_NPROC, &rl);

    if (mount("debugfs", "/sys/kernel/debug", "debugfs", 0, NULL) != 0) {
        if (errno != EBUSY) {
            printf("[-] Failed to mount debugfs: %s\n", strerror(errno));
        }
    }

    // Setup fault injection for page allocations
    // We use fail_page_alloc because percpu_counter_init allocates from the percpu chunk.
    // If the chunk is full, it calls pcpu_populate_chunk which calls alloc_pages.
    // This will fail the page allocation and thus fail percpu_counter_init.
    write_file("/sys/kernel/debug/fail_page_alloc/probability", "100");
    write_file("/sys/kernel/debug/fail_page_alloc/times", "-1");
    write_file("/sys/kernel/debug/fail_page_alloc/task-filter", "Y");
    write_file("/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", "N");

    mkdir("/tmp/nfsd", 0777);

    pthread_t tid;
    if (pthread_create(&tid, NULL, filler_thread, NULL) != 0) {
        printf("[-] Failed to create filler thread\n");
        exit(1);
    }

    printf("[*] Forking children to trigger the bug...\n");

    for (int i = 0; i < 5000; i++) {
        pid_t pid = fork();
        if (pid < 0) {
            usleep(10000);
            continue;
        }
        if (pid == 0) {
            if (unshare(CLONE_NEWNET | CLONE_NEWNS) == 0) {
                bring_lo_up();
                if (mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL) == 0) {
                    int fd = open("/tmp/nfsd/portlist", O_WRONLY);
                    if (fd >= 0) {
                        // Pre-populate kmalloc-4k for simple_transaction_get
                        // This ensures that kzalloc(PAGE_SIZE) in simple_transaction_get
                        // doesn't call alloc_pages and fail due to fail_page_alloc.
                        int fd_dummy = open("/tmp/nfsd/filehandle", O_RDWR);
                        if (fd_dummy >= 0) {
                            write(fd_dummy, "dummy", 5);
                            close(fd_dummy);
                        }

                        // Pre-populate socket caches for svc_xprt_create
                        for (int j = 0; j < 5; j++) {
                            int s = socket(AF_INET, SOCK_STREAM, 0);
                            if (s >= 0) close(s);
                        }

                        // Enable fault injection ONLY for the write syscall
                        write_file("/proc/self/make-it-fail", "1");
                        
                        // Trigger __write_ports_addxprt -> nfsd_create_serv -> __svc_create
                        int ret = write(fd, "tcp 2049", 8);
                        
                        write_file("/proc/self/make-it-fail", "0");
                        close(fd);
                        
                        if (ret >= 0) {
                            // Successfully created service, hold the percpu memory
                            // so we don't create holes in the percpu chunks.
                            // If we exit, the service is destroyed, percpu counters are freed,
                            // and the next iteration will just reuse the holes instead of
                            // triggering a new chunk allocation.
                            sleep(10000);
                        }
                    }
                }
            }
            exit(0);
        }
        usleep(1000); // 1ms delay between forks
        
        if (i % 500 == 0) {
            printf("[+] Iteration %d\n", i);
        }
    }
    
    printf("[*] Waiting for children...\n");
    sleep(5);
    
    printf("[+] Done. If the system didn't crash, the bug was not triggered.\n");
    return 0;
}]

map[CurrentCandidateReproC:#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <sys/socket.h>
#include <linux/bpf.h>
#include <sys/syscall.h>
#include <pthread.h>
#include <sys/resource.h>
#include <errno.h>

void write_file(const char *path, const char *val) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        write(fd, val, strlen(val));
        close(fd);
    }
}

void bring_lo_up() {
    int fd = socket(AF_INET, SOCK_DGRAM, 0);
    if (fd >= 0) {
        struct ifreq ifr;
        strcpy(ifr.ifr_name, "lo");
        if (ioctl(fd, SIOCGIFFLAGS, &ifr) == 0) {
            ifr.ifr_flags |= IFF_UP | IFF_RUNNING;
            ioctl(fd, SIOCSIFFLAGS, &ifr);
        }
        close(fd);
    }
}

void *filler_thread(void *arg) {
    union bpf_attr attr;
    memset(&attr, 0, sizeof(attr));
    attr.map_type = BPF_MAP_TYPE_PERCPU_ARRAY;
    attr.key_size = 4;
    attr.value_size = 32768; // 32KB percpu allocation per map
    attr.max_entries = 1;

    // Allocate percpu memory to exhaust existing chunks.
    // This thread does NOT have fault injection enabled, so it will successfully
    // create new chunks and fill them up, forcing the main thread to eventually
    // need a new chunk when it calls percpu_counter_init().
    while (1) {
        syscall(__NR_bpf, BPF_MAP_CREATE, &attr, sizeof(attr));
        usleep(500); // 0.5ms delay
    }
    return NULL;
}

int main() {
    printf("[*] Starting reproducer...\n");

    struct rlimit rl;
    rl.rlim_cur = RLIM_INFINITY;
    rl.rlim_max = RLIM_INFINITY;
    setrlimit(RLIMIT_NOFILE, &rl);
    setrlimit(RLIMIT_MEMLOCK, &rl);
    setrlimit(RLIMIT_NPROC, &rl);

    if (mount("debugfs", "/sys/kernel/debug", "debugfs", 0, NULL) != 0) {
        if (errno != EBUSY) {
            printf("[-] Failed to mount debugfs: %s\n", strerror(errno));
        }
    }

    // Setup fault injection for page allocations
    // We use fail_page_alloc because percpu_counter_init allocates from the percpu chunk.
    // If the chunk is full, it calls pcpu_populate_chunk which calls alloc_pages.
    // This will fail the page allocation and thus fail percpu_counter_init.
    write_file("/sys/kernel/debug/fail_page_alloc/probability", "100");
    write_file("/sys/kernel/debug/fail_page_alloc/times", "-1");
    write_file("/sys/kernel/debug/fail_page_alloc/task-filter", "Y");
    write_file("/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", "N");

    mkdir("/tmp/nfsd", 0777);

    pthread_t tid;
    if (pthread_create(&tid, NULL, filler_thread, NULL) != 0) {
        printf("[-] Failed to create filler thread\n");
        exit(1);
    }

    printf("[*] Forking children to trigger the bug...\n");

    for (int i = 0; i < 5000; i++) {
        pid_t pid = fork();
        if (pid < 0) {
            usleep(10000);
            continue;
        }
        if (pid == 0) {
            if (unshare(CLONE_NEWNET | CLONE_NEWNS) == 0) {
                bring_lo_up();
                if (mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL) == 0) {
                    int fd = open("/tmp/nfsd/portlist", O_WRONLY);
                    if (fd >= 0) {
                        // Pre-populate kmalloc-4k for simple_transaction_get
                        // This ensures that kzalloc(PAGE_SIZE) in simple_transaction_get
                        // doesn't call alloc_pages and fail due to fail_page_alloc.
                        int fd_dummy = open("/tmp/nfsd/filehandle", O_RDWR);
                        if (fd_dummy >= 0) {
                            write(fd_dummy, "dummy", 5);
                            close(fd_dummy);
                        }

                        // Pre-populate socket caches for svc_xprt_create
                        for (int j = 0; j < 5; j++) {
                            int s = socket(AF_INET, SOCK_STREAM, 0);
                            if (s >= 0) close(s);
                        }

                        // Enable fault injection ONLY for the write syscall
                        write_file("/proc/self/make-it-fail", "1");
                        
                        // Trigger __write_ports_addxprt -> nfsd_create_serv -> __svc_create
                        int ret = write(fd, "tcp 2049", 8);
                        
                        write_file("/proc/self/make-it-fail", "0");
                        close(fd);
                        
                        if (ret >= 0) {
                            // Successfully created service, hold the percpu memory
                            // so we don't create holes in the percpu chunks.
                            // If we exit, the service is destroyed, percpu counters are freed,
                            // and the next iteration will just reuse the holes instead of
                            // triggering a new chunk allocation.
                            sleep(10000);
                        }
                    }
                }
            }
            exit(0);
        }
        usleep(1000); // 1ms delay between forks
        
        if (i % 500 == 0) {
            printf("[+] Iteration %d\n", i);
        }
    }
    
    printf("[*] Waiting for children...\n");
    sleep(5);
    
    printf("[+] Done. If the system didn't crash, the bug was not triggered.\n");
    return 0;
}]

map[CompilerError: FormattedReproC:#define _GNU_SOURCE
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <sys/socket.h>
#include <linux/bpf.h>
#include <sys/syscall.h>
#include <pthread.h>
#include <sys/resource.h>
#include <errno.h>

void write_file(const char *path, const char *val) {
    int fd = open(path, O_WRONLY);
    if (fd >= 0) {
        write(fd, val, strlen(val));
        close(fd);
    }
}

void bring_lo_up() {
    int fd = socket(AF_INET, SOCK_DGRAM, 0);
    if (fd >= 0) {
        struct ifreq ifr;
        strcpy(ifr.ifr_name, "lo");
        if (ioctl(fd, SIOCGIFFLAGS, &ifr) == 0) {
            ifr.ifr_flags |= IFF_UP | IFF_RUNNING;
            ioctl(fd, SIOCSIFFLAGS, &ifr);
        }
        close(fd);
    }
}

void *filler_thread(void *arg) {
    union bpf_attr attr;
    memset(&attr, 0, sizeof(attr));
    attr.map_type = BPF_MAP_TYPE_PERCPU_ARRAY;
    attr.key_size = 4;
    attr.value_size = 32768; // 32KB percpu allocation per map
    attr.max_entries = 1;

    // Allocate percpu memory to exhaust existing chunks.
    // This thread does NOT have fault injection enabled, so it will successfully
    // create new chunks and fill them up, forcing the main thread to eventually
    // need a new chunk when it calls percpu_counter_init().
    while (1) {
        syscall(__NR_bpf, BPF_MAP_CREATE, &attr, sizeof(attr));
        usleep(500); // 0.5ms delay
    }
    return NULL;
}

int main() {
    printf("[*] Starting reproducer...\n");

    struct rlimit rl;
    rl.rlim_cur = RLIM_INFINITY;
    rl.rlim_max = RLIM_INFINITY;
    setrlimit(RLIMIT_NOFILE, &rl);
    setrlimit(RLIMIT_MEMLOCK, &rl);
    setrlimit(RLIMIT_NPROC, &rl);

    if (mount("debugfs", "/sys/kernel/debug", "debugfs", 0, NULL) != 0) {
        if (errno != EBUSY) {
            printf("[-] Failed to mount debugfs: %s\n", strerror(errno));
        }
    }

    // Setup fault injection for page allocations
    // We use fail_page_alloc because percpu_counter_init allocates from the percpu chunk.
    // If the chunk is full, it calls pcpu_populate_chunk which calls alloc_pages.
    // This will fail the page allocation and thus fail percpu_counter_init.
    write_file("/sys/kernel/debug/fail_page_alloc/probability", "100");
    write_file("/sys/kernel/debug/fail_page_alloc/times", "-1");
    write_file("/sys/kernel/debug/fail_page_alloc/task-filter", "Y");
    write_file("/sys/kernel/debug/fail_page_alloc/ignore-gfp-wait", "N");

    mkdir("/tmp/nfsd", 0777);

    pthread_t tid;
    if (pthread_create(&tid, NULL, filler_thread, NULL) != 0) {
        printf("[-] Failed to create filler thread\n");
        exit(1);
    }

    printf("[*] Forking children to trigger the bug...\n");

    for (int i = 0; i < 5000; i++) {
        pid_t pid = fork();
        if (pid < 0) {
            usleep(10000);
            continue;
        }
        if (pid == 0) {
            if (unshare(CLONE_NEWNET | CLONE_NEWNS) == 0) {
                bring_lo_up();
                if (mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL) == 0) {
                    int fd = open("/tmp/nfsd/portlist", O_WRONLY);
                    if (fd >= 0) {
                        // Pre-populate kmalloc-4k for simple_transaction_get
                        // This ensures that kzalloc(PAGE_SIZE) in simple_transaction_get
                        // doesn't call alloc_pages and fail due to fail_page_alloc.
                        int fd_dummy = open("/tmp/nfsd/filehandle", O_RDWR);
                        if (fd_dummy >= 0) {
                            write(fd_dummy, "dummy", 5);
                            close(fd_dummy);
                        }

                        // Pre-populate socket caches for svc_xprt_create
                        for (int j = 0; j < 5; j++) {
                            int s = socket(AF_INET, SOCK_STREAM, 0);
                            if (s >= 0) close(s);
                        }

                        // Enable fault injection ONLY for the write syscall
                        write_file("/proc/self/make-it-fail", "1");
                        
                        // Trigger __write_ports_addxprt -> nfsd_create_serv -> __svc_create
                        int ret = write(fd, "tcp 2049", 8);
                        
                        write_file("/proc/self/make-it-fail", "0");
                        close(fd);
                        
                        if (ret >= 0) {
                            // Successfully created service, hold the percpu memory
                            // so we don't create holes in the percpu chunks.
                            // If we exit, the service is destroyed, percpu counters are freed,
                            // and the next iteration will just reuse the holes instead of
                            // triggering a new chunk allocation.
                            sleep(10000);
                        }
                    }
                }
            }
            exit(0);
        }
        usleep(1000); // 1ms delay between forks
        
        if (i % 500 == 0) {
            printf("[+] Iteration %d\n", i);
        }
    }
    
    printf("[*] Waiting for children...\n");
    sleep(5);
    
    printf("[+] Done. If the system didn't crash, the bug was not triggered.\n");
    return 0;
}]

map[CompilerError:]

map[CandidateBugTitle: CandidateCrashReport: CandidateReproduced:false ConsoleOutput:]  asm_exc_page_fault+0x26/0x30
[  212.509306][ T5856] RIP: 0033:0x7feeb916e49e
[  212.509314][ T5856] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  212.509322][ T5856] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  212.509330][ T5856] RAX: fffffffffffffff4 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  212.509337][ T5856] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000031
[  212.509342][ T5856] RBP: 0000000000000031 R08: 0000000000000000 R09: 0000000000000000
[  212.509348][ T5856] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  212.509353][ T5856] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  212.509370][ T5856]  </TASK>
[  212.509378][ T5856] FAULT_INJECTION: forcing a failure.
[  212.509378][ T5856] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  212.526695][ T6127]   cache: rpc_buffers, object size: 2048, buffer size: 2176, default order: 3, min order: 0
[  212.540607][ T5856] CPU: 1 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  212.540620][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  212.540626][ T5856] Call Trace:
[  212.540630][ T5856]  <TASK>
[  212.540634][ T5856]  dump_stack_lvl+0xe8/0x150
[  212.540649][ T5856]  should_fail_ex+0x40c/0x560
[  212.540664][ T5856]  prepare_alloc_pages+0x230/0x650
[  212.540681][ T5856]  __alloc_frozen_pages_noprof+0x12f/0x380
[  212.540694][ T5856]  ? move_right+0x5d/0xa0
[  212.540705][ T5856]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  212.540724][ T5856]  alloc_pages_mpol+0x212/0x380
[  212.540737][ T5856]  folio_alloc_mpol_noprof+0x39/0x160
[  212.540747][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
[  212.540764][ T5856]  swap_cache_read_folio+0x44/0x120
[  212.540776][ T5856]  swap_cluster_readahead+0x3a0/0x640
[  212.540790][ T5856]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  212.540806][ T5856]  ? get_vma_policy+0x27b/0x3c0
[  212.540816][ T5856]  swapin_readahead+0x19a/0xc10
[  212.540826][ T5856]  ? rcu_is_watching+0x15/0xb0
[  212.540837][ T5856]  ? swap_table_get+0x1e/0x260
[  212.540847][ T5856]  ? swap_table_get+0x1e/0x260
[  212.540858][ T5856]  ? __pfx_swapin_readahead+0x10/0x10
[  212.540869][ T5856]  ? swap_table_get+0x1e/0x260
[  212.540879][ T5856]  ? swap_table_get+0x1e/0x260
[  212.540888][ T5856]  ? swap_table_get+0x1e/0x260
[  212.540898][ T5856]  ? swap_table_get+0x216/0x260
[  212.540908][ T5856]  ? swap_cache_get_folio+0x2e7/0x2f0
[  212.540921][ T5856]  do_swap_page+0x344/0x4930
[  212.540933][ T5856]  ? __pte_offset_map+0x29/0x240
[  212.540945][ T5856]  ? __pte_offset_map+0x29/0x240
[  212.540957][ T5856]  ? __lock_acquire+0x683/0x2cf0
[  212.540965][ T5856]  ? do_swap_page+0x128/0x4930
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[  212.540975][ T5856]  ? __pfx_do_swap_page+0x10/0x10
[  212.540984][ T5856]  ? __pte_offset_map+0x1ae/0x240
[  212.540995][ T5856]  ? pte_offset_map_rw_nolock+0xea/0x160
[  212.541007][ T5856]  handle_mm_fault+0x124c/0x3070
[  212.541023][ T5856]  ? handle_mm_fault+0xec/0x3070
[  212.541036][ T5856]  ? __pfx_handle_mm_fault+0x10/0x10
[  212.541046][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
[  212.541067][ T5856]  do_user_addr_fault+0xa4d/0x1340
[  212.541080][ T5856]  ? trace_page_fault_user+0x84/0x1e0
[  212.541090][ T5856]  exc_page_fault+0x6a/0xc0
[  212.541101][ T5856]  asm_exc_page_fault+0x26/0x30
[  212.541110][ T5856] RIP: 0033:0x7feeb916e49e
[  212.541119][ T5856] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[  212.541127][ T5856] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  212.541135][ T5856] RAX: fffffffffffffff4 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  212.541142][ T5856] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000031
[  212.541147][ T5856] RBP: 0000000000000031 R08: 0000000000000000 R09: 0000000000000000
[  212.541152][ T5856] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  212.541157][ T5856] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  212.541169][ T5856]  </TASK>
[  212.541178][ T5856] FAULT_INJECTION: forcing a failure.
[  212.541178][ T5856] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  212.931358][ T6127]   node 0: slabs: 0, objs: 0, free: 0
[  213.101322][ T5856] CPU: 1 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  213.101336][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  213.101342][ T5856] Call Trace:
[  213.101347][ T5856]  <TASK>
[  213.101351][ T5856]  dump_stack_lvl+0xe8/0x150
[  213.101369][ T5856]  should_fail_ex+0x40c/0x560
[  213.101385][ T5856]  prepare_alloc_pages+0x230/0x650
[  213.101402][ T5856]  __alloc_frozen_pages_noprof+0x12f/0x380
[  213.101415][ T5856]  ? move_right+0x5d/0xa0
[  213.101426][ T5856]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  213.101446][ T5856]  alloc_pages_mpol+0x212/0x380
[  213.101459][ T5856]  folio_alloc_mpol_noprof+0x39/0x160
[  213.101470][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[  213.101486][ T5856]  swap_cache_read_folio+0x44/0x120
[  213.101499][ T5856]  swap_cluster_readahead+0x3a0/0x640
[  213.101512][ T5856]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  213.101528][ T5856]  ? get_vma_policy+0x27b/0x3c0
[  213.101539][ T5856]  swapin_readahead+0x19a/0xc10
[  213.101549][ T5856]  ? rcu_is_watching+0x15/0xb0
[  213.101561][ T5856]  ? swap_table_get+0x1e/0x260
[  213.101571][ T5856]  ? swap_table_get+0x1e/0x260
[  213.101581][ T5856]  ? __pfx_swapin_readahead+0x10/0x10
[  213.101593][ T5856]  ? swap_table_get+0x1e/0x260
[  213.101603][ T5856]  ? swap_table_get+0x1e/0x260
[  213.101612][ T5856]  ? swap_table_get+0x1e/0x260
[  213.101622][ T5856]  ? swap_table_get+0x216/0x260
[  213.101632][ T5856]  ? swap_cache_get_folio+0x2e7/0x2f0
[  213.101645][ T5856]  do_swap_page+0x344/0x4930
[  213.101657][ T5856]  ? __pte_offset_map+0x29/0x240
[  213.101668][ T5856]  ? __pte_offset_map+0x29/0x240
[  213.101681][ T5856]  ? __lock_acquire+0x683/0x2cf0
[  213.101689][ T5856]  ? do_swap_page+0x128/0x4930
[  213.101698][ T5856]  ? __pfx_do_swap_page+0x10/0x10
[  213.101707][ T5856]  ? __pte_offset_map+0x1ae/0x240
[  213.101719][ T5856]  ? pte_offset_map_rw_nolock+0xea/0x160
[  213.101730][ T5856]  handle_mm_fault+0x124c/0x3070
[  213.101746][ T5856]  ? handle_mm_fault+0xec/0x3070
[  213.101760][ T5856]  ? __pfx_handle_mm_fault+0x10/0x10
[  213.101769][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
[  213.101791][ T5856]  do_user_addr_fault+0xa4d/0x1340
[  213.101804][ T5856]  ? trace_page_fault_user+0x84/0x1e0
[  213.101813][ T5856]  exc_page_fault+0x6a/0xc0
[  213.101825][ T5856]  asm_exc_page_fault+0x26/0x30
[  213.101834][ T5856] RIP: 0033:0x7feeb916e49e
[  213.101844][ T5856] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  213.101851][ T5856] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  213.101861][ T5856] RAX: fffffffffffffff4 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  213.101867][ T5856] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000031
[  213.101872][ T5856] RBP: 0000000000000031 R08: 0000000000000000 R09: 0000000000000000
[  213.101878][ T5856] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  213.101883][ T5856] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  213.101895][ T5856]  </TASK>
[  213.101905][ T5856] FAULT_INJECTION: forcing a failure.
[  213.101905][ T5856] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  213.294678][ T6127]   node 1: slabs: 1, objs: 15, free: 4
[  213.412194][ T5856] CPU: 1 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  213.412208][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  213.412213][ T5856] Call Trace:
[  213.412217][ T5856]  <TASK>
[  213.412221][ T5856]  dump_stack_lvl+0xe8/0x150
[  213.412238][ T5856]  should_fail_ex+0x40c/0x560
[  213.412254][ T5856]  prepare_alloc_pages+0x230/0x650
[  213.412271][ T5856]  __alloc_frozen_pages_noprof+0x12f/0x380
[  213.412291][ T5856]  ? move_right+0x5d/0xa0
[  213.412302][ T5856]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  213.412322][ T5856]  alloc_pages_mpol+0x212/0x380
[  213.412335][ T5856]  folio_alloc_mpol_noprof+0x39/0x160
[  213.412345][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
[  213.412361][ T5856]  swap_cache_read_folio+0x44/0x120
[  213.412373][ T5856]  swap_cluster_readahead+0x3a0/0x640
[  213.412387][ T5856]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  213.412403][ T5856]  ? get_vma_policy+0x27b/0x3c0
[  213.412413][ T5856]  swapin_readahead+0x19a/0xc10
[  213.412423][ T5856]  ? rcu_is_watching+0x15/0xb0
[  213.412435][ T5856]  ? swap_table_get+0x1e/0x260
[  213.412445][ T5856]  ? swap_table_get+0x1e/0x260
[  213.412455][ T5856]  ? __pfx_swapin_readahead+0x10/0x10
[  213.412467][ T5856]  ? swap_table_get+0x1e/0x260
[  213.412476][ T5856]  ? swap_table_get+0x1e/0x260
[  213.412485][ T5856]  ? swap_table_get+0x1e/0x260
[  213.412495][ T5856]  ? swap_table_get+0x216/0x260
[  213.412506][ T5856]  ? swap_cache_get_folio+0x2e7/0x2f0
[  213.412518][ T5856]  do_swap_page+0x344/0x4930
[  213.412530][ T5856]  ? __pte_offset_map+0x29/0x240
[  213.412542][ T5856]  ? __pte_offset_map+0x29/0x240
[  213.412555][ T5856]  ? __lock_acquire+0x683/0x2cf0
[  213.412563][ T5856]  ? do_swap_page+0x128/0x4930
[  213.412572][ T5856]  ? __pfx_do_swap_page+0x10/0x10
[  213.412581][ T5856]  ? __pte_offset_map+0x1ae/0x240
[  213.412592][ T5856]  ? pte_offset_map_rw_nolock+0xea/0x160
[  213.412604][ T5856]  handle_mm_fault+0x124c/0x3070
[  213.412619][ T5856]  ? handle_mm_fault+0xec/0x3070
[  213.412633][ T5856]  ? __pfx_handle_mm_fault+0x10/0x10
[  213.412642][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
[  213.412664][ T5856]  do_user_addr_fault+0xa4d/0x1340
[  213.412676][ T5856]  ? trace_page_fault_user+0x84/0x1e0
[  213.412686][ T5856]  exc_page_fault+0x6a/0xc0
[  213.412696][ T5856]  asm_exc_page_fault+0x26/0x30
[  213.412705][ T5856] RIP: 0033:0x7feeb916e49e
[  213.412714][ T5856] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  213.412722][ T5856] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  213.412731][ T5856] RAX: fffffffffffffff4 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  213.412737][ T5856] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000031
[  213.412743][ T5856] RBP: 0000000000000031 R08: 0000000000000000 R09: 0000000000000000
[  213.412748][ T5856] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  213.412754][ T5856] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  213.412766][ T5856]  </TASK>
[  213.412776][ T5856] FAULT_INJECTION: forcing a failure.
[  213.412776][ T5856] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  213.412789][ T5856] CPU: 1 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  213.412798][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  213.412802][ T5856] Call Trace:
[  213.412806][ T5856]  <TASK>
[  213.412809][ T5856]  dump_stack_lvl+0xe8/0x150
[  213.412821][ T5856]  should_fail_ex+0x40c/0x560
[  213.412835][ T5856]  prepare_alloc_pages+0x230/0x650
[  213.412850][ T5856]  __alloc_frozen_pages_noprof+0x12f/0x380
[  213.412865][ T5856]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  213.412881][ T5856]  ? policy_nodemask+0x27c/0x720
[  213.412892][ T5856]  alloc_pages_mpol+0x212/0x380
[  213.412904][ T5856]  folio_alloc_mpol_noprof+0x39/0x160
[  213.412914][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
[  213.412929][ T5856]  swap_cluster_readahead+0x4d9/0x640
[  213.412943][ T5856]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  213.412959][ T5856]  ? get_vma_policy+0x27b/0x3c0
[  213.412968][ T5856]  swapin_readahead+0x19a/0xc10
[  213.412978][ T5856]  ? rcu_is_watching+0x15/0xb0
[  213.412988][ T5856]  ? swap_table_get+0x1e/0x260
[  213.412999][ T5856]  ? swap_table_get+0x1e/0x260
[  213.413009][ T5856]  ? __pfx_swapin_readahead+0x10/0x10
[  213.413020][ T5856]  ? swap_table_get+0x1e/0x260
[  213.413030][ T5856]  ? swap_table_get+0x1e/0x260
[  213.413039][ T5856]  ? swap_table_get+0x1e/0x260
[  213.413048][ T5856]  ? swap_table_get+0x216/0x260
[  213.413059][ T5856]  ? swap_cache_get_folio+0x2e7/0x2f0
[  213.413071][ T5856]  do_swap_page+0x344/0x4930
[  213.413083][ T5856]  ? __pte_offset_map+0x29/0x240
[  213.413093][ T5856]  ? __pte_offset_map+0x29/0x240
[  213.413127][ T5856]  ? __lock_acquire+0x683/0x2cf0
[  213.413135][ T5856]  ? do_swap_page+0x128/0x4930
[  213.413144][ T5856]  ? __pfx_do_swap_page+0x10/0x10
[  213.413153][ T5856]  ? __pte_offset_map+0x1ae/0x240
[  213.413164][ T5856]  ? pte_offset_map_rw_nolock+0xea/0x160
[  213.413176][ T5856]  handle_mm_fault+0x124c/0x3070
** 15 printk messages dropped **
[  213.413334][ T5856]  </TASK>
** 1 printk messages dropped **
[  213.413360][ T5856] FAULT_INJECTION: forcing a failure.
[  213.413360][ T5856] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  213.413371][ T5856] CPU: 1 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
** 64 printk messages dropped **
[  213.414047][ T5856]  swap_cluster_readahead+0x4d9/0x640
[  213.414060][ T5856]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  213.414076][ T5856]  ? get_vma_policy+0x27b/0x3c0
[  213.414086][ T5856]  swapin_readahead+0x19a/0xc10
[  213.414098][ T5856]  ? swap_table_get+0x1e/0x260
[  213.414128][ T5856]  ? swap_table_get+0x1e/0x260
[  213.414138][ T5856]  ? __pfx_swapin_readahead+0x10/0x10
[  213.414150][ T5856]  ? swap_table_get+0x1e/0x260
[  213.414159][ T5856]  ? swap_table_get+0x1e/0x260
[  213.414168][ T5856]  ? swap_table_get+0x1e/0x260
[  213.414178][ T5856]  ? swap_table_get+0x216/0x260
[  213.414188][ T5856]  ? swap_cache_get_folio+0x2e7/0x2f0
[  213.414200][ T5856]  do_swap_page+0x344/0x4930
[  213.414212][ T5856]  ? __pte_offset_map+0x29/0x240
[  213.414222][ T5856]  ? __pte_offset_map+0x29/0x240
[  213.414235][ T5856]  ? __lock_acquire+0x683/0x2cf0
[  213.414242][ T5856]  ? do_swap_page+0x128/0x4930
[  213.414252][ T5856]  ? __pfx_do_swap_page+0x10/0x10
[  213.414260][ T5856]  ? __pte_offset_map+0x1ae/0x240
[  213.414272][ T5856]  ? pte_offset_map_rw_nolock+0xea/0x160
[  213.414288][ T5856]  handle_mm_fault+0x124c/0x3070
[  213.414303][ T5856]  ? handle_mm_fault+0xec/0x3070
[  213.414317][ T5856]  ? __pfx_handle_mm_fault+0x10/0x10
[  213.414326][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
[  213.414347][ T5856]  do_user_addr_fault+0xa4d/0x1340
[  213.414359][ T5856]  ? trace_page_fault_user+0x84/0x1e0
[  213.414368][ T5856]  exc_page_fault+0x6a/0xc0
[  213.414379][ T5856]  asm_exc_page_fault+0x26/0x30
[  213.414387][ T5856] RIP: 0033:0x7feeb916e49e
[  213.414394][ T5856] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  213.414401][ T5856] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  213.414408][ T5856] RAX: fffffffffffffff4 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  213.414414][ T5856] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000031
[  213.414419][ T5856] RBP: 0000000000000031 R08: 0000000000000000 R09: 0000000000000000
[  213.414424][ T5856] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  213.414430][ T5856] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  213.414442][ T5856]  </TASK>
[  213.414448][ T5856] Huh VM_FAULT_OOM leaked out to the #PF handler. Retrying PF
[  213.414458][ T5856] FAULT_INJECTION: forcing a failure.
[  213.414458][ T5856] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  213.652122][ T6127] FAULT_INJECTION: forcing a failure.
[  213.652122][ T6127] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  213.655074][ T5856] CPU: 1 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  213.655105][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  213.655112][ T5856] Call Trace:
[  213.655117][ T5856]  <TASK>
[  213.655121][ T5856]  dump_stack_lvl+0xe8/0x150
[  213.655138][ T5856]  should_fail_ex+0x40c/0x560
[  213.655155][ T5856]  prepare_alloc_pages+0x230/0x650
[  213.655172][ T5856]  __alloc_frozen_pages_noprof+0x12f/0x380
[  213.655188][ T5856]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  213.655204][ T5856]  ? policy_nodemask+0x27c/0x720
[  213.655216][ T5856]  alloc_pages_mpol+0x212/0x380
[  213.655228][ T5856]  folio_alloc_mpol_noprof+0x39/0x160
[  213.655238][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
[  213.655259][ T5856]  swap_cluster_readahead+0x4d9/0x640
** 2 printk messages dropped **
[  213.655300][ T5856]  swapin_readahead+0x19a/0xc10
[  213.655312][ T5856]  ? swap_table_get+0x1e/0x260
[  213.655322][ T5856]  ? swap_table_get+0x1e/0x260
[  213.655333][ T5856]  ? __pfx_swapin_readahead+0x10/0x10
[  213.655344][ T5856]  ? swap_table_get+0x1e/0x260
** 46 printk messages dropped **
[  213.659322][ T6127]  ? rpc_malloc+0xeb/0x260
[  213.659334][ T6127]  ? rpc_malloc+0xeb/0x260
[  213.659349][ T6127]  rpc_malloc+0xeb/0x260
[  213.659362][ T6127]  call_allocate+0x26d/0x680
[  213.659373][ T6127]  ? __pfx_call_allocate+0x10/0x10
** 8 printk messages dropped **
[  213.659488][ T6127]  ? rcu_is_watching+0x15/0xb0
** 46 printk messages dropped **
[  213.660057][ T6127] RAX: ffffffffffffffda RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  213.660065][ T6127] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000200
[  213.660071][ T6127] RBP: 0000000000000200 R08: 0000000000000000 R09: 0000000000000000
[  213.660094][ T6127] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  213.660100][ T6127] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  213.660113][ T6127]  </TASK>
[  213.660144][ T6127] SLUB: Unable to allocate memory on CPU 0 (of node 0) on node -1, gfp=0xcc0(GFP_KERNEL)
[  213.664789][ T5856] CPU: 1 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  213.664801][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  213.664807][ T5856] Call Trace:
[  213.664810][ T5856]  <TASK>
[  213.664814][ T5856]  dump_stack_lvl+0xe8/0x150
[  213.664828][ T5856]  should_fail_ex+0x40c/0x560
[  213.664843][ T5856]  prepare_alloc_pages+0x230/0x650
** 40 printk messages dropped **
[  213.665331][ T5856] RBP: 0000000000000031 R08: 0000000000000000 R09: 0000000000000000
** 50 printk messages dropped **
[  213.724142][ T5856] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000031
[  213.724151][ T5856] RBP: 0000000000000031 R08: 0000000000000000 R09: 0000000000000000
[  213.724156][ T5856] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  213.724162][ T5856] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  213.724174][ T5856]  </TASK>
[  213.724196][ T5856] FAULT_INJECTION: forcing a failure.
[  213.724196][ T5856] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  213.724210][ T5856] CPU: 1 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
** 83 printk messages dropped **
[  213.743581][ T5856]  ? pte_offset_map_rw_nolock+0xea/0x160
** 48 printk messages dropped **
[  213.801148][ T5856]  ? do_swap_page+0x128/0x4930
[  213.801157][ T5856]  ? __pfx_do_swap_page+0x10/0x10
[  213.801166][ T5856]  ? __pte_offset_map+0x1ae/0x240
[  213.801177][ T5856]  ? pte_offset_map_rw_nolock+0xea/0x160
[  213.801189][ T5856]  handle_mm_fault+0x124c/0x3070
[  213.801205][ T5856]  ? handle_mm_fault+0xec/0x3070
[  213.801218][ T5856]  ? __pfx_handle_mm_fault+0x10/0x10
[  213.801228][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
[  213.801249][ T5856]  do_user_addr_fault+0xa4d/0x1340
[  213.801262][ T5856]  ? trace_page_fault_user+0x84/0x1e0
[  213.801271][ T5856]  exc_page_fault+0x6a/0xc0
[  213.801283][ T5856]  asm_exc_page_fault+0x26/0x30
[  213.801292][ T5856] RIP: 0033:0x7feeb916e49e
[  213.801301][ T5856] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
** 40 printk messages dropped **
[  213.884816][ T5856]  ? __pte_offset_map+0x1ae/0x240
[  213.884828][ T5856]  ? pte_offset_map_rw_nolock+0xea/0x160
** 40 printk messages dropped **
[  213.889922][ T6127]  ? __pfx___rpc_execute+0x10/0x10
** 8 printk messages dropped **
[  213.890034][ T6127]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  213.890046][ T6127]  ? xprt_create_transport+0x39b/0x5f0
[  213.890094][ T6127]  ? xprt_create_transport+0x438/0x5f0
[  213.890105][ T6127]  rpc_create+0x649/0x900
[  213.890120][ T6127]  ? __pfx_rpc_create+0x10/0x10
[  213.890147][ T6127]  ? __lock_acquire+0x683/0x2cf0
[  213.890160][ T6127]  rpcb_create_af_local+0x1c7/0x3c0
[  213.890170][ T6127]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  213.890188][ T6127]  ? do_raw_spin_unlock+0xf5/0x210
[  213.890201][ T6127]  rpcb_create_local+0x28f/0x670
** 43 printk messages dropped **
[  213.950685][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  213.950692][ T5856] Call Trace:
[  213.950696][ T5856]  <TASK>
[  213.950700][ T5856]  dump_stack_lvl+0xe8/0x150
[  213.950717][ T5856]  should_fail_ex+0x40c/0x560
[  213.950733][ T5856]  prepare_alloc_pages+0x230/0x650
[  213.950750][ T5856]  __alloc_frozen_pages_noprof+0x12f/0x380
[  213.950765][ T5856]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  213.950781][ T5856]  ? policy_nodemask+0x27c/0x720
[  213.950793][ T5856]  alloc_pages_mpol+0x212/0x380
** 43 printk messages dropped **
[  213.966599][ T5856] Call Trace:
[  213.966603][ T5856]  <TASK>
[  213.966607][ T5856]  dump_stack_lvl+0xe8/0x150
[  213.966623][ T5856]  should_fail_ex+0x40c/0x560
[  213.966639][ T5856]  prepare_alloc_pages+0x230/0x650
[  213.966655][ T5856]  __alloc_frozen_pages_noprof+0x12f/0x380
[  213.966671][ T5856]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
** 24 printk messages dropped **
[  213.966958][ T5856]  handle_mm_fault+0x124c/0x3070
** 24 printk messages dropped **
[  214.044301][ T5856]  dump_stack_lvl+0xe8/0x150
** 46 printk messages dropped **
[  214.045806][ T6127] CPU: 0 UID: 0 PID: 6127 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  214.045818][ T6127] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
** 48 printk messages dropped **
[  214.046461][ T6127]  ? __pfx_nfsd_create_serv+0x10/0x10
** 10 printk messages dropped **
[  214.046590][ T6127]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  214.046599][ T6127]  vfs_write+0x296/0xba0
[  214.046614][ T6127]  ? __pfx_vfs_write+0x10/0x10
[  214.046623][ T6127]  ? lockdep_hardirqs_on+0x7a/0x110
[  214.046638][ T6127]  ? fput_close_sync+0x11f/0x240
[  214.046650][ T6127]  ksys_write+0x150/0x270
[  214.046662][ T6127]  ? __pfx_ksys_write+0x10/0x10
[  214.046676][ T6127]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  214.046686][ T6127]  do_syscall_64+0x174/0x580
[  214.046696][ T6127]  ? trace_irq_disable+0x3b/0x140
[  214.046705][ T6127]  ? clear_bhb_loop+0x70/0xc0
[  214.046715][ T6127]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
** 2 printk messages dropped **
[  214.046740][ T6127] RSP: 002b:00007fff9882b788 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
** 36 printk messages dropped **
[  214.052264][ T5856]  ? do_swap_page+0x128/0x4930
[  214.052274][ T5856]  ? __pfx_do_swap_page+0x10/0x10
[  214.052282][ T5856]  ? __pte_offset_map+0x1ae/0x240
[  214.052294][ T5856]  ? pte_offset_map_rw_nolock+0xea/0x160
[  214.052305][ T5856]  handle_mm_fault+0x124c/0x3070
** 44 printk messages dropped **
[  214.110889][ T5856]  ? __pte_offset_map+0x29/0x240
[  214.110900][ T5856]  ? __pte_offset_map+0x29/0x240
[  214.110912][ T5856]  ? __lock_acquire+0x683/0x2cf0
** 48 printk messages dropped **
[  214.123402][ T5856]  do_swap_page+0x344/0x4930
** 50 printk messages dropped **
[  214.241696][ T5856]  ? swap_cache_get_folio+0x2e7/0x2f0
[  214.241708][ T5856]  do_swap_page+0x344/0x4930
[  214.241721][ T5856]  ? __pte_offset_map+0x29/0x240
[  214.241732][ T5856]  ? __pte_offset_map+0x29/0x240
[  214.241745][ T5856]  ? __lock_acquire+0x683/0x2cf0
[  214.241753][ T5856]  ? do_swap_page+0x128/0x4930
** 45 printk messages dropped **
[  214.242352][ T5856]  ? swap_cache_get_folio+0x2e7/0x2f0
[  214.242365][ T5856]  do_swap_page+0x344/0x4930
[  214.242376][ T5856]  ? __pte_offset_map+0x29/0x240
[  214.242387][ T5856]  ? __pte_offset_map+0x29/0x240
[  214.242399][ T5856]  ? __lock_acquire+0x683/0x2cf0
[  214.242407][ T5856]  ? do_swap_page+0x128/0x4930
[  214.242416][ T5856]  ? __pfx_do_swap_page+0x10/0x10
[  214.242425][ T5856]  ? __pte_offset_map+0x1ae/0x240
[  214.242437][ T5856]  ? pte_offset_map_rw_nolock+0xea/0x160
[  214.242448][ T5856]  handle_mm_fault+0x124c/0x3070
[  214.242464][ T5856]  ? handle_mm_fault+0xec/0x3070
[  214.242477][ T5856]  ? __pfx_handle_mm_fault+0x10/0x10
[  214.242487][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
[  214.242508][ T5856]  do_user_addr_fault+0xa4d/0x1340
[  214.242519][ T5856]  ? trace_page_fault_user+0x84/0x1e0
[  214.242529][ T5856]  exc_page_fault+0x6a/0xc0
[  214.242540][ T5856]  asm_exc_page_fault+0x26/0x30
[  214.242548][ T5856] RIP: 0033:0x7feeb916e49e
[  214.242555][ T5856] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  214.242563][ T5856] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  214.242570][ T5856] RAX: fffffffffffffff4 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  214.242576][ T5856] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000031
[  214.242581][ T5856] RBP: 0000000000000031 R08: 0000000000000000 R09: 0000000000000000
** 30 printk messages dropped **
[  214.242914][ T5856]  ? __pte_offset_map+0x29/0x240
[  214.242925][ T5856]  ? __pte_offset_map+0x29/0x240
[  214.242937][ T5856]  ? __lock_acquire+0x683/0x2cf0
** 35 printk messages dropped **
[  214.243327][ T5856]  swap_cluster_readahead+0x4d9/0x640
** 34 printk messages dropped **
[  214.243686][ T5856] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  214.243697][ T5856]  </TASK>
[  214.243708][ T5856] FAULT_INJECTION: forcing a failure.
[  214.243708][ T5856] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  214.243719][ T5856] CPU: 1 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
** 65 printk messages dropped **
[  214.244443][ T5856]  ? get_vma_policy+0x27b/0x3c0
** 32 printk messages dropped **
[  214.244782][ T5856] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  214.244793][ T5856]  </TASK>
[  214.244805][ T5856] FAULT_INJECTION: forcing a failure.
[  214.244805][ T5856] name fail_page_alloc, interval 1, probability 100, space 0, times -1
** 48 printk messages dropped **
[  214.245344][ T5856] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  214.245355][ T5856]  </TASK>
[  214.245368][ T5856] FAULT_INJECTION: forcing a failure.
[  214.245368][ T5856] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  214.245379][ T5856] CPU: 1 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  214.245388][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  214.245392][ T5856] Call Trace:
[  214.245396][ T5856]  <TASK>
[  214.245399][ T5856]  dump_stack_lvl+0xe8/0x150
[  214.245411][ T5856]  should_fail_ex+0x40c/0x560
[  214.245425][ T5856]  prepare_alloc_pages+0x230/0x650
[  214.245440][ T5856]  __alloc_frozen_pages_noprof+0x12f/0x380
[  214.245455][ T5856]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  214.245471][ T5856]  ? policy_nodemask+0x27c/0x720
[  214.245482][ T5856]  alloc_pages_mpol+0x212/0x380
[  214.245493][ T5856]  folio_alloc_mpol_noprof+0x39/0x160
** 36 printk messages dropped **
[  214.245877][ T5856] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
** 50 printk messages dropped **
[  214.246434][ T5856] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
** 50 printk messages dropped **
[  214.246965][ T5856] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
** 63 printk messages dropped **
[  214.247659][ T5856]  alloc_pages_mpol+0x212/0x380
** 37 printk messages dropped **
[  214.248071][ T5856] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  214.248083][ T5856]  </TASK>
[  214.248095][ T5856] FAULT_INJECTION: forcing a failure.
[  214.248095][ T5856] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  214.248106][ T5856] CPU: 1 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
** 48 printk messages dropped **
[  214.248621][ T5856]  </TASK>
** 54 printk messages dropped **
[  214.249210][ T5856] Call Trace:
** 46 printk messages dropped **
[  214.249705][ T5856]  </TASK>
[  214.249715][ T5856] FAULT_INJECTION: forcing a failure.
[  214.249715][ T5856] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  214.249726][ T5856] CPU: 1 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  214.249735][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
** 51 printk messages dropped **
[  214.250304][ T5856] Call Trace:
** 46 printk messages dropped **
[  214.250817][ T5856]  </TASK>
[  214.250881][ T5856] FAULT_INJECTION: forcing a failure.
[  214.250881][ T5856] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  214.250893][ T5856] CPU: 1 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  214.250902][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  214.250907][ T5856] Call Trace:
[  214.250910][ T5856]  <TASK>
[  214.250913][ T5856]  dump_stack_lvl+0xe8/0x150
[  214.250926][ T5856]  should_fail_ex+0x40c/0x560
[  214.250940][ T5856]  prepare_alloc_pages+0x230/0x650
[  214.250956][ T5856]  __alloc_frozen_pages_noprof+0x12f/0x380
** 42 printk messages dropped **
[  214.251446][ T5856] FAULT_INJECTION: forcing a failure.
[  214.251446][ T5856] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  214.251457][ T5856] CPU: 1 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  214.251466][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  214.251471][ T5856] Call Trace:
[  214.251474][ T5856]  <TASK>
** 8 printk messages dropped **
[  214.251582][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
** 37 printk messages dropped **
[  214.251977][ T5856] FAULT_INJECTION: forcing a failure.
[  214.251977][ T5856] name fail_page_alloc, interval 1, probability 100, space 0, times -1
** 51 printk messages dropped **
[  214.252545][ T5856] CPU: 1 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  214.252554][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
** 50 printk messages dropped **
[  214.253108][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  214.253113][ T5856] Call Trace:
[  214.253116][ T5856]  <TASK>
[  214.253120][ T5856]  dump_stack_lvl+0xe8/0x150
[  214.253132][ T5856]  should_fail_ex+0x40c/0x560
[  214.253146][ T5856]  prepare_alloc_pages+0x230/0x650
[  214.253162][ T5856]  __alloc_frozen_pages_noprof+0x12f/0x380
[  214.253177][ T5856]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
** 78 printk messages dropped **
[  214.389560][ T5856]  ? __pfx_handle_mm_fault+0x10/0x10
[  214.389569][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
[  214.389591][ T5856]  do_user_addr_fault+0xa4d/0x1340
[  214.389603][ T5856]  ? trace_page_fault_user+0x84/0x1e0
[  214.389612][ T5856]  exc_page_fault+0x6a/0xc0
[  214.389625][ T5856]  asm_exc_page_fault+0x26/0x30
[  214.389633][ T5856] RIP: 0033:0x7feeb916e49e
[  214.389642][ T5856] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
** 13 printk messages dropped **
[  214.391664][ T6127]  should_fail_ex+0x40c/0x560
** 29 printk messages dropped **
[  214.392097][ T6127]  ? __pfx_rpc_create+0x10/0x10
** 49 printk messages dropped **
[  214.395501][ T5856] Call Trace:
** 50 printk messages dropped **
[  214.440667][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
** 51 printk messages dropped **
[  214.447183][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
** 50 printk messages dropped **
[  214.520671][ T6127] FAULT_INJECTION: forcing a failure.
[  214.520671][ T6127] name fail_page_alloc, interval 1, probability 100, space 0, times -1
** 49 printk messages dropped **
[  214.529698][ T5856]  </TASK>
** 65 printk messages dropped **
[  214.534192][ T6127]  ? lockdep_hardirqs_on+0x7a/0x110
** 43 printk messages dropped **
[  214.537003][ T5856]  do_swap_page+0x344/0x4930
[  214.537018][ T5856]  ? __pte_offset_map+0x29/0x240
[  214.537029][ T5856]  ? __pte_offset_map+0x29/0x240
[  214.537042][ T5856]  ? __lock_acquire+0x683/0x2cf0
[  214.537049][ T5856]  ? do_swap_page+0x128/0x4930
[  214.537059][ T5856]  ? __pfx_do_swap_page+0x10/0x10
[  214.537068][ T5856]  ? __pte_offset_map+0x1ae/0x240
[  214.537079][ T5856]  ? pte_offset_map_rw_nolock+0xea/0x160
[  214.537091][ T5856]  handle_mm_fault+0x124c/0x3070
** 40 printk messages dropped **
[  214.590913][ T5856]  ? swap_table_get+0x1e/0x260
** 50 printk messages dropped **
[  214.596255][ T5856]  ? swap_table_get+0x1e/0x260
[  214.596264][ T5856]  ? swap_table_get+0x1e/0x260
[  214.596274][ T5856]  ? swap_table_get+0x216/0x260
[  214.596284][ T5856]  ? swap_cache_get_folio+0x2e7/0x2f0
[  214.596297][ T5856]  do_swap_page+0x344/0x4930
[  214.596309][ T5856]  ? __pte_offset_map+0x29/0x240
[  214.596320][ T5856]  ? __pte_offset_map+0x29/0x240
[  214.596333][ T5856]  ? __lock_acquire+0x683/0x2cf0
[  214.596340][ T5856]  ? do_swap_page+0x128/0x4930
** 44 printk messages dropped **
[  214.605183][ T5856]  ? swap_table_get+0x1e/0x260
** 48 printk messages dropped **
[  214.721353][ T5856]  ? __pfx_swapin_readahead+0x10/0x10
[  214.721365][ T5856]  ? swap_table_get+0x1e/0x260
** 1251 printk messages dropped **
[  215.674823][ T6127]  ? sscanf+0xe2/0x140
** 2 printk messages dropped **
[  215.674855][ T6127]  ? net_generic+0x1e/0x240
[  215.674899][ T6127]  ? net_generic+0x1e/0x240
[  215.674914][ T6127]  write_ports+0x669/0xd10
[  215.674924][ T6127]  ? __pfx_write_ports+0x10/0x10
[  215.674941][ T6127]  ? _copy_from_user+0x94/0xb0
[  215.674952][ T6127]  ? simple_transaction_get+0x12d/0x160
[  215.674963][ T6127]  nfsctl_transaction_write+0x10f/0x160
[  215.674972][ T6127]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  215.674981][ T6127]  vfs_write+0x296/0xba0
[  215.674995][ T6127]  ? __pfx_vfs_write+0x10/0x10
[  215.675005][ T6127]  ? lockdep_hardirqs_on+0x7a/0x110
[  215.675020][ T6127]  ? fput_close_sync+0x11f/0x240
[  215.675032][ T6127]  ksys_write+0x150/0x270
[  215.675044][ T6127]  ? __pfx_ksys_write+0x10/0x10
** 42 printk messages dropped **
[  215.771424][ T5856]  ? __pte_offset_map+0x29/0x240
** 57 printk messages dropped **
[  215.774070][ T6127]  rpc_create+0x649/0x900
** 46 printk messages dropped **
[  215.774602][ T6127]  </TASK>
** 1 printk messages dropped **
[  215.851506][ T5856] CPU: 1 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  215.851518][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  215.851524][ T5856] Call Trace:
[  215.851529][ T5856]  <TASK>
[  215.851534][ T5856]  dump_stack_lvl+0xe8/0x150
[  215.851549][ T5856]  should_fail_ex+0x40c/0x560
[  215.851566][ T5856]  prepare_alloc_pages+0x230/0x650
[  215.851584][ T5856]  __alloc_frozen_pages_noprof+0x12f/0x380
[  215.851599][ T5856]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  215.851616][ T5856]  ? policy_nodemask+0x27c/0x720
[  215.851627][ T5856]  alloc_pages_mpol+0x212/0x380
[  215.851639][ T5856]  folio_alloc_mpol_noprof+0x39/0x160
[  215.851650][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
[  215.851667][ T5856]  swap_cluster_readahead+0x4d9/0x640
[  215.851681][ T5856]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  215.851697][ T5856]  ? get_vma_policy+0x27b/0x3c0
[  215.851707][ T5856]  swapin_readahead+0x19a/0xc10
[  215.851719][ T5856]  ? swap_table_get+0x1e/0x260
[  215.851730][ T5856]  ? swap_table_get+0x1e/0x260
[  215.851740][ T5856]  ? __pfx_swapin_readahead+0x10/0x10
[  215.851752][ T5856]  ? swap_table_get+0x1e/0x260
[  215.851761][ T5856]  ? swap_table_get+0x1e/0x260
[  215.851770][ T5856]  ? swap_table_get+0x1e/0x260
[  215.851780][ T5856]  ? swap_table_get+0x216/0x260
[  215.851790][ T5856]  ? swap_cache_get_folio+0x2e7/0x2f0
[  215.851803][ T5856]  do_swap_page+0x344/0x4930
[  215.851816][ T5856]  ? __pte_offset_map+0x29/0x240
[  215.851827][ T5856]  ? __pte_offset_map+0x29/0x240
[  215.851840][ T5856]  ? __lock_acquire+0x683/0x2cf0
[  215.851871][ T5856]  ? do_swap_page+0x128/0x4930
** 21 printk messages dropped **
[  215.852767][ T6127] CPU: 0 UID: 0 PID: 6127 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
** 58 printk messages dropped **
[  215.853522][ T6127]  ? simple_transaction_get+0x12d/0x160
[  215.853533][ T6127]  nfsctl_transaction_write+0x10f/0x160
[  215.853543][ T6127]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  215.853551][ T6127]  vfs_write+0x296/0xba0
[  215.853566][ T6127]  ? __pfx_vfs_write+0x10/0x10
[  215.853576][ T6127]  ? lockdep_hardirqs_on+0x7a/0x110
[  215.853590][ T6127]  ? fput_close_sync+0x11f/0x240
** 43 printk messages dropped **
[  216.181080][ T5856]  ? __pte_offset_map+0x29/0x240
[  216.181091][ T5856]  ? __pte_offset_map+0x29/0x240
[  216.181103][ T5856]  ? __lock_acquire+0x683/0x2cf0
[  216.181111][ T5856]  ? do_swap_page+0x128/0x4930
[  216.181121][ T5856]  ? __pfx_do_swap_page+0x10/0x10
** 47 printk messages dropped **
[  216.281186][ T6127]  rpc_create_xprt+0x533/0xa90
[  216.281196][ T6127]  ? __pfx_rpc_create_xprt+0x10/0x10
[  216.281212][ T6127]  ? rcu_is_watching+0x15/0xb0
[  216.281223][ T6127]  ? trace_kmalloc+0x2a/0xf0
[  216.281237][ T6127]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
** 1 printk messages dropped **
[  216.281263][ T6127]  ? xprt_create_transport+0x438/0x5f0
** 46 printk messages dropped **
[  216.281795][ T6127] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  216.281827][ T6127]  </TASK>
[  216.517557][ T6127] FAULT_INJECTION: forcing a failure.
[  216.517557][ T6127] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  216.606817][ T5856] CPU: 1 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
** 47 printk messages dropped **
[  216.607364][ T5856] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  216.607377][ T5856]  </TASK>
[  216.607389][ T5856] pagefault_out_of_memory: 61 callbacks suppressed
** 56 printk messages dropped **
[  216.732900][ T6127]  ? net_generic+0x1e/0x240
** 48 printk messages dropped **
[  216.804651][ T6127]  call_allocate+0x26d/0x680
[  216.804663][ T6127]  ? __pfx_call_allocate+0x10/0x10
[  216.804675][ T6127]  __rpc_execute+0x526/0x1280
[  216.804693][ T6127]  ? __pfx___rpc_execute+0x10/0x10
[  216.804706][ T6127]  ? rpc_task_get_xprt+0x26/0x250
[  216.804716][ T6127]  ? rpc_make_runnable+0xae/0x1c0
[  216.804729][ T6127]  rpc_execute+0x1c1/0x390
** 13 printk messages dropped **
[  216.804967][ T6127]  ? do_raw_spin_unlock+0xf5/0x210
** 36 printk messages dropped **
[  216.805389][ T6127] RAX: ffffffffffffffda RBX: 0000555571e8f400 RCX: 00007feeb916e49e
** 78 printk messages dropped **
[  216.899220][ T6127]  ? rpc_sysfs_xprt_switch_setup+0x1c6/0x2b0
[  216.899235][ T6127]  xprt_switch_alloc+0x238/0x590
[  216.899247][ T6127]  rpc_create_xprt+0x1c7/0xa90
[  216.899257][ T6127]  ? __pfx_rpc_create_xprt+0x10/0x10
[  216.899274][ T6127]  ? rcu_is_watching+0x15/0xb0
[  216.899285][ T6127]  ? trace_kmalloc+0x2a/0xf0
[  216.899297][ T6127]  ? __kmalloc_node_track_caller_noprof+0x4e1/0x730
** 47 printk messages dropped **
[  216.900454][ T5856] FAULT_INJECTION: forcing a failure.
[  216.900454][ T5856] name fail_page_alloc, interval 1, probability 100, space 0, times -1
** 48 printk messages dropped **
[  216.901027][ T5856] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
** 59 printk messages dropped **
[  216.904701][ T6127]  ? __pfx_ksys_write+0x10/0x10
[  216.904715][ T6127]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  216.904724][ T6127]  do_syscall_64+0x174/0x580
** 9 printk messages dropped **
[  216.904855][ T6127] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
** 35 printk messages dropped **
[  216.913632][ T6127]  ? xprt_create_transport+0x438/0x5f0
** 49 printk messages dropped **
[  217.014166][ T6127]  __alloc_frozen_pages_noprof+0x12f/0x380
** 1 printk messages dropped **
[  217.014197][ T6127]  ? policy_nodemask+0x27c/0x720
** 52 printk messages dropped **
[  217.022214][ T5856]  __alloc_frozen_pages_noprof+0x12f/0x380
[  217.022229][ T5856]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  217.022245][ T5856]  ? policy_nodemask+0x27c/0x720
[  217.022257][ T5856]  alloc_pages_mpol+0x212/0x380
[  217.022269][ T5856]  folio_alloc_mpol_noprof+0x39/0x160
[  217.022279][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
[  217.022296][ T5856]  swap_cluster_readahead+0x4d9/0x640
[  217.022310][ T5856]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  217.022326][ T5856]  ? get_vma_policy+0x27b/0x3c0
[  217.022336][ T5856]  swapin_readahead+0x19a/0xc10
[  217.022348][ T5856]  ? swap_table_get+0x1e/0x260
** 40 printk messages dropped **
[  217.031561][ T6127]  prepare_alloc_pages+0x230/0x650
[  217.031578][ T6127]  __alloc_frozen_pages_noprof+0x12f/0x380
** 32 printk messages dropped **
[  217.032021][ T6127]  exc_page_fault+0x6a/0xc0
** 14 printk messages dropped **
[  217.062890][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  217.062896][ T5856] Call Trace:
[  217.062900][ T5856]  <TASK>
[  217.062909][ T5856]  dump_stack_lvl+0xe8/0x150
[  217.062925][ T5856]  should_fail_ex+0x40c/0x560
[  217.062941][ T5856]  prepare_alloc_pages+0x230/0x650
** 46 printk messages dropped **
[  217.065919][ T6127] Call Trace:
[  217.065923][ T6127]  <TASK>
[  217.065927][ T6127]  dump_stack_lvl+0xe8/0x150
[  217.065942][ T6127]  should_fail_ex+0x40c/0x560
[  217.065958][ T6127]  prepare_alloc_pages+0x230/0x650
[  217.065974][ T6127]  __alloc_frozen_pages_noprof+0x12f/0x380
[  217.065989][ T6127]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  217.066005][ T6127]  ? policy_nodemask+0x27c/0x720
[  217.066016][ T6127]  alloc_pages_mpol+0x212/0x380
[  217.066028][ T6127]  folio_alloc_mpol_noprof+0x39/0x160
[  217.066038][ T6127]  swap_cache_alloc_folio+0x2c1/0x990
[  217.066054][ T6127]  swap_cluster_readahead+0x4d9/0x640
[  217.066067][ T6127]  ? __pfx_swap_cluster_readahead+0x10/0x10
** 39 printk messages dropped **
[  217.082406][ T5880] CPU: 1 UID: 0 PID: 5880 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  217.082417][ T5880] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  217.082423][ T5880] Call Trace:
[  217.082427][ T5880]  <TASK>
[  217.082431][ T5880]  dump_stack_lvl+0xe8/0x150
[  217.082447][ T5880]  should_fail_ex+0x40c/0x560
** 53 printk messages dropped **
[  217.083165][ T5880]  ? __pfx_sscanf+0x10/0x10
** 49 printk messages dropped **
[  217.087270][ T6127]  ? __pfx_swapin_readahead+0x10/0x10
** 48 printk messages dropped **
[  217.109066][ T5856]  ? get_vma_policy+0x27b/0x3c0
[  217.109076][ T5856]  swapin_readahead+0x19a/0xc10
[  217.109089][ T5856]  ? swap_table_get+0x1e/0x260
[  217.109099][ T5856]  ? swap_table_get+0x1e/0x260
** 48 printk messages dropped **
[  217.118596][ T6127]  swapin_readahead+0x19a/0xc10
[  217.118608][ T6127]  ? swap_table_get+0x1e/0x260
[  217.118618][ T6127]  ? swap_table_get+0x1e/0x260
[  217.118628][ T6127]  ? __pfx_swapin_readahead+0x10/0x10
[  217.118640][ T6127]  ? swap_table_get+0x1e/0x260
[  217.118649][ T6127]  ? swap_table_get+0x1e/0x260
[  217.118658][ T6127]  ? swap_table_get+0x1e/0x260
[  217.118668][ T6127]  ? swap_table_get+0x216/0x260
[  217.118678][ T6127]  ? swap_cache_get_folio+0x2e7/0x2f0
[  217.118691][ T6127]  do_swap_page+0x344/0x4930
[  217.118703][ T6127]  ? __pte_offset_map+0x29/0x240
[  217.118745][ T6127]  ? __pte_offset_map+0x29/0x240
[  217.118759][ T6127]  ? __lock_acquire+0x683/0x2cf0
[  217.118767][ T6127]  ? do_swap_page+0x128/0x4930
** 15 printk messages dropped **
[  217.118945][ T6127] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000200
** 21 printk messages dropped **
[  217.148503][ T6127]  ? get_vma_policy+0x27b/0x3c0
[  217.148514][ T6127]  swapin_readahead+0x19a/0xc10
[  217.148526][ T6127]  ? swap_table_get+0x1e/0x260
[  217.148536][ T6127]  ? swap_table_get+0x1e/0x260
[  217.148547][ T6127]  ? __pfx_swapin_readahead+0x10/0x10
[  217.148558][ T6127]  ? swap_table_get+0x1e/0x260
[  217.148568][ T6127]  ? swap_table_get+0x1e/0x260
[  217.148577][ T6127]  ? swap_table_get+0x1e/0x260
[  217.148587][ T6127]  ? swap_table_get+0x216/0x260
[  217.148598][ T6127]  ? swap_cache_get_folio+0x2e7/0x2f0
[  217.148610][ T6127]  do_swap_page+0x344/0x4930
[  217.148623][ T6127]  ? __pte_offset_map+0x29/0x240
[  217.148634][ T6127]  ? __pte_offset_map+0x29/0x240
[  217.148646][ T6127]  ? __lock_acquire+0x683/0x2cf0
[  217.148654][ T6127]  ? do_swap_page+0x128/0x4930
[  217.148664][ T6127]  ? __pfx_do_swap_page+0x10/0x10
[  217.148672][ T6127]  ? __pte_offset_map+0x1ae/0x240
** 14 printk messages dropped **
[  217.148870][ T6127] RBP: 0000000000000200 R08: 0000000000000000 R09: 0000000000000000
** 17 printk messages dropped **
[  217.164462][ T6127]  swap_cache_alloc_folio+0x2c1/0x990
** 48 printk messages dropped **
[  217.176410][ T6127]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  217.176427][ T6127]  ? policy_nodemask+0x27c/0x720
[  217.176438][ T6127]  alloc_pages_mpol+0x212/0x380
[  217.176450][ T6127]  folio_alloc_mpol_noprof+0x39/0x160
[  217.176461][ T6127]  swap_cache_alloc_folio+0x2c1/0x990
[  217.176477][ T6127]  swap_cluster_readahead+0x4d9/0x640
[  217.176490][ T6127]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  217.176506][ T6127]  ? get_vma_policy+0x27b/0x3c0
** 9 printk messages dropped **
[  217.176613][ T6127]  do_swap_page+0x344/0x4930
** 33 printk messages dropped **
[  217.179093][ T5880]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  217.179109][ T5880]  ? policy_nodemask+0x27c/0x720
[  217.179121][ T5880]  alloc_pages_mpol+0x212/0x380
[  217.179132][ T5880]  folio_alloc_mpol_noprof+0x39/0x160
[  217.179143][ T5880]  swap_cache_alloc_folio+0x2c1/0x990
[  217.179159][ T5880]  swap_cluster_readahead+0x4d9/0x640
[  217.179172][ T5880]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  217.179188][ T5880]  ? get_vma_policy+0x27b/0x3c0
[  217.179198][ T5880]  swapin_readahead+0x19a/0xc10
[  217.179210][ T5880]  ? swap_table_get+0x1e/0x260
** 41 printk messages dropped **
[  217.187635][ T6127]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  217.187651][ T6127]  ? policy_nodemask+0x27c/0x720
** 1 printk messages dropped **
[  217.187674][ T6127]  folio_alloc_mpol_noprof+0x39/0x160
[  217.187685][ T6127]  swap_cache_alloc_folio+0x2c1/0x990
[  217.187701][ T6127]  swap_cluster_readahead+0x4d9/0x640
[  217.187742][ T6127]  ? __pfx_swap_cluster_readahead+0x10/0x10
** 47 printk messages dropped **
[  217.210096][ T5856]  folio_alloc_mpol_noprof+0x39/0x160
[  217.210106][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
[  217.210123][ T5856]  swap_cluster_readahead+0x4d9/0x640
[  217.210136][ T5856]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  217.210152][ T5856]  ? get_vma_policy+0x27b/0x3c0
[  217.210162][ T5856]  swapin_readahead+0x19a/0xc10
[  217.210174][ T5856]  ? swap_table_get+0x1e/0x260
[  217.210184][ T5856]  ? swap_table_get+0x1e/0x260
[  217.210195][ T5856]  ? __pfx_swapin_readahead+0x10/0x10
[  217.210206][ T5856]  ? swap_table_get+0x1e/0x260
[  217.210216][ T5856]  ? swap_table_get+0x1e/0x260
** 72 printk messages dropped **
[  217.221128][ T6127] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  217.221137][ T6127] RAX: fffffffffffffff4 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  217.221143][ T6127] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000200
** 48 printk messages dropped **
[  217.226406][ T5880] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  217.226414][ T5880] RAX: 0000000000000008 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  217.226420][ T5880] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000061
[  217.226426][ T5880] RBP: 0000000000000061 R08: 0000000000000000 R09: 0000000000000000
[  217.226431][ T5880] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  217.226437][ T5880] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  217.226449][ T5880]  </TASK>
[  217.226473][ T5880] FAULT_INJECTION: forcing a failure.
[  217.226473][ T5880] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  217.228189][ T6127] CPU: 0 UID: 0 PID: 6127 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
** 42 printk messages dropped **
[  217.228696][ T6127] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
** 50 printk messages dropped **
[  217.238685][ T5880] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  217.238694][ T5880] RAX: 0000000000000008 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  217.238729][ T5880] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000061
** 49 printk messages dropped **
[  217.280677][ T5856] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
** 49 printk messages dropped **
[  217.287982][ T6134]  svc_bind+0x1b4/0x230
[  217.287993][ T6134]  nfsd_create_serv+0x581/0x840
[  217.288005][ T6134]  ? kasan_save_track+0x3e/0x80
[  217.288017][ T6134]  ? __pfx_nfsd_create_serv+0x10/0x10
[  217.288029][ T6134]  ? sscanf+0xe2/0x140
** 46 printk messages dropped **
[  217.301256][ T5856]  ? get_vma_policy+0x27b/0x3c0
[  217.301266][ T5856]  swapin_readahead+0x19a/0xc10
[  217.301279][ T5856]  ? swap_table_get+0x1e/0x260
[  217.301289][ T5856]  ? swap_table_get+0x1e/0x260
[  217.301299][ T5856]  ? __pfx_swapin_readahead+0x10/0x10
** 47 printk messages dropped **
[  217.301865][ T5856]  swapin_readahead+0x19a/0xc10
** 50 printk messages dropped **
[  217.312034][ T6127]  swapin_readahead+0x19a/0xc10
[  217.312046][ T6127]  ? swap_table_get+0x1e/0x260
[  217.312057][ T6127]  ? swap_table_get+0x1e/0x260
[  217.312067][ T6127]  ? __pfx_swapin_readahead+0x10/0x10
[  217.312079][ T6127]  ? swap_table_get+0x1e/0x260
** 43 printk messages dropped **
[  217.340801][ T5880]  swap_cluster_readahead+0x4d9/0x640
** 2 printk messages dropped **
[  217.340840][ T5880]  swapin_readahead+0x19a/0xc10
[  217.340853][ T5880]  ? swap_table_get+0x1e/0x260
[  217.340863][ T5880]  ? swap_table_get+0x1e/0x260
[  217.340874][ T5880]  ? __pfx_swapin_readahead+0x10/0x10
** 53 printk messages dropped **
[  217.342556][ T5856]  ? swap_table_get+0x1e/0x260
** 45 printk messages dropped **
[  217.344785][ T5880]  ? swap_table_get+0x1e/0x260
[  217.344795][ T5880]  ? swap_table_get+0x1e/0x260
[  217.344806][ T5880]  ? __pfx_swapin_readahead+0x10/0x10
[  217.344818][ T5880]  ? swap_table_get+0x1e/0x260
[  217.344828][ T5880]  ? swap_table_get+0x1e/0x260
[  217.344836][ T5880]  ? swap_table_get+0x1e/0x260
** 20 printk messages dropped **
[  217.345080][ T5880] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
** 24 printk messages dropped **
[  217.349333][ T5856]  ? swap_table_get+0x1e/0x260
** 50 printk messages dropped **
[  217.351365][ T5880]  ? swap_table_get+0x1e/0x260
[  217.351376][ T5880]  ? swap_table_get+0x1e/0x260
[  217.351386][ T5880]  ? __pfx_swapin_readahead+0x10/0x10
[  217.351398][ T5880]  ? swap_table_get+0x1e/0x260
** 22 printk messages dropped **
[  217.351652][ T5880] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
** 23 printk messages dropped **
[  217.362285][ T5880]  ? get_vma_policy+0x27b/0x3c0
[  217.362296][ T5880]  swapin_readahead+0x19a/0xc10
[  217.362308][ T5880]  ? swap_table_get+0x1e/0x260
[  217.362318][ T5880]  ? swap_table_get+0x1e/0x260
[  217.362328][ T5880]  ? __pfx_swapin_readahead+0x10/0x10
[  217.362340][ T5880]  ? swap_table_get+0x1e/0x260
[  217.362349][ T5880]  ? swap_table_get+0x1e/0x260
[  217.362358][ T5880]  ? swap_table_get+0x1e/0x260
[  217.362369][ T5880]  ? swap_table_get+0x216/0x260
[  217.362379][ T5880]  ? swap_cache_get_folio+0x2e7/0x2f0
[  217.362392][ T5880]  do_swap_page+0x344/0x4930
[  217.362404][ T5880]  ? __pte_offset_map+0x29/0x240
[  217.362415][ T5880]  ? __pte_offset_map+0x29/0x240
[  217.362427][ T5880]  ? __lock_acquire+0x683/0x2cf0
[  217.362435][ T5880]  ? do_swap_page+0x128/0x4930
[  217.362445][ T5880]  ? __pfx_do_swap_page+0x10/0x10
** 35 printk messages dropped **
[  217.365177][ T5856]  ? get_vma_policy+0x27b/0x3c0
[  217.365187][ T5856]  swapin_readahead+0x19a/0xc10
[  217.365199][ T5856]  ? swap_table_get+0x1e/0x260
[  217.365210][ T5856]  ? swap_table_get+0x1e/0x260
[  217.365220][ T5856]  ? __pfx_swapin_readahead+0x10/0x10
[  217.365232][ T5856]  ? swap_table_get+0x1e/0x260
[  217.365241][ T5856]  ? swap_table_get+0x1e/0x260
[  217.365250][ T5856]  ? swap_table_get+0x1e/0x260
[  217.365260][ T5856]  ? swap_table_get+0x216/0x260
[  217.365271][ T5856]  ? swap_cache_get_folio+0x2e7/0x2f0
[  217.365283][ T5856]  do_swap_page+0x344/0x4930
[  217.365296][ T5856]  ? __pte_offset_map+0x29/0x240
[  217.365307][ T5856]  ? __pte_offset_map+0x29/0x240
[  217.365319][ T5856]  ? __lock_acquire+0x683/0x2cf0
[  217.365327][ T5856]  ? do_swap_page+0x128/0x4930
[  217.365336][ T5856]  ? __pfx_do_swap_page+0x10/0x10
[  217.365345][ T5856]  ? __pte_offset_map+0x1ae/0x240
[  217.365356][ T5856]  ? pte_offset_map_rw_nolock+0xea/0x160
[  217.365368][ T5856]  handle_mm_fault+0x124c/0x3070
[  217.365384][ T5856]  ? handle_mm_fault+0xec/0x3070
[  217.365397][ T5856]  ? __pfx_handle_mm_fault+0x10/0x10
[  217.365407][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
[  217.365428][ T5856]  do_user_addr_fault+0xa4d/0x1340
[  217.365441][ T5856]  ? trace_page_fault_user+0x84/0x1e0
[  217.365450][ T5856]  exc_page_fault+0x6a/0xc0
[  217.365462][ T5856]  asm_exc_page_fault+0x26/0x30
[  217.365470][ T5856] RIP: 0033:0x7feeb916e49e
[  217.365479][ T5856] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  217.365486][ T5856] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  217.365494][ T5856] RAX: fffffffffffffff4 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  217.365500][ T5856] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000031
[  217.365505][ T5856] RBP: 0000000000000031 R08: 0000000000000000 R09: 0000000000000000
** 16 printk messages dropped **
[  217.366787][ T5880]  swap_cache_alloc_folio+0x2c1/0x990
** 2 printk messages dropped **
[  217.366833][ T5880]  ? get_vma_policy+0x27b/0x3c0
** 50 printk messages dropped **
[  217.378415][ T5856]  ? get_vma_policy+0x27b/0x3c0
[  217.378425][ T5856]  swapin_readahead+0x19a/0xc10
[  217.378438][ T5856]  ? swap_table_get+0x1e/0x260
[  217.378448][ T5856]  ? swap_table_get+0x1e/0x260
[  217.378458][ T5856]  ? __pfx_swapin_readahead+0x10/0x10
[  217.378470][ T5856]  ? swap_table_get+0x1e/0x260
[  217.378480][ T5856]  ? swap_table_get+0x1e/0x260
** 44 printk messages dropped **
[  217.380403][ T5880]  ? get_vma_policy+0x27b/0x3c0
[  217.380413][ T5880]  swapin_readahead+0x19a/0xc10
** 1 printk messages dropped **
[  217.380435][ T5880]  ? swap_table_get+0x1e/0x260
[  217.380446][ T5880]  ? __pfx_swapin_readahead+0x10/0x10
[  217.380457][ T5880]  ? swap_table_get+0x1e/0x260
[  217.380467][ T5880]  ? swap_table_get+0x1e/0x260
[  217.380476][ T5880]  ? swap_table_get+0x1e/0x260
[  217.380486][ T5880]  ? swap_table_get+0x216/0x260
[  217.380496][ T5880]  ? swap_cache_get_folio+0x2e7/0x2f0
[  217.380524][ T5880]  do_swap_page+0x344/0x4930
** 202 printk messages dropped **
[  217.426261][ T5880]  ? swap_table_get+0x1e/0x260
** 42 printk messages dropped **
[  217.441960][ T6134]  __kmalloc_flags_noprof+0x347/0x800
** 66 printk messages dropped **
[  217.442801][ T6134] RSP: 002b:00007fff9882b788 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
** 50 printk messages dropped **
[  217.461125][ T6127] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
** 44 printk messages dropped **
[  217.465092][ T5856]  do_user_addr_fault+0xa4d/0x1340
** 78 printk messages dropped **
[  217.467800][ T5856]  ? __pfx_swap_cluster_readahead+0x10/0x10
** 44 printk messages dropped **
[  217.471862][ T6127]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  217.471879][ T6127]  ? policy_nodemask+0x27c/0x720
[  217.471890][ T6127]  alloc_pages_mpol+0x212/0x380
[  217.471902][ T6127]  folio_alloc_mpol_noprof+0x39/0x160
[  217.471912][ T6127]  swap_cache_alloc_folio+0x2c1/0x990
[  217.471928][ T6127]  swap_cluster_readahead+0x4d9/0x640
[  217.471942][ T6127]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  217.471958][ T6127]  ? get_vma_policy+0x27b/0x3c0
** 44 printk messages dropped **
[  217.475697][ T5856]  ? policy_nodemask+0x27c/0x720
[  217.475710][ T5856]  alloc_pages_mpol+0x212/0x380
[  217.475722][ T5856]  folio_alloc_mpol_noprof+0x39/0x160
[  217.475732][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
[  217.475748][ T5856]  swap_cluster_readahead+0x4d9/0x640
[  217.475767][ T5856]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  217.475783][ T5856]  ? get_vma_policy+0x27b/0x3c0
[  217.475794][ T5856]  swapin_readahead+0x19a/0xc10
[  217.475806][ T5856]  ? swap_table_get+0x1e/0x260
[  217.475816][ T5856]  ? swap_table_get+0x1e/0x260
[  217.475827][ T5856]  ? __pfx_swapin_readahead+0x10/0x10
[  217.475838][ T5856]  ? swap_table_get+0x1e/0x260
[  217.475848][ T5856]  ? swap_table_get+0x1e/0x260
[  217.475857][ T5856]  ? swap_table_get+0x1e/0x260
[  217.475867][ T5856]  ? swap_table_get+0x216/0x260
[  217.475877][ T5856]  ? swap_cache_get_folio+0x2e7/0x2f0
** 37 printk messages dropped **
[  217.481463][ T5880]  folio_alloc_mpol_noprof+0x39/0x160
** 50 printk messages dropped **
[  217.482089][ T5880]  folio_alloc_mpol_noprof+0x39/0x160
** 50 printk messages dropped **
[  217.497692][ T5856]  folio_alloc_mpol_noprof+0x39/0x160
[  217.497705][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
[  217.497721][ T5856]  swap_cluster_readahead+0x4d9/0x640
** 49 printk messages dropped **
[  217.499178][ T6127]  swap_cache_alloc_folio+0x2c1/0x990
[  217.499193][ T6127]  swap_cluster_readahead+0x4d9/0x640
[  217.499207][ T6127]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  217.499223][ T6127]  ? get_vma_policy+0x27b/0x3c0
[  217.499233][ T6127]  swapin_readahead+0x19a/0xc10
** 44 printk messages dropped **
[  217.513979][ T5880]  ? policy_nodemask+0x27c/0x720
[  217.513990][ T5880]  alloc_pages_mpol+0x212/0x380
[  217.514002][ T5880]  folio_alloc_mpol_noprof+0x39/0x160
[  217.514013][ T5880]  swap_cache_alloc_folio+0x2c1/0x990
[  217.514028][ T5880]  swap_cluster_readahead+0x4d9/0x640
[  217.514042][ T5880]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  217.514058][ T5880]  ? get_vma_policy+0x27b/0x3c0
** 1 printk messages dropped **
[  217.514081][ T5880]  ? swap_table_get+0x1e/0x260
** 42 printk messages dropped **
[  217.515457][ T5856]  ? policy_nodemask+0x27c/0x720
[  217.515468][ T5856]  alloc_pages_mpol+0x212/0x380
[  217.515480][ T5856]  folio_alloc_mpol_noprof+0x39/0x160
[  217.515491][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
[  217.515507][ T5856]  swap_cluster_readahead+0x4d9/0x640
[  217.515521][ T5856]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  217.515537][ T5856]  ? get_vma_policy+0x27b/0x3c0
[  217.515547][ T5856]  swapin_readahead+0x19a/0xc10
[  217.515560][ T5856]  ? swap_table_get+0x1e/0x260
** 42 printk messages dropped **
[  217.529085][ T6127]  ? policy_nodemask+0x27c/0x720
** 50 printk messages dropped **
[  217.529639][ T6127]  ? policy_nodemask+0x27c/0x720
[  217.529650][ T6127]  alloc_pages_mpol+0x212/0x380
[  217.529661][ T6127]  folio_alloc_mpol_noprof+0x39/0x160
[  217.529694][ T6127]  swap_cache_alloc_folio+0x2c1/0x990
** 47 printk messages dropped **
[  217.530207][ T6127]  ? policy_nodemask+0x27c/0x720
** 52 printk messages dropped **
[  217.531661][ T5880]  swap_cache_alloc_folio+0x2c1/0x990
[  217.531705][ T5880]  swap_cluster_readahead+0x4d9/0x640
[  217.531719][ T5880]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  217.531735][ T5880]  ? get_vma_policy+0x27b/0x3c0
** 47 printk messages dropped **
[  217.532261][ T5880]  swap_cache_alloc_folio+0x2c1/0x990
[  217.532277][ T5880]  swap_cluster_readahead+0x4d9/0x640
[  217.532290][ T5880]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  217.532306][ T5880]  ? get_vma_policy+0x27b/0x3c0
[  217.532316][ T5880]  swapin_readahead+0x19a/0xc10
[  217.532328][ T5880]  ? swap_table_get+0x1e/0x260
[  217.532338][ T5880]  ? swap_table_get+0x1e/0x260
[  217.532349][ T5880]  ? __pfx_swapin_readahead+0x10/0x10
** 43 printk messages dropped **
[  217.532847][ T5880]  swap_cache_alloc_folio+0x2c1/0x990
[  217.532862][ T5880]  swap_cluster_readahead+0x4d9/0x640
[  217.532876][ T5880]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  217.532891][ T5880]  ? get_vma_policy+0x27b/0x3c0
[  217.532902][ T5880]  swapin_readahead+0x19a/0xc10
[  217.532914][ T5880]  ? swap_table_get+0x1e/0x260
[  217.532924][ T5880]  ? swap_table_get+0x1e/0x260
[  217.532934][ T5880]  ? __pfx_swapin_readahead+0x10/0x10
[  217.532946][ T5880]  ? swap_table_get+0x1e/0x260
[  217.532955][ T5880]  ? swap_table_get+0x1e/0x260
[  217.532964][ T5880]  ? swap_table_get+0x1e/0x260
[  217.532974][ T5880]  ? swap_table_get+0x216/0x260
[  217.532985][ T5880]  ? swap_cache_get_folio+0x2e7/0x2f0
[  217.532997][ T5880]  do_swap_page+0x344/0x4930
[  217.533009][ T5880]  ? __pte_offset_map+0x29/0x240
[  217.533033][ T5880]  ? __pte_offset_map+0x29/0x240
[  217.533046][ T5880]  ? __lock_acquire+0x683/0x2cf0
[  217.533054][ T5880]  ? do_swap_page+0x128/0x4930
[  217.533063][ T5880]  ? __pfx_do_swap_page+0x10/0x10
[  217.533072][ T5880]  ? __pte_offset_map+0x1ae/0x240
** 33 printk messages dropped **
[  217.536043][ T6127]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  217.536074][ T6127]  ? get_vma_policy+0x27b/0x3c0
[  217.536087][ T6127]  swapin_readahead+0x19a/0xc10
[  217.536099][ T6127]  ? swap_table_get+0x1e/0x260
** 76 printk messages dropped **
[  217.536979][ T6127] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
** 50 printk messages dropped **
[  217.537529][ T6127] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  217.537536][ T6127] RAX: fffffffffffffff4 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  217.537542][ T6127] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000200
[  217.537547][ T6127] RBP: 0000000000000200 R08: 0000000000000000 R09: 0000000000000000
[  217.537552][ T6127] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  217.537557][ T6127] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  217.537569][ T6127]  </TASK>
** 46 printk messages dropped **
[  217.538353][ T5880] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000061
** 53 printk messages dropped **
[  217.538938][ T5880] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
** 47 printk messages dropped **
[  217.539473][ T5880] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000061
** 3 printk messages dropped **
[  217.539500][ T5880]  </TASK>
** 47 printk messages dropped **
[  217.542071][ T6127] RBP: 0000000000000200 R08: 0000000000000000 R09: 0000000000000000
[  217.542077][ T6127] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  217.542082][ T6127] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  217.542094][ T6127]  </TASK>
[  217.542134][ T6127] FAULT_INJECTION: forcing a failure.
[  217.542134][ T6127] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  217.542147][ T6127] CPU: 1 UID: 0 PID: 6127 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  217.542156][ T6127] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
** 44 printk messages dropped **
[  217.542639][ T6127] RBP: 0000000000000200 R08: 0000000000000000 R09: 0000000000000000
** 52 printk messages dropped **
[  217.543225][ T6127] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
** 48 printk messages dropped **
[  217.544513][ T5880] RBP: 0000000000000061 R08: 0000000000000000 R09: 0000000000000000
[  217.544518][ T5880] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  217.544524][ T5880] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  217.544536][ T5880]  </TASK>
[  217.544547][ T5880] FAULT_INJECTION: forcing a failure.
[  217.544547][ T5880] name fail_page_alloc, interval 1, probability 100, space 0, times -1
** 19 printk messages dropped **
[  217.544818][ T5880]  ? __pfx_swapin_readahead+0x10/0x10
** 26 printk messages dropped **
[  217.545097][ T5880] RBP: 0000000000000061 R08: 0000000000000000 R09: 0000000000000000
[  217.545102][ T5880] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  217.545107][ T5880] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  217.545119][ T5880]  </TASK>
[  217.545157][ T5880] FAULT_INJECTION: forcing a failure.
[  217.545157][ T5880] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  217.545169][ T5880] CPU: 1 UID: 0 PID: 5880 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  217.545178][ T5880] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
** 44 printk messages dropped **
[  217.545692][ T5880] RBP: 0000000000000061 R08: 0000000000000000 R09: 0000000000000000
[  217.545697][ T5880] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
** 51 printk messages dropped **
[  217.548206][ T6127] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
** 48 printk messages dropped **
[  217.548770][ T6127] RBP: 0000000000000200 R08: 0000000000000000 R09: 0000000000000000
** 50 printk messages dropped **
[  217.549349][ T6127] RBP: 0000000000000200 R08: 0000000000000000 R09: 0000000000000000
[  217.549354][ T6127] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  217.549359][ T6127] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  217.549371][ T6127]  </TASK>
[  217.549629][ T5880] FAULT_INJECTION: forcing a failure.
[  217.549629][ T5880] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  217.549641][ T5880] CPU: 1 UID: 0 PID: 5880 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  217.549651][ T5880] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  217.549656][ T5880] Call Trace:
[  217.549659][ T5880]  <TASK>
[  217.549662][ T5880]  dump_stack_lvl+0xe8/0x150
[  217.549698][ T5880]  should_fail_ex+0x40c/0x560
[  217.549712][ T5880]  prepare_alloc_pages+0x230/0x650
[  217.549728][ T5880]  __alloc_frozen_pages_noprof+0x12f/0x380
[  217.549742][ T5880]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
** 4 printk messages dropped **
[  217.549807][ T5880]  swap_cluster_readahead+0x4d9/0x640
** 63 printk messages dropped **
[  217.550512][ T5880]  ? __pte_offset_map+0x29/0x240
** 50 printk messages dropped **
[  217.551132][ T5880]  ? __pte_offset_map+0x29/0x240
[  217.551142][ T5880]  ? __pte_offset_map+0x29/0x240
[  217.551155][ T5880]  ? __lock_acquire+0x683/0x2cf0
** 8 printk messages dropped **
[  217.551263][ T5880]  do_user_addr_fault+0xa4d/0x1340
** 43 printk messages dropped **
[  217.575579][ T5880]  ? __pte_offset_map+0x29/0x240
** 43 printk messages dropped **
[  217.578328][ T5856]  ? swap_table_get+0x1e/0x260
[  217.578338][ T5856]  ? swap_table_get+0x1e/0x260
[  217.578347][ T5856]  ? swap_table_get+0x1e/0x260
[  217.578357][ T5856]  ? swap_table_get+0x216/0x260
[  217.578367][ T5856]  ? swap_cache_get_folio+0x2e7/0x2f0
** 49 printk messages dropped **
[  217.579337][ T5880]  ? swap_table_get+0x216/0x260
[  217.579347][ T5880]  ? swap_cache_get_folio+0x2e7/0x2f0
[  217.579360][ T5880]  do_swap_page+0x344/0x4930
** 43 printk messages dropped **
[  217.631126][ T5880]  ? swap_table_get+0x1e/0x260
** 2 printk messages dropped **
[  217.631158][ T5880]  ? swap_table_get+0x1e/0x260
** 50 printk messages dropped **
[  217.632210][ T5856]  ? swap_table_get+0x1e/0x260
[  217.632220][ T5856]  ? swap_table_get+0x1e/0x260
** 50 printk messages dropped **
[  217.646848][ T5880]  ? swap_table_get+0x1e/0x260
[  217.646857][ T5880]  ? swap_table_get+0x1e/0x260
[  217.646867][ T5880]  ? swap_table_get+0x216/0x260
[  217.646877][ T5880]  ? swap_cache_get_folio+0x2e7/0x2f0
[  217.646889][ T5880]  do_swap_page+0x344/0x4930
[  217.646902][ T5880]  ? __pte_offset_map+0x29/0x240
[  217.646913][ T5880]  ? __pte_offset_map+0x29/0x240
** 15 printk messages dropped **
[  217.647095][ T5880] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
** 29 printk messages dropped **
[  217.654996][ T5856]  ? swap_table_get+0x1e/0x260
** 50 printk messages dropped **
[  217.665182][ T6127]  ? swap_table_get+0x1e/0x260
** 50 printk messages dropped **
[  217.676068][ T5856]  ? swap_table_get+0x1e/0x260
[  217.676078][ T5856]  ? swap_table_get+0x216/0x260
[  217.676088][ T5856]  ? swap_cache_get_folio+0x2e7/0x2f0
[  217.676101][ T5856]  do_swap_page+0x344/0x4930
** 47 printk messages dropped **
[  217.684677][ T5880]  ? swap_table_get+0x1e/0x260
[  217.684688][ T5880]  ? swap_table_get+0x216/0x260
** 49 printk messages dropped **
[  217.686392][ T5856]  ? swap_table_get+0x1e/0x260
[  217.686402][ T5856]  ? swap_table_get+0x216/0x260
[  217.686412][ T5856]  ? swap_cache_get_folio+0x2e7/0x2f0
[  217.686425][ T5856]  do_swap_page+0x344/0x4930
[  217.686437][ T5856]  ? __pte_offset_map+0x29/0x240
[  217.686448][ T5856]  ? __pte_offset_map+0x29/0x240
[  217.686460][ T5856]  ? __lock_acquire+0x683/0x2cf0
[  217.686468][ T5856]  ? do_swap_page+0x128/0x4930
** 149 printk messages dropped **
[  217.703995][ T6134] RAX: ffffffffffffffda RBX: 0000555571e8f400 RCX: 00007feeb916e49e
** 1 printk messages dropped **
[  217.704007][ T6134] RBP: 000000000000020f R08: 0000000000000000 R09: 0000000000000000
[  217.704012][ T6134] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  217.704018][ T6134] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
** 48 printk messages dropped **
[  217.717161][ T6127] RBP: 0000000000000200 R08: 0000000000000000 R09: 0000000000000000
[  217.717166][ T6127] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  217.717172][ T6127] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  217.717185][ T6127]  </TASK>
[  217.717210][ T6127] FAULT_INJECTION: forcing a failure.
[  217.717210][ T6127] name fail_page_alloc, interval 1, probability 100, space 0, times -1
** 46 printk messages dropped **
[  217.721108][ T5856] RBP: 0000000000000031 R08: 0000000000000000 R09: 0000000000000000
** 50 printk messages dropped **
[  217.723165][ T5880] RBP: 0000000000000061 R08: 0000000000000000 R09: 0000000000000000
[  217.723170][ T5880] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  217.723175][ T5880] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
** 48 printk messages dropped **
[  217.731526][ T5856] RBP: 0000000000000031 R08: 0000000000000000 R09: 0000000000000000
[  217.731532][ T5856] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  217.731537][ T5856] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  217.731549][ T5856]  </TASK>
[  217.731569][ T5856] FAULT_INJECTION: forcing a failure.
[  217.731569][ T5856] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  217.734753][ T6127] CPU: 1 UID: 0 PID: 6127 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  217.734764][ T6127] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
** 44 printk messages dropped **
[  217.735261][ T6127] RBP: 0000000000000200 R08: 0000000000000000 R09: 0000000000000000
[  217.735266][ T6127] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  217.735271][ T6127] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  217.735283][ T6127]  </TASK>
** 25 printk messages dropped **
[  217.739977][ T6127]  ? swap_table_get+0x216/0x260
** 22 printk messages dropped **
[  217.740218][ T6127] RBP: 0000000000000200 R08: 0000000000000000 R09: 0000000000000000
[  217.740224][ T6127] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  217.740229][ T6127] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  217.740241][ T6127]  </TASK>
[  217.740259][ T6127] FAULT_INJECTION: forcing a failure.
[  217.740259][ T6127] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  217.752485][ T6134]   node 0: slabs: 0, objs: 0, free: 0
[  217.759318][ T5880] CPU: 1 UID: 0 PID: 5880 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
** 71 printk messages dropped **
[  217.764403][ T5856]  ? swap_table_get+0x1e/0x260
[  217.764412][ T5856]  ? swap_table_get+0x1e/0x260
[  217.764422][ T5856]  ? swap_table_get+0x216/0x260
[  217.764432][ T5856]  ? swap_cache_get_folio+0x2e7/0x2f0
[  217.764445][ T5856]  do_swap_page+0x344/0x4930
[  217.764457][ T5856]  ? __pte_offset_map+0x29/0x240
[  217.764468][ T5856]  ? __pte_offset_map+0x29/0x240
** 44 printk messages dropped **
[  217.776556][ T5880]  ? swap_table_get+0x1e/0x260
[  217.776565][ T5880]  ? swap_table_get+0x1e/0x260
[  217.776575][ T5880]  ? swap_table_get+0x216/0x260
[  217.776586][ T5880]  ? swap_cache_get_folio+0x2e7/0x2f0
[  217.776598][ T5880]  do_swap_page+0x344/0x4930
[  217.776611][ T5880]  ? __pte_offset_map+0x29/0x240
[  217.776622][ T5880]  ? __pte_offset_map+0x29/0x240
[  217.776635][ T5880]  ? __lock_acquire+0x683/0x2cf0
[  217.776667][ T5880]  ? do_swap_page+0x128/0x4930
[  217.776678][ T5880]  ? __pfx_do_swap_page+0x10/0x10
** 44 printk messages dropped **
[  217.796991][ T5880]  ? swap_table_get+0x216/0x260
** 50 printk messages dropped **
[  217.808774][ T5856]  ? swap_table_get+0x216/0x260
[  217.808784][ T5856]  ? swap_cache_get_folio+0x2e7/0x2f0
[  217.808797][ T5856]  do_swap_page+0x344/0x4930
[  217.808810][ T5856]  ? __pte_offset_map+0x29/0x240
[  217.808821][ T5856]  ? __pte_offset_map+0x29/0x240
[  217.808834][ T5856]  ? __lock_acquire+0x683/0x2cf0
[  217.808842][ T5856]  ? do_swap_page+0x128/0x4930
[  217.808851][ T5856]  ? __pfx_do_swap_page+0x10/0x10
** 292 printk messages dropped **
[  217.876445][ T5880]  ? swap_table_get+0x1e/0x260
** 2 printk messages dropped **
[  217.876478][ T5880]  ? swap_table_get+0x1e/0x260
[  217.876488][ T5880]  ? swap_table_get+0x1e/0x260
[  217.876497][ T5880]  ? swap_table_get+0x1e/0x260
** 1 printk messages dropped **
[  217.876517][ T5880]  ? swap_cache_get_folio+0x2e7/0x2f0
[  217.876530][ T5880]  do_swap_page+0x344/0x4930
[  217.876542][ T5880]  ? __pte_offset_map+0x29/0x240
[  217.876553][ T5880]  ? __pte_offset_map+0x29/0x240
** 45 printk messages dropped **
[  217.892382][ T5856]  ? swap_table_get+0x1e/0x260
** 50 printk messages dropped **
[  217.910158][ T5880]  ? swap_table_get+0x1e/0x260
[  217.910167][ T5880]  ? swap_table_get+0x216/0x260
[  217.910178][ T5880]  ? swap_cache_get_folio+0x2e7/0x2f0
[  217.910191][ T5880]  do_swap_page+0x344/0x4930
[  217.910203][ T5880]  ? __pte_offset_map+0x29/0x240
** 44 printk messages dropped **
[  217.922333][ T5880]  ? __pfx_swapin_readahead+0x10/0x10
** 2 printk messages dropped **
[  217.922370][ T5880]  ? swap_table_get+0x1e/0x260
[  217.922380][ T5880]  ? swap_table_get+0x216/0x260
[  217.922390][ T5880]  ? swap_cache_get_folio+0x2e7/0x2f0
[  217.922403][ T5880]  do_swap_page+0x344/0x4930
** 60 printk messages dropped **
[  217.941066][ T6134]  ? __pfx_rpc_create+0x10/0x10
** 42 printk messages dropped **
[  217.941562][ T6134] RBP: 000000000000020f R08: 0000000000000000 R09: 0000000000000000
** 51 printk messages dropped **
[  217.947915][ T6127] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
** 49 printk messages dropped **
[  217.971411][ T6127] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000200
[  217.971416][ T6127] RBP: 0000000000000200 R08: 0000000000000000 R09: 0000000000000000
[  217.971421][ T6127] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  217.971427][ T6127] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  217.971439][ T6127]  </TASK>
[  217.971466][ T6127] FAULT_INJECTION: forcing a failure.
[  217.971466][ T6127] name fail_page_alloc, interval 1, probability 100, space 0, times -1
** 45 printk messages dropped **
[  217.972228][ T5856] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000031
[  217.972234][ T5856] RBP: 0000000000000031 R08: 0000000000000000 R09: 0000000000000000
[  217.972239][ T5856] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
** 48 printk messages dropped **
[  217.981000][ T6127] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000200
** 50 printk messages dropped **
[  217.982253][ T5856] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000031
[  217.982259][ T5856] RBP: 0000000000000031 R08: 0000000000000000 R09: 0000000000000000
[  217.982264][ T5856] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  217.982270][ T5856] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  217.982282][ T5856]  </TASK>
[  217.982302][ T5856] FAULT_INJECTION: forcing a failure.
[  217.982302][ T5856] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  217.991407][ T6127] CPU: 1 UID: 0 PID: 6127 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  217.991420][ T6127] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  217.991425][ T6127] Call Trace:
[  217.991429][ T6127]  <TASK>
[  217.991433][ T6127]  dump_stack_lvl+0xe8/0x150
** 40 printk messages dropped **
[  217.991960][ T6127] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000200
** 51 printk messages dropped **
[  217.999789][ T5880] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000061
[  217.999795][ T5880] RBP: 0000000000000061 R08: 0000000000000000 R09: 0000000000000000
** 50 printk messages dropped **
[  218.001313][ T5856] RBP: 0000000000000031 R08: 0000000000000000 R09: 0000000000000000
** 50 printk messages dropped **
[  218.011226][ T6127] RBP: 0000000000000200 R08: 0000000000000000 R09: 0000000000000000
** 50 printk messages dropped **
[  218.019478][ T5880] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000061
** 76 printk messages dropped **
[  218.032403][ T5880]  ? swap_table_get+0x1e/0x260
[  218.032413][ T5880]  ? swap_table_get+0x1e/0x260
[  218.032422][ T5880]  ? swap_table_get+0x1e/0x260
[  218.032432][ T5880]  ? swap_table_get+0x216/0x260
[  218.032442][ T5880]  ? swap_cache_get_folio+0x2e7/0x2f0
[  218.032454][ T5880]  do_swap_page+0x344/0x4930
[  218.032466][ T5880]  ? __pte_offset_map+0x29/0x240
[  218.032477][ T5880]  ? __pte_offset_map+0x29/0x240
[  218.032489][ T5880]  ? __lock_acquire+0x683/0x2cf0
[  218.032497][ T5880]  ? do_swap_page+0x128/0x4930
[  218.032506][ T5880]  ? __pfx_do_swap_page+0x10/0x10
[  218.032515][ T5880]  ? __pte_offset_map+0x1ae/0x240
[  218.032526][ T5880]  ? pte_offset_map_rw_nolock+0xea/0x160
[  218.032538][ T5880]  handle_mm_fault+0x124c/0x3070
[  218.032553][ T5880]  ? handle_mm_fault+0xec/0x3070
[  218.032567][ T5880]  ? __pfx_handle_mm_fault+0x10/0x10
[  218.032576][ T5880]  ? lock_vma_under_rcu+0x45a/0x500
** 34 printk messages dropped **
[  218.035338][ T6127]  ? swap_table_get+0x1e/0x260
** 50 printk messages dropped **
[  218.044232][ T5880]  ? swap_table_get+0x1e/0x260
[  218.044244][ T5880]  ? swap_table_get+0x1e/0x260
[  218.044253][ T5880]  ? swap_table_get+0x1e/0x260
[  218.044263][ T5880]  ? swap_table_get+0x216/0x260
[  218.044274][ T5880]  ? swap_cache_get_folio+0x2e7/0x2f0
[  218.044286][ T5880]  do_swap_page+0x344/0x4930
[  218.044298][ T5880]  ? __pte_offset_map+0x29/0x240
** 22 printk messages dropped **
[  218.044529][ T5880]  </TASK>
** 21 printk messages dropped **
[  218.070863][ T6127]  ? swap_table_get+0x1e/0x260
** 50 printk messages dropped **
[  218.127080][ T5880]  ? swap_table_get+0x1e/0x260
** 50 printk messages dropped **
[  218.130215][ T5856]  ? swap_table_get+0x1e/0x260
** 2 printk messages dropped **
[  218.130244][ T5856]  ? swap_table_get+0x216/0x260
** 50 printk messages dropped **
[  218.142630][ T5880]  ? swap_table_get+0x216/0x260
** 48 printk messages dropped **
[  218.170869][ T5880]  ? swap_table_get+0x1e/0x260
** 50 printk messages dropped **
[  218.171438][ T5880]  ? swap_table_get+0x1e/0x260
[  218.171448][ T5880]  ? swap_table_get+0x1e/0x260
[  218.171457][ T5880]  ? swap_table_get+0x1e/0x260
** 12 printk messages dropped **
[  218.171620][ T5880]  ? __pfx_handle_mm_fault+0x10/0x10
** 36 printk messages dropped **
[  218.172010][ T5880]  ? swap_table_get+0x1e/0x260
** 50 printk messages dropped **
[  218.172595][ T5880]  ? swap_table_get+0x1e/0x260
** 50 printk messages dropped **
[  218.173155][ T5880]  ? swap_table_get+0x1e/0x260
[  218.173164][ T5880]  ? swap_table_get+0x1e/0x260
** 26 printk messages dropped **
[  218.173431][ T5880]  </TASK>
** 23 printk messages dropped **
[  218.176715][ T5856]  ? swap_table_get+0x1e/0x260
[  218.176725][ T5856]  ? swap_table_get+0x216/0x260
[  218.176736][ T5856]  ? swap_cache_get_folio+0x2e7/0x2f0
[  218.176748][ T5856]  do_swap_page+0x344/0x4930
[  218.176761][ T5856]  ? __pte_offset_map+0x29/0x240
[  218.176772][ T5856]  ? __pte_offset_map+0x29/0x240
[  218.176785][ T5856]  ? __lock_acquire+0x683/0x2cf0
[  218.176792][ T5856]  ? do_swap_page+0x128/0x4930
[  218.176802][ T5856]  ? __pfx_do_swap_page+0x10/0x10
** 42 printk messages dropped **
[  218.178077][ T5880]  ? swap_table_get+0x1e/0x260
** 50 printk messages dropped **
[  218.181566][ T5856]  ? swap_table_get+0x1e/0x260
[  218.181575][ T5856]  ? swap_table_get+0x216/0x260
[  218.181586][ T5856]  ? swap_cache_get_folio+0x2e7/0x2f0
[  218.181615][ T5856]  do_swap_page+0x344/0x4930
** 48 printk messages dropped **
[  218.184374][ T6134]  ? rpc_task_get_xprt+0x26/0x250
** 54 printk messages dropped **
[  218.185039][ T6134] RBP: 000000000000020f R08: 0000000000000000 R09: 0000000000000000
** 51 printk messages dropped **
[  218.186963][ T5856] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  218.186968][ T5856] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  218.186981][ T5856]  </TASK>
[  218.186999][ T5856] FAULT_INJECTION: forcing a failure.
[  218.186999][ T5856] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  218.199882][ T6134]   cache: rpc_buffers, object size: 2048, buffer size: 2176, default order: 3, min order: 0
** 21 printk messages dropped **
[  218.201841][ T5856]  ? swap_table_get+0x1e/0x260
** 23 printk messages dropped **
[  218.202097][ T5856] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000031
** 51 printk messages dropped **
[  218.227470][ T6127] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000200
** 5 printk messages dropped **
[  218.229116][ T5880] CPU: 1 UID: 0 PID: 5880 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
** 44 printk messages dropped **
[  218.229651][ T5880] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000061
[  218.229656][ T5880] RBP: 0000000000000061 R08: 0000000000000000 R09: 0000000000000000
[  218.229662][ T5880] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  218.229668][ T5880] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  218.229680][ T5880]  </TASK>
[  218.229704][ T5880] FAULT_INJECTION: forcing a failure.
[  218.229704][ T5880] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  218.231117][ T6127] CPU: 0 UID: 0 PID: 6127 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  218.231128][ T6127] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  218.231133][ T6127] Call Trace:
[  218.231137][ T6127]  <TASK>
[  218.231141][ T6127]  dump_stack_lvl+0xe8/0x150
[  218.231156][ T6127]  should_fail_ex+0x40c/0x560
[  218.231171][ T6127]  prepare_alloc_pages+0x230/0x650
[  218.231192][ T6127]  __alloc_frozen_pages_noprof+0x12f/0x380
[  218.231207][ T6127]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
** 37 printk messages dropped **
[  218.231648][ T6127] RBP: 0000000000000200 R08: 0000000000000000 R09: 0000000000000000
[  218.231653][ T6127] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  218.231659][ T6127] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
** 48 printk messages dropped **
[  218.238206][ T5856] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000031
** 50 printk messages dropped **
[  218.248102][ T5880] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000061
** 74 printk messages dropped **
[  218.277306][ T5880]  ? swap_table_get+0x1e/0x260
[  218.277316][ T5880]  ? __pfx_swapin_readahead+0x10/0x10
** 46 printk messages dropped **
[  218.277995][ T5856]  ? get_vma_policy+0x27b/0x3c0
** 2 printk messages dropped **
[  218.278027][ T5856]  ? swap_table_get+0x1e/0x260
** 50 printk messages dropped **
[  218.286355][ T5880]  ? swap_table_get+0x1e/0x260
** 50 printk messages dropped **
[  218.288667][ T5856]  ? swap_table_get+0x1e/0x260
** 50 printk messages dropped **
[  218.296387][ T5880]  ? swap_table_get+0x1e/0x260
[  218.296397][ T5880]  ? __pfx_swapin_readahead+0x10/0x10
[  218.296409][ T5880]  ? swap_table_get+0x1e/0x260
[  218.296419][ T5880]  ? swap_table_get+0x1e/0x260
[  218.296428][ T5880]  ? swap_table_get+0x1e/0x260
[  218.296438][ T5880]  ? swap_table_get+0x216/0x260
[  218.296448][ T5880]  ? swap_cache_get_folio+0x2e7/0x2f0
[  218.296461][ T5880]  do_swap_page+0x344/0x4930
[  218.296473][ T5880]  ? __pte_offset_map+0x29/0x240
** 42 printk messages dropped **
[  218.310806][ T6127]  ? swap_table_get+0x1e/0x260
[  218.310816][ T6127]  ? __pfx_swapin_readahead+0x10/0x10
[  218.310828][ T6127]  ? swap_table_get+0x1e/0x260
[  218.310837][ T6127]  ? swap_table_get+0x1e/0x260
** 45 printk messages dropped **
[  218.341338][ T5856]  ? get_vma_policy+0x27b/0x3c0
** 51 printk messages dropped **
[  218.348609][ T6134]  ? rpc_malloc+0xeb/0x260
** 61 printk messages dropped **
[  218.349349][ T6134] RBP: 000000000000020f R08: 0000000000000000 R09: 0000000000000000
** 47 printk messages dropped **
[  218.351186][ T5856] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  218.351194][ T5856] RAX: fffffffffffffff4 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  218.351201][ T5856] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000031
[  218.351207][ T5856] RBP: 0000000000000031 R08: 0000000000000000 R09: 0000000000000000
[  218.351212][ T5856] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  218.351217][ T5856] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  218.351229][ T5856]  </TASK>
[  218.351292][ T5856] FAULT_INJECTION: forcing a failure.
[  218.351292][ T5856] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  218.365888][ T6134]   cache: rpc_buffers, object size: 2048, buffer size: 2176, default order: 3, min order: 0
** 43 printk messages dropped **
[  218.367973][ T5856] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
** 50 printk messages dropped **
[  218.369178][ T5880] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
** 50 printk messages dropped **
[  218.372218][ T5856] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
** 132 printk messages dropped **
[  218.399711][ T5880]  ? swap_table_get+0x1e/0x260
** 40 printk messages dropped **
[  218.402669][ T6127]  folio_alloc_mpol_noprof+0x39/0x160
[  218.402681][ T6127]  swap_cache_alloc_folio+0x2c1/0x990
[  218.402697][ T6127]  swap_cluster_readahead+0x4d9/0x640
[  218.402711][ T6127]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  218.402727][ T6127]  ? get_vma_policy+0x27b/0x3c0
[  218.402737][ T6127]  swapin_readahead+0x19a/0xc10
[  218.402749][ T6127]  ? swap_table_get+0x1e/0x260
[  218.402760][ T6127]  ? swap_table_get+0x1e/0x260
** 43 printk messages dropped **
[  218.418442][ T5880]  folio_alloc_mpol_noprof+0x39/0x160
** 50 printk messages dropped **
[  218.438292][ T5856]  folio_alloc_mpol_noprof+0x39/0x160
** 50 printk messages dropped **
[  218.445264][ T5880]  folio_alloc_mpol_noprof+0x39/0x160
[  218.445274][ T5880]  swap_cache_alloc_folio+0x2c1/0x990
[  218.445291][ T5880]  swap_cluster_readahead+0x4d9/0x640
[  218.445304][ T5880]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  218.445320][ T5880]  ? get_vma_policy+0x27b/0x3c0
** 46 printk messages dropped **
[  218.445852][ T5880]  folio_alloc_mpol_noprof+0x39/0x160
** 50 printk messages dropped **
[  218.450787][ T6127]  folio_alloc_mpol_noprof+0x39/0x160
** 36 printk messages dropped **
[  218.451191][ T6127] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
** 12 printk messages dropped **
[  218.481269][ T6134]  ? policy_nodemask+0x27c/0x720
** 61 printk messages dropped **
[  218.482065][ T6134]  ? trace_irq_disable+0x3b/0x140
** 50 printk messages dropped **
[  218.485315][ T5856]  ? trace_page_fault_user+0x84/0x1e0
[  218.485324][ T5856]  exc_page_fault+0x6a/0xc0
[  218.485337][ T5856]  asm_exc_page_fault+0x26/0x30
[  218.485345][ T5856] RIP: 0033:0x7feeb916e49e
[  218.485354][ T5856] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  218.485362][ T5856] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
** 45 printk messages dropped **
[  218.492288][ T5880]  ? trace_page_fault_user+0x84/0x1e0
[  218.492297][ T5880]  exc_page_fault+0x6a/0xc0
[  218.492309][ T5880]  asm_exc_page_fault+0x26/0x30
[  218.492318][ T5880] RIP: 0033:0x7feeb916e49e
** 49 printk messages dropped **
[  218.494783][ T5856]  asm_exc_page_fault+0x26/0x30
** 119 printk messages dropped **
[  218.513212][ T6127]  prepare_alloc_pages+0x230/0x650
** 50 printk messages dropped **
[  218.517824][ T5856]  should_fail_ex+0x40c/0x560
** 49 printk messages dropped **
[  218.530615][ T6127]  <TASK>
** 50 printk messages dropped **
[  218.533554][ T5880]  <TASK>
** 50 printk messages dropped **
[  218.537405][ T5856]  <TASK>
** 17 printk messages dropped **
[  218.537654][ T5856]  ? swap_table_get+0x1e/0x260
** 32 printk messages dropped **
[  218.544367][ T5880]  <TASK>
[  218.544371][ T5880]  dump_stack_lvl+0xe8/0x150
[  218.544386][ T5880]  should_fail_ex+0x40c/0x560
[  218.544401][ T5880]  prepare_alloc_pages+0x230/0x650
[  218.544417][ T5880]  __alloc_frozen_pages_noprof+0x12f/0x380
[  218.544432][ T5880]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  218.544448][ T5880]  ? policy_nodemask+0x27c/0x720
[  218.544460][ T5880]  alloc_pages_mpol+0x212/0x380
[  218.544471][ T5880]  folio_alloc_mpol_noprof+0x39/0x160
[  218.544482][ T5880]  swap_cache_alloc_folio+0x2c1/0x990
[  218.544518][ T5880]  swap_cluster_readahead+0x4d9/0x640
[  218.544532][ T5880]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  218.544549][ T5880]  ? get_vma_policy+0x27b/0x3c0
[  218.544559][ T5880]  swapin_readahead+0x19a/0xc10
[  218.544596][ T5880]  ? swap_table_get+0x1e/0x260
[  218.544607][ T5880]  ? swap_table_get+0x1e/0x260
[  218.544618][ T5880]  ? __pfx_swapin_readahead+0x10/0x10
[  218.544629][ T5880]  ? swap_table_get+0x1e/0x260
[  218.544638][ T5880]  ? swap_table_get+0x1e/0x260
[  218.544647][ T5880]  ? swap_table_get+0x1e/0x260
[  218.544657][ T5880]  ? swap_table_get+0x216/0x260
[  218.544668][ T5880]  ? swap_cache_get_folio+0x2e7/0x2f0
[  218.544680][ T5880]  do_swap_page+0x344/0x4930
[  218.544692][ T5880]  ? __pte_offset_map+0x29/0x240
[  218.544703][ T5880]  ? __pte_offset_map+0x29/0x240
[  218.544715][ T5880]  ? __lock_acquire+0x683/0x2cf0
[  218.544723][ T5880]  ? do_swap_page+0x128/0x4930
[  218.544733][ T5880]  ? __pfx_do_swap_page+0x10/0x10
[  218.544741][ T5880]  ? __pte_offset_map+0x1ae/0x240
[  218.544753][ T5880]  ? pte_offset_map_rw_nolock+0xea/0x160
[  218.544764][ T5880]  handle_mm_fault+0x124c/0x3070
[  218.544780][ T5880]  ? handle_mm_fault+0xec/0x3070
** 22 printk messages dropped **
[  218.547854][ T6127]  prepare_alloc_pages+0x230/0x650
** 80 printk messages dropped **
[  218.572158][ T5880]  ? lock_vma_under_rcu+0x45a/0x500
** 57 printk messages dropped **
[  218.572864][ T5880] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
** 43 printk messages dropped **
[  218.573344][ T5880]  ? lock_vma_under_rcu+0x45a/0x500
[  218.573364][ T5880]  do_user_addr_fault+0xa4d/0x1340
[  218.573376][ T5880]  ? trace_page_fault_user+0x84/0x1e0
[  218.573386][ T5880]  exc_page_fault+0x6a/0xc0
[  218.573396][ T5880]  asm_exc_page_fault+0x26/0x30
[  218.573404][ T5880] RIP: 0033:0x7feeb916e49e
[  218.573411][ T5880] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
** 44 printk messages dropped **
[  218.584515][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
** 50 printk messages dropped **
[  218.596725][ T5880]  ? lock_vma_under_rcu+0x45a/0x500
[  218.596747][ T5880]  do_user_addr_fault+0xa4d/0x1340
[  218.596760][ T5880]  ? trace_page_fault_user+0x84/0x1e0
[  218.596769][ T5880]  exc_page_fault+0x6a/0xc0
[  218.596781][ T5880]  asm_exc_page_fault+0x26/0x30
[  218.596790][ T5880] RIP: 0033:0x7feeb916e49e
[  218.596799][ T5880] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  218.596807][ T5880] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
** 43 printk messages dropped **
[  218.599041][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
** 50 printk messages dropped **
[  218.608421][ T5880]  ? lock_vma_under_rcu+0x45a/0x500
** 50 printk messages dropped **
[  218.626174][ T6127]  ? lock_vma_under_rcu+0x45a/0x500
[  218.626195][ T6127]  do_user_addr_fault+0xa4d/0x1340
[  218.626208][ T6127]  ? trace_page_fault_user+0x84/0x1e0
[  218.626217][ T6127]  exc_page_fault+0x6a/0xc0
[  218.626230][ T6127]  asm_exc_page_fault+0x26/0x30
[  218.626239][ T6127] RIP: 0033:0x7feeb916e49e
[  218.626248][ T6127] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
** 42 printk messages dropped **
[  218.637905][ T5856]  handle_mm_fault+0x124c/0x3070
[  218.637921][ T5856]  ? handle_mm_fault+0xec/0x3070
[  218.637935][ T5856]  ? __pfx_handle_mm_fault+0x10/0x10
[  218.637944][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
[  218.637966][ T5856]  do_user_addr_fault+0xa4d/0x1340
[  218.637979][ T5856]  ? trace_page_fault_user+0x84/0x1e0
** 7 printk messages dropped **
[  218.638046][ T5856] RBP: 0000000000000031 R08: 0000000000000000 R09: 0000000000000000
** 40 printk messages dropped **
[  218.676094][ T6134]  ? __pfx_rpc_create+0x10/0x10
[  218.676121][ T6134]  ? __lock_acquire+0x683/0x2cf0
[  218.676135][ T6134]  rpcb_create_af_local+0x1c7/0x3c0
[  218.676144][ T6134]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  218.676162][ T6134]  ? do_raw_spin_unlock+0xf5/0x210
[  218.676175][ T6134]  rpcb_create_local+0x28f/0x670
[  218.676185][ T6134]  ? __pfx_rpcb_create_local+0x10/0x10
** 74 printk messages dropped **
[  218.689181][ T6127]  handle_mm_fault+0x124c/0x3070
[  218.689196][ T6127]  ? handle_mm_fault+0xec/0x3070
[  218.689210][ T6127]  ? __pfx_handle_mm_fault+0x10/0x10
[  218.689219][ T6127]  ? lock_vma_under_rcu+0x45a/0x500
[  218.689241][ T6127]  do_user_addr_fault+0xa4d/0x1340
[  218.689254][ T6127]  ? trace_page_fault_user+0x84/0x1e0
[  218.689263][ T6127]  exc_page_fault+0x6a/0xc0
[  218.689276][ T6127]  asm_exc_page_fault+0x26/0x30
[  218.689285][ T6127] RIP: 0033:0x7feeb916e49e
** 41 printk messages dropped **
[  218.704445][ T5856]  ? __pte_offset_map+0x1ae/0x240
** 50 printk messages dropped **
[  218.707328][ T5880]  ? __pte_offset_map+0x1ae/0x240
** 50 printk messages dropped **
[  218.722255][ T5856]  ? __pte_offset_map+0x1ae/0x240
** 50 printk messages dropped **
[  218.722851][ T5856]  ? __pte_offset_map+0x1ae/0x240
** 50 printk messages dropped **
[  218.723387][ T5856]  ? __pte_offset_map+0x1ae/0x240
[  218.723399][ T5856]  ? pte_offset_map_rw_nolock+0xea/0x160
[  218.723410][ T5856]  handle_mm_fault+0x124c/0x3070
[  218.723426][ T5856]  ? handle_mm_fault+0xec/0x3070
[  218.723439][ T5856]  ? __pfx_handle_mm_fault+0x10/0x10
[  218.723448][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
[  218.723482][ T5856]  do_user_addr_fault+0xa4d/0x1340
** 45 printk messages dropped **
[  218.724008][ T6127]  handle_mm_fault+0x124c/0x3070
** 50 printk messages dropped **
[  218.724568][ T6127]  handle_mm_fault+0x124c/0x3070
** 50 printk messages dropped **
[  218.725109][ T6127]  handle_mm_fault+0x124c/0x3070
[  218.725124][ T6127]  ? handle_mm_fault+0xec/0x3070
[  218.725137][ T6127]  ? __pfx_handle_mm_fault+0x10/0x10
[  218.725147][ T6127]  ? lock_vma_under_rcu+0x45a/0x500
[  218.725168][ T6127]  do_user_addr_fault+0xa4d/0x1340
[  218.725179][ T6127]  ? trace_page_fault_user+0x84/0x1e0
[  218.725189][ T6127]  exc_page_fault+0x6a/0xc0
[  218.725199][ T6127]  asm_exc_page_fault+0x26/0x30
[  218.725207][ T6127] RIP: 0033:0x7feeb916e49e
[  218.725227][ T6127] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  218.725235][ T6127] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  218.725242][ T6127] RAX: fffffffffffffff4 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  218.725247][ T6127] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000200
[  218.725253][ T6127] RBP: 0000000000000200 R08: 0000000000000000 R09: 0000000000000000
[  218.725258][ T6127] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  218.725263][ T6127] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  218.725275][ T6127]  </TASK>
[  218.726943][ T5856] FAULT_INJECTION: forcing a failure.
[  218.726943][ T5856] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  218.728822][ T6134]   node 0: slabs: 0, objs: 0, free: 0
** 30 printk messages dropped **
[  218.740402][ T5856]  ? __lock_acquire+0x683/0x2cf0
** 2 printk messages dropped **
[  218.740428][ T5856]  ? __pte_offset_map+0x1ae/0x240
[  218.740440][ T5856]  ? pte_offset_map_rw_nolock+0xea/0x160
** 4 printk messages dropped **
[  218.740526][ T5856]  do_user_addr_fault+0xa4d/0x1340
** 45 printk messages dropped **
[  218.741128][ T6127]  handle_mm_fault+0x124c/0x3070
[  218.741144][ T6127]  ? handle_mm_fault+0xec/0x3070
[  218.741158][ T6127]  ? __pfx_handle_mm_fault+0x10/0x10
[  218.741167][ T6127]  ? lock_vma_under_rcu+0x45a/0x500
[  218.741188][ T6127]  do_user_addr_fault+0xa4d/0x1340
[  218.741200][ T6127]  ? trace_page_fault_user+0x84/0x1e0
[  218.741210][ T6127]  exc_page_fault+0x6a/0xc0
[  218.741220][ T6127]  asm_exc_page_fault+0x26/0x30
[  218.741228][ T6127] RIP: 0033:0x7feeb916e49e
[  218.741236][ T6127] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  218.741243][ T6127] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  218.741250][ T6127] RAX: fffffffffffffff4 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
** 39 printk messages dropped **
[  218.751022][ T5880]  handle_mm_fault+0x124c/0x3070
[  218.751038][ T5880]  ? handle_mm_fault+0xec/0x3070
[  218.751057][ T5880]  ? __pfx_handle_mm_fault+0x10/0x10
[  218.751067][ T5880]  ? lock_vma_under_rcu+0x45a/0x500
** 120 printk messages dropped **
[  218.764439][ T6127]  <TASK>
** 48 printk messages dropped **
[  218.768371][ T5880] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  218.768376][ T5880] Call Trace:
[  218.768379][ T5880]  <TASK>
[  218.768383][ T5880]  dump_stack_lvl+0xe8/0x150
[  218.768398][ T5880]  should_fail_ex+0x40c/0x560
[  218.768413][ T5880]  prepare_alloc_pages+0x230/0x650
[  218.768429][ T5880]  __alloc_frozen_pages_noprof+0x12f/0x380
[  218.768444][ T5880]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  218.768460][ T5880]  ? policy_nodemask+0x27c/0x720
[  218.768472][ T5880]  alloc_pages_mpol+0x212/0x380
[  218.768483][ T5880]  folio_alloc_mpol_noprof+0x39/0x160
[  218.768493][ T5880]  swap_cache_alloc_folio+0x2c1/0x990
[  218.768509][ T5880]  swap_cluster_readahead+0x4d9/0x640
[  218.768523][ T5880]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  218.768579][ T5880]  ? get_vma_policy+0x27b/0x3c0
[  218.768591][ T5880]  swapin_readahead+0x19a/0xc10
[  218.768603][ T5880]  ? swap_table_get+0x1e/0x260
[  218.768614][ T5880]  ? swap_table_get+0x1e/0x260
[  218.768624][ T5880]  ? __pfx_swapin_readahead+0x10/0x10
[  218.768636][ T5880]  ? swap_table_get+0x1e/0x260
[  218.768645][ T5880]  ? swap_table_get+0x1e/0x260
[  218.768654][ T5880]  ? swap_table_get+0x1e/0x260
** 29 printk messages dropped **
[  218.783211][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  218.783216][ T5856] Call Trace:
[  218.783219][ T5856]  <TASK>
** 48 printk messages dropped **
[  218.791689][ T5880] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  218.791695][ T5880] Call Trace:
[  218.791700][ T5880]  <TASK>
[  218.791704][ T5880]  dump_stack_lvl+0xe8/0x150
[  218.791719][ T5880]  should_fail_ex+0x40c/0x560
[  218.791734][ T5880]  prepare_alloc_pages+0x230/0x650
[  218.791751][ T5880]  __alloc_frozen_pages_noprof+0x12f/0x380
[  218.791765][ T5880]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
** 7 printk messages dropped **
[  218.791871][ T5880]  swapin_readahead+0x19a/0xc10
** 35 printk messages dropped **
[  218.795734][ T6127] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
** 50 printk messages dropped **
[  218.820932][ T5880] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  218.820938][ T5880] Call Trace:
[  218.820941][ T5880]  <TASK>
[  218.820945][ T5880]  dump_stack_lvl+0xe8/0x150
[  218.820963][ T5880]  should_fail_ex+0x40c/0x560
[  218.820979][ T5880]  prepare_alloc_pages+0x230/0x650
[  218.820995][ T5880]  __alloc_frozen_pages_noprof+0x12f/0x380
[  218.821010][ T5880]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
** 43 printk messages dropped **
[  218.822674][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  218.822680][ T5856] Call Trace:
[  218.822683][ T5856]  <TASK>
[  218.822687][ T5856]  dump_stack_lvl+0xe8/0x150
[  218.822703][ T5856]  should_fail_ex+0x40c/0x560
[  218.822719][ T5856]  prepare_alloc_pages+0x230/0x650
[  218.822735][ T5856]  __alloc_frozen_pages_noprof+0x12f/0x380
[  218.822750][ T5856]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  218.822767][ T5856]  ? policy_nodemask+0x27c/0x720
[  218.822778][ T5856]  alloc_pages_mpol+0x212/0x380
[  218.822790][ T5856]  folio_alloc_mpol_noprof+0x39/0x160
[  218.822800][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
[  218.822817][ T5856]  swap_cluster_readahead+0x4d9/0x640
** 38 printk messages dropped **
[  218.828959][ T5856] CPU: 0 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  218.828971][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
** 50 printk messages dropped **
[  218.831403][ T5880] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  218.831409][ T5880] Call Trace:
[  218.831412][ T5880]  <TASK>
[  218.831416][ T5880]  dump_stack_lvl+0xe8/0x150
[  218.831430][ T5880]  should_fail_ex+0x40c/0x560
[  218.831445][ T5880]  prepare_alloc_pages+0x230/0x650
[  218.831461][ T5880]  __alloc_frozen_pages_noprof+0x12f/0x380
** 44 printk messages dropped **
[  218.834714][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
** 50 printk messages dropped **
[  218.838676][ T6134] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  218.838681][ T6134] Call Trace:
[  218.838685][ T6134]  <TASK>
[  218.838689][ T6134]  dump_stack_lvl+0xe8/0x150
[  218.838703][ T6134]  should_fail_ex+0x40c/0x560
[  218.838719][ T6134]  prepare_alloc_pages+0x230/0x650
[  218.838735][ T6134]  __alloc_frozen_pages_noprof+0x12f/0x380
[  218.838750][ T6134]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
** 53 printk messages dropped **
[  218.839441][ T6134]  vfs_write+0x296/0xba0
** 122 printk messages dropped **
[  218.880601][ T6127] CPU: 0 UID: 0 PID: 6127 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  218.880620][ T6127] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  218.880626][ T6127] Call Trace:
[  218.880630][ T6127]  <TASK>
** 36 printk messages dropped **
[  218.881076][ T6127]  asm_exc_page_fault+0x26/0x30
** 10 printk messages dropped **
[  218.883118][ T5880] CPU: 1 UID: 0 PID: 5880 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  218.883131][ T5880] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  218.883136][ T5880] Call Trace:
[  218.883140][ T5880]  <TASK>
[  218.883143][ T5880]  dump_stack_lvl+0xe8/0x150
[  218.883158][ T5880]  should_fail_ex+0x40c/0x560
[  218.883172][ T5880]  prepare_alloc_pages+0x230/0x650
[  218.883189][ T5880]  __alloc_frozen_pages_noprof+0x12f/0x380
[  218.883204][ T5880]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  218.883220][ T5880]  ? policy_nodemask+0x27c/0x720
[  218.883231][ T5880]  alloc_pages_mpol+0x212/0x380
[  218.883243][ T5880]  folio_alloc_mpol_noprof+0x39/0x160
[  218.883253][ T5880]  swap_cache_alloc_folio+0x2c1/0x990
[  218.883269][ T5880]  swap_cluster_readahead+0x4d9/0x640
[  218.883283][ T5880]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  218.883299][ T5880]  ? get_vma_policy+0x27b/0x3c0
** 35 printk messages dropped **
[  218.885374][ T5856] CPU: 0 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  218.885385][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  218.885390][ T5856] Call Trace:
[  218.885394][ T5856]  <TASK>
[  218.885398][ T5856]  dump_stack_lvl+0xe8/0x150
[  218.885412][ T5856]  should_fail_ex+0x40c/0x560
[  218.885426][ T5856]  prepare_alloc_pages+0x230/0x650
[  218.885442][ T5856]  __alloc_frozen_pages_noprof+0x12f/0x380
[  218.885457][ T5856]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  218.885473][ T5856]  ? policy_nodemask+0x27c/0x720
[  218.885485][ T5856]  alloc_pages_mpol+0x212/0x380
[  218.885496][ T5856]  folio_alloc_mpol_noprof+0x39/0x160
[  218.885506][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
[  218.885522][ T5856]  swap_cluster_readahead+0x4d9/0x640
[  218.885561][ T5856]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  218.885577][ T5856]  ? get_vma_policy+0x27b/0x3c0
[  218.885587][ T5856]  swapin_readahead+0x19a/0xc10
[  218.885600][ T5856]  ? swap_table_get+0x1e/0x260
[  218.885615][ T5856]  ? swap_table_get+0x1e/0x260
[  218.885626][ T5856]  ? __pfx_swapin_readahead+0x10/0x10
** 233 printk messages dropped **
[  218.902774][ T6127] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  218.902779][ T6127] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  218.902791][ T6127]  </TASK>
[  218.902836][ T6127] FAULT_INJECTION: forcing a failure.
[  218.902836][ T6127] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  218.904986][ T5880] CPU: 1 UID: 0 PID: 5880 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  218.904998][ T5880] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  218.905003][ T5880] Call Trace:
** 48 printk messages dropped **
[  218.907779][ T5856] CPU: 0 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
** 76 printk messages dropped **
[  218.913423][ T5856]  do_swap_page+0x344/0x4930
[  218.913435][ T5856]  ? __pte_offset_map+0x29/0x240
[  218.913445][ T5856]  ? __pte_offset_map+0x29/0x240
[  218.913458][ T5856]  ? __lock_acquire+0x683/0x2cf0
[  218.913465][ T5856]  ? do_swap_page+0x128/0x4930
[  218.913475][ T5856]  ? __pfx_do_swap_page+0x10/0x10
** 45 printk messages dropped **
[  218.929044][ T5880]  do_swap_page+0x344/0x4930
[  218.929056][ T5880]  ? __pte_offset_map+0x29/0x240
[  218.929067][ T5880]  ? __pte_offset_map+0x29/0x240
[  218.929079][ T5880]  ? __lock_acquire+0x683/0x2cf0
[  218.929087][ T5880]  ? do_swap_page+0x128/0x4930
[  218.929096][ T5880]  ? __pfx_do_swap_page+0x10/0x10
[  218.929105][ T5880]  ? __pte_offset_map+0x1ae/0x240
[  218.929117][ T5880]  ? pte_offset_map_rw_nolock+0xea/0x160
[  218.929128][ T5880]  handle_mm_fault+0x124c/0x3070
[  218.929144][ T5880]  ? handle_mm_fault+0xec/0x3070
[  218.929157][ T5880]  ? __pfx_handle_mm_fault+0x10/0x10
[  218.929166][ T5880]  ? lock_vma_under_rcu+0x45a/0x500
[  218.929188][ T5880]  do_user_addr_fault+0xa4d/0x1340
[  218.929200][ T5880]  ? trace_page_fault_user+0x84/0x1e0
[  218.929209][ T5880]  exc_page_fault+0x6a/0xc0
[  218.929221][ T5880]  asm_exc_page_fault+0x26/0x30
[  218.929229][ T5880] RIP: 0033:0x7feeb916e49e
[  218.929238][ T5880] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
** 33 printk messages dropped **
[  218.930868][ T6127]  do_swap_page+0x344/0x4930
[  218.930880][ T6127]  ? __pte_offset_map+0x29/0x240
[  218.930891][ T6127]  ? __pte_offset_map+0x29/0x240
[  218.930903][ T6127]  ? __lock_acquire+0x683/0x2cf0
[  218.930911][ T6127]  ? do_swap_page+0x128/0x4930
[  218.930920][ T6127]  ? __pfx_do_swap_page+0x10/0x10
[  218.930929][ T6127]  ? __pte_offset_map+0x1ae/0x240
[  218.930940][ T6127]  ? pte_offset_map_rw_nolock+0xea/0x160
[  218.930952][ T6127]  handle_mm_fault+0x124c/0x3070
[  218.930967][ T6127]  ? handle_mm_fault+0xec/0x3070
[  218.930981][ T6127]  ? __pfx_handle_mm_fault+0x10/0x10
** 43 printk messages dropped **
[  218.939342][ T5880]  ? __lock_acquire+0x683/0x2cf0
[  218.939350][ T5880]  ? do_swap_page+0x128/0x4930
[  218.939359][ T5880]  ? __pfx_do_swap_page+0x10/0x10
[  218.939368][ T5880]  ? __pte_offset_map+0x1ae/0x240
[  218.939380][ T5880]  ? pte_offset_map_rw_nolock+0xea/0x160
[  218.939391][ T5880]  handle_mm_fault+0x124c/0x3070
[  218.939407][ T5880]  ? handle_mm_fault+0xec/0x3070
** 82 printk messages dropped **
[  218.942967][ T5880]  ? get_vma_policy+0x27b/0x3c0
** 34 printk messages dropped **
[  218.943335][ T5880] FAULT_INJECTION: forcing a failure.
[  218.943335][ T5880] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  218.959430][ T6127] CPU: 0 UID: 0 PID: 6127 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  218.959443][ T6127] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
** 48 printk messages dropped **
[  218.960073][ T6127] FAULT_INJECTION: forcing a failure.
[  218.960073][ T6127] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  218.962871][ T5880] CPU: 1 UID: 0 PID: 5880 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  218.962884][ T5880] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  218.962890][ T5880] Call Trace:
[  218.962894][ T5880]  <TASK>
[  218.962897][ T5880]  dump_stack_lvl+0xe8/0x150
[  218.962913][ T5880]  should_fail_ex+0x40c/0x560
[  218.962928][ T5880]  prepare_alloc_pages+0x230/0x650
[  218.962944][ T5880]  __alloc_frozen_pages_noprof+0x12f/0x380
[  218.962959][ T5880]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  218.962976][ T5880]  ? policy_nodemask+0x27c/0x720
[  218.962987][ T5880]  alloc_pages_mpol+0x212/0x380
[  218.962998][ T5880]  folio_alloc_mpol_noprof+0x39/0x160
[  218.963009][ T5880]  swap_cache_alloc_folio+0x2c1/0x990
[  218.963025][ T5880]  swap_cluster_readahead+0x4d9/0x640
[  218.963038][ T5880]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  218.963054][ T5880]  ? get_vma_policy+0x27b/0x3c0
[  218.963064][ T5880]  swapin_readahead+0x19a/0xc10
[  218.963077][ T5880]  ? swap_table_get+0x1e/0x260
[  218.963087][ T5880]  ? swap_table_get+0x1e/0x260
[  218.963097][ T5880]  ? __pfx_swapin_readahead+0x10/0x10
** 23 printk messages dropped **
[  218.963363][ T5880] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
** 8 printk messages dropped **
[  218.969066][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
** 49 printk messages dropped **
[  219.000719][ T6134] FAULT_INJECTION: forcing a failure.
[  219.000719][ T6134] name fail_page_alloc, interval 1, probability 100, space 0, times -1
** 49 printk messages dropped **
[  219.003302][ T6127]  </TASK>
** 50 printk messages dropped **
[  219.011183][ T5880]  </TASK>
** 1 printk messages dropped **
[  219.012840][ T6127] CPU: 0 UID: 0 PID: 6127 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
** 51 printk messages dropped **
[  219.016029][ T6134] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
** 79 printk messages dropped **
[  219.016992][ T6134]  </TASK>
** 55 printk messages dropped **
[  219.025708][ T6127]  dump_stack_lvl+0xe8/0x150
** 46 printk messages dropped **
[  219.029450][ T5880] CPU: 1 UID: 0 PID: 5880 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  219.029462][ T5880] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  219.029467][ T5880] Call Trace:
[  219.029472][ T5880]  <TASK>
[  219.029475][ T5880]  dump_stack_lvl+0xe8/0x150
[  219.029489][ T5880]  should_fail_ex+0x40c/0x560
[  219.029504][ T5880]  prepare_alloc_pages+0x230/0x650
[  219.029550][ T5880]  __alloc_frozen_pages_noprof+0x12f/0x380
[  219.029565][ T5880]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  219.029581][ T5880]  ? policy_nodemask+0x27c/0x720
[  219.029592][ T5880]  alloc_pages_mpol+0x212/0x380
[  219.029604][ T5880]  folio_alloc_mpol_noprof+0x39/0x160
[  219.029614][ T5880]  swap_cache_alloc_folio+0x2c1/0x990
[  219.029630][ T5880]  swap_cluster_readahead+0x4d9/0x640
** 17 printk messages dropped **
[  219.029826][ T5880]  ? __pte_offset_map+0x1ae/0x240
** 19 printk messages dropped **
[  219.030041][ T5880] CPU: 1 UID: 0 PID: 5880 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  219.030050][ T5880] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  219.030055][ T5880] Call Trace:
[  219.030058][ T5880]  <TASK>
** 47 printk messages dropped **
[  219.045871][ T6127] CPU: 0 UID: 0 PID: 6127 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  219.045884][ T6127] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  219.045889][ T6127] Call Trace:
[  219.045893][ T6127]  <TASK>
[  219.045897][ T6127]  dump_stack_lvl+0xe8/0x150
[  219.045913][ T6127]  should_fail_ex+0x40c/0x560
[  219.045928][ T6127]  prepare_alloc_pages+0x230/0x650
[  219.045944][ T6127]  __alloc_frozen_pages_noprof+0x12f/0x380
[  219.045959][ T6127]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  219.045975][ T6127]  ? policy_nodemask+0x27c/0x720
[  219.045987][ T6127]  alloc_pages_mpol+0x212/0x380
[  219.045999][ T6127]  folio_alloc_mpol_noprof+0x39/0x160
[  219.046009][ T6127]  swap_cache_alloc_folio+0x2c1/0x990
[  219.046025][ T6127]  swap_cluster_readahead+0x4d9/0x640
[  219.046039][ T6127]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  219.046055][ T6127]  ? get_vma_policy+0x27b/0x3c0
[  219.046065][ T6127]  swapin_readahead+0x19a/0xc10
** 34 printk messages dropped **
[  219.053357][ T5880] CPU: 1 UID: 0 PID: 5880 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  219.053369][ T5880] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  219.053375][ T5880] Call Trace:
[  219.053379][ T5880]  <TASK>
[  219.053383][ T5880]  dump_stack_lvl+0xe8/0x150
** 47 printk messages dropped **
[  219.053969][ T5880] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
** 80 printk messages dropped **
[  219.058230][ T5856]  ? __pte_offset_map+0x1ae/0x240
[  219.058241][ T5856]  ? pte_offset_map_rw_nolock+0xea/0x160
[  219.058253][ T5856]  handle_mm_fault+0x124c/0x3070
** 48 printk messages dropped **
[  219.058853][ T5856]  ? __pte_offset_map+0x1ae/0x240
[  219.058865][ T5856]  ? pte_offset_map_rw_nolock+0xea/0x160
[  219.058876][ T5856]  handle_mm_fault+0x124c/0x3070
[  219.058892][ T5856]  ? handle_mm_fault+0xec/0x3070
[  219.058905][ T5856]  ? __pfx_handle_mm_fault+0x10/0x10
[  219.058915][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
[  219.058936][ T5856]  do_user_addr_fault+0xa4d/0x1340
[  219.058947][ T5856]  ? trace_page_fault_user+0x84/0x1e0
[  219.058957][ T5856]  exc_page_fault+0x6a/0xc0
[  219.058967][ T5856]  asm_exc_page_fault+0x26/0x30
[  219.058975][ T5856] RIP: 0033:0x7feeb916e49e
** 38 printk messages dropped **
[  219.082894][ T6127]  ? __lock_acquire+0x683/0x2cf0
[  219.082902][ T6127]  ? do_swap_page+0x128/0x4930
[  219.082911][ T6127]  ? __pfx_do_swap_page+0x10/0x10
[  219.082920][ T6127]  ? __pte_offset_map+0x1ae/0x240
[  219.082932][ T6127]  ? pte_offset_map_rw_nolock+0xea/0x160
[  219.082943][ T6127]  handle_mm_fault+0x124c/0x3070
[  219.082959][ T6127]  ? handle_mm_fault+0xec/0x3070
[  219.082973][ T6127]  ? __pfx_handle_mm_fault+0x10/0x10
[  219.082982][ T6127]  ? lock_vma_under_rcu+0x45a/0x500
[  219.083004][ T6127]  do_user_addr_fault+0xa4d/0x1340
[  219.083016][ T6127]  ? trace_page_fault_user+0x84/0x1e0
[  219.083026][ T6127]  exc_page_fault+0x6a/0xc0
[  219.083038][ T6127]  asm_exc_page_fault+0x26/0x30
[  219.083046][ T6127] RIP: 0033:0x7feeb916e49e
[  219.083055][ T6127] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  219.083063][ T6127] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  219.083071][ T6127] RAX: fffffffffffffff4 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  219.083078][ T6127] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000200
** 33 printk messages dropped **
[  219.084927][ T5880]  ? __lock_acquire+0x683/0x2cf0
** 50 printk messages dropped **
[  219.087673][ T6127]  ? __lock_acquire+0x683/0x2cf0
** 57 printk messages dropped **
[  219.091225][ T6134]  ? __pfx_rpc_create+0x10/0x10
** 45 printk messages dropped **
[  219.091784][ T6134]  </TASK>
** 52 printk messages dropped **
[  219.092441][ T5880] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
** 49 printk messages dropped **
[  219.107363][ T6127] CPU: 0 UID: 0 PID: 6127 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
** 51 printk messages dropped **
[  219.108569][ T5880] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
** 77 printk messages dropped **
[  219.112688][ T6127]  ? __lock_acquire+0x683/0x2cf0
[  219.112695][ T6127]  ? do_swap_page+0x128/0x4930
[  219.112705][ T6127]  ? __pfx_do_swap_page+0x10/0x10
[  219.112714][ T6127]  ? __pte_offset_map+0x1ae/0x240
[  219.112725][ T6127]  ? pte_offset_map_rw_nolock+0xea/0x160
[  219.112737][ T6127]  handle_mm_fault+0x124c/0x3070
[  219.112752][ T6127]  ? handle_mm_fault+0xec/0x3070
[  219.112766][ T6127]  ? __pfx_handle_mm_fault+0x10/0x10
** 46 printk messages dropped **
[  219.132872][ T5880]  ? __pte_offset_map+0x1ae/0x240
** 50 printk messages dropped **
[  219.134443][ T5856]  ? __pte_offset_map+0x1ae/0x240
[  219.134454][ T5856]  ? pte_offset_map_rw_nolock+0xea/0x160
[  219.134466][ T5856]  handle_mm_fault+0x124c/0x3070
[  219.134481][ T5856]  ? handle_mm_fault+0xec/0x3070
[  219.134495][ T5856]  ? __pfx_handle_mm_fault+0x10/0x10
[  219.134531][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
[  219.134556][ T5856]  do_user_addr_fault+0xa4d/0x1340
[  219.134569][ T5856]  ? trace_page_fault_user+0x84/0x1e0
[  219.134578][ T5856]  exc_page_fault+0x6a/0xc0
[  219.134595][ T5856]  asm_exc_page_fault+0x26/0x30
[  219.134603][ T5856] RIP: 0033:0x7feeb916e49e
[  219.134612][ T5856] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
** 39 printk messages dropped **
[  219.138576][ T5880]  ? __pte_offset_map+0x1ae/0x240
[  219.138587][ T5880]  ? pte_offset_map_rw_nolock+0xea/0x160
[  219.138599][ T5880]  handle_mm_fault+0x124c/0x3070
[  219.138614][ T5880]  ? handle_mm_fault+0xec/0x3070
[  219.138627][ T5880]  ? __pfx_handle_mm_fault+0x10/0x10
[  219.138637][ T5880]  ? lock_vma_under_rcu+0x45a/0x500
[  219.138663][ T5880]  do_user_addr_fault+0xa4d/0x1340
[  219.138675][ T5880]  ? trace_page_fault_user+0x84/0x1e0
[  219.138685][ T5880]  exc_page_fault+0x6a/0xc0
[  219.138696][ T5880]  asm_exc_page_fault+0x26/0x30
[  219.138705][ T5880] RIP: 0033:0x7feeb916e49e
[  219.138713][ T5880] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  219.138720][ T5880] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  219.138728][ T5880] RAX: 0000000000000008 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
** 42 printk messages dropped **
[  219.142685][ T6127]  ? lock_vma_under_rcu+0x45a/0x500
** 67 printk messages dropped **
[  219.160314][ T6127] Call Trace:
[  219.160318][ T6127]  <TASK>
[  219.160321][ T6127]  dump_stack_lvl+0xe8/0x150
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
** 48 printk messages dropped **
[  219.166799][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  219.166804][ T5856] Call Trace:
[  219.166808][ T5856]  <TASK>
[  219.166811][ T5856]  dump_stack_lvl+0xe8/0x150
[  219.166827][ T5856]  should_fail_ex+0x40c/0x560
[  219.166842][ T5856]  prepare_alloc_pages+0x230/0x650
[  219.166858][ T5856]  __alloc_frozen_pages_noprof+0x12f/0x380
[  219.166873][ T5856]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  219.166889][ T5856]  ? policy_nodemask+0x27c/0x720
[  219.166901][ T5856]  alloc_pages_mpol+0x212/0x380
[  219.166912][ T5856]  folio_alloc_mpol_noprof+0x39/0x160
[  219.166923][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
[  219.166939][ T5856]  swap_cluster_readahead+0x4d9/0x640
[  219.166952][ T5856]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  219.166968][ T5856]  ? get_vma_policy+0x27b/0x3c0
[  219.166978][ T5856]  swapin_readahead+0x19a/0xc10
[  219.166991][ T5856]  ? swap_table_get+0x1e/0x260
[  219.167001][ T5856]  ? swap_table_get+0x1e/0x260
[  219.167011][ T5856]  ? __pfx_swapin_readahead+0x10/0x10
[  219.167023][ T5856]  ? swap_table_get+0x1e/0x260
[  219.167032][ T5856]  ? swap_table_get+0x1e/0x260
[  219.167041][ T5856]  ? swap_table_get+0x1e/0x260
[  219.167051][ T5856]  ? swap_table_get+0x216/0x260
[  219.167062][ T5856]  ? swap_cache_get_folio+0x2e7/0x2f0
** 3 printk messages dropped **
[  219.167110][ T5856]  ? __lock_acquire+0x683/0x2cf0
** 24 printk messages dropped **
[  219.168135][ T6134] Call Trace:
** 59 printk messages dropped **
[  219.168914][ T6134]  vfs_write+0x296/0xba0
[  219.168929][ T6134]  ? __pfx_vfs_write+0x10/0x10
[  219.168939][ T6134]  ? lockdep_hardirqs_on+0x7a/0x110
[  219.168955][ T6134]  ? fput_close_sync+0x11f/0x240
[  219.168968][ T6134]  ksys_write+0x150/0x270
[  219.168980][ T6134]  ? __pfx_ksys_write+0x10/0x10
[  219.168995][ T6134]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  219.169004][ T6134]  do_syscall_64+0x174/0x580
[  219.169015][ T6134]  ? trace_irq_disable+0x3b/0x140
[  219.169025][ T6134]  ? clear_bhb_loop+0x70/0xc0
[  219.169035][ T6134]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  219.169044][ T6134] RIP: 0033:0x7feeb916e49e
[  219.169053][ T6134] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  219.169061][ T6134] RSP: 002b:00007fff9882b788 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  219.169071][ T6134] RAX: ffffffffffffffda RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  219.169077][ T6134] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 000000000000020f
[  219.169084][ T6134] RBP: 000000000000020f R08: 0000000000000000 R09: 0000000000000000
[  219.169089][ T6134] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  219.169095][ T6134] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  219.169109][ T6134]  </TASK>
[  219.169136][ T5880] CPU: 1 UID: 0 PID: 5880 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  219.169146][ T5880] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  219.169152][ T5880] Call Trace:
[  219.169156][ T5880]  <TASK>
** 28 printk messages dropped **
[  219.169545][ T5880]  ? pte_offset_map_rw_nolock+0xea/0x160
** 2 printk messages dropped **
[  219.169588][ T5880]  ? __pfx_handle_mm_fault+0x10/0x10
[  219.169599][ T5880]  ? lock_vma_under_rcu+0x45a/0x500
** 3 printk messages dropped **
[  219.169659][ T5880]  asm_exc_page_fault+0x26/0x30
** 45 printk messages dropped **
[  219.170862][ T6127]  ? __pfx_handle_mm_fault+0x10/0x10
** 50 printk messages dropped **
[  219.173468][ T5880]  ? __pfx_handle_mm_fault+0x10/0x10
[  219.173478][ T5880]  ? lock_vma_under_rcu+0x45a/0x500
[  219.173522][ T5880]  do_user_addr_fault+0xa4d/0x1340
** 8 printk messages dropped **
[  219.173607][ T5880] RBP: 0000000000000061 R08: 0000000000000000 R09: 0000000000000000
** 39 printk messages dropped **
[  219.175753][ T5856]  ? __pfx_handle_mm_fault+0x10/0x10
[  219.175763][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
[  219.175784][ T5856]  do_user_addr_fault+0xa4d/0x1340
[  219.175796][ T5856]  ? trace_page_fault_user+0x84/0x1e0
[  219.175805][ T5856]  exc_page_fault+0x6a/0xc0
** 46 printk messages dropped **
[  219.177477][ T5880]  ? __pfx_handle_mm_fault+0x10/0x10
** 58 printk messages dropped **
[  219.181009][ T6127] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
** 9 printk messages dropped **
[  219.231881][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  219.231887][ T5856] Call Trace:
[  219.231892][ T5856]  <TASK>
[  219.231896][ T5856]  dump_stack_lvl+0xe8/0x150
[  219.231913][ T5856]  should_fail_ex+0x40c/0x560
[  219.231929][ T5856]  prepare_alloc_pages+0x230/0x650
[  219.231946][ T5856]  __alloc_frozen_pages_noprof+0x12f/0x380
[  219.231961][ T5856]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  219.231978][ T5856]  ? policy_nodemask+0x27c/0x720
[  219.231990][ T5856]  alloc_pages_mpol+0x212/0x380
[  219.232001][ T5856]  folio_alloc_mpol_noprof+0x39/0x160
[  219.232012][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
[  219.232029][ T5856]  swap_cluster_readahead+0x4d9/0x640
[  219.232043][ T5856]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  219.232059][ T5856]  ? get_vma_policy+0x27b/0x3c0
[  219.232069][ T5856]  swapin_readahead+0x19a/0xc10
[  219.232081][ T5856]  ? swap_table_get+0x1e/0x260
** 34 printk messages dropped **
[  219.233356][ T6134] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  219.233362][ T6134] Call Trace:
[  219.233366][ T6134]  <TASK>
[  219.233370][ T6134]  dump_stack_lvl+0xe8/0x150
[  219.233386][ T6134]  should_fail_ex+0x40c/0x560
[  219.233401][ T6134]  prepare_alloc_pages+0x230/0x650
[  219.233419][ T6134]  __alloc_frozen_pages_noprof+0x12f/0x380
[  219.233434][ T6134]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  219.233451][ T6134]  ? policy_nodemask+0x27c/0x720
[  219.233463][ T6134]  alloc_pages_mpol+0x212/0x380
[  219.233475][ T6134]  allocate_slab+0x131/0x5e0
[  219.233485][ T6134]  ? kfree+0x1c5/0x640
[  219.233517][ T6134]  ___slab_alloc+0x16a/0x950
[  219.233532][ T6134]  kmem_cache_alloc_noprof+0x135/0x5f0
[  219.233543][ T6134]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  219.233554][ T6134]  ? rpc_malloc+0xeb/0x260
[  219.233567][ T6134]  ? rpc_malloc+0xeb/0x260
[  219.233581][ T6134]  rpc_malloc+0xeb/0x260
[  219.233595][ T6134]  call_allocate+0x26d/0x680
** 49 printk messages dropped **
[  219.234217][ T6134]  do_syscall_64+0x174/0x580
** 44 printk messages dropped **
[  219.236389][ T5880]  ? pte_offset_map_rw_nolock+0xea/0x160
** 2 printk messages dropped **
[  219.236430][ T5880]  ? __pfx_handle_mm_fault+0x10/0x10
[  219.236439][ T5880]  ? lock_vma_under_rcu+0x45a/0x500
[  219.236461][ T5880]  do_user_addr_fault+0xa4d/0x1340
** 8 printk messages dropped **
[  219.236561][ T5880] RBP: 0000000000000061 R08: 0000000000000000 R09: 0000000000000000
** 39 printk messages dropped **
[  219.238568][ T5856]  ? __pfx_handle_mm_fault+0x10/0x10
[  219.238582][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
** 19 printk messages dropped **
[  219.250980][ T5880]  should_fail_ex+0x40c/0x560
** 47 printk messages dropped **
[  219.256684][ T5856] Call Trace:
[  219.256689][ T5856]  <TASK>
[  219.256693][ T5856]  dump_stack_lvl+0xe8/0x150
[  219.256708][ T5856]  should_fail_ex+0x40c/0x560
[  219.256724][ T5856]  prepare_alloc_pages+0x230/0x650
[  219.256742][ T5856]  __alloc_frozen_pages_noprof+0x12f/0x380
[  219.256756][ T5856]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  219.256773][ T5856]  ? policy_nodemask+0x27c/0x720
[  219.256785][ T5856]  alloc_pages_mpol+0x212/0x380
[  219.256796][ T5856]  folio_alloc_mpol_noprof+0x39/0x160
[  219.256807][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
[  219.256823][ T5856]  swap_cluster_readahead+0x4d9/0x640
[  219.256837][ T5856]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  219.256853][ T5856]  ? get_vma_policy+0x27b/0x3c0
[  219.256863][ T5856]  swapin_readahead+0x19a/0xc10
[  219.256875][ T5856]  ? swap_table_get+0x1e/0x260
[  219.256886][ T5856]  ? swap_table_get+0x1e/0x260
[  219.256896][ T5856]  ? __pfx_swapin_readahead+0x10/0x10
[  219.256908][ T5856]  ? swap_table_get+0x1e/0x260
** 32 printk messages dropped **
[  219.275268][ T5880] Call Trace:
[  219.275272][ T5880]  <TASK>
[  219.275277][ T5880]  dump_stack_lvl+0xe8/0x150
[  219.275293][ T5880]  should_fail_ex+0x40c/0x560
[  219.275309][ T5880]  prepare_alloc_pages+0x230/0x650
[  219.275326][ T5880]  __alloc_frozen_pages_noprof+0x12f/0x380
[  219.275340][ T5880]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  219.275357][ T5880]  ? policy_nodemask+0x27c/0x720
[  219.275369][ T5880]  alloc_pages_mpol+0x212/0x380
[  219.275380][ T5880]  folio_alloc_mpol_noprof+0x39/0x160
** 41 printk messages dropped **
[  219.277094][ T5856] Call Trace:
[  219.277098][ T5856]  <TASK>
[  219.277102][ T5856]  dump_stack_lvl+0xe8/0x150
[  219.277117][ T5856]  should_fail_ex+0x40c/0x560
[  219.277132][ T5856]  prepare_alloc_pages+0x230/0x650
[  219.277149][ T5856]  __alloc_frozen_pages_noprof+0x12f/0x380
[  219.277163][ T5856]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  219.277180][ T5856]  ? policy_nodemask+0x27c/0x720
[  219.277191][ T5856]  alloc_pages_mpol+0x212/0x380
[  219.277203][ T5856]  folio_alloc_mpol_noprof+0x39/0x160
[  219.277213][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
[  219.277230][ T5856]  swap_cluster_readahead+0x4d9/0x640
[  219.277243][ T5856]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  219.277259][ T5856]  ? get_vma_policy+0x27b/0x3c0
[  219.277269][ T5856]  swapin_readahead+0x19a/0xc10
[  219.277282][ T5856]  ? swap_table_get+0x1e/0x260
[  219.277292][ T5856]  ? swap_table_get+0x1e/0x260
[  219.277303][ T5856]  ? __pfx_swapin_readahead+0x10/0x10
[  219.277314][ T5856]  ? swap_table_get+0x1e/0x260
[  219.277324][ T5856]  ? swap_table_get+0x1e/0x260
[  219.277333][ T5856]  ? swap_table_get+0x1e/0x260
[  219.277343][ T5856]  ? swap_table_get+0x216/0x260
[  219.277353][ T5856]  ? swap_cache_get_folio+0x2e7/0x2f0
[  219.277366][ T5856]  do_swap_page+0x344/0x4930
[  219.277378][ T5856]  ? __pte_offset_map+0x29/0x240
[  219.277389][ T5856]  ? __pte_offset_map+0x29/0x240
[  219.277401][ T5856]  ? __lock_acquire+0x683/0x2cf0
** 27 printk messages dropped **
[  219.279923][ T5880]  should_fail_ex+0x40c/0x560
** 80 printk messages dropped **
[  219.299748][ T5856]  ? __pfx_handle_mm_fault+0x10/0x10
[  219.299758][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
[  219.299779][ T5856]  do_user_addr_fault+0xa4d/0x1340
[  219.299791][ T5856]  ? trace_page_fault_user+0x84/0x1e0
[  219.299801][ T5856]  exc_page_fault+0x6a/0xc0
[  219.299813][ T5856]  asm_exc_page_fault+0x26/0x30
[  219.299821][ T5856] RIP: 0033:0x7feeb916e49e
[  219.299830][ T5856] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
** 42 printk messages dropped **
[  219.312781][ T6127]  handle_mm_fault+0x124c/0x3070
** 50 printk messages dropped **
[  219.326508][ T6134]  ? xprt_create_transport+0x438/0x5f0
** 50 printk messages dropped **
[  219.340631][ T5880] Call Trace:
** 50 printk messages dropped **
[  219.342245][ T5856] Call Trace:
** 50 printk messages dropped **
[  219.344702][ T5880] Call Trace:
** 17 printk messages dropped **
[  219.344917][ T5880]  ? swap_table_get+0x1e/0x260
** 32 printk messages dropped **
[  219.347048][ T5856] Call Trace:
** 50 printk messages dropped **
[  219.349638][ T5880] Call Trace:
[  219.349644][ T5880]  <TASK>
[  219.349649][ T5880]  dump_stack_lvl+0xe8/0x150
[  219.349663][ T5880]  should_fail_ex+0x40c/0x560
[  219.349678][ T5880]  prepare_alloc_pages+0x230/0x650
[  219.349694][ T5880]  __alloc_frozen_pages_noprof+0x12f/0x380
[  219.349709][ T5880]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  219.349725][ T5880]  ? policy_nodemask+0x27c/0x720
[  219.349736][ T5880]  alloc_pages_mpol+0x212/0x380
[  219.349748][ T5880]  folio_alloc_mpol_noprof+0x39/0x160
[  219.349758][ T5880]  swap_cache_alloc_folio+0x2c1/0x990
[  219.349774][ T5880]  swap_cluster_readahead+0x4d9/0x640
[  219.349787][ T5880]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  219.349803][ T5880]  ? get_vma_policy+0x27b/0x3c0
[  219.349813][ T5880]  swapin_readahead+0x19a/0xc10
[  219.349825][ T5880]  ? swap_table_get+0x1e/0x260
[  219.349835][ T5880]  ? swap_table_get+0x1e/0x260
** 34 printk messages dropped **
[  219.364664][ T5856] Call Trace:
** 50 printk messages dropped **
[  219.365884][ T5880] Call Trace:
** 17 printk messages dropped **
[  219.366217][ T5880]  ? swap_table_get+0x1e/0x260
** 32 printk messages dropped **
[  219.369406][ T5856] Call Trace:
[  219.369410][ T5856]  <TASK>
[  219.369413][ T5856]  dump_stack_lvl+0xe8/0x150
[  219.369427][ T5856]  should_fail_ex+0x40c/0x560
[  219.369442][ T5856]  prepare_alloc_pages+0x230/0x650
[  219.369458][ T5856]  __alloc_frozen_pages_noprof+0x12f/0x380
[  219.369495][ T5856]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  219.369514][ T5856]  ? policy_nodemask+0x27c/0x720
[  219.369525][ T5856]  alloc_pages_mpol+0x212/0x380
[  219.369536][ T5856]  folio_alloc_mpol_noprof+0x39/0x160
[  219.369546][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
[  219.369581][ T5856]  swap_cluster_readahead+0x4d9/0x640
[  219.369595][ T5856]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  219.369611][ T5856]  ? get_vma_policy+0x27b/0x3c0
[  219.369621][ T5856]  swapin_readahead+0x19a/0xc10
[  219.369634][ T5856]  ? swap_table_get+0x1e/0x260
** 36 printk messages dropped **
[  219.409993][ T6127] Call Trace:
** 81 printk messages dropped **
[  219.417290][ T5880]  handle_mm_fault+0x124c/0x3070
** 50 printk messages dropped **
[  219.442966][ T6127]  handle_mm_fault+0x124c/0x3070
** 50 printk messages dropped **
[  219.450185][ T6134]  ? xprt_create_transport+0x438/0x5f0
[  219.450195][ T6134]  rpc_create+0x649/0x900
[  219.450209][ T6134]  ? __pfx_rpc_create+0x10/0x10
[  219.450237][ T6134]  ? __lock_acquire+0x683/0x2cf0
[  219.450250][ T6134]  rpcb_create_af_local+0x1c7/0x3c0
[  219.450259][ T6134]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  219.450277][ T6134]  ? do_raw_spin_unlock+0xf5/0x210
[  219.450290][ T6134]  rpcb_create_local+0x28f/0x670
[  219.450300][ T6134]  ? __pfx_rpcb_create_local+0x10/0x10
[  219.450307][ T6134]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  219.450318][ T6134]  ? lockdep_hardirqs_on+0x7a/0x110
[  219.450329][ T6134]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
** 39 printk messages dropped **
[  219.450869][ T5856] Call Trace:
** 50 printk messages dropped **
[  219.451501][ T5856] Call Trace:
** 51 printk messages dropped **
[  219.487645][ T6127] Call Trace:
** 50 printk messages dropped **
[  219.493498][ T5880] Call Trace:
** 50 printk messages dropped **
[  219.508251][ T6127] Call Trace:
[  219.508255][ T6127]  <TASK>
[  219.508259][ T6127]  dump_stack_lvl+0xe8/0x150
[  219.508275][ T6127]  should_fail_ex+0x40c/0x560
[  219.508291][ T6127]  prepare_alloc_pages+0x230/0x650
[  219.508307][ T6127]  __alloc_frozen_pages_noprof+0x12f/0x380
[  219.508322][ T6127]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  219.508339][ T6127]  ? policy_nodemask+0x27c/0x720
[  219.508350][ T6127]  alloc_pages_mpol+0x212/0x380
[  219.508362][ T6127]  folio_alloc_mpol_noprof+0x39/0x160
[  219.508372][ T6127]  swap_cache_alloc_folio+0x2c1/0x990
[  219.508389][ T6127]  swap_cluster_readahead+0x4d9/0x640
[  219.508403][ T6127]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  219.508419][ T6127]  ? get_vma_policy+0x27b/0x3c0
[  219.508429][ T6127]  swapin_readahead+0x19a/0xc10
[  219.508441][ T6127]  ? swap_table_get+0x1e/0x260
[  219.508451][ T6127]  ? swap_table_get+0x1e/0x260
[  219.508490][ T6127]  ? __pfx_swapin_readahead+0x10/0x10
[  219.508502][ T6127]  ? swap_table_get+0x1e/0x260
[  219.508512][ T6127]  ? swap_table_get+0x1e/0x260
[  219.508521][ T6127]  ? swap_table_get+0x1e/0x260
[  219.508531][ T6127]  ? swap_table_get+0x216/0x260
[  219.508541][ T6127]  ? swap_cache_get_folio+0x2e7/0x2f0
[  219.508561][ T6127]  do_swap_page+0x344/0x4930
[  219.508574][ T6127]  ? __pte_offset_map+0x29/0x240
[  219.508585][ T6127]  ? __pte_offset_map+0x29/0x240
[  219.508598][ T6127]  ? __lock_acquire+0x683/0x2cf0
[  219.508605][ T6127]  ? do_swap_page+0x128/0x4930
[  219.508615][ T6127]  ? __pfx_do_swap_page+0x10/0x10
[  219.508624][ T6127]  ? __pte_offset_map+0x1ae/0x240
[  219.508635][ T6127]  ? pte_offset_map_rw_nolock+0xea/0x160
[  219.508647][ T6127]  handle_mm_fault+0x124c/0x3070
[  219.508663][ T6127]  ? handle_mm_fault+0xec/0x3070
[  219.508677][ T6127]  ? __pfx_handle_mm_fault+0x10/0x10
[  219.508687][ T6127]  ? lock_vma_under_rcu+0x45a/0x500
[  219.508721][ T6127]  do_user_addr_fault+0xa4d/0x1340
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[  219.508735][ T6127]  ? trace_page_fault_user+0x84/0x1e0
[  219.508745][ T6127]  exc_page_fault+0x6a/0xc0
[  219.508757][ T6127]  asm_exc_page_fault+0x26/0x30
[  219.508766][ T6127] RIP: 0033:0x7feeb916e49e
[  219.508775][ T6127] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  219.508782][ T6127] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  219.508790][ T6127] RAX: fffffffffffffff4 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  219.508797][ T6127] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000200
[  219.508802][ T6127] RBP: 0000000000000200 R08: 0000000000000000 R09: 0000000000000000
[  219.508807][ T6127] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  219.508813][ T6127] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  219.508825][ T6127]  </TASK>
[  219.508878][ T6127] FAULT_INJECTION: forcing a failure.
[  219.508878][ T6127] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  219.510791][ T5880] CPU: 1 UID: 0 PID: 5880 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  219.510802][ T5880] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  219.510807][ T5880] Call Trace:
[  219.510812][ T5880]  <TASK>
[  219.510816][ T5880]  dump_stack_lvl+0xe8/0x150
[  219.510831][ T5880]  should_fail_ex+0x40c/0x560
[  219.510847][ T5880]  prepare_alloc_pages+0x230/0x650
[  219.510863][ T5880]  __alloc_frozen_pages_noprof+0x12f/0x380
[  219.510878][ T5880]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  219.510894][ T5880]  ? policy_nodemask+0x27c/0x720
[  219.510906][ T5880]  alloc_pages_mpol+0x212/0x380
[  219.510918][ T5880]  folio_alloc_mpol_noprof+0x39/0x160
[  219.510928][ T5880]  swap_cache_alloc_folio+0x2c1/0x990
[  219.510944][ T5880]  swap_cluster_readahead+0x4d9/0x640
[  219.510958][ T5880]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  219.510974][ T5880]  ? get_vma_policy+0x27b/0x3c0
[  219.510984][ T5880]  swapin_readahead+0x19a/0xc10
[  219.510996][ T5880]  ? swap_table_get+0x1e/0x260
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[  219.511006][ T5880]  ? swap_table_get+0x1e/0x260
[  219.511017][ T5880]  ? __pfx_swapin_readahead+0x10/0x10
[  219.511028][ T5880]  ? swap_table_get+0x1e/0x260
[  219.511038][ T5880]  ? swap_table_get+0x1e/0x260
[  219.511047][ T5880]  ? swap_table_get+0x1e/0x260
[  219.511057][ T5880]  ? swap_table_get+0x216/0x260
[  219.511067][ T5880]  ? swap_cache_get_folio+0x2e7/0x2f0
[  219.511080][ T5880]  do_swap_page+0x344/0x4930
[  219.511092][ T5880]  ? __pte_offset_map+0x29/0x240
[  219.511103][ T5880]  ? __pte_offset_map+0x29/0x240
[  219.511116][ T5880]  ? __lock_acquire+0x683/0x2cf0
[  219.511124][ T5880]  ? do_swap_page+0x128/0x4930
[  219.511133][ T5880]  ? __pfx_do_swap_page+0x10/0x10
[  219.511142][ T5880]  ? __pte_offset_map+0x1ae/0x240
[  219.511154][ T5880]  ? pte_offset_map_rw_nolock+0xea/0x160
[  219.511165][ T5880]  handle_mm_fault+0x124c/0x3070
[  219.511181][ T5880]  ? handle_mm_fault+0xec/0x3070
[  219.511195][ T5880]  ? __pfx_handle_mm_fault+0x10/0x10
[  219.511204][ T5880]  ? lock_vma_under_rcu+0x45a/0x500
[  219.511225][ T5880]  do_user_addr_fault+0xa4d/0x1340
[  219.511238][ T5880]  ? trace_page_fault_user+0x84/0x1e0
[  219.511248][ T5880]  exc_page_fault+0x6a/0xc0
[  219.511260][ T5880]  asm_exc_page_fault+0x26/0x30
[  219.511268][ T5880] RIP: 0033:0x7feeb916e49e
[  219.511276][ T5880] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  219.511283][ T5880] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  219.511290][ T5880] RAX: 0000000000000008 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  219.511296][ T5880] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000061
[  219.511302][ T5880] RBP: 0000000000000061 R08: 0000000000000000 R09: 0000000000000000
[  219.511307][ T5880] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  219.511312][ T5880] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  219.511324][ T5880]  </TASK>
[  219.511345][ T5880] FAULT_INJECTION: forcing a failure.
[  219.511345][ T5880] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  219.527756][ T6127] CPU: 0 UID: 0 PID: 6127 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  219.527769][ T6127] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  219.527775][ T6127] Call Trace:
[  219.527779][ T6127]  <TASK>
[  219.527782][ T6127]  dump_stack_lvl+0xe8/0x150
[  219.527798][ T6127]  should_fail_ex+0x40c/0x560
[  219.527814][ T6127]  prepare_alloc_pages+0x230/0x650
[  219.527831][ T6127]  __alloc_frozen_pages_noprof+0x12f/0x380
[  219.527846][ T6127]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  219.527862][ T6127]  ? policy_nodemask+0x27c/0x720
[  219.527874][ T6127]  alloc_pages_mpol+0x212/0x380
** 3 printk messages dropped **
[  219.527926][ T6127]  ? __pfx_swap_cluster_readahead+0x10/0x10
** 71 printk messages dropped **
[  219.550419][ T6127]  ? handle_mm_fault+0xec/0x3070
** 48 printk messages dropped **
[  219.556293][ T5856]  ? pte_offset_map_rw_nolock+0xea/0x160
** 50 printk messages dropped **
[  219.569557][ T6127]  ? pte_offset_map_rw_nolock+0xea/0x160
** 50 printk messages dropped **
[  219.570775][ T5880]  ? pte_offset_map_rw_nolock+0xea/0x160
** 50 printk messages dropped **
[  219.586810][ T6127]  ? pte_offset_map_rw_nolock+0xea/0x160
** 50 printk messages dropped **
[  219.588785][ T6134]  ? xprt_create_transport+0x39b/0x5f0
** 51 printk messages dropped **
[  219.589389][ T5856] Call Trace:
** 56 printk messages dropped **
[  219.599072][ T6127]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
** 44 printk messages dropped **
[  219.640824][ T5880] Call Trace:
[  219.640828][ T5880]  <TASK>
[  219.640832][ T5880]  dump_stack_lvl+0xe8/0x150
[  219.640848][ T5880]  should_fail_ex+0x40c/0x560
** 47 printk messages dropped **
[  219.683662][ T6127] Call Trace:
** 50 printk messages dropped **
[  219.684252][ T6127] Call Trace:
** 56 printk messages dropped **
[  219.684932][ T6127]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
** 44 printk messages dropped **
[  219.689576][ T6127] Call Trace:
[  219.689580][ T6127]  <TASK>
[  219.689584][ T6127]  dump_stack_lvl+0xe8/0x150
[  219.689599][ T6127]  should_fail_ex+0x40c/0x560
** 47 printk messages dropped **
[  219.690179][ T6127] Call Trace:
[  219.690183][ T6127]  <TASK>
[  219.690186][ T6127]  dump_stack_lvl+0xe8/0x150
[  219.690198][ T6127]  should_fail_ex+0x40c/0x560
[  219.690213][ T6127]  prepare_alloc_pages+0x230/0x650
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[  219.690228][ T6127]  __alloc_frozen_pages_noprof+0x12f/0x380
** 44 printk messages dropped **
[  219.712308][ T5856] CPU: 0 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  219.712321][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  219.712327][ T5856] Call Trace:
[  219.712331][ T5856]  <TASK>
[  219.712335][ T5856]  dump_stack_lvl+0xe8/0x150
** 26 printk messages dropped **
[  219.712693][ T5856]  ? __pte_offset_map+0x1ae/0x240
** 19 printk messages dropped **
[  219.713460][ T6134] CPU: 1 UID: 0 PID: 6134 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
** 1 printk messages dropped **
[  219.713488][ T6134] Call Trace:
[  219.713495][ T6134]  <TASK>
[  219.713501][ T6134]  dump_stack_lvl+0xe8/0x150
[  219.713521][ T6134]  should_fail_ex+0x40c/0x560
[  219.713537][ T6134]  prepare_alloc_pages+0x230/0x650
[  219.713554][ T6134]  __alloc_frozen_pages_noprof+0x12f/0x380
[  219.713570][ T6134]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  219.713586][ T6134]  ? policy_nodemask+0x27c/0x720
[  219.713598][ T6134]  alloc_pages_mpol+0x212/0x380
** 53 printk messages dropped **
[  219.714288][ T6134]  ? lockdep_hardirqs_on+0x7a/0x110
** 51 printk messages dropped **
[  219.726263][ T5880]  ? handle_mm_fault+0xec/0x3070
** 50 printk messages dropped **
[  219.760132][ T5856]  ? handle_mm_fault+0xec/0x3070
** 48 printk messages dropped **
[  219.794483][ T6127]  ? __pte_offset_map+0x1ae/0x240
** 51 printk messages dropped **
[  219.806111][ T6134]  ? xprt_create_transport+0x39b/0x5f0
** 131 printk messages dropped **
[  219.819101][ T5856]  ? __pte_offset_map+0x1ae/0x240
** 50 printk messages dropped **
[  219.857894][ T5880]  ? __pte_offset_map+0x1ae/0x240
** 50 printk messages dropped **
[  219.861131][ T6127]  ? __pfx_do_swap_page+0x10/0x10
** 58 printk messages dropped **
[  219.866906][ T5880]  ? trace_page_fault_user+0x84/0x1e0
** 42 printk messages dropped **
[  219.870260][ T6127]  ? __pfx_do_swap_page+0x10/0x10
[  219.870269][ T6127]  ? __pte_offset_map+0x1ae/0x240
[  219.870280][ T6127]  ? pte_offset_map_rw_nolock+0xea/0x160
[  219.870292][ T6127]  handle_mm_fault+0x124c/0x3070
[  219.870307][ T6127]  ? handle_mm_fault+0xec/0x3070
[  219.870321][ T6127]  ? __pfx_handle_mm_fault+0x10/0x10
[  219.870331][ T6127]  ? lock_vma_under_rcu+0x45a/0x500
[  219.870352][ T6127]  do_user_addr_fault+0xa4d/0x1340
[  219.870364][ T6127]  ? trace_page_fault_user+0x84/0x1e0
[  219.870373][ T6127]  exc_page_fault+0x6a/0xc0
[  219.870385][ T6127]  asm_exc_page_fault+0x26/0x30
[  219.870393][ T6127] RIP: 0033:0x7feeb916e49e
[  219.870402][ T6127] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
** 36 printk messages dropped **
[  219.873451][ T6127]  ? __pte_offset_map+0x29/0x240
** 51 printk messages dropped **
[  219.877177][ T6134]  ? __pfx_rpc_create_xprt+0x10/0x10
[  219.877194][ T6134]  ? rcu_is_watching+0x15/0xb0
[  219.877204][ T6134]  ? trace_kmalloc+0x2a/0xf0
[  219.877218][ T6134]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
** 49 printk messages dropped **
[  219.877806][ T6134]  </TASK>
** 51 printk messages dropped **
[  219.882579][ T5880] CPU: 1 UID: 0 PID: 5880 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  219.882590][ T5880] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  219.882596][ T5880] Call Trace:
[  219.882600][ T5880]  <TASK>
[  219.882603][ T5880]  dump_stack_lvl+0xe8/0x150
[  219.882615][ T5880]  should_fail_ex+0x40c/0x560
[  219.882634][ T5880]  prepare_alloc_pages+0x230/0x650
[  219.882650][ T5880]  __alloc_frozen_pages_noprof+0x12f/0x380
[  219.882665][ T5880]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
** 49 printk messages dropped **
[  219.908858][ T6127]  __alloc_frozen_pages_noprof+0x12f/0x380
** 43 printk messages dropped **
[  219.919294][ T5880] CPU: 1 UID: 0 PID: 5880 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  219.919306][ T5880] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
** 5 printk messages dropped **
[  219.919367][ T5880]  __alloc_frozen_pages_noprof+0x12f/0x380
** 44 printk messages dropped **
[  219.948168][ T6127] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  219.948174][ T6127] Call Trace:
[  219.948178][ T6127]  <TASK>
[  219.948182][ T6127]  dump_stack_lvl+0xe8/0x150
[  219.948198][ T6127]  should_fail_ex+0x40c/0x560
[  219.948214][ T6127]  prepare_alloc_pages+0x230/0x650
[  219.948231][ T6127]  __alloc_frozen_pages_noprof+0x12f/0x380
** 44 printk messages dropped **
[  219.958767][ T5856] CPU: 0 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
** 50 printk messages dropped **
[  219.959983][ T6134] CPU: 1 UID: 0 PID: 6134 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
** 60 printk messages dropped **
[  219.960801][ T6134]  ? __pfx_nfsctl_transaction_write+0x10/0x10
** 49 printk messages dropped **
[  219.968332][ T5880]  ? do_swap_page+0x128/0x4930
** 49 printk messages dropped **
[  219.986345][ T6127]  ? __lock_acquire+0x683/0x2cf0
** 22 printk messages dropped **
[  220.020981][ T5880] CPU: 1 UID: 0 PID: 5880 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
** 50 printk messages dropped **
[  220.021584][ T5880] CPU: 1 UID: 0 PID: 5880 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  220.021594][ T5880] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  220.021599][ T5880] Call Trace:
[  220.021602][ T5880]  <TASK>
[  220.021606][ T5880]  dump_stack_lvl+0xe8/0x150
[  220.021624][ T5880]  should_fail_ex+0x40c/0x560
[  220.021639][ T5880]  prepare_alloc_pages+0x230/0x650
** 44 printk messages dropped **
[  220.023989][ T5856] CPU: 0 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
** 50 printk messages dropped **
[  220.026313][ T5880] CPU: 1 UID: 0 PID: 5880 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  220.026324][ T5880] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  220.026329][ T5880] Call Trace:
[  220.026333][ T5880]  <TASK>
[  220.026337][ T5880]  dump_stack_lvl+0xe8/0x150
** 46 printk messages dropped **
[  220.028707][ T5856] CPU: 0 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
** 50 printk messages dropped **
[  220.030482][ T5880] CPU: 1 UID: 0 PID: 5880 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
** 50 printk messages dropped **
[  220.034641][ T5856] CPU: 0 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
** 50 printk messages dropped **
[  220.038065][ T6134] CPU: 1 UID: 0 PID: 6134 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
** 58 printk messages dropped **
[  220.038822][ T6134]  ? simple_transaction_get+0x12d/0x160
[  220.038833][ T6134]  nfsctl_transaction_write+0x10f/0x160
[  220.038842][ T6134]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  220.038851][ T6134]  vfs_write+0x296/0xba0
[  220.038865][ T6134]  ? __pfx_vfs_write+0x10/0x10
[  220.038875][ T6134]  ? lockdep_hardirqs_on+0x7a/0x110
[  220.038890][ T6134]  ? fput_close_sync+0x11f/0x240
[  220.038902][ T6134]  ksys_write+0x150/0x270
[  220.038914][ T6134]  ? __pfx_ksys_write+0x10/0x10
** 41 printk messages dropped **
[  220.055180][ T5856]  ? __pte_offset_map+0x29/0x240
** 50 printk messages dropped **
[  220.057032][ T5880]  ? __pte_offset_map+0x29/0x240
** 2 printk messages dropped **
[  220.057063][ T5880]  ? do_swap_page+0x128/0x4930
** 50 printk messages dropped **
[  220.080908][ T5856]  ? do_swap_page+0x128/0x4930
** 48 printk messages dropped **
[  220.107494][ T6127]  ? __pte_offset_map+0x29/0x240
** 50 printk messages dropped **
[  220.109862][ T6134]  rpc_execute+0x1c1/0x390
[  220.109874][ T6134]  rpc_run_task+0x4a6/0x660
[  220.109884][ T6134]  rpc_create_xprt+0x533/0xa90
[  220.109894][ T6134]  ? __pfx_rpc_create_xprt+0x10/0x10
[  220.109911][ T6134]  ? rcu_is_watching+0x15/0xb0
** 3 printk messages dropped **
[  220.109968][ T6134]  ? xprt_create_transport+0x438/0x5f0
** 124 printk messages dropped **
[  220.155386][ T6127]  do_swap_page+0x344/0x4930
** 50 printk messages dropped **
[  220.158079][ T5880]  do_swap_page+0x344/0x4930
** 50 printk messages dropped **
[  220.206775][ T5856]  do_swap_page+0x344/0x4930
[  220.206788][ T5856]  ? __pte_offset_map+0x29/0x240
[  220.206799][ T5856]  ? __pte_offset_map+0x29/0x240
[  220.206812][ T5856]  ? __lock_acquire+0x683/0x2cf0
[  220.206820][ T5856]  ? do_swap_page+0x128/0x4930
[  220.206829][ T5856]  ? __pfx_do_swap_page+0x10/0x10
[  220.206838][ T5856]  ? __pte_offset_map+0x1ae/0x240
[  220.206850][ T5856]  ? pte_offset_map_rw_nolock+0xea/0x160
[  220.206862][ T5856]  handle_mm_fault+0x124c/0x3070
[  220.206878][ T5856]  ? handle_mm_fault+0xec/0x3070
[  220.206891][ T5856]  ? __pfx_handle_mm_fault+0x10/0x10
[  220.206901][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
[  220.206923][ T5856]  do_user_addr_fault+0xa4d/0x1340
[  220.206936][ T5856]  ? trace_page_fault_user+0x84/0x1e0
[  220.206945][ T5856]  exc_page_fault+0x6a/0xc0
** 34 printk messages dropped **
[  220.215198][ T5856]  ? swap_table_get+0x1e/0x260
** 50 printk messages dropped **
[  220.217774][ T6127]  ? swap_table_get+0x1e/0x260
** 29 printk messages dropped **
[  220.225216][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
** 20 printk messages dropped **
[  220.225673][ T5856]  ? swap_table_get+0x1e/0x260
** 50 printk messages dropped **
[  220.236801][ T6127]  ? swap_table_get+0x1e/0x260
** 15 printk messages dropped **
[  220.236990][ T6127]  ? trace_page_fault_user+0x84/0x1e0
** 35 printk messages dropped **
[  220.239487][ T6134]  ? rpc_task_get_xprt+0x26/0x250
[  220.239497][ T6134]  ? rpc_make_runnable+0xae/0x1c0
[  220.239510][ T6134]  rpc_execute+0x1c1/0x390
[  220.239523][ T6134]  rpc_run_task+0x4a6/0x660
[  220.239533][ T6134]  rpc_create_xprt+0x533/0xa90
[  220.239543][ T6134]  ? __pfx_rpc_create_xprt+0x10/0x10
[  220.239559][ T6134]  ? rcu_is_watching+0x15/0xb0
[  220.239570][ T6134]  ? trace_kmalloc+0x2a/0xf0
[  220.239584][ T6134]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  220.239596][ T6134]  ? xprt_create_transport+0x39b/0x5f0
[  220.239611][ T6134]  ? xprt_create_transport+0x438/0x5f0
[  220.239622][ T6134]  rpc_create+0x649/0x900
[  220.239636][ T6134]  ? __pfx_rpc_create+0x10/0x10
[  220.239663][ T6134]  ? __lock_acquire+0x683/0x2cf0
[  220.239676][ T6134]  rpcb_create_af_local+0x1c7/0x3c0
** 95 printk messages dropped **
[  220.300593][ T6127] CPU: 1 UID: 0 PID: 6127 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
** 24 printk messages dropped **
[  220.300895][ T6127]  do_swap_page+0x344/0x4930
** 50 printk messages dropped **
[  220.301487][ T6127]  do_swap_page+0x344/0x4930
[  220.301498][ T6127]  ? __pte_offset_map+0x29/0x240
[  220.301509][ T6127]  ? __pte_offset_map+0x29/0x240
[  220.301521][ T6127]  ? __lock_acquire+0x683/0x2cf0
** 42 printk messages dropped **
[  220.311804][ T6127]  ? __pfx_swapin_readahead+0x10/0x10
** 2 printk messages dropped **
[  220.311834][ T6127]  ? swap_table_get+0x1e/0x260
[  220.311844][ T6127]  ? swap_table_get+0x216/0x260
[  220.311854][ T6127]  ? swap_cache_get_folio+0x2e7/0x2f0
[  220.311866][ T6127]  do_swap_page+0x344/0x4930
[  220.311878][ T6127]  ? __pte_offset_map+0x29/0x240
[  220.311889][ T6127]  ? __pte_offset_map+0x29/0x240
[  220.311902][ T6127]  ? __lock_acquire+0x683/0x2cf0
[  220.311910][ T6127]  ? do_swap_page+0x128/0x4930
[  220.311919][ T6127]  ? __pfx_do_swap_page+0x10/0x10
[  220.311928][ T6127]  ? __pte_offset_map+0x1ae/0x240
[  220.311940][ T6127]  ? pte_offset_map_rw_nolock+0xea/0x160
[  220.311951][ T6127]  handle_mm_fault+0x124c/0x3070
[  220.311967][ T6127]  ? handle_mm_fault+0xec/0x3070
[  220.311980][ T6127]  ? __pfx_handle_mm_fault+0x10/0x10
** 38 printk messages dropped **
[  220.318971][ T6134]  ? rpc_task_get_xprt+0x26/0x250
[  220.318982][ T6134]  ? rpc_make_runnable+0xae/0x1c0
[  220.319012][ T6134]  rpc_execute+0x1c1/0x390
** 52 printk messages dropped **
[  220.319661][ T6134] RBP: 000000000000020f R08: 0000000000000000 R09: 0000000000000000
** 51 printk messages dropped **
[  220.355848][ T5856] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  220.355860][ T5856]  </TASK>
[  220.355887][ T5856] FAULT_INJECTION: forcing a failure.
[  220.355887][ T5856] name fail_page_alloc, interval 1, probability 100, space 0, times -1
** 48 printk messages dropped **
[  220.371122][ T5880] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  220.371134][ T5880]  </TASK>
[  220.371159][ T5880] FAULT_INJECTION: forcing a failure.
[  220.371159][ T5880] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  220.411066][ T6134] FAULT_INJECTION: forcing a failure.
[  220.411066][ T6134] name fail_page_alloc, interval 1, probability 100, space 0, times -1
** 43 printk messages dropped **
[  220.412146][ T6127] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
** 2 printk messages dropped **
[  220.412166][ T6127] RBP: 0000000000000200 R08: 0000000000000000 R09: 0000000000000000
** 1 printk messages dropped **
[  220.412176][ T6127] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
** 56 printk messages dropped **
[  220.413766][ T6134]  ? net_generic+0x1e/0x240
** 126 printk messages dropped **
[  220.434325][ T5880] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  220.434337][ T5880]  </TASK>
[  220.434414][ T5880] FAULT_INJECTION: forcing a failure.
[  220.434414][ T5880] name fail_page_alloc, interval 1, probability 100, space 0, times -1
** 8 printk messages dropped **
[  220.435339][ T5856]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
** 39 printk messages dropped **
[  220.435804][ T5856] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
** 50 printk messages dropped **
[  220.438351][ T5880] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
** 50 printk messages dropped **
[  220.441334][ T5856] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
** 48 printk messages dropped **
[  220.443763][ T6127] RBP: 0000000000000200 R08: 0000000000000000 R09: 0000000000000000
[  220.443768][ T6127] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  220.443773][ T6127] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  220.443785][ T6127]  </TASK>
[  220.443807][ T6127] FAULT_INJECTION: forcing a failure.
[  220.443807][ T6127] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  220.447021][ T5856] CPU: 0 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  220.447033][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  220.447038][ T5856] Call Trace:
[  220.447042][ T5856]  <TASK>
[  220.447045][ T5856]  dump_stack_lvl+0xe8/0x150
[  220.447059][ T5856]  should_fail_ex+0x40c/0x560
[  220.447074][ T5856]  prepare_alloc_pages+0x230/0x650
[  220.447090][ T5856]  __alloc_frozen_pages_noprof+0x12f/0x380
[  220.447105][ T5856]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  220.447121][ T5856]  ? policy_nodemask+0x27c/0x720
[  220.447133][ T5856]  alloc_pages_mpol+0x212/0x380
** 25 printk messages dropped **
[  220.447459][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
** 11 printk messages dropped **
[  220.447567][ T5856] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  220.447579][ T5856]  </TASK>
[  220.447599][ T5856] FAULT_INJECTION: forcing a failure.
[  220.447599][ T5856] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  220.473657][ T5880] CPU: 1 UID: 0 PID: 5880 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  220.473670][ T5880] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
** 46 printk messages dropped **
[  220.474187][ T5880] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  220.474199][ T5880]  </TASK>
[  220.474225][ T5880] FAULT_INJECTION: forcing a failure.
[  220.474225][ T5880] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  220.474851][ T5856] CPU: 0 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  220.474863][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  220.474868][ T5856] Call Trace:
[  220.474872][ T5856]  <TASK>
[  220.474876][ T5856]  dump_stack_lvl+0xe8/0x150
[  220.474891][ T5856]  should_fail_ex+0x40c/0x560
[  220.474906][ T5856]  prepare_alloc_pages+0x230/0x650
[  220.474922][ T5856]  __alloc_frozen_pages_noprof+0x12f/0x380
[  220.474937][ T5856]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
** 39 printk messages dropped **
[  220.475402][ T5856] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  220.475414][ T5856]  </TASK>
[  220.475436][ T5856] FAULT_INJECTION: forcing a failure.
[  220.475436][ T5856] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  220.478166][ T6127] CPU: 1 UID: 0 PID: 6127 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
** 48 printk messages dropped **
[  220.478761][ T6127]  </TASK>
** 76 printk messages dropped **
[  220.506154][ T6134]  ? rpc_task_get_xprt+0x26/0x250
[  220.506165][ T6134]  ? rpc_make_runnable+0xae/0x1c0
[  220.506178][ T6134]  rpc_execute+0x1c1/0x390
[  220.506191][ T6134]  rpc_run_task+0x4a6/0x660
[  220.506201][ T6134]  rpc_create_xprt+0x533/0xa90
[  220.506211][ T6134]  ? __pfx_rpc_create_xprt+0x10/0x10
[  220.506228][ T6134]  ? rcu_is_watching+0x15/0xb0
[  220.506238][ T6134]  ? trace_kmalloc+0x2a/0xf0
[  220.506253][ T6134]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  220.506265][ T6134]  ? xprt_create_transport+0x39b/0x5f0
[  220.506279][ T6134]  ? xprt_create_transport+0x438/0x5f0
[  220.506290][ T6134]  rpc_create+0x649/0x900
[  220.506304][ T6134]  ? __pfx_rpc_create+0x10/0x10
[  220.506331][ T6134]  ? __lock_acquire+0x683/0x2cf0
[  220.506344][ T6134]  rpcb_create_af_local+0x1c7/0x3c0
[  220.506377][ T6134]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  220.506397][ T6134]  ? do_raw_spin_unlock+0xf5/0x210
** 7 printk messages dropped **
[  220.506485][ T6134]  svc_bind+0x1b4/0x230
** 30 printk messages dropped **
[  220.506819][ T6134] RBP: 000000000000020f R08: 0000000000000000 R09: 0000000000000000
[  220.506824][ T6134] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  220.506829][ T6134] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  220.506842][ T6134]  </TASK>
[  220.507700][ T5856] CPU: 0 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  220.507724][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
** 46 printk messages dropped **
[  220.508241][ T5856] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  220.508253][ T5856]  </TASK>
[  220.508299][ T5856] FAULT_INJECTION: forcing a failure.
[  220.508299][ T5856] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  220.510240][ T5880] CPU: 1 UID: 0 PID: 5880 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  220.510251][ T5880] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  220.510257][ T5880] Call Trace:
[  220.510260][ T5880]  <TASK>
[  220.510264][ T5880]  dump_stack_lvl+0xe8/0x150
[  220.510277][ T5880]  should_fail_ex+0x40c/0x560
[  220.510291][ T5880]  prepare_alloc_pages+0x230/0x650
[  220.510307][ T5880]  __alloc_frozen_pages_noprof+0x12f/0x380
** 41 printk messages dropped **
[  220.510817][ T5880]  </TASK>
[  220.510898][ T5880] FAULT_INJECTION: forcing a failure.
[  220.510898][ T5880] name fail_page_alloc, interval 1, probability 100, space 0, times -1
** 51 printk messages dropped **
[  220.532767][ T6127] CPU: 1 UID: 0 PID: 6127 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
** 24 printk messages dropped **
[  220.533053][ T6127]  do_swap_page+0x344/0x4930
[  220.533066][ T6127]  ? __pte_offset_map+0x29/0x240
[  220.533076][ T6127]  ? __pte_offset_map+0x29/0x240
[  220.533089][ T6127]  ? __lock_acquire+0x683/0x2cf0
[  220.533096][ T6127]  ? do_swap_page+0x128/0x4930
[  220.533106][ T6127]  ? __pfx_do_swap_page+0x10/0x10
[  220.533115][ T6127]  ? __pte_offset_map+0x1ae/0x240
[  220.533126][ T6127]  ? pte_offset_map_rw_nolock+0xea/0x160
[  220.533137][ T6127]  handle_mm_fault+0x124c/0x3070
[  220.533153][ T6127]  ? handle_mm_fault+0xec/0x3070
[  220.533167][ T6127]  ? __pfx_handle_mm_fault+0x10/0x10
[  220.533177][ T6127]  ? lock_vma_under_rcu+0x45a/0x500
[  220.533198][ T6127]  do_user_addr_fault+0xa4d/0x1340
[  220.533211][ T6127]  ? trace_page_fault_user+0x84/0x1e0
[  220.533220][ T6127]  exc_page_fault+0x6a/0xc0
[  220.533231][ T6127]  asm_exc_page_fault+0x26/0x30
** 40 printk messages dropped **
[  220.535082][ T5856]  ? __pfx_do_swap_page+0x10/0x10
** 45 printk messages dropped **
[  220.536933][ T5880]  do_swap_page+0x344/0x4930
[  220.536945][ T5880]  ? __pte_offset_map+0x29/0x240
[  220.536955][ T5880]  ? __pte_offset_map+0x29/0x240
[  220.536968][ T5880]  ? __lock_acquire+0x683/0x2cf0
[  220.536975][ T5880]  ? do_swap_page+0x128/0x4930
[  220.536985][ T5880]  ? __pfx_do_swap_page+0x10/0x10
[  220.536994][ T5880]  ? __pte_offset_map+0x1ae/0x240
[  220.537005][ T5880]  ? pte_offset_map_rw_nolock+0xea/0x160
** 43 printk messages dropped **
[  220.538855][ T5856]  do_swap_page+0x344/0x4930
[  220.538867][ T5856]  ? __pte_offset_map+0x29/0x240
[  220.538878][ T5856]  ? __pte_offset_map+0x29/0x240
[  220.538890][ T5856]  ? __lock_acquire+0x683/0x2cf0
[  220.538898][ T5856]  ? do_swap_page+0x128/0x4930
[  220.538907][ T5856]  ? __pfx_do_swap_page+0x10/0x10
[  220.538916][ T5856]  ? __pte_offset_map+0x1ae/0x240
[  220.538927][ T5856]  ? pte_offset_map_rw_nolock+0xea/0x160
[  220.538944][ T5856]  handle_mm_fault+0x124c/0x3070
[  220.538959][ T5856]  ? handle_mm_fault+0xec/0x3070
[  220.538973][ T5856]  ? __pfx_handle_mm_fault+0x10/0x10
[  220.538983][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
[  220.539004][ T5856]  do_user_addr_fault+0xa4d/0x1340
[  220.539016][ T5856]  ? trace_page_fault_user+0x84/0x1e0
** 35 printk messages dropped **
[  220.753309][ T5880]  ? swap_table_get+0x1e/0x260
[  220.753319][ T5880]  ? swap_table_get+0x216/0x260
** 1 printk messages dropped **
[  220.753367][ T5880]  do_swap_page+0x344/0x4930
[  220.753380][ T5880]  ? __pte_offset_map+0x29/0x240
** 16 printk messages dropped **
[  220.753577][ T5880] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
** 32 printk messages dropped **
[  220.755449][ T6134]  rpc_execute+0x1c1/0x390
[  220.755461][ T6134]  rpc_run_task+0x4a6/0x660
[  220.755472][ T6134]  rpc_create_xprt+0x533/0xa90
[  220.755481][ T6134]  ? __pfx_rpc_create_xprt+0x10/0x10
[  220.755498][ T6134]  ? rcu_is_watching+0x15/0xb0
[  220.755509][ T6134]  ? trace_kmalloc+0x2a/0xf0
[  220.755523][ T6134]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  220.755536][ T6134]  ? xprt_create_transport+0x39b/0x5f0
[  220.755551][ T6134]  ? xprt_create_transport+0x438/0x5f0
** 73 printk messages dropped **
[  220.756482][ T5856]  do_swap_page+0x344/0x4930
[  220.756494][ T5856]  ? __pte_offset_map+0x29/0x240
[  220.756506][ T5856]  ? __pte_offset_map+0x29/0x240
[  220.756518][ T5856]  ? __lock_acquire+0x683/0x2cf0
[  220.756526][ T5856]  ? do_swap_page+0x128/0x4930
[  220.756535][ T5856]  ? __pfx_do_swap_page+0x10/0x10
[  220.756544][ T5856]  ? __pte_offset_map+0x1ae/0x240
[  220.756557][ T5856]  ? pte_offset_map_rw_nolock+0xea/0x160
[  220.756569][ T5856]  handle_mm_fault+0x124c/0x3070
[  220.756584][ T5856]  ? handle_mm_fault+0xec/0x3070
[  220.756598][ T5856]  ? __pfx_handle_mm_fault+0x10/0x10
[  220.756608][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
[  220.756629][ T5856]  do_user_addr_fault+0xa4d/0x1340
[  220.756642][ T5856]  ? trace_page_fault_user+0x84/0x1e0
[  220.756652][ T5856]  exc_page_fault+0x6a/0xc0
[  220.756663][ T5856]  asm_exc_page_fault+0x26/0x30
[  220.756671][ T5856] RIP: 0033:0x7feeb916e49e
[  220.756679][ T5856] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  220.756686][ T5856] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  220.756694][ T5856] RAX: fffffffffffffff4 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  220.756700][ T5856] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000031
** 12 printk messages dropped **
[  220.758741][ T6127]  __alloc_frozen_pages_noprof+0x12f/0x380
** 17 printk messages dropped **
[  220.758963][ T6127]  do_swap_page+0x344/0x4930
** 48 printk messages dropped **
[  220.762770][ T5856]  ? swap_table_get+0x216/0x260
** 2 printk messages dropped **
[  220.762805][ T5856]  ? __pte_offset_map+0x29/0x240
[  220.762816][ T5856]  ? __pte_offset_map+0x29/0x240
[  220.762828][ T5856]  ? __lock_acquire+0x683/0x2cf0
[  220.762836][ T5856]  ? do_swap_page+0x128/0x4930
[  220.762845][ T5856]  ? __pfx_do_swap_page+0x10/0x10
[  220.762854][ T5856]  ? __pte_offset_map+0x1ae/0x240
[  220.762865][ T5856]  ? pte_offset_map_rw_nolock+0xea/0x160
[  220.762877][ T5856]  handle_mm_fault+0x124c/0x3070
[  220.762893][ T5856]  ? handle_mm_fault+0xec/0x3070
[  220.762906][ T5856]  ? __pfx_handle_mm_fault+0x10/0x10
** 41 printk messages dropped **
[  220.763988][ T5880]  ? __pte_offset_map+0x29/0x240
** 50 printk messages dropped **
[  220.766637][ T5856]  ? __pte_offset_map+0x29/0x240
** 2 printk messages dropped **
[  220.766667][ T5856]  ? do_swap_page+0x128/0x4930
[  220.766676][ T5856]  ? __pfx_do_swap_page+0x10/0x10
[  220.766685][ T5856]  ? __pte_offset_map+0x1ae/0x240
[  220.766696][ T5856]  ? pte_offset_map_rw_nolock+0xea/0x160
[  220.766709][ T5856]  handle_mm_fault+0x124c/0x3070
[  220.766724][ T5856]  ? handle_mm_fault+0xec/0x3070
** 45 printk messages dropped **
[  220.769247][ T6127]  ? do_swap_page+0x128/0x4930
[  220.769257][ T6127]  ? __pfx_do_swap_page+0x10/0x10
[  220.769266][ T6127]  ? __pte_offset_map+0x1ae/0x240
[  220.769277][ T6127]  ? pte_offset_map_rw_nolock+0xea/0x160
** 47 printk messages dropped **
[  220.771844][ T5856]  ? do_swap_page+0x128/0x4930
[  220.771853][ T5856]  ? __pfx_do_swap_page+0x10/0x10
[  220.771862][ T5856]  ? __pte_offset_map+0x1ae/0x240
[  220.771874][ T5856]  ? pte_offset_map_rw_nolock+0xea/0x160
[  220.771885][ T5856]  handle_mm_fault+0x124c/0x3070
** 2 printk messages dropped **
[  220.771924][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
** 43 printk messages dropped **
[  220.774426][ T5880]  ? do_swap_page+0x128/0x4930
** 36 printk messages dropped **
[  220.776132][ T5856]  ? get_vma_policy+0x27b/0x3c0
** 35 printk messages dropped **
[  220.783935][ T6127] CPU: 0 UID: 0 PID: 6127 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  220.783948][ T6127] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  220.783954][ T6127] Call Trace:
[  220.783958][ T6127]  <TASK>
[  220.783962][ T6127]  dump_stack_lvl+0xe8/0x150
[  220.783976][ T6127]  should_fail_ex+0x40c/0x560
[  220.783991][ T6127]  prepare_alloc_pages+0x230/0x650
[  220.784007][ T6127]  __alloc_frozen_pages_noprof+0x12f/0x380
** 8 printk messages dropped **
[  220.784127][ T6127]  swapin_readahead+0x19a/0xc10
** 34 printk messages dropped **
[  220.785359][ T5856] CPU: 1 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  220.785370][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  220.785376][ T5856] Call Trace:
[  220.785380][ T5856]  <TASK>
[  220.785383][ T5856]  dump_stack_lvl+0xe8/0x150
[  220.785397][ T5856]  should_fail_ex+0x40c/0x560
[  220.785411][ T5856]  prepare_alloc_pages+0x230/0x650
[  220.785427][ T5856]  __alloc_frozen_pages_noprof+0x12f/0x380
[  220.785442][ T5856]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
** 42 printk messages dropped **
[  220.787301][ T5880] CPU: 0 UID: 0 PID: 5880 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
** 49 printk messages dropped **
[  220.787875][ T5880] FAULT_INJECTION: forcing a failure.
[  220.787875][ T5880] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  220.789114][ T5856] CPU: 1 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  220.789124][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  220.789129][ T5856] Call Trace:
[  220.789133][ T5856]  <TASK>
[  220.789137][ T5856]  dump_stack_lvl+0xe8/0x150
[  220.789150][ T5856]  should_fail_ex+0x40c/0x560
[  220.789164][ T5856]  prepare_alloc_pages+0x230/0x650
[  220.789180][ T5856]  __alloc_frozen_pages_noprof+0x12f/0x380
[  220.789195][ T5856]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  220.789211][ T5856]  ? policy_nodemask+0x27c/0x720
[  220.789222][ T5856]  alloc_pages_mpol+0x212/0x380
[  220.789233][ T5856]  folio_alloc_mpol_noprof+0x39/0x160
[  220.789244][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
** 39 printk messages dropped **
[  220.796790][ T6127] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  220.796796][ T6127] Call Trace:
** 3 printk messages dropped **
[  220.796833][ T6127]  prepare_alloc_pages+0x230/0x650
** 69 printk messages dropped **
[  220.820135][ T5856]  do_swap_page+0x344/0x4930
** 10 printk messages dropped **
[  220.820261][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
** 21 printk messages dropped **
[  220.831121][ T5880]  __alloc_frozen_pages_noprof+0x12f/0x380
** 26 printk messages dropped **
[  220.831470][ T5880]  ? handle_mm_fault+0xec/0x3070
** 48 printk messages dropped **
[  220.850949][ T5880]  ? __pte_offset_map+0x1ae/0x240
[  220.850960][ T5880]  ? pte_offset_map_rw_nolock+0xea/0x160
[  220.850972][ T5880]  handle_mm_fault+0x124c/0x3070
[  220.850987][ T5880]  ? handle_mm_fault+0xec/0x3070
[  220.851001][ T5880]  ? __pfx_handle_mm_fault+0x10/0x10
[  220.851010][ T5880]  ? lock_vma_under_rcu+0x45a/0x500
** 9 printk messages dropped **
[  220.851112][ T5880] RBP: 0000000000000061 R08: 0000000000000000 R09: 0000000000000000
** 36 printk messages dropped **
[  220.852176][ T5856]  ? pte_offset_map_rw_nolock+0xea/0x160
[  220.852188][ T5856]  handle_mm_fault+0x124c/0x3070
[  220.852203][ T5856]  ? handle_mm_fault+0xec/0x3070
[  220.852217][ T5856]  ? __pfx_handle_mm_fault+0x10/0x10
[  220.852227][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
[  220.852248][ T5856]  do_user_addr_fault+0xa4d/0x1340
[  220.852261][ T5856]  ? trace_page_fault_user+0x84/0x1e0
[  220.852270][ T5856]  exc_page_fault+0x6a/0xc0
[  220.852282][ T5856]  asm_exc_page_fault+0x26/0x30
[  220.852290][ T5856] RIP: 0033:0x7feeb916e49e
[  220.852299][ T5856] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
** 39 printk messages dropped **
[  220.854487][ T6127]  ? __pte_offset_map+0x1ae/0x240
[  220.854499][ T6127]  ? pte_offset_map_rw_nolock+0xea/0x160
[  220.854510][ T6127]  handle_mm_fault+0x124c/0x3070
[  220.854526][ T6127]  ? handle_mm_fault+0xec/0x3070
[  220.854540][ T6127]  ? __pfx_handle_mm_fault+0x10/0x10
[  220.854550][ T6127]  ? lock_vma_under_rcu+0x45a/0x500
[  220.854571][ T6127]  do_user_addr_fault+0xa4d/0x1340
[  220.854583][ T6127]  ? trace_page_fault_user+0x84/0x1e0
[  220.854592][ T6127]  exc_page_fault+0x6a/0xc0
[  220.854603][ T6127]  asm_exc_page_fault+0x26/0x30
[  220.854612][ T6127] RIP: 0033:0x7feeb916e49e
[  220.854620][ T6127] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  220.854627][ T6127] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  220.854635][ T6127] RAX: fffffffffffffff4 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  220.854641][ T6127] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000200
[  220.854647][ T6127] RBP: 0000000000000200 R08: 0000000000000000 R09: 0000000000000000
** 40 printk messages dropped **
[  220.856941][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
[  220.856962][ T5856]  do_user_addr_fault+0xa4d/0x1340
[  220.856974][ T5856]  ? trace_page_fault_user+0x84/0x1e0
[  220.856983][ T5856]  exc_page_fault+0x6a/0xc0
** 11 printk messages dropped **
[  220.858943][ T5880] CPU: 0 UID: 0 PID: 5880 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
** 52 printk messages dropped **
[  220.861865][ T6134] Call Trace:
[  220.861869][ T6134]  <TASK>
[  220.861872][ T6134]  dump_stack_lvl+0xe8/0x150
[  220.861886][ T6134]  should_fail_ex+0x40c/0x560
[  220.861901][ T6134]  prepare_alloc_pages+0x230/0x650
[  220.861917][ T6134]  __alloc_frozen_pages_noprof+0x12f/0x380
[  220.861938][ T6134]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  220.861955][ T6134]  ? policy_nodemask+0x27c/0x720
[  220.861967][ T6134]  alloc_pages_mpol+0x212/0x380
** 520 printk messages dropped **
[  220.912897][ T5880] RIP: 0033:0x7feeb916e49e
[  220.912905][ T5880] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  220.912912][ T5880] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  220.912920][ T5880] RAX: 0000000000000008 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  220.912926][ T5880] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000061
[  220.912931][ T5880] RBP: 0000000000000061 R08: 0000000000000000 R09: 0000000000000000
[  220.912936][ T5880] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  220.912941][ T5880] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  220.912954][ T5880]  </TASK>
[  220.912973][ T5880] FAULT_INJECTION: forcing a failure.
[  220.912973][ T5880] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  220.928832][ T6127] CPU: 1 UID: 0 PID: 6127 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  220.928844][ T6127] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  220.928850][ T6127] Call Trace:
[  220.928854][ T6127]  <TASK>
[  220.928858][ T6127]  dump_stack_lvl+0xe8/0x150
[  220.928873][ T6127]  should_fail_ex+0x40c/0x560
[  220.928889][ T6127]  prepare_alloc_pages+0x230/0x650
[  220.928906][ T6127]  __alloc_frozen_pages_noprof+0x12f/0x380
[  220.928924][ T6127]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  220.928941][ T6127]  ? policy_nodemask+0x27c/0x720
[  220.928953][ T6127]  alloc_pages_mpol+0x212/0x380
[  220.928965][ T6127]  folio_alloc_mpol_noprof+0x39/0x160
[  220.928975][ T6127]  swap_cache_alloc_folio+0x2c1/0x990
[  220.928992][ T6127]  swap_cluster_readahead+0x4d9/0x640
[  220.929005][ T6127]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  220.929022][ T6127]  ? get_vma_policy+0x27b/0x3c0
[  220.929032][ T6127]  swapin_readahead+0x19a/0xc10
[  220.929044][ T6127]  ? swap_table_get+0x1e/0x260
[  220.929054][ T6127]  ? swap_table_get+0x1e/0x260
[  220.929065][ T6127]  ? __pfx_swapin_readahead+0x10/0x10
[  220.929077][ T6127]  ? swap_table_get+0x1e/0x260
[  220.929086][ T6127]  ? swap_table_get+0x1e/0x260
[  220.929095][ T6127]  ? swap_table_get+0x1e/0x260
[  220.929105][ T6127]  ? swap_table_get+0x216/0x260
[  220.929116][ T6127]  ? swap_cache_get_folio+0x2e7/0x2f0
[  220.929129][ T6127]  do_swap_page+0x344/0x4930
[  220.929141][ T6127]  ? __pte_offset_map+0x29/0x240
** 262 printk messages dropped **
[  220.959570][ T5856]  handle_mm_fault+0x124c/0x3070
** 2 printk messages dropped **
[  220.959608][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
[  220.959629][ T5856]  do_user_addr_fault+0xa4d/0x1340
[  220.959642][ T5856]  ? trace_page_fault_user+0x84/0x1e0
[  220.959651][ T5856]  exc_page_fault+0x6a/0xc0
[  220.959662][ T5856]  asm_exc_page_fault+0x26/0x30
[  220.959671][ T5856] RIP: 0033:0x7feeb916e49e
[  220.959679][ T5856] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  220.959687][ T5856] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  220.959694][ T5856] RAX: fffffffffffffff4 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  220.959700][ T5856] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000031
[  220.959706][ T5856] RBP: 0000000000000031 R08: 0000000000000000 R09: 0000000000000000
[  220.959711][ T5856] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  220.959717][ T5856] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  220.959729][ T5856]  </TASK>
[  220.959750][ T5856] FAULT_INJECTION: forcing a failure.
[  220.959750][ T5856] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  220.962767][ T5880] CPU: 0 UID: 0 PID: 5880 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  220.962779][ T5880] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  220.962784][ T5880] Call Trace:
[  220.962788][ T5880]  <TASK>
[  220.962792][ T5880]  dump_stack_lvl+0xe8/0x150
[  220.962805][ T5880]  should_fail_ex+0x40c/0x560
[  220.962820][ T5880]  prepare_alloc_pages+0x230/0x650
[  220.962836][ T5880]  __alloc_frozen_pages_noprof+0x12f/0x380
[  220.962851][ T5880]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  220.962868][ T5880]  ? policy_nodemask+0x27c/0x720
[  220.962879][ T5880]  alloc_pages_mpol+0x212/0x380
[  220.962891][ T5880]  folio_alloc_mpol_noprof+0x39/0x160
[  220.962902][ T5880]  swap_cache_alloc_folio+0x2c1/0x990
[  220.962917][ T5880]  swap_cluster_readahead+0x4d9/0x640
[  220.962931][ T5880]  ? __pfx_swap_cluster_readahead+0x10/0x10
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[  220.962947][ T5880]  ? get_vma_policy+0x27b/0x3c0
[  220.962957][ T5880]  swapin_readahead+0x19a/0xc10
[  220.962969][ T5880]  ? swap_table_get+0x1e/0x260
[  220.962979][ T5880]  ? swap_table_get+0x1e/0x260
[  220.962989][ T5880]  ? __pfx_swapin_readahead+0x10/0x10
[  220.963001][ T5880]  ? swap_table_get+0x1e/0x260
[  220.963010][ T5880]  ? swap_table_get+0x1e/0x260
[  220.963019][ T5880]  ? swap_table_get+0x1e/0x260
[  220.963029][ T5880]  ? swap_table_get+0x216/0x260
[  220.963040][ T5880]  ? swap_cache_get_folio+0x2e7/0x2f0
[  220.963052][ T5880]  do_swap_page+0x344/0x4930
[  220.963064][ T5880]  ? __pte_offset_map+0x29/0x240
[  220.963075][ T5880]  ? __pte_offset_map+0x29/0x240
[  220.963087][ T5880]  ? __lock_acquire+0x683/0x2cf0
[  220.963095][ T5880]  ? do_swap_page+0x128/0x4930
[  220.963104][ T5880]  ? __pfx_do_swap_page+0x10/0x10
[  220.963113][ T5880]  ? __pte_offset_map+0x1ae/0x240
[  220.963124][ T5880]  ? pte_offset_map_rw_nolock+0xea/0x160
[  220.963136][ T5880]  handle_mm_fault+0x124c/0x3070
[  220.963151][ T5880]  ? handle_mm_fault+0xec/0x3070
[  220.963164][ T5880]  ? __pfx_handle_mm_fault+0x10/0x10
[  220.963174][ T5880]  ? lock_vma_under_rcu+0x45a/0x500
[  220.963195][ T5880]  do_user_addr_fault+0xa4d/0x1340
[  220.963207][ T5880]  ? trace_page_fault_user+0x84/0x1e0
[  220.963216][ T5880]  exc_page_fault+0x6a/0xc0
[  220.963227][ T5880]  asm_exc_page_fault+0x26/0x30
[  220.963236][ T5880] RIP: 0033:0x7feeb916e49e
[  220.963243][ T5880] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  220.963250][ T5880] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  220.963258][ T5880] RAX: 0000000000000008 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  220.963263][ T5880] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000061
[  220.963269][ T5880] RBP: 0000000000000061 R08: 0000000000000000 R09: 0000000000000000
[  220.963274][ T5880] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  220.963279][ T5880] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  220.963291][ T5880]  </TASK>
[  220.963327][ T5880] FAULT_INJECTION: forcing a failure.
[  220.963327][ T5880] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  220.967130][ T6134] CPU: 1 UID: 0 PID: 6134 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  220.967142][ T6134] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  220.967148][ T6134] Call Trace:
[  220.967151][ T6134]  <TASK>
[  220.967155][ T6134]  dump_stack_lvl+0xe8/0x150
[  220.967169][ T6134]  should_fail_ex+0x40c/0x560
[  220.967184][ T6134]  prepare_alloc_pages+0x230/0x650
[  220.967200][ T6134]  __alloc_frozen_pages_noprof+0x12f/0x380
[  220.967216][ T6134]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  220.967232][ T6134]  ? policy_nodemask+0x27c/0x720
[  220.967244][ T6134]  alloc_pages_mpol+0x212/0x380
[  220.967256][ T6134]  allocate_slab+0x131/0x5e0
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[  220.967266][ T6134]  ? kfree+0x1c5/0x640
[  220.967278][ T6134]  ___slab_alloc+0x16a/0x950
[  220.967292][ T6134]  kmem_cache_alloc_noprof+0x135/0x5f0
[  220.967303][ T6134]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  220.967340][ T6134]  ? rpc_malloc+0xeb/0x260
[  220.967352][ T6134]  ? rpc_malloc+0xeb/0x260
[  220.967366][ T6134]  rpc_malloc+0xeb/0x260
[  220.967380][ T6134]  call_allocate+0x26d/0x680
[  220.967391][ T6134]  ? __pfx_call_allocate+0x10/0x10
[  220.967403][ T6134]  __rpc_execute+0x526/0x1280
[  220.967421][ T6134]  ? __pfx___rpc_execute+0x10/0x10
[  220.967434][ T6134]  ? rpc_task_get_xprt+0x26/0x250
[  220.967445][ T6134]  ? rpc_make_runnable+0xae/0x1c0
[  220.967458][ T6134]  rpc_execute+0x1c1/0x390
[  220.967470][ T6134]  rpc_run_task+0x4a6/0x660
[  220.967481][ T6134]  rpc_create_xprt+0x533/0xa90
[  220.967491][ T6134]  ? __pfx_rpc_create_xprt+0x10/0x10
[  220.967508][ T6134]  ? rcu_is_watching+0x15/0xb0
[  220.967518][ T6134]  ? trace_kmalloc+0x2a/0xf0
[  220.967532][ T6134]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  220.967544][ T6134]  ? xprt_create_transport+0x39b/0x5f0
[  220.967559][ T6134]  ? xprt_create_transport+0x438/0x5f0
[  220.967569][ T6134]  rpc_create+0x649/0x900
[  220.967583][ T6134]  ? __pfx_rpc_create+0x10/0x10
[  220.967611][ T6134]  ? __lock_acquire+0x683/0x2cf0
[  220.967624][ T6134]  rpcb_create_af_local+0x1c7/0x3c0
[  220.967633][ T6134]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  220.967651][ T6134]  ? do_raw_spin_unlock+0xf5/0x210
[  220.967664][ T6134]  rpcb_create_local+0x28f/0x670
[  220.967673][ T6134]  ? __pfx_rpcb_create_local+0x10/0x10
[  220.967681][ T6134]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  220.967691][ T6134]  ? lockdep_hardirqs_on+0x7a/0x110
[  220.967702][ T6134]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  220.967711][ T6134]  ? __percpu_counter_init_many+0x35f/0x380
[  220.967726][ T6134]  ? __svc_create+0x88f/0x990
[  220.967740][ T6134]  svc_bind+0x1b4/0x230
[  220.967751][ T6134]  nfsd_create_serv+0x581/0x840
[  220.967763][ T6134]  ? kasan_save_track+0x3e/0x80
[  220.967775][ T6134]  ? __pfx_nfsd_create_serv+0x10/0x10
[  220.967787][ T6134]  ? sscanf+0xe2/0x140
[  220.967796][ T6134]  ? net_generic+0x1e/0x240
[  220.967809][ T6134]  ? __pfx_sscanf+0x10/0x10
[  220.967818][ T6134]  ? net_generic+0x1e/0x240
[  220.967830][ T6134]  ? net_generic+0x1e/0x240
[  220.967845][ T6134]  write_ports+0x669/0xd10
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[  220.967855][ T6134]  ? __pfx_write_ports+0x10/0x10
[  220.967872][ T6134]  ? _copy_from_user+0x94/0xb0
[  220.967883][ T6134]  ? simple_transaction_get+0x12d/0x160
[  220.967894][ T6134]  nfsctl_transaction_write+0x10f/0x160
[  220.967904][ T6134]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  220.967918][ T6134]  vfs_write+0x296/0xba0
[  220.967933][ T6134]  ? __pfx_vfs_write+0x10/0x10
[  220.967942][ T6134]  ? lockdep_hardirqs_on+0x7a/0x110
[  220.967958][ T6134]  ? fput_close_sync+0x11f/0x240
[  220.967970][ T6134]  ksys_write+0x150/0x270
[  220.967982][ T6134]  ? __pfx_ksys_write+0x10/0x10
[  220.967996][ T6134]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  220.968005][ T6134]  do_syscall_64+0x174/0x580
[  220.968016][ T6134]  ? trace_irq_disable+0x3b/0x140
[  220.968025][ T6134]  ? clear_bhb_loop+0x70/0xc0
[  220.968035][ T6134]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  220.968043][ T6134] RIP: 0033:0x7feeb916e49e
[  220.968052][ T6134] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  220.968059][ T6134] RSP: 002b:00007fff9882b788 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  220.968069][ T6134] RAX: ffffffffffffffda RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  220.968075][ T6134] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 000000000000020f
[  220.968080][ T6134] RBP: 000000000000020f R08: 0000000000000000 R09: 0000000000000000
[  220.968085][ T6134] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  220.968091][ T6134] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  220.968103][ T6134]  </TASK>
[  220.972265][ T6127] CPU: 1 UID: 0 PID: 6127 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  220.972276][ T6127] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  220.972281][ T6127] Call Trace:
[  220.972285][ T6127]  <TASK>
[  220.972288][ T6127]  dump_stack_lvl+0xe8/0x150
[  220.972302][ T6127]  should_fail_ex+0x40c/0x560
[  220.972346][ T6127]  prepare_alloc_pages+0x230/0x650
[  220.972362][ T6127]  __alloc_frozen_pages_noprof+0x12f/0x380
[  220.972377][ T6127]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  220.972393][ T6127]  ? policy_nodemask+0x27c/0x720
[  220.972404][ T6127]  alloc_pages_mpol+0x212/0x380
[  220.972416][ T6127]  folio_alloc_mpol_noprof+0x39/0x160
[  220.972427][ T6127]  swap_cache_alloc_folio+0x2c1/0x990
[  220.972442][ T6127]  swap_cluster_readahead+0x4d9/0x640
[  220.972456][ T6127]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  220.972472][ T6127]  ? get_vma_policy+0x27b/0x3c0
[  220.972482][ T6127]  swapin_readahead+0x19a/0xc10
[  220.972494][ T6127]  ? swap_table_get+0x1e/0x260
[  220.972505][ T6127]  ? swap_table_get+0x1e/0x260
[  220.972515][ T6127]  ? __pfx_swapin_readahead+0x10/0x10
[  220.972527][ T6127]  ? swap_table_get+0x1e/0x260
[  220.972536][ T6127]  ? swap_table_get+0x1e/0x260
[  220.972545][ T6127]  ? swap_table_get+0x1e/0x260
[  220.972556][ T6127]  ? swap_table_get+0x216/0x260
[  220.972566][ T6127]  ? swap_cache_get_folio+0x2e7/0x2f0
[  220.972579][ T6127]  do_swap_page+0x344/0x4930
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[+] Iteration 2500
[  220.972591][ T6127]  ? __pte_offset_map+0x29/0x240
[  220.972602][ T6127]  ? __pte_offset_map+0x29/0x240
[  220.972614][ T6127]  ? __lock_acquire+0x683/0x2cf0
[  220.972621][ T6127]  ? do_swap_page+0x128/0x4930
[  220.972631][ T6127]  ? __pfx_do_swap_page+0x10/0x10
[  220.972640][ T6127]  ? __pte_offset_map+0x1ae/0x240
[  220.972651][ T6127]  ? pte_offset_map_rw_nolock+0xea/0x160
[  220.972663][ T6127]  handle_mm_fault+0x124c/0x3070
[  220.972678][ T6127]  ? handle_mm_fault+0xec/0x3070
[  220.972692][ T6127]  ? __pfx_handle_mm_fault+0x10/0x10
[  220.972702][ T6127]  ? lock_vma_under_rcu+0x45a/0x500
[  220.972723][ T6127]  do_user_addr_fault+0xa4d/0x1340
[  220.972735][ T6127]  ? trace_page_fault_user+0x84/0x1e0
[  220.972744][ T6127]  exc_page_fault+0x6a/0xc0
[  220.972756][ T6127]  asm_exc_page_fault+0x26/0x30
[  220.972764][ T6127] RIP: 0033:0x7feeb916e49e
[  220.972772][ T6127] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  220.972779][ T6127] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  220.972787][ T6127] RAX: fffffffffffffff4 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  220.972793][ T6127] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000200
[  220.972799][ T6127] RBP: 0000000000000200 R08: 0000000000000000 R09: 0000000000000000
[  220.972804][ T6127] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  220.972809][ T6127] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  220.972821][ T6127]  </TASK>
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[  220.972842][ T6127] FAULT_INJECTION: forcing a failure.
[  220.972842][ T6127] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  220.985741][ T5880] CPU: 0 UID: 0 PID: 5880 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  220.985752][ T5880] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  220.985758][ T5880] Call Trace:
[  220.985761][ T5880]  <TASK>
[  220.985765][ T5880]  dump_stack_lvl+0xe8/0x150
[  220.985779][ T5880]  should_fail_ex+0x40c/0x560
[  220.985794][ T5880]  prepare_alloc_pages+0x230/0x650
[  220.985811][ T5880]  __alloc_frozen_pages_noprof+0x12f/0x380
[  220.985826][ T5880]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  220.985842][ T5880]  ? policy_nodemask+0x27c/0x720
[  220.985854][ T5880]  alloc_pages_mpol+0x212/0x380
[  220.985865][ T5880]  folio_alloc_mpol_noprof+0x39/0x160
[  220.985876][ T5880]  swap_cache_alloc_folio+0x2c1/0x990
[  220.985892][ T5880]  swap_cluster_readahead+0x4d9/0x640
[  220.985905][ T5880]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  220.985921][ T5880]  ? get_vma_policy+0x27b/0x3c0
[  220.985931][ T5880]  swapin_readahead+0x19a/0xc10
[  220.985943][ T5880]  ? swap_table_get+0x1e/0x260
[  220.985953][ T5880]  ? swap_table_get+0x1e/0x260
[  220.985964][ T5880]  ? __pfx_swapin_readahead+0x10/0x10
[  220.985976][ T5880]  ? swap_table_get+0x1e/0x260
[  220.985985][ T5880]  ? swap_table_get+0x1e/0x260
[  220.985994][ T5880]  ? swap_table_get+0x1e/0x260
[  220.986004][ T5880]  ? swap_table_get+0x216/0x260
[  220.986014][ T5880]  ? swap_cache_get_folio+0x2e7/0x2f0
[  220.986027][ T5880]  do_swap_page+0x344/0x4930
[  220.986039][ T5880]  ? __pte_offset_map+0x29/0x240
[  220.986050][ T5880]  ? __pte_offset_map+0x29/0x240
[  220.986062][ T5880]  ? __lock_acquire+0x683/0x2cf0
[  220.986070][ T5880]  ? do_swap_page+0x128/0x4930
[  220.986079][ T5880]  ? __pfx_do_swap_page+0x10/0x10
[  220.986088][ T5880]  ? __pte_offset_map+0x1ae/0x240
[  220.986100][ T5880]  ? pte_offset_map_rw_nolock+0xea/0x160
[  220.986111][ T5880]  handle_mm_fault+0x124c/0x3070
[  220.986127][ T5880]  ? handle_mm_fault+0xec/0x3070
[  220.986141][ T5880]  ? __pfx_handle_mm_fault+0x10/0x10
[  220.986150][ T5880]  ? lock_vma_under_rcu+0x45a/0x500
[  220.986171][ T5880]  do_user_addr_fault+0xa4d/0x1340
[  220.986183][ T5880]  ? trace_page_fault_user+0x84/0x1e0
[  220.986193][ T5880]  exc_page_fault+0x6a/0xc0
[  220.986205][ T5880]  asm_exc_page_fault+0x26/0x30
[  220.986213][ T5880] RIP: 0033:0x7feeb916e49e
[  220.986221][ T5880] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  220.986228][ T5880] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  220.986236][ T5880] RAX: 0000000000000008 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  220.986242][ T5880] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000061
[  220.986247][ T5880] RBP: 0000000000000061 R08: 0000000000000000 R09: 0000000000000000
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[  220.986252][ T5880] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  220.986258][ T5880] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  220.986270][ T5880]  </TASK>
[  220.986291][ T5880] FAULT_INJECTION: forcing a failure.
[  220.986291][ T5880] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  220.987275][ T5856] CPU: 1 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  220.987287][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  220.987292][ T5856] Call Trace:
[  220.987296][ T5856]  <TASK>
[  220.987300][ T5856]  dump_stack_lvl+0xe8/0x150
[  220.987333][ T5856]  should_fail_ex+0x40c/0x560
[  220.987348][ T5856]  prepare_alloc_pages+0x230/0x650
[  220.987364][ T5856]  __alloc_frozen_pages_noprof+0x12f/0x380
[  220.987379][ T5856]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  220.987395][ T5856]  ? policy_nodemask+0x27c/0x720
[  220.987407][ T5856]  alloc_pages_mpol+0x212/0x380
[  220.987418][ T5856]  folio_alloc_mpol_noprof+0x39/0x160
[  220.987429][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
[  220.987444][ T5856]  swap_cluster_readahead+0x4d9/0x640
[  220.987458][ T5856]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  220.987474][ T5856]  ? get_vma_policy+0x27b/0x3c0
[  220.987484][ T5856]  swapin_readahead+0x19a/0xc10
[  220.987496][ T5856]  ? swap_table_get+0x1e/0x260
[  220.987507][ T5856]  ? swap_table_get+0x1e/0x260
[  220.987517][ T5856]  ? __pfx_swapin_readahead+0x10/0x10
[  220.987529][ T5856]  ? swap_table_get+0x1e/0x260
[  220.987539][ T5856]  ? swap_table_get+0x1e/0x260
[  220.987548][ T5856]  ? swap_table_get+0x1e/0x260
[  220.987558][ T5856]  ? swap_table_get+0x216/0x260
[  220.987568][ T5856]  ? swap_cache_get_folio+0x2e7/0x2f0
[  220.987581][ T5856]  do_swap_page+0x344/0x4930
[  220.987593][ T5856]  ? __pte_offset_map+0x29/0x240
[  220.987604][ T5856]  ? __pte_offset_map+0x29/0x240
[  220.987617][ T5856]  ? __lock_acquire+0x683/0x2cf0
[  220.987624][ T5856]  ? do_swap_page+0x128/0x4930
[  220.987634][ T5856]  ? __pfx_do_swap_page+0x10/0x10
[  220.987643][ T5856]  ? __pte_offset_map+0x1ae/0x240
[  220.987654][ T5856]  ? pte_offset_map_rw_nolock+0xea/0x160
[  220.987666][ T5856]  handle_mm_fault+0x124c/0x3070
[  220.987681][ T5856]  ? handle_mm_fault+0xec/0x3070
[  220.987695][ T5856]  ? __pfx_handle_mm_fault+0x10/0x10
[  220.987705][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
[  220.987726][ T5856]  do_user_addr_fault+0xa4d/0x1340
[  220.987738][ T5856]  ? trace_page_fault_user+0x84/0x1e0
[  220.987747][ T5856]  exc_page_fault+0x6a/0xc0
[  220.987759][ T5856]  asm_exc_page_fault+0x26/0x30
[  220.987767][ T5856] RIP: 0033:0x7feeb916e49e
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[+] Iteration 2500
[  220.987776][ T5856] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  220.987783][ T5856] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  220.987790][ T5856] RAX: fffffffffffffff4 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  220.987797][ T5856] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000031
[  220.987802][ T5856] RBP: 0000000000000031 R08: 0000000000000000 R09: 0000000000000000
[  220.987807][ T5856] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
** 33 printk messages dropped **
[  221.000905][ T5880]  ? __pfx_do_swap_page+0x10/0x10
** 43 printk messages dropped **
[  221.001802][ T6127]  ? swap_table_get+0x216/0x260
[  221.001812][ T6127]  ? swap_cache_get_folio+0x2e7/0x2f0
[  221.001825][ T6127]  do_swap_page+0x344/0x4930
[  221.001836][ T6127]  ? __pte_offset_map+0x29/0x240
** 49 printk messages dropped **
[  221.006965][ T5880]  do_swap_page+0x344/0x4930
** 1 printk messages dropped **
[  221.006987][ T5880]  ? __pte_offset_map+0x29/0x240
** 50 printk messages dropped **
[  221.009202][ T5856]  ? __pte_offset_map+0x29/0x240
[  221.009214][ T5856]  ? __lock_acquire+0x683/0x2cf0
** 50 printk messages dropped **
[  221.014542][ T5880]  ? __lock_acquire+0x683/0x2cf0
[  221.014549][ T5880]  ? do_swap_page+0x128/0x4930
[  221.014559][ T5880]  ? __pfx_do_swap_page+0x10/0x10
[  221.014568][ T5880]  ? __pte_offset_map+0x1ae/0x240
[  221.014579][ T5880]  ? pte_offset_map_rw_nolock+0xea/0x160
[  221.014591][ T5880]  handle_mm_fault+0x124c/0x3070
[  221.014607][ T5880]  ? handle_mm_fault+0xec/0x3070
[  221.014620][ T5880]  ? __pfx_handle_mm_fault+0x10/0x10
[  221.014630][ T5880]  ? lock_vma_under_rcu+0x45a/0x500
[  221.014651][ T5880]  do_user_addr_fault+0xa4d/0x1340
[  221.014663][ T5880]  ? trace_page_fault_user+0x84/0x1e0
[  221.014673][ T5880]  exc_page_fault+0x6a/0xc0
[  221.014684][ T5880]  asm_exc_page_fault+0x26/0x30
[  221.014692][ T5880] RIP: 0033:0x7feeb916e49e
[  221.014701][ T5880] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  221.014709][ T5880] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  221.014717][ T5880] RAX: 0000000000000008 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  221.014723][ T5880] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000061
[  221.014728][ T5880] RBP: 0000000000000061 R08: 0000000000000000 R09: 0000000000000000
[  221.014733][ T5880] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  221.014739][ T5880] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  221.014751][ T5880]  </TASK>
[  221.014775][ T5880] FAULT_INJECTION: forcing a failure.
[  221.014775][ T5880] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  221.029244][ T6127] CPU: 1 UID: 0 PID: 6127 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  221.029256][ T6127] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  221.029262][ T6127] Call Trace:
[  221.029265][ T6127]  <TASK>
[  221.029269][ T6127]  dump_stack_lvl+0xe8/0x150
[  221.029283][ T6127]  should_fail_ex+0x40c/0x560
[  221.029298][ T6127]  prepare_alloc_pages+0x230/0x650
[  221.029341][ T6127]  __alloc_frozen_pages_noprof+0x12f/0x380
[  221.029356][ T6127]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  221.029372][ T6127]  ? policy_nodemask+0x27c/0x720
[  221.029384][ T6127]  alloc_pages_mpol+0x212/0x380
[  221.029395][ T6127]  folio_alloc_mpol_noprof+0x39/0x160
[  221.029405][ T6127]  swap_cache_alloc_folio+0x2c1/0x990
[  221.029421][ T6127]  swap_cluster_readahead+0x4d9/0x640
[  221.029435][ T6127]  ? __pfx_swap_cluster_readahead+0x10/0x10
** 16 printk messages dropped **
[  221.029617][ T6127]  ? __pte_offset_map+0x1ae/0x240
** 50 printk messages dropped **
[  221.031572][ T5880]  ? __pte_offset_map+0x1ae/0x240
** 20 printk messages dropped **
[  221.036001][ T5880] CPU: 0 UID: 0 PID: 5880 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
** 50 printk messages dropped **
[  221.039002][ T6127] CPU: 1 UID: 0 PID: 6127 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  221.039014][ T6127] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  221.039019][ T6127] Call Trace:
[  221.039023][ T6127]  <TASK>
[  221.039027][ T6127]  dump_stack_lvl+0xe8/0x150
[  221.039042][ T6127]  should_fail_ex+0x40c/0x560
[  221.039057][ T6127]  prepare_alloc_pages+0x230/0x650
** 46 printk messages dropped **
[  221.040836][ T5880] Call Trace:
[  221.040839][ T5880]  <TASK>
** 49 printk messages dropped **
[  221.051155][ T6134] Call Trace:
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[+] Iteration 2500
[  221.051159][ T6134]  <TASK>
[  221.051163][ T6134]  dump_stack_lvl+0xe8/0x150
[  221.051178][ T6134]  should_fail_ex+0x40c/0x560
[  221.051193][ T6134]  prepare_alloc_pages+0x230/0x650
[  221.051209][ T6134]  __alloc_frozen_pages_noprof+0x12f/0x380
[  221.051224][ T6134]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  221.051241][ T6134]  ? policy_nodemask+0x27c/0x720
[  221.051253][ T6134]  alloc_pages_mpol+0x212/0x380
[  221.051265][ T6134]  allocate_slab+0x131/0x5e0
[  221.051275][ T6134]  ? kfree+0x1c5/0x640
[  221.051287][ T6134]  ___slab_alloc+0x16a/0x950
[  221.051322][ T6134]  kmem_cache_alloc_noprof+0x135/0x5f0
[  221.051336][ T6134]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  221.051346][ T6134]  ? rpc_malloc+0xeb/0x260
[  221.051358][ T6134]  ? rpc_malloc+0xeb/0x260
[  221.051372][ T6134]  rpc_malloc+0xeb/0x260
[  221.051386][ T6134]  call_allocate+0x26d/0x680
[  221.051397][ T6134]  ? __pfx_call_allocate+0x10/0x10
[  221.051409][ T6134]  __rpc_execute+0x526/0x1280
[  221.051427][ T6134]  ? __pfx___rpc_execute+0x10/0x10
[  221.051440][ T6134]  ? rpc_task_get_xprt+0x26/0x250
[  221.051451][ T6134]  ? rpc_make_runnable+0xae/0x1c0
[  221.051464][ T6134]  rpc_execute+0x1c1/0x390
[  221.051477][ T6134]  rpc_run_task+0x4a6/0x660
[  221.051487][ T6134]  rpc_create_xprt+0x533/0xa90
[  221.051497][ T6134]  ? __pfx_rpc_create_xprt+0x10/0x10
[  221.051513][ T6134]  ? rcu_is_watching+0x15/0xb0
[  221.051524][ T6134]  ? trace_kmalloc+0x2a/0xf0
[  221.051538][ T6134]  ? __kmalloc_node_track_caller_noprof+0x2fd/0x730
[  221.051550][ T6134]  ? xprt_create_transport+0x39b/0x5f0
[  221.051565][ T6134]  ? xprt_create_transport+0x438/0x5f0
[  221.051576][ T6134]  rpc_create+0x649/0x900
[  221.051590][ T6134]  ? __pfx_rpc_create+0x10/0x10
[  221.051617][ T6134]  ? __lock_acquire+0x683/0x2cf0
[  221.051630][ T6134]  rpcb_create_af_local+0x1c7/0x3c0
[  221.051640][ T6134]  ? __pfx_rpcb_create_af_local+0x10/0x10
[  221.051658][ T6134]  ? do_raw_spin_unlock+0xf5/0x210
[  221.051670][ T6134]  rpcb_create_local+0x28f/0x670
[  221.051680][ T6134]  ? __pfx_rpcb_create_local+0x10/0x10
[  221.051688][ T6134]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  221.051699][ T6134]  ? lockdep_hardirqs_on+0x7a/0x110
[  221.051709][ T6134]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  221.051719][ T6134]  ? __percpu_counter_init_many+0x35f/0x380
[  221.051733][ T6134]  ? __svc_create+0x88f/0x990
[  221.051747][ T6134]  svc_bind+0x1b4/0x230
** 20 printk messages dropped **
[  221.052016][ T6134]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
** 55 printk messages dropped **
[  221.052686][ T5856] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
** 16 printk messages dropped **
[  221.054150][ T5880]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
** 50 printk messages dropped **
[  221.057710][ T6127]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  221.057727][ T6127]  ? policy_nodemask+0x27c/0x720
[  221.057738][ T6127]  alloc_pages_mpol+0x212/0x380
[  221.057749][ T6127]  folio_alloc_mpol_noprof+0x39/0x160
[  221.057760][ T6127]  swap_cache_alloc_folio+0x2c1/0x990
[  221.057776][ T6127]  swap_cluster_readahead+0x4d9/0x640
[  221.057790][ T6127]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  221.057806][ T6127]  ? get_vma_policy+0x27b/0x3c0
[  221.057816][ T6127]  swapin_readahead+0x19a/0xc10
[  221.057828][ T6127]  ? swap_table_get+0x1e/0x260
[  221.057838][ T6127]  ? swap_table_get+0x1e/0x260
** 42 printk messages dropped **
[  221.080690][ T5880]  alloc_pages_mpol+0x212/0x380
[  221.080702][ T5880]  folio_alloc_mpol_noprof+0x39/0x160
** 51 printk messages dropped **
[  221.082217][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
[  221.082233][ T5856]  swap_cluster_readahead+0x4d9/0x640
[  221.082246][ T5856]  ? __pfx_swap_cluster_readahead+0x10/0x10
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[+] Iteration 2500
[  221.082262][ T5856]  ? get_vma_policy+0x27b/0x3c0
[  221.082272][ T5856]  swapin_readahead+0x19a/0xc10
[  221.082285][ T5856]  ? swap_table_get+0x1e/0x260
[  221.082319][ T5856]  ? swap_table_get+0x1e/0x260
[  221.082331][ T5856]  ? __pfx_swapin_readahead+0x10/0x10
[  221.082342][ T5856]  ? swap_table_get+0x1e/0x260
[  221.082352][ T5856]  ? swap_table_get+0x1e/0x260
[  221.082361][ T5856]  ? swap_table_get+0x1e/0x260
[  221.082371][ T5856]  ? swap_table_get+0x216/0x260
[  221.082381][ T5856]  ? swap_cache_get_folio+0x2e7/0x2f0
[  221.082394][ T5856]  do_swap_page+0x344/0x4930
[  221.082406][ T5856]  ? __pte_offset_map+0x29/0x240
[  221.082417][ T5856]  ? __pte_offset_map+0x29/0x240
[  221.082429][ T5856]  ? __lock_acquire+0x683/0x2cf0
[  221.082437][ T5856]  ? do_swap_page+0x128/0x4930
[  221.082446][ T5856]  ? __pfx_do_swap_page+0x10/0x10
[  221.082455][ T5856]  ? __pte_offset_map+0x1ae/0x240
[  221.082468][ T5856]  ? pte_offset_map_rw_nolock+0xea/0x160
[  221.082480][ T5856]  handle_mm_fault+0x124c/0x3070
[  221.082495][ T5856]  ? handle_mm_fault+0xec/0x3070
[  221.082509][ T5856]  ? __pfx_handle_mm_fault+0x10/0x10
[  221.082518][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
[  221.082539][ T5856]  do_user_addr_fault+0xa4d/0x1340
[  221.082551][ T5856]  ? trace_page_fault_user+0x84/0x1e0
[  221.082560][ T5856]  exc_page_fault+0x6a/0xc0
[  221.082572][ T5856]  asm_exc_page_fault+0x26/0x30
[  221.082580][ T5856] RIP: 0033:0x7feeb916e49e
[  221.082588][ T5856] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  221.082595][ T5856] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  221.082603][ T5856] RAX: fffffffffffffff4 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  221.082609][ T5856] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000031
[  221.082615][ T5856] RBP: 0000000000000031 R08: 0000000000000000 R09: 0000000000000000
[  221.082620][ T5856] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  221.082625][ T5856] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
** 17 printk messages dropped **
[  221.086149][ T5880]  ? get_vma_policy+0x27b/0x3c0
[  221.086159][ T5880]  swapin_readahead+0x19a/0xc10
[  221.086171][ T5880]  ? swap_table_get+0x1e/0x260
[  221.086181][ T5880]  ? swap_table_get+0x1e/0x260
[  221.086192][ T5880]  ? __pfx_swapin_readahead+0x10/0x10
** 52 printk messages dropped **
[  221.090851][ T5856]  ? swap_table_get+0x1e/0x260
** 25 printk messages dropped **
[  221.091122][ T5856] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
** 48 printk messages dropped **
[  221.095387][ T5880] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000061
[  221.095393][ T5880] RBP: 0000000000000061 R08: 0000000000000000 R09: 0000000000000000
[  221.095398][ T5880] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
** 54 printk messages dropped **
[  221.133176][ T6134]  ? __pfx_nfsd_create_serv+0x10/0x10
[  221.133188][ T6134]  ? sscanf+0xe2/0x140
[  221.133198][ T6134]  ? net_generic+0x1e/0x240
[  221.133210][ T6134]  ? __pfx_sscanf+0x10/0x10
[  221.133220][ T6134]  ? net_generic+0x1e/0x240
[  221.133232][ T6134]  ? net_generic+0x1e/0x240
[  221.133246][ T6134]  write_ports+0x669/0xd10
[  221.133256][ T6134]  ? __pfx_write_ports+0x10/0x10
[  221.133273][ T6134]  ? _copy_from_user+0x94/0xb0
[  221.133283][ T6134]  ? simple_transaction_get+0x12d/0x160
[  221.133317][ T6134]  nfsctl_transaction_write+0x10f/0x160
[  221.133327][ T6134]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  221.133336][ T6134]  vfs_write+0x296/0xba0
[  221.133350][ T6134]  ? __pfx_vfs_write+0x10/0x10
[  221.133360][ T6134]  ? lockdep_hardirqs_on+0x7a/0x110
[  221.133375][ T6134]  ? fput_close_sync+0x11f/0x240
[  221.133387][ T6134]  ksys_write+0x150/0x270
[  221.133399][ T6134]  ? __pfx_ksys_write+0x10/0x10
[  221.133413][ T6134]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  221.133422][ T6134]  do_syscall_64+0x174/0x580
[  221.133433][ T6134]  ? trace_irq_disable+0x3b/0x140
[  221.133441][ T6134]  ? clear_bhb_loop+0x70/0xc0
[  221.133452][ T6134]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  221.133461][ T6134] RIP: 0033:0x7feeb916e49e
[  221.133470][ T6134] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  221.133477][ T6134] RSP: 002b:00007fff9882b788 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  221.133487][ T6134] RAX: ffffffffffffffda RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  221.133494][ T6134] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 000000000000020f
[  221.133499][ T6134] RBP: 000000000000020f R08: 0000000000000000 R09: 0000000000000000
[  221.133504][ T6134] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  221.133510][ T6134] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  221.133523][ T6134]  </TASK>
[  221.133549][ T5856] CPU: 1 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  221.133559][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[  221.133564][ T5856] Call Trace:
[  221.133568][ T5856]  <TASK>
[  221.133571][ T5856]  dump_stack_lvl+0xe8/0x150
[  221.133584][ T5856]  should_fail_ex+0x40c/0x560
** 17 printk messages dropped **
[  221.133822][ T5856]  ? swap_table_get+0x216/0x260
** 76 printk messages dropped **
[  221.139867][ T6127]  </TASK>
** 50 printk messages dropped **
[  221.146928][ T5856]  </TASK>
** 3 printk messages dropped **
[  221.170651][ T6127] Call Trace:
** 48 printk messages dropped **
[  221.175715][ T5856] CPU: 1 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  221.175728][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  221.175734][ T5856] Call Trace:
** 48 printk messages dropped **
[  221.179079][ T6127] CPU: 0 UID: 0 PID: 6127 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
[  221.179091][ T6127] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  221.179096][ T6127] Call Trace:
[  221.179100][ T6127]  <TASK>
[  221.179104][ T6127]  dump_stack_lvl+0xe8/0x150
[  221.179119][ T6127]  should_fail_ex+0x40c/0x560
[  221.179134][ T6127]  prepare_alloc_pages+0x230/0x650
[  221.179150][ T6127]  __alloc_frozen_pages_noprof+0x12f/0x380
[  221.179165][ T6127]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  221.179181][ T6127]  ? policy_nodemask+0x27c/0x720
[  221.179193][ T6127]  alloc_pages_mpol+0x212/0x380
[  221.179204][ T6127]  folio_alloc_mpol_noprof+0x39/0x160
[  221.179215][ T6127]  swap_cache_alloc_folio+0x2c1/0x990
[  221.179231][ T6127]  swap_cluster_readahead+0x4d9/0x640
[  221.179245][ T6127]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  221.179261][ T6127]  ? get_vma_policy+0x27b/0x3c0
[  221.179271][ T6127]  swapin_readahead+0x19a/0xc10
[  221.179305][ T6127]  ? swap_table_get+0x1e/0x260
[  221.179318][ T6127]  ? swap_table_get+0x1e/0x260
[  221.179328][ T6127]  ? __pfx_swapin_readahead+0x10/0x10
[  221.179340][ T6127]  ? swap_table_get+0x1e/0x260
[  221.179349][ T6127]  ? swap_table_get+0x1e/0x260
[  221.179358][ T6127]  ? swap_table_get+0x1e/0x260
[  221.179368][ T6127]  ? swap_table_get+0x216/0x260
[  221.179379][ T6127]  ? swap_cache_get_folio+0x2e7/0x2f0
[  221.179391][ T6127]  do_swap_page+0x344/0x4930
[  221.179404][ T6127]  ? __pte_offset_map+0x29/0x240
[  221.179415][ T6127]  ? __pte_offset_map+0x29/0x240
[  221.179427][ T6127]  ? __lock_acquire+0x683/0x2cf0
[  221.179435][ T6127]  ? do_swap_page+0x128/0x4930
[  221.179445][ T6127]  ? __pfx_do_swap_page+0x10/0x10
[  221.179454][ T6127]  ? __pte_offset_map+0x1ae/0x240
[  221.179465][ T6127]  ? pte_offset_map_rw_nolock+0xea/0x160
[  221.179477][ T6127]  handle_mm_fault+0x124c/0x3070
[  221.179493][ T6127]  ? handle_mm_fault+0xec/0x3070
[  221.179507][ T6127]  ? __pfx_handle_mm_fault+0x10/0x10
[  221.179516][ T6127]  ? lock_vma_under_rcu+0x45a/0x500
[  221.179537][ T6127]  do_user_addr_fault+0xa4d/0x1340
[  221.179550][ T6127]  ? trace_page_fault_user+0x84/0x1e0
[  221.179560][ T6127]  exc_page_fault+0x6a/0xc0
[  221.179571][ T6127]  asm_exc_page_fault+0x26/0x30
[  221.179580][ T6127] RIP: 0033:0x7feeb916e49e
[  221.179588][ T6127] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  221.179596][ T6127] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  221.179604][ T6127] RAX: fffffffffffffff4 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  221.179610][ T6127] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000200
[  221.179616][ T6127] RBP: 0000000000000200 R08: 0000000000000000 R09: 0000000000000000
[  221.179621][ T6127] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  221.179626][ T6127] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
** 4 printk messages dropped **
[  221.184988][ T5856] Call Trace:
[  221.184992][ T5856]  <TASK>
[  221.184995][ T5856]  dump_stack_lvl+0xe8/0x150
[  221.185010][ T5856]  should_fail_ex+0x40c/0x560
[  221.185025][ T5856]  prepare_alloc_pages+0x230/0x650
** 78 printk messages dropped **
[  221.200975][ T6127]  ? handle_mm_fault+0xec/0x3070
[  221.200988][ T6127]  ? __pfx_handle_mm_fault+0x10/0x10
[  221.200998][ T6127]  ? lock_vma_under_rcu+0x45a/0x500
[  221.201019][ T6127]  do_user_addr_fault+0xa4d/0x1340
[  221.201032][ T6127]  ? trace_page_fault_user+0x84/0x1e0
[  221.201041][ T6127]  exc_page_fault+0x6a/0xc0
[  221.201053][ T6127]  asm_exc_page_fault+0x26/0x30
[  221.201061][ T6127] RIP: 0033:0x7feeb916e49e
[  221.201070][ T6127] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
** 40 printk messages dropped **
[  221.209472][ T5880]  ? __pte_offset_map+0x1ae/0x240
** 51 printk messages dropped **
[  221.211105][ T6134]  ? xprt_create_transport+0x39b/0x5f0
[  221.211121][ T6134]  ? xprt_create_transport+0x438/0x5f0
[  221.211131][ T6134]  rpc_create+0x649/0x900
[  221.211145][ T6134]  ? __pfx_rpc_create+0x10/0x10
[  221.211172][ T6134]  ? __lock_acquire+0x683/0x2cf0
[  221.211185][ T6134]  rpcb_create_af_local+0x1c7/0x3c0
[  221.211194][ T6134]  ? __pfx_rpcb_create_af_local+0x10/0x10
** 44 printk messages dropped **
[  221.211724][ T5856] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  221.211729][ T5856] Call Trace:
[  221.211733][ T5856]  <TASK>
[  221.211736][ T5856]  dump_stack_lvl+0xe8/0x150
[  221.211748][ T5856]  should_fail_ex+0x40c/0x560
[  221.211763][ T5856]  prepare_alloc_pages+0x230/0x650
[  221.211778][ T5856]  __alloc_frozen_pages_noprof+0x12f/0x380
[  221.211798][ T5856]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  221.211814][ T5856]  ? policy_nodemask+0x27c/0x720
[  221.211825][ T5856]  alloc_pages_mpol+0x212/0x380
[  221.211853][ T5856]  folio_alloc_mpol_noprof+0x39/0x160
[  221.211863][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
[  221.211880][ T5856]  swap_cluster_readahead+0x4d9/0x640
[  221.211893][ T5856]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  221.211909][ T5856]  ? get_vma_policy+0x27b/0x3c0
[  221.211919][ T5856]  swapin_readahead+0x19a/0xc10
[  221.211931][ T5856]  ? swap_table_get+0x1e/0x260
[  221.211942][ T5856]  ? swap_table_get+0x1e/0x260
[  221.211952][ T5856]  ? __pfx_swapin_readahead+0x10/0x10
[  221.211964][ T5856]  ? swap_table_get+0x1e/0x260
[  221.211974][ T5856]  ? swap_table_get+0x1e/0x260
[  221.211983][ T5856]  ? swap_table_get+0x1e/0x260
[  221.211993][ T5856]  ? swap_table_get+0x216/0x260
[  221.212003][ T5856]  ? swap_cache_get_folio+0x2e7/0x2f0
[  221.212016][ T5856]  do_swap_page+0x344/0x4930
[  221.212028][ T5856]  ? __pte_offset_map+0x29/0x240
[  221.212039][ T5856]  ? __pte_offset_map+0x29/0x240
[  221.212051][ T5856]  ? __lock_acquire+0x683/0x2cf0
[  221.212059][ T5856]  ? do_swap_page+0x128/0x4930
[  221.212068][ T5856]  ? __pfx_do_swap_page+0x10/0x10
[  221.212077][ T5856]  ? __pte_offset_map+0x1ae/0x240
[  221.212089][ T5856]  ? pte_offset_map_rw_nolock+0xea/0x160
[  221.212100][ T5856]  handle_mm_fault+0x124c/0x3070
[  221.212116][ T5856]  ? handle_mm_fault+0xec/0x3070
[  221.212130][ T5856]  ? __pfx_handle_mm_fault+0x10/0x10
[  221.212139][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
[  221.212161][ T5856]  do_user_addr_fault+0xa4d/0x1340
[  221.212174][ T5856]  ? trace_page_fault_user+0x84/0x1e0
[  221.212183][ T5856]  exc_page_fault+0x6a/0xc0
[  221.212194][ T5856]  asm_exc_page_fault+0x26/0x30
[  221.212202][ T5856] RIP: 0033:0x7feeb916e49e
[  221.212210][ T5856] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
** 10 printk messages dropped **
[  221.220621][ T6127] Call Trace:
** 1 printk messages dropped **
[  221.220628][ T6127]  dump_stack_lvl+0xe8/0x150
[  221.220645][ T6127]  should_fail_ex+0x40c/0x560
[  221.220660][ T6127]  prepare_alloc_pages+0x230/0x650
[  221.220677][ T6127]  __alloc_frozen_pages_noprof+0x12f/0x380
[  221.220692][ T6127]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  221.220708][ T6127]  ? policy_nodemask+0x27c/0x720
** 31 printk messages dropped **
[  221.221089][ T6127] RIP: 0033:0x7feeb916e49e
** 13 printk messages dropped **
[  221.223725][ T5856]  dump_stack_lvl+0xe8/0x150
** 1 printk messages dropped **
[  221.223754][ T5856]  prepare_alloc_pages+0x230/0x650
** 50 printk messages dropped **
[  221.227160][ T5880]  prepare_alloc_pages+0x230/0x650
[  221.227176][ T5880]  __alloc_frozen_pages_noprof+0x12f/0x380
[  221.227190][ T5880]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[+] Iteration 2500
[  221.227206][ T5880]  ? policy_nodemask+0x27c/0x720
[  221.227218][ T5880]  alloc_pages_mpol+0x212/0x380
[  221.227229][ T5880]  folio_alloc_mpol_noprof+0x39/0x160
[  221.227240][ T5880]  swap_cache_alloc_folio+0x2c1/0x990
[  221.227256][ T5880]  swap_cluster_readahead+0x4d9/0x640
[  221.227269][ T5880]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  221.227313][ T5880]  ? get_vma_policy+0x27b/0x3c0
[  221.227324][ T5880]  swapin_readahead+0x19a/0xc10
[  221.227336][ T5880]  ? swap_table_get+0x1e/0x260
[  221.227347][ T5880]  ? swap_table_get+0x1e/0x260
[  221.227357][ T5880]  ? __pfx_swapin_readahead+0x10/0x10
[  221.227369][ T5880]  ? swap_table_get+0x1e/0x260
[  221.227378][ T5880]  ? swap_table_get+0x1e/0x260
[  221.227387][ T5880]  ? swap_table_get+0x1e/0x260
[  221.227397][ T5880]  ? swap_table_get+0x216/0x260
[  221.227408][ T5880]  ? swap_cache_get_folio+0x2e7/0x2f0
[  221.227421][ T5880]  do_swap_page+0x344/0x4930
[  221.227432][ T5880]  ? __pte_offset_map+0x29/0x240
[  221.227443][ T5880]  ? __pte_offset_map+0x29/0x240
[  221.227456][ T5880]  ? __lock_acquire+0x683/0x2cf0
[  221.227463][ T5880]  ? do_swap_page+0x128/0x4930
[  221.227473][ T5880]  ? __pfx_do_swap_page+0x10/0x10
[  221.227482][ T5880]  ? __pte_offset_map+0x1ae/0x240
[  221.227493][ T5880]  ? pte_offset_map_rw_nolock+0xea/0x160
[  221.227505][ T5880]  handle_mm_fault+0x124c/0x3070
[  221.227521][ T5880]  ? handle_mm_fault+0xec/0x3070
[  221.227535][ T5880]  ? __pfx_handle_mm_fault+0x10/0x10
[  221.227544][ T5880]  ? lock_vma_under_rcu+0x45a/0x500
[  221.227565][ T5880]  do_user_addr_fault+0xa4d/0x1340
[  221.227577][ T5880]  ? trace_page_fault_user+0x84/0x1e0
[  221.227587][ T5880]  exc_page_fault+0x6a/0xc0
[  221.227599][ T5880]  asm_exc_page_fault+0x26/0x30
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[+] Iteration 2500
[  221.227607][ T5880] RIP: 0033:0x7feeb916e49e
[  221.227616][ T5880] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  221.227623][ T5880] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  221.227631][ T5880] RAX: 0000000000000008 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  221.227637][ T5880] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000061
[  221.227642][ T5880] RBP: 0000000000000061 R08: 0000000000000000 R09: 0000000000000000
[  221.227647][ T5880] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  221.227653][ T5880] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  221.227665][ T5880]  </TASK>
[  221.227686][ T5880] FAULT_INJECTION: forcing a failure.
[  221.227686][ T5880] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  221.230160][ T5856] CPU: 1 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
** 7 printk messages dropped **
[  221.230242][ T5856]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  221.230258][ T5856]  ? policy_nodemask+0x27c/0x720
[  221.230269][ T5856]  alloc_pages_mpol+0x212/0x380
[  221.230303][ T5856]  folio_alloc_mpol_noprof+0x39/0x160
[  221.230315][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
** 683 printk messages dropped **
[  221.434418][ T5856]  ? swap_table_get+0x1e/0x260
** 21 printk messages dropped **
[  221.434681][ T5856] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  221.434689][ T5856] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  221.434697][ T5856] RAX: fffffffffffffff4 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  221.434703][ T5856] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000031
[  221.434709][ T5856] RBP: 0000000000000031 R08: 0000000000000000 R09: 0000000000000000
[  221.434714][ T5856] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
** 45 printk messages dropped **
[  221.461338][ T5880] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
** 46 printk messages dropped **
[  221.469589][ T5880]  do_user_addr_fault+0xa4d/0x1340
[  221.469601][ T5880]  ? trace_page_fault_user+0x84/0x1e0
[  221.469611][ T5880]  exc_page_fault+0x6a/0xc0
[  221.469623][ T5880]  asm_exc_page_fault+0x26/0x30
[  221.469632][ T5880] RIP: 0033:0x7feeb916e49e
[  221.469641][ T5880] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  221.469648][ T5880] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[+] Iteration 2500
[  221.469657][ T5880] RAX: 0000000000000008 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
** 45 printk messages dropped **
[  221.486503][ T6134]  ? do_raw_spin_unlock+0xf5/0x210
[  221.486516][ T6134]  rpcb_create_local+0x28f/0x670
[  221.486526][ T6134]  ? __pfx_rpcb_create_local+0x10/0x10
[  221.486534][ T6134]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  221.486545][ T6134]  ? lockdep_hardirqs_on+0x7a/0x110
[  221.486556][ T6134]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  221.486566][ T6134]  ? __percpu_counter_init_many+0x35f/0x380
[  221.486581][ T6134]  ? __svc_create+0x88f/0x990
[  221.486594][ T6134]  svc_bind+0x1b4/0x230
[  221.486605][ T6134]  nfsd_create_serv+0x581/0x840
[  221.486618][ T6134]  ? kasan_save_track+0x3e/0x80
[  221.486629][ T6134]  ? __pfx_nfsd_create_serv+0x10/0x10
[  221.486641][ T6134]  ? sscanf+0xe2/0x140
[  221.486650][ T6134]  ? net_generic+0x1e/0x240
[  221.486663][ T6134]  ? __pfx_sscanf+0x10/0x10
[  221.486672][ T6134]  ? net_generic+0x1e/0x240
[  221.486684][ T6134]  ? net_generic+0x1e/0x240
[  221.486699][ T6134]  write_ports+0x669/0xd10
[  221.486709][ T6134]  ? __pfx_write_ports+0x10/0x10
[  221.486726][ T6134]  ? _copy_from_user+0x94/0xb0
[  221.486736][ T6134]  ? simple_transaction_get+0x12d/0x160
** 31 printk messages dropped **
[  221.525452][ T5856]  ? policy_nodemask+0x27c/0x720
** 2 printk messages dropped **
[  221.525485][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
[  221.525502][ T5856]  swap_cluster_readahead+0x4d9/0x640
[  221.525516][ T5856]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  221.525532][ T5856]  ? get_vma_policy+0x27b/0x3c0
[  221.525542][ T5856]  swapin_readahead+0x19a/0xc10
[  221.525554][ T5856]  ? swap_table_get+0x1e/0x260
[  221.525564][ T5856]  ? swap_table_get+0x1e/0x260
[  221.525574][ T5856]  ? __pfx_swapin_readahead+0x10/0x10
** 43 printk messages dropped **
[  221.529102][ T6127]  swap_cache_alloc_folio+0x2c1/0x990
** 50 printk messages dropped **
[  221.548398][ T5856]  folio_alloc_mpol_noprof+0x39/0x160
[  221.548408][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
[  221.548425][ T5856]  swap_cluster_readahead+0x4d9/0x640
[  221.548438][ T5856]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  221.548454][ T5856]  ? get_vma_policy+0x27b/0x3c0
[  221.548464][ T5856]  swapin_readahead+0x19a/0xc10
[  221.548477][ T5856]  ? swap_table_get+0x1e/0x260
[  221.548487][ T5856]  ? swap_table_get+0x1e/0x260
[  221.548497][ T5856]  ? __pfx_swapin_readahead+0x10/0x10
[  221.548513][ T5856]  ? swap_table_get+0x1e/0x260
[  221.548523][ T5856]  ? swap_table_get+0x1e/0x260
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[+] Iteration 2500
** 40 printk messages dropped **
[  221.549415][ T6127]  folio_alloc_mpol_noprof+0x39/0x160
** 81 printk messages dropped **
[  221.563147][ T6127] RIP: 0033:0x7feeb916e49e
[  221.563156][ T6127] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  221.563163][ T6127] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  221.563172][ T6127] RAX: fffffffffffffff4 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  221.563178][ T6127] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000200
[  221.563184][ T6127] RBP: 0000000000000200 R08: 0000000000000000 R09: 0000000000000000
[  221.563189][ T6127] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c

[host] Command execution timed out after 2m30s
 OtherCrashReports:<nil> StraceOutput:/strace -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f /syz-executor394804033

<...>
rame+0x77/0x7f
[  222.933527][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  222.933536][ T5901]  do_syscall_64+0x174/0x580
[  222.933546][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  222.933555][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  222.933565][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  222.933574][ T5901] RIP: 0033:0x7fcfafca149e
[  222.933584][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  222.933591][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  222.933602][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  222.933608][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  222.933614][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  222.933619][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  222.933624][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  222.933637][ T5901]  </TASK>
[  223.052740][ T5901] FAULT_INJECTION: forcing a failure.
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  223.052740][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[pid 10027] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[  223.057208][ T5901] CPU: 0 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  223.057220][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  223.057227][ T5901] Call Trace:
[  223.057231][ T5901]  <TASK>
[  223.057235][ T5901]  dump_stack_lvl+0xe8/0x150
[  223.057251][ T5901]  should_fail_ex+0x40c/0x560
[  223.057268][ T5901]  prepare_alloc_pages+0x230/0x650
[  223.057284][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  223.057299][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  223.057316][ T5901]  ? policy_nodemask+0x27c/0x720
[  223.057328][ T5901]  alloc_pages_mpol+0x212/0x380
[  223.057340][ T5901]  allocate_slab+0x131/0x5e0
[  223.057349][ T5901]  ? kfree+0x1c5/0x640
[  223.057361][ T5901]  ___slab_alloc+0x16a/0x950
[  223.057372][ T5901]  ? kmem_cache_alloc_noprof+0xbf/0x5f0
[  223.057385][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  223.057400][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  223.057411][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.057422][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.057436][ T5901]  rpc_malloc+0xeb/0x260
[  223.057449][ T5901]  call_allocate+0x26d/0x680
[  223.057461][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  223.057472][ T5901]  __rpc_execute+0x526/0x1280
[  223.057490][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  223.057503][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  223.057513][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  223.057526][ T5901]  rpc_execute+0x1c1/0x390
[  223.057538][ T5901]  rpc_run_task+0x4a6/0x660
[  223.057564][ T5901]  rpc_call_sync+0x10f/0x200
[  223.057573][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  223.057585][ T5901]  ? net_generic+0x1e/0x240
[  223.057594][ T5901]  ? net_generic+0x1e/0x240
[  223.057604][ T5901]  rpcb_register+0x2d0/0x530
[  223.057614][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  223.057621][ T5901]  ? net_generic+0x1e/0x240
[  223.057632][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  223.057643][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  223.057656][ T5901]  svc_unregister+0x24d/0x780
[  223.057671][ T5901]  svc_bind+0x1e9/0x230
[  223.057682][ T5901]  nfsd_create_serv+0x581/0x840
[  223.057694][ T5901]  ? kasan_save_track+0x3e/0x80
[  223.057706][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  223.057718][ T5901]  ? sscanf+0xe2/0x140
[  223.057729][ T5901]  ? net_generic+0x1e/0x240
[  223.057741][ T5901]  ? __pfx_sscanf+0x10/0x10
[  223.057750][ T5901]  ? net_generic+0x1e/0x240
[  223.057762][ T5901]  ? net_generic+0x1e/0x240
[  223.057776][ T5901]  write_ports+0x669/0xd10
[  223.057786][ T5901]  ? __pfx_write_ports+0x10/0x10
[  223.057802][ T5901]  ? _copy_from_user+0x94/0xb0
[  223.057813][ T5901]  ? simple_transaction_get+0x12d/0x160
[  223.057824][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  223.057833][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  223.057842][ T5901]  vfs_write+0x296/0xba0
[  223.057857][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  223.057871][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  223.057880][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  223.057894][ T5901]  ksys_write+0x150/0x270
[  223.057905][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  223.057918][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.057927][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.057936][ T5901]  do_syscall_64+0x174/0x580
[  223.057946][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.057955][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  223.057992][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.058001][ T5901] RIP: 0033:0x7fcfafca149e
[  223.058010][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  223.058018][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  223.058028][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  223.058034][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  223.058040][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  223.058045][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  223.058051][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  223.058063][ T5901]  </TASK>
[pid 10027] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555728886d0) = 10029
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[]/strace: Process 10029 attached
, [], 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid 10029] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
/strace: Process 10030 attached
[pid 10029] <... set_robust_list resumed>) = 0
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10030
[pid 10030] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid 10029] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10030] <... set_robust_list resumed>) = 0
[pid 10029] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10030] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10029] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10030] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10030] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[  223.260273][ T5901] FAULT_INJECTION: forcing a failure.
[  223.260273][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
/strace: Process 10031 attached
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10031
[  223.265379][ T5901] CPU: 0 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[pid 10031] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[  223.265399][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  223.265406][ T5901] Call Trace:
[  223.265410][ T5901]  <TASK>
[  223.265414][ T5901]  dump_stack_lvl+0xe8/0x150
[  223.265430][ T5901]  should_fail_ex+0x40c/0x560
[  223.265447][ T5901]  prepare_alloc_pages+0x230/0x650
[  223.265464][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  223.265479][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  223.265496][ T5901]  ? policy_nodemask+0x27c/0x720
[  223.265508][ T5901]  alloc_pages_mpol+0x212/0x380
[  223.265519][ T5901]  allocate_slab+0x131/0x5e0
[  223.265529][ T5901]  ? kfree+0x1c5/0x640
[  223.265541][ T5901]  ___slab_alloc+0x16a/0x950
[  223.265555][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  223.265567][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  223.265577][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.265589][ T5901]  ? rpc_malloc+0xeb/0x260
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10031] <... set_robust_list resumed>) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10031] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10031] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10031] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[  223.265603][ T5901]  rpc_malloc+0xeb/0x260
[  223.265616][ T5901]  call_allocate+0x26d/0x680
[  223.265629][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  223.265640][ T5901]  __rpc_execute+0x526/0x1280
[  223.265658][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  223.265671][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  223.265681][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  223.265694][ T5901]  rpc_execute+0x1c1/0x390
[  223.265707][ T5901]  rpc_run_task+0x4a6/0x660
[  223.265717][ T5901]  rpc_call_sync+0x10f/0x200
[  223.265725][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  223.265737][ T5901]  ? net_generic+0x1e/0x240
[  223.265745][ T5901]  ? net_generic+0x1e/0x240
[  223.265755][ T5901]  rpcb_register+0x2d0/0x530
[  223.265764][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  223.265772][ T5901]  ? net_generic+0x1e/0x240
[  223.265782][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  223.265792][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  223.265804][ T5901]  svc_unregister+0x24d/0x780
[  223.265819][ T5901]  svc_bind+0x1e9/0x230
[  223.265829][ T5901]  nfsd_create_serv+0x581/0x840
[  223.265841][ T5901]  ? kasan_save_track+0x3e/0x80
[  223.265852][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  223.265864][ T5901]  ? sscanf+0xe2/0x140
[  223.265874][ T5901]  ? net_generic+0x1e/0x240
[  223.265887][ T5901]  ? __pfx_sscanf+0x10/0x10
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10032 attached
 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10032
[pid 10032] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10032] <... set_robust_list resumed>) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10032] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 10032] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10033 attached
, child_tidptr=0x5555728886d0) = 10033
[pid 10033] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10033] <... set_robust_list resumed>) = 0
[  223.265896][ T5901]  ? net_generic+0x1e/0x240
[  223.265908][ T5901]  ? net_generic+0x1e/0x240
[  223.265922][ T5901]  write_ports+0x669/0xd10
[  223.265932][ T5901]  ? __pfx_write_ports+0x10/0x10
[  223.265988][ T5901]  ? _copy_from_user+0x94/0xb0
[  223.266006][ T5901]  ? simple_transaction_get+0x12d/0x160
[  223.266022][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  223.266032][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  223.266041][ T5901]  vfs_write+0x296/0xba0
[  223.266055][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  223.266070][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  223.266080][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  223.266094][ T5901]  ksys_write+0x150/0x270
[  223.266105][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  223.266123][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.266132][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.266141][ T5901]  do_syscall_64+0x174/0x580
[  223.266152][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.266160][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  223.266171][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.266179][ T5901] RIP: 0033:0x7fcfafca149e
[  223.266189][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  223.266197][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  223.266207][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  223.266213][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  223.266219][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  223.266224][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  223.266230][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  223.266242][ T5901]  </TASK>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10033] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 10033] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10034 attached
, child_tidptr=0x5555728886d0) = 10034
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10034] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10034] <... set_robust_list resumed>) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10034] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid 10034] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10035
[  223.390843][ T5901] FAULT_INJECTION: forcing a failure.
/strace: Process 10035 attached
[  223.390843][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[  223.395446][ T5901] CPU: 0 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[pid 10035] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  6259] <... unshare resumed>)      = 0
[  223.395460][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  223.395466][ T5901] Call Trace:
[  223.395471][ T5901]  <TASK>
[  223.395475][ T5901]  dump_stack_lvl+0xe8/0x150
[pid 10035] <... set_robust_list resumed>) = 0
[pid  6259] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10035] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  6259] <... socket resumed>)       = 706
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[  223.395494][ T5901]  should_fail_ex+0x40c/0x560
[  223.395511][ T5901]  prepare_alloc_pages+0x230/0x650
[  223.395528][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  223.395543][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  223.395560][ T5901]  ? policy_nodemask+0x27c/0x720
[  223.395572][ T5901]  alloc_pages_mpol+0x212/0x380
[  223.395584][ T5901]  allocate_slab+0x131/0x5e0
[  223.395594][ T5901]  ? kfree+0x1c5/0x640
[  223.395605][ T5901]  ___slab_alloc+0x16a/0x950
[  223.395619][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  223.395631][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  223.395641][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.395654][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.395668][ T5901]  rpc_malloc+0xeb/0x260
[  223.395681][ T5901]  call_allocate+0x26d/0x680
[  223.395692][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  223.395703][ T5901]  __rpc_execute+0x526/0x1280
[  223.395721][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  223.395734][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  223.395744][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[pid 10035] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6259] ioctl(706, SIOCGIFFLAGS, {ifr_name="lo" <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid 10035] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  6259] <... ioctl resumed>, ifr_flags=IFF_LOOPBACK}) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  6259] ioctl(706, SIOCSIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING} <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10037
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10038
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[  223.395757][ T5901]  rpc_execute+0x1c1/0x390
[  223.395769][ T5901]  rpc_run_task+0x4a6/0x660
[  223.395780][ T5901]  rpc_call_sync+0x10f/0x200
[  223.395789][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  223.395800][ T5901]  ? net_generic+0x1e/0x240
[  223.395808][ T5901]  ? net_generic+0x1e/0x240
[  223.395818][ T5901]  rpcb_register+0x2d0/0x530
[  223.395828][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  223.395835][ T5901]  ? net_generic+0x1e/0x240
[  223.395845][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  223.395855][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  223.395867][ T5901]  svc_unregister+0x24d/0x780
[  223.395882][ T5901]  svc_bind+0x1e9/0x230
[  223.395892][ T5901]  nfsd_create_serv+0x581/0x840
[  223.395905][ T5901]  ? kasan_save_track+0x3e/0x80
[  223.395916][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  223.395959][ T5901]  ? sscanf+0xe2/0x140
[  223.395970][ T5901]  ? net_generic+0x1e/0x240
[  223.395982][ T5901]  ? __pfx_sscanf+0x10/0x10
[  223.395996][ T5901]  ? net_generic+0x1e/0x240
[  223.396008][ T5901]  ? net_generic+0x1e/0x240
[  223.396023][ T5901]  write_ports+0x669/0xd10
[  223.396033][ T5901]  ? __pfx_write_ports+0x10/0x10
[  223.396049][ T5901]  ? _copy_from_user+0x94/0xb0
[  223.396059][ T5901]  ? simple_transaction_get+0x12d/0x160
[  223.396070][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  223.396079][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  223.396088][ T5901]  vfs_write+0x296/0xba0
[  223.396103][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  223.396117][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  223.396127][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  223.396140][ T5901]  ksys_write+0x150/0x270
[  223.396152][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  223.396165][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.396174][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.396183][ T5901]  do_syscall_64+0x174/0x580
[  223.396193][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.396202][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  223.396213][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.396221][ T5901] RIP: 0033:0x7fcfafca149e
[  223.396231][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  223.396238][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10039
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10040
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152/strace: Process 10041 attached
) = -1 EMFILE (Too many open files)
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10041
[pid 10041] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10041] <... set_robust_list resumed>) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10041] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10041] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10041] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
/strace: Process 10042 attached
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10042
[pid 10042] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10042] <... set_robust_list resumed>) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10042] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10042] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10042] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[  223.396249][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  223.396255][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  223.396261][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  223.396266][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  223.396271][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  223.396283][ T5901]  </TASK>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10043 attached
, child_tidptr=0x5555728886d0) = 10043
[pid 10043] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10043] <... set_robust_list resumed>) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[  223.519962][ T5901] FAULT_INJECTION: forcing a failure.
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10043] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  223.519962][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[pid 10043] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10043] unshare(CLONE_NEWNS|CLONE_NEWNET/strace: Process 10040 attached
[  223.525260][ T5901] CPU: 0 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
/strace: Process 10039 attached
/strace: Process 10038 attached
/strace: Process 10037 attached
[  223.525272][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  223.525279][ T5901] Call Trace:
[  223.525283][ T5901]  <TASK>
[  223.525287][ T5901]  dump_stack_lvl+0xe8/0x150
[  223.525304][ T5901]  should_fail_ex+0x40c/0x560
[  223.525320][ T5901]  prepare_alloc_pages+0x230/0x650
[  223.525337][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  223.525352][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  223.525368][ T5901]  ? policy_nodemask+0x27c/0x720
[  223.525380][ T5901]  alloc_pages_mpol+0x212/0x380
[  223.525392][ T5901]  allocate_slab+0x131/0x5e0
[  223.525402][ T5901]  ? kfree+0x1c5/0x640
[  223.525414][ T5901]  ___slab_alloc+0x16a/0x950
[  223.525427][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  223.525439][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  223.525450][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.525462][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.525477][ T5901]  rpc_malloc+0xeb/0x260
 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
/strace: Process 10044 attached
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10044
[  223.525491][ T5901]  call_allocate+0x26d/0x680
[  223.525503][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  223.525514][ T5901]  __rpc_execute+0x526/0x1280
[  223.525532][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  223.525545][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  223.525555][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  223.525568][ T5901]  rpc_execute+0x1c1/0x390
[  223.525581][ T5901]  rpc_run_task+0x4a6/0x660
[  223.525591][ T5901]  rpc_call_sync+0x10f/0x200
[  223.525599][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  223.525611][ T5901]  ? net_generic+0x1e/0x240
[  223.525619][ T5901]  ? net_generic+0x1e/0x240
[  223.525630][ T5901]  rpcb_register+0x2d0/0x530
[  223.525639][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  223.525647][ T5901]  ? net_generic+0x1e/0x240
[  223.525657][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  223.525666][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  223.525679][ T5901]  svc_unregister+0x24d/0x780
[  223.525694][ T5901]  svc_bind+0x1e9/0x230
[  223.525704][ T5901]  nfsd_create_serv+0x581/0x840
[  223.525716][ T5901]  ? kasan_save_track+0x3e/0x80
[  223.525728][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  223.525740][ T5901]  ? sscanf+0xe2/0x140
[  223.525750][ T5901]  ? net_generic+0x1e/0x240
[  223.525762][ T5901]  ? __pfx_sscanf+0x10/0x10
[  223.525771][ T5901]  ? net_generic+0x1e/0x240
[  223.525783][ T5901]  ? net_generic+0x1e/0x240
[  223.525798][ T5901]  write_ports+0x669/0xd10
[  223.525807][ T5901]  ? __pfx_write_ports+0x10/0x10
[  223.525824][ T5901]  ? _copy_from_user+0x94/0xb0
[  223.525834][ T5901]  ? simple_transaction_get+0x12d/0x160
[  223.525845][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  223.525854][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  223.525863][ T5901]  vfs_write+0x296/0xba0
[  223.525878][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  223.525892][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  223.525902][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  223.525950][ T5901]  ksys_write+0x150/0x270
[  223.525971][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  223.525997][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.526006][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.526015][ T5901]  do_syscall_64+0x174/0x580
[  223.526025][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.526034][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  223.526044][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.526053][ T5901] RIP: 0033:0x7fcfafca149e
[  223.526062][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  223.526070][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  223.526080][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  223.526086][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  223.526091][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  223.526096][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  223.526102][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  223.526115][ T5901]  </TASK>
[pid 10044] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10044] <... set_robust_list resumed>) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10044] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10044] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10044] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10045 attached
 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10045
[pid 10045] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10045] <... set_robust_list resumed>) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  223.651722][ T5901] FAULT_INJECTION: forcing a failure.
[  223.651722][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  223.655639][ T5901] CPU: 0 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  223.655651][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  223.655658][ T5901] Call Trace:
[  223.655662][ T5901]  <TASK>
[  223.655666][ T5901]  dump_stack_lvl+0xe8/0x150
[  223.655682][ T5901]  should_fail_ex+0x40c/0x560
[  223.655699][ T5901]  prepare_alloc_pages+0x230/0x650
[  223.655716][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  223.655732][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[pid 10045] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 10038] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid 10039] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid 10037] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid 10040] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  223.655749][ T5901]  ? policy_nodemask+0x27c/0x720
[  223.655761][ T5901]  alloc_pages_mpol+0x212/0x380
[  223.655773][ T5901]  allocate_slab+0x131/0x5e0
[  223.655783][ T5901]  ? kfree+0x1c5/0x640
[  223.655795][ T5901]  ___slab_alloc+0x16a/0x950
[  223.655808][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  223.655820][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  223.655831][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.655843][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.655857][ T5901]  rpc_malloc+0xeb/0x260
[  223.655870][ T5901]  call_allocate+0x26d/0x680
[  223.655882][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  223.655912][ T5901]  __rpc_execute+0x526/0x1280
[pid 10045] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10046
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
/strace: Process 10046 attached
[pid 10046] set_robust_list(0x5555728886e0, 24) = 0
[  223.655932][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  223.655945][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  223.655956][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  223.655969][ T5901]  rpc_execute+0x1c1/0x390
[  223.655981][ T5901]  rpc_run_task+0x4a6/0x660
[  223.655992][ T5901]  rpc_call_sync+0x10f/0x200
[  223.656000][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  223.656012][ T5901]  ? net_generic+0x1e/0x240
[  223.656020][ T5901]  ? net_generic+0x1e/0x240
[  223.656030][ T5901]  rpcb_register+0x2d0/0x530
[  223.656040][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  223.656048][ T5901]  ? net_generic+0x1e/0x240
[  223.656058][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  223.656067][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[pid 10046] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid 10046] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid 10046] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10047
/strace: Process 10047 attached
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10047] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10047] <... set_robust_list resumed>) = 0
[pid 10047] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 10047] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[  223.656080][ T5901]  svc_unregister+0x24d/0x780
[  223.656094][ T5901]  svc_bind+0x1e9/0x230
[  223.656105][ T5901]  nfsd_create_serv+0x581/0x840
[  223.656117][ T5901]  ? kasan_save_track+0x3e/0x80
[  223.656129][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  223.656141][ T5901]  ? sscanf+0xe2/0x140
[  223.656151][ T5901]  ? net_generic+0x1e/0x240
[  223.656163][ T5901]  ? __pfx_sscanf+0x10/0x10
[  223.656172][ T5901]  ? net_generic+0x1e/0x240
[  223.656184][ T5901]  ? net_generic+0x1e/0x240
[  223.656199][ T5901]  write_ports+0x669/0xd10
[  223.656209][ T5901]  ? __pfx_write_ports+0x10/0x10
[  223.656226][ T5901]  ? _copy_from_user+0x94/0xb0
[  223.656236][ T5901]  ? simple_transaction_get+0x12d/0x160
[  223.656247][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  223.656256][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  223.656265][ T5901]  vfs_write+0x296/0xba0
[  223.656280][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  223.656294][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  223.656304][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  223.656318][ T5901]  ksys_write+0x150/0x270
[  223.656329][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  223.656342][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.656351][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.656359][ T5901]  do_syscall_64+0x174/0x580
[  223.656370][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.656379][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  223.656389][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10048 attached
, child_tidptr=0x5555728886d0) = 10048
[pid 10048] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 10048] <... set_robust_list resumed>) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10048] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10048] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10048] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10049 attached
 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10049
[pid 10049] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10049] <... set_robust_list resumed>) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10049] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 10049] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10050 attached
 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10050
[pid 10050] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10050] <... set_robust_list resumed>) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10050] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10038] <... set_robust_list resumed>) = 0
[pid 10050] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10038] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10050] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid 10038] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  223.656397][ T5901] RIP: 0033:0x7fcfafca149e
[  223.656407][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  223.656415][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  223.656425][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  223.656431][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  223.656437][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  223.656458][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  223.656464][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  223.656476][ T5901]  </TASK>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10038] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10051
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10052 attached
 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10052
[pid 10052] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10052] <... set_robust_list resumed>) = 0
[  223.778105][ T5901] FAULT_INJECTION: forcing a failure.
[  223.778105][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10052] rt_sigprocmask(SIG_SETMASK, []/strace: Process 10051 attached
, NULL, 8) = 0
[pid 10040] <... set_robust_list resumed>) = 0
[pid 10039] <... set_robust_list resumed>) = 0
[pid 10037] <... set_robust_list resumed>) = 0
[  223.782308][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  223.782320][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  223.782326][ T5901] Call Trace:
[  223.782330][ T5901]  <TASK>
[  223.782335][ T5901]  dump_stack_lvl+0xe8/0x150
[  223.782351][ T5901]  should_fail_ex+0x40c/0x560
[  223.782368][ T5901]  prepare_alloc_pages+0x230/0x650
[  223.782385][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  223.782401][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  223.782417][ T5901]  ? policy_nodemask+0x27c/0x720
[  223.782429][ T5901]  alloc_pages_mpol+0x212/0x380
[  223.782441][ T5901]  allocate_slab+0x131/0x5e0
[  223.782451][ T5901]  ? kfree+0x1c5/0x640
[  223.782463][ T5901]  ___slab_alloc+0x16a/0x950
[  223.782477][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  223.782488][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  223.782499][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.782511][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.782525][ T5901]  rpc_malloc+0xeb/0x260
[  223.782538][ T5901]  call_allocate+0x26d/0x680
[  223.782550][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  223.782561][ T5901]  __rpc_execute+0x526/0x1280
[  223.782579][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  223.782591][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  223.782602][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  223.782614][ T5901]  rpc_execute+0x1c1/0x390
[  223.782627][ T5901]  rpc_run_task+0x4a6/0x660
[  223.782638][ T5901]  rpc_call_sync+0x10f/0x200
[  223.782646][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  223.782658][ T5901]  ? net_generic+0x1e/0x240
[  223.782666][ T5901]  ? net_generic+0x1e/0x240
[  223.782677][ T5901]  rpcb_register+0x2d0/0x530
[  223.782686][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  223.782693][ T5901]  ? net_generic+0x1e/0x240
[  223.782704][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  223.782713][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  223.782725][ T5901]  svc_unregister+0x24d/0x780
[  223.782740][ T5901]  svc_bind+0x1e9/0x230
[  223.782751][ T5901]  nfsd_create_serv+0x581/0x840
[  223.782763][ T5901]  ? kasan_save_track+0x3e/0x80
[  223.782774][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  223.782786][ T5901]  ? sscanf+0xe2/0x140
[  223.782797][ T5901]  ? net_generic+0x1e/0x240
[  223.782809][ T5901]  ? __pfx_sscanf+0x10/0x10
[  223.782818][ T5901]  ? net_generic+0x1e/0x240
[  223.782830][ T5901]  ? net_generic+0x1e/0x240
[  223.782844][ T5901]  write_ports+0x669/0xd10
[  223.782854][ T5901]  ? __pfx_write_ports+0x10/0x10
[  223.782871][ T5901]  ? _copy_from_user+0x94/0xb0
[  223.782902][ T5901]  ? simple_transaction_get+0x12d/0x160
[  223.782914][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  223.782924][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  223.782932][ T5901]  vfs_write+0x296/0xba0
[  223.782948][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  223.782962][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  223.782973][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  223.782987][ T5901]  ksys_write+0x150/0x270
[  223.782999][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  223.783011][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.783020][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.783029][ T5901]  do_syscall_64+0x174/0x580
[  223.783040][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.783053][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  223.783064][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.783073][ T5901] RIP: 0033:0x7fcfafca149e
[  223.783082][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  223.783089][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  223.783100][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  223.783106][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  223.783111][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  223.783117][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  223.783123][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  223.783135][ T5901]  </TASK>
[  223.919117][ T5901] FAULT_INJECTION: forcing a failure.
[  223.919117][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  223.923135][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  223.923161][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  223.923167][ T5901] Call Trace:
[  223.923172][ T5901]  <TASK>
[  223.923176][ T5901]  dump_stack_lvl+0xe8/0x150
[  223.923193][ T5901]  should_fail_ex+0x40c/0x560
[  223.923209][ T5901]  prepare_alloc_pages+0x230/0x650
[  223.923227][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  223.923243][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  223.923259][ T5901]  ? policy_nodemask+0x27c/0x720
[  223.923271][ T5901]  alloc_pages_mpol+0x212/0x380
[  223.923283][ T5901]  allocate_slab+0x131/0x5e0
[  223.923294][ T5901]  ? kfree+0x1c5/0x640
[  223.923306][ T5901]  ___slab_alloc+0x16a/0x950
[  223.923320][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  223.923332][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  223.923342][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.923354][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.923368][ T5901]  rpc_malloc+0xeb/0x260
[  223.923381][ T5901]  call_allocate+0x26d/0x680
[  223.923393][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  223.923404][ T5901]  __rpc_execute+0x526/0x1280
[  223.923422][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  223.923435][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  223.923445][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  223.923458][ T5901]  rpc_execute+0x1c1/0x390
[  223.923471][ T5901]  rpc_run_task+0x4a6/0x660
[  223.923481][ T5901]  rpc_call_sync+0x10f/0x200
[  223.923489][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  223.923501][ T5901]  ? net_generic+0x1e/0x240
[  223.923509][ T5901]  ? net_generic+0x1e/0x240
[  223.923520][ T5901]  rpcb_register+0x2d0/0x530
[  223.923529][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  223.923536][ T5901]  ? net_generic+0x1e/0x240
[  223.923547][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  223.923556][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  223.923569][ T5901]  svc_unregister+0x24d/0x780
[  223.923583][ T5901]  svc_bind+0x1e9/0x230
[  223.923594][ T5901]  nfsd_create_serv+0x581/0x840
[  223.923606][ T5901]  ? kasan_save_track+0x3e/0x80
[  223.923618][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  223.923630][ T5901]  ? sscanf+0xe2/0x140
[  223.923640][ T5901]  ? net_generic+0x1e/0x240
[  223.923652][ T5901]  ? __pfx_sscanf+0x10/0x10
[  223.923661][ T5901]  ? net_generic+0x1e/0x240
[  223.923673][ T5901]  ? net_generic+0x1e/0x240
[  223.923687][ T5901]  write_ports+0x669/0xd10
[  223.923697][ T5901]  ? __pfx_write_ports+0x10/0x10
[  223.923715][ T5901]  ? _copy_from_user+0x94/0xb0
[  223.923725][ T5901]  ? simple_transaction_get+0x12d/0x160
[  223.923736][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  223.923746][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  223.923754][ T5901]  vfs_write+0x296/0xba0
[  223.923769][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  223.923783][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  223.923793][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  223.923807][ T5901]  ksys_write+0x150/0x270
[  223.923819][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  223.923831][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.923840][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.923849][ T5901]  do_syscall_64+0x174/0x580
[  223.923860][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.923887][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  223.923898][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.923907][ T5901] RIP: 0033:0x7fcfafca149e
[  223.923917][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  223.923925][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  223.923934][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  223.923941][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  223.923946][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  223.923951][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  223.923957][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  223.923969][ T5901]  </TASK>
[  224.043424][ T5901] FAULT_INJECTION: forcing a failure.
[  224.043424][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  224.047387][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  224.047399][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  224.047405][ T5901] Call Trace:
[  224.047410][ T5901]  <TASK>
[  224.047414][ T5901]  dump_stack_lvl+0xe8/0x150
[  224.047431][ T5901]  should_fail_ex+0x40c/0x560
[  224.047448][ T5901]  prepare_alloc_pages+0x230/0x650
[  224.047466][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  224.047482][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  224.047498][ T5901]  ? policy_nodemask+0x27c/0x720
[  224.047510][ T5901]  alloc_pages_mpol+0x212/0x380
[  224.047522][ T5901]  allocate_slab+0x131/0x5e0
[  224.047532][ T5901]  ? kfree+0x1c5/0x640
[  224.047559][ T5901]  ___slab_alloc+0x16a/0x950
[  224.047571][ T5901]  ? kmem_cache_alloc_noprof+0xbf/0x5f0
[  224.047585][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  224.047596][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  224.047607][ T5901]  ? rpc_malloc+0xeb/0x260
[  224.047618][ T5901]  ? rpc_malloc+0xeb/0x260
[  224.047632][ T5901]  rpc_malloc+0xeb/0x260
[  224.047645][ T5901]  call_allocate+0x26d/0x680
[  224.047657][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  224.047668][ T5901]  __rpc_execute+0x526/0x1280
[  224.047686][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  224.047699][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  224.047709][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  224.047722][ T5901]  rpc_execute+0x1c1/0x390
[  224.047735][ T5901]  rpc_run_task+0x4a6/0x660
[  224.047745][ T5901]  rpc_call_sync+0x10f/0x200
[  224.047754][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  224.047766][ T5901]  ? net_generic+0x1e/0x240
[  224.047774][ T5901]  ? net_generic+0x1e/0x240
[  224.047784][ T5901]  rpcb_register+0x2d0/0x530
[  224.047794][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  224.047801][ T5901]  ? net_generic+0x1e/0x240
[  224.047811][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  224.047821][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  224.047833][ T5901]  svc_unregister+0x24d/0x780
[  224.047847][ T5901]  svc_bind+0x1e9/0x230
[  224.047877][ T5901]  nfsd_create_serv+0x581/0x840
[  224.047891][ T5901]  ? kasan_save_track+0x3e/0x80
[  224.047902][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  224.047914][ T5901]  ? sscanf+0xe2/0x140
[  224.047924][ T5901]  ? net_generic+0x1e/0x240
[  224.047936][ T5901]  ? __pfx_sscanf+0x10/0x10
[  224.047945][ T5901]  ? net_generic+0x1e/0x240
[  224.047957][ T5901]  ? net_generic+0x1e/0x240
[  224.047972][ T5901]  write_ports+0x669/0xd10
[  224.047981][ T5901]  ? __pfx_write_ports+0x10/0x10
[  224.047998][ T5901]  ? _copy_from_user+0x94/0xb0
[  224.048008][ T5901]  ? simple_transaction_get+0x12d/0x160
[  224.048019][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  224.048033][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  224.048042][ T5901]  vfs_write+0x296/0xba0
[  224.048057][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  224.048071][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  224.048081][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  224.048095][ T5901]  ksys_write+0x150/0x270
[  224.048107][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  224.048120][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.048129][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.048138][ T5901]  do_syscall_64+0x174/0x580
[  224.048148][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.048157][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  224.048167][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.048175][ T5901] RIP: 0033:0x7fcfafca149e
[  224.048185][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  224.048193][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  224.048203][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  224.048210][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  224.048215][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  224.048220][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  224.048226][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  224.048239][ T5901]  </TASK>
[pid 10052] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10051] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid 10040] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10039] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10037] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  6261] <... unshare resumed>)      = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid 10051] <... set_robust_list resumed>) = 0
[pid  6261] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid 10040] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10039] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10037] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10051] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  6261] <... socket resumed>)       = 708
[pid 10039] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid 10037] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid 10040] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid 10051] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6261] ioctl(708, SIOCGIFFLAGS, {ifr_name="lo" <unfinished ...>
[pid 10051] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  6261] <... ioctl resumed>, ifr_flags=IFF_LOOPBACK}) = 0
[pid  6261] ioctl(708, SIOCSIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING}) = 0
[pid  6261] close(708)                  = 0
[pid  6261] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL <unfinished ...>
[  224.240141][ T5901] slab_out_of_memory: 18 callbacks suppressed
[  224.240151][ T5901] SLUB: Unable to allocate memory on CPU 1 (of node 1) on node -1, gfp=0xcc0(GFP_KERNEL)
[  224.245106][ T5901]   cache: rpc_buffers, object size: 2048, buffer size: 2176, default order: 3, min order: 0
[  224.248961][ T5901]   node 0: slabs: 1, objs: 15, free: 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152/strace: Process 10054 attached
[  224.251155][ T5901]   node 1: slabs: 0, objs: 0, free: 0
 <unfinished ...>
[pid  6261] <... mount resumed>)        = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10054
[pid 10054] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  6261] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  6261] <... openat resumed>)       = 708
[pid 10054] <... set_robust_list resumed>) = 0
[pid  6261] openat(AT_FDCWD, "/tmp/nfsd/filehandle", O_RDWR <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10054] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  6261] <... openat resumed>)       = 709
[pid 10054] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid 10054] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  6261] write(709, "dummy", 5 <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  6261] <... write resumed>)        = -1 EINVAL (Invalid argument)
/strace: Process 10055 attached
[pid  6261] close(709 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10055
[pid  6261] <... close resumed>)        = 0
[pid 10055] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  6261] socket(AF_INET, SOCK_STREAM, IPPROTO_IP <unfinished ...>
[pid 10055] <... set_robust_list resumed>) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6261] <... socket resumed>)       = 709
[pid 10055] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  7190] <... unshare resumed>)      = 0
[pid 10055] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6261] close(709 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid 10055] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  7190] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  6261] <... close resumed>)        = 0
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  7190] <... socket resumed>)       = -1 EMFILE (Too many open files)
[pid  6261] socket(AF_INET, SOCK_STREAM, IPPROTO_IP <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  224.318302][ T5901] FAULT_INJECTION: forcing a failure.
[  224.318302][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  224.322301][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  224.322312][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  224.322319][ T5901] Call Trace:
[  224.322323][ T5901]  <TASK>
[  224.322327][ T5901]  dump_stack_lvl+0xe8/0x150
[  224.322344][ T5901]  should_fail_ex+0x40c/0x560
[  224.322373][ T5901]  prepare_alloc_pages+0x230/0x650
[  224.322392][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  224.322407][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  224.322436][ T5901]  ? policy_nodemask+0x27c/0x720
[  224.322450][ T5901]  alloc_pages_mpol+0x212/0x380
[  224.322462][ T5901]  allocate_slab+0x131/0x5e0
[  224.322472][ T5901]  ? kfree+0x1c5/0x640
[  224.322483][ T5901]  ___slab_alloc+0x16a/0x950
[  224.322497][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  224.322509][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  224.322519][ T5901]  ? rpc_malloc+0xeb/0x260
[  224.322531][ T5901]  ? rpc_malloc+0xeb/0x260
[  224.322545][ T5901]  rpc_malloc+0xeb/0x260
[  224.322558][ T5901]  call_allocate+0x26d/0x680
[  224.322569][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  224.322581][ T5901]  __rpc_execute+0x526/0x1280
[  224.322599][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  224.322611][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  224.322621][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  224.322634][ T5901]  rpc_execute+0x1c1/0x390
[  224.322647][ T5901]  rpc_run_task+0x4a6/0x660
[  224.322657][ T5901]  rpc_call_sync+0x10f/0x200
[  224.322665][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  224.322677][ T5901]  ? net_generic+0x1e/0x240
[  224.322685][ T5901]  ? net_generic+0x1e/0x240
[  224.322696][ T5901]  rpcb_register+0x2d0/0x530
[  224.322706][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  224.322713][ T5901]  ? net_generic+0x1e/0x240
[  224.322723][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  224.322733][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  7190] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL <unfinished ...>
[pid  6261] <... socket resumed>)       = 709
/strace: Process 10057 attached
[pid  7190] <... mount resumed>)        = 0
[pid  6261] close(709)                  = 0
[pid  6261] socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 709
[pid  7190] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  6261] close(709 <unfinished ...>
[pid  7190] <... openat resumed>)       = -1 EMFILE (Too many open files)
[pid  6261] <... close resumed>)        = 0
[pid  7190] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 123 <unfinished ...>
[pid  6261] socket(AF_INET, SOCK_STREAM, IPPROTO_IP <unfinished ...>
[pid  7190] <... write resumed>)        = 123
[pid  6261] <... socket resumed>)       = 709
[pid  7190] exit_group(0 <unfinished ...>
[pid  6261] close(709 <unfinished ...>
[pid  7190] <... exit_group resumed>)   = ?
[pid  6261] <... close resumed>)        = 0
[pid  6261] socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 709
[pid  6261] close(709)                  = 0
[pid  6261] openat(AT_FDCWD, "/proc/self/make-it-fail", O_WRONLY) = 709
[pid  6261] write(709, "1", 1)          = 1
[pid  6261] close(709)                  = 0
[  224.322745][ T5901]  svc_unregister+0x24d/0x780
[  224.322760][ T5901]  svc_bind+0x1e9/0x230
[pid  6261] write(708, "tcp 2049", 8 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10057
[  224.322770][ T5901]  nfsd_create_serv+0x581/0x840
[  224.322782][ T5901]  ? kasan_save_track+0x3e/0x80
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[  224.322794][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  224.322806][ T5901]  ? sscanf+0xe2/0x140
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[  224.322816][ T5901]  ? net_generic+0x1e/0x240
[  224.322847][ T5901]  ? __pfx_sscanf+0x10/0x10
[  224.322857][ T5901]  ? net_generic+0x1e/0x240
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[  224.322873][ T5901]  ? net_generic+0x1e/0x240
[  224.322888][ T5901]  write_ports+0x669/0xd10
[  224.322898][ T5901]  ? __pfx_write_ports+0x10/0x10
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[  224.322915][ T5901]  ? _copy_from_user+0x94/0xb0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[  224.322925][ T5901]  ? simple_transaction_get+0x12d/0x160
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10059
[  224.322936][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  224.322946][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[  224.322954][ T5901]  vfs_write+0x296/0xba0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[  224.322969][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  224.322983][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  224.322993][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[  224.323007][ T5901]  ksys_write+0x150/0x270
[  224.323018][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  224.323032][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152/strace: Process 10060 attached
 <unfinished ...>
[pid 10060] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[  224.323040][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10060
[  224.323049][ T5901]  do_syscall_64+0x174/0x580
[pid 10060] <... set_robust_list resumed>) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10060] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[  224.323060][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10060] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  224.323069][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  224.323079][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.323088][ T5901] RIP: 0033:0x7fcfafca149e
[pid 10060] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[  224.323097][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  224.323105][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  224.323115][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10061 attached
[  224.323121][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  224.323127][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  224.323132][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[  224.323137][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  224.323150][ T5901]  </TASK>
[  224.323213][ T5901] SLUB: Unable to allocate memory on CPU 1 (of node 1) on node -1, gfp=0xcc0(GFP_KERNEL)
[pid 10061] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10061
[pid 10061] <... set_robust_list resumed>) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10061] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[  224.470671][ T5901]   cache: rpc_buffers, object size: 2048, buffer size: 2176, default order: 3, min order: 0
[pid 10057] set_robust_list(0x5555728886e0, 24/strace: Process 10059 attached
[  224.477697][ T5901]   node 0: slabs: 1, objs: 15, free: 0
[  224.479558][ T5901]   node 1: slabs: 0, objs: 0, free: 0
 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10061] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10057] <... set_robust_list resumed>) = 0
[pid 10059] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  7191] <... unshare resumed>)      = 0
[pid 10061] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid 10059] <... set_robust_list resumed>) = 0
[pid 10057] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  7191] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10059] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10057] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  7191] <... socket resumed>)       = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  6265] <... unshare resumed>)      = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10059] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10057] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  7191] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid 10059] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  6265] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  7191] <... mount resumed>)        = 0
[pid  6265] <... socket resumed>)       = 713
[pid  6265] ioctl(713, SIOCGIFFLAGS, {ifr_name="lo", ifr_flags=IFF_LOOPBACK}) = 0
[pid  7191] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY/strace: Process 10063 attached
 <unfinished ...>
[pid  6265] ioctl(713, SIOCSIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING} <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10063
[pid  7191] <... openat resumed>)       = -1 EMFILE (Too many open files)
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10063] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  7191] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 123 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10063] <... set_robust_list resumed>) = 0
[pid  7191] <... write resumed>)        = 123
[pid  7191] exit_group(0 <unfinished ...>
[pid 10063] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  7191] <... exit_group resumed>)   = ?
[pid 10063] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10063] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[  224.547990][ T5901] FAULT_INJECTION: forcing a failure.
[  224.547990][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  224.552146][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  224.552158][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  224.552163][ T5901] Call Trace:
[  224.552168][ T5901]  <TASK>
[  224.552172][ T5901]  dump_stack_lvl+0xe8/0x150
[  224.552189][ T5901]  should_fail_ex+0x40c/0x560
[  224.552205][ T5901]  prepare_alloc_pages+0x230/0x650
[  224.552222][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  224.552238][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  224.552254][ T5901]  ? policy_nodemask+0x27c/0x720
[  224.552266][ T5901]  alloc_pages_mpol+0x212/0x380
[  224.552278][ T5901]  allocate_slab+0x131/0x5e0
[  224.552288][ T5901]  ? kfree+0x1c5/0x640
[  224.552300][ T5901]  ___slab_alloc+0x16a/0x950
[  224.552314][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  224.552326][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  224.552336][ T5901]  ? rpc_malloc+0xeb/0x260
[  224.552348][ T5901]  ? rpc_malloc+0xeb/0x260
[  224.552362][ T5901]  rpc_malloc+0xeb/0x260
[  224.552375][ T5901]  call_allocate+0x26d/0x680
[  224.552386][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  224.552398][ T5901]  __rpc_execute+0x526/0x1280
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10064 attached
[  224.552416][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  224.552429][ T5901]  ? rpc_task_get_xprt+0x26/0x250
 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  7193] <... unshare resumed>)      = 0
[  224.552439][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  224.552452][ T5901]  rpc_execute+0x1c1/0x390
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10064
[  224.552465][ T5901]  rpc_run_task+0x4a6/0x660
[  224.552475][ T5901]  rpc_call_sync+0x10f/0x200
[pid 10064] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[  224.552484][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10064] <... set_robust_list resumed>) = 0
[  224.552496][ T5901]  ? net_generic+0x1e/0x240
[  224.552504][ T5901]  ? net_generic+0x1e/0x240
[pid  7193] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[  224.552514][ T5901]  rpcb_register+0x2d0/0x530
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10064] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  7193] <... socket resumed>)       = -1 EMFILE (Too many open files)
[  224.552524][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10064] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  224.552531][ T5901]  ? net_generic+0x1e/0x240
[  224.552542][ T5901]  ? rpcb_create_local+0x4ee/0x670
[pid  7193] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  224.552551][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  224.552563][ T5901]  svc_unregister+0x24d/0x780
[pid 10064] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  7193] <... mount resumed>)        = 0
[  224.552578][ T5901]  svc_bind+0x1e9/0x230
[  224.552589][ T5901]  nfsd_create_serv+0x581/0x840
[  224.552601][ T5901]  ? kasan_save_track+0x3e/0x80
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[  224.552613][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  224.552625][ T5901]  ? sscanf+0xe2/0x140
[  224.552635][ T5901]  ? net_generic+0x1e/0x240
[  224.552647][ T5901]  ? __pfx_sscanf+0x10/0x10
[  224.552656][ T5901]  ? net_generic+0x1e/0x240
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[  224.552668][ T5901]  ? net_generic+0x1e/0x240
[pid  7193] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY) = -1 EMFILE (Too many open files)
[  224.552683][ T5901]  write_ports+0x669/0xd10
[  224.552693][ T5901]  ? __pfx_write_ports+0x10/0x10
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10066
[  224.552710][ T5901]  ? _copy_from_user+0x94/0xb0
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[  224.552720][ T5901]  ? simple_transaction_get+0x12d/0x160
[  224.552731][ T5901]  nfsctl_transaction_write+0x10f/0x160
[pid  7193] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 123 <unfinished ...>
[  224.552740][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  224.552749][ T5901]  vfs_write+0x296/0xba0
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  7193] <... write resumed>)        = 123
[  224.552763][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  224.552778][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  224.552788][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  224.552821][ T5901]  ksys_write+0x150/0x270
[  224.552835][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  224.552853][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[pid  7193] exit_group(0)               = ?
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  224.552862][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.552871][ T5901]  do_syscall_64+0x174/0x580
[  224.552881][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.552890][ T5901]  ? clear_bhb_loop+0x70/0xc0
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[  224.552900][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.552909][ T5901] RIP: 0033:0x7fcfafca149e
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10067 attached
 <unfinished ...>
[  224.552918][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  224.552926][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  224.552936][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[  224.552942][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10067
[pid 10067] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[  224.552948][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  224.552953][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10067] <... set_robust_list resumed>) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  224.552959][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  224.552971][ T5901]  </TASK>
[  224.552976][ T5901] SLUB: Unable to allocate memory on CPU 1 (of node 1) on node -1, gfp=0xcc0(GFP_KERNEL)
[pid 10067] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 10067] unshare(CLONE_NEWNS|CLONE_NEWNET/strace: Process 10066 attached
[  224.690507][ T5901]   cache: rpc_buffers, object size: 2048, buffer size: 2176, default order: 3, min order: 0
[  224.694874][ T5901]   node 0: slabs: 1, objs: 15, free: 0
[  224.697870][ T5901]   node 1: slabs: 0, objs: 0, free: 0
 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid 10066] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid 10066] <... set_robust_list resumed>) = 0
/strace: Process 10068 attached
[pid 10066] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10068] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid 10066] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10066] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10068
[pid 10068] <... set_robust_list resumed>) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10068] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10068] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10068] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
/strace: Process 10069 attached
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10069
[pid 10069] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10069] <... set_robust_list resumed>) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10069] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10069] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10070 attached
[  224.767715][ T5901] FAULT_INJECTION: forcing a failure.
[  224.767715][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  224.771886][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  224.771898][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  224.771904][ T5901] Call Trace:
[  224.771908][ T5901]  <TASK>
[  224.771912][ T5901]  dump_stack_lvl+0xe8/0x150
[  224.771935][ T5901]  should_fail_ex+0x40c/0x560
[  224.771951][ T5901]  prepare_alloc_pages+0x230/0x650
[  224.771969][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  224.771984][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  224.772000][ T5901]  ? policy_nodemask+0x27c/0x720
[  224.772012][ T5901]  alloc_pages_mpol+0x212/0x380
[  224.772024][ T5901]  allocate_slab+0x131/0x5e0
[  224.772034][ T5901]  ? kfree+0x1c5/0x640
[  224.772046][ T5901]  ___slab_alloc+0x16a/0x950
[  224.772060][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  224.772072][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  224.772083][ T5901]  ? rpc_malloc+0xeb/0x260
[  224.772095][ T5901]  ? rpc_malloc+0xeb/0x260
[  224.772109][ T5901]  rpc_malloc+0xeb/0x260
[  224.772122][ T5901]  call_allocate+0x26d/0x680
[  224.772134][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  224.772145][ T5901]  __rpc_execute+0x526/0x1280
[  224.772163][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  224.772176][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  224.772186][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  224.772199][ T5901]  rpc_execute+0x1c1/0x390
[  224.772212][ T5901]  rpc_run_task+0x4a6/0x660
[  224.772222][ T5901]  rpc_call_sync+0x10f/0x200
[  224.772231][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  224.772243][ T5901]  ? net_generic+0x1e/0x240
[  224.772251][ T5901]  ? net_generic+0x1e/0x240
[  224.772261][ T5901]  rpcb_register+0x2d0/0x530
[  224.772271][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  224.772278][ T5901]  ? net_generic+0x1e/0x240
[  224.772289][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  224.772298][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  224.772310][ T5901]  svc_unregister+0x24d/0x780
[  224.772325][ T5901]  svc_bind+0x1e9/0x230
[  224.772336][ T5901]  nfsd_create_serv+0x581/0x840
[  224.772348][ T5901]  ? kasan_save_track+0x3e/0x80
[  224.772359][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  224.772371][ T5901]  ? sscanf+0xe2/0x140
[  224.772382][ T5901]  ? net_generic+0x1e/0x240
[  224.772394][ T5901]  ? __pfx_sscanf+0x10/0x10
[  224.772403][ T5901]  ? net_generic+0x1e/0x240
[  224.772415][ T5901]  ? net_generic+0x1e/0x240
[  224.772430][ T5901]  write_ports+0x669/0xd10
[  224.772439][ T5901]  ? __pfx_write_ports+0x10/0x10
[  224.772456][ T5901]  ? _copy_from_user+0x94/0xb0
[  224.772467][ T5901]  ? simple_transaction_get+0x12d/0x160
[  224.772477][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  224.772487][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  224.772496][ T5901]  vfs_write+0x296/0xba0
[  224.772510][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  224.772524][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  224.772534][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  224.772548][ T5901]  ksys_write+0x150/0x270
[  224.772560][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  224.772573][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.772582][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.772590][ T5901]  do_syscall_64+0x174/0x580
[  224.772601][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.772610][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  224.772620][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.772629][ T5901] RIP: 0033:0x7fcfafca149e
[  224.772638][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  224.772645][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  224.772655][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  224.772661][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  224.772667][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  224.772672][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  224.772677][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  224.772690][ T5901]  </TASK>
[  224.772695][ T5901] SLUB: Unable to allocate memory on CPU 1 (of node 1) on node -1, gfp=0xcc0(GFP_KERNEL)
 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  8939] <... unshare resumed>)      = 0
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10070
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  8939] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  8939] <... socket resumed>)       = -1 EMFILE (Too many open files)
[pid 10070] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  8939] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL <unfinished ...>
[pid 10070] <... set_robust_list resumed>) = 0
[pid  8939] <... mount resumed>)        = 0
[pid 10070] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  8939] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  8939] <... openat resumed>)       = -1 EMFILE (Too many open files)
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid 10070] <... rt_sigprocmask resumed>, NULL, 8) = 0
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[pid  8939] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 161 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid 10070] unshare(CLONE_NEWNS|CLONE_NEWNET/strace: Process 10072 attached
 <unfinished ...>
[pid  8939] <... write resumed>)        = 161
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  8939] exit_group(0 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10072
[pid 10072] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10072] <... set_robust_list resumed>) = 0
[pid  8939] <... exit_group resumed>)   = ?
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10072] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10072] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10072] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10073 attached
, child_tidptr=0x5555728886d0) = 10073
[pid 10073] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10073] <... set_robust_list resumed>) = 0
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 10073] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10073] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  224.962188][ T5901]   cache: rpc_buffers, object size: 2048, buffer size: 2176, default order: 3, min order: 0
[  224.975626][ T5901]   node 0: slabs: 1, objs: 15, free: 0
[pid 10073] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[  224.992436][ T5901]   node 1: slabs: 0, objs: 0, free: 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10074 attached
, child_tidptr=0x5555728886d0) = 10074
[pid 10074] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 10074] <... set_robust_list resumed>) = 0
[pid 10074] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10074] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid 10074] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152/strace: Process 10075 attached
) = -1 EMFILE (Too many open files)
[pid  6553] <... unshare resumed>)      = 0
[pid  6553] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10075
[pid 10075] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  6553] <... socket resumed>)       = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10075] <... set_robust_list resumed>) = 0
[pid  6553] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10075] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid 10075] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6553] <... mount resumed>)        = 0
[pid 10075] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[  225.057820][ T5901] FAULT_INJECTION: forcing a failure.
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[  225.057820][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  225.062267][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  225.062280][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  225.062286][ T5901] Call Trace:
[  225.062290][ T5901]  <TASK>
[  225.062294][ T5901]  dump_stack_lvl+0xe8/0x150
[  225.062311][ T5901]  should_fail_ex+0x40c/0x560
[  225.062327][ T5901]  prepare_alloc_pages+0x230/0x650
[  225.062345][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  225.062360][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  225.062393][ T5901]  ? policy_nodemask+0x27c/0x720
[  225.062406][ T5901]  alloc_pages_mpol+0x212/0x380
[  225.062417][ T5901]  allocate_slab+0x131/0x5e0
[  225.062427][ T5901]  ? kfree+0x1c5/0x640
[  225.062439][ T5901]  ___slab_alloc+0x16a/0x950
[  225.062453][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  225.062465][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  225.062475][ T5901]  ? rpc_malloc+0xeb/0x260
[  225.062487][ T5901]  ? rpc_malloc+0xeb/0x260
[  225.062502][ T5901]  rpc_malloc+0xeb/0x260
[  225.062514][ T5901]  call_allocate+0x26d/0x680
[  225.062526][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  225.062538][ T5901]  __rpc_execute+0x526/0x1280
[  225.062556][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  225.062568][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  225.062579][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  225.062592][ T5901]  rpc_execute+0x1c1/0x390
[  225.062605][ T5901]  rpc_run_task+0x4a6/0x660
[  225.062615][ T5901]  rpc_call_sync+0x10f/0x200
[  225.062624][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  225.062636][ T5901]  ? net_generic+0x1e/0x240
[  225.062644][ T5901]  ? net_generic+0x1e/0x240
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[pid  6553] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  6553] <... openat resumed>)       = -1 EMFILE (Too many open files)
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  6553] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 104 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10077
/strace: Process 10077 attached
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  6553] <... write resumed>)        = 104
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10077] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[  225.062655][ T5901]  rpcb_register+0x2d0/0x530
[pid  6553] exit_group(0 <unfinished ...>
[pid 10077] <... set_robust_list resumed>) = 0
[pid  6553] <... exit_group resumed>)   = ?
[  225.062664][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  225.062672][ T5901]  ? net_generic+0x1e/0x240
[pid 10077] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[  225.062682][ T5901]  ? rpcb_create_local+0x4ee/0x670
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[  225.062691][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[pid 10077] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.062704][ T5901]  svc_unregister+0x24d/0x780
[  225.062719][ T5901]  svc_bind+0x1e9/0x230
[  225.062730][ T5901]  nfsd_create_serv+0x581/0x840
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[  225.062743][ T5901]  ? kasan_save_track+0x3e/0x80
[  225.062775][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10078 attached
[  225.062787][ T5901]  ? sscanf+0xe2/0x140
[  225.062798][ T5901]  ? net_generic+0x1e/0x240
[  225.062810][ T5901]  ? __pfx_sscanf+0x10/0x10
[  225.062819][ T5901]  ? net_generic+0x1e/0x240
 <unfinished ...>
[  225.062831][ T5901]  ? net_generic+0x1e/0x240
[  225.062851][ T5901]  write_ports+0x669/0xd10
[  225.062861][ T5901]  ? __pfx_write_ports+0x10/0x10
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10078
[  225.062878][ T5901]  ? _copy_from_user+0x94/0xb0
[pid 10078] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.062889][ T5901]  ? simple_transaction_get+0x12d/0x160
[  225.062900][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  225.062909][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  225.062918][ T5901]  vfs_write+0x296/0xba0
[  225.062933][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  225.062947][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  225.062958][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.062972][ T5901]  ksys_write+0x150/0x270
[  225.062984][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  225.062996][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.063005][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.063014][ T5901]  do_syscall_64+0x174/0x580
[  225.063025][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.063033][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  225.063044][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10078] <... set_robust_list resumed>) = 0
[  225.063052][ T5901] RIP: 0033:0x7fcfafca149e
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  225.063062][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[pid 10078] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[  225.063070][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[  225.063080][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  225.063086][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[pid 10078] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  7199] <... unshare resumed>)      = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.063091][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  225.063096][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  225.063101][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  225.063114][ T5901]  </TASK>
[  225.063207][ T5901] SLUB: Unable to allocate memory on CPU 1 (of node 1) on node -1, gfp=0xcc0(GFP_KERNEL)
[  225.196195][ T5901]   cache: rpc_buffers, object size: 2048, buffer size: 2176, default order: 3, min order: 0
[  225.199500][ T5901]   node 0: slabs: 1, objs: 15, free: 0
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  7199] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  7199] <... socket resumed>)       = -1 EMFILE (Too many open files)
[  225.201302][ T5901]   node 1: slabs: 0, objs: 0, free: 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  7199] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10080
[pid  7199] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  7199] <... openat resumed>)       = -1 EMFILE (Too many open files)
/strace: Process 10080 attached
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10080] set_robust_list(0x5555728886e0, 24) = 0
[pid 10080] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[pid  7199] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 123 <unfinished ...>
[pid 10080] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  7199] <... write resumed>)        = 123
[pid 10080] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  7199] exit_group(0 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  7199] <... exit_group resumed>)   = ?
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  6140] <... unshare resumed>)      = 0
/strace: Process 10082 attached
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10082
[pid 10082] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  6140] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  6140] <... socket resumed>)       = 474
[pid 10082] <... set_robust_list resumed>) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10082] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[  225.269276][ T5901] FAULT_INJECTION: forcing a failure.
[  225.269276][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[pid  6140] ioctl(474, SIOCGIFFLAGS, {ifr_name="lo" <unfinished ...>
[pid 10082] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6140] <... ioctl resumed>, ifr_flags=IFF_LOOPBACK}) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10082] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.278181][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  225.278194][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  225.278200][ T5901] Call Trace:
[  225.278204][ T5901]  <TASK>
[  225.278208][ T5901]  dump_stack_lvl+0xe8/0x150
[  225.278225][ T5901]  should_fail_ex+0x40c/0x560
[  225.278242][ T5901]  prepare_alloc_pages+0x230/0x650
[  225.278259][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  225.278275][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  225.278291][ T5901]  ? policy_nodemask+0x27c/0x720
[  225.278303][ T5901]  alloc_pages_mpol+0x212/0x380
[  225.278315][ T5901]  allocate_slab+0x131/0x5e0
[  225.278325][ T5901]  ? kfree+0x1c5/0x640
[  225.278337][ T5901]  ___slab_alloc+0x16a/0x950
[  225.278351][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  225.278362][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  225.278373][ T5901]  ? rpc_malloc+0xeb/0x260
[  225.278385][ T5901]  ? rpc_malloc+0xeb/0x260
[  225.278399][ T5901]  rpc_malloc+0xeb/0x260
[  225.278412][ T5901]  call_allocate+0x26d/0x680
[  225.278424][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  225.278436][ T5901]  __rpc_execute+0x526/0x1280
[  225.278453][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  225.278466][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  225.278477][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  225.278490][ T5901]  rpc_execute+0x1c1/0x390
[  225.278502][ T5901]  rpc_run_task+0x4a6/0x660
[  225.278513][ T5901]  rpc_call_sync+0x10f/0x200
[  225.278521][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  225.278533][ T5901]  ? net_generic+0x1e/0x240
[  225.278542][ T5901]  ? net_generic+0x1e/0x240
[  225.278552][ T5901]  rpcb_register+0x2d0/0x530
[  225.278562][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  225.278569][ T5901]  ? net_generic+0x1e/0x240
[  225.278580][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  225.278589][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  225.278602][ T5901]  svc_unregister+0x24d/0x780
[  225.278617][ T5901]  svc_bind+0x1e9/0x230
[  225.278628][ T5901]  nfsd_create_serv+0x581/0x840
[  225.278640][ T5901]  ? kasan_save_track+0x3e/0x80
[  225.278652][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  225.278664][ T5901]  ? sscanf+0xe2/0x140
[  225.278674][ T5901]  ? net_generic+0x1e/0x240
[  225.278686][ T5901]  ? __pfx_sscanf+0x10/0x10
[  225.278696][ T5901]  ? net_generic+0x1e/0x240
[  225.278708][ T5901]  ? net_generic+0x1e/0x240
[  225.278722][ T5901]  write_ports+0x669/0xd10
[  225.278754][ T5901]  ? __pfx_write_ports+0x10/0x10
[  225.278771][ T5901]  ? _copy_from_user+0x94/0xb0
[  225.278781][ T5901]  ? simple_transaction_get+0x12d/0x160
[  225.278792][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  225.278802][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  225.278811][ T5901]  vfs_write+0x296/0xba0
[  225.278831][ T5901]  ? __pfx_vfs_write+0x10/0x10
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  6141] <... unshare resumed>)      = 0
[  225.278845][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  225.278855][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.278869][ T5901]  ksys_write+0x150/0x270
[  225.278880][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  225.278894][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.278903][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.278911][ T5901]  do_syscall_64+0x174/0x580
[  225.278922][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.278930][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  225.278941][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.278949][ T5901] RIP: 0033:0x7fcfafca149e
[pid  6140] ioctl(474, SIOCSIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING} <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[  225.278957][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[pid  6141] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[  225.278965][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  225.278975][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  225.278981][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152/strace: Process 10084 attached
[  225.278987][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  225.278992][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  225.278997][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  225.279010][ T5901]  </TASK>
[  225.279015][ T5901] SLUB: Unable to allocate memory on CPU 1 (of node 1) on node -1, gfp=0xcc0(GFP_KERNEL)
 <unfinished ...>
[pid  6141] <... socket resumed>)       = 476
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.404970][ T5901]   cache: rpc_buffers, object size: 2048, buffer size: 2176, default order: 3, min order: 0
[  225.409641][ T5901]   node 0: slabs: 1, objs: 15, free: 0
[  225.412928][ T5901]   node 1: slabs: 0, objs: 0, free: 0
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10084
[pid  6141] ioctl(476, SIOCGIFFLAGS, {ifr_name="lo" <unfinished ...>
[pid 10084] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10084] <... set_robust_list resumed>) = 0
[pid  6141] <... ioctl resumed>, ifr_flags=IFF_LOOPBACK}) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10084] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  6141] ioctl(476, SIOCSIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING} <unfinished ...>
[pid 10084] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10084] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  6558] <... unshare resumed>)      = 0
[pid  6558] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  6558] <... socket resumed>)       = -1 EMFILE (Too many open files)
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  6558] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL/strace: Process 10086 attached
 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.477734][ T5901] FAULT_INJECTION: forcing a failure.
[pid  6558] <... mount resumed>)        = 0
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10086
[  225.477734][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  225.481933][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[pid 10086] set_robust_list(0x5555728886e0, 24) = 0
[pid 10086] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[  225.481945][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  225.481952][ T5901] Call Trace:
[  225.481956][ T5901]  <TASK>
[  225.481961][ T5901]  dump_stack_lvl+0xe8/0x150
[  225.481977][ T5901]  should_fail_ex+0x40c/0x560
[  225.481993][ T5901]  prepare_alloc_pages+0x230/0x650
[  225.482011][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  225.482027][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  225.482044][ T5901]  ? policy_nodemask+0x27c/0x720
[  225.482056][ T5901]  alloc_pages_mpol+0x212/0x380
[  225.482068][ T5901]  allocate_slab+0x131/0x5e0
[  225.482079][ T5901]  ? kfree+0x1c5/0x640
[  225.482091][ T5901]  ___slab_alloc+0x16a/0x950
[  225.482105][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  225.482116][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  225.482127][ T5901]  ? rpc_malloc+0xeb/0x260
[  225.482139][ T5901]  ? rpc_malloc+0xeb/0x260
[  225.482153][ T5901]  rpc_malloc+0xeb/0x260
[  225.482166][ T5901]  call_allocate+0x26d/0x680
[  225.482178][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  225.482190][ T5901]  __rpc_execute+0x526/0x1280
[  225.482208][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  225.482220][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  225.482231][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  225.482244][ T5901]  rpc_execute+0x1c1/0x390
[  225.482256][ T5901]  rpc_run_task+0x4a6/0x660
[  225.482267][ T5901]  rpc_call_sync+0x10f/0x200
[  225.482275][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  225.482287][ T5901]  ? net_generic+0x1e/0x240
[  225.482296][ T5901]  ? net_generic+0x1e/0x240
[  225.482308][ T5901]  rpcb_register+0x2d0/0x530
[  225.482318][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  225.482326][ T5901]  ? net_generic+0x1e/0x240
[  225.482336][ T5901]  ? rpcb_create_local+0x4ee/0x670
[pid 10086] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  6558] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6558] <... openat resumed>)       = -1 EMFILE (Too many open files)
[  225.482345][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  225.482357][ T5901]  svc_unregister+0x24d/0x780
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[  225.482372][ T5901]  svc_bind+0x1e9/0x230
[  225.482383][ T5901]  nfsd_create_serv+0x581/0x840
[  225.482396][ T5901]  ? kasan_save_track+0x3e/0x80
[  225.482407][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  225.482419][ T5901]  ? sscanf+0xe2/0x140
[  225.482429][ T5901]  ? net_generic+0x1e/0x240
[  225.482441][ T5901]  ? __pfx_sscanf+0x10/0x10
[  225.482451][ T5901]  ? net_generic+0x1e/0x240
[  225.482462][ T5901]  ? net_generic+0x1e/0x240
[  225.482477][ T5901]  write_ports+0x669/0xd10
[  225.482487][ T5901]  ? __pfx_write_ports+0x10/0x10
[  225.482504][ T5901]  ? _copy_from_user+0x94/0xb0
[  225.482514][ T5901]  ? simple_transaction_get+0x12d/0x160
[  225.482525][ T5901]  nfsctl_transaction_write+0x10f/0x160
[pid  6558] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 104 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.482535][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  225.482544][ T5901]  vfs_write+0x296/0xba0
[  225.482558][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  225.482572][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[pid  6558] <... write resumed>)        = 104
[  225.482582][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[  225.482596][ T5901]  ksys_write+0x150/0x270
[  225.482608][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  225.482620][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.482629][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.482638][ T5901]  do_syscall_64+0x174/0x580
[pid  6558] exit_group(0 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  6558] <... exit_group resumed>)   = ?
[  225.482648][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.482657][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  225.482667][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.482675][ T5901] RIP: 0033:0x7fcfafca149e
[  225.482685][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  225.482692][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  225.482721][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[  225.482728][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  225.482734][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  225.482739][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  225.482744][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  225.482757][ T5901]  </TASK>
[  225.482763][ T5901] SLUB: Unable to allocate memory on CPU 1 (of node 1) on node -1, gfp=0xcc0(GFP_KERNEL)
[  225.605118][ T5901]   cache: rpc_buffers, object size: 2048, buffer size: 2176, default order: 3, min order: 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152/strace: Process 10087 attached
[  225.608330][ T5901]   node 0: slabs: 1, objs: 15, free: 0
[  225.610044][ T5901]   node 1: slabs: 0, objs: 0, free: 0
) = -1 EMFILE (Too many open files)
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10087
[pid 10087] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  8107] <... unshare resumed>)      = 0
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  8107] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10087] <... set_robust_list resumed>) = 0
[pid  8107] <... socket resumed>)       = -1 EMFILE (Too many open files)
[pid 10087] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  8107] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10087] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  8107] <... mount resumed>)        = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid 10087] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  8107] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  8107] <... openat resumed>)       = -1 EMFILE (Too many open files)
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152/strace: Process 10089 attached
[  225.677677][ T5901] FAULT_INJECTION: forcing a failure.
[  225.677677][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
 <unfinished ...>
[pid  8107] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 142 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10089
[pid 10089] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  8107] <... write resumed>)        = 142
[  225.687112][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10089] <... set_robust_list resumed>) = 0
[  225.687126][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  225.687132][ T5901] Call Trace:
[pid  8107] exit_group(0 <unfinished ...>
[  225.687136][ T5901]  <TASK>
[  225.687140][ T5901]  dump_stack_lvl+0xe8/0x150
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  225.687158][ T5901]  should_fail_ex+0x40c/0x560
[  225.687174][ T5901]  prepare_alloc_pages+0x230/0x650
[pid 10089] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  8107] <... exit_group resumed>)   = ?
[  225.687191][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  225.687211][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  225.687228][ T5901]  ? policy_nodemask+0x27c/0x720
[  225.687240][ T5901]  alloc_pages_mpol+0x212/0x380
[  225.687252][ T5901]  allocate_slab+0x131/0x5e0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10089] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.687262][ T5901]  ? kfree+0x1c5/0x640
[  225.687274][ T5901]  ___slab_alloc+0x16a/0x950
[  225.687288][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  225.687300][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  225.687310][ T5901]  ? rpc_malloc+0xeb/0x260
[pid 10089] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[  225.687322][ T5901]  ? rpc_malloc+0xeb/0x260
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[  225.687336][ T5901]  rpc_malloc+0xeb/0x260
[  225.687351][ T5901]  call_allocate+0x26d/0x680
[  225.687363][ T5901]  ? __pfx_call_allocate+0x10/0x10
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.687374][ T5901]  __rpc_execute+0x526/0x1280
[  225.687392][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  225.687405][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10090 attached
[  225.687415][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  225.687428][ T5901]  rpc_execute+0x1c1/0x390
[  225.687441][ T5901]  rpc_run_task+0x4a6/0x660
, child_tidptr=0x5555728886d0) = 10090
[  225.687451][ T5901]  rpc_call_sync+0x10f/0x200
[  225.687460][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  225.687472][ T5901]  ? net_generic+0x1e/0x240
[pid 10090] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10090] <... set_robust_list resumed>) = 0
[  225.687481][ T5901]  ? net_generic+0x1e/0x240
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[  225.687491][ T5901]  rpcb_register+0x2d0/0x530
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10090] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[  225.687501][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.687508][ T5901]  ? net_generic+0x1e/0x240
[  225.687518][ T5901]  ? rpcb_create_local+0x4ee/0x670
[pid 10090] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  225.687528][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  225.687553][ T5901]  svc_unregister+0x24d/0x780
[  225.687570][ T5901]  svc_bind+0x1e9/0x230
[  225.687581][ T5901]  nfsd_create_serv+0x581/0x840
[  225.687594][ T5901]  ? kasan_save_track+0x3e/0x80
[  225.687605][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  225.687617][ T5901]  ? sscanf+0xe2/0x140
[  225.687627][ T5901]  ? net_generic+0x1e/0x240
[  225.687639][ T5901]  ? __pfx_sscanf+0x10/0x10
[  225.687648][ T5901]  ? net_generic+0x1e/0x240
[  225.687660][ T5901]  ? net_generic+0x1e/0x240
[  225.687674][ T5901]  write_ports+0x669/0xd10
[  225.687711][ T5901]  ? __pfx_write_ports+0x10/0x10
[  225.687736][ T5901]  ? _copy_from_user+0x94/0xb0
[  225.687747][ T5901]  ? simple_transaction_get+0x12d/0x160
[  225.687757][ T5901]  nfsctl_transaction_write+0x10f/0x160
[pid 10090] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[  225.687767][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  225.687775][ T5901]  vfs_write+0x296/0xba0
[  225.687790][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  225.687804][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  225.687814][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.687827][ T5901]  ksys_write+0x150/0x270
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[  225.687839][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  225.687852][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.687861][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.687869][ T5901]  do_syscall_64+0x174/0x580
[  225.687880][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[  225.687888][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  225.687899][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.687907][ T5901] RIP: 0033:0x7fcfafca149e
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10091
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.687917][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  225.687924][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  225.687934][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  225.687941][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  225.687946][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  225.687951][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  225.687957][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  225.687969][ T5901]  </TASK>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
/strace: Process 10091 attached
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid 10091] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[  225.844495][ T5901] SLUB: Unable to allocate memory on CPU 1 (of node 1) on node -1, gfp=0xcc0(GFP_KERNEL)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid 10091] <... set_robust_list resumed>) = 0
[pid  7207] <... unshare resumed>)      = 0
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid 10091] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid 10091] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  7207] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10091] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  7207] <... socket resumed>)       = -1 EMFILE (Too many open files)
/strace: Process 10095 attached
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10095
[pid  8971] <... unshare resumed>)      = 0
[pid  6853] <... unshare resumed>)      = 0
[pid  7207] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10095] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  6853] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  8971] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  7207] <... mount resumed>)        = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10095] <... set_robust_list resumed>) = 0
[pid  8971] <... socket resumed>)       = -1 EMFILE (Too many open files)
[pid  6853] <... socket resumed>)       = -1 EMFILE (Too many open files)
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.986466][ T5901]   cache: rpc_buffers, object size: 2048, buffer size: 2176, default order: 3, min order: 0
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[pid  7207] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  6853] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL <unfinished ...>
[pid 10095] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  8971] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL <unfinished ...>
[pid  7207] <... openat resumed>)       = -1 EMFILE (Too many open files)
[pid  8971] <... mount resumed>)        = 0
[pid  7207] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 123 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  8971] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  7207] <... write resumed>)        = 123
[pid 10095] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[  225.993487][ T5901]   node 0: slabs: 1, objs: 15, free: 0
[pid  8971] <... openat resumed>)       = -1 EMFILE (Too many open files)
[pid  7207] exit_group(0 <unfinished ...>
[pid 10095] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  6853] <... mount resumed>)        = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[+] Iteration 2500
[  226.003737][ T5901]   node 1: slabs: 0, objs: 0, free: 0
[pid  8971] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 180 <unfinished ...>
[pid  7207] <... exit_group resumed>)   = ?
/strace: Process 10096 attached
[pid  8971] <... write resumed>)        = 180
[pid  6853] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10096
[pid 10096] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  8971] exit_group(0 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10096] <... set_robust_list resumed>) = 0
[pid  8971] <... exit_group resumed>)   = ?
[pid  6853] <... openat resumed>)       = -1 EMFILE (Too many open files)
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10096] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  6853] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 104) = 104
[pid 10096] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6268] <... unshare resumed>)      = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10096] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  6853] exit_group(0 <unfinished ...>
[pid  6268] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 744
[pid  6268] ioctl(744, SIOCGIFFLAGS, {ifr_name="lo" <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  6853] <... exit_group resumed>)   = ?
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  6268] <... ioctl resumed>, ifr_flags=IFF_LOOPBACK}) = 0
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  6268] ioctl(744, SIOCSIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING} <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10098 attached
 <unfinished ...>
[  226.068180][ T5901] FAULT_INJECTION: forcing a failure.
[  226.068180][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  226.072498][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  226.072510][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  226.072516][ T5901] Call Trace:
[  226.072520][ T5901]  <TASK>
[  226.072524][ T5901]  dump_stack_lvl+0xe8/0x150
[  226.072541][ T5901]  should_fail_ex+0x40c/0x560
[  226.072557][ T5901]  prepare_alloc_pages+0x230/0x650
[  226.072575][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  226.072590][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  226.072607][ T5901]  ? policy_nodemask+0x27c/0x720
[  226.072619][ T5901]  alloc_pages_mpol+0x212/0x380
[  226.072630][ T5901]  allocate_slab+0x131/0x5e0
[  226.072666][ T5901]  ? kfree+0x1c5/0x640
[  226.072680][ T5901]  ___slab_alloc+0x16a/0x950
[  226.072694][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  226.072706][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  226.072717][ T5901]  ? rpc_malloc+0xeb/0x260
[  226.072728][ T5901]  ? rpc_malloc+0xeb/0x260
[  226.072743][ T5901]  rpc_malloc+0xeb/0x260
[  226.072756][ T5901]  call_allocate+0x26d/0x680
[  226.072768][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  226.072779][ T5901]  __rpc_execute+0x526/0x1280
[  226.072798][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10098
[pid 10098] set_robust_list(0x5555728886e0, 24) = 0
[pid 10098] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 10098] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  6271] <... unshare resumed>)      = 0
[pid  6271] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 749
[pid  6271] ioctl(749, SIOCGIFFLAGS, {ifr_name="lo", ifr_flags=IFF_LOOPBACK}) = 0
[pid  6271] ioctl(749, SIOCSIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING}) = 0
[pid  6271] close(749)                  = 0
[pid  6271] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL) = 0
[  226.072810][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  226.072821][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  226.072833][ T5901]  rpc_execute+0x1c1/0x390
[  226.072846][ T5901]  rpc_run_task+0x4a6/0x660
[  226.072857][ T5901]  rpc_call_sync+0x10f/0x200
[  226.072866][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  226.072878][ T5901]  ? net_generic+0x1e/0x240
[  226.072886][ T5901]  ? net_generic+0x1e/0x240
[  226.072902][ T5901]  rpcb_register+0x2d0/0x530
[pid  6271] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  226.072912][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[pid  6271] <... openat resumed>)       = 749
[  226.072919][ T5901]  ? net_generic+0x1e/0x240
[  226.072930][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  226.072939][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[pid  6271] openat(AT_FDCWD, "/tmp/nfsd/filehandle", O_RDWR) = 750
[  226.072951][ T5901]  svc_unregister+0x24d/0x780
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[  226.072966][ T5901]  svc_bind+0x1e9/0x230
[  226.072977][ T5901]  nfsd_create_serv+0x581/0x840
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[  226.072990][ T5901]  ? kasan_save_track+0x3e/0x80

[host] Command execution timed out after 2m30s
 TestError:]

map[TruncatedConsoleOutput:[  221.212003][ T5856]  ? swap_cache_get_folio+0x2e7/0x2f0
[  221.212016][ T5856]  do_swap_page+0x344/0x4930
[  221.212028][ T5856]  ? __pte_offset_map+0x29/0x240
[  221.212039][ T5856]  ? __pte_offset_map+0x29/0x240
[  221.212051][ T5856]  ? __lock_acquire+0x683/0x2cf0
[  221.212059][ T5856]  ? do_swap_page+0x128/0x4930
[  221.212068][ T5856]  ? __pfx_do_swap_page+0x10/0x10
[  221.212077][ T5856]  ? __pte_offset_map+0x1ae/0x240
[  221.212089][ T5856]  ? pte_offset_map_rw_nolock+0xea/0x160
[  221.212100][ T5856]  handle_mm_fault+0x124c/0x3070
[  221.212116][ T5856]  ? handle_mm_fault+0xec/0x3070
[  221.212130][ T5856]  ? __pfx_handle_mm_fault+0x10/0x10
[  221.212139][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
[  221.212161][ T5856]  do_user_addr_fault+0xa4d/0x1340
[  221.212174][ T5856]  ? trace_page_fault_user+0x84/0x1e0
[  221.212183][ T5856]  exc_page_fault+0x6a/0xc0
[  221.212194][ T5856]  asm_exc_page_fault+0x26/0x30
[  221.212202][ T5856] RIP: 0033:0x7feeb916e49e
[  221.212210][ T5856] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
** 10 printk messages dropped **
[  221.220621][ T6127] Call Trace:
** 1 printk messages dropped **
[  221.220628][ T6127]  dump_stack_lvl+0xe8/0x150
[  221.220645][ T6127]  should_fail_ex+0x40c/0x560
[  221.220660][ T6127]  prepare_alloc_pages+0x230/0x650
[  221.220677][ T6127]  __alloc_frozen_pages_noprof+0x12f/0x380
[  221.220692][ T6127]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  221.220708][ T6127]  ? policy_nodemask+0x27c/0x720
** 31 printk messages dropped **
[  221.221089][ T6127] RIP: 0033:0x7feeb916e49e
** 13 printk messages dropped **
[  221.223725][ T5856]  dump_stack_lvl+0xe8/0x150
** 1 printk messages dropped **
[  221.223754][ T5856]  prepare_alloc_pages+0x230/0x650
** 50 printk messages dropped **
[  221.227160][ T5880]  prepare_alloc_pages+0x230/0x650
[  221.227176][ T5880]  __alloc_frozen_pages_noprof+0x12f/0x380
[  221.227190][ T5880]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[+] Iteration 2500
[  221.227206][ T5880]  ? policy_nodemask+0x27c/0x720
[  221.227218][ T5880]  alloc_pages_mpol+0x212/0x380
[  221.227229][ T5880]  folio_alloc_mpol_noprof+0x39/0x160
[  221.227240][ T5880]  swap_cache_alloc_folio+0x2c1/0x990
[  221.227256][ T5880]  swap_cluster_readahead+0x4d9/0x640
[  221.227269][ T5880]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  221.227313][ T5880]  ? get_vma_policy+0x27b/0x3c0
[  221.227324][ T5880]  swapin_readahead+0x19a/0xc10
[  221.227336][ T5880]  ? swap_table_get+0x1e/0x260
[  221.227347][ T5880]  ? swap_table_get+0x1e/0x260
[  221.227357][ T5880]  ? __pfx_swapin_readahead+0x10/0x10
[  221.227369][ T5880]  ? swap_table_get+0x1e/0x260
[  221.227378][ T5880]  ? swap_table_get+0x1e/0x260
[  221.227387][ T5880]  ? swap_table_get+0x1e/0x260
[  221.227397][ T5880]  ? swap_table_get+0x216/0x260
[  221.227408][ T5880]  ? swap_cache_get_folio+0x2e7/0x2f0
[  221.227421][ T5880]  do_swap_page+0x344/0x4930
[  221.227432][ T5880]  ? __pte_offset_map+0x29/0x240
[  221.227443][ T5880]  ? __pte_offset_map+0x29/0x240
[  221.227456][ T5880]  ? __lock_acquire+0x683/0x2cf0
[  221.227463][ T5880]  ? do_swap_page+0x128/0x4930
[  221.227473][ T5880]  ? __pfx_do_swap_page+0x10/0x10
[  221.227482][ T5880]  ? __pte_offset_map+0x1ae/0x240
[  221.227493][ T5880]  ? pte_offset_map_rw_nolock+0xea/0x160
[  221.227505][ T5880]  handle_mm_fault+0x124c/0x3070
[  221.227521][ T5880]  ? handle_mm_fault+0xec/0x3070
[  221.227535][ T5880]  ? __pfx_handle_mm_fault+0x10/0x10
[  221.227544][ T5880]  ? lock_vma_under_rcu+0x45a/0x500
[  221.227565][ T5880]  do_user_addr_fault+0xa4d/0x1340
[  221.227577][ T5880]  ? trace_page_fault_user+0x84/0x1e0
[  221.227587][ T5880]  exc_page_fault+0x6a/0xc0
[  221.227599][ T5880]  asm_exc_page_fault+0x26/0x30
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[+] Iteration 2500
[  221.227607][ T5880] RIP: 0033:0x7feeb916e49e
[  221.227616][ T5880] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  221.227623][ T5880] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  221.227631][ T5880] RAX: 0000000000000008 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  221.227637][ T5880] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000061
[  221.227642][ T5880] RBP: 0000000000000061 R08: 0000000000000000 R09: 0000000000000000
[  221.227647][ T5880] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  221.227653][ T5880] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  221.227665][ T5880]  </TASK>
[  221.227686][ T5880] FAULT_INJECTION: forcing a failure.
[  221.227686][ T5880] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  221.230160][ T5856] CPU: 1 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
** 7 printk messages dropped **
[  221.230242][ T5856]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  221.230258][ T5856]  ? policy_nodemask+0x27c/0x720
[  221.230269][ T5856]  alloc_pages_mpol+0x212/0x380
[  221.230303][ T5856]  folio_alloc_mpol_noprof+0x39/0x160
[  221.230315][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
** 683 printk messages dropped **
[  221.434418][ T5856]  ? swap_table_get+0x1e/0x260
** 21 printk messages dropped **
[  221.434681][ T5856] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  221.434689][ T5856] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  221.434697][ T5856] RAX: fffffffffffffff4 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  221.434703][ T5856] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000031
[  221.434709][ T5856] RBP: 0000000000000031 R08: 0000000000000000 R09: 0000000000000000
[  221.434714][ T5856] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
** 45 printk messages dropped **
[  221.461338][ T5880] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
** 46 printk messages dropped **
[  221.469589][ T5880]  do_user_addr_fault+0xa4d/0x1340
[  221.469601][ T5880]  ? trace_page_fault_user+0x84/0x1e0
[  221.469611][ T5880]  exc_page_fault+0x6a/0xc0
[  221.469623][ T5880]  asm_exc_page_fault+0x26/0x30
[  221.469632][ T5880] RIP: 0033:0x7feeb916e49e
[  221.469641][ T5880] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  221.469648][ T5880] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[+] Iteration 2500
[  221.469657][ T5880] RAX: 0000000000000008 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
** 45 printk messages dropped **
[  221.486503][ T6134]  ? do_raw_spin_unlock+0xf5/0x210
[  221.486516][ T6134]  rpcb_create_local+0x28f/0x670
[  221.486526][ T6134]  ? __pfx_rpcb_create_local+0x10/0x10
[  221.486534][ T6134]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  221.486545][ T6134]  ? lockdep_hardirqs_on+0x7a/0x110
[  221.486556][ T6134]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  221.486566][ T6134]  ? __percpu_counter_init_many+0x35f/0x380
[  221.486581][ T6134]  ? __svc_create+0x88f/0x990
[  221.486594][ T6134]  svc_bind+0x1b4/0x230
[  221.486605][ T6134]  nfsd_create_serv+0x581/0x840
[  221.486618][ T6134]  ? kasan_save_track+0x3e/0x80
[  221.486629][ T6134]  ? __pfx_nfsd_create_serv+0x10/0x10
[  221.486641][ T6134]  ? sscanf+0xe2/0x140
[  221.486650][ T6134]  ? net_generic+0x1e/0x240
[  221.486663][ T6134]  ? __pfx_sscanf+0x10/0x10
[  221.486672][ T6134]  ? net_generic+0x1e/0x240
[  221.486684][ T6134]  ? net_generic+0x1e/0x240
[  221.486699][ T6134]  write_ports+0x669/0xd10
[  221.486709][ T6134]  ? __pfx_write_ports+0x10/0x10
[  221.486726][ T6134]  ? _copy_from_user+0x94/0xb0
[  221.486736][ T6134]  ? simple_transaction_get+0x12d/0x160
** 31 printk messages dropped **
[  221.525452][ T5856]  ? policy_nodemask+0x27c/0x720
** 2 printk messages dropped **
[  221.525485][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
[  221.525502][ T5856]  swap_cluster_readahead+0x4d9/0x640
[  221.525516][ T5856]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  221.525532][ T5856]  ? get_vma_policy+0x27b/0x3c0
[  221.525542][ T5856]  swapin_readahead+0x19a/0xc10
[  221.525554][ T5856]  ? swap_table_get+0x1e/0x260
[  221.525564][ T5856]  ? swap_table_get+0x1e/0x260
[  221.525574][ T5856]  ? __pfx_swapin_readahead+0x10/0x10
** 43 printk messages dropped **
[  221.529102][ T6127]  swap_cache_alloc_folio+0x2c1/0x990
** 50 printk messages dropped **
[  221.548398][ T5856]  folio_alloc_mpol_noprof+0x39/0x160
[  221.548408][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
[  221.548425][ T5856]  swap_cluster_readahead+0x4d9/0x640
[  221.548438][ T5856]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  221.548454][ T5856]  ? get_vma_policy+0x27b/0x3c0
[  221.548464][ T5856]  swapin_readahead+0x19a/0xc10
[  221.548477][ T5856]  ? swap_table_get+0x1e/0x260
[  221.548487][ T5856]  ? swap_table_get+0x1e/0x260
[  221.548497][ T5856]  ? __pfx_swapin_readahead+0x10/0x10
[  221.548513][ T5856]  ? swap_table_get+0x1e/0x260
[  221.548523][ T5856]  ? swap_table_get+0x1e/0x260
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[+] Iteration 2500
** 40 printk messages dropped **
[  221.549415][ T6127]  folio_alloc_mpol_noprof+0x39/0x160
** 81 printk messages dropped **
[  221.563147][ T6127] RIP: 0033:0x7feeb916e49e
[  221.563156][ T6127] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  221.563163][ T6127] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  221.563172][ T6127] RAX: fffffffffffffff4 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  221.563178][ T6127] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000200
[  221.563184][ T6127] RBP: 0000000000000200 R08: 0000000000000000 R09: 0000000000000000
[  221.563189][ T6127] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c

[host] Command execution timed out after 2m30s
 TruncatedCrashReport: TruncatedStraceOutput:[  223.266219][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  223.266224][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  223.266230][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  223.266242][ T5901]  </TASK>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10033] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 10033] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10034 attached
, child_tidptr=0x5555728886d0) = 10034
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10034] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10034] <... set_robust_list resumed>) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10034] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid 10034] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10035
[  223.390843][ T5901] FAULT_INJECTION: forcing a failure.
/strace: Process 10035 attached
[  223.390843][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[  223.395446][ T5901] CPU: 0 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[pid 10035] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  6259] <... unshare resumed>)      = 0
[  223.395460][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  223.395466][ T5901] Call Trace:
[  223.395471][ T5901]  <TASK>
[  223.395475][ T5901]  dump_stack_lvl+0xe8/0x150
[pid 10035] <... set_robust_list resumed>) = 0
[pid  6259] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10035] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  6259] <... socket resumed>)       = 706
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[  223.395494][ T5901]  should_fail_ex+0x40c/0x560
[  223.395511][ T5901]  prepare_alloc_pages+0x230/0x650
[  223.395528][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  223.395543][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  223.395560][ T5901]  ? policy_nodemask+0x27c/0x720
[  223.395572][ T5901]  alloc_pages_mpol+0x212/0x380
[  223.395584][ T5901]  allocate_slab+0x131/0x5e0
[  223.395594][ T5901]  ? kfree+0x1c5/0x640
[  223.395605][ T5901]  ___slab_alloc+0x16a/0x950
[  223.395619][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  223.395631][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  223.395641][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.395654][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.395668][ T5901]  rpc_malloc+0xeb/0x260
[  223.395681][ T5901]  call_allocate+0x26d/0x680
[  223.395692][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  223.395703][ T5901]  __rpc_execute+0x526/0x1280
[  223.395721][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  223.395734][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  223.395744][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[pid 10035] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6259] ioctl(706, SIOCGIFFLAGS, {ifr_name="lo" <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid 10035] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  6259] <... ioctl resumed>, ifr_flags=IFF_LOOPBACK}) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  6259] ioctl(706, SIOCSIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING} <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10037
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10038
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[  223.395757][ T5901]  rpc_execute+0x1c1/0x390
[  223.395769][ T5901]  rpc_run_task+0x4a6/0x660
[  223.395780][ T5901]  rpc_call_sync+0x10f/0x200
[  223.395789][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  223.395800][ T5901]  ? net_generic+0x1e/0x240
[  223.395808][ T5901]  ? net_generic+0x1e/0x240
[  223.395818][ T5901]  rpcb_register+0x2d0/0x530
[  223.395828][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  223.395835][ T5901]  ? net_generic+0x1e/0x240
[  223.395845][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  223.395855][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  223.395867][ T5901]  svc_unregister+0x24d/0x780
[  223.395882][ T5901]  svc_bind+0x1e9/0x230
[  223.395892][ T5901]  nfsd_create_serv+0x581/0x840
[  223.395905][ T5901]  ? kasan_save_track+0x3e/0x80
[  223.395916][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  223.395959][ T5901]  ? sscanf+0xe2/0x140
[  223.395970][ T5901]  ? net_generic+0x1e/0x240
[  223.395982][ T5901]  ? __pfx_sscanf+0x10/0x10
[  223.395996][ T5901]  ? net_generic+0x1e/0x240
[  223.396008][ T5901]  ? net_generic+0x1e/0x240
[  223.396023][ T5901]  write_ports+0x669/0xd10
[  223.396033][ T5901]  ? __pfx_write_ports+0x10/0x10
[  223.396049][ T5901]  ? _copy_from_user+0x94/0xb0
[  223.396059][ T5901]  ? simple_transaction_get+0x12d/0x160
[  223.396070][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  223.396079][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  223.396088][ T5901]  vfs_write+0x296/0xba0
[  223.396103][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  223.396117][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  223.396127][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  223.396140][ T5901]  ksys_write+0x150/0x270
[  223.396152][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  223.396165][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.396174][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.396183][ T5901]  do_syscall_64+0x174/0x580
[  223.396193][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.396202][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  223.396213][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.396221][ T5901] RIP: 0033:0x7fcfafca149e
[  223.396231][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  223.396238][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10039
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10040
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152/strace: Process 10041 attached
) = -1 EMFILE (Too many open files)
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10041
[pid 10041] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10041] <... set_robust_list resumed>) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10041] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10041] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10041] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
/strace: Process 10042 attached
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10042
[pid 10042] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10042] <... set_robust_list resumed>) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10042] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10042] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10042] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[  223.396249][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  223.396255][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  223.396261][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  223.396266][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  223.396271][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  223.396283][ T5901]  </TASK>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10043 attached
, child_tidptr=0x5555728886d0) = 10043
[pid 10043] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10043] <... set_robust_list resumed>) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[  223.519962][ T5901] FAULT_INJECTION: forcing a failure.
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10043] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  223.519962][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[pid 10043] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10043] unshare(CLONE_NEWNS|CLONE_NEWNET/strace: Process 10040 attached
[  223.525260][ T5901] CPU: 0 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
/strace: Process 10039 attached
/strace: Process 10038 attached
/strace: Process 10037 attached
[  223.525272][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  223.525279][ T5901] Call Trace:
[  223.525283][ T5901]  <TASK>
[  223.525287][ T5901]  dump_stack_lvl+0xe8/0x150
[  223.525304][ T5901]  should_fail_ex+0x40c/0x560
[  223.525320][ T5901]  prepare_alloc_pages+0x230/0x650
[  223.525337][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  223.525352][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  223.525368][ T5901]  ? policy_nodemask+0x27c/0x720
[  223.525380][ T5901]  alloc_pages_mpol+0x212/0x380
[  223.525392][ T5901]  allocate_slab+0x131/0x5e0
[  223.525402][ T5901]  ? kfree+0x1c5/0x640
[  223.525414][ T5901]  ___slab_alloc+0x16a/0x950
[  223.525427][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  223.525439][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  223.525450][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.525462][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.525477][ T5901]  rpc_malloc+0xeb/0x260
 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
/strace: Process 10044 attached
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10044
[  223.525491][ T5901]  call_allocate+0x26d/0x680
[  223.525503][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  223.525514][ T5901]  __rpc_execute+0x526/0x1280
[  223.525532][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  223.525545][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  223.525555][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  223.525568][ T5901]  rpc_execute+0x1c1/0x390
[  223.525581][ T5901]  rpc_run_task+0x4a6/0x660
[  223.525591][ T5901]  rpc_call_sync+0x10f/0x200
[  223.525599][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  223.525611][ T5901]  ? net_generic+0x1e/0x240
[  223.525619][ T5901]  ? net_generic+0x1e/0x240
[  223.525630][ T5901]  rpcb_register+0x2d0/0x530
[  223.525639][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  223.525647][ T5901]  ? net_generic+0x1e/0x240
[  223.525657][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  223.525666][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  223.525679][ T5901]  svc_unregister+0x24d/0x780
[  223.525694][ T5901]  svc_bind+0x1e9/0x230
[  223.525704][ T5901]  nfsd_create_serv+0x581/0x840
[  223.525716][ T5901]  ? kasan_save_track+0x3e/0x80
[  223.525728][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  223.525740][ T5901]  ? sscanf+0xe2/0x140
[  223.525750][ T5901]  ? net_generic+0x1e/0x240
[  223.525762][ T5901]  ? __pfx_sscanf+0x10/0x10
[  223.525771][ T5901]  ? net_generic+0x1e/0x240
[  223.525783][ T5901]  ? net_generic+0x1e/0x240
[  223.525798][ T5901]  write_ports+0x669/0xd10
[  223.525807][ T5901]  ? __pfx_write_ports+0x10/0x10
[  223.525824][ T5901]  ? _copy_from_user+0x94/0xb0
[  223.525834][ T5901]  ? simple_transaction_get+0x12d/0x160
[  223.525845][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  223.525854][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  223.525863][ T5901]  vfs_write+0x296/0xba0
[  223.525878][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  223.525892][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  223.525902][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  223.525950][ T5901]  ksys_write+0x150/0x270
[  223.525971][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  223.525997][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.526006][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.526015][ T5901]  do_syscall_64+0x174/0x580
[  223.526025][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.526034][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  223.526044][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.526053][ T5901] RIP: 0033:0x7fcfafca149e
[  223.526062][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  223.526070][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  223.526080][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  223.526086][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  223.526091][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  223.526096][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  223.526102][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  223.526115][ T5901]  </TASK>
[pid 10044] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10044] <... set_robust_list resumed>) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10044] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10044] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10044] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10045 attached
 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10045
[pid 10045] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10045] <... set_robust_list resumed>) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  223.651722][ T5901] FAULT_INJECTION: forcing a failure.
[  223.651722][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  223.655639][ T5901] CPU: 0 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  223.655651][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  223.655658][ T5901] Call Trace:
[  223.655662][ T5901]  <TASK>
[  223.655666][ T5901]  dump_stack_lvl+0xe8/0x150
[  223.655682][ T5901]  should_fail_ex+0x40c/0x560
[  223.655699][ T5901]  prepare_alloc_pages+0x230/0x650
[  223.655716][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  223.655732][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[pid 10045] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 10038] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid 10039] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid 10037] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid 10040] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  223.655749][ T5901]  ? policy_nodemask+0x27c/0x720
[  223.655761][ T5901]  alloc_pages_mpol+0x212/0x380
[  223.655773][ T5901]  allocate_slab+0x131/0x5e0
[  223.655783][ T5901]  ? kfree+0x1c5/0x640
[  223.655795][ T5901]  ___slab_alloc+0x16a/0x950
[  223.655808][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  223.655820][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  223.655831][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.655843][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.655857][ T5901]  rpc_malloc+0xeb/0x260
[  223.655870][ T5901]  call_allocate+0x26d/0x680
[  223.655882][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  223.655912][ T5901]  __rpc_execute+0x526/0x1280
[pid 10045] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10046
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
/strace: Process 10046 attached
[pid 10046] set_robust_list(0x5555728886e0, 24) = 0
[  223.655932][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  223.655945][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  223.655956][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  223.655969][ T5901]  rpc_execute+0x1c1/0x390
[  223.655981][ T5901]  rpc_run_task+0x4a6/0x660
[  223.655992][ T5901]  rpc_call_sync+0x10f/0x200
[  223.656000][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  223.656012][ T5901]  ? net_generic+0x1e/0x240
[  223.656020][ T5901]  ? net_generic+0x1e/0x240
[  223.656030][ T5901]  rpcb_register+0x2d0/0x530
[  223.656040][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  223.656048][ T5901]  ? net_generic+0x1e/0x240
[  223.656058][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  223.656067][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[pid 10046] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid 10046] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid 10046] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10047
/strace: Process 10047 attached
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10047] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10047] <... set_robust_list resumed>) = 0
[pid 10047] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 10047] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[  223.656080][ T5901]  svc_unregister+0x24d/0x780
[  223.656094][ T5901]  svc_bind+0x1e9/0x230
[  223.656105][ T5901]  nfsd_create_serv+0x581/0x840
[  223.656117][ T5901]  ? kasan_save_track+0x3e/0x80
[  223.656129][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  223.656141][ T5901]  ? sscanf+0xe2/0x140
[  223.656151][ T5901]  ? net_generic+0x1e/0x240
[  223.656163][ T5901]  ? __pfx_sscanf+0x10/0x10
[  223.656172][ T5901]  ? net_generic+0x1e/0x240
[  223.656184][ T5901]  ? net_generic+0x1e/0x240
[  223.656199][ T5901]  write_ports+0x669/0xd10
[  223.656209][ T5901]  ? __pfx_write_ports+0x10/0x10
[  223.656226][ T5901]  ? _copy_from_user+0x94/0xb0
[  223.656236][ T5901]  ? simple_transaction_get+0x12d/0x160
[  223.656247][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  223.656256][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  223.656265][ T5901]  vfs_write+0x296/0xba0
[  223.656280][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  223.656294][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  223.656304][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  223.656318][ T5901]  ksys_write+0x150/0x270
[  223.656329][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  223.656342][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.656351][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.656359][ T5901]  do_syscall_64+0x174/0x580
[  223.656370][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.656379][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  223.656389][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10048 attached
, child_tidptr=0x5555728886d0) = 10048
[pid 10048] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 10048] <... set_robust_list resumed>) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10048] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10048] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10048] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10049 attached
 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10049
[pid 10049] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10049] <... set_robust_list resumed>) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10049] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 10049] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10050 attached
 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10050
[pid 10050] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10050] <... set_robust_list resumed>) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10050] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10038] <... set_robust_list resumed>) = 0
[pid 10050] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10038] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10050] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid 10038] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  223.656397][ T5901] RIP: 0033:0x7fcfafca149e
[  223.656407][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  223.656415][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  223.656425][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  223.656431][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  223.656437][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  223.656458][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  223.656464][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  223.656476][ T5901]  </TASK>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10038] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10051
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10052 attached
 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10052
[pid 10052] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10052] <... set_robust_list resumed>) = 0
[  223.778105][ T5901] FAULT_INJECTION: forcing a failure.
[  223.778105][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10052] rt_sigprocmask(SIG_SETMASK, []/strace: Process 10051 attached
, NULL, 8) = 0
[pid 10040] <... set_robust_list resumed>) = 0
[pid 10039] <... set_robust_list resumed>) = 0
[pid 10037] <... set_robust_list resumed>) = 0
[  223.782308][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  223.782320][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  223.782326][ T5901] Call Trace:
[  223.782330][ T5901]  <TASK>
[  223.782335][ T5901]  dump_stack_lvl+0xe8/0x150
[  223.782351][ T5901]  should_fail_ex+0x40c/0x560
[  223.782368][ T5901]  prepare_alloc_pages+0x230/0x650
[  223.782385][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  223.782401][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  223.782417][ T5901]  ? policy_nodemask+0x27c/0x720
[  223.782429][ T5901]  alloc_pages_mpol+0x212/0x380
[  223.782441][ T5901]  allocate_slab+0x131/0x5e0
[  223.782451][ T5901]  ? kfree+0x1c5/0x640
[  223.782463][ T5901]  ___slab_alloc+0x16a/0x950
[  223.782477][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  223.782488][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  223.782499][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.782511][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.782525][ T5901]  rpc_malloc+0xeb/0x260
[  223.782538][ T5901]  call_allocate+0x26d/0x680
[  223.782550][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  223.782561][ T5901]  __rpc_execute+0x526/0x1280
[  223.782579][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  223.782591][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  223.782602][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  223.782614][ T5901]  rpc_execute+0x1c1/0x390
[  223.782627][ T5901]  rpc_run_task+0x4a6/0x660
[  223.782638][ T5901]  rpc_call_sync+0x10f/0x200
[  223.782646][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  223.782658][ T5901]  ? net_generic+0x1e/0x240
[  223.782666][ T5901]  ? net_generic+0x1e/0x240
[  223.782677][ T5901]  rpcb_register+0x2d0/0x530
[  223.782686][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  223.782693][ T5901]  ? net_generic+0x1e/0x240
[  223.782704][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  223.782713][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  223.782725][ T5901]  svc_unregister+0x24d/0x780
[  223.782740][ T5901]  svc_bind+0x1e9/0x230
[  223.782751][ T5901]  nfsd_create_serv+0x581/0x840
[  223.782763][ T5901]  ? kasan_save_track+0x3e/0x80
[  223.782774][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  223.782786][ T5901]  ? sscanf+0xe2/0x140
[  223.782797][ T5901]  ? net_generic+0x1e/0x240
[  223.782809][ T5901]  ? __pfx_sscanf+0x10/0x10
[  223.782818][ T5901]  ? net_generic+0x1e/0x240
[  223.782830][ T5901]  ? net_generic+0x1e/0x240
[  223.782844][ T5901]  write_ports+0x669/0xd10
[  223.782854][ T5901]  ? __pfx_write_ports+0x10/0x10
[  223.782871][ T5901]  ? _copy_from_user+0x94/0xb0
[  223.782902][ T5901]  ? simple_transaction_get+0x12d/0x160
[  223.782914][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  223.782924][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  223.782932][ T5901]  vfs_write+0x296/0xba0
[  223.782948][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  223.782962][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  223.782973][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  223.782987][ T5901]  ksys_write+0x150/0x270
[  223.782999][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  223.783011][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.783020][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.783029][ T5901]  do_syscall_64+0x174/0x580
[  223.783040][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.783053][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  223.783064][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.783073][ T5901] RIP: 0033:0x7fcfafca149e
[  223.783082][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  223.783089][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  223.783100][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  223.783106][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  223.783111][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  223.783117][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  223.783123][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  223.783135][ T5901]  </TASK>
[  223.919117][ T5901] FAULT_INJECTION: forcing a failure.
[  223.919117][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  223.923135][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  223.923161][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  223.923167][ T5901] Call Trace:
[  223.923172][ T5901]  <TASK>
[  223.923176][ T5901]  dump_stack_lvl+0xe8/0x150
[  223.923193][ T5901]  should_fail_ex+0x40c/0x560
[  223.923209][ T5901]  prepare_alloc_pages+0x230/0x650
[  223.923227][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  223.923243][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  223.923259][ T5901]  ? policy_nodemask+0x27c/0x720
[  223.923271][ T5901]  alloc_pages_mpol+0x212/0x380
[  223.923283][ T5901]  allocate_slab+0x131/0x5e0
[  223.923294][ T5901]  ? kfree+0x1c5/0x640
[  223.923306][ T5901]  ___slab_alloc+0x16a/0x950
[  223.923320][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  223.923332][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  223.923342][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.923354][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.923368][ T5901]  rpc_malloc+0xeb/0x260
[  223.923381][ T5901]  call_allocate+0x26d/0x680
[  223.923393][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  223.923404][ T5901]  __rpc_execute+0x526/0x1280
[  223.923422][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  223.923435][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  223.923445][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  223.923458][ T5901]  rpc_execute+0x1c1/0x390
[  223.923471][ T5901]  rpc_run_task+0x4a6/0x660
[  223.923481][ T5901]  rpc_call_sync+0x10f/0x200
[  223.923489][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  223.923501][ T5901]  ? net_generic+0x1e/0x240
[  223.923509][ T5901]  ? net_generic+0x1e/0x240
[  223.923520][ T5901]  rpcb_register+0x2d0/0x530
[  223.923529][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  223.923536][ T5901]  ? net_generic+0x1e/0x240
[  223.923547][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  223.923556][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  223.923569][ T5901]  svc_unregister+0x24d/0x780
[  223.923583][ T5901]  svc_bind+0x1e9/0x230
[  223.923594][ T5901]  nfsd_create_serv+0x581/0x840
[  223.923606][ T5901]  ? kasan_save_track+0x3e/0x80
[  223.923618][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  223.923630][ T5901]  ? sscanf+0xe2/0x140
[  223.923640][ T5901]  ? net_generic+0x1e/0x240
[  223.923652][ T5901]  ? __pfx_sscanf+0x10/0x10
[  223.923661][ T5901]  ? net_generic+0x1e/0x240
[  223.923673][ T5901]  ? net_generic+0x1e/0x240
[  223.923687][ T5901]  write_ports+0x669/0xd10
[  223.923697][ T5901]  ? __pfx_write_ports+0x10/0x10
[  223.923715][ T5901]  ? _copy_from_user+0x94/0xb0
[  223.923725][ T5901]  ? simple_transaction_get+0x12d/0x160
[  223.923736][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  223.923746][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  223.923754][ T5901]  vfs_write+0x296/0xba0
[  223.923769][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  223.923783][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  223.923793][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  223.923807][ T5901]  ksys_write+0x150/0x270
[  223.923819][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  223.923831][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.923840][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.923849][ T5901]  do_syscall_64+0x174/0x580
[  223.923860][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.923887][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  223.923898][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.923907][ T5901] RIP: 0033:0x7fcfafca149e
[  223.923917][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  223.923925][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  223.923934][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  223.923941][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  223.923946][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  223.923951][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  223.923957][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  223.923969][ T5901]  </TASK>
[  224.043424][ T5901] FAULT_INJECTION: forcing a failure.
[  224.043424][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  224.047387][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  224.047399][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  224.047405][ T5901] Call Trace:
[  224.047410][ T5901]  <TASK>
[  224.047414][ T5901]  dump_stack_lvl+0xe8/0x150
[  224.047431][ T5901]  should_fail_ex+0x40c/0x560
[  224.047448][ T5901]  prepare_alloc_pages+0x230/0x650
[  224.047466][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  224.047482][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  224.047498][ T5901]  ? policy_nodemask+0x27c/0x720
[  224.047510][ T5901]  alloc_pages_mpol+0x212/0x380
[  224.047522][ T5901]  allocate_slab+0x131/0x5e0
[  224.047532][ T5901]  ? kfree+0x1c5/0x640
[  224.047559][ T5901]  ___slab_alloc+0x16a/0x950
[  224.047571][ T5901]  ? kmem_cache_alloc_noprof+0xbf/0x5f0
[  224.047585][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  224.047596][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  224.047607][ T5901]  ? rpc_malloc+0xeb/0x260
[  224.047618][ T5901]  ? rpc_malloc+0xeb/0x260
[  224.047632][ T5901]  rpc_malloc+0xeb/0x260
[  224.047645][ T5901]  call_allocate+0x26d/0x680
[  224.047657][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  224.047668][ T5901]  __rpc_execute+0x526/0x1280
[  224.047686][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  224.047699][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  224.047709][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  224.047722][ T5901]  rpc_execute+0x1c1/0x390
[  224.047735][ T5901]  rpc_run_task+0x4a6/0x660
[  224.047745][ T5901]  rpc_call_sync+0x10f/0x200
[  224.047754][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  224.047766][ T5901]  ? net_generic+0x1e/0x240
[  224.047774][ T5901]  ? net_generic+0x1e/0x240
[  224.047784][ T5901]  rpcb_register+0x2d0/0x530
[  224.047794][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  224.047801][ T5901]  ? net_generic+0x1e/0x240
[  224.047811][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  224.047821][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  224.047833][ T5901]  svc_unregister+0x24d/0x780
[  224.047847][ T5901]  svc_bind+0x1e9/0x230
[  224.047877][ T5901]  nfsd_create_serv+0x581/0x840
[  224.047891][ T5901]  ? kasan_save_track+0x3e/0x80
[  224.047902][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  224.047914][ T5901]  ? sscanf+0xe2/0x140
[  224.047924][ T5901]  ? net_generic+0x1e/0x240
[  224.047936][ T5901]  ? __pfx_sscanf+0x10/0x10
[  224.047945][ T5901]  ? net_generic+0x1e/0x240
[  224.047957][ T5901]  ? net_generic+0x1e/0x240
[  224.047972][ T5901]  write_ports+0x669/0xd10
[  224.047981][ T5901]  ? __pfx_write_ports+0x10/0x10
[  224.047998][ T5901]  ? _copy_from_user+0x94/0xb0
[  224.048008][ T5901]  ? simple_transaction_get+0x12d/0x160
[  224.048019][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  224.048033][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  224.048042][ T5901]  vfs_write+0x296/0xba0
[  224.048057][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  224.048071][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  224.048081][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  224.048095][ T5901]  ksys_write+0x150/0x270
[  224.048107][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  224.048120][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.048129][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.048138][ T5901]  do_syscall_64+0x174/0x580
[  224.048148][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.048157][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  224.048167][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.048175][ T5901] RIP: 0033:0x7fcfafca149e
[  224.048185][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  224.048193][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  224.048203][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  224.048210][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  224.048215][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  224.048220][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  224.048226][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  224.048239][ T5901]  </TASK>
[pid 10052] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10051] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid 10040] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10039] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10037] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  6261] <... unshare resumed>)      = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid 10051] <... set_robust_list resumed>) = 0
[pid  6261] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid 10040] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10039] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10037] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10051] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  6261] <... socket resumed>)       = 708
[pid 10039] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid 10037] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid 10040] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid 10051] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6261] ioctl(708, SIOCGIFFLAGS, {ifr_name="lo" <unfinished ...>
[pid 10051] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  6261] <... ioctl resumed>, ifr_flags=IFF_LOOPBACK}) = 0
[pid  6261] ioctl(708, SIOCSIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING}) = 0
[pid  6261] close(708)                  = 0
[pid  6261] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL <unfinished ...>
[  224.240141][ T5901] slab_out_of_memory: 18 callbacks suppressed
[  224.240151][ T5901] SLUB: Unable to allocate memory on CPU 1 (of node 1) on node -1, gfp=0xcc0(GFP_KERNEL)
[  224.245106][ T5901]   cache: rpc_buffers, object size: 2048, buffer size: 2176, default order: 3, min order: 0
[  224.248961][ T5901]   node 0: slabs: 1, objs: 15, free: 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152/strace: Process 10054 attached
[  224.251155][ T5901]   node 1: slabs: 0, objs: 0, free: 0
 <unfinished ...>
[pid  6261] <... mount resumed>)        = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10054
[pid 10054] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  6261] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  6261] <... openat resumed>)       = 708
[pid 10054] <... set_robust_list resumed>) = 0
[pid  6261] openat(AT_FDCWD, "/tmp/nfsd/filehandle", O_RDWR <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10054] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  6261] <... openat resumed>)       = 709
[pid 10054] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid 10054] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  6261] write(709, "dummy", 5 <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  6261] <... write resumed>)        = -1 EINVAL (Invalid argument)
/strace: Process 10055 attached
[pid  6261] close(709 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10055
[pid  6261] <... close resumed>)        = 0
[pid 10055] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  6261] socket(AF_INET, SOCK_STREAM, IPPROTO_IP <unfinished ...>
[pid 10055] <... set_robust_list resumed>) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6261] <... socket resumed>)       = 709
[pid 10055] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  7190] <... unshare resumed>)      = 0
[pid 10055] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6261] close(709 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid 10055] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  7190] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  6261] <... close resumed>)        = 0
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  7190] <... socket resumed>)       = -1 EMFILE (Too many open files)
[pid  6261] socket(AF_INET, SOCK_STREAM, IPPROTO_IP <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  224.318302][ T5901] FAULT_INJECTION: forcing a failure.
[  224.318302][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  224.322301][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  224.322312][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  224.322319][ T5901] Call Trace:
[  224.322323][ T5901]  <TASK>
[  224.322327][ T5901]  dump_stack_lvl+0xe8/0x150
[  224.322344][ T5901]  should_fail_ex+0x40c/0x560
[  224.322373][ T5901]  prepare_alloc_pages+0x230/0x650
[  224.322392][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  224.322407][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  224.322436][ T5901]  ? policy_nodemask+0x27c/0x720
[  224.322450][ T5901]  alloc_pages_mpol+0x212/0x380
[  224.322462][ T5901]  allocate_slab+0x131/0x5e0
[  224.322472][ T5901]  ? kfree+0x1c5/0x640
[  224.322483][ T5901]  ___slab_alloc+0x16a/0x950
[  224.322497][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  224.322509][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  224.322519][ T5901]  ? rpc_malloc+0xeb/0x260
[  224.322531][ T5901]  ? rpc_malloc+0xeb/0x260
[  224.322545][ T5901]  rpc_malloc+0xeb/0x260
[  224.322558][ T5901]  call_allocate+0x26d/0x680
[  224.322569][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  224.322581][ T5901]  __rpc_execute+0x526/0x1280
[  224.322599][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  224.322611][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  224.322621][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  224.322634][ T5901]  rpc_execute+0x1c1/0x390
[  224.322647][ T5901]  rpc_run_task+0x4a6/0x660
[  224.322657][ T5901]  rpc_call_sync+0x10f/0x200
[  224.322665][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  224.322677][ T5901]  ? net_generic+0x1e/0x240
[  224.322685][ T5901]  ? net_generic+0x1e/0x240
[  224.322696][ T5901]  rpcb_register+0x2d0/0x530
[  224.322706][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  224.322713][ T5901]  ? net_generic+0x1e/0x240
[  224.322723][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  224.322733][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  7190] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL <unfinished ...>
[pid  6261] <... socket resumed>)       = 709
/strace: Process 10057 attached
[pid  7190] <... mount resumed>)        = 0
[pid  6261] close(709)                  = 0
[pid  6261] socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 709
[pid  7190] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  6261] close(709 <unfinished ...>
[pid  7190] <... openat resumed>)       = -1 EMFILE (Too many open files)
[pid  6261] <... close resumed>)        = 0
[pid  7190] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 123 <unfinished ...>
[pid  6261] socket(AF_INET, SOCK_STREAM, IPPROTO_IP <unfinished ...>
[pid  7190] <... write resumed>)        = 123
[pid  6261] <... socket resumed>)       = 709
[pid  7190] exit_group(0 <unfinished ...>
[pid  6261] close(709 <unfinished ...>
[pid  7190] <... exit_group resumed>)   = ?
[pid  6261] <... close resumed>)        = 0
[pid  6261] socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 709
[pid  6261] close(709)                  = 0
[pid  6261] openat(AT_FDCWD, "/proc/self/make-it-fail", O_WRONLY) = 709
[pid  6261] write(709, "1", 1)          = 1
[pid  6261] close(709)                  = 0
[  224.322745][ T5901]  svc_unregister+0x24d/0x780
[  224.322760][ T5901]  svc_bind+0x1e9/0x230
[pid  6261] write(708, "tcp 2049", 8 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10057
[  224.322770][ T5901]  nfsd_create_serv+0x581/0x840
[  224.322782][ T5901]  ? kasan_save_track+0x3e/0x80
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[  224.322794][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  224.322806][ T5901]  ? sscanf+0xe2/0x140
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[  224.322816][ T5901]  ? net_generic+0x1e/0x240
[  224.322847][ T5901]  ? __pfx_sscanf+0x10/0x10
[  224.322857][ T5901]  ? net_generic+0x1e/0x240
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[  224.322873][ T5901]  ? net_generic+0x1e/0x240
[  224.322888][ T5901]  write_ports+0x669/0xd10
[  224.322898][ T5901]  ? __pfx_write_ports+0x10/0x10
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[  224.322915][ T5901]  ? _copy_from_user+0x94/0xb0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[  224.322925][ T5901]  ? simple_transaction_get+0x12d/0x160
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10059
[  224.322936][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  224.322946][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[  224.322954][ T5901]  vfs_write+0x296/0xba0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[  224.322969][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  224.322983][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  224.322993][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[  224.323007][ T5901]  ksys_write+0x150/0x270
[  224.323018][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  224.323032][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152/strace: Process 10060 attached
 <unfinished ...>
[pid 10060] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[  224.323040][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10060
[  224.323049][ T5901]  do_syscall_64+0x174/0x580
[pid 10060] <... set_robust_list resumed>) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10060] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[  224.323060][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10060] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  224.323069][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  224.323079][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.323088][ T5901] RIP: 0033:0x7fcfafca149e
[pid 10060] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[  224.323097][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  224.323105][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  224.323115][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10061 attached
[  224.323121][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  224.323127][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  224.323132][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[  224.323137][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  224.323150][ T5901]  </TASK>
[  224.323213][ T5901] SLUB: Unable to allocate memory on CPU 1 (of node 1) on node -1, gfp=0xcc0(GFP_KERNEL)
[pid 10061] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10061
[pid 10061] <... set_robust_list resumed>) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10061] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[  224.470671][ T5901]   cache: rpc_buffers, object size: 2048, buffer size: 2176, default order: 3, min order: 0
[pid 10057] set_robust_list(0x5555728886e0, 24/strace: Process 10059 attached
[  224.477697][ T5901]   node 0: slabs: 1, objs: 15, free: 0
[  224.479558][ T5901]   node 1: slabs: 0, objs: 0, free: 0
 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10061] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10057] <... set_robust_list resumed>) = 0
[pid 10059] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  7191] <... unshare resumed>)      = 0
[pid 10061] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid 10059] <... set_robust_list resumed>) = 0
[pid 10057] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  7191] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10059] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10057] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  7191] <... socket resumed>)       = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  6265] <... unshare resumed>)      = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10059] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10057] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  7191] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid 10059] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  6265] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  7191] <... mount resumed>)        = 0
[pid  6265] <... socket resumed>)       = 713
[pid  6265] ioctl(713, SIOCGIFFLAGS, {ifr_name="lo", ifr_flags=IFF_LOOPBACK}) = 0
[pid  7191] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY/strace: Process 10063 attached
 <unfinished ...>
[pid  6265] ioctl(713, SIOCSIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING} <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10063
[pid  7191] <... openat resumed>)       = -1 EMFILE (Too many open files)
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10063] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  7191] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 123 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10063] <... set_robust_list resumed>) = 0
[pid  7191] <... write resumed>)        = 123
[pid  7191] exit_group(0 <unfinished ...>
[pid 10063] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  7191] <... exit_group resumed>)   = ?
[pid 10063] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10063] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[  224.547990][ T5901] FAULT_INJECTION: forcing a failure.
[  224.547990][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  224.552146][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  224.552158][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  224.552163][ T5901] Call Trace:
[  224.552168][ T5901]  <TASK>
[  224.552172][ T5901]  dump_stack_lvl+0xe8/0x150
[  224.552189][ T5901]  should_fail_ex+0x40c/0x560
[  224.552205][ T5901]  prepare_alloc_pages+0x230/0x650
[  224.552222][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  224.552238][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  224.552254][ T5901]  ? policy_nodemask+0x27c/0x720
[  224.552266][ T5901]  alloc_pages_mpol+0x212/0x380
[  224.552278][ T5901]  allocate_slab+0x131/0x5e0
[  224.552288][ T5901]  ? kfree+0x1c5/0x640
[  224.552300][ T5901]  ___slab_alloc+0x16a/0x950
[  224.552314][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  224.552326][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  224.552336][ T5901]  ? rpc_malloc+0xeb/0x260
[  224.552348][ T5901]  ? rpc_malloc+0xeb/0x260
[  224.552362][ T5901]  rpc_malloc+0xeb/0x260
[  224.552375][ T5901]  call_allocate+0x26d/0x680
[  224.552386][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  224.552398][ T5901]  __rpc_execute+0x526/0x1280
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10064 attached
[  224.552416][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  224.552429][ T5901]  ? rpc_task_get_xprt+0x26/0x250
 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  7193] <... unshare resumed>)      = 0
[  224.552439][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  224.552452][ T5901]  rpc_execute+0x1c1/0x390
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10064
[  224.552465][ T5901]  rpc_run_task+0x4a6/0x660
[  224.552475][ T5901]  rpc_call_sync+0x10f/0x200
[pid 10064] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[  224.552484][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10064] <... set_robust_list resumed>) = 0
[  224.552496][ T5901]  ? net_generic+0x1e/0x240
[  224.552504][ T5901]  ? net_generic+0x1e/0x240
[pid  7193] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[  224.552514][ T5901]  rpcb_register+0x2d0/0x530
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10064] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  7193] <... socket resumed>)       = -1 EMFILE (Too many open files)
[  224.552524][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10064] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  224.552531][ T5901]  ? net_generic+0x1e/0x240
[  224.552542][ T5901]  ? rpcb_create_local+0x4ee/0x670
[pid  7193] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  224.552551][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  224.552563][ T5901]  svc_unregister+0x24d/0x780
[pid 10064] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  7193] <... mount resumed>)        = 0
[  224.552578][ T5901]  svc_bind+0x1e9/0x230
[  224.552589][ T5901]  nfsd_create_serv+0x581/0x840
[  224.552601][ T5901]  ? kasan_save_track+0x3e/0x80
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[  224.552613][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  224.552625][ T5901]  ? sscanf+0xe2/0x140
[  224.552635][ T5901]  ? net_generic+0x1e/0x240
[  224.552647][ T5901]  ? __pfx_sscanf+0x10/0x10
[  224.552656][ T5901]  ? net_generic+0x1e/0x240
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[  224.552668][ T5901]  ? net_generic+0x1e/0x240
[pid  7193] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY) = -1 EMFILE (Too many open files)
[  224.552683][ T5901]  write_ports+0x669/0xd10
[  224.552693][ T5901]  ? __pfx_write_ports+0x10/0x10
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10066
[  224.552710][ T5901]  ? _copy_from_user+0x94/0xb0
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[  224.552720][ T5901]  ? simple_transaction_get+0x12d/0x160
[  224.552731][ T5901]  nfsctl_transaction_write+0x10f/0x160
[pid  7193] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 123 <unfinished ...>
[  224.552740][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  224.552749][ T5901]  vfs_write+0x296/0xba0
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  7193] <... write resumed>)        = 123
[  224.552763][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  224.552778][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  224.552788][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  224.552821][ T5901]  ksys_write+0x150/0x270
[  224.552835][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  224.552853][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[pid  7193] exit_group(0)               = ?
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  224.552862][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.552871][ T5901]  do_syscall_64+0x174/0x580
[  224.552881][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.552890][ T5901]  ? clear_bhb_loop+0x70/0xc0
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[  224.552900][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.552909][ T5901] RIP: 0033:0x7fcfafca149e
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10067 attached
 <unfinished ...>
[  224.552918][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  224.552926][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  224.552936][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[  224.552942][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10067
[pid 10067] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[  224.552948][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  224.552953][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10067] <... set_robust_list resumed>) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  224.552959][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  224.552971][ T5901]  </TASK>
[  224.552976][ T5901] SLUB: Unable to allocate memory on CPU 1 (of node 1) on node -1, gfp=0xcc0(GFP_KERNEL)
[pid 10067] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 10067] unshare(CLONE_NEWNS|CLONE_NEWNET/strace: Process 10066 attached
[  224.690507][ T5901]   cache: rpc_buffers, object size: 2048, buffer size: 2176, default order: 3, min order: 0
[  224.694874][ T5901]   node 0: slabs: 1, objs: 15, free: 0
[  224.697870][ T5901]   node 1: slabs: 0, objs: 0, free: 0
 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid 10066] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid 10066] <... set_robust_list resumed>) = 0
/strace: Process 10068 attached
[pid 10066] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10068] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid 10066] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10066] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10068
[pid 10068] <... set_robust_list resumed>) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10068] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10068] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10068] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
/strace: Process 10069 attached
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10069
[pid 10069] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10069] <... set_robust_list resumed>) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10069] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10069] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10070 attached
[  224.767715][ T5901] FAULT_INJECTION: forcing a failure.
[  224.767715][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  224.771886][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  224.771898][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  224.771904][ T5901] Call Trace:
[  224.771908][ T5901]  <TASK>
[  224.771912][ T5901]  dump_stack_lvl+0xe8/0x150
[  224.771935][ T5901]  should_fail_ex+0x40c/0x560
[  224.771951][ T5901]  prepare_alloc_pages+0x230/0x650
[  224.771969][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  224.771984][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  224.772000][ T5901]  ? policy_nodemask+0x27c/0x720
[  224.772012][ T5901]  alloc_pages_mpol+0x212/0x380
[  224.772024][ T5901]  allocate_slab+0x131/0x5e0
[  224.772034][ T5901]  ? kfree+0x1c5/0x640
[  224.772046][ T5901]  ___slab_alloc+0x16a/0x950
[  224.772060][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  224.772072][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  224.772083][ T5901]  ? rpc_malloc+0xeb/0x260
[  224.772095][ T5901]  ? rpc_malloc+0xeb/0x260
[  224.772109][ T5901]  rpc_malloc+0xeb/0x260
[  224.772122][ T5901]  call_allocate+0x26d/0x680
[  224.772134][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  224.772145][ T5901]  __rpc_execute+0x526/0x1280
[  224.772163][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  224.772176][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  224.772186][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  224.772199][ T5901]  rpc_execute+0x1c1/0x390
[  224.772212][ T5901]  rpc_run_task+0x4a6/0x660
[  224.772222][ T5901]  rpc_call_sync+0x10f/0x200
[  224.772231][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  224.772243][ T5901]  ? net_generic+0x1e/0x240
[  224.772251][ T5901]  ? net_generic+0x1e/0x240
[  224.772261][ T5901]  rpcb_register+0x2d0/0x530
[  224.772271][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  224.772278][ T5901]  ? net_generic+0x1e/0x240
[  224.772289][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  224.772298][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  224.772310][ T5901]  svc_unregister+0x24d/0x780
[  224.772325][ T5901]  svc_bind+0x1e9/0x230
[  224.772336][ T5901]  nfsd_create_serv+0x581/0x840
[  224.772348][ T5901]  ? kasan_save_track+0x3e/0x80
[  224.772359][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  224.772371][ T5901]  ? sscanf+0xe2/0x140
[  224.772382][ T5901]  ? net_generic+0x1e/0x240
[  224.772394][ T5901]  ? __pfx_sscanf+0x10/0x10
[  224.772403][ T5901]  ? net_generic+0x1e/0x240
[  224.772415][ T5901]  ? net_generic+0x1e/0x240
[  224.772430][ T5901]  write_ports+0x669/0xd10
[  224.772439][ T5901]  ? __pfx_write_ports+0x10/0x10
[  224.772456][ T5901]  ? _copy_from_user+0x94/0xb0
[  224.772467][ T5901]  ? simple_transaction_get+0x12d/0x160
[  224.772477][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  224.772487][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  224.772496][ T5901]  vfs_write+0x296/0xba0
[  224.772510][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  224.772524][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  224.772534][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  224.772548][ T5901]  ksys_write+0x150/0x270
[  224.772560][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  224.772573][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.772582][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.772590][ T5901]  do_syscall_64+0x174/0x580
[  224.772601][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.772610][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  224.772620][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.772629][ T5901] RIP: 0033:0x7fcfafca149e
[  224.772638][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  224.772645][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  224.772655][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  224.772661][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  224.772667][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  224.772672][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  224.772677][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  224.772690][ T5901]  </TASK>
[  224.772695][ T5901] SLUB: Unable to allocate memory on CPU 1 (of node 1) on node -1, gfp=0xcc0(GFP_KERNEL)
 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  8939] <... unshare resumed>)      = 0
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10070
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  8939] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  8939] <... socket resumed>)       = -1 EMFILE (Too many open files)
[pid 10070] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  8939] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL <unfinished ...>
[pid 10070] <... set_robust_list resumed>) = 0
[pid  8939] <... mount resumed>)        = 0
[pid 10070] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  8939] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  8939] <... openat resumed>)       = -1 EMFILE (Too many open files)
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid 10070] <... rt_sigprocmask resumed>, NULL, 8) = 0
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[pid  8939] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 161 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid 10070] unshare(CLONE_NEWNS|CLONE_NEWNET/strace: Process 10072 attached
 <unfinished ...>
[pid  8939] <... write resumed>)        = 161
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  8939] exit_group(0 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10072
[pid 10072] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10072] <... set_robust_list resumed>) = 0
[pid  8939] <... exit_group resumed>)   = ?
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10072] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10072] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10072] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10073 attached
, child_tidptr=0x5555728886d0) = 10073
[pid 10073] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10073] <... set_robust_list resumed>) = 0
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 10073] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10073] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  224.962188][ T5901]   cache: rpc_buffers, object size: 2048, buffer size: 2176, default order: 3, min order: 0
[  224.975626][ T5901]   node 0: slabs: 1, objs: 15, free: 0
[pid 10073] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[  224.992436][ T5901]   node 1: slabs: 0, objs: 0, free: 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10074 attached
, child_tidptr=0x5555728886d0) = 10074
[pid 10074] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 10074] <... set_robust_list resumed>) = 0
[pid 10074] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10074] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid 10074] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152/strace: Process 10075 attached
) = -1 EMFILE (Too many open files)
[pid  6553] <... unshare resumed>)      = 0
[pid  6553] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10075
[pid 10075] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  6553] <... socket resumed>)       = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10075] <... set_robust_list resumed>) = 0
[pid  6553] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10075] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid 10075] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6553] <... mount resumed>)        = 0
[pid 10075] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[  225.057820][ T5901] FAULT_INJECTION: forcing a failure.
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[  225.057820][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  225.062267][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  225.062280][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  225.062286][ T5901] Call Trace:
[  225.062290][ T5901]  <TASK>
[  225.062294][ T5901]  dump_stack_lvl+0xe8/0x150
[  225.062311][ T5901]  should_fail_ex+0x40c/0x560
[  225.062327][ T5901]  prepare_alloc_pages+0x230/0x650
[  225.062345][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  225.062360][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  225.062393][ T5901]  ? policy_nodemask+0x27c/0x720
[  225.062406][ T5901]  alloc_pages_mpol+0x212/0x380
[  225.062417][ T5901]  allocate_slab+0x131/0x5e0
[  225.062427][ T5901]  ? kfree+0x1c5/0x640
[  225.062439][ T5901]  ___slab_alloc+0x16a/0x950
[  225.062453][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  225.062465][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  225.062475][ T5901]  ? rpc_malloc+0xeb/0x260
[  225.062487][ T5901]  ? rpc_malloc+0xeb/0x260
[  225.062502][ T5901]  rpc_malloc+0xeb/0x260
[  225.062514][ T5901]  call_allocate+0x26d/0x680
[  225.062526][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  225.062538][ T5901]  __rpc_execute+0x526/0x1280
[  225.062556][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  225.062568][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  225.062579][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  225.062592][ T5901]  rpc_execute+0x1c1/0x390
[  225.062605][ T5901]  rpc_run_task+0x4a6/0x660
[  225.062615][ T5901]  rpc_call_sync+0x10f/0x200
[  225.062624][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  225.062636][ T5901]  ? net_generic+0x1e/0x240
[  225.062644][ T5901]  ? net_generic+0x1e/0x240
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[pid  6553] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  6553] <... openat resumed>)       = -1 EMFILE (Too many open files)
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  6553] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 104 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10077
/strace: Process 10077 attached
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  6553] <... write resumed>)        = 104
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10077] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[  225.062655][ T5901]  rpcb_register+0x2d0/0x530
[pid  6553] exit_group(0 <unfinished ...>
[pid 10077] <... set_robust_list resumed>) = 0
[pid  6553] <... exit_group resumed>)   = ?
[  225.062664][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  225.062672][ T5901]  ? net_generic+0x1e/0x240
[pid 10077] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[  225.062682][ T5901]  ? rpcb_create_local+0x4ee/0x670
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[  225.062691][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[pid 10077] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.062704][ T5901]  svc_unregister+0x24d/0x780
[  225.062719][ T5901]  svc_bind+0x1e9/0x230
[  225.062730][ T5901]  nfsd_create_serv+0x581/0x840
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[  225.062743][ T5901]  ? kasan_save_track+0x3e/0x80
[  225.062775][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10078 attached
[  225.062787][ T5901]  ? sscanf+0xe2/0x140
[  225.062798][ T5901]  ? net_generic+0x1e/0x240
[  225.062810][ T5901]  ? __pfx_sscanf+0x10/0x10
[  225.062819][ T5901]  ? net_generic+0x1e/0x240
 <unfinished ...>
[  225.062831][ T5901]  ? net_generic+0x1e/0x240
[  225.062851][ T5901]  write_ports+0x669/0xd10
[  225.062861][ T5901]  ? __pfx_write_ports+0x10/0x10
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10078
[  225.062878][ T5901]  ? _copy_from_user+0x94/0xb0
[pid 10078] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.062889][ T5901]  ? simple_transaction_get+0x12d/0x160
[  225.062900][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  225.062909][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  225.062918][ T5901]  vfs_write+0x296/0xba0
[  225.062933][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  225.062947][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  225.062958][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.062972][ T5901]  ksys_write+0x150/0x270
[  225.062984][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  225.062996][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.063005][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.063014][ T5901]  do_syscall_64+0x174/0x580
[  225.063025][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.063033][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  225.063044][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10078] <... set_robust_list resumed>) = 0
[  225.063052][ T5901] RIP: 0033:0x7fcfafca149e
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  225.063062][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[pid 10078] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[  225.063070][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[  225.063080][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  225.063086][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[pid 10078] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  7199] <... unshare resumed>)      = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.063091][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  225.063096][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  225.063101][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  225.063114][ T5901]  </TASK>
[  225.063207][ T5901] SLUB: Unable to allocate memory on CPU 1 (of node 1) on node -1, gfp=0xcc0(GFP_KERNEL)
[  225.196195][ T5901]   cache: rpc_buffers, object size: 2048, buffer size: 2176, default order: 3, min order: 0
[  225.199500][ T5901]   node 0: slabs: 1, objs: 15, free: 0
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  7199] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  7199] <... socket resumed>)       = -1 EMFILE (Too many open files)
[  225.201302][ T5901]   node 1: slabs: 0, objs: 0, free: 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  7199] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10080
[pid  7199] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  7199] <... openat resumed>)       = -1 EMFILE (Too many open files)
/strace: Process 10080 attached
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10080] set_robust_list(0x5555728886e0, 24) = 0
[pid 10080] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[pid  7199] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 123 <unfinished ...>
[pid 10080] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  7199] <... write resumed>)        = 123
[pid 10080] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  7199] exit_group(0 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  7199] <... exit_group resumed>)   = ?
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  6140] <... unshare resumed>)      = 0
/strace: Process 10082 attached
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10082
[pid 10082] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  6140] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  6140] <... socket resumed>)       = 474
[pid 10082] <... set_robust_list resumed>) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10082] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[  225.269276][ T5901] FAULT_INJECTION: forcing a failure.
[  225.269276][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[pid  6140] ioctl(474, SIOCGIFFLAGS, {ifr_name="lo" <unfinished ...>
[pid 10082] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6140] <... ioctl resumed>, ifr_flags=IFF_LOOPBACK}) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10082] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.278181][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  225.278194][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  225.278200][ T5901] Call Trace:
[  225.278204][ T5901]  <TASK>
[  225.278208][ T5901]  dump_stack_lvl+0xe8/0x150
[  225.278225][ T5901]  should_fail_ex+0x40c/0x560
[  225.278242][ T5901]  prepare_alloc_pages+0x230/0x650
[  225.278259][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  225.278275][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  225.278291][ T5901]  ? policy_nodemask+0x27c/0x720
[  225.278303][ T5901]  alloc_pages_mpol+0x212/0x380
[  225.278315][ T5901]  allocate_slab+0x131/0x5e0
[  225.278325][ T5901]  ? kfree+0x1c5/0x640
[  225.278337][ T5901]  ___slab_alloc+0x16a/0x950
[  225.278351][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  225.278362][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  225.278373][ T5901]  ? rpc_malloc+0xeb/0x260
[  225.278385][ T5901]  ? rpc_malloc+0xeb/0x260
[  225.278399][ T5901]  rpc_malloc+0xeb/0x260
[  225.278412][ T5901]  call_allocate+0x26d/0x680
[  225.278424][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  225.278436][ T5901]  __rpc_execute+0x526/0x1280
[  225.278453][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  225.278466][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  225.278477][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  225.278490][ T5901]  rpc_execute+0x1c1/0x390
[  225.278502][ T5901]  rpc_run_task+0x4a6/0x660
[  225.278513][ T5901]  rpc_call_sync+0x10f/0x200
[  225.278521][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  225.278533][ T5901]  ? net_generic+0x1e/0x240
[  225.278542][ T5901]  ? net_generic+0x1e/0x240
[  225.278552][ T5901]  rpcb_register+0x2d0/0x530
[  225.278562][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  225.278569][ T5901]  ? net_generic+0x1e/0x240
[  225.278580][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  225.278589][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  225.278602][ T5901]  svc_unregister+0x24d/0x780
[  225.278617][ T5901]  svc_bind+0x1e9/0x230
[  225.278628][ T5901]  nfsd_create_serv+0x581/0x840
[  225.278640][ T5901]  ? kasan_save_track+0x3e/0x80
[  225.278652][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  225.278664][ T5901]  ? sscanf+0xe2/0x140
[  225.278674][ T5901]  ? net_generic+0x1e/0x240
[  225.278686][ T5901]  ? __pfx_sscanf+0x10/0x10
[  225.278696][ T5901]  ? net_generic+0x1e/0x240
[  225.278708][ T5901]  ? net_generic+0x1e/0x240
[  225.278722][ T5901]  write_ports+0x669/0xd10
[  225.278754][ T5901]  ? __pfx_write_ports+0x10/0x10
[  225.278771][ T5901]  ? _copy_from_user+0x94/0xb0
[  225.278781][ T5901]  ? simple_transaction_get+0x12d/0x160
[  225.278792][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  225.278802][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  225.278811][ T5901]  vfs_write+0x296/0xba0
[  225.278831][ T5901]  ? __pfx_vfs_write+0x10/0x10
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  6141] <... unshare resumed>)      = 0
[  225.278845][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  225.278855][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.278869][ T5901]  ksys_write+0x150/0x270
[  225.278880][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  225.278894][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.278903][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.278911][ T5901]  do_syscall_64+0x174/0x580
[  225.278922][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.278930][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  225.278941][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.278949][ T5901] RIP: 0033:0x7fcfafca149e
[pid  6140] ioctl(474, SIOCSIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING} <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[  225.278957][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[pid  6141] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[  225.278965][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  225.278975][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  225.278981][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152/strace: Process 10084 attached
[  225.278987][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  225.278992][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  225.278997][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  225.279010][ T5901]  </TASK>
[  225.279015][ T5901] SLUB: Unable to allocate memory on CPU 1 (of node 1) on node -1, gfp=0xcc0(GFP_KERNEL)
 <unfinished ...>
[pid  6141] <... socket resumed>)       = 476
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.404970][ T5901]   cache: rpc_buffers, object size: 2048, buffer size: 2176, default order: 3, min order: 0
[  225.409641][ T5901]   node 0: slabs: 1, objs: 15, free: 0
[  225.412928][ T5901]   node 1: slabs: 0, objs: 0, free: 0
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10084
[pid  6141] ioctl(476, SIOCGIFFLAGS, {ifr_name="lo" <unfinished ...>
[pid 10084] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10084] <... set_robust_list resumed>) = 0
[pid  6141] <... ioctl resumed>, ifr_flags=IFF_LOOPBACK}) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10084] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  6141] ioctl(476, SIOCSIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING} <unfinished ...>
[pid 10084] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10084] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  6558] <... unshare resumed>)      = 0
[pid  6558] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  6558] <... socket resumed>)       = -1 EMFILE (Too many open files)
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  6558] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL/strace: Process 10086 attached
 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.477734][ T5901] FAULT_INJECTION: forcing a failure.
[pid  6558] <... mount resumed>)        = 0
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10086
[  225.477734][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  225.481933][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[pid 10086] set_robust_list(0x5555728886e0, 24) = 0
[pid 10086] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[  225.481945][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  225.481952][ T5901] Call Trace:
[  225.481956][ T5901]  <TASK>
[  225.481961][ T5901]  dump_stack_lvl+0xe8/0x150
[  225.481977][ T5901]  should_fail_ex+0x40c/0x560
[  225.481993][ T5901]  prepare_alloc_pages+0x230/0x650
[  225.482011][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  225.482027][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  225.482044][ T5901]  ? policy_nodemask+0x27c/0x720
[  225.482056][ T5901]  alloc_pages_mpol+0x212/0x380
[  225.482068][ T5901]  allocate_slab+0x131/0x5e0
[  225.482079][ T5901]  ? kfree+0x1c5/0x640
[  225.482091][ T5901]  ___slab_alloc+0x16a/0x950
[  225.482105][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  225.482116][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  225.482127][ T5901]  ? rpc_malloc+0xeb/0x260
[  225.482139][ T5901]  ? rpc_malloc+0xeb/0x260
[  225.482153][ T5901]  rpc_malloc+0xeb/0x260
[  225.482166][ T5901]  call_allocate+0x26d/0x680
[  225.482178][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  225.482190][ T5901]  __rpc_execute+0x526/0x1280
[  225.482208][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  225.482220][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  225.482231][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  225.482244][ T5901]  rpc_execute+0x1c1/0x390
[  225.482256][ T5901]  rpc_run_task+0x4a6/0x660
[  225.482267][ T5901]  rpc_call_sync+0x10f/0x200
[  225.482275][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  225.482287][ T5901]  ? net_generic+0x1e/0x240
[  225.482296][ T5901]  ? net_generic+0x1e/0x240
[  225.482308][ T5901]  rpcb_register+0x2d0/0x530
[  225.482318][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  225.482326][ T5901]  ? net_generic+0x1e/0x240
[  225.482336][ T5901]  ? rpcb_create_local+0x4ee/0x670
[pid 10086] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  6558] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6558] <... openat resumed>)       = -1 EMFILE (Too many open files)
[  225.482345][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  225.482357][ T5901]  svc_unregister+0x24d/0x780
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[  225.482372][ T5901]  svc_bind+0x1e9/0x230
[  225.482383][ T5901]  nfsd_create_serv+0x581/0x840
[  225.482396][ T5901]  ? kasan_save_track+0x3e/0x80
[  225.482407][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  225.482419][ T5901]  ? sscanf+0xe2/0x140
[  225.482429][ T5901]  ? net_generic+0x1e/0x240
[  225.482441][ T5901]  ? __pfx_sscanf+0x10/0x10
[  225.482451][ T5901]  ? net_generic+0x1e/0x240
[  225.482462][ T5901]  ? net_generic+0x1e/0x240
[  225.482477][ T5901]  write_ports+0x669/0xd10
[  225.482487][ T5901]  ? __pfx_write_ports+0x10/0x10
[  225.482504][ T5901]  ? _copy_from_user+0x94/0xb0
[  225.482514][ T5901]  ? simple_transaction_get+0x12d/0x160
[  225.482525][ T5901]  nfsctl_transaction_write+0x10f/0x160
[pid  6558] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 104 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.482535][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  225.482544][ T5901]  vfs_write+0x296/0xba0
[  225.482558][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  225.482572][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[pid  6558] <... write resumed>)        = 104
[  225.482582][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[  225.482596][ T5901]  ksys_write+0x150/0x270
[  225.482608][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  225.482620][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.482629][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.482638][ T5901]  do_syscall_64+0x174/0x580
[pid  6558] exit_group(0 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  6558] <... exit_group resumed>)   = ?
[  225.482648][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.482657][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  225.482667][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.482675][ T5901] RIP: 0033:0x7fcfafca149e
[  225.482685][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  225.482692][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  225.482721][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[  225.482728][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  225.482734][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  225.482739][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  225.482744][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  225.482757][ T5901]  </TASK>
[  225.482763][ T5901] SLUB: Unable to allocate memory on CPU 1 (of node 1) on node -1, gfp=0xcc0(GFP_KERNEL)
[  225.605118][ T5901]   cache: rpc_buffers, object size: 2048, buffer size: 2176, default order: 3, min order: 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152/strace: Process 10087 attached
[  225.608330][ T5901]   node 0: slabs: 1, objs: 15, free: 0
[  225.610044][ T5901]   node 1: slabs: 0, objs: 0, free: 0
) = -1 EMFILE (Too many open files)
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10087
[pid 10087] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  8107] <... unshare resumed>)      = 0
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  8107] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10087] <... set_robust_list resumed>) = 0
[pid  8107] <... socket resumed>)       = -1 EMFILE (Too many open files)
[pid 10087] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  8107] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10087] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  8107] <... mount resumed>)        = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid 10087] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  8107] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  8107] <... openat resumed>)       = -1 EMFILE (Too many open files)
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152/strace: Process 10089 attached
[  225.677677][ T5901] FAULT_INJECTION: forcing a failure.
[  225.677677][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
 <unfinished ...>
[pid  8107] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 142 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10089
[pid 10089] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  8107] <... write resumed>)        = 142
[  225.687112][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10089] <... set_robust_list resumed>) = 0
[  225.687126][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  225.687132][ T5901] Call Trace:
[pid  8107] exit_group(0 <unfinished ...>
[  225.687136][ T5901]  <TASK>
[  225.687140][ T5901]  dump_stack_lvl+0xe8/0x150
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  225.687158][ T5901]  should_fail_ex+0x40c/0x560
[  225.687174][ T5901]  prepare_alloc_pages+0x230/0x650
[pid 10089] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  8107] <... exit_group resumed>)   = ?
[  225.687191][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  225.687211][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  225.687228][ T5901]  ? policy_nodemask+0x27c/0x720
[  225.687240][ T5901]  alloc_pages_mpol+0x212/0x380
[  225.687252][ T5901]  allocate_slab+0x131/0x5e0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10089] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.687262][ T5901]  ? kfree+0x1c5/0x640
[  225.687274][ T5901]  ___slab_alloc+0x16a/0x950
[  225.687288][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  225.687300][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  225.687310][ T5901]  ? rpc_malloc+0xeb/0x260
[pid 10089] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[  225.687322][ T5901]  ? rpc_malloc+0xeb/0x260
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[  225.687336][ T5901]  rpc_malloc+0xeb/0x260
[  225.687351][ T5901]  call_allocate+0x26d/0x680
[  225.687363][ T5901]  ? __pfx_call_allocate+0x10/0x10
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.687374][ T5901]  __rpc_execute+0x526/0x1280
[  225.687392][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  225.687405][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10090 attached
[  225.687415][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  225.687428][ T5901]  rpc_execute+0x1c1/0x390
[  225.687441][ T5901]  rpc_run_task+0x4a6/0x660
, child_tidptr=0x5555728886d0) = 10090
[  225.687451][ T5901]  rpc_call_sync+0x10f/0x200
[  225.687460][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  225.687472][ T5901]  ? net_generic+0x1e/0x240
[pid 10090] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10090] <... set_robust_list resumed>) = 0
[  225.687481][ T5901]  ? net_generic+0x1e/0x240
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[  225.687491][ T5901]  rpcb_register+0x2d0/0x530
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10090] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[  225.687501][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.687508][ T5901]  ? net_generic+0x1e/0x240
[  225.687518][ T5901]  ? rpcb_create_local+0x4ee/0x670
[pid 10090] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  225.687528][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  225.687553][ T5901]  svc_unregister+0x24d/0x780
[  225.687570][ T5901]  svc_bind+0x1e9/0x230
[  225.687581][ T5901]  nfsd_create_serv+0x581/0x840
[  225.687594][ T5901]  ? kasan_save_track+0x3e/0x80
[  225.687605][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  225.687617][ T5901]  ? sscanf+0xe2/0x140
[  225.687627][ T5901]  ? net_generic+0x1e/0x240
[  225.687639][ T5901]  ? __pfx_sscanf+0x10/0x10
[  225.687648][ T5901]  ? net_generic+0x1e/0x240
[  225.687660][ T5901]  ? net_generic+0x1e/0x240
[  225.687674][ T5901]  write_ports+0x669/0xd10
[  225.687711][ T5901]  ? __pfx_write_ports+0x10/0x10
[  225.687736][ T5901]  ? _copy_from_user+0x94/0xb0
[  225.687747][ T5901]  ? simple_transaction_get+0x12d/0x160
[  225.687757][ T5901]  nfsctl_transaction_write+0x10f/0x160
[pid 10090] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[  225.687767][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  225.687775][ T5901]  vfs_write+0x296/0xba0
[  225.687790][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  225.687804][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  225.687814][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.687827][ T5901]  ksys_write+0x150/0x270
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[  225.687839][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  225.687852][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.687861][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.687869][ T5901]  do_syscall_64+0x174/0x580
[  225.687880][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[  225.687888][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  225.687899][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.687907][ T5901] RIP: 0033:0x7fcfafca149e
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10091
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.687917][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  225.687924][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  225.687934][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  225.687941][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  225.687946][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  225.687951][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  225.687957][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  225.687969][ T5901]  </TASK>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
/strace: Process 10091 attached
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid 10091] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[  225.844495][ T5901] SLUB: Unable to allocate memory on CPU 1 (of node 1) on node -1, gfp=0xcc0(GFP_KERNEL)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid 10091] <... set_robust_list resumed>) = 0
[pid  7207] <... unshare resumed>)      = 0
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid 10091] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid 10091] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  7207] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10091] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  7207] <... socket resumed>)       = -1 EMFILE (Too many open files)
/strace: Process 10095 attached
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10095
[pid  8971] <... unshare resumed>)      = 0
[pid  6853] <... unshare resumed>)      = 0
[pid  7207] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10095] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  6853] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  8971] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  7207] <... mount resumed>)        = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10095] <... set_robust_list resumed>) = 0
[pid  8971] <... socket resumed>)       = -1 EMFILE (Too many open files)
[pid  6853] <... socket resumed>)       = -1 EMFILE (Too many open files)
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.986466][ T5901]   cache: rpc_buffers, object size: 2048, buffer size: 2176, default order: 3, min order: 0
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[pid  7207] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  6853] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL <unfinished ...>
[pid 10095] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  8971] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL <unfinished ...>
[pid  7207] <... openat resumed>)       = -1 EMFILE (Too many open files)
[pid  8971] <... mount resumed>)        = 0
[pid  7207] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 123 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  8971] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  7207] <... write resumed>)        = 123
[pid 10095] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[  225.993487][ T5901]   node 0: slabs: 1, objs: 15, free: 0
[pid  8971] <... openat resumed>)       = -1 EMFILE (Too many open files)
[pid  7207] exit_group(0 <unfinished ...>
[pid 10095] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  6853] <... mount resumed>)        = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[+] Iteration 2500
[  226.003737][ T5901]   node 1: slabs: 0, objs: 0, free: 0
[pid  8971] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 180 <unfinished ...>
[pid  7207] <... exit_group resumed>)   = ?
/strace: Process 10096 attached
[pid  8971] <... write resumed>)        = 180
[pid  6853] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10096
[pid 10096] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  8971] exit_group(0 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10096] <... set_robust_list resumed>) = 0
[pid  8971] <... exit_group resumed>)   = ?
[pid  6853] <... openat resumed>)       = -1 EMFILE (Too many open files)
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10096] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  6853] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 104) = 104
[pid 10096] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6268] <... unshare resumed>)      = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10096] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  6853] exit_group(0 <unfinished ...>
[pid  6268] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 744
[pid  6268] ioctl(744, SIOCGIFFLAGS, {ifr_name="lo" <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  6853] <... exit_group resumed>)   = ?
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  6268] <... ioctl resumed>, ifr_flags=IFF_LOOPBACK}) = 0
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  6268] ioctl(744, SIOCSIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING} <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10098 attached
 <unfinished ...>
[  226.068180][ T5901] FAULT_INJECTION: forcing a failure.
[  226.068180][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  226.072498][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  226.072510][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  226.072516][ T5901] Call Trace:
[  226.072520][ T5901]  <TASK>
[  226.072524][ T5901]  dump_stack_lvl+0xe8/0x150
[  226.072541][ T5901]  should_fail_ex+0x40c/0x560
[  226.072557][ T5901]  prepare_alloc_pages+0x230/0x650
[  226.072575][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  226.072590][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  226.072607][ T5901]  ? policy_nodemask+0x27c/0x720
[  226.072619][ T5901]  alloc_pages_mpol+0x212/0x380
[  226.072630][ T5901]  allocate_slab+0x131/0x5e0
[  226.072666][ T5901]  ? kfree+0x1c5/0x640
[  226.072680][ T5901]  ___slab_alloc+0x16a/0x950
[  226.072694][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  226.072706][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  226.072717][ T5901]  ? rpc_malloc+0xeb/0x260
[  226.072728][ T5901]  ? rpc_malloc+0xeb/0x260
[  226.072743][ T5901]  rpc_malloc+0xeb/0x260
[  226.072756][ T5901]  call_allocate+0x26d/0x680
[  226.072768][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  226.072779][ T5901]  __rpc_execute+0x526/0x1280
[  226.072798][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10098
[pid 10098] set_robust_list(0x5555728886e0, 24) = 0
[pid 10098] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 10098] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  6271] <... unshare resumed>)      = 0
[pid  6271] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 749
[pid  6271] ioctl(749, SIOCGIFFLAGS, {ifr_name="lo", ifr_flags=IFF_LOOPBACK}) = 0
[pid  6271] ioctl(749, SIOCSIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING}) = 0
[pid  6271] close(749)                  = 0
[pid  6271] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL) = 0
[  226.072810][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  226.072821][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  226.072833][ T5901]  rpc_execute+0x1c1/0x390
[  226.072846][ T5901]  rpc_run_task+0x4a6/0x660
[  226.072857][ T5901]  rpc_call_sync+0x10f/0x200
[  226.072866][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  226.072878][ T5901]  ? net_generic+0x1e/0x240
[  226.072886][ T5901]  ? net_generic+0x1e/0x240
[  226.072902][ T5901]  rpcb_register+0x2d0/0x530
[pid  6271] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  226.072912][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[pid  6271] <... openat resumed>)       = 749
[  226.072919][ T5901]  ? net_generic+0x1e/0x240
[  226.072930][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  226.072939][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[pid  6271] openat(AT_FDCWD, "/tmp/nfsd/filehandle", O_RDWR) = 750
[  226.072951][ T5901]  svc_unregister+0x24d/0x780
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[  226.072966][ T5901]  svc_bind+0x1e9/0x230
[  226.072977][ T5901]  nfsd_create_serv+0x581/0x840
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[  226.072990][ T5901]  ? kasan_save_track+0x3e/0x80

[host] Command execution timed out after 2m30s
]

best-expensive

map[Feedback:The reproduction attempt failed to trigger the bug because of three main issues in the reproducer logic:

1. **Failure to exhaust percpu memory (`EMFILE`)**: The reproducer attempts to exhaust percpu memory by creating many `BPF_MAP_TYPE_PERCPU_ARRAY` maps. However, it hits the `RLIMIT_NOFILE` limit (1024) and receives `EMFILE` before percpu memory is actually exhausted. Because percpu memory is not full, `__alloc_percpu_gfp` does not call the page allocator, meaning `fail_page_alloc` does not intercept it, and `percpu_counter_init` succeeds.

2. **`percpu_ref_init` failing first**: Even if percpu memory was exhausted, `nfsd_create_serv` calls `percpu_ref_init` before `__svc_create` (which calls `percpu_counter_init`). If percpu memory is full, `percpu_ref_init` will fail and abort the service creation, meaning `percpu_counter_init` is never reached.

3. **`rpc_malloc` failing due to `fail_page_alloc`**: The reproducer enables `fail_page_alloc` for the task and then calls `write_ports`. This causes `rpc_malloc` (called via `svc_bind`) to fail because the `rpc_buffers` slab cache is empty and calls the page allocator. When `svc_bind` fails, the transport creation is aborted before `svc_xprt_enqueue` is ever called.

**How to improve the reproducer:**
1. **Pre-allocate slab objects**: Before enabling `fail_page_alloc`, write `tcp 2049` to `/tmp/nfsd/portlist` to create a transport, then write `0` to `/tmp/nfsd/threads` to destroy it. This populates the slab caches (`rpc_buffers`, `socket`, `svc_sock`, etc.) with free objects. When `fail_page_alloc` is enabled later, these allocations will succeed without calling the page allocator.
2. **Increase `RLIMIT_NOFILE`**: Call `setrlimit(RLIMIT_NOFILE, ...)` to allow creating enough BPF maps to fully exhaust percpu memory.
3. **Precise percpu memory hole**: To make `percpu_ref_init` succeed but `percpu_counter_init` fail, you must leave exactly 8 bytes of free percpu memory. Do this by creating a BPF map with `value_size = 8`, then exhaust the rest of the percpu memory using maps of decreasing sizes (from 32768 down to 8), and finally close the 8-byte map. This leaves an 8-byte hole that `percpu_ref_init` will consume, leaving 0 bytes for `percpu_counter_init`, forcing it to hit the page allocator and fail. ProbePassed:false TerminalError: TitleMatches:false]

You are a security researcher with deep Linux kernel background.
Analyze the results of running the generated program.

=== CRITICAL ENVIRONMENT & TARGET CLASSIFICATION ===
Set 'TerminalError' to a descriptive error message ONLY if:
1. The execution failed due to missing hardware device nodes, subsystems, kernel modules, or privilege limits
   that cannot be loaded, created, or bypassed by user-space C code edits in the VM guest.
2. The target source files or functions described in the bug description do not exist in the checked-out codebase,
   meaning the codebase version is mismatched and the target code is absent.

=== CRITICAL PROHIBITIONS ===
- Do NOT classify a run as a terminal failure or assume a bug is fixed based on git log entries, commit titles,
  or commit messages. Reproducibility can ONLY be determined by executing reproducer candidates in the VM.
- Do NOT suggest C code strategies, repairs, or namespace bypasses when setting 'TerminalError'.


=== PHASE 2: BUG REPRODUCTION (EVALUATION) ===
The executed program was a full reproducer candidate attempting to trigger the target bug/crash.
Use this to guide your classification and feedback:
1. If a crash was triggered (Reproduced is true):
   - Determine if the triggered crash matches the expected bug.
   - If you conclude they represent the same underlying bug (the same root cause)
     despite different titles, crash signatures, or call traces, set TitleMatches
     to true and provide a detailed, technical, and verbose explanation of the
     equivalence in the 'Feedback' field.
   - If they do not represent the same bug (a completely unrelated crash/collision),
     set TitleMatches to false and explain the collision in 'Feedback'.
   - If they match exactly, set TitleMatches to true and provide a brief confirmation in 'Feedback'.
2. If the execution was successful (exit 0) WITHOUT a crash (Reproduced is false):
   - The reproduction attempt failed to trigger the bug. Analyze the console/strace output
     to understand why the bug did not trigger (e.g., timing, input arguments, environment setup)
     and provide feedback on how to improve the reproducer logic to trigger the crash.

Critical Diagnostic Rule for Reproduction Failures:
If the reproduction attempt fails (e.g., a system call returns an error, or a
warning/error message appears in the console log), you MUST:
1. Identify the failing system call from the execution trace or strace output.
2. Identify any corresponding warning or error messages in the console log.
3. Immediately search the kernel source tree for the warning message strings or
   the code of the failing system call/subsystem to locate the validation logic.
4. Trace the kernel's validation logic to diagnose the exact constraint violation
   or input mismatch in the generated program.
5. Provide a technical diagnosis in the feedback explaining the exact kernel constraint that was violated and why.

Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Bug Description: BUG: unable to handle kernel paging request in percpu_counter_add_batch

BUG: unable to handle page fault for address: ffff88808c54a000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 1acd5067 P4D 1acd5067 PUD 0 
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 5311 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:percpu_counter_add_batch+0x50/0x1d0 lib/percpu_counter.c:98
Code: f6 48 b7 fc 48 89 5c 24 10 48 83 c3 58 49 89 de 49 c1 ee 03 43 80 3c 3e 00 74 08 48 89 df e8 07 7d 26 fd 48 89 1c 24 48 8b 03 <65> 8b 28 41 89 ef 41 c1 ff 1f 49 c1 e7 20 4c 89 6c 24 08 4d 01 ef
RSP: 0018:ffffc9000dc47810 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888036dc4930 RCX: ffff888012f0ca80
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888036dc48d8
RBP: ffffc9000dc47908 R08: ffff888012c3e03f R09: 1ffff11002587c07
R10: dffffc0000000000 R11: ffffed1002587c08 R12: 0000000000000020
R13: 0000000000000001 R14: 1ffff11006db8926 R15: dffffc0000000000
FS:  00007f711d27e6c0(0000) GS:ffff88808c54a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88808c54a000 CR3: 000000001fde5000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 percpu_counter_add include/linux/percpu_counter.h:71 [inline]
 percpu_counter_inc include/linux/percpu_counter.h:267 [inline]
 svc_xprt_enqueue+0x2ee/0x8b0 net/sunrpc/svc_xprt.c:524
 svc_xprt_received+0x10f/0x150 net/sunrpc/svc_xprt.c:248
 svc_add_new_perm_xprt net/sunrpc/svc_xprt.c:260 [inline]
 _svc_xprt_create+0x3d8/0x600 net/sunrpc/svc_xprt.c:290
 svc_xprt_create_from_sa net/sunrpc/svc_xprt.c:332 [inline]
 svc_xprt_create+0x1aa/0x280 net/sunrpc/svc_xprt.c:387
 __write_ports_addxprt fs/nfsd/nfsctl.c:774 [inline]
 __write_ports fs/nfsd/nfsctl.c:808 [inline]
 write_ports+0x71a/0xd10 fs/nfsd/nfsctl.c:861
 nfsctl_transaction_write+0x10f/0x160 fs/nfsd/nfsctl.c:112
 vfs_write+0x296/0xba0 fs/read_write.c:685
 ksys_write+0x150/0x270 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f711c39e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f711d27dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f711c625fa0 RCX: 00007f711c39e0d9
RDX: 0000000000000005 RSI: 0000200000000300 RDI: 0000000000000004
RBP: 00007f711c435024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f711c626038 R14: 00007f711c625fa0 R15: 00007ffc740e4ce8
 </TASK>
Modules linked in:
CR2: ffff88808c54a000
---[ end trace 0000000000000000 ]---
RIP: 0010:percpu_counter_add_batch+0x50/0x1d0 lib/percpu_counter.c:98
Code: f6 48 b7 fc 48 89 5c 24 10 48 83 c3 58 49 89 de 49 c1 ee 03 43 80 3c 3e 00 74 08 48 89 df e8 07 7d 26 fd 48 89 1c 24 48 8b 03 <65> 8b 28 41 89 ef 41 c1 ff 1f 49 c1 e7 20 4c 89 6c 24 08 4d 01 ef
RSP: 0018:ffffc9000dc47810 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff888036dc4930 RCX: ffff888012f0ca80
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888036dc48d8
RBP: ffffc9000dc47908 R08: ffff888012c3e03f R09: 1ffff11002587c07
R10: dffffc0000000000 R11: ffffed1002587c08 R12: 0000000000000020
R13: 0000000000000001 R14: 1ffff11006db8926 R15: dffffc0000000000
FS:  00007f711d27e6c0(0000) GS:ffff88808c54a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff88808c54a000 CR3: 000000001fde5000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
   0:	f6 48 b7 fc          	testb  $0xfc,-0x49(%rax)
   4:	48 89 5c 24 10       	mov    %rbx,0x10(%rsp)
   9:	48 83 c3 58          	add    $0x58,%rbx
   d:	49 89 de             	mov    %rbx,%r14
  10:	49 c1 ee 03          	shr    $0x3,%r14
  14:	43 80 3c 3e 00       	cmpb   $0x0,(%r14,%r15,1)
  19:	74 08                	je     0x23
  1b:	48 89 df             	mov    %rbx,%rdi
  1e:	e8 07 7d 26 fd       	call   0xfd267d2a
  23:	48 89 1c 24          	mov    %rbx,(%rsp)
  27:	48 8b 03             	mov    (%rbx),%rax
* 2a:	65 8b 28             	mov    %gs:(%rax),%ebp <-- trapping instruction
  2d:	41 89 ef             	mov    %ebp,%r15d
  30:	41 c1 ff 1f          	sar    $0x1f,%r15d
  34:	49 c1 e7 20          	shl    $0x20,%r15
  38:	4c 89 6c 24 08       	mov    %r13,0x8(%rsp)
  3d:	4d 01 ef             	add    %r13,%r15

IsProbe: false
Reproduced: false
Console Output: [  221.212003][ T5856]  ? swap_cache_get_folio+0x2e7/0x2f0
[  221.212016][ T5856]  do_swap_page+0x344/0x4930
[  221.212028][ T5856]  ? __pte_offset_map+0x29/0x240
[  221.212039][ T5856]  ? __pte_offset_map+0x29/0x240
[  221.212051][ T5856]  ? __lock_acquire+0x683/0x2cf0
[  221.212059][ T5856]  ? do_swap_page+0x128/0x4930
[  221.212068][ T5856]  ? __pfx_do_swap_page+0x10/0x10
[  221.212077][ T5856]  ? __pte_offset_map+0x1ae/0x240
[  221.212089][ T5856]  ? pte_offset_map_rw_nolock+0xea/0x160
[  221.212100][ T5856]  handle_mm_fault+0x124c/0x3070
[  221.212116][ T5856]  ? handle_mm_fault+0xec/0x3070
[  221.212130][ T5856]  ? __pfx_handle_mm_fault+0x10/0x10
[  221.212139][ T5856]  ? lock_vma_under_rcu+0x45a/0x500
[  221.212161][ T5856]  do_user_addr_fault+0xa4d/0x1340
[  221.212174][ T5856]  ? trace_page_fault_user+0x84/0x1e0
[  221.212183][ T5856]  exc_page_fault+0x6a/0xc0
[  221.212194][ T5856]  asm_exc_page_fault+0x26/0x30
[  221.212202][ T5856] RIP: 0033:0x7feeb916e49e
[  221.212210][ T5856] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
** 10 printk messages dropped **
[  221.220621][ T6127] Call Trace:
** 1 printk messages dropped **
[  221.220628][ T6127]  dump_stack_lvl+0xe8/0x150
[  221.220645][ T6127]  should_fail_ex+0x40c/0x560
[  221.220660][ T6127]  prepare_alloc_pages+0x230/0x650
[  221.220677][ T6127]  __alloc_frozen_pages_noprof+0x12f/0x380
[  221.220692][ T6127]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  221.220708][ T6127]  ? policy_nodemask+0x27c/0x720
** 31 printk messages dropped **
[  221.221089][ T6127] RIP: 0033:0x7feeb916e49e
** 13 printk messages dropped **
[  221.223725][ T5856]  dump_stack_lvl+0xe8/0x150
** 1 printk messages dropped **
[  221.223754][ T5856]  prepare_alloc_pages+0x230/0x650
** 50 printk messages dropped **
[  221.227160][ T5880]  prepare_alloc_pages+0x230/0x650
[  221.227176][ T5880]  __alloc_frozen_pages_noprof+0x12f/0x380
[  221.227190][ T5880]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[+] Iteration 2500
[  221.227206][ T5880]  ? policy_nodemask+0x27c/0x720
[  221.227218][ T5880]  alloc_pages_mpol+0x212/0x380
[  221.227229][ T5880]  folio_alloc_mpol_noprof+0x39/0x160
[  221.227240][ T5880]  swap_cache_alloc_folio+0x2c1/0x990
[  221.227256][ T5880]  swap_cluster_readahead+0x4d9/0x640
[  221.227269][ T5880]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  221.227313][ T5880]  ? get_vma_policy+0x27b/0x3c0
[  221.227324][ T5880]  swapin_readahead+0x19a/0xc10
[  221.227336][ T5880]  ? swap_table_get+0x1e/0x260
[  221.227347][ T5880]  ? swap_table_get+0x1e/0x260
[  221.227357][ T5880]  ? __pfx_swapin_readahead+0x10/0x10
[  221.227369][ T5880]  ? swap_table_get+0x1e/0x260
[  221.227378][ T5880]  ? swap_table_get+0x1e/0x260
[  221.227387][ T5880]  ? swap_table_get+0x1e/0x260
[  221.227397][ T5880]  ? swap_table_get+0x216/0x260
[  221.227408][ T5880]  ? swap_cache_get_folio+0x2e7/0x2f0
[  221.227421][ T5880]  do_swap_page+0x344/0x4930
[  221.227432][ T5880]  ? __pte_offset_map+0x29/0x240
[  221.227443][ T5880]  ? __pte_offset_map+0x29/0x240
[  221.227456][ T5880]  ? __lock_acquire+0x683/0x2cf0
[  221.227463][ T5880]  ? do_swap_page+0x128/0x4930
[  221.227473][ T5880]  ? __pfx_do_swap_page+0x10/0x10
[  221.227482][ T5880]  ? __pte_offset_map+0x1ae/0x240
[  221.227493][ T5880]  ? pte_offset_map_rw_nolock+0xea/0x160
[  221.227505][ T5880]  handle_mm_fault+0x124c/0x3070
[  221.227521][ T5880]  ? handle_mm_fault+0xec/0x3070
[  221.227535][ T5880]  ? __pfx_handle_mm_fault+0x10/0x10
[  221.227544][ T5880]  ? lock_vma_under_rcu+0x45a/0x500
[  221.227565][ T5880]  do_user_addr_fault+0xa4d/0x1340
[  221.227577][ T5880]  ? trace_page_fault_user+0x84/0x1e0
[  221.227587][ T5880]  exc_page_fault+0x6a/0xc0
[  221.227599][ T5880]  asm_exc_page_fault+0x26/0x30
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[+] Iteration 2500
[  221.227607][ T5880] RIP: 0033:0x7feeb916e49e
[  221.227616][ T5880] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  221.227623][ T5880] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  221.227631][ T5880] RAX: 0000000000000008 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  221.227637][ T5880] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000061
[  221.227642][ T5880] RBP: 0000000000000061 R08: 0000000000000000 R09: 0000000000000000
[  221.227647][ T5880] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
[  221.227653][ T5880] R13: 0000000000000002 R14: 00007feeb91ea560 R15: 0000000000000002
[  221.227665][ T5880]  </TASK>
[  221.227686][ T5880] FAULT_INJECTION: forcing a failure.
[  221.227686][ T5880] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  221.230160][ T5856] CPU: 1 UID: 0 PID: 5856 Comm: syz-executor408 Not tainted syzkaller #1 PREEMPT(full) 
** 7 printk messages dropped **
[  221.230242][ T5856]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  221.230258][ T5856]  ? policy_nodemask+0x27c/0x720
[  221.230269][ T5856]  alloc_pages_mpol+0x212/0x380
[  221.230303][ T5856]  folio_alloc_mpol_noprof+0x39/0x160
[  221.230315][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
** 683 printk messages dropped **
[  221.434418][ T5856]  ? swap_table_get+0x1e/0x260
** 21 printk messages dropped **
[  221.434681][ T5856] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  221.434689][ T5856] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  221.434697][ T5856] RAX: fffffffffffffff4 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  221.434703][ T5856] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000031
[  221.434709][ T5856] RBP: 0000000000000031 R08: 0000000000000000 R09: 0000000000000000
[  221.434714][ T5856] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c
** 45 printk messages dropped **
[  221.461338][ T5880] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
** 46 printk messages dropped **
[  221.469589][ T5880]  do_user_addr_fault+0xa4d/0x1340
[  221.469601][ T5880]  ? trace_page_fault_user+0x84/0x1e0
[  221.469611][ T5880]  exc_page_fault+0x6a/0xc0
[  221.469623][ T5880]  asm_exc_page_fault+0x26/0x30
[  221.469632][ T5880] RIP: 0033:0x7feeb916e49e
[  221.469641][ T5880] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  221.469648][ T5880] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[+] Iteration 2500
[  221.469657][ T5880] RAX: 0000000000000008 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
** 45 printk messages dropped **
[  221.486503][ T6134]  ? do_raw_spin_unlock+0xf5/0x210
[  221.486516][ T6134]  rpcb_create_local+0x28f/0x670
[  221.486526][ T6134]  ? __pfx_rpcb_create_local+0x10/0x10
[  221.486534][ T6134]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  221.486545][ T6134]  ? lockdep_hardirqs_on+0x7a/0x110
[  221.486556][ T6134]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  221.486566][ T6134]  ? __percpu_counter_init_many+0x35f/0x380
[  221.486581][ T6134]  ? __svc_create+0x88f/0x990
[  221.486594][ T6134]  svc_bind+0x1b4/0x230
[  221.486605][ T6134]  nfsd_create_serv+0x581/0x840
[  221.486618][ T6134]  ? kasan_save_track+0x3e/0x80
[  221.486629][ T6134]  ? __pfx_nfsd_create_serv+0x10/0x10
[  221.486641][ T6134]  ? sscanf+0xe2/0x140
[  221.486650][ T6134]  ? net_generic+0x1e/0x240
[  221.486663][ T6134]  ? __pfx_sscanf+0x10/0x10
[  221.486672][ T6134]  ? net_generic+0x1e/0x240
[  221.486684][ T6134]  ? net_generic+0x1e/0x240
[  221.486699][ T6134]  write_ports+0x669/0xd10
[  221.486709][ T6134]  ? __pfx_write_ports+0x10/0x10
[  221.486726][ T6134]  ? _copy_from_user+0x94/0xb0
[  221.486736][ T6134]  ? simple_transaction_get+0x12d/0x160
** 31 printk messages dropped **
[  221.525452][ T5856]  ? policy_nodemask+0x27c/0x720
** 2 printk messages dropped **
[  221.525485][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
[  221.525502][ T5856]  swap_cluster_readahead+0x4d9/0x640
[  221.525516][ T5856]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  221.525532][ T5856]  ? get_vma_policy+0x27b/0x3c0
[  221.525542][ T5856]  swapin_readahead+0x19a/0xc10
[  221.525554][ T5856]  ? swap_table_get+0x1e/0x260
[  221.525564][ T5856]  ? swap_table_get+0x1e/0x260
[  221.525574][ T5856]  ? __pfx_swapin_readahead+0x10/0x10
** 43 printk messages dropped **
[  221.529102][ T6127]  swap_cache_alloc_folio+0x2c1/0x990
** 50 printk messages dropped **
[  221.548398][ T5856]  folio_alloc_mpol_noprof+0x39/0x160
[  221.548408][ T5856]  swap_cache_alloc_folio+0x2c1/0x990
[  221.548425][ T5856]  swap_cluster_readahead+0x4d9/0x640
[  221.548438][ T5856]  ? __pfx_swap_cluster_readahead+0x10/0x10
[  221.548454][ T5856]  ? get_vma_policy+0x27b/0x3c0
[  221.548464][ T5856]  swapin_readahead+0x19a/0xc10
[  221.548477][ T5856]  ? swap_table_get+0x1e/0x260
[  221.548487][ T5856]  ? swap_table_get+0x1e/0x260
[  221.548497][ T5856]  ? __pfx_swapin_readahead+0x10/0x10
[  221.548513][ T5856]  ? swap_table_get+0x1e/0x260
[  221.548523][ T5856]  ? swap_table_get+0x1e/0x260
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[+] Iteration 2500
** 40 printk messages dropped **
[  221.549415][ T6127]  folio_alloc_mpol_noprof+0x39/0x160
** 81 printk messages dropped **
[  221.563147][ T6127] RIP: 0033:0x7feeb916e49e
[  221.563156][ T6127] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  221.563163][ T6127] RSP: 002b:00007fff9882b788 EFLAGS: 00010246
[  221.563172][ T6127] RAX: fffffffffffffff4 RBX: 0000555571e8f400 RCX: 00007feeb916e49e
[  221.563178][ T6127] RDX: 0000000000000008 RSI: 00007feeb91bb0b4 RDI: 0000000000000200
[  221.563184][ T6127] RBP: 0000000000000200 R08: 0000000000000000 R09: 0000000000000000
[  221.563189][ T6127] R10: 0000000000000000 R11: 0000000000000246 R12: 00007feeb91bb09c

[host] Command execution timed out after 2m30s

Strace Output: [  223.266219][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  223.266224][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  223.266230][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  223.266242][ T5901]  </TASK>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10033] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 10033] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10034 attached
, child_tidptr=0x5555728886d0) = 10034
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10034] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10034] <... set_robust_list resumed>) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10034] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid 10034] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10035
[  223.390843][ T5901] FAULT_INJECTION: forcing a failure.
/strace: Process 10035 attached
[  223.390843][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[  223.395446][ T5901] CPU: 0 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[pid 10035] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  6259] <... unshare resumed>)      = 0
[  223.395460][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  223.395466][ T5901] Call Trace:
[  223.395471][ T5901]  <TASK>
[  223.395475][ T5901]  dump_stack_lvl+0xe8/0x150
[pid 10035] <... set_robust_list resumed>) = 0
[pid  6259] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10035] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  6259] <... socket resumed>)       = 706
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[  223.395494][ T5901]  should_fail_ex+0x40c/0x560
[  223.395511][ T5901]  prepare_alloc_pages+0x230/0x650
[  223.395528][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  223.395543][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  223.395560][ T5901]  ? policy_nodemask+0x27c/0x720
[  223.395572][ T5901]  alloc_pages_mpol+0x212/0x380
[  223.395584][ T5901]  allocate_slab+0x131/0x5e0
[  223.395594][ T5901]  ? kfree+0x1c5/0x640
[  223.395605][ T5901]  ___slab_alloc+0x16a/0x950
[  223.395619][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  223.395631][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  223.395641][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.395654][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.395668][ T5901]  rpc_malloc+0xeb/0x260
[  223.395681][ T5901]  call_allocate+0x26d/0x680
[  223.395692][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  223.395703][ T5901]  __rpc_execute+0x526/0x1280
[  223.395721][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  223.395734][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  223.395744][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[pid 10035] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6259] ioctl(706, SIOCGIFFLAGS, {ifr_name="lo" <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid 10035] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  6259] <... ioctl resumed>, ifr_flags=IFF_LOOPBACK}) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  6259] ioctl(706, SIOCSIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING} <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10037
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10038
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[  223.395757][ T5901]  rpc_execute+0x1c1/0x390
[  223.395769][ T5901]  rpc_run_task+0x4a6/0x660
[  223.395780][ T5901]  rpc_call_sync+0x10f/0x200
[  223.395789][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  223.395800][ T5901]  ? net_generic+0x1e/0x240
[  223.395808][ T5901]  ? net_generic+0x1e/0x240
[  223.395818][ T5901]  rpcb_register+0x2d0/0x530
[  223.395828][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  223.395835][ T5901]  ? net_generic+0x1e/0x240
[  223.395845][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  223.395855][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  223.395867][ T5901]  svc_unregister+0x24d/0x780
[  223.395882][ T5901]  svc_bind+0x1e9/0x230
[  223.395892][ T5901]  nfsd_create_serv+0x581/0x840
[  223.395905][ T5901]  ? kasan_save_track+0x3e/0x80
[  223.395916][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  223.395959][ T5901]  ? sscanf+0xe2/0x140
[  223.395970][ T5901]  ? net_generic+0x1e/0x240
[  223.395982][ T5901]  ? __pfx_sscanf+0x10/0x10
[  223.395996][ T5901]  ? net_generic+0x1e/0x240
[  223.396008][ T5901]  ? net_generic+0x1e/0x240
[  223.396023][ T5901]  write_ports+0x669/0xd10
[  223.396033][ T5901]  ? __pfx_write_ports+0x10/0x10
[  223.396049][ T5901]  ? _copy_from_user+0x94/0xb0
[  223.396059][ T5901]  ? simple_transaction_get+0x12d/0x160
[  223.396070][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  223.396079][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  223.396088][ T5901]  vfs_write+0x296/0xba0
[  223.396103][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  223.396117][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  223.396127][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  223.396140][ T5901]  ksys_write+0x150/0x270
[  223.396152][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  223.396165][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.396174][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.396183][ T5901]  do_syscall_64+0x174/0x580
[  223.396193][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.396202][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  223.396213][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.396221][ T5901] RIP: 0033:0x7fcfafca149e
[  223.396231][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  223.396238][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10039
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10040
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152/strace: Process 10041 attached
) = -1 EMFILE (Too many open files)
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10041
[pid 10041] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10041] <... set_robust_list resumed>) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10041] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10041] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10041] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
/strace: Process 10042 attached
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10042
[pid 10042] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10042] <... set_robust_list resumed>) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10042] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10042] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10042] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[  223.396249][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  223.396255][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  223.396261][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  223.396266][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  223.396271][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  223.396283][ T5901]  </TASK>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10043 attached
, child_tidptr=0x5555728886d0) = 10043
[pid 10043] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10043] <... set_robust_list resumed>) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[  223.519962][ T5901] FAULT_INJECTION: forcing a failure.
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10043] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  223.519962][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[pid 10043] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10043] unshare(CLONE_NEWNS|CLONE_NEWNET/strace: Process 10040 attached
[  223.525260][ T5901] CPU: 0 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
/strace: Process 10039 attached
/strace: Process 10038 attached
/strace: Process 10037 attached
[  223.525272][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  223.525279][ T5901] Call Trace:
[  223.525283][ T5901]  <TASK>
[  223.525287][ T5901]  dump_stack_lvl+0xe8/0x150
[  223.525304][ T5901]  should_fail_ex+0x40c/0x560
[  223.525320][ T5901]  prepare_alloc_pages+0x230/0x650
[  223.525337][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  223.525352][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  223.525368][ T5901]  ? policy_nodemask+0x27c/0x720
[  223.525380][ T5901]  alloc_pages_mpol+0x212/0x380
[  223.525392][ T5901]  allocate_slab+0x131/0x5e0
[  223.525402][ T5901]  ? kfree+0x1c5/0x640
[  223.525414][ T5901]  ___slab_alloc+0x16a/0x950
[  223.525427][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  223.525439][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  223.525450][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.525462][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.525477][ T5901]  rpc_malloc+0xeb/0x260
 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
/strace: Process 10044 attached
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10044
[  223.525491][ T5901]  call_allocate+0x26d/0x680
[  223.525503][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  223.525514][ T5901]  __rpc_execute+0x526/0x1280
[  223.525532][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  223.525545][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  223.525555][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  223.525568][ T5901]  rpc_execute+0x1c1/0x390
[  223.525581][ T5901]  rpc_run_task+0x4a6/0x660
[  223.525591][ T5901]  rpc_call_sync+0x10f/0x200
[  223.525599][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  223.525611][ T5901]  ? net_generic+0x1e/0x240
[  223.525619][ T5901]  ? net_generic+0x1e/0x240
[  223.525630][ T5901]  rpcb_register+0x2d0/0x530
[  223.525639][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  223.525647][ T5901]  ? net_generic+0x1e/0x240
[  223.525657][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  223.525666][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  223.525679][ T5901]  svc_unregister+0x24d/0x780
[  223.525694][ T5901]  svc_bind+0x1e9/0x230
[  223.525704][ T5901]  nfsd_create_serv+0x581/0x840
[  223.525716][ T5901]  ? kasan_save_track+0x3e/0x80
[  223.525728][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  223.525740][ T5901]  ? sscanf+0xe2/0x140
[  223.525750][ T5901]  ? net_generic+0x1e/0x240
[  223.525762][ T5901]  ? __pfx_sscanf+0x10/0x10
[  223.525771][ T5901]  ? net_generic+0x1e/0x240
[  223.525783][ T5901]  ? net_generic+0x1e/0x240
[  223.525798][ T5901]  write_ports+0x669/0xd10
[  223.525807][ T5901]  ? __pfx_write_ports+0x10/0x10
[  223.525824][ T5901]  ? _copy_from_user+0x94/0xb0
[  223.525834][ T5901]  ? simple_transaction_get+0x12d/0x160
[  223.525845][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  223.525854][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  223.525863][ T5901]  vfs_write+0x296/0xba0
[  223.525878][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  223.525892][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  223.525902][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  223.525950][ T5901]  ksys_write+0x150/0x270
[  223.525971][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  223.525997][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.526006][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.526015][ T5901]  do_syscall_64+0x174/0x580
[  223.526025][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.526034][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  223.526044][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.526053][ T5901] RIP: 0033:0x7fcfafca149e
[  223.526062][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  223.526070][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  223.526080][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  223.526086][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  223.526091][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  223.526096][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  223.526102][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  223.526115][ T5901]  </TASK>
[pid 10044] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10044] <... set_robust_list resumed>) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10044] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10044] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10044] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10045 attached
 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10045
[pid 10045] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10045] <... set_robust_list resumed>) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  223.651722][ T5901] FAULT_INJECTION: forcing a failure.
[  223.651722][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  223.655639][ T5901] CPU: 0 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  223.655651][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  223.655658][ T5901] Call Trace:
[  223.655662][ T5901]  <TASK>
[  223.655666][ T5901]  dump_stack_lvl+0xe8/0x150
[  223.655682][ T5901]  should_fail_ex+0x40c/0x560
[  223.655699][ T5901]  prepare_alloc_pages+0x230/0x650
[  223.655716][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  223.655732][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[pid 10045] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 10038] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid 10039] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid 10037] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid 10040] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  223.655749][ T5901]  ? policy_nodemask+0x27c/0x720
[  223.655761][ T5901]  alloc_pages_mpol+0x212/0x380
[  223.655773][ T5901]  allocate_slab+0x131/0x5e0
[  223.655783][ T5901]  ? kfree+0x1c5/0x640
[  223.655795][ T5901]  ___slab_alloc+0x16a/0x950
[  223.655808][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  223.655820][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  223.655831][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.655843][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.655857][ T5901]  rpc_malloc+0xeb/0x260
[  223.655870][ T5901]  call_allocate+0x26d/0x680
[  223.655882][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  223.655912][ T5901]  __rpc_execute+0x526/0x1280
[pid 10045] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10046
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
/strace: Process 10046 attached
[pid 10046] set_robust_list(0x5555728886e0, 24) = 0
[  223.655932][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  223.655945][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  223.655956][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  223.655969][ T5901]  rpc_execute+0x1c1/0x390
[  223.655981][ T5901]  rpc_run_task+0x4a6/0x660
[  223.655992][ T5901]  rpc_call_sync+0x10f/0x200
[  223.656000][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  223.656012][ T5901]  ? net_generic+0x1e/0x240
[  223.656020][ T5901]  ? net_generic+0x1e/0x240
[  223.656030][ T5901]  rpcb_register+0x2d0/0x530
[  223.656040][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  223.656048][ T5901]  ? net_generic+0x1e/0x240
[  223.656058][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  223.656067][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[pid 10046] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid 10046] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid 10046] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10047
/strace: Process 10047 attached
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10047] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10047] <... set_robust_list resumed>) = 0
[pid 10047] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 10047] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[  223.656080][ T5901]  svc_unregister+0x24d/0x780
[  223.656094][ T5901]  svc_bind+0x1e9/0x230
[  223.656105][ T5901]  nfsd_create_serv+0x581/0x840
[  223.656117][ T5901]  ? kasan_save_track+0x3e/0x80
[  223.656129][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  223.656141][ T5901]  ? sscanf+0xe2/0x140
[  223.656151][ T5901]  ? net_generic+0x1e/0x240
[  223.656163][ T5901]  ? __pfx_sscanf+0x10/0x10
[  223.656172][ T5901]  ? net_generic+0x1e/0x240
[  223.656184][ T5901]  ? net_generic+0x1e/0x240
[  223.656199][ T5901]  write_ports+0x669/0xd10
[  223.656209][ T5901]  ? __pfx_write_ports+0x10/0x10
[  223.656226][ T5901]  ? _copy_from_user+0x94/0xb0
[  223.656236][ T5901]  ? simple_transaction_get+0x12d/0x160
[  223.656247][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  223.656256][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  223.656265][ T5901]  vfs_write+0x296/0xba0
[  223.656280][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  223.656294][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  223.656304][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  223.656318][ T5901]  ksys_write+0x150/0x270
[  223.656329][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  223.656342][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.656351][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.656359][ T5901]  do_syscall_64+0x174/0x580
[  223.656370][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.656379][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  223.656389][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10048 attached
, child_tidptr=0x5555728886d0) = 10048
[pid 10048] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 10048] <... set_robust_list resumed>) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10048] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10048] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10048] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10049 attached
 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10049
[pid 10049] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10049] <... set_robust_list resumed>) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10049] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 10049] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10050 attached
 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10050
[pid 10050] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10050] <... set_robust_list resumed>) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10050] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10038] <... set_robust_list resumed>) = 0
[pid 10050] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10038] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10050] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid 10038] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  223.656397][ T5901] RIP: 0033:0x7fcfafca149e
[  223.656407][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  223.656415][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  223.656425][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  223.656431][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  223.656437][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  223.656458][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  223.656464][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  223.656476][ T5901]  </TASK>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10038] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10051
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10052 attached
 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10052
[pid 10052] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10052] <... set_robust_list resumed>) = 0
[  223.778105][ T5901] FAULT_INJECTION: forcing a failure.
[  223.778105][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10052] rt_sigprocmask(SIG_SETMASK, []/strace: Process 10051 attached
, NULL, 8) = 0
[pid 10040] <... set_robust_list resumed>) = 0
[pid 10039] <... set_robust_list resumed>) = 0
[pid 10037] <... set_robust_list resumed>) = 0
[  223.782308][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  223.782320][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  223.782326][ T5901] Call Trace:
[  223.782330][ T5901]  <TASK>
[  223.782335][ T5901]  dump_stack_lvl+0xe8/0x150
[  223.782351][ T5901]  should_fail_ex+0x40c/0x560
[  223.782368][ T5901]  prepare_alloc_pages+0x230/0x650
[  223.782385][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  223.782401][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  223.782417][ T5901]  ? policy_nodemask+0x27c/0x720
[  223.782429][ T5901]  alloc_pages_mpol+0x212/0x380
[  223.782441][ T5901]  allocate_slab+0x131/0x5e0
[  223.782451][ T5901]  ? kfree+0x1c5/0x640
[  223.782463][ T5901]  ___slab_alloc+0x16a/0x950
[  223.782477][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  223.782488][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  223.782499][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.782511][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.782525][ T5901]  rpc_malloc+0xeb/0x260
[  223.782538][ T5901]  call_allocate+0x26d/0x680
[  223.782550][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  223.782561][ T5901]  __rpc_execute+0x526/0x1280
[  223.782579][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  223.782591][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  223.782602][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  223.782614][ T5901]  rpc_execute+0x1c1/0x390
[  223.782627][ T5901]  rpc_run_task+0x4a6/0x660
[  223.782638][ T5901]  rpc_call_sync+0x10f/0x200
[  223.782646][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  223.782658][ T5901]  ? net_generic+0x1e/0x240
[  223.782666][ T5901]  ? net_generic+0x1e/0x240
[  223.782677][ T5901]  rpcb_register+0x2d0/0x530
[  223.782686][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  223.782693][ T5901]  ? net_generic+0x1e/0x240
[  223.782704][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  223.782713][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  223.782725][ T5901]  svc_unregister+0x24d/0x780
[  223.782740][ T5901]  svc_bind+0x1e9/0x230
[  223.782751][ T5901]  nfsd_create_serv+0x581/0x840
[  223.782763][ T5901]  ? kasan_save_track+0x3e/0x80
[  223.782774][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  223.782786][ T5901]  ? sscanf+0xe2/0x140
[  223.782797][ T5901]  ? net_generic+0x1e/0x240
[  223.782809][ T5901]  ? __pfx_sscanf+0x10/0x10
[  223.782818][ T5901]  ? net_generic+0x1e/0x240
[  223.782830][ T5901]  ? net_generic+0x1e/0x240
[  223.782844][ T5901]  write_ports+0x669/0xd10
[  223.782854][ T5901]  ? __pfx_write_ports+0x10/0x10
[  223.782871][ T5901]  ? _copy_from_user+0x94/0xb0
[  223.782902][ T5901]  ? simple_transaction_get+0x12d/0x160
[  223.782914][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  223.782924][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  223.782932][ T5901]  vfs_write+0x296/0xba0
[  223.782948][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  223.782962][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  223.782973][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  223.782987][ T5901]  ksys_write+0x150/0x270
[  223.782999][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  223.783011][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.783020][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.783029][ T5901]  do_syscall_64+0x174/0x580
[  223.783040][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.783053][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  223.783064][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.783073][ T5901] RIP: 0033:0x7fcfafca149e
[  223.783082][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  223.783089][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  223.783100][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  223.783106][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  223.783111][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  223.783117][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  223.783123][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  223.783135][ T5901]  </TASK>
[  223.919117][ T5901] FAULT_INJECTION: forcing a failure.
[  223.919117][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  223.923135][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  223.923161][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  223.923167][ T5901] Call Trace:
[  223.923172][ T5901]  <TASK>
[  223.923176][ T5901]  dump_stack_lvl+0xe8/0x150
[  223.923193][ T5901]  should_fail_ex+0x40c/0x560
[  223.923209][ T5901]  prepare_alloc_pages+0x230/0x650
[  223.923227][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  223.923243][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  223.923259][ T5901]  ? policy_nodemask+0x27c/0x720
[  223.923271][ T5901]  alloc_pages_mpol+0x212/0x380
[  223.923283][ T5901]  allocate_slab+0x131/0x5e0
[  223.923294][ T5901]  ? kfree+0x1c5/0x640
[  223.923306][ T5901]  ___slab_alloc+0x16a/0x950
[  223.923320][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  223.923332][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  223.923342][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.923354][ T5901]  ? rpc_malloc+0xeb/0x260
[  223.923368][ T5901]  rpc_malloc+0xeb/0x260
[  223.923381][ T5901]  call_allocate+0x26d/0x680
[  223.923393][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  223.923404][ T5901]  __rpc_execute+0x526/0x1280
[  223.923422][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  223.923435][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  223.923445][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  223.923458][ T5901]  rpc_execute+0x1c1/0x390
[  223.923471][ T5901]  rpc_run_task+0x4a6/0x660
[  223.923481][ T5901]  rpc_call_sync+0x10f/0x200
[  223.923489][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  223.923501][ T5901]  ? net_generic+0x1e/0x240
[  223.923509][ T5901]  ? net_generic+0x1e/0x240
[  223.923520][ T5901]  rpcb_register+0x2d0/0x530
[  223.923529][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  223.923536][ T5901]  ? net_generic+0x1e/0x240
[  223.923547][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  223.923556][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  223.923569][ T5901]  svc_unregister+0x24d/0x780
[  223.923583][ T5901]  svc_bind+0x1e9/0x230
[  223.923594][ T5901]  nfsd_create_serv+0x581/0x840
[  223.923606][ T5901]  ? kasan_save_track+0x3e/0x80
[  223.923618][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  223.923630][ T5901]  ? sscanf+0xe2/0x140
[  223.923640][ T5901]  ? net_generic+0x1e/0x240
[  223.923652][ T5901]  ? __pfx_sscanf+0x10/0x10
[  223.923661][ T5901]  ? net_generic+0x1e/0x240
[  223.923673][ T5901]  ? net_generic+0x1e/0x240
[  223.923687][ T5901]  write_ports+0x669/0xd10
[  223.923697][ T5901]  ? __pfx_write_ports+0x10/0x10
[  223.923715][ T5901]  ? _copy_from_user+0x94/0xb0
[  223.923725][ T5901]  ? simple_transaction_get+0x12d/0x160
[  223.923736][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  223.923746][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  223.923754][ T5901]  vfs_write+0x296/0xba0
[  223.923769][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  223.923783][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  223.923793][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  223.923807][ T5901]  ksys_write+0x150/0x270
[  223.923819][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  223.923831][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.923840][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.923849][ T5901]  do_syscall_64+0x174/0x580
[  223.923860][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.923887][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  223.923898][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  223.923907][ T5901] RIP: 0033:0x7fcfafca149e
[  223.923917][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  223.923925][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  223.923934][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  223.923941][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  223.923946][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  223.923951][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  223.923957][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  223.923969][ T5901]  </TASK>
[  224.043424][ T5901] FAULT_INJECTION: forcing a failure.
[  224.043424][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  224.047387][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  224.047399][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  224.047405][ T5901] Call Trace:
[  224.047410][ T5901]  <TASK>
[  224.047414][ T5901]  dump_stack_lvl+0xe8/0x150
[  224.047431][ T5901]  should_fail_ex+0x40c/0x560
[  224.047448][ T5901]  prepare_alloc_pages+0x230/0x650
[  224.047466][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  224.047482][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  224.047498][ T5901]  ? policy_nodemask+0x27c/0x720
[  224.047510][ T5901]  alloc_pages_mpol+0x212/0x380
[  224.047522][ T5901]  allocate_slab+0x131/0x5e0
[  224.047532][ T5901]  ? kfree+0x1c5/0x640
[  224.047559][ T5901]  ___slab_alloc+0x16a/0x950
[  224.047571][ T5901]  ? kmem_cache_alloc_noprof+0xbf/0x5f0
[  224.047585][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  224.047596][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  224.047607][ T5901]  ? rpc_malloc+0xeb/0x260
[  224.047618][ T5901]  ? rpc_malloc+0xeb/0x260
[  224.047632][ T5901]  rpc_malloc+0xeb/0x260
[  224.047645][ T5901]  call_allocate+0x26d/0x680
[  224.047657][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  224.047668][ T5901]  __rpc_execute+0x526/0x1280
[  224.047686][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  224.047699][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  224.047709][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  224.047722][ T5901]  rpc_execute+0x1c1/0x390
[  224.047735][ T5901]  rpc_run_task+0x4a6/0x660
[  224.047745][ T5901]  rpc_call_sync+0x10f/0x200
[  224.047754][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  224.047766][ T5901]  ? net_generic+0x1e/0x240
[  224.047774][ T5901]  ? net_generic+0x1e/0x240
[  224.047784][ T5901]  rpcb_register+0x2d0/0x530
[  224.047794][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  224.047801][ T5901]  ? net_generic+0x1e/0x240
[  224.047811][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  224.047821][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  224.047833][ T5901]  svc_unregister+0x24d/0x780
[  224.047847][ T5901]  svc_bind+0x1e9/0x230
[  224.047877][ T5901]  nfsd_create_serv+0x581/0x840
[  224.047891][ T5901]  ? kasan_save_track+0x3e/0x80
[  224.047902][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  224.047914][ T5901]  ? sscanf+0xe2/0x140
[  224.047924][ T5901]  ? net_generic+0x1e/0x240
[  224.047936][ T5901]  ? __pfx_sscanf+0x10/0x10
[  224.047945][ T5901]  ? net_generic+0x1e/0x240
[  224.047957][ T5901]  ? net_generic+0x1e/0x240
[  224.047972][ T5901]  write_ports+0x669/0xd10
[  224.047981][ T5901]  ? __pfx_write_ports+0x10/0x10
[  224.047998][ T5901]  ? _copy_from_user+0x94/0xb0
[  224.048008][ T5901]  ? simple_transaction_get+0x12d/0x160
[  224.048019][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  224.048033][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  224.048042][ T5901]  vfs_write+0x296/0xba0
[  224.048057][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  224.048071][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  224.048081][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  224.048095][ T5901]  ksys_write+0x150/0x270
[  224.048107][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  224.048120][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.048129][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.048138][ T5901]  do_syscall_64+0x174/0x580
[  224.048148][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.048157][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  224.048167][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.048175][ T5901] RIP: 0033:0x7fcfafca149e
[  224.048185][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  224.048193][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  224.048203][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  224.048210][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  224.048215][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  224.048220][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  224.048226][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  224.048239][ T5901]  </TASK>
[pid 10052] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10051] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid 10040] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10039] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10037] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  6261] <... unshare resumed>)      = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid 10051] <... set_robust_list resumed>) = 0
[pid  6261] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid 10040] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10039] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10037] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10051] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  6261] <... socket resumed>)       = 708
[pid 10039] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid 10037] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid 10040] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid 10051] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6261] ioctl(708, SIOCGIFFLAGS, {ifr_name="lo" <unfinished ...>
[pid 10051] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  6261] <... ioctl resumed>, ifr_flags=IFF_LOOPBACK}) = 0
[pid  6261] ioctl(708, SIOCSIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING}) = 0
[pid  6261] close(708)                  = 0
[pid  6261] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL <unfinished ...>
[  224.240141][ T5901] slab_out_of_memory: 18 callbacks suppressed
[  224.240151][ T5901] SLUB: Unable to allocate memory on CPU 1 (of node 1) on node -1, gfp=0xcc0(GFP_KERNEL)
[  224.245106][ T5901]   cache: rpc_buffers, object size: 2048, buffer size: 2176, default order: 3, min order: 0
[  224.248961][ T5901]   node 0: slabs: 1, objs: 15, free: 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152/strace: Process 10054 attached
[  224.251155][ T5901]   node 1: slabs: 0, objs: 0, free: 0
 <unfinished ...>
[pid  6261] <... mount resumed>)        = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10054
[pid 10054] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  6261] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  6261] <... openat resumed>)       = 708
[pid 10054] <... set_robust_list resumed>) = 0
[pid  6261] openat(AT_FDCWD, "/tmp/nfsd/filehandle", O_RDWR <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10054] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  6261] <... openat resumed>)       = 709
[pid 10054] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid 10054] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  6261] write(709, "dummy", 5 <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  6261] <... write resumed>)        = -1 EINVAL (Invalid argument)
/strace: Process 10055 attached
[pid  6261] close(709 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10055
[pid  6261] <... close resumed>)        = 0
[pid 10055] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  6261] socket(AF_INET, SOCK_STREAM, IPPROTO_IP <unfinished ...>
[pid 10055] <... set_robust_list resumed>) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6261] <... socket resumed>)       = 709
[pid 10055] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  7190] <... unshare resumed>)      = 0
[pid 10055] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6261] close(709 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid 10055] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  7190] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  6261] <... close resumed>)        = 0
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  7190] <... socket resumed>)       = -1 EMFILE (Too many open files)
[pid  6261] socket(AF_INET, SOCK_STREAM, IPPROTO_IP <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  224.318302][ T5901] FAULT_INJECTION: forcing a failure.
[  224.318302][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  224.322301][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  224.322312][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  224.322319][ T5901] Call Trace:
[  224.322323][ T5901]  <TASK>
[  224.322327][ T5901]  dump_stack_lvl+0xe8/0x150
[  224.322344][ T5901]  should_fail_ex+0x40c/0x560
[  224.322373][ T5901]  prepare_alloc_pages+0x230/0x650
[  224.322392][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  224.322407][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  224.322436][ T5901]  ? policy_nodemask+0x27c/0x720
[  224.322450][ T5901]  alloc_pages_mpol+0x212/0x380
[  224.322462][ T5901]  allocate_slab+0x131/0x5e0
[  224.322472][ T5901]  ? kfree+0x1c5/0x640
[  224.322483][ T5901]  ___slab_alloc+0x16a/0x950
[  224.322497][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  224.322509][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  224.322519][ T5901]  ? rpc_malloc+0xeb/0x260
[  224.322531][ T5901]  ? rpc_malloc+0xeb/0x260
[  224.322545][ T5901]  rpc_malloc+0xeb/0x260
[  224.322558][ T5901]  call_allocate+0x26d/0x680
[  224.322569][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  224.322581][ T5901]  __rpc_execute+0x526/0x1280
[  224.322599][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  224.322611][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  224.322621][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  224.322634][ T5901]  rpc_execute+0x1c1/0x390
[  224.322647][ T5901]  rpc_run_task+0x4a6/0x660
[  224.322657][ T5901]  rpc_call_sync+0x10f/0x200
[  224.322665][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  224.322677][ T5901]  ? net_generic+0x1e/0x240
[  224.322685][ T5901]  ? net_generic+0x1e/0x240
[  224.322696][ T5901]  rpcb_register+0x2d0/0x530
[  224.322706][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  224.322713][ T5901]  ? net_generic+0x1e/0x240
[  224.322723][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  224.322733][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  7190] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL <unfinished ...>
[pid  6261] <... socket resumed>)       = 709
/strace: Process 10057 attached
[pid  7190] <... mount resumed>)        = 0
[pid  6261] close(709)                  = 0
[pid  6261] socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 709
[pid  7190] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  6261] close(709 <unfinished ...>
[pid  7190] <... openat resumed>)       = -1 EMFILE (Too many open files)
[pid  6261] <... close resumed>)        = 0
[pid  7190] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 123 <unfinished ...>
[pid  6261] socket(AF_INET, SOCK_STREAM, IPPROTO_IP <unfinished ...>
[pid  7190] <... write resumed>)        = 123
[pid  6261] <... socket resumed>)       = 709
[pid  7190] exit_group(0 <unfinished ...>
[pid  6261] close(709 <unfinished ...>
[pid  7190] <... exit_group resumed>)   = ?
[pid  6261] <... close resumed>)        = 0
[pid  6261] socket(AF_INET, SOCK_STREAM, IPPROTO_IP) = 709
[pid  6261] close(709)                  = 0
[pid  6261] openat(AT_FDCWD, "/proc/self/make-it-fail", O_WRONLY) = 709
[pid  6261] write(709, "1", 1)          = 1
[pid  6261] close(709)                  = 0
[  224.322745][ T5901]  svc_unregister+0x24d/0x780
[  224.322760][ T5901]  svc_bind+0x1e9/0x230
[pid  6261] write(708, "tcp 2049", 8 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10057
[  224.322770][ T5901]  nfsd_create_serv+0x581/0x840
[  224.322782][ T5901]  ? kasan_save_track+0x3e/0x80
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[  224.322794][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  224.322806][ T5901]  ? sscanf+0xe2/0x140
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[  224.322816][ T5901]  ? net_generic+0x1e/0x240
[  224.322847][ T5901]  ? __pfx_sscanf+0x10/0x10
[  224.322857][ T5901]  ? net_generic+0x1e/0x240
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[  224.322873][ T5901]  ? net_generic+0x1e/0x240
[  224.322888][ T5901]  write_ports+0x669/0xd10
[  224.322898][ T5901]  ? __pfx_write_ports+0x10/0x10
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[  224.322915][ T5901]  ? _copy_from_user+0x94/0xb0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[  224.322925][ T5901]  ? simple_transaction_get+0x12d/0x160
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10059
[  224.322936][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  224.322946][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[  224.322954][ T5901]  vfs_write+0x296/0xba0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[  224.322969][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  224.322983][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  224.322993][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[  224.323007][ T5901]  ksys_write+0x150/0x270
[  224.323018][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  224.323032][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152/strace: Process 10060 attached
 <unfinished ...>
[pid 10060] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[  224.323040][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10060
[  224.323049][ T5901]  do_syscall_64+0x174/0x580
[pid 10060] <... set_robust_list resumed>) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10060] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[  224.323060][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10060] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  224.323069][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  224.323079][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.323088][ T5901] RIP: 0033:0x7fcfafca149e
[pid 10060] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[  224.323097][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  224.323105][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  224.323115][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10061 attached
[  224.323121][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  224.323127][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  224.323132][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[  224.323137][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  224.323150][ T5901]  </TASK>
[  224.323213][ T5901] SLUB: Unable to allocate memory on CPU 1 (of node 1) on node -1, gfp=0xcc0(GFP_KERNEL)
[pid 10061] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10061
[pid 10061] <... set_robust_list resumed>) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10061] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[  224.470671][ T5901]   cache: rpc_buffers, object size: 2048, buffer size: 2176, default order: 3, min order: 0
[pid 10057] set_robust_list(0x5555728886e0, 24/strace: Process 10059 attached
[  224.477697][ T5901]   node 0: slabs: 1, objs: 15, free: 0
[  224.479558][ T5901]   node 1: slabs: 0, objs: 0, free: 0
 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10061] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10057] <... set_robust_list resumed>) = 0
[pid 10059] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  7191] <... unshare resumed>)      = 0
[pid 10061] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid 10059] <... set_robust_list resumed>) = 0
[pid 10057] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  7191] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10059] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10057] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  7191] <... socket resumed>)       = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  6265] <... unshare resumed>)      = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10059] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10057] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  7191] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid 10059] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  6265] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  7191] <... mount resumed>)        = 0
[pid  6265] <... socket resumed>)       = 713
[pid  6265] ioctl(713, SIOCGIFFLAGS, {ifr_name="lo", ifr_flags=IFF_LOOPBACK}) = 0
[pid  7191] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY/strace: Process 10063 attached
 <unfinished ...>
[pid  6265] ioctl(713, SIOCSIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING} <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10063
[pid  7191] <... openat resumed>)       = -1 EMFILE (Too many open files)
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10063] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  7191] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 123 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10063] <... set_robust_list resumed>) = 0
[pid  7191] <... write resumed>)        = 123
[pid  7191] exit_group(0 <unfinished ...>
[pid 10063] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  7191] <... exit_group resumed>)   = ?
[pid 10063] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10063] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[  224.547990][ T5901] FAULT_INJECTION: forcing a failure.
[  224.547990][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  224.552146][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  224.552158][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  224.552163][ T5901] Call Trace:
[  224.552168][ T5901]  <TASK>
[  224.552172][ T5901]  dump_stack_lvl+0xe8/0x150
[  224.552189][ T5901]  should_fail_ex+0x40c/0x560
[  224.552205][ T5901]  prepare_alloc_pages+0x230/0x650
[  224.552222][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  224.552238][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  224.552254][ T5901]  ? policy_nodemask+0x27c/0x720
[  224.552266][ T5901]  alloc_pages_mpol+0x212/0x380
[  224.552278][ T5901]  allocate_slab+0x131/0x5e0
[  224.552288][ T5901]  ? kfree+0x1c5/0x640
[  224.552300][ T5901]  ___slab_alloc+0x16a/0x950
[  224.552314][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  224.552326][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  224.552336][ T5901]  ? rpc_malloc+0xeb/0x260
[  224.552348][ T5901]  ? rpc_malloc+0xeb/0x260
[  224.552362][ T5901]  rpc_malloc+0xeb/0x260
[  224.552375][ T5901]  call_allocate+0x26d/0x680
[  224.552386][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  224.552398][ T5901]  __rpc_execute+0x526/0x1280
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10064 attached
[  224.552416][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  224.552429][ T5901]  ? rpc_task_get_xprt+0x26/0x250
 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  7193] <... unshare resumed>)      = 0
[  224.552439][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  224.552452][ T5901]  rpc_execute+0x1c1/0x390
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10064
[  224.552465][ T5901]  rpc_run_task+0x4a6/0x660
[  224.552475][ T5901]  rpc_call_sync+0x10f/0x200
[pid 10064] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[  224.552484][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10064] <... set_robust_list resumed>) = 0
[  224.552496][ T5901]  ? net_generic+0x1e/0x240
[  224.552504][ T5901]  ? net_generic+0x1e/0x240
[pid  7193] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[  224.552514][ T5901]  rpcb_register+0x2d0/0x530
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10064] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  7193] <... socket resumed>)       = -1 EMFILE (Too many open files)
[  224.552524][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10064] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  224.552531][ T5901]  ? net_generic+0x1e/0x240
[  224.552542][ T5901]  ? rpcb_create_local+0x4ee/0x670
[pid  7193] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  224.552551][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  224.552563][ T5901]  svc_unregister+0x24d/0x780
[pid 10064] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  7193] <... mount resumed>)        = 0
[  224.552578][ T5901]  svc_bind+0x1e9/0x230
[  224.552589][ T5901]  nfsd_create_serv+0x581/0x840
[  224.552601][ T5901]  ? kasan_save_track+0x3e/0x80
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[  224.552613][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  224.552625][ T5901]  ? sscanf+0xe2/0x140
[  224.552635][ T5901]  ? net_generic+0x1e/0x240
[  224.552647][ T5901]  ? __pfx_sscanf+0x10/0x10
[  224.552656][ T5901]  ? net_generic+0x1e/0x240
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[  224.552668][ T5901]  ? net_generic+0x1e/0x240
[pid  7193] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY) = -1 EMFILE (Too many open files)
[  224.552683][ T5901]  write_ports+0x669/0xd10
[  224.552693][ T5901]  ? __pfx_write_ports+0x10/0x10
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10066
[  224.552710][ T5901]  ? _copy_from_user+0x94/0xb0
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[  224.552720][ T5901]  ? simple_transaction_get+0x12d/0x160
[  224.552731][ T5901]  nfsctl_transaction_write+0x10f/0x160
[pid  7193] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 123 <unfinished ...>
[  224.552740][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  224.552749][ T5901]  vfs_write+0x296/0xba0
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  7193] <... write resumed>)        = 123
[  224.552763][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  224.552778][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  224.552788][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  224.552821][ T5901]  ksys_write+0x150/0x270
[  224.552835][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  224.552853][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[pid  7193] exit_group(0)               = ?
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  224.552862][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.552871][ T5901]  do_syscall_64+0x174/0x580
[  224.552881][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.552890][ T5901]  ? clear_bhb_loop+0x70/0xc0
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[  224.552900][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.552909][ T5901] RIP: 0033:0x7fcfafca149e
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10067 attached
 <unfinished ...>
[  224.552918][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  224.552926][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  224.552936][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[  224.552942][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10067
[pid 10067] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[  224.552948][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  224.552953][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10067] <... set_robust_list resumed>) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  224.552959][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  224.552971][ T5901]  </TASK>
[  224.552976][ T5901] SLUB: Unable to allocate memory on CPU 1 (of node 1) on node -1, gfp=0xcc0(GFP_KERNEL)
[pid 10067] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 10067] unshare(CLONE_NEWNS|CLONE_NEWNET/strace: Process 10066 attached
[  224.690507][ T5901]   cache: rpc_buffers, object size: 2048, buffer size: 2176, default order: 3, min order: 0
[  224.694874][ T5901]   node 0: slabs: 1, objs: 15, free: 0
[  224.697870][ T5901]   node 1: slabs: 0, objs: 0, free: 0
 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid 10066] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid 10066] <... set_robust_list resumed>) = 0
/strace: Process 10068 attached
[pid 10066] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10068] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid 10066] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10066] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10068
[pid 10068] <... set_robust_list resumed>) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10068] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10068] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10068] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
/strace: Process 10069 attached
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10069
[pid 10069] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10069] <... set_robust_list resumed>) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10069] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10069] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10070 attached
[  224.767715][ T5901] FAULT_INJECTION: forcing a failure.
[  224.767715][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  224.771886][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  224.771898][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  224.771904][ T5901] Call Trace:
[  224.771908][ T5901]  <TASK>
[  224.771912][ T5901]  dump_stack_lvl+0xe8/0x150
[  224.771935][ T5901]  should_fail_ex+0x40c/0x560
[  224.771951][ T5901]  prepare_alloc_pages+0x230/0x650
[  224.771969][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  224.771984][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  224.772000][ T5901]  ? policy_nodemask+0x27c/0x720
[  224.772012][ T5901]  alloc_pages_mpol+0x212/0x380
[  224.772024][ T5901]  allocate_slab+0x131/0x5e0
[  224.772034][ T5901]  ? kfree+0x1c5/0x640
[  224.772046][ T5901]  ___slab_alloc+0x16a/0x950
[  224.772060][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  224.772072][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  224.772083][ T5901]  ? rpc_malloc+0xeb/0x260
[  224.772095][ T5901]  ? rpc_malloc+0xeb/0x260
[  224.772109][ T5901]  rpc_malloc+0xeb/0x260
[  224.772122][ T5901]  call_allocate+0x26d/0x680
[  224.772134][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  224.772145][ T5901]  __rpc_execute+0x526/0x1280
[  224.772163][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  224.772176][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  224.772186][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  224.772199][ T5901]  rpc_execute+0x1c1/0x390
[  224.772212][ T5901]  rpc_run_task+0x4a6/0x660
[  224.772222][ T5901]  rpc_call_sync+0x10f/0x200
[  224.772231][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  224.772243][ T5901]  ? net_generic+0x1e/0x240
[  224.772251][ T5901]  ? net_generic+0x1e/0x240
[  224.772261][ T5901]  rpcb_register+0x2d0/0x530
[  224.772271][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  224.772278][ T5901]  ? net_generic+0x1e/0x240
[  224.772289][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  224.772298][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  224.772310][ T5901]  svc_unregister+0x24d/0x780
[  224.772325][ T5901]  svc_bind+0x1e9/0x230
[  224.772336][ T5901]  nfsd_create_serv+0x581/0x840
[  224.772348][ T5901]  ? kasan_save_track+0x3e/0x80
[  224.772359][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  224.772371][ T5901]  ? sscanf+0xe2/0x140
[  224.772382][ T5901]  ? net_generic+0x1e/0x240
[  224.772394][ T5901]  ? __pfx_sscanf+0x10/0x10
[  224.772403][ T5901]  ? net_generic+0x1e/0x240
[  224.772415][ T5901]  ? net_generic+0x1e/0x240
[  224.772430][ T5901]  write_ports+0x669/0xd10
[  224.772439][ T5901]  ? __pfx_write_ports+0x10/0x10
[  224.772456][ T5901]  ? _copy_from_user+0x94/0xb0
[  224.772467][ T5901]  ? simple_transaction_get+0x12d/0x160
[  224.772477][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  224.772487][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  224.772496][ T5901]  vfs_write+0x296/0xba0
[  224.772510][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  224.772524][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  224.772534][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  224.772548][ T5901]  ksys_write+0x150/0x270
[  224.772560][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  224.772573][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.772582][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.772590][ T5901]  do_syscall_64+0x174/0x580
[  224.772601][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.772610][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  224.772620][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  224.772629][ T5901] RIP: 0033:0x7fcfafca149e
[  224.772638][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  224.772645][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  224.772655][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  224.772661][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  224.772667][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  224.772672][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  224.772677][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  224.772690][ T5901]  </TASK>
[  224.772695][ T5901] SLUB: Unable to allocate memory on CPU 1 (of node 1) on node -1, gfp=0xcc0(GFP_KERNEL)
 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  8939] <... unshare resumed>)      = 0
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10070
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  8939] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  8939] <... socket resumed>)       = -1 EMFILE (Too many open files)
[pid 10070] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  8939] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL <unfinished ...>
[pid 10070] <... set_robust_list resumed>) = 0
[pid  8939] <... mount resumed>)        = 0
[pid 10070] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  8939] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  8939] <... openat resumed>)       = -1 EMFILE (Too many open files)
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid 10070] <... rt_sigprocmask resumed>, NULL, 8) = 0
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[pid  8939] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 161 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid 10070] unshare(CLONE_NEWNS|CLONE_NEWNET/strace: Process 10072 attached
 <unfinished ...>
[pid  8939] <... write resumed>)        = 161
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  8939] exit_group(0 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10072
[pid 10072] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10072] <... set_robust_list resumed>) = 0
[pid  8939] <... exit_group resumed>)   = ?
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10072] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10072] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10072] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10073 attached
, child_tidptr=0x5555728886d0) = 10073
[pid 10073] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10073] <... set_robust_list resumed>) = 0
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 10073] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10073] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  224.962188][ T5901]   cache: rpc_buffers, object size: 2048, buffer size: 2176, default order: 3, min order: 0
[  224.975626][ T5901]   node 0: slabs: 1, objs: 15, free: 0
[pid 10073] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[  224.992436][ T5901]   node 1: slabs: 0, objs: 0, free: 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10074 attached
, child_tidptr=0x5555728886d0) = 10074
[pid 10074] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 10074] <... set_robust_list resumed>) = 0
[pid 10074] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10074] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid 10074] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152/strace: Process 10075 attached
) = -1 EMFILE (Too many open files)
[pid  6553] <... unshare resumed>)      = 0
[pid  6553] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10075
[pid 10075] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  6553] <... socket resumed>)       = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10075] <... set_robust_list resumed>) = 0
[pid  6553] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10075] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid 10075] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6553] <... mount resumed>)        = 0
[pid 10075] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[  225.057820][ T5901] FAULT_INJECTION: forcing a failure.
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[  225.057820][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  225.062267][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  225.062280][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  225.062286][ T5901] Call Trace:
[  225.062290][ T5901]  <TASK>
[  225.062294][ T5901]  dump_stack_lvl+0xe8/0x150
[  225.062311][ T5901]  should_fail_ex+0x40c/0x560
[  225.062327][ T5901]  prepare_alloc_pages+0x230/0x650
[  225.062345][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  225.062360][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  225.062393][ T5901]  ? policy_nodemask+0x27c/0x720
[  225.062406][ T5901]  alloc_pages_mpol+0x212/0x380
[  225.062417][ T5901]  allocate_slab+0x131/0x5e0
[  225.062427][ T5901]  ? kfree+0x1c5/0x640
[  225.062439][ T5901]  ___slab_alloc+0x16a/0x950
[  225.062453][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  225.062465][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  225.062475][ T5901]  ? rpc_malloc+0xeb/0x260
[  225.062487][ T5901]  ? rpc_malloc+0xeb/0x260
[  225.062502][ T5901]  rpc_malloc+0xeb/0x260
[  225.062514][ T5901]  call_allocate+0x26d/0x680
[  225.062526][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  225.062538][ T5901]  __rpc_execute+0x526/0x1280
[  225.062556][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  225.062568][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  225.062579][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  225.062592][ T5901]  rpc_execute+0x1c1/0x390
[  225.062605][ T5901]  rpc_run_task+0x4a6/0x660
[  225.062615][ T5901]  rpc_call_sync+0x10f/0x200
[  225.062624][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  225.062636][ T5901]  ? net_generic+0x1e/0x240
[  225.062644][ T5901]  ? net_generic+0x1e/0x240
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[pid  6553] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  6553] <... openat resumed>)       = -1 EMFILE (Too many open files)
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  6553] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 104 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10077
/strace: Process 10077 attached
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  6553] <... write resumed>)        = 104
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10077] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[  225.062655][ T5901]  rpcb_register+0x2d0/0x530
[pid  6553] exit_group(0 <unfinished ...>
[pid 10077] <... set_robust_list resumed>) = 0
[pid  6553] <... exit_group resumed>)   = ?
[  225.062664][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  225.062672][ T5901]  ? net_generic+0x1e/0x240
[pid 10077] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[  225.062682][ T5901]  ? rpcb_create_local+0x4ee/0x670
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[  225.062691][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[pid 10077] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.062704][ T5901]  svc_unregister+0x24d/0x780
[  225.062719][ T5901]  svc_bind+0x1e9/0x230
[  225.062730][ T5901]  nfsd_create_serv+0x581/0x840
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[  225.062743][ T5901]  ? kasan_save_track+0x3e/0x80
[  225.062775][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10078 attached
[  225.062787][ T5901]  ? sscanf+0xe2/0x140
[  225.062798][ T5901]  ? net_generic+0x1e/0x240
[  225.062810][ T5901]  ? __pfx_sscanf+0x10/0x10
[  225.062819][ T5901]  ? net_generic+0x1e/0x240
 <unfinished ...>
[  225.062831][ T5901]  ? net_generic+0x1e/0x240
[  225.062851][ T5901]  write_ports+0x669/0xd10
[  225.062861][ T5901]  ? __pfx_write_ports+0x10/0x10
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10078
[  225.062878][ T5901]  ? _copy_from_user+0x94/0xb0
[pid 10078] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.062889][ T5901]  ? simple_transaction_get+0x12d/0x160
[  225.062900][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  225.062909][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  225.062918][ T5901]  vfs_write+0x296/0xba0
[  225.062933][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  225.062947][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  225.062958][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.062972][ T5901]  ksys_write+0x150/0x270
[  225.062984][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  225.062996][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.063005][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.063014][ T5901]  do_syscall_64+0x174/0x580
[  225.063025][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.063033][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  225.063044][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10078] <... set_robust_list resumed>) = 0
[  225.063052][ T5901] RIP: 0033:0x7fcfafca149e
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  225.063062][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[pid 10078] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[  225.063070][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[  225.063080][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  225.063086][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[pid 10078] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  7199] <... unshare resumed>)      = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.063091][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  225.063096][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  225.063101][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  225.063114][ T5901]  </TASK>
[  225.063207][ T5901] SLUB: Unable to allocate memory on CPU 1 (of node 1) on node -1, gfp=0xcc0(GFP_KERNEL)
[  225.196195][ T5901]   cache: rpc_buffers, object size: 2048, buffer size: 2176, default order: 3, min order: 0
[  225.199500][ T5901]   node 0: slabs: 1, objs: 15, free: 0
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  7199] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  7199] <... socket resumed>)       = -1 EMFILE (Too many open files)
[  225.201302][ T5901]   node 1: slabs: 0, objs: 0, free: 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  7199] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10080
[pid  7199] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  7199] <... openat resumed>)       = -1 EMFILE (Too many open files)
/strace: Process 10080 attached
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10080] set_robust_list(0x5555728886e0, 24) = 0
[pid 10080] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[pid  7199] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 123 <unfinished ...>
[pid 10080] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  7199] <... write resumed>)        = 123
[pid 10080] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  7199] exit_group(0 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  7199] <... exit_group resumed>)   = ?
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  6140] <... unshare resumed>)      = 0
/strace: Process 10082 attached
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10082
[pid 10082] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  6140] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  6140] <... socket resumed>)       = 474
[pid 10082] <... set_robust_list resumed>) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10082] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[  225.269276][ T5901] FAULT_INJECTION: forcing a failure.
[  225.269276][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[pid  6140] ioctl(474, SIOCGIFFLAGS, {ifr_name="lo" <unfinished ...>
[pid 10082] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6140] <... ioctl resumed>, ifr_flags=IFF_LOOPBACK}) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10082] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.278181][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  225.278194][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  225.278200][ T5901] Call Trace:
[  225.278204][ T5901]  <TASK>
[  225.278208][ T5901]  dump_stack_lvl+0xe8/0x150
[  225.278225][ T5901]  should_fail_ex+0x40c/0x560
[  225.278242][ T5901]  prepare_alloc_pages+0x230/0x650
[  225.278259][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  225.278275][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  225.278291][ T5901]  ? policy_nodemask+0x27c/0x720
[  225.278303][ T5901]  alloc_pages_mpol+0x212/0x380
[  225.278315][ T5901]  allocate_slab+0x131/0x5e0
[  225.278325][ T5901]  ? kfree+0x1c5/0x640
[  225.278337][ T5901]  ___slab_alloc+0x16a/0x950
[  225.278351][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  225.278362][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  225.278373][ T5901]  ? rpc_malloc+0xeb/0x260
[  225.278385][ T5901]  ? rpc_malloc+0xeb/0x260
[  225.278399][ T5901]  rpc_malloc+0xeb/0x260
[  225.278412][ T5901]  call_allocate+0x26d/0x680
[  225.278424][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  225.278436][ T5901]  __rpc_execute+0x526/0x1280
[  225.278453][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  225.278466][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  225.278477][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  225.278490][ T5901]  rpc_execute+0x1c1/0x390
[  225.278502][ T5901]  rpc_run_task+0x4a6/0x660
[  225.278513][ T5901]  rpc_call_sync+0x10f/0x200
[  225.278521][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  225.278533][ T5901]  ? net_generic+0x1e/0x240
[  225.278542][ T5901]  ? net_generic+0x1e/0x240
[  225.278552][ T5901]  rpcb_register+0x2d0/0x530
[  225.278562][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  225.278569][ T5901]  ? net_generic+0x1e/0x240
[  225.278580][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  225.278589][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  225.278602][ T5901]  svc_unregister+0x24d/0x780
[  225.278617][ T5901]  svc_bind+0x1e9/0x230
[  225.278628][ T5901]  nfsd_create_serv+0x581/0x840
[  225.278640][ T5901]  ? kasan_save_track+0x3e/0x80
[  225.278652][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  225.278664][ T5901]  ? sscanf+0xe2/0x140
[  225.278674][ T5901]  ? net_generic+0x1e/0x240
[  225.278686][ T5901]  ? __pfx_sscanf+0x10/0x10
[  225.278696][ T5901]  ? net_generic+0x1e/0x240
[  225.278708][ T5901]  ? net_generic+0x1e/0x240
[  225.278722][ T5901]  write_ports+0x669/0xd10
[  225.278754][ T5901]  ? __pfx_write_ports+0x10/0x10
[  225.278771][ T5901]  ? _copy_from_user+0x94/0xb0
[  225.278781][ T5901]  ? simple_transaction_get+0x12d/0x160
[  225.278792][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  225.278802][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  225.278811][ T5901]  vfs_write+0x296/0xba0
[  225.278831][ T5901]  ? __pfx_vfs_write+0x10/0x10
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[pid  6141] <... unshare resumed>)      = 0
[  225.278845][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  225.278855][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.278869][ T5901]  ksys_write+0x150/0x270
[  225.278880][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  225.278894][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.278903][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.278911][ T5901]  do_syscall_64+0x174/0x580
[  225.278922][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.278930][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  225.278941][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.278949][ T5901] RIP: 0033:0x7fcfafca149e
[pid  6140] ioctl(474, SIOCSIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING} <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[  225.278957][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[pid  6141] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[  225.278965][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  225.278975][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  225.278981][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152/strace: Process 10084 attached
[  225.278987][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  225.278992][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  225.278997][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  225.279010][ T5901]  </TASK>
[  225.279015][ T5901] SLUB: Unable to allocate memory on CPU 1 (of node 1) on node -1, gfp=0xcc0(GFP_KERNEL)
 <unfinished ...>
[pid  6141] <... socket resumed>)       = 476
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.404970][ T5901]   cache: rpc_buffers, object size: 2048, buffer size: 2176, default order: 3, min order: 0
[  225.409641][ T5901]   node 0: slabs: 1, objs: 15, free: 0
[  225.412928][ T5901]   node 1: slabs: 0, objs: 0, free: 0
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10084
[pid  6141] ioctl(476, SIOCGIFFLAGS, {ifr_name="lo" <unfinished ...>
[pid 10084] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10084] <... set_robust_list resumed>) = 0
[pid  6141] <... ioctl resumed>, ifr_flags=IFF_LOOPBACK}) = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10084] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  6141] ioctl(476, SIOCSIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING} <unfinished ...>
[pid 10084] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10084] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  6558] <... unshare resumed>)      = 0
[pid  6558] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  6558] <... socket resumed>)       = -1 EMFILE (Too many open files)
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  6558] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL/strace: Process 10086 attached
 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.477734][ T5901] FAULT_INJECTION: forcing a failure.
[pid  6558] <... mount resumed>)        = 0
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10086
[  225.477734][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  225.481933][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[pid 10086] set_robust_list(0x5555728886e0, 24) = 0
[pid 10086] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[  225.481945][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  225.481952][ T5901] Call Trace:
[  225.481956][ T5901]  <TASK>
[  225.481961][ T5901]  dump_stack_lvl+0xe8/0x150
[  225.481977][ T5901]  should_fail_ex+0x40c/0x560
[  225.481993][ T5901]  prepare_alloc_pages+0x230/0x650
[  225.482011][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  225.482027][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  225.482044][ T5901]  ? policy_nodemask+0x27c/0x720
[  225.482056][ T5901]  alloc_pages_mpol+0x212/0x380
[  225.482068][ T5901]  allocate_slab+0x131/0x5e0
[  225.482079][ T5901]  ? kfree+0x1c5/0x640
[  225.482091][ T5901]  ___slab_alloc+0x16a/0x950
[  225.482105][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  225.482116][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  225.482127][ T5901]  ? rpc_malloc+0xeb/0x260
[  225.482139][ T5901]  ? rpc_malloc+0xeb/0x260
[  225.482153][ T5901]  rpc_malloc+0xeb/0x260
[  225.482166][ T5901]  call_allocate+0x26d/0x680
[  225.482178][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  225.482190][ T5901]  __rpc_execute+0x526/0x1280
[  225.482208][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  225.482220][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  225.482231][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  225.482244][ T5901]  rpc_execute+0x1c1/0x390
[  225.482256][ T5901]  rpc_run_task+0x4a6/0x660
[  225.482267][ T5901]  rpc_call_sync+0x10f/0x200
[  225.482275][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  225.482287][ T5901]  ? net_generic+0x1e/0x240
[  225.482296][ T5901]  ? net_generic+0x1e/0x240
[  225.482308][ T5901]  rpcb_register+0x2d0/0x530
[  225.482318][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[  225.482326][ T5901]  ? net_generic+0x1e/0x240
[  225.482336][ T5901]  ? rpcb_create_local+0x4ee/0x670
[pid 10086] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  6558] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6558] <... openat resumed>)       = -1 EMFILE (Too many open files)
[  225.482345][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  225.482357][ T5901]  svc_unregister+0x24d/0x780
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[  225.482372][ T5901]  svc_bind+0x1e9/0x230
[  225.482383][ T5901]  nfsd_create_serv+0x581/0x840
[  225.482396][ T5901]  ? kasan_save_track+0x3e/0x80
[  225.482407][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  225.482419][ T5901]  ? sscanf+0xe2/0x140
[  225.482429][ T5901]  ? net_generic+0x1e/0x240
[  225.482441][ T5901]  ? __pfx_sscanf+0x10/0x10
[  225.482451][ T5901]  ? net_generic+0x1e/0x240
[  225.482462][ T5901]  ? net_generic+0x1e/0x240
[  225.482477][ T5901]  write_ports+0x669/0xd10
[  225.482487][ T5901]  ? __pfx_write_ports+0x10/0x10
[  225.482504][ T5901]  ? _copy_from_user+0x94/0xb0
[  225.482514][ T5901]  ? simple_transaction_get+0x12d/0x160
[  225.482525][ T5901]  nfsctl_transaction_write+0x10f/0x160
[pid  6558] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 104 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.482535][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  225.482544][ T5901]  vfs_write+0x296/0xba0
[  225.482558][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  225.482572][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[pid  6558] <... write resumed>)        = 104
[  225.482582][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[  225.482596][ T5901]  ksys_write+0x150/0x270
[  225.482608][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  225.482620][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.482629][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.482638][ T5901]  do_syscall_64+0x174/0x580
[pid  6558] exit_group(0 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  6558] <... exit_group resumed>)   = ?
[  225.482648][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.482657][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  225.482667][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.482675][ T5901] RIP: 0033:0x7fcfafca149e
[  225.482685][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  225.482692][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  225.482721][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[  225.482728][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  225.482734][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  225.482739][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  225.482744][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  225.482757][ T5901]  </TASK>
[  225.482763][ T5901] SLUB: Unable to allocate memory on CPU 1 (of node 1) on node -1, gfp=0xcc0(GFP_KERNEL)
[  225.605118][ T5901]   cache: rpc_buffers, object size: 2048, buffer size: 2176, default order: 3, min order: 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152/strace: Process 10087 attached
[  225.608330][ T5901]   node 0: slabs: 1, objs: 15, free: 0
[  225.610044][ T5901]   node 1: slabs: 0, objs: 0, free: 0
) = -1 EMFILE (Too many open files)
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10087
[pid 10087] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  8107] <... unshare resumed>)      = 0
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  8107] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10087] <... set_robust_list resumed>) = 0
[pid  8107] <... socket resumed>)       = -1 EMFILE (Too many open files)
[pid 10087] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  8107] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10087] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  8107] <... mount resumed>)        = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid 10087] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  8107] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid  8107] <... openat resumed>)       = -1 EMFILE (Too many open files)
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152/strace: Process 10089 attached
[  225.677677][ T5901] FAULT_INJECTION: forcing a failure.
[  225.677677][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
 <unfinished ...>
[pid  8107] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 142 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10089
[pid 10089] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  8107] <... write resumed>)        = 142
[  225.687112][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10089] <... set_robust_list resumed>) = 0
[  225.687126][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  225.687132][ T5901] Call Trace:
[pid  8107] exit_group(0 <unfinished ...>
[  225.687136][ T5901]  <TASK>
[  225.687140][ T5901]  dump_stack_lvl+0xe8/0x150
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  225.687158][ T5901]  should_fail_ex+0x40c/0x560
[  225.687174][ T5901]  prepare_alloc_pages+0x230/0x650
[pid 10089] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  8107] <... exit_group resumed>)   = ?
[  225.687191][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  225.687211][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  225.687228][ T5901]  ? policy_nodemask+0x27c/0x720
[  225.687240][ T5901]  alloc_pages_mpol+0x212/0x380
[  225.687252][ T5901]  allocate_slab+0x131/0x5e0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10089] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.687262][ T5901]  ? kfree+0x1c5/0x640
[  225.687274][ T5901]  ___slab_alloc+0x16a/0x950
[  225.687288][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  225.687300][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  225.687310][ T5901]  ? rpc_malloc+0xeb/0x260
[pid 10089] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[  225.687322][ T5901]  ? rpc_malloc+0xeb/0x260
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[  225.687336][ T5901]  rpc_malloc+0xeb/0x260
[  225.687351][ T5901]  call_allocate+0x26d/0x680
[  225.687363][ T5901]  ? __pfx_call_allocate+0x10/0x10
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.687374][ T5901]  __rpc_execute+0x526/0x1280
[  225.687392][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[  225.687405][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10090 attached
[  225.687415][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  225.687428][ T5901]  rpc_execute+0x1c1/0x390
[  225.687441][ T5901]  rpc_run_task+0x4a6/0x660
, child_tidptr=0x5555728886d0) = 10090
[  225.687451][ T5901]  rpc_call_sync+0x10f/0x200
[  225.687460][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  225.687472][ T5901]  ? net_generic+0x1e/0x240
[pid 10090] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10090] <... set_robust_list resumed>) = 0
[  225.687481][ T5901]  ? net_generic+0x1e/0x240
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[  225.687491][ T5901]  rpcb_register+0x2d0/0x530
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10090] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[  225.687501][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.687508][ T5901]  ? net_generic+0x1e/0x240
[  225.687518][ T5901]  ? rpcb_create_local+0x4ee/0x670
[pid 10090] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  225.687528][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  225.687553][ T5901]  svc_unregister+0x24d/0x780
[  225.687570][ T5901]  svc_bind+0x1e9/0x230
[  225.687581][ T5901]  nfsd_create_serv+0x581/0x840
[  225.687594][ T5901]  ? kasan_save_track+0x3e/0x80
[  225.687605][ T5901]  ? __pfx_nfsd_create_serv+0x10/0x10
[  225.687617][ T5901]  ? sscanf+0xe2/0x140
[  225.687627][ T5901]  ? net_generic+0x1e/0x240
[  225.687639][ T5901]  ? __pfx_sscanf+0x10/0x10
[  225.687648][ T5901]  ? net_generic+0x1e/0x240
[  225.687660][ T5901]  ? net_generic+0x1e/0x240
[  225.687674][ T5901]  write_ports+0x669/0xd10
[  225.687711][ T5901]  ? __pfx_write_ports+0x10/0x10
[  225.687736][ T5901]  ? _copy_from_user+0x94/0xb0
[  225.687747][ T5901]  ? simple_transaction_get+0x12d/0x160
[  225.687757][ T5901]  nfsctl_transaction_write+0x10f/0x160
[pid 10090] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[  225.687767][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  225.687775][ T5901]  vfs_write+0x296/0xba0
[  225.687790][ T5901]  ? __pfx_vfs_write+0x10/0x10
[  225.687804][ T5901]  ? _raw_spin_unlock_irq+0x23/0x50
[  225.687814][ T5901]  ? lockdep_hardirqs_on+0x7a/0x110
[  225.687827][ T5901]  ksys_write+0x150/0x270
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0
[  225.687839][ T5901]  ? __pfx_ksys_write+0x10/0x10
[  225.687852][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.687861][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.687869][ T5901]  do_syscall_64+0x174/0x580
[  225.687880][ T5901]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[  225.687888][ T5901]  ? clear_bhb_loop+0x70/0xc0
[  225.687899][ T5901]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  225.687907][ T5901] RIP: 0033:0x7fcfafca149e
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10091
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.687917][ T5901] Code: 08 0f 85 f5 e1 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[  225.687924][ T5901] RSP: 002b:00007ffe27cf2368 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  225.687934][ T5901] RAX: ffffffffffffffda RBX: 0000555572888400 RCX: 00007fcfafca149e
[  225.687941][ T5901] RDX: 0000000000000008 RSI: 00007fcfafcee0b4 RDI: 000000000000000e
[  225.687946][ T5901] RBP: 000000000000000e R08: 0000000000000000 R09: 0000000000000000
[  225.687951][ T5901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfafcee09c
[  225.687957][ T5901] R13: 0000000000000002 R14: 00007fcfafd1d560 R15: 0000000000000002
[  225.687969][ T5901]  </TASK>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
/strace: Process 10091 attached
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
[pid 10091] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[  225.844495][ T5901] SLUB: Unable to allocate memory on CPU 1 (of node 1) on node -1, gfp=0xcc0(GFP_KERNEL)
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid 10091] <... set_robust_list resumed>) = 0
[pid  7207] <... unshare resumed>)      = 0
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid 10091] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[pid 10091] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  7207] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid 10091] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  7207] <... socket resumed>)       = -1 EMFILE (Too many open files)
/strace: Process 10095 attached
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10095
[pid  8971] <... unshare resumed>)      = 0
[pid  6853] <... unshare resumed>)      = 0
[pid  7207] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10095] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  6853] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  8971] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP <unfinished ...>
[pid  7207] <... mount resumed>)        = 0
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10095] <... set_robust_list resumed>) = 0
[pid  8971] <... socket resumed>)       = -1 EMFILE (Too many open files)
[pid  6853] <... socket resumed>)       = -1 EMFILE (Too many open files)
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[  225.986466][ T5901]   cache: rpc_buffers, object size: 2048, buffer size: 2176, default order: 3, min order: 0
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[pid  7207] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  6853] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL <unfinished ...>
[pid 10095] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  8971] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL <unfinished ...>
[pid  7207] <... openat resumed>)       = -1 EMFILE (Too many open files)
[pid  8971] <... mount resumed>)        = 0
[pid  7207] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 123 <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  8971] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  7207] <... write resumed>)        = 123
[pid 10095] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[  225.993487][ T5901]   node 0: slabs: 1, objs: 15, free: 0
[pid  8971] <... openat resumed>)       = -1 EMFILE (Too many open files)
[pid  7207] exit_group(0 <unfinished ...>
[pid 10095] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  6853] <... mount resumed>)        = 0
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD <unfinished ...>
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[+] Iteration 1000
[+] Iteration 1500
[+] Iteration 2000
[+] Iteration 2500
[  226.003737][ T5901]   node 1: slabs: 0, objs: 0, free: 0
[pid  8971] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 180 <unfinished ...>
[pid  7207] <... exit_group resumed>)   = ?
/strace: Process 10096 attached
[pid  8971] <... write resumed>)        = 180
[pid  6853] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10096
[pid 10096] set_robust_list(0x5555728886e0, 24 <unfinished ...>
[pid  8971] exit_group(0 <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid 10096] <... set_robust_list resumed>) = 0
[pid  8971] <... exit_group resumed>)   = ?
[pid  6853] <... openat resumed>)       = -1 EMFILE (Too many open files)
[*] Starting reproducer...
[*] Forking children to trigger the bug...
[+] Iteration 0
[+] Iteration 500
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid 10096] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  6853] write(1, "[*] Starting reproducer...\n[*] Forking children to trigger the bug...\n[+] Iteration 0\n[+] Iteration "..., 104) = 104
[pid 10096] <... rt_sigprocmask resumed>, NULL, 8) = 0
[pid  6268] <... unshare resumed>)      = 0
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid 10096] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  6853] exit_group(0 <unfinished ...>
[pid  6268] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 744
[pid  6268] ioctl(744, SIOCGIFFLAGS, {ifr_name="lo" <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[pid  6853] <... exit_group resumed>)   = ?
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  6268] <... ioctl resumed>, ifr_flags=IFF_LOOPBACK}) = 0
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[pid  6268] ioctl(744, SIOCSIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING} <unfinished ...>
[pid  5894] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD/strace: Process 10098 attached
 <unfinished ...>
[  226.068180][ T5901] FAULT_INJECTION: forcing a failure.
[  226.068180][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
[  226.072498][ T5901] CPU: 1 UID: 0 PID: 5901 Comm: syz-executor394 Not tainted syzkaller #1 PREEMPT(full) 
[  226.072510][ T5901] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  226.072516][ T5901] Call Trace:
[  226.072520][ T5901]  <TASK>
[  226.072524][ T5901]  dump_stack_lvl+0xe8/0x150
[  226.072541][ T5901]  should_fail_ex+0x40c/0x560
[  226.072557][ T5901]  prepare_alloc_pages+0x230/0x650
[  226.072575][ T5901]  __alloc_frozen_pages_noprof+0x12f/0x380
[  226.072590][ T5901]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  226.072607][ T5901]  ? policy_nodemask+0x27c/0x720
[  226.072619][ T5901]  alloc_pages_mpol+0x212/0x380
[  226.072630][ T5901]  allocate_slab+0x131/0x5e0
[  226.072666][ T5901]  ? kfree+0x1c5/0x640
[  226.072680][ T5901]  ___slab_alloc+0x16a/0x950
[  226.072694][ T5901]  kmem_cache_alloc_noprof+0x135/0x5f0
[  226.072706][ T5901]  ? kmem_cache_alloc_noprof+0x150/0x5f0
[  226.072717][ T5901]  ? rpc_malloc+0xeb/0x260
[  226.072728][ T5901]  ? rpc_malloc+0xeb/0x260
[  226.072743][ T5901]  rpc_malloc+0xeb/0x260
[  226.072756][ T5901]  call_allocate+0x26d/0x680
[  226.072768][ T5901]  ? __pfx_call_allocate+0x10/0x10
[  226.072779][ T5901]  __rpc_execute+0x526/0x1280
[  226.072798][ T5901]  ? __pfx___rpc_execute+0x10/0x10
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... clone resumed>, child_tidptr=0x5555728886d0) = 10098
[pid 10098] set_robust_list(0x5555728886e0, 24) = 0
[pid 10098] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
[pid 10098] unshare(CLONE_NEWNS|CLONE_NEWNET <unfinished ...>
[pid  5894] rt_sigprocmask(SIG_SETMASK, [] <unfinished ...>
[pid  5895] <... bpf resumed>)          = -1 EMFILE (Too many open files)
[pid  6271] <... unshare resumed>)      = 0
[pid  6271] socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 749
[pid  6271] ioctl(749, SIOCGIFFLAGS, {ifr_name="lo", ifr_flags=IFF_LOOPBACK}) = 0
[pid  6271] ioctl(749, SIOCSIFFLAGS, {ifr_name="lo", ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING}) = 0
[pid  6271] close(749)                  = 0
[pid  6271] mount("nfsd", "/tmp/nfsd", "nfsd", 0, NULL) = 0
[  226.072810][ T5901]  ? rpc_task_get_xprt+0x26/0x250
[  226.072821][ T5901]  ? rpc_make_runnable+0xae/0x1c0
[  226.072833][ T5901]  rpc_execute+0x1c1/0x390
[  226.072846][ T5901]  rpc_run_task+0x4a6/0x660
[  226.072857][ T5901]  rpc_call_sync+0x10f/0x200
[  226.072866][ T5901]  ? __pfx_rpc_call_sync+0x10/0x10
[  226.072878][ T5901]  ? net_generic+0x1e/0x240
[  226.072886][ T5901]  ? net_generic+0x1e/0x240
[  226.072902][ T5901]  rpcb_register+0x2d0/0x530
[pid  6271] openat(AT_FDCWD, "/tmp/nfsd/portlist", O_WRONLY <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, NULL, 8) = 0
[  226.072912][ T5901]  ? __pfx_rpcb_register+0x10/0x10
[pid  6271] <... openat resumed>)       = 749
[  226.072919][ T5901]  ? net_generic+0x1e/0x240
[  226.072930][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  226.072939][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[pid  6271] openat(AT_FDCWD, "/tmp/nfsd/filehandle", O_RDWR) = 750
[  226.072951][ T5901]  svc_unregister+0x24d/0x780
[pid  5894] rt_sigprocmask(SIG_BLOCK, ~[] <unfinished ...>
[  226.072966][ T5901]  svc_bind+0x1e9/0x230
[  226.072977][ T5901]  nfsd_create_serv+0x581/0x840
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152 <unfinished ...>
[pid  5894] <... rt_sigprocmask resumed>, [], 8) = 0
[  226.072990][ T5901]  ? kasan_save_track+0x3e/0x80

[host] Command execution timed out after 2m30s

Crash Report: 

gemini-3.1-pro-preview

							input: 100327
							output: 43
							thoughts: 1845
						

**My Thoughts on Debugging the `percpu_counter_add_batch` Kernel Page Fault**

Okay, I'm looking at this bug report about an inability to handle a kernel paging request in `percpu_counter_add_batch`. The call trace seems to point to the NFS server (`fs/nfsd`) as the origin, specifically within the `svc_xprt_enqueue` function, which ultimately calls `percpu_counter_inc`. This suggests that the core issue might be related to how per-CPU counters are being managed, potentially due to resource exhaustion or an unexpected state.

The initial reproducer execution failed to trigger the bug, which is frustrating but not entirely unexpected in kernel debugging. However, the console output provides a crucial clue: "[ T5880] FAULT_INJECTION: forcing a failure." This immediately shifts my focus. It seems the test environment is intentionally injecting failures, specifically with `name fail_page_alloc, interval 1, probability 100, space 0, times -1`. This tells me the reproducer isn't directly hitting the *original* bug condition but is instead triggering a *different* failure mode due to fault injection.

Looking further down the console output, I see a cascade of messages related to memory allocation failures: "[ T5901] slab_out_of_memory: 18 callbacks suppressed" and "SLUB: Unable to allocate memory on CPU 1..." followed by details about the `rpc_buffers` slab cache. This confirms that the fault injection is indeed causing memory allocation failures, and it's happening in a loop because the reproducer is repeatedly calling `write_ports` and triggering either this fault injection or an out-of-memory condition.

Now, I need to reconcile this with the original bug. The original bug was a page fault in `percpu_counter_add_batch`. The crash report itself is empty, but the extensive fault injection traces are a strong indicator of the *type* of problem being exercised by the test setup. The fact that the reproducer timed out after 2m30s is likely a direct consequence of this infinite loop of failed memory allocations and retries, effectively starving the system.

So, my current hypothesis is that while the *test* is exercising memory allocation failures via fault injection, the *original bug* might be triggered under conditions where memory is genuinely scarce, or perhaps a specific race condition around `percpu_counter_add_batch` combined with an allocation failure leads to the page fault.

Let's re-examine the call trace for the *original* bug. The crash is indeed in `percpu_counter_add_batch`, called from `svc_xprt_enqueue`. My understanding of `svc_xprt_enqueue` is that it increments a counter (`pool->sp_sockets_queued`) to track queued sockets. If `xprt->xpt_server` is NULL, or if `sv_pools` is not properly initialized, then accessing `pool` could certainly lead to a crash, and potentially a page fault if the memory that *should* have contained that structure is now unmapped or invalid.

My next step is to delve into the `svc_xprt_create` function. This function is responsible for setting up the transport for RPC connections, and it's a likely candidate for initializing `xprt->xpt_server` and its associated `sv_pools`. I need to scrutinize the logic there, especially concerning error handling and the order of operations, to see if there's a path where a successful creation might leave these structures in an inconsistent state, which then, under certain (perhaps memory-constrained) conditions, leads to the observed page fault in `percpu_counter_add_batch`.

map[ContextFile:net/sunrpc/svc_xprt.c Name:svc_xprt_create]

map[SourceCode: 343:	/**
 344:	 * svc_xprt_create - Add a new listener to @serv
 345:	 * @serv: target RPC service
 346:	 * @xprt_name: transport class name
 347:	 * @net: network namespace
 348:	 * @family: network address family
 349:	 * @port: listener port
 350:	 * @flags: SVC_SOCK flags
 351:	 * @cred: credential to bind to this transport
 352:	 *
 353:	 * Return local xprt port on success or %-EPROTONOSUPPORT on failure
 354:	 */
 355:	int svc_xprt_create(struct svc_serv *serv, const char *xprt_name,
 356:			    struct net *net, const int family,
 357:			    const unsigned short port, int flags,
 358:			    const struct cred *cred)
 359:	{
 360:		struct sockaddr_in sin = {
 361:			.sin_family		= AF_INET,
 362:			.sin_addr.s_addr	= htonl(INADDR_ANY),
 363:			.sin_port		= htons(port),
 364:		};
 365:	#if IS_ENABLED(CONFIG_IPV6)
 366:		struct sockaddr_in6 sin6 = {
 367:			.sin6_family		= AF_INET6,
 368:			.sin6_addr		= IN6ADDR_ANY_INIT,
 369:			.sin6_port		= htons(port),
 370:		};
 371:	#endif
 372:		struct sockaddr *sap;
 373:	
 374:		switch (family) {
 375:		case PF_INET:
 376:			sap = (struct sockaddr *)&sin;
 377:			break;
 378:	#if IS_ENABLED(CONFIG_IPV6)
 379:		case PF_INET6:
 380:			sap = (struct sockaddr *)&sin6;
 381:			break;
 382:	#endif
 383:		default:
 384:			return -EAFNOSUPPORT;
 385:		}
 386:	
 387:		return svc_xprt_create_from_sa(serv, xprt_name, net, sap, flags, cred);
 388:	}
 SourceFile:net/sunrpc/svc_xprt.c]

gemini-3.1-pro-preview

							input: 102899
							output: 47
							thoughts: 17
						

**My Thought Process**

Okay, so my immediate focus is on verifying the functionality and behavior of the `svc_xprt_create_from_sa` function. I need to make sure it's doing exactly what it's supposed to do, and that it's doing it robustly. This means I'm looking to understand its internal workings, the specific parameters it accepts, and what it returns under various conditions. I'm also curious about its dependencies and how it interacts with other parts of the system, particularly anything related to the "sa" component. My goal here is to gain a complete and thorough understanding of this specific piece of code.

map[ContextFile:net/sunrpc/svc_xprt.c Name:svc_xprt_create_from_sa]

map[SourceCode: 301:	/**
 302:	 * svc_xprt_create_from_sa - Add a new listener to @serv from socket address
 303:	 * @serv: target RPC service
 304:	 * @xprt_name: transport class name
 305:	 * @net: network namespace
 306:	 * @sap: socket address pointer
 307:	 * @flags: SVC_SOCK flags
 308:	 * @cred: credential to bind to this transport
 309:	 *
 310:	 * Return local xprt port on success or %-EPROTONOSUPPORT on failure
 311:	 */
 312:	int svc_xprt_create_from_sa(struct svc_serv *serv, const char *xprt_name,
 313:				    struct net *net, struct sockaddr *sap,
 314:				    int flags, const struct cred *cred)
 315:	{
 316:		size_t len;
 317:		int err;
 318:	
 319:		switch (sap->sa_family) {
 320:		case AF_INET:
 321:			len = sizeof(struct sockaddr_in);
 322:			break;
 323:	#if IS_ENABLED(CONFIG_IPV6)
 324:		case AF_INET6:
 325:			len = sizeof(struct sockaddr_in6);
 326:			break;
 327:	#endif
 328:		default:
 329:			return -EAFNOSUPPORT;
 330:		}
 331:	
 332:		err = _svc_xprt_create(serv, xprt_name, net, sap, len, flags, cred);
 333:		if (err == -EPROTONOSUPPORT) {
 334:			request_module("svc%s", xprt_name);
 335:			err = _svc_xprt_create(serv, xprt_name, net, sap, len, flags,
 336:					       cred);
 337:		}
 338:	
 339:		return err;
 340:	}
 SourceFile:net/sunrpc/svc_xprt.c]

gemini-3.1-pro-preview

							input: 103568
							output: 44
							thoughts: 14
						

**My Thought Process**

Right, so the first thing that comes to my mind when I see this task is a need to dig into the specifics of the `_svc_xprt_create` function. I need to understand its role, its inputs, its outputs, and crucially, its behavior within the broader system. This isn't just about a cursory glance; I'm looking to get a deep, functional understanding of what this piece of code *does*. I'll be considering its dependencies, any potential side effects, and how it integrates with other components. This is the foundational step before I can really evaluate anything else.

map[ContextFile:net/sunrpc/svc_xprt.c Name:_svc_xprt_create]

map[SourceCode: 263:	static int _svc_xprt_create(struct svc_serv *serv, const char *xprt_name,
 264:				    struct net *net, struct sockaddr *sap,
 265:				    size_t len, int flags, const struct cred *cred)
 266:	{
 267:		struct svc_xprt_class *xcl;
 268:	
 269:		spin_lock(&svc_xprt_class_lock);
 270:		list_for_each_entry(xcl, &svc_xprt_class_list, xcl_list) {
 271:			struct svc_xprt *newxprt;
 272:			unsigned short newport;
 273:	
 274:			if (strcmp(xprt_name, xcl->xcl_name))
 275:				continue;
 276:	
 277:			if (!try_module_get(xcl->xcl_owner))
 278:				goto err;
 279:	
 280:			spin_unlock(&svc_xprt_class_lock);
 281:			newxprt = xcl->xcl_ops->xpo_create(serv, net, sap, len, flags);
 282:			if (IS_ERR(newxprt)) {
 283:				trace_svc_xprt_create_err(serv->sv_programs->pg_name,
 284:							  xcl->xcl_name, sap, len,
 285:							  newxprt);
 286:				module_put(xcl->xcl_owner);
 287:				return PTR_ERR(newxprt);
 288:			}
 289:			newxprt->xpt_cred = get_cred(cred);
 290:			svc_add_new_perm_xprt(serv, newxprt);
 291:			newport = svc_xprt_local_port(newxprt);
 292:			return newport;
 293:		}
 294:	 err:
 295:		spin_unlock(&svc_xprt_class_lock);
 296:		/* This errno is exposed to user space.  Provide a reasonable
 297:		 * perror msg for a bad transport. */
 298:		return -EPROTONOSUPPORT;
 299:	}
 SourceFile:net/sunrpc/svc_xprt.c]

gemini-3.1-pro-preview

							input: 104287
							output: 47
							thoughts: 17
						

**My Thought Process**

Right, so the first thing on my mind, as I'm looking at this system, is to quickly verify the functionality of `svc_add_new_perm_xprt`. My immediate instinct is to jump right in and see if that specific service call, the one responsible for adding new permissions for expert users, is behaving as expected. It's a crucial piece of the puzzle, ensuring that our access controls are robust and correctly implemented for those with elevated privileges. I need to confirm its integrity before delving deeper.

map[ContextFile:net/sunrpc/svc_xprt.c Name:svc_add_new_perm_xprt]

map[SourceCode: 254:	void svc_add_new_perm_xprt(struct svc_serv *serv, struct svc_xprt *new)
 255:	{
 256:		clear_bit(XPT_TEMP, &new->xpt_flags);
 257:		spin_lock_bh(&serv->sv_lock);
 258:		list_add(&new->xpt_list, &serv->sv_permsocks);
 259:		spin_unlock_bh(&serv->sv_lock);
 260:		svc_xprt_received(new);
 261:	}
 SourceFile:net/sunrpc/svc_xprt.c]

gemini-3.1-pro-preview

							input: 104523
							output: 43
							thoughts: 13
						

**My Thought Process for Debugging `svc_xprt_received`**

My immediate inclination is to dive into the `svc_xprt_received` function. I need to understand precisely how it's handling incoming requests. My goal here is to pinpoint any potential logical flaws, race conditions, or misinterpretations of network data that could be leading to the issue we're seeing. I'll be scrutinizing the data parsing, the state management within the function, and how it interacts with other components of the service. I expect that by tracing the execution flow through this specific function, I'll uncover the root cause of the problem.

map[ContextFile:net/sunrpc/svc_xprt.c Name:svc_xprt_received]

map[SourceCode: 214:	/**
 215:	 * svc_xprt_received - start next receiver thread
 216:	 * @xprt: controlling transport
 217:	 *
 218:	 * The caller must hold the XPT_BUSY bit and must
 219:	 * not thereafter touch transport data.
 220:	 *
 221:	 * Note: XPT_DATA only gets cleared when a read-attempt finds no (or
 222:	 * insufficient) data.
 223:	 */
 224:	void svc_xprt_received(struct svc_xprt *xprt)
 225:	{
 226:		if (!test_bit(XPT_BUSY, &xprt->xpt_flags)) {
 227:			WARN_ONCE(1, "xprt=0x%p already busy!", xprt);
 228:			return;
 229:		}
 230:	
 231:		/* As soon as we clear busy, the xprt could be closed and
 232:		 * 'put', so we need a reference to call svc_xprt_enqueue with:
 233:		 */
 234:		svc_xprt_get(xprt);
 235:		smp_mb__before_atomic();
 236:		clear_bit(XPT_BUSY, &xprt->xpt_flags);
 237:	
 238:		/*
 239:		 * Skip the enqueue when no actionable flags are set.
 240:		 * Each producer both sets its flag (XPT_DATA, XPT_CLOSE,
 241:		 * etc.) and calls svc_xprt_enqueue(); if a set_bit races
 242:		 * with this check, the producer's own enqueue observes
 243:		 * !XPT_BUSY and dispatches the transport.
 244:		 */
 245:		if (READ_ONCE(xprt->xpt_flags) &
 246:		    (BIT(XPT_CONN) | BIT(XPT_CLOSE) | BIT(XPT_HANDSHAKE) |
 247:		     BIT(XPT_DATA) | BIT(XPT_DEFERRED)))
 248:			svc_xprt_enqueue(xprt);
 249:	
 250:		svc_xprt_put(xprt);
 251:	}
 SourceFile:net/sunrpc/svc_xprt.c]

gemini-3.1-pro-preview

							input: 105240
							output: 43
							thoughts: 13
						

**My Thought Process**

Right, first things first, I need to dive into the `svc_xprt_enqueue` function. This is where the magic, or at least the core mechanism, of how we get this data onto the wire happens, so it's the logical place to start understanding the flow. I'm assuming this is the point where the request is being prepared and handed off for transmission.

map[ContextFile:net/sunrpc/svc_xprt.c Name:svc_xprt_enqueue]

map[SourceCode: 502:	/**
 503:	 * svc_xprt_enqueue - Queue a transport on an idle nfsd thread
 504:	 * @xprt: transport with data pending
 505:	 *
 506:	 */
 507:	void svc_xprt_enqueue(struct svc_xprt *xprt)
 508:	{
 509:		struct svc_pool *pool;
 510:	
 511:		if (!svc_xprt_ready(xprt))
 512:			return;
 513:	
 514:		/* Mark transport as busy. It will remain in this state until
 515:		 * the provider calls svc_xprt_received. We update XPT_BUSY
 516:		 * atomically because it also guards against trying to enqueue
 517:		 * the transport twice.
 518:		 */
 519:		if (test_and_set_bit(XPT_BUSY, &xprt->xpt_flags))
 520:			return;
 521:	
 522:		pool = svc_pool_for_cpu(xprt->xpt_server);
 523:	
 524:		percpu_counter_inc(&pool->sp_sockets_queued);
 525:		xprt->xpt_qtime = ktime_get();
 526:		lwq_enqueue(&xprt->xpt_ready, &pool->sp_xprts);
 527:	
 528:		svc_pool_wake_idle_thread(pool);
 529:	}
 SourceFile:net/sunrpc/svc_xprt.c]

gemini-3.1-pro-preview

							input: 105744
							output: 43
							thoughts: 13
						

**My Thought Process for Assessing `svc_pool_for_cpu`**

Alright, my first inclination is to dive straight into `svc_pool_for_cpu`. This is where the rubber meets the road for a lot of the core resource management, particularly when it comes to CPU allocation and scheduling. I need to get a clear picture of how this service pool is configured and, more importantly, how it's actually behaving in real-time.

My immediate questions revolve around its current state and performance characteristics. Is it actively being utilized? What's the load like? Are there any obvious bottlenecks or saturation points showing up in the metrics? I'll be looking for things like CPU utilization per core, queue lengths, context switch rates, and perhaps even specific process or thread activity within that pool.

Beyond just the raw numbers, I'm also keen to understand the underlying configuration. What are the defined limits and priorities for this pool? Are there any specific affinity settings or NUMA node allocations that could be influencing performance? Understanding these parameters will help me interpret the observed metrics and identify any discrepancies between the intended state and the actual state.

Furthermore, I'll be considering the interactions this pool has with other components. How does `svc_pool_for_cpu` interface with the broader scheduling system? Are there any dependencies on other service pools or infrastructure elements that might be impacting its efficiency? Tracing these dependencies is crucial for a holistic understanding of the system's performance.

Ultimately, my goal here is to establish a baseline and identify any anomalies or areas of concern within `svc_pool_for_cpu` that might be contributing to the overall problem I'm investigating. This is a foundational step in diagnosing potential performance issues.

map[ContextFile:net/sunrpc/svc_xprt.c Name:svc_pool_for_cpu]

map[SourceCode: 389:	/**
 390:	 * svc_pool_for_cpu - Select pool to run a thread on this cpu
 391:	 * @serv: An RPC service
 392:	 *
 393:	 * Use the active CPU and the svc_pool_map's mode setting to
 394:	 * select the svc thread pool to use. Once initialized, the
 395:	 * svc_pool_map does not change.
 396:	 *
 397:	 * Return value:
 398:	 *   A pointer to an svc_pool
 399:	 */
 400:	struct svc_pool *svc_pool_for_cpu(struct svc_serv *serv)
 401:	{
 402:		struct svc_pool_map *m = &svc_pool_map;
 403:		int cpu = raw_smp_processor_id();
 404:		unsigned int pidx = 0;
 405:	
 406:		if (serv->sv_nrpools <= 1)
 407:			return serv->sv_pools;
 408:	
 409:		switch (m->mode) {
 410:		case SVC_POOL_PERCPU:
 411:			pidx = m->to_pool[cpu];
 412:			break;
 413:		case SVC_POOL_PERNODE:
 414:			pidx = m->to_pool[cpu_to_node(cpu)];
 415:			break;
 416:		}
 417:	
 418:		return &serv->sv_pools[pidx % serv->sv_nrpools];
 419:	}
 SourceFile:net/sunrpc/svc.c]

gemini-3.1-pro-preview

							input: 106261
							output: 37
							thoughts: 58
						

**A Deep Dive into Pooled Service Initialization**

Right, I've just stumbled upon a potential issue within the pooled service creation logic. My immediate thought process is centered around the `serv->sv_pools` structure and its members. Specifically, I'm questioning whether it's guaranteed to be properly initialized. The memory for `serv->sv_pools` itself is allocated within the `svc_create_pooled` function, which is good, but that doesn't inherently mean all of its *fields* are set up correctly.

My primary concern is about `sp_sockets_queued`. Is it possible that `serv->sv_pools` is allocated, but `sp_sockets_queued` within it remains uninitialized? Or perhaps, even more fundamentally, could `serv->sv_pools` itself be somehow left in an uninitialized state *before* or *during* the allocation process in `svc_create_pooled`?

To get to the bottom of this, I need to meticulously examine the `svc_create_pooled` function. I'm going to trace its execution flow, paying close attention to where `serv->sv_pools` is declared, allocated, and, most importantly, where and how its fields, particularly `sp_sockets_queued`, are initialized. This is the crucial step to either confirm or refute my suspicion about potential uninitialized data.

map[ContextFile:net/sunrpc/svc.c Name:svc_create_pooled]

map[SourceCode: 566:	/**
 567:	 * svc_create_pooled - Create an RPC service with pooled threads
 568:	 * @prog:  Array of RPC programs the new service will handle
 569:	 * @nprogs: Number of programs in the array
 570:	 * @stats: the stats struct if desired
 571:	 * @bufsize: maximum message size for @prog
 572:	 * @threadfn: a function to service RPC requests for @prog
 573:	 *
 574:	 * Returns an instantiated struct svc_serv object or NULL.
 575:	 */
 576:	struct svc_serv *svc_create_pooled(struct svc_program *prog,
 577:					   unsigned int nprogs,
 578:					   struct svc_stat *stats,
 579:					   unsigned int bufsize,
 580:					   int (*threadfn)(void *data))
 581:	{
 582:		struct svc_serv *serv;
 583:		unsigned int npools = svc_pool_map_get();
 584:	
 585:		serv = __svc_create(prog, nprogs, stats, bufsize, npools, threadfn);
 586:		if (!serv)
 587:			goto out_err;
 588:		serv->sv_is_pooled = true;
 589:		return serv;
 590:	out_err:
 591:		svc_pool_map_put();
 592:		return NULL;
 593:	}
 SourceFile:net/sunrpc/svc.c]

gemini-3.1-pro-preview

							input: 106784
							output: 36
							thoughts: 10
						

**My Thought Process**

Right, first things first, I need to get a handle on how this new service is being initiated. My immediate instinct is to dive straight into the `__svc_create` function. This is where the core setup for the service will be happening, and understanding that initialisation is paramount. I expect to find the critical parameters being passed in, any fundamental resource allocations, and the initial state being established. Without a clear picture of `__svc_create`, any subsequent analysis of the service's behaviour would be built on shaky foundations. It's the genesis, the blueprint for the service's existence, and therefore, my starting point for comprehension.

map[ContextFile:net/sunrpc/svc.c Name:__svc_create]

map[SourceCode: 479:	/*
 480:	 * Create an RPC service
 481:	 */
 482:	static struct svc_serv *
 483:	__svc_create(struct svc_program *prog, int nprogs, struct svc_stat *stats,
 484:		     unsigned int bufsize, int npools, int (*threadfn)(void *data))
 485:	{
 486:		struct svc_serv	*serv;
 487:		unsigned int vers;
 488:		unsigned int xdrsize;
 489:		unsigned int i;
 490:	
 491:		if (!(serv = kzalloc_obj(*serv)))
 492:			return NULL;
 493:		serv->sv_name      = prog->pg_name;
 494:		serv->sv_programs  = prog;
 495:		serv->sv_nprogs    = nprogs;
 496:		serv->sv_stats     = stats;
 497:		if (bufsize > RPCSVC_MAXPAYLOAD)
 498:			bufsize = RPCSVC_MAXPAYLOAD;
 499:		serv->sv_max_payload = bufsize? bufsize : 4096;
 500:		serv->sv_max_mesg  = roundup(serv->sv_max_payload + PAGE_SIZE, PAGE_SIZE);
 501:		serv->sv_threadfn = threadfn;
 502:		xdrsize = 0;
 503:		for (i = 0; i < nprogs; i++) {
 504:			struct svc_program *progp = &prog[i];
 505:	
 506:			progp->pg_lovers = progp->pg_nvers-1;
 507:			for (vers = 0; vers < progp->pg_nvers ; vers++)
 508:				if (progp->pg_vers[vers]) {
 509:					progp->pg_hivers = vers;
 510:					if (progp->pg_lovers > vers)
 511:						progp->pg_lovers = vers;
 512:					if (progp->pg_vers[vers]->vs_xdrsize > xdrsize)
 513:						xdrsize = progp->pg_vers[vers]->vs_xdrsize;
 514:				}
 515:		}
 516:		serv->sv_xdrsize   = xdrsize;
 517:		INIT_LIST_HEAD(&serv->sv_tempsocks);
 518:		INIT_LIST_HEAD(&serv->sv_permsocks);
 519:		timer_setup(&serv->sv_temptimer, NULL, 0);
 520:		spin_lock_init(&serv->sv_lock);
 521:	
 522:		__svc_init_bc(serv);
 523:	
 524:		serv->sv_nrpools = npools;
 525:		serv->sv_pools =
 526:			kzalloc_objs(struct svc_pool, serv->sv_nrpools);
 527:		if (!serv->sv_pools) {
 528:			kfree(serv);
 529:			return NULL;
 530:		}
 531:	
 532:		for (i = 0; i < serv->sv_nrpools; i++) {
 533:			struct svc_pool *pool = &serv->sv_pools[i];
 534:	
 535:			dprintk("svc: initialising pool %u for %s\n",
 536:					i, serv->sv_name);
 537:	
 538:			pool->sp_id = i;
 539:			lwq_init(&pool->sp_xprts);
 540:			INIT_LIST_HEAD(&pool->sp_all_threads);
 541:			init_llist_head(&pool->sp_idle_threads);
 542:	
 543:			percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL);
 544:			percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL);
 545:			percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL);
 546:		}
 547:	
 548:		return serv;
 549:	}
 SourceFile:net/sunrpc/svc.c]

gemini-3.1-pro-preview

							input: 108023
							output: 40
							thoughts: 48
						

**My Thought Process Regarding `percpu_counter_init`**

Ah, I've just realized something critical about `percpu_counter_init`. My initial assumption might have been that it's a straightforward initialization. However, upon deeper reflection, I'm recognizing that it's entirely possible for `percpu_counter_init` to fail, specifically due to a memory allocation failure. This is a significant point, as it implies that the caller needs to be prepared to handle such an eventuality.

My next step, then, is to confirm this potential failure. I need to verify if `percpu_counter_init` actually returns an error code to signal such a problem. It's not enough to simply suspect it; I need to know for sure how the function communicates its success or failure.

To do this, I'll be checking the definition of `percpu_counter_init`. This will involve delving into the source code or relevant documentation to understand its return type and the specific error codes it might produce. Only by examining the definition can I definitively ascertain how to properly handle potential failures and ensure robust operation of the code that utilizes this function.

log-in to see details

map[ContextFile:include/linux/percpu_counter.h Name:percpu_counter_init]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 108116
							output: 29
							thoughts: 26
						

**My Thought Process on `percpu_counter_init`**

Right, so my immediate instinct, when faced with the need to understand how `percpu_counter_init` works and where it's defined, is to head straight for the source code. Given that this is a core kernel primitive related to per-CPU data structures, the most logical place to look for its definition is in the relevant header files. Specifically, anything dealing with "percpu" structures will likely reside in the `include/linux/percpu*` directory. Therefore, my first port of call is to search within `include/linux/percpu_counter.h`. This file, by its very name, should contain the declarations and likely the inline definitions or function prototypes for the per-CPU counter management functions, including the initialization routine I'm interested in. This direct approach bypasses indirect references and gets me to the heart of the matter, allowing me to examine the function signature, its parameters, and any accompanying comments that explain its purpose and usage.

map[SourceFile:include/linux/percpu_counter.h]

map[Entities:[map[Kind:function Name:percpu_counter_add] map[Kind:function Name:percpu_counter_add_local] map[Kind:function Name:percpu_counter_compare] map[Kind:function Name:percpu_counter_dec] map[Kind:function Name:percpu_counter_destroy] map[Kind:function Name:percpu_counter_inc] map[Kind:function Name:percpu_counter_initialized] map[Kind:function Name:percpu_counter_limited_add] map[Kind:function Name:percpu_counter_read] map[Kind:function Name:percpu_counter_read_positive] map[Kind:function Name:percpu_counter_sub] map[Kind:function Name:percpu_counter_sub_local] map[Kind:function Name:percpu_counter_sum] map[Kind:function Name:percpu_counter_sum_positive] map[Kind:struct Name:percpu_counter]]]

gemini-3.1-pro-preview

							input: 108318
							output: 22
							thoughts: 14
						

**My Thought Process Regarding `percpu_counter_init`**

Ah, so my initial assumption that `percpu_counter_init` would be a standard, callable function appears to be incorrect. I'm realizing now that it's actually defined as a macro. This is an important distinction, and it immediately triggers a cascade of related considerations in my mind, given my expertise in this area.

First and foremost, this macro definition implies that the code for initializing a per-CPU counter will be *inlined* directly at the call site, rather than involving a function call overhead. For performance-critical kernel code, this is often a deliberate design choice to minimize latency and potentially improve cache locality by keeping initialization logic close to where it's used.

However, it also means I need to be mindful of the potential for code bloat if this macro is used very frequently across a large codebase. While individual instances might be small, repeated expansion could lead to a noticeable increase in the overall binary size. This is something I'd typically want to monitor during development and optimization phases.

Furthermore, the macro expansion means I'm not dealing with a traditional function signature. If I were to look at the source code, I wouldn't see a `static inline void percpu_counter_init(...)` declaration in the same way I would for a regular function. Instead, I'd expect to find `#define percpu_counter_init(...)` followed by the expanded code, which likely involves setting up the per-CPU data structures and perhaps initializing the counter value to zero or a specified initial value.

This also has implications for debugging. While modern debuggers are generally good at handling macros, understanding the underlying expanded code can sometimes be crucial for tracing issues, especially if the macro's logic itself is complex or has subtle side effects.

Given this, my immediate next step would be to examine the macro's definition to understand exactly *how* it initializes the per-CPU counter. What specific members of the `percpu_counter` structure are being set? Is it just a simple assignment, or does it involve more intricate operations like allocating per-CPU memory or setting up synchronization primitives if necessary (though for a simple counter, this is less likely)? This would involve navigating to the definition within the kernel source code.

Ultimately, recognizing `percpu_counter_init` as a macro shifts my focus from a call-and-return model to one of code substitution and its direct implications on performance and code size. It's a subtle but significant detail that impacts how I'd reason about its usage and potential optimizations.

map[Expression:#define percpu_counter_init]

map[Output:include/linux/percpu_counter.h=33=int __percpu_counter_init_many(struct percpu_counter *fbc, s64 amount,
--
include/linux/percpu_counter.h-36-
include/linux/percpu_counter.h:37:#define percpu_counter_init_many(fbc, value, gfp, nr_counters)		\
include/linux/percpu_counter.h-38-	({								\
--
include/linux/percpu_counter.h-45-
include/linux/percpu_counter.h:46:#define percpu_counter_init(fbc, value, gfp)				\
include/linux/percpu_counter.h-47-	percpu_counter_init_many(fbc, value, gfp, 1)
]

gemini-3.1-pro-preview

							input: 108555
							output: 40
							thoughts: 372
						

**The Perils of Ignored Return Values: A Deep Dive into `__svc_create` and `percpu_counter_init`**

It seems I've stumbled upon a rather critical oversight in the `__svc_create` function. My initial thought process was focused on understanding the return value of `percpu_counter_init`. I recognized, correctly, that `percpu_counter_init` is designed to return an `int` which signifies an error code. This is standard practice, indicating success or failure of the initialization.

However, as I reviewed the code snippet from `__svc_create`, a disturbing pattern emerged: the return value of `percpu_counter_init` is being completely disregarded within the `for` loop that initializes service pools.

Specifically, for each `struct svc_pool` being set up, `percpu_counter_init` is called three times: for `sp_messages_arrived`, `sp_sockets_queued`, and `sp_threads_woken`. The crucial point here is that `percpu_counter_init` is responsible for allocating the necessary memory to establish the per-CPU counter structure. If this allocation fails – which is a distinct possibility, especially in memory-constrained environments – the function will return an error.

If `percpu_counter_init` *does* fail, the associated per-CPU counter structure (let's call it `fbc` for the sake of discussion, as it's the internal structure holding the per-CPU counters) will not be properly initialized. This could manifest as `fbc->counters` being `NULL` or in an undefined state.

The real danger lies downstream. Later operations, such as `percpu_counter_inc` (or potentially `percpu_counter_add_batch` which I was about to investigate), will attempt to access and manipulate this per-CPU counter. If the underlying `fbc->counters` is `NULL` or uninitialized due to the failed `percpu_counter_init`, dereferencing it will inevitably lead to a crash. This isn't a subtle bug; it's a direct path to kernel panic.

My attention is now squarely fixed on `percpu_counter_add_batch` to confirm how it interacts with these potentially uninitialized per-CPU counters and to fully trace the impact of this ignored error condition. The core issue, as I see it, is the implicit assumption that `percpu_counter_init` will always succeed, an assumption that is being violated by the lack of error handling in the calling code.

map[ContextFile:lib/percpu_counter.c Name:percpu_counter_add_batch]

map[SourceCode:  88:	/*
  89:	 * Safety against interrupts is achieved in 2 ways:
  90:	 * 1. the fast path uses local cmpxchg (note: no lock prefix)
  91:	 * 2. the slow path operates with interrupts disabled
  92:	 */
  93:	void percpu_counter_add_batch(struct percpu_counter *fbc, s64 amount, s32 batch)
  94:	{
  95:		s64 count;
  96:		unsigned long flags;
  97:	
  98:		count = this_cpu_read(*fbc->counters);
  99:		do {
 100:			if (unlikely(abs(count + amount) >= batch)) {
 101:				raw_spin_lock_irqsave(&fbc->lock, flags);
 102:				/*
 103:				 * Note: by now we might have migrated to another CPU
 104:				 * or the value might have changed.
 105:				 */
 106:				count = __this_cpu_read(*fbc->counters);
 107:				fbc->count += count + amount;
 108:				__this_cpu_sub(*fbc->counters, count);
 109:				raw_spin_unlock_irqrestore(&fbc->lock, flags);
 110:				return;
 111:			}
 112:		} while (!this_cpu_try_cmpxchg(*fbc->counters, &count, count + amount));
 113:	}
 SourceFile:lib/percpu_counter.c]

gemini-3.1-pro-preview

							input: 109384
							output: 42
							thoughts: 2217
						

**My Thought Process Unraveling the NFS Crash**

Right, so I'm looking at this kernel crash, and my initial thought is about `this_cpu_read(*fbc->counters)`. I'm immediately thinking, "Okay, if `percpu_counter_init` failed, `fbc->counters` would be NULL, and dereferencing it like this is going to be a problem."

Then I pause. Hold on, `fbc->counters` isn't just a regular pointer; it's a *percpu* pointer. If it's NULL (which is essentially 0 in pointer terms), `this_cpu_read` isn't going to crash immediately by dereferencing a NULL address in the traditional sense. Instead, it adds the percpu offset to that pointer. So, if the pointer is 0, it'll be reading from offset 0 *relative to the current CPU's percpu area*.

Now, I look at the actual crash report, specifically the page fault information:
```
BUG: unable to handle page fault for address: ffff88808c54a000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
...
RIP: 0010:percpu_counter_add_batch+0x50/0x1d0 lib/percpu_counter.c:98
...
GS:ffff88808c54a000(0000)
```
This is the crucial piece of information. The address causing the page fault, `ffff88808c54a000`, is *exactly* the base address of the `GS` register. This confirms my suspicion. My previous thought about `this_cpu_read` adding the percpu offset to the pointer? Well, when `fbc->counters` is NULL (0), and `GS` is pointing to `ffff88808c54a000`, `this_cpu_read(*fbc->counters)` translates to `this_cpu_read(0)`, which then attempts to access `GS:0`. And that address, `ffff88808c54a000`, is precisely where the page fault occurs. This definitively proves that `fbc->counters` is indeed NULL.

So, the root cause is clear: the `__svc_create` function is carelessly ignoring the return value from `percpu_counter_init`. If `percpu_counter_init` fails, `__svc_create` just keeps chugging along as if everything is fine.

Now, I need to see if the reproducer I'm working with actually triggers this specific scenario. I examine the reproducer's output:
```
[  223.395845][ T5901]  ? rpcb_create_local+0x4ee/0x670
[  223.395855][ T5901]  ? __pfx_rpcb_create_local+0x10/0x10
[  223.395867][ T5901]  svc_unregister+0x24d/0x780
[  223.395882][ T5901]  svc_bind+0x1e9/0x230
[  223.395892][ T5901]  nfsd_create_serv+0x581/0x840
```
This trace shows that `nfsd_create_serv` calls `svc_create_pooled`, which in turn calls `__svc_create`. This looks promising. If `__svc_create` fails to allocate the percpu counter (as we've established it does without checking the return value), it proceeds. Then, later on, `write_ports` eventually calls `svc_xprt_create`, leading to `svc_xprt_enqueue`, which finally calls `percpu_counter_inc(&pool->sp_sockets_queued)`. Since `pool->sp_sockets_queued` wasn't properly initialized because `percpu_counter_init` failed (due to fault injection, presumably), this is where the crash should happen.

But wait a minute, the reproducer output I'm looking at *doesn't* show a crash at that exact point. It shows the fault injection occurring, but no immediate crash. This is confusing. Let me re-examine the reproducer output more carefully, focusing on the *exact* sequence of events:
```
[  223.396023][ T5901]  write_ports+0x669/0xd10
[  223.396033][ T5901]  ? __pfx_write_ports+0x10/0x10
[  223.396049][ T5901]  ? _copy_from_user+0x94/0xb0
[  223.396059][ T5901]  ? simple_transaction_get+0x12d/0x160
[  223.396070][ T5901]  nfsctl_transaction_write+0x10f/0x160
[  223.396079][ T5901]  ? __pfx_nfsctl_transaction_write+0x10/0x10
[  223.396088][ T5901]  vfs_write+0x296/0xba0
```
This trace shows fault injection happening, but it's occurring within `rpc_malloc`, called from `call_allocate`, which is called from `__rpc_execute`. This sequence is associated with `rpcb_register` or `rpcb_create_local`.

This contradicts my previous understanding. If the fault injection is in `rpc_malloc` and that fails, it means `rpcb_register` would fail, and consequently, `svc_bind` would fail, leading to `nfsd_create_serv` failing. If `nfsd_create_serv` fails, it should return an error, and `write_ports` *should not proceed* to `svc_xprt_create` and the subsequent `svc_xprt_enqueue`.

So, my current hypothesis is that the fault injection *needs* to happen specifically within `__svc_create` during the `percpu_counter_init` call itself. The reproducer, as it stands, seems to be triggering fault injection in `rpc_malloc` *before* `__svc_create` gets to the point of initializing the percpu counter. This might be because `rpc_malloc` is called earlier in the process of setting up the RPC infrastructure for `nfsd_create_serv`.

I need to refine the fault injection strategy. The target is definitely `alloc_percpu_gfp` within `percpu_counter_init` (or `__percpu_counter_init_many`). If `alloc_percpu_gfp` returns `-ENOMEM` due to fault injection, *that's* when `percpu_counter_init` will fail, and that's when `__svc_create` will ignore the failure, leading to the subsequent crash in `percpu_counter_inc`. The current fault injection is hitting a different part of the code. Let's go back and re-examine the `nfsd_create_serv` call flow to pinpoint where `percpu_counter_init` is actually invoked.

map[ContextFile:fs/nfsd/nfsctl.c Name:nfsd_create_serv]

map[SourceCode: 596:	int nfsd_create_serv(struct net *net)
 597:	{
 598:		int error;
 599:		struct nfsd_net *nn = net_generic(net, nfsd_net_id);
 600:		struct svc_serv *serv;
 601:	
 602:		WARN_ON(!mutex_is_locked(&nfsd_mutex));
 603:		if (nn->nfsd_serv)
 604:			return 0;
 605:	
 606:		error = percpu_ref_init(&nn->nfsd_net_ref, nfsd_net_free,
 607:					0, GFP_KERNEL);
 608:		if (error)
 609:			return error;
 610:		init_completion(&nn->nfsd_net_free_done);
 611:		init_completion(&nn->nfsd_net_confirm_done);
 612:	
 613:		if (nfsd_max_blksize == 0)
 614:			nfsd_max_blksize = nfsd_get_default_max_blksize();
 615:		nfsd_reset_versions(nn);
 616:		serv = svc_create_pooled(nfsd_programs, ARRAY_SIZE(nfsd_programs),
 617:					 &nn->nfsd_svcstats,
 618:					 nfsd_max_blksize, nfsd);
 619:		if (serv == NULL) {
 620:			percpu_ref_exit(&nn->nfsd_net_ref);
 621:			return -ENOMEM;
 622:		}
 623:	
 624:		error = svc_bind(serv, net);
 625:		if (error < 0) {
 626:			svc_destroy(&serv);
 627:			percpu_ref_exit(&nn->nfsd_net_ref);
 628:			return error;
 629:		}
 630:		spin_lock(&nfsd_notifier_lock);
 631:		nn->nfsd_serv = serv;
 632:		spin_unlock(&nfsd_notifier_lock);
 633:	
 634:		/* check if the notifier is already set */
 635:		if (atomic_inc_return(&nfsd_notifier_refcount) == 1) {
 636:			register_inetaddr_notifier(&nfsd_inetaddr_notifier);
 637:	#if IS_ENABLED(CONFIG_IPV6)
 638:			register_inet6addr_notifier(&nfsd_inet6addr_notifier);
 639:	#endif
 640:		}
 641:		nfsd_reset_write_verifier(nn);
 642:		return 0;
 643:	}
 SourceFile:fs/nfsd/nfssvc.c]

gemini-3.1-pro-preview

							input: 112442
							output: 38
							thoughts: 1364
						

**My Thought Process Unraveling the NFS Bug**

This is quite the rabbit hole, but I think I'm finally seeing the path to triggering this bug. It all starts with `nfsd_create_serv`, which, as I traced, calls `svc_create_pooled`, and then dives into `__svc_create`. The critical observation here is that if `__svc_create` fails to allocate a `percpu_counter` – and it *ignores* this failure, mind you, returning a valid `serv` pointer regardless – the process continues.

Then, `nfsd_create_serv` proceeds to call `svc_bind(serv, net)`. Inside `svc_bind`, we find `svc_unregister`, which in turn calls `rpcb_create_local`, and finally `rpc_malloc`. Now, if fault injection is active and specifically targets `rpc_malloc` to fail, then `svc_bind` will return an error. Consequently, `nfsd_create_serv` will clean up the `serv` it just created and return an error itself. So, the problem I'm trying to hit isn't triggered when `svc_bind` fails because of `rpc_malloc`'s failure.

My attention then shifted to what happens when `svc_bind` *does* fail, regardless of the *reason*. If `svc_bind` fails, `nfsd_create_serv` returns an error, and crucially, `write_ports` also fails. This means `write_ports` never even gets to the point of calling `svc_xprt_create`.

The core of the bug seems to lie in needing `percpu_counter_init` to fail, but for `svc_bind` to *succeed*. This is the delicate balance I need to strike. I know `percpu_counter_init` relies on memory allocation through `alloc_percpu_gfp`. My initial thought was to use fault injection on `alloc_percpu_gfp` directly, or perhaps `__percpu_counter_init_many`. Alternatively, I considered using BPF to simply exhaust memory, or using a broad tool like `fail_page_alloc`, though I was wary of that potentially impacting other, unrelated allocations.

Looking at the provided reproducer, it *is* using `fail_page_alloc`:
```
[  223.390843][ T5901] FAULT_INJECTION: forcing a failure.
[  223.390843][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
```
And the reproducer's actions are:
```c
write(fd, "1", 1); // to /proc/self/make-it-fail
write(portlist_fd, "tcp 2049", 8);
```
However, `write_ports` itself performs a substantial number of allocations. If `fail_page_alloc` is configured to fail *every* allocation (as indicated by `times -1` and `probability 100`), then it would fail at the very first allocation encountered. This could be `percpu_counter_init`, yes, but it would *also* fail `rpc_malloc` within `svc_bind`.

This is the crucial point: if `fail_page_alloc` is aggressively enabled to fail *every* allocation, `svc_bind` is almost guaranteed to fail. This isn't what I need; I need `percpu_counter_init` to fail, but `svc_bind` to pass.

How can this specific condition be met? I remembered that `percpu_counter_init` is called multiple times within a loop in `__svc_create`:
```c
		for (i = 0; i < serv->sv_nrpools; i++) {
			struct svc_pool *pool = &serv->sv_pools[i];
...
			percpu_counter_init(&pool->sp_messages_arrived, 0, GFP_KERNEL);
			percpu_counter_init(&pool->sp_sockets_queued, 0, GFP_KERNEL);
			percpu_counter_init(&pool->sp_threads_woken, 0, GFP_KERNEL);
		}
```
So, the goal is to make *just one* of these `percpu_counter_init` calls fail, or more precisely, to fail the underlying `alloc_percpu` allocation without concurrently failing standard `kmalloc` allocations used by `rpc_malloc`.

This is where the BPF element in the reproducer's `strace` became highly significant:
```c
[pid  5895] bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_PERCPU_ARRAY, key_size=4, value_size=32768, max_entries=1, map_flags=0, inner_map_fd=0, map_name="", map_ifindex=0, btf_fd=0, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0, excl_prog_hash=NULL, excl_prog_hash_size=0}, 152) = -1 EMFILE (Too many open files)
```
The reproducer is indeed attempting to exhaust percpu memory using BPF maps! However, it's running into an `EMFILE` (Too many open files) error *before* it can actually deplete the percpu memory. This is because it's creating a new file descriptor for each BPF map it tries to create, and it's hitting the system's file descriptor limit (typically 1024).

To truly exhaust percpu memory using this BPF approach, the reproducer needs a way to keep the BPF map file descriptors open to prevent the associated percpu memory from being released. Simply closing the fd would undo the memory exhaustion. The current issue implies either increasing the `RLIMIT_NOFILE` limit or, more elegantly, using a single BPF map but with a significantly larger `max_entries` value. It's important to remember that `BPF_MAP_TYPE_PERCPU_ARRAY` allocates `value_size` *per CPU* for each entry. With a large `value_size` like 32768, even a single map could potentially exhaust percpu memory if `max_entries` is large enough.

So, the path forward is clear: I need to target the percpu allocation mechanism specifically, bypassing the broad `fail_page_alloc` that contaminates other critical allocations. The BPF approach, when correctly implemented to avoid the `EMFILE` limit, appears to be the most promising avenue to achieve the specific failure of `percpu_counter_init` while allowing `svc_bind` to proceed.

map[ContextFile:kernel/bpf/arraymap.c Name:array_map_alloc]

map[SourceCode:  84:	static struct bpf_map *array_map_alloc(union bpf_attr *attr)
  85:	{
  86:		bool percpu = attr->map_type == BPF_MAP_TYPE_PERCPU_ARRAY;
  87:		int numa_node = bpf_map_attr_numa_node(attr);
  88:		u32 elem_size, index_mask, max_entries;
  89:		bool bypass_spec_v1 = bpf_bypass_spec_v1(NULL);
  90:		u64 array_size, mask64;
  91:		struct bpf_array *array;
  92:	
  93:		elem_size = round_up(attr->value_size, 8);
  94:	
  95:		max_entries = attr->max_entries;
  96:	
  97:		/* On 32 bit archs roundup_pow_of_two() with max_entries that has
  98:		 * upper most bit set in u32 space is undefined behavior due to
  99:		 * resulting 1U << 32, so do it manually here in u64 space.
 100:		 */
 101:		mask64 = fls_long(max_entries - 1);
 102:		mask64 = 1ULL << mask64;
 103:		mask64 -= 1;
 104:	
 105:		index_mask = mask64;
 106:		if (!bypass_spec_v1) {
 107:			/* round up array size to nearest power of 2,
 108:			 * since cpu will speculate within index_mask limits
 109:			 */
 110:			max_entries = index_mask + 1;
 111:			/* Check for overflows. */
 112:			if (max_entries < attr->max_entries)
 113:				return ERR_PTR(-E2BIG);
 114:		}
 115:	
 116:		array_size = sizeof(*array);
 117:		if (percpu) {
 118:			array_size += (u64) max_entries * sizeof(void *);
 119:		} else {
 120:			/* rely on vmalloc() to return page-aligned memory and
 121:			 * ensure array->value is exactly page-aligned
 122:			 */
 123:			if (attr->map_flags & BPF_F_MMAPABLE) {
 124:				array_size = PAGE_ALIGN(array_size);
 125:				array_size += PAGE_ALIGN((u64) max_entries * elem_size);
 126:			} else {
 127:				array_size += (u64) max_entries * elem_size;
 128:			}
 129:		}
 130:	
 131:		/* allocate all map elements and zero-initialize them */
 132:		if (attr->map_flags & BPF_F_MMAPABLE) {
 133:			void *data;
 134:	
 135:			/* kmalloc'ed memory can't be mmap'ed, use explicit vmalloc */
 136:			data = bpf_map_area_mmapable_alloc(array_size, numa_node);
 137:			if (!data)
 138:				return ERR_PTR(-ENOMEM);
 139:			array = data + PAGE_ALIGN(sizeof(struct bpf_array))
 140:				- offsetof(struct bpf_array, value);
 141:		} else {
 142:			array = bpf_map_area_alloc(array_size, numa_node);
 143:		}
 144:		if (!array)
 145:			return ERR_PTR(-ENOMEM);
 146:		array->index_mask = index_mask;
 147:		array->map.bypass_spec_v1 = bypass_spec_v1;
 148:	
 149:		/* copy mandatory map attributes */
 150:		bpf_map_init_from_attr(&array->map, attr);
 151:		array->elem_size = elem_size;
 152:	
 153:		if (percpu && bpf_array_alloc_percpu(array)) {
 154:			bpf_map_area_free(array);
 155:			return ERR_PTR(-ENOMEM);
 156:		}
 157:	
 158:		return &array->map;
 159:	}
 SourceFile:kernel/bpf/arraymap.c]

gemini-3.1-pro-preview

							input: 115080
							output: 42
							thoughts: 15
						

**My Thought Process on `bpf_array_alloc_percpu`**

Alright, I need to get a grip on what's happening with `bpf_array_alloc_percpu`. My first inclination is to dive straight into the implementation. I want to understand its core functionality, its purpose within the larger BPF ecosystem. What exactly is it *doing*? Is it allocating memory, and if so, for what kind of BPF data structures? The "percpu" part immediately piques my interest – this suggests a focus on per-CPU data, which is a critical optimization strategy in kernel development for reducing contention.

So, the immediate next step in my mental model is to trace the execution flow. Where is this function called from? What are its dependencies? Understanding its call sites will give me context about the scenarios in which per-CPU BPF arrays are being utilized. Is it for general-purpose arrays, or are there specific BPF helpers or programs that rely on this mechanism? I'm also keen to examine its arguments. What information does it need to perform its allocation? Are there parameters related to size, flags, or perhaps specific CPU configurations?

Then, I'll zoom in on the actual allocation logic. How does it manage the memory? Is it using standard kernel memory allocation primitives, or is there a specialized BPF-specific allocator at play? The "percpu" aspect strongly implies interaction with the kernel's per-CPU infrastructure. I need to understand how it maps these BPF-managed per-CPU arrays onto the underlying kernel mechanisms for per-CPU data. This likely involves looking at how it ensures isolation between CPUs and how data is accessed from each CPU's perspective.

Furthermore, I'll be scrutinizing its error handling. What are the potential failure modes? If memory allocation fails, how does the function signal this? How are these errors propagated upwards to the caller? For someone dealing with BPF, robust error handling is paramount, especially in kernel space.

Finally, I'll consider the implications of using per-CPU arrays. What are the performance benefits this function aims to achieve? What are the potential drawbacks or trade-offs? Understanding the "why" behind this function's existence is just as important as the "how." It's about understanding the design choices and the trade-offs made to optimize BPF program performance and scalability. This analysis will involve looking at its return values and any associated documentation or comments that explain its intended usage and performance characteristics.

map[ContextFile:kernel/bpf/arraymap.c Name:bpf_array_alloc_percpu]

map[SourceCode:  33:	static int bpf_array_alloc_percpu(struct bpf_array *array)
  34:	{
  35:		void __percpu *ptr;
  36:		int i;
  37:	
  38:		for (i = 0; i < array->map.max_entries; i++) {
  39:			ptr = bpf_map_alloc_percpu(&array->map, array->elem_size, 8,
  40:						   GFP_USER | __GFP_NOWARN);
  41:			if (!ptr) {
  42:				bpf_array_free_percpu(array);
  43:				return -ENOMEM;
  44:			}
  45:			array->pptrs[i] = ptr;
  46:			cond_resched();
  47:		}
  48:	
  49:		return 0;
  50:	}
 SourceFile:kernel/bpf/arraymap.c]

gemini-3.1-pro-preview

							input: 115389
							output: 38
							thoughts: 961
						

**My Thought Process Unraveling the NFSv4 Client Bug**

Initially, I was looking at `bpf_array_alloc_percpu`. My understanding was that it allocates `elem_size` per CPU for each entry in the array. If `max_entries` is large, this could lead to significant per-CPU memory consumption. Then, my focus shifted to `bpf_map_alloc_percpu`, noting its use of `GFP_USER | __GFP_NOWARN`, and that it returns `-ENOMEM` on failure.

The reproducer caught my attention. It was using `max_entries=1` and a `value_size=32768`, creating many maps. My initial thought was that this would lead to memory exhaustion, but it was hitting `EMFILE` instead. This was a bit of a puzzle.

Then I realized the critical detail: the reproducer was employing `fail_page_alloc` fault injection. This is a powerful mechanism. The log clearly showed:
```
[  223.390843][ T5901] FAULT_INJECTION: forcing a failure.
[  223.390843][ T5901] name fail_page_alloc, interval 1, probability 100, space 0, times -1
```
My understanding of `fail_page_alloc` is that it fails *any* page allocation that has `__GFP_FAULT` set, or if the task itself has the `make_it_fail` flag set. The latter is key: if the task has `make_it_fail` set, then *all* allocations by that task will fail.

This led me to examine the `svc_bind` call within the reproducer. `svc_bind` uses `rpc_malloc`, which in turn uses `kmalloc`. If `make_it_fail` is set for the task, `kmalloc` *will* fail. Consequently, `svc_bind` fails, `nfsd_create_serv` returns an error, and `write_ports` also fails. My conclusion at this point was that the intended bug, a crash in `percpu_counter_add_batch`, was never being reached because `svc_bind` was failing prematurely.

However, I had to revisit the sequence of events. I recalled that `percpu_counter_init` is called within `__svc_create`, which precedes `svc_bind`. If `percpu_counter_init` failed, `__svc_create` was designed to ignore the error and continue. Then, `svc_bind` would be called, its memory allocation would fail, and it would return an error. Subsequently, `nfsd_create_serv` would destroy the `serv` and return an error. This seemed to confirm my previous thought about `svc_bind` being the point of failure.

But the ultimate goal was to understand the crash. The crash trace pointed to `percpu_counter_add_batch` being called from `svc_xprt_enqueue`. I needed to figure out *when* `svc_xprt_enqueue` is actually invoked. The trace indicated it's called during transport creation or data reception:
```
 svc_xprt_enqueue+0x2ee/0x8b0 net/sunrpc/svc_xprt.c:524
 svc_xprt_received+0x10f/0x150 net/sunrpc/svc_xprt.c:248
 svc_add_new_perm_xprt net/sunrpc/svc_xprt.c:260 [inline]
 _svc_xprt_create+0x3d8/0x600 net/sunrpc/svc_xprt.c:290
 svc_xprt_create_from_sa net/sunrpc/svc_xprt.c:332 [inline]
 svc_xprt_create+0x1aa/0x280 net/sunrpc/svc_xprt.c:387
 __write_ports_addxprt fs/nfsd/nfsctl.c:774 [inline]
 __write_ports fs/nfsd/nfsctl.c:808 [inline]
 write_ports+0x71a/0xd10 fs/nfsd/nfsctl.c:861
```
This trace showed that `write_ports` calls `__write_ports_addxprt`, which then calls `svc_xprt_create`. This path seemed promising. However, I then looked back at `write_ports` itself. It *first* calls `nfsd_create_serv`. My reasoning then was: if `nfsd_create_serv` fails (which it was, due to `svc_bind` failing because of the fault injection), `write_ports` returns an error *without ever calling `__write_ports_addxprt`*. This means the code path leading to the crash in `svc_xprt_enqueue` would never be reached under the current fault injection scenario. This was the crux of my confusion.

map[ContextFile:fs/nfsd/nfsctl.c Name:write_ports]

map[SourceCode: 813:	/*
 814:	 * write_ports - Pass a socket file descriptor or transport name to listen on
 815:	 *
 816:	 * Input:
 817:	 *			buf:		ignored
 818:	 *			size:		zero
 819:	 * Output:
 820:	 *	On success:	passed-in buffer filled with a '\n'-terminated C
 821:	 *			string containing a whitespace-separated list of
 822:	 *			named NFSD listeners;
 823:	 *			return code is the size in bytes of the string
 824:	 *	On error:	return code is zero or a negative errno value
 825:	 *
 826:	 * OR
 827:	 *
 828:	 * Input:
 829:	 *			buf:		C string containing an unsigned
 830:	 *					integer value representing a bound
 831:	 *					but unconnected socket that is to be
 832:	 *					used as an NFSD listener; listen(3)
 833:	 *					must be called for a SOCK_STREAM
 834:	 *					socket, otherwise it is ignored
 835:	 *			size:		non-zero length of C string in @buf
 836:	 * Output:
 837:	 *	On success:	NFS service is started;
 838:	 *			passed-in buffer filled with a '\n'-terminated C
 839:	 *			string containing a unique alphanumeric name of
 840:	 *			the listener;
 841:	 *			return code is the size in bytes of the string
 842:	 *	On error:	return code is a negative errno value
 843:	 *
 844:	 * OR
 845:	 *
 846:	 * Input:
 847:	 *			buf:		C string containing a transport
 848:	 *					name and an unsigned integer value
 849:	 *					representing the port to listen on,
 850:	 *					separated by whitespace
 851:	 *			size:		non-zero length of C string in @buf
 852:	 * Output:
 853:	 *	On success:	returns zero; NFS service is started
 854:	 *	On error:	return code is a negative errno value
 855:	 */
 856:	static ssize_t write_ports(struct file *file, char *buf, size_t size)
 857:	{
 858:		ssize_t rv;
 859:	
 860:		mutex_lock(&nfsd_mutex);
 861:		rv = __write_ports(file, buf, size, netns(file));
 862:		mutex_unlock(&nfsd_mutex);
 863:		return rv;
 864:	}
 SourceFile:fs/nfsd/nfsctl.c]

gemini-3.1-pro-preview

							input: 117166
							output: 39
							thoughts: 10
						

**My Thought Process for Checking `__write_ports`**

My immediate inclination is to delve into the mechanics of `__write_ports`. I need to understand its precise functionality. What are the underlying operations it performs when I invoke it? I'm particularly interested in the data flow and how it interacts with the system's port interface. I'll be scrutinizing its implementation to ensure it aligns with my expectations for port communication and data transmission.

map[ContextFile:fs/nfsd/nfsctl.c Name:__write_ports]

map[SourceCode: 798:	static ssize_t __write_ports(struct file *file, char *buf, size_t size,
 799:				     struct net *net)
 800:	{
 801:		if (size == 0)
 802:			return __write_ports_names(buf, net);
 803:	
 804:		if (isdigit(buf[0]))
 805:			return __write_ports_addfd(buf, net, file->f_cred);
 806:	
 807:		if (isalpha(buf[0]))
 808:			return __write_ports_addxprt(buf, net, file->f_cred);
 809:	
 810:		return -EINVAL;
 811:	}
 SourceFile:fs/nfsd/nfsctl.c]

gemini-3.1-pro-preview

							input: 117438
							output: 44
							thoughts: 15
						

**My Thought Process on `__write_ports_addxprt`**

Alright, so my initial impulse is to dive right into the `__write_ports_addxprt` function. I need to understand its role, its inputs, its outputs, and crucially, how it interacts with the broader system, particularly concerning port manipulation. My immediate concern is to ascertain its primary purpose: is it a low-level utility for directly manipulating hardware ports, or does it operate at a higher abstraction layer, perhaps managing port configurations within a software framework? I'll be scrutinizing its parameters – what data is it expecting? Is it receiving port numbers, data to be written, or more complex configuration structures? Equally important is understanding what it returns. Does it signal success or failure? Does it provide any status information or modified data? The name `addxprt` is a bit of a hint, suggesting some form of addition or registration, possibly related to port export or expression, but I won't rely solely on that. I need to trace its execution flow, identify any dependencies it has, and consider the potential side effects of its operation. Given my expertise, I'll be looking for potential race conditions, memory safety issues, or any deviations from established best practices in port management. Essentially, I'm starting with a specific component and working outwards, seeking to build a comprehensive understanding of its function within its operational context.

map[ContextFile:fs/nfsd/nfsctl.c Name:__write_ports_addxprt]

map[SourceCode: 750:	/*
 751:	 * A transport listener is added by writing its transport name and
 752:	 * a port number.
 753:	 */
 754:	static ssize_t __write_ports_addxprt(char *buf, struct net *net, const struct cred *cred)
 755:	{
 756:		char transport[16];
 757:		struct svc_xprt *xprt;
 758:		int port, err;
 759:		struct nfsd_net *nn = net_generic(net, nfsd_net_id);
 760:		struct svc_serv *serv;
 761:	
 762:		if (sscanf(buf, "%15s %5u", transport, &port) != 2)
 763:			return -EINVAL;
 764:	
 765:		if (port < 1 || port > USHRT_MAX)
 766:			return -EINVAL;
 767:		trace_nfsd_ctl_ports_addxprt(net, transport, port);
 768:	
 769:		err = nfsd_create_serv(net);
 770:		if (err != 0)
 771:			return err;
 772:	
 773:		serv = nn->nfsd_serv;
 774:		err = svc_xprt_create(serv, transport, net,
 775:				      PF_INET, port, SVC_SOCK_ANONYMOUS, cred);
 776:		if (err < 0)
 777:			goto out_err;
 778:	
 779:		err = svc_xprt_create(serv, transport, net,
 780:				      PF_INET6, port, SVC_SOCK_ANONYMOUS, cred);
 781:		if (err < 0 && err != -EAFNOSUPPORT)
 782:			goto out_close;
 783:	
 784:		return 0;
 785:	out_close:
 786:		xprt = svc_find_xprt(serv, transport, net, PF_INET, port);
 787:		if (xprt != NULL) {
 788:			svc_xprt_close(xprt);
 789:			svc_xprt_put(xprt);
 790:		}
 791:	out_err:
 792:		if (!serv->sv_nrthreads && list_empty(&nn->nfsd_serv->sv_permsocks))
 793:			nfsd_destroy_serv(net);
 794:	
 795:		return err;
 796:	}
 SourceFile:fs/nfsd/nfsctl.c]

gemini-3.1-pro-preview

							input: 118256
							output: 41
							thoughts: 1683
						

**Understanding the NFS Service Creation Failure**

My thought process here is all about dissecting the NFS service creation flow, specifically looking for a way to reliably trigger a failure scenario that results in the service *not* being created properly, but without immediately aborting the entire process.

Initially, I'm tracing the execution path. I see `nfsd_create_serv` is the first critical function. If this function returns an error, then `__write_ports_addxprt` gracefully handles it by returning that same error, crucially *without* proceeding to call `svc_xprt_create`. This means if `svc_bind` fails within `nfsd_create_serv`, the entire `svc_xprt_create` path is bypassed, which is a good starting point for understanding potential failure modes.

However, I quickly realize a key detail about `nfsd_create_serv`: it *only* creates the NFS service if it doesn't already exist. There's a check:
```c
	if (nn->nfsd_serv)
		return 0;
```
If the service is already present, it simply returns success (0). This is significant. If the service were created successfully beforehand (perhaps by a normal write operation without any fault injection), then subsequent calls to `nfsd_create_serv` would just return 0. This would, in turn, mean that `percpu_counter_init` would succeed, and the `pool->sp_sockets_queued` counter would be properly initialized, preventing the crash I'm trying to reproduce.

Therefore, my objective shifts: I *must* force `percpu_counter_init` to fail.

Now, let's consider the implications if `percpu_counter_init` *does* fail. In this scenario, `__svc_create` *still* returns a valid `serv` pointer. Then, `nfsd_create_serv` proceeds to call `svc_bind`. If `svc_bind` *then* fails, the code correctly handles this by destroying the `serv` pointer and returning an error. Crucially, the `serv` is destroyed, and `nn->nfsd_serv` is *not* set, as shown in this snippet:
```c
	error = svc_bind(serv, net);
	if (error < 0) {
		svc_destroy(&serv);
		percpu_ref_exit(&nn->nfsd_net_ref);
		return error;
	}
	spin_lock(&nfsd_notifier_lock);
	nn->nfsd_serv = serv; // This line is NOT reached if svc_bind fails
```
This is exactly what I want! If `svc_bind` fails, `nn->nfsd_serv` remains unset. The next time `nfsd_create_serv` is called, it will find that `nn->nfsd_serv` is still null and will attempt to create the service again, potentially hitting the same failure path.

So, the refined goal becomes: I need to make `percpu_counter_init` fail, *but* `svc_bind` must succeed.

The question then is, how can I achieve this specific failure combination? I know `percpu_counter_init` internally uses `alloc_percpu_gfp` for memory allocation. Meanwhile, `svc_bind` relies on `kmalloc` (via `rpc_malloc`).

My first thought is to use `fail_page_alloc`. However, I recall that `alloc_percpu_gfp` allocates from the percpu allocator. If the percpu allocator needs more memory chunks, it calls `pcpu_alloc_pages`, which indeed allocates pages. But, if the percpu allocator already has free space in existing chunks, `alloc_percpu_gfp` might *not* allocate new pages. If it doesn't allocate pages, `fail_page_alloc` won't be effective. If it *does* allocate pages, then `fail_page_alloc` *could* intercept it. This is a bit uncertain.

Then I consider that `percpu_counter_init` uses `GFP_KERNEL`. How can I reliably make *just* `percpu_counter_init` fail?

The idea of using BPF to exhaust percpu memory comes to mind. If percpu memory is exhausted, `alloc_percpu_gfp` will fail, but `kmalloc` (used by `svc_bind`) might still succeed. This aligns perfectly with my objective.

The reproducer attempts to use BPF for this:
```c
  for (i = 0; i < 1000; i++) {
    union bpf_attr attr = {
        .map_type = BPF_MAP_TYPE_PERCPU_ARRAY,
        .key_size = 4,
        .value_size = 32768,
        .max_entries = 1,
    };
    bpf(BPF_MAP_CREATE, &attr, sizeof(attr));
  }
```
However, this approach hits an `EMFILE` error because the file descriptors (fildes) for the BPF maps are never closed. If an fd is closed, the BPF map is freed, and the percpu memory is released, undoing the exhaustion. So, simply closing the fd isn't an option.

The reproducer then suggests increasing the `RLIMIT_NOFILE` limit using `setrlimit`. This would allow creating more BPF maps without hitting `EMFILE`.
```c
  struct rlimit rlim = { .rlim_cur = 10000, .rlim_max = 10000 };
  setrlimit(RLIMIT_NOFILE, &rlim);
```
With an increased limit, it can indeed create more BPF maps and potentially exhaust percpu memory. I then ponder if there are other limits, like `RLIMIT_MEMLOCK` or cgroup memory accounting for BPF, that could interfere.

My attention returns to the BPF map creation itself. The reproducer uses `BPF_MAP_TYPE_PERCPU_ARRAY` with `max_entries = 1` and a large `value_size`. What if I try a much larger `max_entries`?
```c
    union bpf_attr attr = {
        .map_type = BPF_MAP_TYPE_PERCPU_ARRAY,
        .key_size = 4,
        .value_size = 32768,
        .max_entries = 10000,
    };
```
This would attempt to allocate a massive `320 MB` of percpu memory. However, I recall how `bpf_array_alloc_percpu` works: it allocates percpu memory for *each* entry individually.
```c
	for (i = 0; i < array->map.max_entries; i++) {
		ptr = bpf_map_alloc_percpu(&array->map, array->elem_size, 8,
					   GFP_USER | __GFP_NOWARN);
		if (!ptr) {
			bpf_array_free_percpu(array); // Frees ALL allocated entries
			return -ENOMEM;
		}
		array->pptrs[i] = ptr;
		cond_resched();
	}
```
If it fails halfway through, it frees *all* previously allocated entries. This means a single large map creation that fails won't permanently exhaust memory.

So, the strategy must be to create *multiple* maps, each of which *succeeds* in its initial allocation, until the available percpu memory is critically low.

Finally, I circle back to `fail_page_alloc`. Could I target it more precisely? Perhaps to `alloc_percpu_gfp` specifically? I consider using `fault-inject` stacktrace filtering or the `fail_function` option. But this depends on whether the kernel was compiled with `ALLOW_ERROR_INJECTION` and if `percpu_counter_init` (or its underlying allocation functions) are exposed in a way that `fail_function` can target. A quick check reveals `percpu_counter_init` itself is often inline, and `__percpu_counter_init_many` is exported. It's not immediately clear if `fail_function` can directly hook into the percpu allocation path in a straightforward manner.

The most promising path seems to be exhausting percpu memory through the BPF map creation with a sufficiently large `RLIMIT_NOFILE`, ensuring individual map creations succeed but collectively deplete the percpu pool, thus failing `percpu_counter_init` while allowing `svc_bind` (using `kmalloc`) to proceed.

map[ContextFile:lib/percpu_counter.c Name:__percpu_counter_init_many]

map[SourceCode: 188:	int __percpu_counter_init_many(struct percpu_counter *fbc, s64 amount,
 189:				       gfp_t gfp, u32 nr_counters,
 190:				       struct lock_class_key *key)
 191:	{
 192:		unsigned long flags __maybe_unused;
 193:		size_t counter_size;
 194:		s32 __percpu *counters;
 195:		u32 i;
 196:	
 197:		counter_size = ALIGN(sizeof(*counters), __alignof__(*counters));
 198:		counters = __alloc_percpu_gfp(nr_counters * counter_size,
 199:					      __alignof__(*counters), gfp);
 200:		if (!counters) {
 201:			fbc[0].counters = NULL;
 202:			return -ENOMEM;
 203:		}
 204:	
 205:		for (i = 0; i < nr_counters; i++) {
 206:			raw_spin_lock_init(&fbc[i].lock);
 207:			lockdep_set_class(&fbc[i].lock, key);
 208:	#ifdef CONFIG_HOTPLUG_CPU
 209:			INIT_LIST_HEAD(&fbc[i].list);
 210:	#endif
 211:			fbc[i].count = amount;
 212:			fbc[i].counters = (void __percpu *)counters + i * counter_size;
 213:	
 214:			debug_percpu_counter_activate(&fbc[i]);
 215:		}
 216:	
 217:	#ifdef CONFIG_HOTPLUG_CPU
 218:		spin_lock_irqsave(&percpu_counters_lock, flags);
 219:		for (i = 0; i < nr_counters; i++)
 220:			list_add(&fbc[i].list, &percpu_counters);
 221:		spin_unlock_irqrestore(&percpu_counters_lock, flags);
 222:	#endif
 223:		return 0;
 224:	}
 SourceFile:lib/percpu_counter.c]

gemini-3.1-pro-preview

							input: 120597
							output: 30
							thoughts: 66
						

**My Thought Process Regarding Error Injection for `__percpu_counter_init_many`**

Okay, so my initial thought is, "Hold on a second." I'm looking at this function, `__percpu_counter_init_many`, and I notice it's exported. This immediately piques my interest because if something is exported, it means it's intended for use by other parts of the system, and that also makes it a potential candidate for testing robustness through error injection.

Then, I immediately jump to the question: "Can I actually apply `fail_function` to this particular exported function?" My mind is already framing the necessary condition for this to work. The crucial piece of information I need is whether `__percpu_counter_init_many` has been explicitly marked with the `ALLOW_ERROR_INJECTION` macro. This is the gatekeeper – without that explicit allowance, attempting to inject errors would likely be futile or, at best, unsupported and potentially lead to unexpected behavior. So, my focus narrows down to verifying that specific annotation.

log-in to see details

map[Expression:ALLOW_ERROR_INJECTION\(__percpu_counter_init_many]

map[Output:]

gemini-3.1-pro-preview

							input: 120695
							output: 29
							thoughts: 16
						

**A Deep Dive into Per-CPU Allocation and Memory Management**

My initial reaction is a firm "No." This is my immediate, gut-level response, indicating a clear rejection of the preceding proposal or line of reasoning. However, as an expert in this domain, I know that a simple negation isn't sufficient. The underlying complexity demands exploration.

My mind immediately jumps to a specific, critical area: `__alloc_percpu_gfp`. This is where the real nuance lies, and it’s the key to understanding *why* my initial "No" might be too simplistic, or perhaps what the actual implications of the rejected proposal are.

I'm thinking about the intricacies of per-CPU memory allocation. My brain is already dissecting the implications:

*   **`__alloc_percpu_gfp`:** This function is the workhorse for allocating per-CPU memory, specifically using GFP (Get Free Pages) flags. This means I'm not just considering *if* memory can be allocated, but *how* and *under what constraints*. What are the typical GFP flags used in this context? Are we talking about DMA, device-specific memory, or general-purpose allocation? Each has different implications for performance, availability, and system behavior.

*   **Per-CPU Semantics:** The very nature of per-CPU allocation means each CPU gets its own dedicated chunk of memory. This offers significant performance benefits by avoiding locks and cache contention. However, it also comes with its own set of challenges:
    *   **Memory Footprint:** Per-CPU allocations can quickly consume a substantial amount of memory, especially on systems with many CPUs. This is a critical consideration for resource management.
    *   **Initialization:** How is this per-CPU memory initialized? Is it zeroed on allocation? Is there a separate initialization phase? The `__alloc_percpu_gfp` function itself might influence this.
    *   **Access Patterns:** I'm considering the expected access patterns. Will this per-CPU memory be accessed frequently by the local CPU, or will there be inter-CPU access (which would defeat some of the purpose)?
    *   **Deallocation:** How is per-CPU memory deallocated? Is it managed statically or dynamically? `__alloc_percpu_gfp` is typically used for static allocations that persist for the lifetime of the object or system, but dynamic scenarios also exist.

*   **GFP Flags and Their Impact:** The `gfp` part of `__alloc_percpu_gfp` is not to be understated.
    *   **`__GFP_NOWARN`:** Is there a concern about allocation failures? If so, are we expecting silent failures or do we need to handle them explicitly?
    *   **`__GFP_HIGH`:** Are we dealing with critical kernel paths where memory pressure is a significant concern, and we need to try harder to get memory, potentially even reclaiming from other zones?
    *   **`__GFP_ZERO`:** Does the caller expect the allocated memory to be zero-filled? This can have performance implications.
    *   **Zone allocation (`GFP_DMA`, `GFP_MOVABLE`, etc.):** Is there a requirement for memory to be in a specific memory zone, perhaps for hardware reasons or to avoid fragmentation?

*   **The "No" in Context:** My initial "No" likely stems from an awareness of one or more of these considerations. Perhaps the proposal implicitly assumes a simpler allocation mechanism, or overlooks the complexities and potential pitfalls of per-CPU memory management, especially when combined with specific GFP constraints. It's possible the proposal might lead to:
    *   Excessive memory consumption.
    *   Performance degradation due to unforeseen cache effects or locking.
    *   Difficulties in initialization or deallocation.
    *   Increased vulnerability to memory allocation failures in high-pressure scenarios.

In essence, my thought process is moving from a high-level rejection to a granular examination of the underlying memory management mechanisms, specifically focusing on how `__alloc_percpu_gfp` and its associated GFP flags interact with the core principles of per-CPU data structures. This detailed scrutiny is crucial for any expert in the field to understand the full ramifications of a proposal.

log-in to see details

map[Expression:ALLOW_ERROR_INJECTION\(__alloc_percpu_gfp]

map[Output:]

gemini-3.1-pro-preview

							input: 120742
							output: 35
							thoughts: 738
						

**My Thought Process on Simulating Memory Allocation Failures**

Okay, so the initial thought of just using `fail_function` is out. That's a non-starter. My immediate next idea was to try `fail_page_alloc`, but I need to be strategic about *when* I enable it. My target is `write_ports`. I know that `write_ports` eventually kicks off `nfsd_create_serv`, which then leads into `__svc_create`, and that's where `percpu_counter_init` happens. Great, so if I enable `fail_page_alloc` right before `write_ports`, it should interfere with `percpu_counter_init` by causing the page allocator to fail.

But then I remembered another critical path: `nfsd_create_serv` also calls `svc_bind`, and *that* calls `rpc_malloc`. So, if I enable `fail_page_alloc` just before `write_ports`, it's not just going to hit `percpu_counter_init`; it's going to potentially break `rpc_malloc` too. This is a double-edged sword, and I need to understand the implications.

Now, let's dive deeper into `rpc_malloc`. My understanding is that it primarily uses `kmem_cache_alloc_noprof` from the `rpc_buffers` cache. This is a crucial detail. If the `rpc_buffers` cache actually has available objects – meaning, if it's not completely depleted – then `kmem_cache_alloc` will succeed *without* ever touching the page allocator. This is a significant loophole for `fail_page_alloc`! It means my initial assumption about `fail_page_alloc` always intercepting `rpc_malloc` is flawed.

Ah, I see the way forward! If I can ensure that the `rpc_buffers` cache has some free objects *before* I enable `fail_page_alloc`, then `rpc_malloc` will likely succeed. How can I achieve this pre-allocation?

I need to populate the slab cache for `rpc_buffers`. I can do this by performing some RPC operations or setting up some RPC transports *before* I trigger the fault injection. For instance, if I create an RPC transport, that action itself should allocate objects from `rpc_buffers`. And critically, when I subsequently destroy that transport, those objects will be returned to the slab cache, making them available.

Now, I need to consider the percpu allocation as well. `__alloc_percpu_gfp` is also a potential point of failure for `fail_page_alloc`. However, similar to the `rpc_buffers` cache, the percpu allocator has its own internal free space. If it has available chunks, it *also* won't call the page allocator. So, the situation is: if both the `rpc_buffers` cache and the percpu allocator have free space, neither will fail. If both need to allocate pages, then both will fail.

The reproducer output is key here. It clearly shows:
```
[  224.240141][ T5901] slab_out_of_memory: 18 callbacks suppressed
[  224.240151][ T5901] SLUB: Unable to allocate memory on CPU 1 (of node 1) on node -1, gfp=0xcc0(GFP_KERNEL)
[  224.245106][ T5901]   cache: rpc_buffers, object size: 2048, buffer size: 2176, default order: 3, min order: 0
[  224.248961][ T5901]   node 0: slabs: 1, objs: 15, free: 0
[  224.251155][ T5901]   node 1: slabs: 0, objs: 0, free: 0
```
This output explicitly states that the `rpc_buffers` cache was empty (`free: 0`) when the failure occurred. This confirms my hypothesis: the page allocator was invoked because the slab cache was exhausted, and *that's* where `fail_page_alloc` intervened.

Therefore, my strategy needs to focus on ensuring `rpc_buffers` is *not* empty when `fail_page_alloc` is active. If I can pre-allocate `rpc_buffers` objects, then `rpc_malloc` should succeed. The most straightforward way to do this is by performing some initial RPC actions, like creating an RPC transport, before enabling the fault injection. This will prime the `rpc_buffers` cache with free objects.

My current thinking is that writing to `portlist` to establish a transport is a good candidate for triggering the necessary `rpc_buffers` allocations. Then, I'll destroy that transport to ensure the objects are available in the slab cache for subsequent use by `rpc_malloc` when `fail_page_alloc` is enabled. I need to re-examine the exact mechanics of `rpc_malloc` to confirm this is the most robust approach.

map[ContextFile:net/sunrpc/sched.c Name:rpc_malloc]

map[SourceCode:1036:	/**
1037:	 * rpc_malloc - allocate RPC buffer resources
1038:	 * @task: RPC task
1039:	 *
1040:	 * A single memory region is allocated, which is split between the
1041:	 * RPC call and RPC reply that this task is being used for. When
1042:	 * this RPC is retired, the memory is released by calling rpc_free.
1043:	 *
1044:	 * To prevent rpciod from hanging, this allocator never sleeps,
1045:	 * returning -ENOMEM and suppressing warning if the request cannot
1046:	 * be serviced immediately. The caller can arrange to sleep in a
1047:	 * way that is safe for rpciod.
1048:	 *
1049:	 * Most requests are 'small' (under 2KiB) and can be serviced from a
1050:	 * mempool, ensuring that NFS reads and writes can always proceed,
1051:	 * and that there is good locality of reference for these buffers.
1052:	 */
1053:	int rpc_malloc(struct rpc_task *task)
1054:	{
1055:		struct rpc_rqst *rqst = task->tk_rqstp;
1056:		size_t size = rqst->rq_callsize + rqst->rq_rcvsize;
1057:		struct rpc_buffer *buf;
1058:		gfp_t gfp = rpc_task_gfp_mask();
1059:	
1060:		size += sizeof(struct rpc_buffer);
1061:		if (size <= RPC_BUFFER_MAXSIZE) {
1062:			buf = kmem_cache_alloc(rpc_buffer_slabp, gfp);
1063:			/* Reach for the mempool if dynamic allocation fails */
1064:			if (!buf && RPC_IS_ASYNC(task))
1065:				buf = mempool_alloc(rpc_buffer_mempool, GFP_NOWAIT);
1066:		} else
1067:			buf = kmalloc(size, gfp);
1068:	
1069:		if (!buf)
1070:			return -ENOMEM;
1071:	
1072:		buf->len = size;
1073:		rqst->rq_buffer = buf->data;
1074:		rqst->rq_rbuffer = (char *)rqst->rq_buffer + rqst->rq_callsize;
1075:		return 0;
1076:	}
 SourceFile:net/sunrpc/sched.c]

gemini-3.1-pro-preview

							input: 122211
							output: 60
							thoughts: 1227
						

**My Thought Process on Reproducing the Bug**

So, I've been digging into this bug, and it seems to hinge on a very specific set of conditions related to memory allocation. The core of the problem, as I understand it, is within the `rpc_malloc` function, which relies on `rpc_buffer_slabp`. My initial thought was, "Okay, if `rpc_buffer_slabp` has free objects, then `kmem_cache_alloc` will definitely work." That seems straightforward enough.

However, then I noticed `percpu_counter_init` makes use of `__alloc_percpu_gfp`. This introduces another layer: if the percpu allocator *itself* has free space, then `__alloc_percpu_gfp` should also succeed.

The critical insight is that the bug *isn't* triggered if both of these allocations succeed. For the bug to manifest, I need a scenario where `__alloc_percpu_gfp` *fails*, but `kmem_cache_alloc(rpc_buffer_slabp)` *succeeds*.

This led me to think about how to manipulate the memory allocators. My first idea was to use BPF to exhaust the percpu memory. The reasoning was that if percpu memory is depleted, `__alloc_percpu_gfp` would naturally fail. And importantly, this BPF allocation for `BPF_MAP_TYPE_PERCPU_ARRAY` doesn't touch `rpc_buffer_slabp` directly. So, even with percpu memory gone, the slab allocator for `rpc_buffer_slabp` should still have plenty of room.

But then I hit a snag when looking at the provided reproducer. It attempts to use BPF to exhaust percpu memory by creating many `BPF_MAP_TYPE_PERCPU_ARRAY` maps in a loop. The problem is, it hits `EMFILE`! This `EMFILE` error means it stops creating BPF maps *before* it can truly exhaust the percpu memory.

Following that, the reproducer enables `fail_page_alloc` by writing to `/proc/self/make-it-fail`. This is where things go wrong for the reproducer's logic. Because `fail_page_alloc` is active, `__alloc_percpu_gfp` *does* fail, as intended. However, `rpc_malloc` *also* fails because `rpc_buffer_slabp` is now empty (or partially depleted by the BPF maps that *did* get created), and it also ends up trying to call the page allocator, which is now being intercepted by `fail_page_alloc`. So, both allocations fail, and the bug isn't triggered.

To fix this, I realized that using `fail_page_alloc` is counterproductive. Instead, the goal should be to *successfully* exhaust the percpu memory using BPF maps, leaving the slab allocator for `rpc_buffer_slabp` untouched and available.

The key challenge then becomes avoiding that `EMFILE` limit. I considered increasing `RLIMIT_NOFILE` with `setrlimit`, but I know that unprivileged users often have limits tied to `fs.nr_open` anyway, so that might not be a foolproof solution.

A better approach emerged when I re-examined how `bpf_array_alloc_percpu` works. It allocates percpu memory for *each entry* within a map in a loop. My initial thought of using a single map with a huge `max_entries` was flawed because if it fails midway, it cleans up everything and returns `-ENOMEM`.

So, the winning strategy, as I see it now, is to iteratively exhaust the percpu memory. I can start by creating many BPF maps with a moderate `max_entries` (say, 100). Each of these maps consumes a portion of the percpu memory. I'll keep creating these until `bpf()` returns `-ENOMEM`. Once that happens, I know I've reached the limit for that map size. Then, I can repeat the process with a smaller `max_entries` (e.g., 10), and then even smaller (e.g., 1), each time until `-ENOMEM` is returned. This fine-grained approach will meticulously deplete the percpu memory.

The beauty of this is that it won't require a massive number of file descriptors. If I estimate the total percpu memory available (say, tens to a hundred MBs) and divide that by the memory used per map (e.g., 3.2MB for 100 entries of 32KB each), I'm looking at maybe 50 maps in total. That's well within the default file descriptor limit. This way, I can ensure `__alloc_percpu_gfp` fails due to memory exhaustion, while `kmem_cache_alloc(rpc_buffer_slabp)` will still succeed because its underlying slab allocator is unaffected. This seems to be the precise condition needed to expose the bug. Now, I just need to implement a function to perform this iterative exhaustion.

map[Question:How to exhaust percpu memory using BPF maps from user space in C? I want to allocate BPF_MAP_TYPE_PERCPU_ARRAY maps until percpu memory is full, without hitting the EMFILE limit.]

map[Answer:To allocate `BPF_MAP_TYPE_PERCPU_ARRAY` maps until kernel percpu dynamic memory is exhausted without hitting the `EMFILE` ("Too many open files") limit, you need to understand both how kernel percpu memory is allocated for BPF maps and how to manage BPF map file descriptor references in user space.

---

### 1. How `BPF_MAP_TYPE_PERCPU_ARRAY` Allocates Percpu Memory

When user space creates a `BPF_MAP_TYPE_PERCPU_ARRAY`:
- **Per-element maximum size:** The kernel enforces a strict upper bound on the value size of percpu map elements: `round_up(value_size, 8) <= PCPU_MIN_UNIT_SIZE` (which is **32 KB** or 32,768 bytes, defined in `kernel/bpf/arraymap.c` and `include/linux/percpu.h`).
- **Percpu allocation mechanism:** For each entry $0 \le i < \text{max\_entries}$, the kernel calls `__alloc_percpu_gfp()`, allocating `round_up(value_size, 8)` bytes **for every online CPU core**.
- **System-wide footprint:**
  $$\text{Total allocated percpu memory} = N_{\text{cpus}} \times \text{max\_entries} \times \text{round\_up}(\text{value\_size}, 8)$$

A single map with `value_size = 32768` and `max_entries = 65536` consumes **2 GB per CPU core** ($16\text{ GB}$ total on an 8-core system).

---

### 2. Why `EMFILE` Occurs and How to Avoid It

`EMFILE` occurs when the process reaches its limit on open file descriptors (`RLIMIT_NOFILE`, default is 1024). Every call to `bpf(BPF_MAP_CREATE, ...)` returns a new FD.

To avoid hitting `EMFILE`, user space can use one or more of the following techniques:

#### Strategy A: High Sizing per Map (Minimizes FD count)
Maximize `value_size` (`32768`) and set `max_entries` large (e.g., `65536` or higher). This exhausts percpu memory with only a tiny fraction of the 1024 open file descriptor limit.

#### Strategy B: Pinning Maps to BPFFS (`bpf_obj_pin`)
1. Create the map (`bpf_map_create`).
2. Pin the map to the BPF filesystem (e.g., `/sys/fs/bpf/percpu_map_N`) using `bpf_obj_pin()`.
3. Call `close(fd)` immediately.
4. The BPFFS entry retains a kernel reference count on the map object so the percpu memory stays allocated, while `close(fd)` releases the file descriptor in user space, completely avoiding `EMFILE`.

#### Strategy C: Outer Map / Map-in-Map (`BPF_MAP_TYPE_ARRAY_OF_MAPS`)
1. Create an outer map of type `BPF_MAP_TYPE_ARRAY_OF_MAPS`.
2. For each created inner percpu map, store its FD into the outer map (`bpf_map_update_elem`).
3. Call `close(inner_fd)`. The outer map maintains kernel references to all inner percpu array maps, keeping their percpu memory allocated while using only 1 open FD for the outer map.

#### Strategy D: Raising `RLIMIT_NOFILE`
Call `setrlimit(RLIMIT_NOFILE, ...)` before creating maps if the process has `CAP_SYS_RESOURCE`.

---

### 3. C Code Example Using Libbpf and BPFFS Pinning

The following C program creates percpu array maps with maximum element size (`32768` bytes), pins them to `/sys/fs/bpf/`, and closes the file descriptors after each creation to avoid `EMFILE`. The loop continues until the kernel returns `-ENOMEM` (indicating percpu allocation failure).

```c
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/resource.h>
#include <bpf/bpf.h>
#include <bpf/libbpf.h>

#define PCPU_MIN_UNIT_SIZE 32768  /* Max value size for percpu maps */
#define MAP_ENTRIES        32768  /* Adjust based on target system memory */
#define PIN_DIR            "/sys/fs/bpf/percpu_fill"

int main(void)
{
    int i = 0;
    int ret;
    char pin_path[256];

    /* Ensure pin directory exists in bpffs */
    mkdir(PIN_DIR, 0700);

    printf("Starting allocation of BPF_MAP_TYPE_PERCPU_ARRAY maps...\n");

    while (1) {
        /* Create map with max entry value size */
        int map_fd = bpf_map_create(BPF_MAP_TYPE_PERCPU_ARRAY,
                                    "fill_percpu",
                                    sizeof(__u32),        /* key_size = 4 */
                                    PCPU_MIN_UNIT_SIZE,   /* value_size = 32KB */
                                    MAP_ENTRIES,
                                    NULL);

        if (map_fd < 0) {
            int err = errno;
            printf("\nMap creation stopped at iteration %d. Error: %s (%d)\n",
                   i, strerror(err), err);
            if (err == ENOMEM) {
                printf("Percpu dynamic memory limit reached (ENOMEM).\n");
            } else if (err == EMFILE) {
                printf("Hit EMFILE limit (increase RLIMIT_NOFILE or use pinning).\n");
            }
            break;
        }

        /* Pin map to BPFFS to hold kernel reference */
        snprintf(pin_path, sizeof(pin_path), "%s/map_%d", PIN_DIR, i);
        ret = bpf_obj_pin(map_fd, pin_path);
        if (ret < 0) {
            perror("bpf_obj_pin failed");
            close(map_fd);
            break;
        }

        /* Close user space FD to prevent hitting EMFILE */
        close(map_fd);

        i++;
        if (i % 10 == 0) {
            printf("Allocated and pinned %d maps (~%lu MB per CPU core allocated)\n",
                   i, (unsigned long)i * MAP_ENTRIES * PCPU_MIN_UNIT_SIZE / (1024 * 1024));
        }
    }

    return 0;
}
```

### Cleanup
To unpin the maps and free the allocated percpu memory:
```bash
rm -rf /sys/fs/bpf/percpu_fill
```]

good-balanced

map[Answer:To allocate `BPF_MAP_TYPE_PERCPU_ARRAY` maps until kernel percpu dynamic memory is exhausted without hitting the `EMFILE` ("Too many open files") limit, you need to understand both how kernel percpu memory is allocated for BPF maps and how to manage BPF map file descriptor references in user space.

---

### 1. How `BPF_MAP_TYPE_PERCPU_ARRAY` Allocates Percpu Memory

When user space creates a `BPF_MAP_TYPE_PERCPU_ARRAY`:
- **Per-element maximum size:** The kernel enforces a strict upper bound on the value size of percpu map elements: `round_up(value_size, 8) <= PCPU_MIN_UNIT_SIZE` (which is **32 KB** or 32,768 bytes, defined in `kernel/bpf/arraymap.c` and `include/linux/percpu.h`).
- **Percpu allocation mechanism:** For each entry $0 \le i < \text{max\_entries}$, the kernel calls `__alloc_percpu_gfp()`, allocating `round_up(value_size, 8)` bytes **for every online CPU core**.
- **System-wide footprint:**
  $$\text{Total allocated percpu memory} = N_{\text{cpus}} \times \text{max\_entries} \times \text{round\_up}(\text{value\_size}, 8)$$

A single map with `value_size = 32768` and `max_entries = 65536` consumes **2 GB per CPU core** ($16\text{ GB}$ total on an 8-core system).

---

### 2. Why `EMFILE` Occurs and How to Avoid It

`EMFILE` occurs when the process reaches its limit on open file descriptors (`RLIMIT_NOFILE`, default is 1024). Every call to `bpf(BPF_MAP_CREATE, ...)` returns a new FD.

To avoid hitting `EMFILE`, user space can use one or more of the following techniques:

#### Strategy A: High Sizing per Map (Minimizes FD count)
Maximize `value_size` (`32768`) and set `max_entries` large (e.g., `65536` or higher). This exhausts percpu memory with only a tiny fraction of the 1024 open file descriptor limit.

#### Strategy B: Pinning Maps to BPFFS (`bpf_obj_pin`)
1. Create the map (`bpf_map_create`).
2. Pin the map to the BPF filesystem (e.g., `/sys/fs/bpf/percpu_map_N`) using `bpf_obj_pin()`.
3. Call `close(fd)` immediately.
4. The BPFFS entry retains a kernel reference count on the map object so the percpu memory stays allocated, while `close(fd)` releases the file descriptor in user space, completely avoiding `EMFILE`.

#### Strategy C: Outer Map / Map-in-Map (`BPF_MAP_TYPE_ARRAY_OF_MAPS`)
1. Create an outer map of type `BPF_MAP_TYPE_ARRAY_OF_MAPS`.
2. For each created inner percpu map, store its FD into the outer map (`bpf_map_update_elem`).
3. Call `close(inner_fd)`. The outer map maintains kernel references to all inner percpu array maps, keeping their percpu memory allocated while using only 1 open FD for the outer map.

#### Strategy D: Raising `RLIMIT_NOFILE`
Call `setrlimit(RLIMIT_NOFILE, ...)` before creating maps if the process has `CAP_SYS_RESOURCE`.

---

### 3. C Code Example Using Libbpf and BPFFS Pinning

The following C program creates percpu array maps with maximum element size (`32768` bytes), pins them to `/sys/fs/bpf/`, and closes the file descriptors after each creation to avoid `EMFILE`. The loop continues until the kernel returns `-ENOMEM` (indicating percpu allocation failure).

```c
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/resource.h>
#include <bpf/bpf.h>
#include <bpf/libbpf.h>

#define PCPU_MIN_UNIT_SIZE 32768  /* Max value size for percpu maps */
#define MAP_ENTRIES        32768  /* Adjust based on target system memory */
#define PIN_DIR            "/sys/fs/bpf/percpu_fill"

int main(void)
{
    int i = 0;
    int ret;
    char pin_path[256];

    /* Ensure pin directory exists in bpffs */
    mkdir(PIN_DIR, 0700);

    printf("Starting allocation of BPF_MAP_TYPE_PERCPU_ARRAY maps...\n");

    while (1) {
        /* Create map with max entry value size */
        int map_fd = bpf_map_create(BPF_MAP_TYPE_PERCPU_ARRAY,
                                    "fill_percpu",
                                    sizeof(__u32),        /* key_size = 4 */
                                    PCPU_MIN_UNIT_SIZE,   /* value_size = 32KB */
                                    MAP_ENTRIES,
                                    NULL);

        if (map_fd < 0) {
            int err = errno;
            printf("\nMap creation stopped at iteration %d. Error: %s (%d)\n",
                   i, strerror(err), err);
            if (err == ENOMEM) {
                printf("Percpu dynamic memory limit reached (ENOMEM).\n");
            } else if (err == EMFILE) {
                printf("Hit EMFILE limit (increase RLIMIT_NOFILE or use pinning).\n");
            }
            break;
        }

        /* Pin map to BPFFS to hold kernel reference */
        snprintf(pin_path, sizeof(pin_path), "%s/map_%d", PIN_DIR, i);
        ret = bpf_obj_pin(map_fd, pin_path);
        if (ret < 0) {
            perror("bpf_obj_pin failed");
            close(map_fd);
            break;
        }

        /* Close user space FD to prevent hitting EMFILE */
        close(map_fd);

        i++;
        if (i % 10 == 0) {
            printf("Allocated and pinned %d maps (~%lu MB per CPU core allocated)\n",
                   i, (unsigned long)i * MAP_ENTRIES * PCPU_MIN_UNIT_SIZE / (1024 * 1024));
        }
    }

    return 0;
}
```

### Cleanup
To unpin the maps and free the allocated percpu memory:
```bash
rm -rf /sys/fs/bpf/percpu_fill
```]

You are a capable Linux kernel developer tasked with researching complex questions
about kernel source code. You will be given a concrete question, and need to provide
a concrete answer.
Use tools extensively while researching the question. Don't make assumptions,
or rely on your previous knowledge about the kernel source code, use available tools
to access the actual source code.
Use all available sources of information:
 - kernel source code
 - documentation in the Documentation dir in the source tree

Do not guess file names or file paths and attempt to read them without
verifying their existence first using content search or directory listing tools.
If a file, symbol, or directory is not found via content search (grepper) or
directory listing (codesearch-dir-index), treat it as completely absent.
Do not attempt to guess alternative names, extensions, or directories.

Tool Selection Guidelines:
1. For C functions, structs, and variables: Prefer codesearch-definition-source
   or codesearch-struct-layout FIRST to retrieve clean, exact definitions
   without line-number guessing.
2. If symbol lookup fails (e.g., preprocessor macros, macro-generated code, or
   disabled #ifdef branches), fall back to read-file or grepper.
3. For file headers, #include directives, preprocessor macro definitions, and
   non-C files (Kconfig, Makefiles, docs): Use read-file or grepper directly.

Prefer calling several tools at the same time to save round-trips.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

How to exhaust percpu memory using BPF maps from user space in C? I want to allocate BPF_MAP_TYPE_PERCPU_ARRAY maps until percpu memory is full, without hitting the EMFILE limit.

gemini-3.6-flash

							input: 2265
							output: 19
							thoughts: 485
						

**My Thought Process on Exhausting Per-CPU Memory with BPF Maps**

So, the core of your question is about how to *fill up* the per-CPU memory in the kernel using BPF maps, specifically `BPF_MAP_TYPE_PERCPU_ARRAY`, from user space in C, all while ensuring we don't run into that pesky `EMFILE` error – the one that signifies we've hit the per-process limit on open file descriptors.

My immediate thought is: "Okay, this is a bit of a puzzle. Creating *many* BPF map file descriptors (FDs) will absolutely hit `EMFILE`. So, the strategy can't be about creating thousands of individual maps."

This brings me to the real meat of the problem: how can a single `BPF_MAP_TYPE_PERCPU_ARRAY` map, or perhaps a small number of them, consume a significant chunk of per-CPU memory? I'm wondering about the parameters we can control when creating these maps. Can we set `max_entries` to an astronomically high number? Can the `value_size` be made so large that even a moderate number of entries in a single map exhausts the available per-CPU memory? This seems like a more plausible path than just opening countless FDs.

I'm also considering the lifecycle of BPF map FDs. Is there a way to "release" or "close" FDs once the map is established, perhaps by pinning it? Or are there advanced techniques like "map-in-map" or other BPF object management primitives (`BPF_OBJ_PIN`) that could help manage the FDs more efficiently? I need to investigate if the kernel's BPF subsystem has any specific mechanisms to avoid `EMFILE` in this context, or if it's purely a matter of judiciously sizing a single map.

Ultimately, to really answer this, I need to dive into the kernel source code. I need to understand precisely how `BPF_MAP_TYPE_PERCPU_ARRAY` is allocated, what the actual limits are on `value_size` and `max_entries`, and critically, how the kernel accounts for and manages per-CPU memory allocations in general. I suspect tools like `grepper` or internal kernel code search will be my best friends here, focusing on functions like `array_map_alloc` and the broader BPF map size limit checks within the kernel. This is where the real constraints and possibilities lie.

map[Expression:array_map_alloc]

map[Output:include/linux/bpf.h=3094=struct bpf_prog *bpf_prog_get_type_path(const char *name, enum bpf_prog_type type);
include/linux/bpf.h:3095:int array_map_alloc_check(union bpf_attr *attr);
include/linux/bpf.h-3096-
--
kernel/bpf/arraymap.c=33=static int bpf_array_alloc_percpu(struct bpf_array *array)
--
kernel/bpf/arraymap.c-52-/* Called from syscall */
kernel/bpf/arraymap.c:53:int array_map_alloc_check(union bpf_attr *attr)
kernel/bpf/arraymap.c-54-{
--
kernel/bpf/arraymap.c-83-
kernel/bpf/arraymap.c:84:static struct bpf_map *array_map_alloc(union bpf_attr *attr)
kernel/bpf/arraymap.c-85-{
--
kernel/bpf/arraymap.c=801=const struct bpf_map_ops array_map_ops = {
kernel/bpf/arraymap.c-802-	.map_meta_equal = array_map_meta_equal,
kernel/bpf/arraymap.c:803:	.map_alloc_check = array_map_alloc_check,
kernel/bpf/arraymap.c:804:	.map_alloc = array_map_alloc,
kernel/bpf/arraymap.c-805-	.map_free = array_map_free,
--
kernel/bpf/arraymap.c=827=const struct bpf_map_ops percpu_array_map_ops = {
kernel/bpf/arraymap.c-828-	.map_meta_equal = array_map_meta_equal,
kernel/bpf/arraymap.c:829:	.map_alloc_check = array_map_alloc_check,
kernel/bpf/arraymap.c:830:	.map_alloc = array_map_alloc,
kernel/bpf/arraymap.c-831-	.map_free = array_map_free,
--
kernel/bpf/arraymap.c-848-
kernel/bpf/arraymap.c:849:static int fd_array_map_alloc_check(union bpf_attr *attr)
kernel/bpf/arraymap.c-850-{
--
kernel/bpf/arraymap.c-856-		return -EINVAL;
kernel/bpf/arraymap.c:857:	return array_map_alloc_check(attr);
kernel/bpf/arraymap.c-858-}
--
kernel/bpf/arraymap.c=1164=static void prog_array_map_clear(struct bpf_map *map)
--
kernel/bpf/arraymap.c-1171-
kernel/bpf/arraymap.c:1172:static struct bpf_map *prog_array_map_alloc(union bpf_attr *attr)
kernel/bpf/arraymap.c-1173-{
--
kernel/bpf/arraymap.c-1184-
kernel/bpf/arraymap.c:1185:	map = array_map_alloc(attr);
kernel/bpf/arraymap.c-1186-	if (IS_ERR(map)) {
--
kernel/bpf/arraymap.c=1216=const struct bpf_map_ops prog_array_map_ops = {
kernel/bpf/arraymap.c:1217:	.map_alloc_check = fd_array_map_alloc_check,
kernel/bpf/arraymap.c:1218:	.map_alloc = prog_array_map_alloc,
kernel/bpf/arraymap.c-1219-	.map_free = prog_array_map_free,
--
kernel/bpf/arraymap.c=1322=const struct bpf_map_ops perf_event_array_map_ops = {
kernel/bpf/arraymap.c-1323-	.map_meta_equal = bpf_map_meta_equal,
kernel/bpf/arraymap.c:1324:	.map_alloc_check = fd_array_map_alloc_check,
kernel/bpf/arraymap.c:1325:	.map_alloc = array_map_alloc,
kernel/bpf/arraymap.c-1326-	.map_free = perf_event_fd_array_map_free,
--
kernel/bpf/arraymap.c=1358=const struct bpf_map_ops cgroup_array_map_ops = {
kernel/bpf/arraymap.c-1359-	.map_meta_equal = bpf_map_meta_equal,
kernel/bpf/arraymap.c:1360:	.map_alloc_check = fd_array_map_alloc_check,
kernel/bpf/arraymap.c:1361:	.map_alloc = array_map_alloc,
kernel/bpf/arraymap.c-1362-	.map_free = cgroup_fd_array_free,
--
kernel/bpf/arraymap.c=1374=static struct bpf_map *array_of_map_alloc(union bpf_attr *attr)
--
kernel/bpf/arraymap.c-1381-
kernel/bpf/arraymap.c:1382:	map = array_map_alloc(attr);
kernel/bpf/arraymap.c-1383-	if (IS_ERR(map)) {
--
kernel/bpf/arraymap.c=1444=const struct bpf_map_ops array_of_maps_map_ops = {
kernel/bpf/arraymap.c:1445:	.map_alloc_check = fd_array_map_alloc_check,
kernel/bpf/arraymap.c-1446-	.map_alloc = array_of_map_alloc,
--
kernel/bpf/reuseport_array.c=41=static int reuseport_array_alloc_check(union bpf_attr *attr)
--
kernel/bpf/reuseport_array.c-46-
kernel/bpf/reuseport_array.c:47:	return array_map_alloc_check(attr);
kernel/bpf/reuseport_array.c-48-}
]

gemini-3.6-flash

							input: 4409
							output: 37
							thoughts: 42
						

**My Thought Process for Analyzing `arraymap.c`**

Alright, so my immediate instinct is to dive into the kernel's BPF implementation, specifically the `arraymap.c` file. My goal here is to understand how array maps are managed, and that means I need to examine the allocation and checking mechanisms. I'm going to focus on two key functions: `array_map_alloc_check` and `array_map_alloc`.

The `read-file` command is my tool of choice for this kind of exploration. It's efficient for getting the raw source code into my environment, allowing me to then step through it or use my preferred static analysis tools. I'm not just looking for a surface-level understanding; I'm an expert in this domain, so I'm anticipating the nuances. I want to see how the kernel handles potential issues during map creation – things like size constraints, memory pressure, and perhaps even security considerations if they're relevant to allocation.

Specifically, when I look at `array_map_alloc_check`, I'm expecting to find validation logic. This is where the kernel should be enforcing limits on the size of the array map, ensuring it doesn't exceed reasonable bounds or invite denial-of-service vulnerabilities. I'll be scrutinizing the parameters it takes and the conditions it checks.

Then, `array_map_alloc` is where the actual memory allocation happens. I'll be looking for the underlying kernel memory allocation functions being used (likely `kmalloc` or similar) and how they're being invoked. Critically, I'll want to see how errors from the allocation itself are handled, and how the results of `array_map_alloc_check` are integrated into this process. Is there a clear separation of concerns, or is the checking tightly coupled with the allocation?

My expertise tells me that the devil is in the details. I'm not just reading the code; I'm mentally simulating execution paths, considering edge cases, and thinking about the broader implications for BPF program stability and performance. This isn't just about a single function; it's about understanding a fundamental building block of the BPF subsystem.

map[File:kernel/bpf/arraymap.c FirstLine:30 LineCount:100]

map[Contents:  30:		}
  31:	}
  32:	
  33:	static int bpf_array_alloc_percpu(struct bpf_array *array)
  34:	{
  35:		void __percpu *ptr;
  36:		int i;
  37:	
  38:		for (i = 0; i < array->map.max_entries; i++) {
  39:			ptr = bpf_map_alloc_percpu(&array->map, array->elem_size, 8,
  40:						   GFP_USER | __GFP_NOWARN);
  41:			if (!ptr) {
  42:				bpf_array_free_percpu(array);
  43:				return -ENOMEM;
  44:			}
  45:			array->pptrs[i] = ptr;
  46:			cond_resched();
  47:		}
  48:	
  49:		return 0;
  50:	}
  51:	
  52:	/* Called from syscall */
  53:	int array_map_alloc_check(union bpf_attr *attr)
  54:	{
  55:		bool percpu = attr->map_type == BPF_MAP_TYPE_PERCPU_ARRAY;
  56:		int numa_node = bpf_map_attr_numa_node(attr);
  57:	
  58:		/* check sanity of attributes */
  59:		if (attr->max_entries == 0 || attr->key_size != 4 ||
  60:		    attr->value_size == 0 ||
  61:		    attr->map_flags & ~ARRAY_CREATE_FLAG_MASK ||
  62:		    !bpf_map_flags_access_ok(attr->map_flags) ||
  63:		    (percpu && numa_node != NUMA_NO_NODE))
  64:			return -EINVAL;
  65:	
  66:		if (attr->map_type != BPF_MAP_TYPE_ARRAY &&
  67:		    attr->map_flags & (BPF_F_MMAPABLE | BPF_F_INNER_MAP))
  68:			return -EINVAL;
  69:	
  70:		if (attr->map_type != BPF_MAP_TYPE_PERF_EVENT_ARRAY &&
  71:		    attr->map_flags & BPF_F_PRESERVE_ELEMS)
  72:			return -EINVAL;
  73:	
  74:		/* avoid overflow on round_up(map->value_size) */
  75:		if (attr->value_size > INT_MAX)
  76:			return -E2BIG;
  77:		/* percpu map value size is bound by PCPU_MIN_UNIT_SIZE */
  78:		if (percpu && round_up(attr->value_size, 8) > PCPU_MIN_UNIT_SIZE)
  79:			return -E2BIG;
  80:	
  81:		return 0;
  82:	}
  83:	
  84:	static struct bpf_map *array_map_alloc(union bpf_attr *attr)
  85:	{
  86:		bool percpu = attr->map_type == BPF_MAP_TYPE_PERCPU_ARRAY;
  87:		int numa_node = bpf_map_attr_numa_node(attr);
  88:		u32 elem_size, index_mask, max_entries;
  89:		bool bypass_spec_v1 = bpf_bypass_spec_v1(NULL);
  90:		u64 array_size, mask64;
  91:		struct bpf_array *array;
  92:	
  93:		elem_size = round_up(attr->value_size, 8);
  94:	
  95:		max_entries = attr->max_entries;
  96:	
  97:		/* On 32 bit archs roundup_pow_of_two() with max_entries that has
  98:		 * upper most bit set in u32 space is undefined behavior due to
  99:		 * resulting 1U << 32, so do it manually here in u64 space.
 100:		 */
 101:		mask64 = fls_long(max_entries - 1);
 102:		mask64 = 1ULL << mask64;
 103:		mask64 -= 1;
 104:	
 105:		index_mask = mask64;
 106:		if (!bypass_spec_v1) {
 107:			/* round up array size to nearest power of 2,
 108:			 * since cpu will speculate within index_mask limits
 109:			 */
 110:			max_entries = index_mask + 1;
 111:			/* Check for overflows. */
 112:			if (max_entries < attr->max_entries)
 113:				return ERR_PTR(-E2BIG);
 114:		}
 115:	
 116:		array_size = sizeof(*array);
 117:		if (percpu) {
 118:			array_size += (u64) max_entries * sizeof(void *);
 119:		} else {
 120:			/* rely on vmalloc() to return page-aligned memory and
 121:			 * ensure array->value is exactly page-aligned
 122:			 */
 123:			if (attr->map_flags & BPF_F_MMAPABLE) {
 124:				array_size = PAGE_ALIGN(array_size);
 125:				array_size += PAGE_ALIGN((u64) max_entries * elem_size);
 126:			} else {
 127:				array_size += (u64) max_entries * elem_size;
 128:			}
 129:		}
]

gemini-3.6-flash

							input: 6038
							output: 22
							thoughts: 936
						

**My Thought Process on Exhausting BPF Per-CPU Memory Without Hitting File Descriptor Limits**

My primary goal is to understand how to fill up the per-CPU memory allocated by BPF maps, specifically using `BPF_MAP_TYPE_PERCPU_ARRAY`, from user-space C code, without running into the `EMFILE` (too many open files) error.

First, I need to break down the problem into its core components:
*   **BPF Map Creation and Referencing:** How are BPF maps actually brought into existence from user space, and what mechanisms does the kernel use to track them?
*   **The `EMFILE` Limit:** What is this `EMFILE` error, and why does it occur in the context of creating BPF maps?
*   **BPF Per-CPU Allocation:** How does BPF handle per-CPU memory allocation for maps, and what are its specific characteristics?
*   **User-Space Allocation Strategy:** What techniques can I employ in user space to repeatedly create and manage per-CPU maps in a way that avoids the `EMFILE` limit?

Let's tackle `EMFILE` first. When user space calls `bpf(BPF_MAP_CREATE, ...)` – whether directly or via libraries like libbpf – the kernel creates a BPF map object. Crucially, it also associates an open File Descriptor (FD) with this map in the calling process's FD table. If I were to simply loop and call `BPF_MAP_CREATE` repeatedly, holding onto each FD, I would inevitably exhaust the process's file descriptor limit, which is typically a low default like 1024 (`RLIMIT_NOFILE`). This is the `EMFILE` scenario.

So, how can I circumvent this `EMFILE` limitation while still creating maps? I'm considering several possibilities:

1.  **Increasing the `RLIMIT_NOFILE` Limit:** This is the most straightforward approach. I could use `setrlimit(RLIMIT_NOFILE, ...)` to raise the limit. However, this feels like a temporary fix. Per-CPU memory exhaustion might require thousands of map allocations if each map is small, and even an increased limit is finite. This might not be the robust solution I'm looking for.

2.  **BPFFS Pinning and FD Closure:** I recall that BPF maps can be "pinned" to a BPF filesystem (like `/sys/fs/bpf`). The `bpf(BPF_OBJ_PIN, ...)` syscall, or `bpf_obj_pin()` in libbpf, allows me to associate a map with a specific path in this filesystem. The key insight here is that once a map is pinned, the kernel maintains a reference to the map object through the BPFFS reference count. This means I can then safely `close(fd)` the file descriptor returned by `BPF_MAP_CREATE`. Closing the FD releases it from my process's table, preventing `EMFILE`, while the map itself and its allocated per-CPU memory remain resident in the kernel. This seems promising.

3.  **Map-in-Map (Hierarchical Maps):** I'm also thinking about using `BPF_MAP_TYPE_ARRAY_OF_MAPS`. If I create an outer map of this type, and then as "values" within this outer map, I store FDs of inner maps (which could be `BPF_MAP_TYPE_PERCPU_ARRAY`), the outer map will hold references to these inner maps (via `bpf_map_inc`). Similar to the pinning approach, this allows me to close the FDs of the inner maps in user space, thereby conserving file descriptors, while the inner maps and their per-CPU memory remain active in the kernel.

4.  **Maximizing Allocation Per Map:** Another angle is to consider the `value_size` parameter when creating the `BPF_MAP_TYPE_PERCPU_ARRAY`. If I can make each map as large as possible in terms of per-CPU memory it consumes, I'll naturally need fewer maps and thus fewer FDs. I need to investigate the limits on `value_size` for per-CPU arrays. I remember seeing constraints related to `PCPU_MIN_UNIT_SIZE` or a hardcoded maximum like 32KB. If I can push this limit, I might need significantly fewer `BPF_MAP_CREATE` calls in the first place.

I'm leaning towards a combination of these techniques. The pinning and map-in-map strategies seem like the most elegant ways to decouple FD management from map object lifetime, thus directly addressing the `EMFILE` issue. I might also explore maximizing `value_size` to reduce the sheer number of allocations needed.

I should also verify if this is a common pattern or if there are any known caveats. I'll be looking into kernel source code, existing BPF examples, and community discussions related to per-CPU memory management, pinning, and map size limits for `BPF_MAP_TYPE_PERCPU_ARRAY`.

Specifically, I need to find the exact definition and behavior of `PCPU_MIN_UNIT_SIZE` in the kernel's BPF map allocation code, likely within functions like `array_map_alloc_check`, to understand the per-map per-CPU memory constraints.

map[Expression:PCPU_MIN_UNIT_SIZE]

map[Output:Documentation/bpf/map_array.rst=18=stored can be of any size for ``BPF_MAP_TYPE_ARRAY`` and not more than
Documentation/bpf/map_array.rst:19:``PCPU_MIN_UNIT_SIZE`` (32 kB) for ``BPF_MAP_TYPE_PERCPU_ARRAY``. All
Documentation/bpf/map_array.rst-20-array elements are aligned to 8 bytes.
--
drivers/net/ethernet/chelsio/libcxgb/libcxgb_ppm.c=346=ppm_alloc_cpu_pool(unsigned int *total, unsigned int *pcpu_ppmax)
--
drivers/net/ethernet/chelsio/libcxgb/libcxgb_ppm.c-349-	unsigned int ppmax = (*total) / num_possible_cpus();
drivers/net/ethernet/chelsio/libcxgb/libcxgb_ppm.c:350:	unsigned int max = (PCPU_MIN_UNIT_SIZE - sizeof(*pools)) << 3;
drivers/net/ethernet/chelsio/libcxgb/libcxgb_ppm.c-351-	unsigned int bmap;
--
drivers/net/ethernet/chelsio/libcxgb/libcxgb_ppm.c-355-
drivers/net/ethernet/chelsio/libcxgb/libcxgb_ppm.c:356:	/* make sure per cpu pool fits into PCPU_MIN_UNIT_SIZE */
drivers/net/ethernet/chelsio/libcxgb/libcxgb_ppm.c-357-	if (ppmax > max)
--
drivers/scsi/libfc/fc_exch.c=2462=struct fc_exch_mgr *fc_exch_mgr_alloc(struct fc_lport *lport,
--
drivers/scsi/libfc/fc_exch.c-2491-
drivers/scsi/libfc/fc_exch.c:2492:       /* reduce range so per cpu pool fits into PCPU_MIN_UNIT_SIZE pool */
drivers/scsi/libfc/fc_exch.c:2493:	pool_exch_range = (PCPU_MIN_UNIT_SIZE - sizeof(*pool)) /
drivers/scsi/libfc/fc_exch.c-2494-		sizeof(struct fc_exch *);
--
include/linux/percpu.h-24-/* minimum unit size, also is the maximum supported allocation size */
include/linux/percpu.h:25:#define PCPU_MIN_UNIT_SIZE		PFN_ALIGN(32 << 10)
include/linux/percpu.h-26-
--
kernel/bpf/arraymap.c=53=int array_map_alloc_check(union bpf_attr *attr)
--
kernel/bpf/arraymap.c-76-		return -E2BIG;
kernel/bpf/arraymap.c:77:	/* percpu map value size is bound by PCPU_MIN_UNIT_SIZE */
kernel/bpf/arraymap.c:78:	if (percpu && round_up(attr->value_size, 8) > PCPU_MIN_UNIT_SIZE)
kernel/bpf/arraymap.c-79-		return -E2BIG;
--
kernel/bpf/hashtab.c=412=static int htab_map_alloc_check(union bpf_attr *attr)
--
kernel/bpf/hashtab.c-462-		return -E2BIG;
kernel/bpf/hashtab.c:463:	/* percpu map value size is bound by PCPU_MIN_UNIT_SIZE */
kernel/bpf/hashtab.c:464:	if (percpu && round_up(attr->value_size, 8) > PCPU_MIN_UNIT_SIZE)
kernel/bpf/hashtab.c-465-		return -E2BIG;
--
kernel/bpf/local_storage.c=296=static struct bpf_map *cgroup_storage_map_alloc(union bpf_attr *attr)
--
kernel/bpf/local_storage.c-301-
kernel/bpf/local_storage.c:302:	/* percpu is bound by PCPU_MIN_UNIT_SIZE, non-percu
kernel/bpf/local_storage.c-303-	 * is the same as other local storages.
--
kernel/bpf/local_storage.c-306-		max_value_size = min_t(__u32, max_value_size,
kernel/bpf/local_storage.c:307:				       PCPU_MIN_UNIT_SIZE);
kernel/bpf/local_storage.c-308-
--
mm/percpu.c=1736=void __percpu *pcpu_alloc_noprof(size_t size, size_t align, bool reserved,
--
mm/percpu.c-1769-
mm/percpu.c:1770:	if (unlikely(!size || size > PCPU_MIN_UNIT_SIZE || align > PAGE_SIZE ||
mm/percpu.c-1771-		     !is_power_of_2(align))) {
--
mm/percpu.c=2564=void __init pcpu_setup_first_chunk(const struct pcpu_alloc_info *ai,
--
mm/percpu.c-2597-	PCPU_SETUP_BUG_ON(offset_in_page(ai->unit_size));
mm/percpu.c:2598:	PCPU_SETUP_BUG_ON(ai->unit_size < PCPU_MIN_UNIT_SIZE);
mm/percpu.c-2599-	PCPU_SETUP_BUG_ON(!IS_ALIGNED(ai->unit_size, PCPU_BITMAP_BLOCK_SIZE));
--
mm/percpu.c=2805=static struct pcpu_alloc_info * __init __flatten pcpu_build_alloc_info(
--
mm/percpu.c-2837-	 */
mm/percpu.c:2838:	min_unit_size = max_t(size_t, size_sum, PCPU_MIN_UNIT_SIZE);
mm/percpu.c-2839-
--
mm/percpu.c=3334=void __init setup_per_cpu_areas(void)
--
mm/percpu.c-3336-	const size_t unit_size =
mm/percpu.c:3337:		roundup_pow_of_two(max_t(size_t, PCPU_MIN_UNIT_SIZE,
mm/percpu.c-3338-					 PERCPU_DYNAMIC_RESERVE));
--
net/openvswitch/datapath.c=2103=static const struct nla_policy datapath_policy[OVS_DP_ATTR_MAX + 1] = {
--
net/openvswitch/datapath.c-2107-	[OVS_DP_ATTR_MASKS_CACHE_SIZE] =  NLA_POLICY_RANGE(NLA_U32, 0,
net/openvswitch/datapath.c:2108:		PCPU_MIN_UNIT_SIZE / sizeof(struct mask_cache_entry)),
net/openvswitch/datapath.c-2109-	[OVS_DP_ATTR_IFINDEX] = NLA_POLICY_MIN(NLA_S32, 0),
--
net/openvswitch/flow_table.c=357=static struct mask_cache *tbl_mask_cache_alloc(u32 size)
--
net/openvswitch/flow_table.c-365-	if ((!is_power_of_2(size) && size != 0) ||
net/openvswitch/flow_table.c:366:	    (size * sizeof(struct mask_cache_entry)) > PCPU_MIN_UNIT_SIZE)
net/openvswitch/flow_table.c-367-		return NULL;
--
net/openvswitch/flow_table.c=387=int ovs_flow_tbl_masks_cache_resize(struct flow_table *table, u32 size)
--
net/openvswitch/flow_table.c-395-	if ((!is_power_of_2(size) && size != 0) ||
net/openvswitch/flow_table.c:396:	    (size * sizeof(struct mask_cache_entry)) > PCPU_MIN_UNIT_SIZE)
net/openvswitch/flow_table.c-397-		return -EINVAL;
--
tools/testing/selftests/bpf/map_tests/map_percpu_stats.c-19-#define MAX_MAP_KEY_SIZE		4
tools/testing/selftests/bpf/map_tests/map_percpu_stats.c:20:#define PCPU_MIN_UNIT_SIZE		32768
tools/testing/selftests/bpf/map_tests/map_percpu_stats.c-21-
--
tools/testing/selftests/bpf/map_tests/map_percpu_stats.c=460=static void map_percpu_stats_map_value_size(void)
--
tools/testing/selftests/bpf/map_tests/map_percpu_stats.c-462-	int fd;
tools/testing/selftests/bpf/map_tests/map_percpu_stats.c:463:	int value_sz = PCPU_MIN_UNIT_SIZE + 1;
tools/testing/selftests/bpf/map_tests/map_percpu_stats.c-464-	struct bpf_map_create_opts opts = { .sz = sizeof(opts) };
--
tools/testing/selftests/bpf/netcnt_common.h-20-
tools/testing/selftests/bpf/netcnt_common.h:21:#define PCPU_MIN_UNIT_SIZE			32768
tools/testing/selftests/bpf/netcnt_common.h-22-
tools/testing/selftests/bpf/netcnt_common.h=23=union percpu_net_cnt {
--
tools/testing/selftests/bpf/netcnt_common.h-32-	};
tools/testing/selftests/bpf/netcnt_common.h:33:	__u8 data[PCPU_MIN_UNIT_SIZE];
tools/testing/selftests/bpf/netcnt_common.h-34-};
]

gemini-3.6-flash

							input: 9631
							output: 23
							thoughts: 97
						

**My Thought Process on Per-CPU BPF Array Allocation**

Okay, so my immediate goal is to get a really firm grasp on how the `BPF_MAP_TYPE_PERCPU_ARRAY` type of BPF map gets its per-CPU memory allocated. I know the core function for this is `bpf_array_alloc_percpu` located in `kernel/bpf/arraymap.c`. My initial step is to dive back into the source code for `bpf_array_alloc_percpu` and also examine its caller, `bpf_map_alloc_percpu`, to see how they interact and what parameters are passed. Then, to ensure I haven't missed any nuances, I'm going to perform a broader search across the entire kernel source for any other instances or usages of `bpf_map_alloc_percpu`. This comprehensive approach should illuminate the entire allocation path and any potential edge cases or alternative allocation strategies.

map[Expression:bpf_map_alloc_percpu]

map[Output:include/linux/bpf.h=2792=void *bpf_map_kvcalloc(struct bpf_map *map, size_t n, size_t size,
include/linux/bpf.h-2793-		       gfp_t flags);
include/linux/bpf.h:2794:void __percpu *bpf_map_alloc_percpu(const struct bpf_map *map, size_t size,
include/linux/bpf.h-2795-				    size_t align, gfp_t flags);
--
include/linux/bpf.h-2808-		kvcalloc(_n, _size, _flags)
include/linux/bpf.h:2809:#define bpf_map_alloc_percpu(_map, _size, _align, _flags)	\
include/linux/bpf.h-2810-		__alloc_percpu_gfp(_size, _align, _flags)
--
include/linux/bpf.h=2825=bpf_map_init_elem_count(struct bpf_map *map)
--
include/linux/bpf.h-2829-
include/linux/bpf.h:2830:	map->elem_count = bpf_map_alloc_percpu(map, size, align, flags);
include/linux/bpf.h-2831-	if (!map->elem_count)
--
kernel/bpf/arraymap.c=33=static int bpf_array_alloc_percpu(struct bpf_array *array)
--
kernel/bpf/arraymap.c-38-	for (i = 0; i < array->map.max_entries; i++) {
kernel/bpf/arraymap.c:39:		ptr = bpf_map_alloc_percpu(&array->map, array->elem_size, 8,
kernel/bpf/arraymap.c-40-					   GFP_USER | __GFP_NOWARN);
--
kernel/bpf/cpumap.c=435=__cpu_map_entry_alloc(struct bpf_map *map, struct bpf_cpumap_val *value,
--
kernel/bpf/cpumap.c-450-	/* Alloc percpu bulkq */
kernel/bpf/cpumap.c:451:	rcpu->bulkq = bpf_map_alloc_percpu(map, sizeof(*rcpu->bulkq),
kernel/bpf/cpumap.c-452-					   sizeof(void *), gfp);
--
kernel/bpf/hashtab.c=319=static int prealloc_init(struct bpf_htab *htab)
--
kernel/bpf/hashtab.c-338-
kernel/bpf/hashtab.c:339:		pptr = bpf_map_alloc_percpu(&htab->map, size, 8,
kernel/bpf/hashtab.c-340-					    GFP_USER | __GFP_NOWARN);
--
kernel/bpf/hashtab.c=388=static int alloc_extra_elems(struct bpf_htab *htab)
--
kernel/bpf/hashtab.c-393-
kernel/bpf/hashtab.c:394:	pptr = bpf_map_alloc_percpu(&htab->map, sizeof(struct htab_elem *), 8,
kernel/bpf/hashtab.c-395-				    GFP_USER | __GFP_NOWARN);
--
kernel/bpf/local_storage.c=503=struct bpf_cgroup_storage *bpf_cgroup_storage_alloc(struct bpf_prog *prog,
--
kernel/bpf/local_storage.c-529-	} else {
kernel/bpf/local_storage.c:530:		storage->percpu_buf = bpf_map_alloc_percpu(map, size, 8, gfp);
kernel/bpf/local_storage.c-531-		if (!storage->percpu_buf)
--
kernel/bpf/syscall.c=564=void *bpf_map_kvcalloc(struct bpf_map *map, size_t n, size_t size,
--
kernel/bpf/syscall.c-576-
kernel/bpf/syscall.c:577:void __percpu *bpf_map_alloc_percpu(const struct bpf_map *map, size_t size,
kernel/bpf/syscall.c-578-				    size_t align, gfp_t flags)
]

gemini-3.6-flash

							input: 10895
							output: 36
							thoughts: 45
						

**My Thought Process on Exploring `bpf_map_alloc_percpu`**

Alright, the first thing that comes to mind is that I need to get a solid understanding of what `bpf_map_alloc_percpu` is actually *doing*. Given my expertise, I know that documentation can sometimes lag or be incomplete, so the most reliable path is to go straight to the source code. My instinct is to look at the implementation, and the specific function name points me directly to `kernel/bpf/syscall.c`.

I'm not just going to eyeball it, though. I need to see the context, the surrounding code, and how it's called. This is where a tool like `read-file` becomes invaluable. It allows me to quickly and efficiently pull up the relevant section of the kernel source tree. I'll be navigating to `kernel/bpf/syscall.c` and then I'll be looking specifically around line 577, as that's where the function is likely defined or at least where its immediate usage might be evident. This will give me a concrete starting point to dissect the function's behavior, its parameters, its return values, and any side effects it might have. It's about getting my hands dirty with the actual code, which is always the most definitive way to understand something at this level.

map[File:kernel/bpf/syscall.c FirstLine:560 LineCount:40]

map[Contents: 560:	
 561:		return ptr;
 562:	}
 563:	
 564:	void *bpf_map_kvcalloc(struct bpf_map *map, size_t n, size_t size,
 565:			       gfp_t flags)
 566:	{
 567:		struct mem_cgroup *memcg, *old_memcg;
 568:		void *ptr;
 569:	
 570:		bpf_map_memcg_enter(map, &old_memcg, &memcg);
 571:		ptr = kvcalloc(n, size, flags | __GFP_ACCOUNT);
 572:		bpf_map_memcg_exit(old_memcg, memcg);
 573:	
 574:		return ptr;
 575:	}
 576:	
 577:	void __percpu *bpf_map_alloc_percpu(const struct bpf_map *map, size_t size,
 578:					    size_t align, gfp_t flags)
 579:	{
 580:		struct mem_cgroup *memcg, *old_memcg;
 581:		void __percpu *ptr;
 582:	
 583:		bpf_map_memcg_enter(map, &old_memcg, &memcg);
 584:		ptr = __alloc_percpu_gfp(size, align, flags | __GFP_ACCOUNT);
 585:		bpf_map_memcg_exit(old_memcg, memcg);
 586:	
 587:		return ptr;
 588:	}
 589:	
 590:	#else
 591:	static void bpf_map_save_memcg(struct bpf_map *map)
 592:	{
 593:	}
 594:	
 595:	static void bpf_map_release_memcg(struct bpf_map *map)
 596:	{
 597:	}
 598:	#endif
 599:	
]

gemini-3.6-flash

							input: 11552
							output: 32
							thoughts: 1951
						

**Understanding the Depths of PerCPU Memory Exhaustion with BPF Maps**

My goal here is to achieve a rather ambitious feat: to push the boundaries of per-CPU memory allocation within the Linux kernel using BPF maps, specifically `BPF_MAP_TYPE_PERCPU_ARRAY`s. The core challenge isn't just about allocating memory; it's about *exhausting* the available per-CPU dynamic memory space, all while deftly sidestepping the common `EMFILE` error that typically arises when we try to create too many file descriptors. This requires a deep understanding of BPF's memory management and file descriptor handling mechanisms.

First, I need to understand precisely how `BPF_MAP_TYPE_PERCPU_ARRAY` operates. When I create such a map, the kernel, in `kernel/bpf/arraymap.c`, enforces certain constraints: the `value_size` for each entry must be positive and, crucially, rounded up to the nearest 8 bytes, it cannot exceed `PCPU_MIN_UNIT_SIZE`, which is 32 kilobytes. The `key_size` must be a 4-byte unsigned integer. The `max_entries` parameter defines how many such per-CPU elements will be allocated for this map.

The allocation mechanism itself is quite impactful. For every single entry in the map, the kernel invokes `__alloc_percpu_gfp()`, allocating memory that is private to each CPU. This means the total per-CPU memory consumed by a single map is the product of `max_entries` and the rounded-up `value_size`. Consequently, the total per-CPU memory footprint across the entire system becomes the sum of these per-map allocations multiplied by the number of online CPU cores. This is where the potential for exhaustion lies. A single map with a `value_size` of 32KB and, say, 65,536 entries would consume an astounding 2 gigabytes of per-CPU memory *per core*. On a multi-core system, this can quickly scale into tens of gigabytes.

The `EMFILE` error is a signal that my process has hit its limit for open file descriptors, typically a soft limit of 1024. Each time I call the `bpf(BPF_MAP_CREATE, ...)` syscall to create a map, a file descriptor is returned. If I'm creating a vast number of maps in a loop and holding onto all these file descriptors, this limit will be reached.

To circumvent `EMFILE` while still creating and maintaining a large number of per-CPU memory allocations, I've identified several key strategies.

One of the most robust approaches involves leveraging the BPF filesystem (`bpffs`). When I create a BPF map, I can then "pin" it to a specific location within `bpffs` using the `bpf_obj_pin()` syscall. This pinning action increments the kernel's reference count for the map object. After pinning, I can safely `close()` the file descriptor associated with that map. The file descriptor slot in my process table is freed, preventing the `EMFILE` error, but the map itself, and its significant per-CPU memory allocations, remain resident in kernel memory because the `bpffs` entry maintains a reference.

Another elegant technique is to use "map-in-map" structures, specifically `BPF_MAP_TYPE_ARRAY_OF_MAPS`. I can create a single outer map, which itself requires only one file descriptor (or can also be pinned and its FD closed). Then, for each per-CPU array map I wish to create, I allocate it and store its file descriptor as an element within this outer map using `bpf_map_update_elem()`. This update operation increases the reference count on the inner, per-CPU map. Once the inner map's FD is stored in the outer map, I can again `close()` the inner map's FD without losing access to its underlying per-CPU memory allocations. This drastically reduces the number of open FDs I need to manage at any given time.

Alternatively, though less efficient if I truly intend to exhaust memory by creating many *distinct* maps, I can simply increase the `RLIMIT_NOFILE` soft limit using `setrlimit()`. If I have sufficient privileges (usually root or `CAP_SYS_RESOURCE`), I can raise this limit to a very high value, allowing me to open tens or hundreds of thousands of file descriptors, thereby creating many individual maps before hitting the per-process limit.

Finally, to maximize the amount of per-CPU memory consumed with the *fewest* number of map creations, I'll aim to set the `value_size` to its maximum allowed value, 32768 bytes, and pair this with a very large `max_entries`, constrained only by the available per-CPU memory in the system. By tuning these parameters, I can make each map allocation as memory-intensive as possible. The goal is to hit the per-CPU memory allocator's limits (returning `-ENOMEM`) before I encounter `EMFILE`, thus achieving the desired resource exhaustion scenario.

In essence, my plan involves a careful interplay between understanding kernel memory allocation strategies, efficient file descriptor management through techniques like pinning and map-in-map, and strategic parameter tuning for `BPF_MAP_TYPE_PERCPU_ARRAY`s to achieve per-CPU memory exhaustion. This is purely a deep dive into the technicalities of kernel resource management, not an attempt to cause harm.

map[Expression:bpf_map_create PathPrefix:tools/lib/bpf]

map[Output:tools/lib/bpf/bpf.c=185=int bump_rlimit_memlock(void)
--
tools/lib/bpf/bpf.c-205-
tools/lib/bpf/bpf.c:206:int bpf_map_create(enum bpf_map_type map_type,
tools/lib/bpf/bpf.c-207-		   const char *map_name,
--
tools/lib/bpf/bpf.c-210-		   __u32 max_entries,
tools/lib/bpf/bpf.c:211:		   const struct bpf_map_create_opts *opts)
tools/lib/bpf/bpf.c-212-{
--
tools/lib/bpf/bpf.c-223-
tools/lib/bpf/bpf.c:224:	if (!OPTS_VALID(opts, bpf_map_create_opts))
tools/lib/bpf/bpf.c-225-		return libbpf_err(-EINVAL);
--
tools/lib/bpf/bpf.h=40=struct bpf_log_opts {
--
tools/lib/bpf/bpf.h-51-
tools/lib/bpf/bpf.h:52:struct bpf_map_create_opts {
tools/lib/bpf/bpf.h-53-	size_t sz; /* size of this struct for forward/backward compatibility */
--
tools/lib/bpf/bpf.h-76-};
tools/lib/bpf/bpf.h:77:#define bpf_map_create_opts__last_field log_opts
tools/lib/bpf/bpf.h-78-
tools/lib/bpf/bpf.h:79:LIBBPF_API int bpf_map_create(enum bpf_map_type map_type,
tools/lib/bpf/bpf.h-80-			      const char *map_name,
--
tools/lib/bpf/bpf.h-83-			      __u32 max_entries,
tools/lib/bpf/bpf.h:84:			      const struct bpf_map_create_opts *opts);
tools/lib/bpf/bpf.h-85-
--
tools/lib/bpf/bpf_gen_internal.h=61=void bpf_gen__map_create(struct bpf_gen *gen,
--
tools/lib/bpf/bpf_gen_internal.h-63-			 __u32 key_size, __u32 value_size, __u32 max_entries,
tools/lib/bpf/bpf_gen_internal.h:64:			 struct bpf_map_create_opts *map_attr, int map_idx);
tools/lib/bpf/bpf_gen_internal.h-65-void bpf_gen__prog_load(struct bpf_gen *gen,
--
tools/lib/bpf/features.c=47=static int probe_kern_global_data(int token_fd)
--
tools/lib/bpf/features.c-54-	};
tools/lib/bpf/features.c:55:	LIBBPF_OPTS(bpf_map_create_opts, map_opts,
tools/lib/bpf/features.c-56-		.token_fd = token_fd,
--
tools/lib/bpf/features.c-64-
tools/lib/bpf/features.c:65:	map = bpf_map_create(BPF_MAP_TYPE_ARRAY, "libbpf_global", sizeof(int), 32, 1, &map_opts);
tools/lib/bpf/features.c-66-	if (map < 0) {
--
tools/lib/bpf/features.c=211=static int probe_kern_array_mmap(int token_fd)
tools/lib/bpf/features.c-212-{
tools/lib/bpf/features.c:213:	LIBBPF_OPTS(bpf_map_create_opts, opts,
tools/lib/bpf/features.c-214-		.map_flags = BPF_F_MMAPABLE | (token_fd ? BPF_F_TOKEN_FD : 0),
--
tools/lib/bpf/features.c-218-
tools/lib/bpf/features.c:219:	fd = bpf_map_create(BPF_MAP_TYPE_ARRAY, "libbpf_mmap", sizeof(int), sizeof(int), 1, &opts);
tools/lib/bpf/features.c-220-	return probe_fd(fd);
--
tools/lib/bpf/features.c=265=static int probe_prog_bind_map(int token_fd)
--
tools/lib/bpf/features.c-270-	};
tools/lib/bpf/features.c:271:	LIBBPF_OPTS(bpf_map_create_opts, map_opts,
tools/lib/bpf/features.c-272-		.token_fd = token_fd,
--
tools/lib/bpf/features.c-280-
tools/lib/bpf/features.c:281:	map = bpf_map_create(BPF_MAP_TYPE_ARRAY, "libbpf_det_bind", sizeof(int), 32, 1, &map_opts);
tools/lib/bpf/features.c-282-	if (map < 0) {
--
tools/lib/bpf/features.c=509=static int probe_ldimm64_full_range_off(int token_fd)
--
tools/lib/bpf/features.c-513-	int ret;
tools/lib/bpf/features.c:514:	LIBBPF_OPTS(bpf_map_create_opts, map_opts,
tools/lib/bpf/features.c-515-		.token_fd = token_fd,
--
tools/lib/bpf/features.c-529-
tools/lib/bpf/features.c:530:	map_fd = bpf_map_create(BPF_MAP_TYPE_ARRAY, "arr", sizeof(int), 1, 1, &map_opts);
tools/lib/bpf/features.c-531-	if (map_fd < 0) {
--
tools/lib/bpf/gen_loader.c=511=void bpf_gen__map_create(struct bpf_gen *gen,
--
tools/lib/bpf/gen_loader.c-514-			 __u32 key_size, __u32 value_size, __u32 max_entries,
tools/lib/bpf/gen_loader.c:515:			 struct bpf_map_create_opts *map_attr, int map_idx)
tools/lib/bpf/gen_loader.c-516-{
--
tools/lib/bpf/libbpf.c=5366=static int bpf_object__create_map(struct bpf_object *obj, struct bpf_map *map, bool is_inner)
tools/lib/bpf/libbpf.c-5367-{
tools/lib/bpf/libbpf.c:5368:	LIBBPF_OPTS(bpf_map_create_opts, create_attr);
tools/lib/bpf/libbpf.c-5369-	struct bpf_map_def *def = &map->def;
--
tools/lib/bpf/libbpf.c-5461-	} else {
tools/lib/bpf/libbpf.c:5462:		map_fd = bpf_map_create(def->type, map_name,
tools/lib/bpf/libbpf.c-5463-					def->key_size, def->value_size,
--
tools/lib/bpf/libbpf.c-5474-		map->btf_value_type_id = 0;
tools/lib/bpf/libbpf.c:5475:		map_fd = bpf_map_create(def->type, map_name,
tools/lib/bpf/libbpf.c-5476-					def->key_size, def->value_size,
--
tools/lib/bpf/libbpf.c=6308=static int create_jt_map(struct bpf_object *obj, struct bpf_program *prog, struct reloc_desc *relo)
--
tools/lib/bpf/libbpf.c-6337-
tools/lib/bpf/libbpf.c:6338:	map_fd = bpf_map_create(BPF_MAP_TYPE_INSN_ARRAY, ".jumptables",
tools/lib/bpf/libbpf.c-6339-				4, value_size, max_entries, NULL);
--
tools/lib/bpf/libbpf.map=287=LIBBPF_0.6.0 {
--
tools/lib/bpf/libbpf.map-290-		bpf_map__set_map_extra;
tools/lib/bpf/libbpf.map:291:		bpf_map_create;
tools/lib/bpf/libbpf.map-292-		bpf_object__next_map;
--
tools/lib/bpf/libbpf_legacy.h=28=enum libbpf_strict_mode {
--
tools/lib/bpf/libbpf_legacy.h-80-	 * Note that libbpf_set_memlock_rlim() needs to be called before
tools/lib/bpf/libbpf_legacy.h:81:	 * the very first bpf_prog_load(), bpf_map_create() or bpf_object__load()
tools/lib/bpf/libbpf_legacy.h-82-	 * operation.
--
tools/lib/bpf/libbpf_probes.c=292=static int probe_map_create(enum bpf_map_type map_type)
tools/lib/bpf/libbpf_probes.c-293-{
tools/lib/bpf/libbpf_probes.c:294:	LIBBPF_OPTS(bpf_map_create_opts, opts);
tools/lib/bpf/libbpf_probes.c-295-	int key_size, value_size, max_entries;
--
tools/lib/bpf/libbpf_probes.c-390-	    map_type == BPF_MAP_TYPE_HASH_OF_MAPS) {
tools/lib/bpf/libbpf_probes.c:391:		fd_inner = bpf_map_create(BPF_MAP_TYPE_HASH, NULL,
tools/lib/bpf/libbpf_probes.c-392-					  sizeof(__u32), sizeof(__u32), 1, NULL);
--
tools/lib/bpf/libbpf_probes.c-404-
tools/lib/bpf/libbpf_probes.c:405:	fd = bpf_map_create(map_type, NULL, key_size, value_size, max_entries, &opts);
tools/lib/bpf/libbpf_probes.c-406-	err = -errno;
]

gemini-3.6-flash

							input: 16428
							output: 1646
							thoughts: 879
						

**My Thought Process on `BPF_MAP_TYPE_PERCPU_ARRAY` Allocation and `EMFILE`**

My primary objective here is to construct a robust, technically detailed response that directly addresses your query. I'm breaking this down into a structured approach to ensure clarity and accuracy, drawing upon my understanding of the underlying kernel mechanics.

First, I need to lay the groundwork by explaining the fundamental memory allocation strategy for `BPF_MAP_TYPE_PERCPU_ARRAY` within the kernel. The core concept is that for each element defined within such a map, the kernel, specifically through `bpf_map_alloc_percpu()`, reserves a block of memory of `round_up(value_size, 8)` bytes. Crucially, this allocation is done *for each available CPU core*. This is achieved using the kernel's per-CPU dynamic memory allocation subsystem, invoked via `__alloc_percpu_gfp`. I also need to flag the hard limit imposed on the size of individual elements in per-CPU maps: `PCPU_MIN_UNIT_SIZE`, which translates to 32 KB or 32,768 bytes. This constraint is vital for understanding the subsequent discussions on memory exhaustion.

Next, I must clearly articulate *why* the `EMFILE` error occurs. From my perspective, `EMFILE`, which signifies "Too many open files," is triggered when a process attempts to create more file descriptors than its allocated limit allows. In the context of BPF maps, each `bpf(BPF_MAP_CREATE, ...)` call, or its `libbpf` equivalent `bpf_map_create()`, returns a file descriptor. Exceeding the process's `RLIMIT_NOFILE` limit (which commonly defaults to 1024) will inevitably lead to this error.

Now, I need to pivot to the core of your problem: how to proactively avoid `EMFILE` while simultaneously pushing the allocation of per-CPU memory to its limits. I see a few distinct, viable strategies here, each with its own trade-offs:

**Method 1: Maximizing Allocation Size per Map (Efficiency)**
My first thought for optimization is to minimize the number of file descriptors required to consume the available per-CPU memory. The most efficient way to do this is by maximizing the `value_size` for each element within a `BPF_MAP_TYPE_PERCPU_ARRAY`. Setting `value_size` to the maximum of 32,768 bytes and then setting `max_entries` to a large number (say, 65,536 or even higher) will result in a single map consuming a colossal amount of per-CPU memory. Specifically, a single map configured this way will allocate 2 GB of per-CPU memory *per CPU core*. Across a system with multiple cores, this quickly adds up to terabytes of memory. This means only a handful of map file descriptors are needed to exhaust the kernel's per-CPU dynamic heap space, making `EMFILE` less of a concern if you're specifically targeting memory exhaustion.

**Method 2: Map Pinning (`bpf_obj_pin` / `BPF_OBJ_PIN`)**
This is a clever approach that leverages the BPF filesystem. The strategy is to create each per-CPU array map using `bpf_map_create()`, but immediately after creation, I'll "pin" it to the BPF filesystem using `bpf_obj_pin()`. Pinning is critical because it increments the kernel's internal reference count for that map object. Once pinned, I can then `close(map_fd)` in user space. This action releases the file descriptor slot, effectively preventing `EMFILE` from ever being hit. Meanwhile, the kernel still holds a reference to the map and, crucially, the per-CPU memory it has allocated. This allows for the creation of many maps without consuming user-space file descriptor resources.

**Method 3: Outer Map / Map-in-Map (`BPF_MAP_TYPE_ARRAY_OF_MAPS`)**
This method offers a different structural approach. I can create an "outer" map of type `BPF_MAP_TYPE_ARRAY_OF_MAPS`. Then, as I create each individual per-CPU array map, instead of holding its file descriptor directly, I'll update an entry in this outer map (`bpf_map_update_elem`) to store the inner map's file descriptor. The outer map itself maintains a kernel reference to these inner maps. After inserting the inner map's FD into the outer map, I can then `close` the inner map's FD immediately. This technique consolidates the management of all these per-CPU maps under a single file descriptor for the outer map, thereby circumventing `EMFILE`.

**Method 4: Raising `RLIMIT_NOFILE`**
The most straightforward, albeit potentially less elegant for certain scenarios, solution is to simply increase the process's open file descriptor limit. This can be done before any map creation occurs by calling `setrlimit(RLIMIT_NOFILE, ...)` with a sufficiently high value. This directly addresses the `EMFILE` error by providing more available file descriptor slots.

Finally, I need to demonstrate these concepts with practical code. I plan to provide clean, compileable C code, likely using `libbpf` for ease of use, or potentially raw `syscall(SYS_bpf, ...)` if I want to highlight the lower-level interaction. This code will incorporate error handling, specifically for `-ENOMEM` which signals the exhaustion of per-CPU memory, and will clearly illustrate the map creation logic for each of the proposed techniques.

My confidence in this approach is high because I've mentally verified the mechanisms against the kernel source code. I'm ready to present this detailed explanation.

map[Answer:To allocate `BPF_MAP_TYPE_PERCPU_ARRAY` maps until kernel percpu dynamic memory is exhausted without hitting the `EMFILE` ("Too many open files") limit, you need to understand both how kernel percpu memory is allocated for BPF maps and how to manage BPF map file descriptor references in user space.

---

### 1. How `BPF_MAP_TYPE_PERCPU_ARRAY` Allocates Percpu Memory

When user space creates a `BPF_MAP_TYPE_PERCPU_ARRAY`:
- **Per-element maximum size:** The kernel enforces a strict upper bound on the value size of percpu map elements: `round_up(value_size, 8) <= PCPU_MIN_UNIT_SIZE` (which is **32 KB** or 32,768 bytes, defined in `kernel/bpf/arraymap.c` and `include/linux/percpu.h`).
- **Percpu allocation mechanism:** For each entry $0 \le i < \text{max\_entries}$, the kernel calls `__alloc_percpu_gfp()`, allocating `round_up(value_size, 8)` bytes **for every online CPU core**.
- **System-wide footprint:**
  $$\text{Total allocated percpu memory} = N_{\text{cpus}} \times \text{max\_entries} \times \text{round\_up}(\text{value\_size}, 8)$$

A single map with `value_size = 32768` and `max_entries = 65536` consumes **2 GB per CPU core** ($16\text{ GB}$ total on an 8-core system).

---

### 2. Why `EMFILE` Occurs and How to Avoid It

`EMFILE` occurs when the process reaches its limit on open file descriptors (`RLIMIT_NOFILE`, default is 1024). Every call to `bpf(BPF_MAP_CREATE, ...)` returns a new FD.

To avoid hitting `EMFILE`, user space can use one or more of the following techniques:

#### Strategy A: High Sizing per Map (Minimizes FD count)
Maximize `value_size` (`32768`) and set `max_entries` large (e.g., `65536` or higher). This exhausts percpu memory with only a tiny fraction of the 1024 open file descriptor limit.

#### Strategy B: Pinning Maps to BPFFS (`bpf_obj_pin`)
1. Create the map (`bpf_map_create`).
2. Pin the map to the BPF filesystem (e.g., `/sys/fs/bpf/percpu_map_N`) using `bpf_obj_pin()`.
3. Call `close(fd)` immediately.
4. The BPFFS entry retains a kernel reference count on the map object so the percpu memory stays allocated, while `close(fd)` releases the file descriptor in user space, completely avoiding `EMFILE`.

#### Strategy C: Outer Map / Map-in-Map (`BPF_MAP_TYPE_ARRAY_OF_MAPS`)
1. Create an outer map of type `BPF_MAP_TYPE_ARRAY_OF_MAPS`.
2. For each created inner percpu map, store its FD into the outer map (`bpf_map_update_elem`).
3. Call `close(inner_fd)`. The outer map maintains kernel references to all inner percpu array maps, keeping their percpu memory allocated while using only 1 open FD for the outer map.

#### Strategy D: Raising `RLIMIT_NOFILE`
Call `setrlimit(RLIMIT_NOFILE, ...)` before creating maps if the process has `CAP_SYS_RESOURCE`.

---

### 3. C Code Example Using Libbpf and BPFFS Pinning

The following C program creates percpu array maps with maximum element size (`32768` bytes), pins them to `/sys/fs/bpf/`, and closes the file descriptors after each creation to avoid `EMFILE`. The loop continues until the kernel returns `-ENOMEM` (indicating percpu allocation failure).

```c
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/resource.h>
#include <bpf/bpf.h>
#include <bpf/libbpf.h>

#define PCPU_MIN_UNIT_SIZE 32768  /* Max value size for percpu maps */
#define MAP_ENTRIES        32768  /* Adjust based on target system memory */
#define PIN_DIR            "/sys/fs/bpf/percpu_fill"

int main(void)
{
    int i = 0;
    int ret;
    char pin_path[256];

    /* Ensure pin directory exists in bpffs */
    mkdir(PIN_DIR, 0700);

    printf("Starting allocation of BPF_MAP_TYPE_PERCPU_ARRAY maps...\n");

    while (1) {
        /* Create map with max entry value size */
        int map_fd = bpf_map_create(BPF_MAP_TYPE_PERCPU_ARRAY,
                                    "fill_percpu",
                                    sizeof(__u32),        /* key_size = 4 */
                                    PCPU_MIN_UNIT_SIZE,   /* value_size = 32KB */
                                    MAP_ENTRIES,
                                    NULL);

        if (map_fd < 0) {
            int err = errno;
            printf("\nMap creation stopped at iteration %d. Error: %s (%d)\n",
                   i, strerror(err), err);
            if (err == ENOMEM) {
                printf("Percpu dynamic memory limit reached (ENOMEM).\n");
            } else if (err == EMFILE) {
                printf("Hit EMFILE limit (increase RLIMIT_NOFILE or use pinning).\n");
            }
            break;
        }

        /* Pin map to BPFFS to hold kernel reference */
        snprintf(pin_path, sizeof(pin_path), "%s/map_%d", PIN_DIR, i);
        ret = bpf_obj_pin(map_fd, pin_path);
        if (ret < 0) {
            perror("bpf_obj_pin failed");
            close(map_fd);
            break;
        }

        /* Close user space FD to prevent hitting EMFILE */
        close(map_fd);

        i++;
        if (i % 10 == 0) {
            printf("Allocated and pinned %d maps (~%lu MB per CPU core allocated)\n",
                   i, (unsigned long)i * MAP_ENTRIES * PCPU_MIN_UNIT_SIZE / (1024 * 1024));
        }
    }

    return 0;
}
```

### Cleanup
To unpin the maps and free the allocated percpu memory:
```bash
rm -rf /sys/fs/bpf/percpu_fill
```]

map[Answer:To allocate `BPF_MAP_TYPE_PERCPU_ARRAY` maps until kernel percpu dynamic memory is exhausted without hitting the `EMFILE` ("Too many open files") limit, you need to understand both how kernel percpu memory is allocated for BPF maps and how to manage BPF map file descriptor references in user space.

---

### 1. How `BPF_MAP_TYPE_PERCPU_ARRAY` Allocates Percpu Memory

When user space creates a `BPF_MAP_TYPE_PERCPU_ARRAY`:
- **Per-element maximum size:** The kernel enforces a strict upper bound on the value size of percpu map elements: `round_up(value_size, 8) <= PCPU_MIN_UNIT_SIZE` (which is **32 KB** or 32,768 bytes, defined in `kernel/bpf/arraymap.c` and `include/linux/percpu.h`).
- **Percpu allocation mechanism:** For each entry $0 \le i < \text{max\_entries}$, the kernel calls `__alloc_percpu_gfp()`, allocating `round_up(value_size, 8)` bytes **for every online CPU core**.
- **System-wide footprint:**
  $$\text{Total allocated percpu memory} = N_{\text{cpus}} \times \text{max\_entries} \times \text{round\_up}(\text{value\_size}, 8)$$

A single map with `value_size = 32768` and `max_entries = 65536` consumes **2 GB per CPU core** ($16\text{ GB}$ total on an 8-core system).

---

### 2. Why `EMFILE` Occurs and How to Avoid It

`EMFILE` occurs when the process reaches its limit on open file descriptors (`RLIMIT_NOFILE`, default is 1024). Every call to `bpf(BPF_MAP_CREATE, ...)` returns a new FD.

To avoid hitting `EMFILE`, user space can use one or more of the following techniques:

#### Strategy A: High Sizing per Map (Minimizes FD count)
Maximize `value_size` (`32768`) and set `max_entries` large (e.g., `65536` or higher). This exhausts percpu memory with only a tiny fraction of the 1024 open file descriptor limit.

#### Strategy B: Pinning Maps to BPFFS (`bpf_obj_pin`)
1. Create the map (`bpf_map_create`).
2. Pin the map to the BPF filesystem (e.g., `/sys/fs/bpf/percpu_map_N`) using `bpf_obj_pin()`.
3. Call `close(fd)` immediately.
4. The BPFFS entry retains a kernel reference count on the map object so the percpu memory stays allocated, while `close(fd)` releases the file descriptor in user space, completely avoiding `EMFILE`.

#### Strategy C: Outer Map / Map-in-Map (`BPF_MAP_TYPE_ARRAY_OF_MAPS`)
1. Create an outer map of type `BPF_MAP_TYPE_ARRAY_OF_MAPS`.
2. For each created inner percpu map, store its FD into the outer map (`bpf_map_update_elem`).
3. Call `close(inner_fd)`. The outer map maintains kernel references to all inner percpu array maps, keeping their percpu memory allocated while using only 1 open FD for the outer map.

#### Strategy D: Raising `RLIMIT_NOFILE`
Call `setrlimit(RLIMIT_NOFILE, ...)` before creating maps if the process has `CAP_SYS_RESOURCE`.

---

### 3. C Code Example Using Libbpf and BPFFS Pinning

The following C program creates percpu array maps with maximum element size (`32768` bytes), pins them to `/sys/fs/bpf/`, and closes the file descriptors after each creation to avoid `EMFILE`. The loop continues until the kernel returns `-ENOMEM` (indicating percpu allocation failure).

```c
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/resource.h>
#include <bpf/bpf.h>
#include <bpf/libbpf.h>

#define PCPU_MIN_UNIT_SIZE 32768  /* Max value size for percpu maps */
#define MAP_ENTRIES        32768  /* Adjust based on target system memory */
#define PIN_DIR            "/sys/fs/bpf/percpu_fill"

int main(void)
{
    int i = 0;
    int ret;
    char pin_path[256];

    /* Ensure pin directory exists in bpffs */
    mkdir(PIN_DIR, 0700);

    printf("Starting allocation of BPF_MAP_TYPE_PERCPU_ARRAY maps...\n");

    while (1) {
        /* Create map with max entry value size */
        int map_fd = bpf_map_create(BPF_MAP_TYPE_PERCPU_ARRAY,
                                    "fill_percpu",
                                    sizeof(__u32),        /* key_size = 4 */
                                    PCPU_MIN_UNIT_SIZE,   /* value_size = 32KB */
                                    MAP_ENTRIES,
                                    NULL);

        if (map_fd < 0) {
            int err = errno;
            printf("\nMap creation stopped at iteration %d. Error: %s (%d)\n",
                   i, strerror(err), err);
            if (err == ENOMEM) {
                printf("Percpu dynamic memory limit reached (ENOMEM).\n");
            } else if (err == EMFILE) {
                printf("Hit EMFILE limit (increase RLIMIT_NOFILE or use pinning).\n");
            }
            break;
        }

        /* Pin map to BPFFS to hold kernel reference */
        snprintf(pin_path, sizeof(pin_path), "%s/map_%d", PIN_DIR, i);
        ret = bpf_obj_pin(map_fd, pin_path);
        if (ret < 0) {
            perror("bpf_obj_pin failed");
            close(map_fd);
            break;
        }

        /* Close user space FD to prevent hitting EMFILE */
        close(map_fd);

        i++;
        if (i % 10 == 0) {
            printf("Allocated and pinned %d maps (~%lu MB per CPU core allocated)\n",
                   i, (unsigned long)i * MAP_ENTRIES * PCPU_MIN_UNIT_SIZE / (1024 * 1024));
        }
    }

    return 0;
}
```

### Cleanup
To unpin the maps and free the allocated percpu memory:
```bash
rm -rf /sys/fs/bpf/percpu_fill
```]

gemini-3.1-pro-preview

							input: 125129
							output: 34
							thoughts: 882
						

**My Thoughts on Exhausting PerCPU Memory for BPF Object Pinning and NFS Service Creation**

Okay, so the idea of `bpf_obj_pin` is really appealing for its utility, but I'm immediately hitting a roadblock: it *requires* `bpffs` to be mounted. This means if I'm relying on `bpf_obj_pin` directly, I need to ensure `bpffs` is available, which might not always be the case.

Now, let's consider Strategy A, the "High Sizing per Map" approach. My initial thought was that this could minimize the file descriptor (FD) count. However, I ran into a critical detail: if I set `max_entries = 10000` for a map, it *allocates* 10000 entries upfront. The problem is, if the allocation fails at, say, entry 9999, the entire 9999 entries are freed, and the operation returns `-ENOMEM`. This means a single, massive map might not completely exhaust memory; it could leave a significant gap of up to 10000 entries unused.

This observation leads me to realize that I can't just rely on one enormous map. Instead, I need a more nuanced approach. Binary search or a strategy of decreasing map sizes seems more appropriate.

Consider this function I've drafted:

```c
void exhaust_percpu() {
    int max_entries = 10000;
    while (max_entries > 0) {
        union bpf_attr attr = {
            .map_type = BPF_MAP_TYPE_PERCPU_ARRAY,
            .key_size = 4,
            .value_size = 32768, // This is a substantial chunk
            .max_entries = max_entries,
        };
        int fd = syscall(__NR_bpf, BPF_MAP_CREATE, &attr, sizeof(attr));
        if (fd < 0) {
            // If creation fails, it's likely due to memory pressure.
            // Reduce the size and try again.
            max_entries /= 2;
        }
        // If it succeeds, we can continue with this size or adjust strategy.
        // For exhaustion, we're primarily interested in the failure points.
    }
}
```

The logic here is to iteratively attempt to create `BPF_MAP_TYPE_PERCPU_ARRAY` maps with decreasing `max_entries`. The loop continues as long as `max_entries` is positive. When a `BPF_MAP_CREATE` call fails (likely due to memory exhaustion), I halve `max_entries` and try again. This process will continue until `max_entries` effectively becomes zero, meaning I've pushed the percpu allocator to its limits. The goal is to leave percpu memory exhausted down to a minimal usable state, specifically down to the size of the last *failed* allocation, which in this case means down to 32KB (the `value_size` of the last attempted allocation).

The beauty of this approach, as I see it, is that the number of file descriptors used will be remarkably small. For example, with a starting size of 10000 and halving it, I'd likely end up using only a few dozen FDs. This easily fits within the typical 1024 limit for FDs per process.

Now, let's trace the subsequent flow if I execute this `exhaust_percpu()` function *before* attempting to create an NFS service:

1.  `exhaust_percpu()` runs and successfully exhausts the percpu memory pool to a significant degree.
2.  Then, I call `write_ports` to initiate the creation of a transport.
3.  `write_ports` subsequently calls `nfsd_create_serv`.
4.  `nfsd_create_serv` then invokes `__svc_create`.
5.  `__svc_create` attempts to initialize a percpu counter by calling `percpu_counter_init`.
6.  This, in turn, calls `__alloc_percpu_gfp`.
7.  And here's the critical point: `__alloc_percpu_gfp` *fails* because the percpu memory pool has been effectively exhausted by my earlier `exhaust_percpu()` function.
8.  However, the design of `__svc_create` is such that it *ignores* this specific error and proceeds to return the partially created `serv` structure.
9.  Following this, `nfsd_create_serv` calls `svc_bind`.
10. `svc_bind` then calls `rpc_malloc` to allocate memory for the RPC buffer.
11. `rpc_malloc` attempts to allocate memory using `kmem_cache_alloc(rpc_buffer_slabp, GFP_KERNEL)`.

My next thought is: will `kmem_cache_alloc` succeed? I believe it *should*. The reason is that my exhaustion strategy specifically targeted *percpu* memory. It did not touch the general kernel slab allocator (`kmem_cache_alloc`). So, even though `rpc_buffer_slabp` might be a slab cache, it should still have available memory.

However, there's a subtle point: `rpc_buffer_slabp` might, under pressure, need to allocate a new slab page from the general page allocator. Will *that* succeed? My reasoning is, yes, it should. I've only exhausted *percpu* memory, not the overall system's normal memory which the page allocator manages.

This brings me back to a deeper understanding of `__alloc_percpu_gfp`. It doesn't just try to find space in existing percpu chunks; if the percpu allocator is exhausted, it attempts to allocate *new* chunks by calling `pcpu_alloc_pages`. If `pcpu_alloc_pages` succeeds, it adds a brand new chunk to the percpu allocator's management.

This is a crucial realization: the percpu allocator is designed to be dynamic and can grow. If I exhaust the current chunks, it *will try* to allocate a new chunk. This means my simple halving strategy might not *permanently* exhaust percpu memory if the kernel can easily allocate more. My next question then becomes: is there an *actual limit* on the number of percpu chunks the kernel will manage? I need to investigate the `pcpu_alloc` mechanism further to understand if there's a hard ceiling on the number of percpu chunks that can be created, or if there are other constraints that prevent it from growing indefinitely. This is the next piece of the puzzle I need to solve to confirm if my exhaustion strategy will be effective.

map[ContextFile:mm/percpu.c Name:pcpu_alloc]

map[SourceCode: 249:	static struct debug_obj *pcpu_alloc(void)
 250:	{
 251:		struct obj_pool *pcp = this_cpu_ptr(&pool_pcpu);
 252:	
 253:		lockdep_assert_irqs_disabled();
 254:	
 255:		for (;;) {
 256:			struct debug_obj *obj = __alloc_object(&pcp->objects);
 257:	
 258:			if (likely(obj)) {
 259:				pcp->cnt--;
 260:				/*
 261:				 * If this emptied a batch try to refill from the
 262:				 * free pool. Don't do that if this was the top-most
 263:				 * batch as pcpu_free() expects the per CPU pool
 264:				 * to be less than ODEBUG_POOL_PERCPU_SIZE.
 265:				 */
 266:				if (unlikely(pcp->cnt < (ODEBUG_POOL_PERCPU_SIZE - ODEBUG_BATCH_SIZE) &&
 267:					     !(pcp->cnt % ODEBUG_BATCH_SIZE))) {
 268:					/*
 269:					 * Don't try to allocate from the regular pool here
 270:					 * to not exhaust it prematurely.
 271:					 */
 272:					if (pool_count(&pool_to_free)) {
 273:						guard(raw_spinlock)(&pool_lock);
 274:						pool_move_batch(pcp, &pool_to_free);
 275:						pcpu_refill_stats();
 276:					}
 277:				}
 278:				return obj;
 279:			}
 280:	
 281:			guard(raw_spinlock)(&pool_lock);
 282:			if (!pool_move_batch(pcp, &pool_to_free)) {
 283:				if (!pool_move_batch(pcp, &pool_global))
 284:					return NULL;
 285:			}
 286:			pcpu_refill_stats();
 287:		}
 288:	}
 SourceFile:lib/debugobjects.c]

gemini-3.1-pro-preview

							input: 126644
							output: 34
							thoughts: 41
						

**My Thought Process:**

My initial reaction to seeing `pcpu_alloc` was to immediately pinpoint its location. My mental model of the codebase strongly suggests that per-CPU allocations are managed primarily within the `mm/percpu.c` file. Therefore, my immediate impulse was to confirm this by searching for `pcpu_alloc` specifically within that core per-CPU management module. This is a crucial step in understanding the scope and implementation details of this function, ensuring I'm looking at the primary source of its logic rather than a potential secondary or debugging-specific usage.

map[ContextFile:mm/percpu.c Name:pcpu_alloc]

map[SourceCode: 249:	static struct debug_obj *pcpu_alloc(void)
 250:	{
 251:		struct obj_pool *pcp = this_cpu_ptr(&pool_pcpu);
 252:	
 253:		lockdep_assert_irqs_disabled();
 254:	
 255:		for (;;) {
 256:			struct debug_obj *obj = __alloc_object(&pcp->objects);
 257:	
 258:			if (likely(obj)) {
 259:				pcp->cnt--;
 260:				/*
 261:				 * If this emptied a batch try to refill from the
 262:				 * free pool. Don't do that if this was the top-most
 263:				 * batch as pcpu_free() expects the per CPU pool
 264:				 * to be less than ODEBUG_POOL_PERCPU_SIZE.
 265:				 */
 266:				if (unlikely(pcp->cnt < (ODEBUG_POOL_PERCPU_SIZE - ODEBUG_BATCH_SIZE) &&
 267:					     !(pcp->cnt % ODEBUG_BATCH_SIZE))) {
 268:					/*
 269:					 * Don't try to allocate from the regular pool here
 270:					 * to not exhaust it prematurely.
 271:					 */
 272:					if (pool_count(&pool_to_free)) {
 273:						guard(raw_spinlock)(&pool_lock);
 274:						pool_move_batch(pcp, &pool_to_free);
 275:						pcpu_refill_stats();
 276:					}
 277:				}
 278:				return obj;
 279:			}
 280:	
 281:			guard(raw_spinlock)(&pool_lock);
 282:			if (!pool_move_batch(pcp, &pool_to_free)) {
 283:				if (!pool_move_batch(pcp, &pool_global))
 284:					return NULL;
 285:			}
 286:			pcpu_refill_stats();
 287:		}
 288:	}
 SourceFile:lib/debugobjects.c]

gemini-3.1-pro-preview

							input: 127318
							output: 38
							thoughts: 40
						

**A Deep Dive into Per-CPU Allocation Debugging**

My initial investigation into a potential issue has hit a minor snag. The debugging tool, which I rely on for tracing memory allocation patterns, has once again pointed me towards `lib/debugobjects.c`. While this file is certainly involved in memory management, it feels like a tangential clue at this stage, perhaps indicating an overarching system behavior rather than the precise root cause of what I'm trying to isolate.

My current hypothesis is that the problematic allocation, or at least a key component of its lifecycle, is directly related to the per-CPU memory allocation mechanism. Specifically, I need to examine the core implementation of how per-CPU data structures are dynamically allocated. Therefore, my immediate next step is to shift my focus from the generic debugging object layer and delve directly into the heart of per-CPU allocation logic. I'll be searching for the `__alloc_percpu_gfp` function within the `mm/percpu.c` file. This function is the linchpin for per-CPU allocations using GFP flags, and understanding its behavior in the context of this recurring `lib/debugobjects.c` artifact is paramount to unraveling this puzzle. I expect that by scrutinizing this function, I'll gain insight into any specific flags being used, potential resource contention, or perhaps even a subtle interaction between per-CPU allocation and the object debugging framework that's causing the repeated, yet perhaps unhelpful, reporting of `lib/debugobjects.c`.

log-in to see details

map[ContextFile:mm/percpu.c Name:__alloc_percpu_gfp]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 127401
							output: 25
							thoughts: 30
						

**My Thought Process on Per-CPU Allocation Optimization**

Okay, so the core of my thinking here revolves around optimizing how we manage per-CPU data structures, specifically when it comes to their allocation. I'm looking at the `mm/percpu.c` file as the likely source for this kind of low-level memory management. My initial hypothesis is that there will be some specialized functions within this file that handle the intricacies of allocating memory that's dedicated to each CPU.

I'm specifically targeting two function names: `alloc_percpu_gfp` and `pcpu_alloc`.

*   `alloc_percpu_gfp`: The `_gfp` suffix strongly suggests that this function will accept GFP flags. This is crucial because it means the allocation process can be influenced by the current memory allocation context – things like whether we can sleep, if we need to reclaim memory, or if we're in an atomic context. This level of control is vital for ensuring per-CPU allocations are as efficient and context-aware as possible, preventing deadlocks or unnecessary delays. I'd expect this function to be the primary entry point for allocating per-CPU memory where the allocation flags are explicitly managed.

*   `pcpu_alloc`: This name is more direct and likely represents the fundamental mechanism for allocating per-CPU memory. It might be a more general-purpose allocator, potentially calling `alloc_percpu_gfp` internally or having its own set of optimizations. I'm anticipating that this function will encapsulate the logic for determining the size needed, finding contiguous blocks if necessary (though per-CPU often implies non-contiguous, but with specific alignment), and then actually reserving that memory space for each individual processor.

My expectation is that by examining the implementation of these functions, I'll gain insights into:

1.  **The underlying memory allocation strategy:** Are they using general-purpose allocators and then segmenting, or is there a more specialized per-CPU pool?
2.  **Alignment and layout:** How is the memory laid out to ensure each CPU gets its dedicated chunk, and what are the alignment guarantees?
3.  **Concurrency handling:** Since this is per-CPU, there's a inherent degree of per-CPU isolation. However, the *allocation* itself might still involve some level of global locking or synchronization, and I want to see how that's managed.
4.  **Error handling and recovery:** What happens if allocation fails? Are there fallback mechanisms?

Ultimately, by digging into these specific functions within `mm/percpu.c`, I'm hoping to understand the fine-grained details of how the kernel ensures that per-CPU data is efficiently and reliably provisioned, which is a critical aspect of achieving high performance in multi-processor systems.

map[SourceFile:mm/percpu.c]

map[Entities:[map[Kind:function Name:__is_kernel_percpu_address] map[Kind:function Name:__pcpu_chunk_move] map[Kind:function Name:__pcpu_size_to_slot] map[Kind:function Name:free_percpu] map[Kind:function Name:is_kernel_percpu_address] map[Kind:function Name:pcpu_addr_in_chunk] map[Kind:function Name:pcpu_alloc_alloc_info] map[Kind:function Name:pcpu_alloc_area] map[Kind:function Name:pcpu_alloc_chunk] map[Kind:function Name:pcpu_alloc_first_chunk] map[Kind:function Name:pcpu_alloc_noprof] map[Kind:function Name:pcpu_alloc_tag_alloc_hook] map[Kind:function Name:pcpu_alloc_tag_free_hook] map[Kind:function Name:pcpu_balance_free] map[Kind:function Name:pcpu_balance_populated] map[Kind:function Name:pcpu_balance_workfn] map[Kind:function Name:pcpu_block_off_to_off] map[Kind:function Name:pcpu_block_refresh_hint] map[Kind:function Name:pcpu_block_update] map[Kind:function Name:pcpu_block_update_hint_alloc] map[Kind:function Name:pcpu_block_update_hint_free] map[Kind:function Name:pcpu_block_update_scan] map[Kind:function Name:pcpu_build_alloc_info] map[Kind:function Name:pcpu_check_block_hint] map[Kind:function Name:pcpu_chunk_addr] map[Kind:function Name:pcpu_chunk_addr_search] map[Kind:function Name:pcpu_chunk_depopulated] map[Kind:function Name:pcpu_chunk_move] map[Kind:function Name:pcpu_chunk_populated] map[Kind:function Name:pcpu_chunk_refresh_hint] map[Kind:function Name:pcpu_chunk_relocate] map[Kind:function Name:pcpu_chunk_slot] map[Kind:function Name:pcpu_dump_alloc_info] map[Kind:function Name:pcpu_embed_first_chunk] map[Kind:function Name:pcpu_fc_alloc] map[Kind:function Name:pcpu_fc_free] map[Kind:function Name:pcpu_find_block_fit] map[Kind:function Name:pcpu_find_zero_area] map[Kind:function Name:pcpu_free_alloc_info] map[Kind:function Name:pcpu_free_area] map[Kind:function Name:pcpu_free_chunk] map[Kind:function Name:pcpu_get_page_chunk] map[Kind:function Name:pcpu_index_alloc_map] map[Kind:function Name:pcpu_init_md_block] map[Kind:function Name:pcpu_init_md_blocks] map[Kind:function Name:pcpu_is_populated] map[Kind:function Name:pcpu_isolate_chunk] map[Kind:function Name:pcpu_mem_free] map[Kind:function Name:pcpu_mem_zalloc] map[Kind:function Name:pcpu_memcg_free_hook] map[Kind:function Name:pcpu_memcg_post_alloc_hook] map[Kind:function Name:pcpu_memcg_pre_alloc_hook] map[Kind:function Name:pcpu_next_fit_region] map[Kind:function Name:pcpu_next_hint] map[Kind:function Name:pcpu_next_md_free_region] map[Kind:function Name:pcpu_nr_pages] map[Kind:function Name:pcpu_off_to_block_index] map[Kind:function Name:pcpu_off_to_block_off] map[Kind:function Name:pcpu_page_first_chunk] map[Kind:function Name:pcpu_page_idx] map[Kind:function Name:pcpu_populate_pte] map[Kind:function Name:pcpu_reclaim_populated] map[Kind:function Name:pcpu_region_overlap] map[Kind:function Name:pcpu_reintegrate_chunk] map[Kind:function Name:pcpu_schedule_balance_work] map[Kind:function Name:pcpu_set_page_chunk] map[Kind:function Name:pcpu_setup_first_chunk] map[Kind:function Name:pcpu_size_to_slot] map[Kind:function Name:pcpu_unit_page_offset] map[Kind:function Name:pcpu_update_empty_pages] map[Kind:function Name:per_cpu_ptr_to_phys] map[Kind:function Name:percpu_alloc_setup] map[Kind:function Name:percpu_enable_async] map[Kind:global_variable Name:__UNIQUE_ID_addressable_free_percpu_1468] map[Kind:global_variable Name:__UNIQUE_ID_addressable_pcpu_alloc_noprof_1441] map[Kind:global_variable Name:__UNIQUE_ID_addressable_percpu_enable_async_1529] map[Kind:global_variable Name:__gendwarfksyms_ptr_free_percpu] map[Kind:global_variable Name:__gendwarfksyms_ptr_pcpu_alloc_noprof] map[Kind:global_variable Name:__setup_percpu_alloc_setup] map[Kind:global_variable Name:__setup_str_percpu_alloc_setup] map[Kind:global_variable Name:pcpu_alloc_mutex] map[Kind:global_variable Name:pcpu_balance_work] map[Kind:global_variable Name:pcpu_chosen_fc] map[Kind:global_variable Name:pcpu_fc_names] map[Kind:global_variable Name:pcpu_lock]]]

gemini-3.1-pro-preview

							input: 128428
							output: 38
							thoughts: 58
						

**My Thought Process Unpacking `pcpu_alloc_noprof`**

Okay, so I've just encountered `pcpu_alloc_noprof`, and my immediate thought is, "Right, this is the core allocation function for per-CPU data when profiling isn't a concern." But then, my mind immediately jumps to how it's *invoked*. I know that `__alloc_percpu_gfp` is a commonly used entry point for per-CPU allocations, especially when dealing with specific memory allocation flags (`gfp_t`). So, I need to verify that `__alloc_percpu_gfp` is indeed just a macro that delegates its work to `pcpu_alloc_noprof`. This is a crucial step in understanding the call stack and the actual underlying mechanism. My next step, therefore, is to dive into the definition and implementation of `pcpu_alloc_noprof` itself to see exactly what it does and how it manages these per-CPU allocations.

map[ContextFile:mm/percpu.c Name:pcpu_alloc_noprof]

map[SourceCode:1721:	/**
1722:	 * pcpu_alloc - the percpu allocator
1723:	 * @size: size of area to allocate in bytes
1724:	 * @align: alignment of area (max PAGE_SIZE)
1725:	 * @reserved: allocate from the reserved chunk if available
1726:	 * @gfp: allocation flags
1727:	 *
1728:	 * Allocate percpu area of @size bytes aligned at @align.  If @gfp doesn't
1729:	 * contain %GFP_KERNEL, the allocation is atomic. If @gfp has __GFP_NOWARN
1730:	 * then no warning will be triggered on invalid or failed allocation
1731:	 * requests.
1732:	 *
1733:	 * RETURNS:
1734:	 * Percpu pointer to the allocated area on success, NULL on failure.
1735:	 */
1736:	void __percpu *pcpu_alloc_noprof(size_t size, size_t align, bool reserved,
1737:					 gfp_t gfp)
1738:	{
1739:		gfp_t pcpu_gfp;
1740:		bool is_atomic;
1741:		bool do_warn;
1742:		struct obj_cgroup *objcg = NULL;
1743:		static atomic_t warn_limit = ATOMIC_INIT(10);
1744:		struct pcpu_chunk *chunk, *next;
1745:		const char *err;
1746:		int slot, off, cpu, ret;
1747:		unsigned long flags;
1748:		void __percpu *ptr;
1749:		size_t bits, bit_align;
1750:	
1751:		gfp = current_gfp_context(gfp);
1752:		/* whitelisted flags that can be passed to the backing allocators */
1753:		pcpu_gfp = gfp & (GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN);
1754:		is_atomic = !gfpflags_allow_blocking(gfp);
1755:		do_warn = !(gfp & __GFP_NOWARN);
1756:	
1757:		/*
1758:		 * There is now a minimum allocation size of PCPU_MIN_ALLOC_SIZE,
1759:		 * therefore alignment must be a minimum of that many bytes.
1760:		 * An allocation may have internal fragmentation from rounding up
1761:		 * of up to PCPU_MIN_ALLOC_SIZE - 1 bytes.
1762:		 */
1763:		if (unlikely(align < PCPU_MIN_ALLOC_SIZE))
1764:			align = PCPU_MIN_ALLOC_SIZE;
1765:	
1766:		size = ALIGN(size, PCPU_MIN_ALLOC_SIZE);
1767:		bits = size >> PCPU_MIN_ALLOC_SHIFT;
1768:		bit_align = align >> PCPU_MIN_ALLOC_SHIFT;
1769:	
1770:		if (unlikely(!size || size > PCPU_MIN_UNIT_SIZE || align > PAGE_SIZE ||
1771:			     !is_power_of_2(align))) {
1772:			WARN(do_warn, "illegal size (%zu) or align (%zu) for percpu allocation\n",
1773:			     size, align);
1774:			return NULL;
1775:		}
1776:	
1777:		if (unlikely(!pcpu_memcg_pre_alloc_hook(size, gfp, &objcg)))
1778:			return NULL;
1779:	
1780:		if (!is_atomic) {
1781:			/*
1782:			 * pcpu_balance_workfn() allocates memory under this mutex,
1783:			 * and it may wait for memory reclaim. Allow current task
1784:			 * to become OOM victim, in case of memory pressure.
1785:			 */
1786:			if (gfp & __GFP_NOFAIL) {
1787:				mutex_lock(&pcpu_alloc_mutex);
1788:			} else if (mutex_lock_killable(&pcpu_alloc_mutex)) {
1789:				pcpu_memcg_post_alloc_hook(objcg, NULL, 0, size);
1790:				return NULL;
1791:			}
1792:		}
1793:	
1794:		spin_lock_irqsave(&pcpu_lock, flags);
1795:	
1796:		/* serve reserved allocations from the reserved chunk if available */
1797:		if (reserved && pcpu_reserved_chunk) {
1798:			chunk = pcpu_reserved_chunk;
1799:	
1800:			off = pcpu_find_block_fit(chunk, bits, bit_align, is_atomic);
1801:			if (off < 0) {
1802:				err = "alloc from reserved chunk failed";
1803:				goto fail_unlock;
1804:			}
1805:	
1806:			off = pcpu_alloc_area(chunk, bits, bit_align, off);
1807:			if (off >= 0)
1808:				goto area_found;
1809:	
1810:			err = "alloc from reserved chunk failed";
1811:			goto fail_unlock;
1812:		}
1813:	
1814:	restart:
1815:		/* search through normal chunks */
1816:		for (slot = pcpu_size_to_slot(size); slot <= pcpu_free_slot; slot++) {
1817:			list_for_each_entry_safe(chunk, next, &pcpu_chunk_lists[slot],
1818:						 list) {
1819:				off = pcpu_find_block_fit(chunk, bits, bit_align,
1820:							  is_atomic);
1821:				if (off < 0) {
1822:					if (slot < PCPU_SLOT_FAIL_THRESHOLD)
1823:						pcpu_chunk_move(chunk, 0);
1824:					continue;
1825:				}
1826:	
1827:				off = pcpu_alloc_area(chunk, bits, bit_align, off);
1828:				if (off >= 0) {
1829:					pcpu_reintegrate_chunk(chunk);
1830:					goto area_found;
1831:				}
1832:			}
1833:		}
1834:	
1835:		spin_unlock_irqrestore(&pcpu_lock, flags);
1836:	
1837:		if (is_atomic) {
1838:			err = "atomic alloc failed, no space left";
1839:			goto fail;
1840:		}
1841:	
1842:		/* No space left.  Create a new chunk. */
1843:		if (list_empty(&pcpu_chunk_lists[pcpu_free_slot])) {
1844:			chunk = pcpu_create_chunk(pcpu_gfp);
1845:			if (!chunk) {
1846:				err = "failed to allocate new chunk";
1847:				goto fail;
1848:			}
1849:	
1850:			spin_lock_irqsave(&pcpu_lock, flags);
1851:			pcpu_chunk_relocate(chunk, -1);
1852:		} else {
1853:			spin_lock_irqsave(&pcpu_lock, flags);
1854:		}
1855:	
1856:		goto restart;
1857:	
1858:	area_found:
1859:		pcpu_stats_area_alloc(chunk, size);
1860:	
1861:		if (pcpu_nr_empty_pop_pages < PCPU_EMPTY_POP_PAGES_LOW)
1862:			pcpu_schedule_balance_work();
1863:	
1864:		spin_unlock_irqrestore(&pcpu_lock, flags);
1865:	
1866:		/* populate if not all pages are already there */
1867:		if (!is_atomic) {
1868:			unsigned int page_end, rs, re;
1869:	
1870:			rs = PFN_DOWN(off);
1871:			page_end = PFN_UP(off + size);
1872:	
1873:			for_each_clear_bitrange_from(rs, re, chunk->populated, page_end) {
1874:				WARN_ON(chunk->immutable);
1875:	
1876:				ret = pcpu_populate_chunk(chunk, rs, re, pcpu_gfp);
1877:	
1878:				spin_lock_irqsave(&pcpu_lock, flags);
1879:				if (ret) {
1880:					pcpu_free_area(chunk, off);
1881:					err = "failed to populate";
1882:					goto fail_unlock;
1883:				}
1884:				pcpu_chunk_populated(chunk, rs, re);
1885:				spin_unlock_irqrestore(&pcpu_lock, flags);
1886:			}
1887:	
1888:			mutex_unlock(&pcpu_alloc_mutex);
1889:		}
1890:	
1891:		/* clear the areas and return address relative to base address */
1892:		for_each_possible_cpu(cpu)
1893:			memset((void *)pcpu_chunk_addr(chunk, cpu, 0) + off, 0, size);
1894:	
1895:		ptr = __addr_to_pcpu_ptr(chunk->base_addr + off);
1896:		kmemleak_alloc_percpu(ptr, size, gfp);
1897:	
1898:		trace_percpu_alloc_percpu(_RET_IP_, reserved, is_atomic, size, align,
1899:					  chunk->base_addr, off, ptr,
1900:					  pcpu_obj_full_size(size), gfp);
1901:	
1902:		pcpu_memcg_post_alloc_hook(objcg, chunk, off, size);
1903:	
1904:		pcpu_alloc_tag_alloc_hook(chunk, off, size);
1905:	
1906:		return ptr;
1907:	
1908:	fail_unlock:
1909:		spin_unlock_irqrestore(&pcpu_lock, flags);
1910:	fail:
1911:		trace_percpu_alloc_percpu_fail(reserved, is_atomic, size, align);
1912:	
1913:		if (do_warn) {
1914:			int remaining = atomic_dec_if_positive(&warn_limit);
1915:	
1916:			if (remaining >= 0) {
1917:				pr_warn("allocation failed, size=%zu align=%zu atomic=%d, %s\n",
1918:					size, align, is_atomic, err);
1919:				if (!is_atomic)
1920:					dump_stack();
1921:				if (remaining == 0)
1922:					pr_info("limit reached, disable warning\n");
1923:			}
1924:		}
1925:	
1926:		if (is_atomic) {
1927:			/* see the flag handling in pcpu_balance_workfn() */
1928:			pcpu_atomic_alloc_failed = true;
1929:			pcpu_schedule_balance_work();
1930:		} else {
1931:			mutex_unlock(&pcpu_alloc_mutex);
1932:		}
1933:	
1934:		pcpu_memcg_post_alloc_hook(objcg, NULL, 0, size);
1935:	
1936:		return NULL;
1937:	}
 SourceFile:mm/percpu.c]

gemini-3.1-pro-preview

							input: 131849
							output: 39
							thoughts: 2220
						

**The Perilous Path to Per-CPU Memory Exhaustion and Beyond**

My initial thought process revolved around `pcpu_alloc_noprof` and its mechanism for allocating per-CPU memory. I observed that when there's no space left in existing chunks, it attempts to create a new one via `pcpu_create_chunk`. This function, in turn, relies on `pcpu_mem_zalloc` or `vmalloc`, which ultimately boil down to page allocation. My immediate concern was what happens when the system runs out of memory entirely.

The thought then shifted: if `pcpu_create_chunk` fails due to memory exhaustion, that's a direct consequence of exhausting *normal* memory pages. This then led me to question the interplay between per-CPU memory allocation and the general memory allocator, specifically `kmalloc`. If we allocate a significant amount of per-CPU memory, it translates to many per-CPU chunks, consuming normal memory. If *that* runs dry, `kmalloc` itself would fail.

Then, a critical question arose: does `pcpu_alloc_noprof` have any inherent limits on the number of chunks it can create? I deduced that it doesn't; it simply keeps trying until either memory runs out (`pcpu_create_chunk` failing) or page population for a chunk fails (`pcpu_populate_chunk`). This reinforced the idea that a complete memory exhaustion scenario is the ultimate limit.

The core problem I was trying to solve was how to make `__alloc_percpu_gfp` (which `pcpu_alloc_noprof` uses) fail *specifically* while `kmalloc` still succeeds. This would be a more nuanced failure scenario. I recalled the existence of memory control groups (memcgs) and their pre-allocation hooks like `pcpu_memcg_pre_alloc_hook`, but then realized this wouldn't apply if we're not operating within a restricted memcg.

The hint of using `fail_page_alloc` surfaced. If I could somehow trigger `pcpu_create_chunk` or `pcpu_populate_chunk` to call the page allocator, and `fail_page_alloc` was active, it should fail. However, my concern was that `fail_page_alloc` is a blunt instrument; it would likely cause `kmalloc` to fail simultaneously, which is precisely what I wanted to avoid.

My focus then turned to the specific functions involved in per-CPU allocation. I noticed `percpu_counter_init` and `rpc_malloc` both use `GFP_KERNEL`. If `fail_page_alloc` is probabilistic, it might only fail some allocations. But if set to 100%, it would break everything, including `kmalloc`. The idea of filtering `fail_page_alloc` by `min-order` also crossed my mind, but I concluded that `pcpu_populate_chunk` typically allocates order-0 pages, making this filter less relevant.

The key insight came when considering how per-CPU allocations are managed. `percpu_counter_init` and `rpc_malloc` allocate small per-CPU areas. The per-CPU allocator groups these into chunks. If there's *existing free space* within a chunk, `__alloc_percpu_gfp` (and thus `pcpu_alloc_noprof`) wouldn't need to call the page allocator at all. This meant that `fail_page_alloc` wouldn't intercept these allocations, and `percpu_counter_init` would succeed, failing to trigger the bug.

This led to the realization that to *force* `percpu_counter_init` to call the page allocator, I needed to exhaust the available free space within the *existing* per-CPU chunks. This is where the BPF map creation in the reproducer became crucial. By creating a large number of BPF maps of type `BPF_MAP_TYPE_PERCPU_ARRAY` with substantial value sizes, the reproducer effectively consumed all the readily available per-CPU memory space. This "primes the pump," so to speak.

With the per-CPU chunks filled, the *next* allocation attempt, specifically by `percpu_counter_init`, would be forced to either create a new chunk or populate pages for an existing one, thereby invoking the page allocator. With `fail_page_alloc` enabled, this page allocation would then fail, causing `percpu_counter_init` to fail as intended.

However, a lingering doubt remained: if `fail_page_alloc` is active, wouldn't `rpc_malloc` also fail? My reasoning was that `rpc_malloc` uses `rpc_buffer_slabp`, and if the slab cache itself needs to allocate pages (because it's empty or needs more space), `fail_page_alloc` would catch it. The reproducer, as I examined it, didn't seem to pre-allocate objects for `rpc_buffer_slabp` *before* enabling `fail_page_alloc`. This explained why `rpc_malloc` failed in the reproducer's context and the bug didn't manifest.

The solution, then, became clear: I needed to ensure that `rpc_buffer_slabp` had its objects pre-allocated *before* `fail_page_alloc` was activated. This would guarantee that `rpc_malloc` would succeed by drawing from the already allocated slab cache. I figured the way to do this would be to create an RPC transport (which allocates `rpc_buffers`), then somehow free those buffers back to the slab cache. This would populate the `rpc_buffer_slabp` free list. The mechanism for freeing a transport seemed to involve writing to `/tmp/nfsd/portlist` with a leading `-`. This would ensure that when `write_ports` is called after enabling `fail_page_alloc`, `rpc_malloc` would not trigger the page allocator failure, leaving `percpu_counter_init` as the sole point of failure for the page allocator, thus triggering the bug.

map[ContextFile:fs/nfsd/nfsctl.c Name:__write_ports]

map[SourceCode: 798:	static ssize_t __write_ports(struct file *file, char *buf, size_t size,
 799:				     struct net *net)
 800:	{
 801:		if (size == 0)
 802:			return __write_ports_names(buf, net);
 803:	
 804:		if (isdigit(buf[0]))
 805:			return __write_ports_addfd(buf, net, file->f_cred);
 806:	
 807:		if (isalpha(buf[0]))
 808:			return __write_ports_addxprt(buf, net, file->f_cred);
 809:	
 810:		return -EINVAL;
 811:	}
 SourceFile:fs/nfsd/nfsctl.c]

gemini-3.1-pro-preview

							input: 134331
							output: 42
							thoughts: 888
						

**My Thought Process Unraveling the NFS Service Creation and Resource Management**

Initially, I was focused on how transports are managed within the NFS service. My first thought was around the `__write_ports` function, but I quickly realized it only supports *adding* transports. This immediately raised the question: how do I remove a transport if needed?

My next hypothesis was that perhaps creating a transport itself would automatically allocate `rpc_buffers` for a pool. However, I then remembered that `rpc_buffers` are actually allocated on a per-RPC request basis, not per transport. This shifted my focus to understanding *when* these `rpc_malloc` calls actually occur.

By tracing the calls, I discovered that `rpc_malloc` is invoked from `call_allocate`, which is itself called when an RPC request is being sent. This led me to a crucial observation: `svc_bind` actually calls `rpcb_create_local`. And what does `rpcb_create_local` do? It sends an RPC request to the *local rpcbind*!

Digging deeper into the call stack (`rpcb_create_local` -> `svc_unregister` -> `svc_bind`), I confirmed that `svc_bind` indeed sends an RPC request specifically to unregister the service from rpcbind. This means that *every time* `svc_bind` is called, an `rpc_buffer` is allocated to facilitate this unregistration request. Critically, when this RPC request completes, the `rpc_buffer` is then freed.

This realization was a breakthrough. If I could trigger `nfsd_create_serv` (for instance, by writing to the `portlist` file), it would in turn call `svc_bind`. `svc_bind` would then send an RPC request, allocate an `rpc_buffer`, and immediately free it upon completion. This sequence means the `rpc_buffer` would inevitably end up in the slab cache's free list, ready for reuse.

To solidify this, I mentally walked through the process of writing `tcp 2049` to `portlist`:
1. `nfsd_create_serv` is invoked, setting up the service and calling `svc_bind`.
2. `svc_bind` initiates an RPC request via `svc_unregister`.
3. `rpc_malloc` allocates an `rpc_buffer` for this request.
4. Upon the RPC request's completion, `rpc_free` reclaims the `rpc_buffer`.
5. The `rpc_buffer` now resides in the slab cache's free list.
6. Subsequently, `svc_xprt_create` is called to establish the TCP transport.
7. The transport is successfully created and associated with the service.

However, the path to triggering the *actual bug* required a second call to `nfsd_create_serv`. My next hurdle was realizing that if the service already exists, `nfsd_create_serv` simply returns `0` immediately, skipping the call to `__svc_create` and thus preventing `percpu_counter_init` from being called. This meant I had to find a way to *destroy* the existing service before attempting to recreate it.

My attention then turned to how a service is destroyed. I recalled that `nfsd_destroy_serv` is invoked when the last transport is closed *and* there are no active threads. This led me back to `__write_ports_addxprt`, where I found a crucial error handling path:
```c
out_err:
	if (!serv->sv_nrthreads && list_empty(&nn->nfsd_serv->sv_permsocks))
		nfsd_destroy_serv(net);
```
This snippet showed me that if an error occurs during the addition of a transport, and there are no threads and no persistent sockets, `nfsd_destroy_serv` is called. This was the key to destroying the service.

Now, I needed to engineer a failure in `svc_xprt_create`. I considered a few scenarios:
*   Writing `tcp 0` or `tcp 99999` to `portlist` would fail early due to invalid port numbers (`< 1` or `> USHRT_MAX`).
*   A more interesting case was writing `rdma 2049`. If RDMA support isn't present, `svc_xprt_create` would return an error like `-EPROTONOSUPPORT` or `-ENOENT`.

Any of these failures would lead to the `out_err` path, triggering `nfsd_destroy_serv` and clearing the service. My final step was to verify if `nfsd_destroy_serv` indeed properly cleans up the service, which was the prerequisite for re-entering the vulnerable code path.

map[ContextFile:fs/nfsd/nfsctl.c Name:nfsd_destroy_serv]

map[SourceCode: 498:	/**
 499:	 * nfsd_destroy_serv - tear down NFSD's svc_serv for a namespace
 500:	 * @net: network namespace the NFS service is associated with
 501:	 */
 502:	void nfsd_destroy_serv(struct net *net)
 503:	{
 504:		struct nfsd_net *nn = net_generic(net, nfsd_net_id);
 505:		struct svc_serv *serv = nn->nfsd_serv;
 506:	
 507:		lockdep_assert_held(&nfsd_mutex);
 508:	
 509:		spin_lock(&nfsd_notifier_lock);
 510:		nn->nfsd_serv = NULL;
 511:		spin_unlock(&nfsd_notifier_lock);
 512:	
 513:		/* check if the notifier still has clients */
 514:		if (atomic_dec_return(&nfsd_notifier_refcount) == 0) {
 515:			unregister_inetaddr_notifier(&nfsd_inetaddr_notifier);
 516:	#if IS_ENABLED(CONFIG_IPV6)
 517:			unregister_inet6addr_notifier(&nfsd_inet6addr_notifier);
 518:	#endif
 519:		}
 520:	
 521:		/*
 522:		 * write_ports can create the server without actually starting
 523:		 * any threads.  If we get shut down before any threads are
 524:		 * started, then nfsd_destroy_serv will be run before any of this
 525:		 * other initialization has been done except the rpcb information.
 526:		 */
 527:		svc_xprt_destroy_all(serv, net, true);
 528:		nfsd_shutdown_net(net);
 529:		svc_destroy(&serv);
 530:	}
 SourceFile:fs/nfsd/nfssvc.c]

gemini-3.1-pro-preview

							input: 135811
							output: 40
							thoughts: 2327
						

**The Path to Exploiting the Per-CPU Memory Allocation Vulnerability in NFS**

My goal here is to unravel the intricate sequence of events that leads to a specific vulnerability, and I believe I've pieced it together. The core of the problem lies in how per-CPU memory is managed, particularly when coupled with RPC buffer allocations.

Initially, I focused on the `nfsd_destroy_serv` function. I saw that it zeros out `nn->nfsd_serv` and then proceeds to call `svc_destroy(&serv)`. This gave me a starting point for thinking about how to trigger a state where we might have pre-allocated `rpc_buffers` and then subsequently hit a bug.

The proposed sequence began with writing `rdma 2049` to `portlist`. This action, I understood, would trigger `nfsd_create_serv`, which in turn calls `svc_bind`. During `svc_bind`, an RPC request is initiated, and crucially, this request allocates an `rpc_buffer` by invoking the page allocator. The subsequent completion of this RPC request then frees that `rpc_buffer` back to its slab cache. The next step in this initial path was `svc_xprt_create` being called for `rdma`. I anticipated this would fail, perhaps because RDMA isn't loaded or supported, or we could simulate this failure using a transport name like `fake 2049`. My reasoning was that `__write_ports_addxprt` checks the first character of the buffer for `isalpha`, meaning `fake 2049` would be considered valid syntax. The expected failure from `svc_xprt_create` with `-ENOENT` (due to a missing `svcfake` module) would lead `__write_ports_addxprt` to call `nfsd_destroy_serv` via the `out_err` path. This would effectively destroy the service and set `nn->nfsd_serv` to NULL.

At this point, the critical insight was that the `rpc_buffers` slab cache would now have at least one free object. This pre-allocated buffer was key. The next phase involved exhausting per-CPU memory. I planned to achieve this using BPF maps, specifically by creating `BPF_MAP_TYPE_PERCPU_ARRAY` maps of progressively smaller sizes until their `max_entries` reached zero, thereby filling all per-CPU memory.

With the slab cache primed and per-CPU memory full, the final trigger was to write `tcp 2049` to `portlist`. This would again call `nfsd_create_serv` and then `__svc_create`. Inside `__svc_create`, `percpu_counter_init` would be invoked. This function then calls `__alloc_percpu_gfp` to attempt a per-CPU memory allocation. My initial thought was that since per-CPU memory was full, `__alloc_percpu_gfp` would try to allocate a new chunk, which would, in turn, call the page allocator. If this succeeded, `percpu_counter_init` would also succeed. However, this was precisely the opposite of what I wanted; I needed it to *fail*.

This realization led to a crucial refinement: I absolutely *needed* the page allocation to fail. This is where `fail_page_alloc` came into play. My initial concern was that `fail_page_alloc` would also cause `rpc_malloc` to fail. But then I remembered: `rpc_malloc` ultimately relies on `kmem_cache_alloc`. If the `rpc_buffers` slab cache already has a free object (which it does from step 1), `kmem_cache_alloc` will retrieve it directly and *will not* call the page allocator. Therefore, `fail_page_alloc` would not intercept the `rpc_malloc` call in this scenario. This was the missing piece of the puzzle.

So, the refined and complete sequence emerged:

1.  **Pre-allocate `rpc_buffer`:** Write `fake 2049` to `portlist`. This initiates `nfsd_create_serv`, calls `svc_bind` which allocates and then frees an `rpc_buffer`, and then `svc_xprt_create` fails. `nfsd_destroy_serv` cleans up, leaving a free `rpc_buffer` object in the slab.
2.  **Exhaust Per-CPU Memory:** Use BPF maps to create per-CPU arrays of diminishing size until they are full. This ensures that any subsequent per-CPU allocation attempt will need to create a new chunk, thus requiring a page allocation.
3.  **Enable Page Allocation Failure:** Set `fail_page_alloc` for the current task by writing `1` to `/proc/self/make-it-fail`.
4.  **Trigger the Vulnerability:** Write `tcp 2049` to `portlist`.
    *   `nfsd_create_serv` is called, leading to `__svc_create` and then `percpu_counter_init`.
    *   `__alloc_percpu_gfp` is called. Since the current per-CPU chunks are full, it attempts to create a new chunk via `pcpu_create_chunk`, which calls the page allocator.
    *   `fail_page_alloc` intercepts this page allocation and makes it fail.
    *   `__alloc_percpu_gfp` returns NULL, and `percpu_counter_init` returns `-ENOMEM`.
    *   `__svc_create` proceeds, and importantly, `nfsd_create_serv` continues by calling `svc_bind`.
    *   `svc_bind` calls `rpc_malloc`. Because the `rpc_buffers` slab cache has a free object from step 1, `kmem_cache_alloc` succeeds without invoking the page allocator.
    *   `svc_bind` successfully completes.
    *   `__write_ports_addxprt` proceeds to create the TCP transport.
    *   This leads to `svc_xprt_enqueue` and subsequently `percpu_counter_inc(&pool->sp_sockets_queued)`.
    *   The `percpu_counter_inc` function dereferences `pool->sp_sockets_queued.counters`. Since `pool->sp_sockets_queued.counters` is NULL (because the earlier per-CPU allocation failed), this dereference triggers the crash – the bug is now successfully triggered!

I have also verified that `pcpu_create_chunk` uses `GFP_KERNEL`, which is subject to `fail_page_alloc` when `__GFP_DIRECT_RECLAIM` is present, as it is here. Similarly, `rpc_malloc` with `GFP_KERNEL` would normally be intercepted by `fail_page_alloc`, but this is circumvented by the pre-allocated `rpc_buffer` object from the slab. The reproducer output confirming the interception of `allocate_slab` and `kmem_cache_alloc` further solidifies this understanding. The logic seems sound and perfectly explains the observed behavior.

log-in to see details

map[ContextFile:fs/nfsd/nfssvc.c Name:nfsd_bind]

map[SourceCode: SourceFile:]

gemini-3.1-pro-preview

							input: 138183
							output: 29
							thoughts: 24
						

**My Thought Process on `pg_bind` in `fs/nfsd/nfssvc.c`**

Alright, my first instinct is to dive right into the code. I need to understand how this `pg_bind` function is being used, and the most direct way to do that is to see its context. So, I'm initiating a search specifically for the string `pg_bind` within the `fs/nfsd/nfssvc.c` file. This is a targeted approach to quickly identify all the locations where this particular symbol or function is referenced. My goal is to find the actual implementation of `pg_bind` and, equally importantly, to see how it's being called and what arguments are being passed to it. This will give me immediate insight into its purpose and how it fits into the broader NFS server functionality handled by `nfssvc.c`.

log-in to see details

map[Expression:pg_bind PathPrefix:fs/nfsd/]

map[Output:]

gemini-3.1-pro-preview

							input: 138234
							output: 40
							thoughts: 11
						

**My Thought Process Regarding `nfsd_programs`**

My initial reaction upon encountering the `nfsd_programs` definition was one of immediate curiosity, bordering on a slight pause for clarification. It's not a term that immediately springs to mind as a standard, universally recognized component within the NFS (Network File System) ecosystem, at least not in the way that terms like "NFS server," "NFS client," or "NFS protocol" are.

Therefore, my internal thought process immediately shifted to understanding its context and purpose. My first question was: *What exactly *is* `nfsd_programs`?* Is it a specific implementation detail within a particular NFS server daemon? Is it a configuration directive? Is it an internal data structure used by the NFS server process itself?

Given my expertise, I know that NFS servers, particularly the Linux `nfsd` kernel daemon, are complex. They manage various aspects of NFS operations, from handling incoming RPC (Remote Procedure Call) requests to interacting with the underlying filesystem and managing client connections. Within such a system, there are naturally internal "programs" or modules that handle distinct functionalities. These could be responsible for specific NFS versions (v3, v4), different RPC services (mount, nfs, lockd, statd), or even internal optimizations and bookkeeping.

So, my immediate assumption would be that `nfsd_programs` likely refers to a collection or enumeration of these distinct functional units or RPC services that the `nfsd` daemon is configured to support or is actively running. It's the set of "programs" that the NFS server exposes and manages.

My next line of thought would be to consider *why* this definition is relevant. Is it for:

*   **Configuration:** To specify which NFS services should be enabled or disabled?
*   **Monitoring:** To track the status or resource usage of specific NFS services?
*   **Development/Debugging:** To understand the internal architecture or troubleshoot issues related to specific NFS functionalities?
*   **Security:** To control which RPC services are exposed to the network?

The "definition" itself, implying a structured description, suggests it's something that can be queried, manipulated, or at least understood structurally. It's a way to abstract and manage the diverse set of services that constitute a fully functional NFS server.

In essence, my thought process is one of dissecting the term, placing it within the known architecture of NFS, and then inferring its likely purpose and implications based on the inherent complexity and operational requirements of an NFS server. It's a moment of acknowledging a specific, potentially internal, abstraction that aids in managing the multifaceted nature of the NFS server process.

map[ContextFile:fs/nfsd/nfssvc.c Name:nfsd_programs]

map[SourceCode: 107:	struct svc_program		nfsd_programs[] = {
 108:		{
 109:		.pg_prog		= NFS_PROGRAM,		/* program number */
 110:		.pg_nvers		= NFSD_MAXVERS+1,	/* nr of entries in nfsd_version */
 111:		.pg_vers		= nfsd_version,		/* version table */
 112:		.pg_name		= "nfsd",		/* program name */
 113:		.pg_class		= "nfsd",		/* authentication class */
 114:		.pg_authenticate	= svc_set_client,	/* export authentication */
 115:		.pg_init_request	= nfsd_init_request,
 116:		.pg_rpcbind_set		= nfsd_rpcbind_set,
 117:		},
 118:	#if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL)
 119:		{
 120:		.pg_prog		= NFS_ACL_PROGRAM,
 121:		.pg_nvers		= NFSD_ACL_NRVERS,
 122:		.pg_vers		= nfsd_acl_version,
 123:		.pg_name		= "nfsacl",
 124:		.pg_class		= "nfsd",
 125:		.pg_authenticate	= svc_set_client,
 126:		.pg_init_request	= nfsd_acl_init_request,
 127:		.pg_rpcbind_set		= nfsd_acl_rpcbind_set,
 128:		},
 129:	#endif /* defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL) */
 130:	#if IS_ENABLED(CONFIG_NFS_LOCALIO)
 131:		{
 132:		.pg_prog		= NFS_LOCALIO_PROGRAM,
 133:		.pg_nvers		= NFSD_LOCALIO_NRVERS,
 134:		.pg_vers		= localio_versions,
 135:		.pg_name		= "nfslocalio",
 136:		.pg_class		= "nfsd",
 137:		.pg_authenticate	= svc_set_client,
 138:		.pg_init_request	= svc_generic_init_request,
 139:		.pg_rpcbind_set		= svc_generic_rpcbind_set,
 140:		}
 141:	#endif /* CONFIG_NFS_LOCALIO */
 142:	};
 SourceFile:fs/nfsd/nfssvc.c]

gemini-3.1-pro-preview

							input: 139016
							output: 35
							thoughts: 23
						

**My Realization about `svc_bind` and `pg_bind`**

Ah, I've just had a moment of clarity regarding the service binding mechanism. It seems my initial assumption was that there's a dedicated `pg_bind` function, much like `svc_bind`, that handles the low-level binding operations, perhaps with some PostgreSQL-specific nuances. However, upon deeper inspection (or perhaps a thorough mental walk-through of the code), I'm realizing that this isn't the case. There is no `pg_bind` function to be found. This means my entire understanding of how `svc_bind` interacts with the underlying binding layer needs to be re-evaluated. It's now evident to me that when `svc_bind` is invoked, it doesn't delegate to a separate `pg_bind`. Instead, it directly calls `svc_unregister`. This is a significant simplification, and frankly, a bit of a surprise. It implies that the "binding" aspect, at least from the perspective of this specific `svc_bind` call, is effectively managed or perhaps even *concluded* by the unregistration process. This fundamentally alters how I'm thinking about the lifecycle and purpose of these functions, suggesting that perhaps the "binding" is more of a conceptual stage that is immediately followed by, or inherently includes, the act of unregistering from whatever service it was interacting with.

map[ContextFile:net/sunrpc/svc.c Name:svc_bind]

map[SourceCode: 458:	int svc_bind(struct svc_serv *serv, struct net *net)
 459:	{
 460:		if (!svc_uses_rpcbind(serv))
 461:			return 0;
 462:		return svc_rpcb_setup(serv, net);
 463:	}
 SourceFile:net/sunrpc/svc.c]

gemini-3.1-pro-preview

							input: 139173
							output: 38
							thoughts: 16
						

**A Deep Dive into the Service Registration Flow**

So, my initial mental model was that `svc_bind` was primarily responsible for the low-level network binding process, establishing the connection point for a given RPC service. However, as I trace the execution further, I'm realizing that my understanding needs refinement. It appears that `svc_bind` doesn't just stop at the network socket level. Instead, it has a direct dependency on `svc_rpcb_setup`. This is a crucial realization for me. It means that `svc_bind` isn't just about *making* the service available on a port; it's also intrinsically linked to the process of *registering* that service with the RPC Binder service.

My thought process here is moving from a purely connection-oriented view to one that encompasses the entire RPC service discovery mechanism. The fact that `svc_bind` *calls* `svc_rpcb_setup` implies a tightly coupled relationship. It suggests that as soon as we're setting up the bind for a service, we *must* also be ensuring it's registered with the RPCB. This makes a lot of sense from a functional perspective – what good is a service bound to a port if no one knows where to find it? The RPCBinder is the directory service, and `svc_rpcb_setup` is the act of adding an entry to that directory.

This revelation prompts me to re-evaluate the responsibilities within the RPC library. I'm now seeing `svc_bind` not just as a socket wrapper, but as a higher-level constructor that orchestrates both the network availability *and* the discoverability of the service through the RPCBinder. This implies that if `svc_rpcb_setup` fails, `svc_bind` should likely also fail, as the service, while potentially listening on a port, wouldn't be discoverable by clients relying on the Binder. This connection is a significant piece of the puzzle for understanding the robustness and interdependencies within the RPC framework.

map[ContextFile:net/sunrpc/svc.c Name:svc_rpcb_setup]

map[SourceCode: 421:	static int svc_rpcb_setup(struct svc_serv *serv, struct net *net)
 422:	{
 423:		int err;
 424:	
 425:		err = rpcb_create_local(net);
 426:		if (err)
 427:			return err;
 428:	
 429:		/* Remove any stale portmap registrations */
 430:		svc_unregister(serv, net);
 431:		return 0;
 432:	}
 SourceFile:net/sunrpc/svc.c]

gemini-3.1-pro-preview

							input: 139387
							output: 42
							thoughts: 19
						

**My Thought Process on `rpcb_create_local`**

So, I've encountered this function, `rpcb_create_local`, and my immediate interpretation is that its primary purpose is to establish a connection, specifically an RPC client, that will interact with the *local* instance of the `rpcbind` service. This isn't about reaching out to some remote `rpcbind` daemon; it's entirely focused on the `rpcbind` that's running on the very machine I'm currently operating on. This implies that the function is designed to handle local inter-process communication, leveraging the `rpcbind` service to facilitate that. I'm thinking this is likely a foundational step for any client that needs to discover or communicate with RPC services available *within* the local system, without the overhead or complexity of network-based RPC setup.

map[ContextFile:net/sunrpc/rpcb_clnt.c Name:rpcb_create_local]

map[SourceCode: 341:	/*
 342:	 * Returns zero on success, otherwise a negative errno value
 343:	 * is returned.
 344:	 */
 345:	int rpcb_create_local(struct net *net)
 346:	{
 347:		static DEFINE_MUTEX(rpcb_create_local_mutex);
 348:		int result = 0;
 349:	
 350:		if (rpcb_get_local(net))
 351:			return result;
 352:	
 353:		mutex_lock(&rpcb_create_local_mutex);
 354:		if (rpcb_get_local(net))
 355:			goto out;
 356:	
 357:		if (rpcb_create_local_abstract(net) != 0 &&
 358:		    rpcb_create_local_unix(net) != 0)
 359:			result = rpcb_create_local_net(net);
 360:	
 361:	out:
 362:		mutex_unlock(&rpcb_create_local_mutex);
 363:		return result;
 364:	}
 SourceFile:net/sunrpc/rpcb_clnt.c]

gemini-3.1-pro-preview

							input: 139792
							output: 35
							thoughts: 100
						

**My Thought Process Regarding `rpcb_get_local` and `rpcb_create_local` in the `nfsd_create_serv` Path**

Okay, let me walk through this. My primary concern here is understanding the behavior of `rpcb_get_local(net)` and its interaction with `rpcb_create_local` within the context of `nfsd_create_serv`.

The first thing I notice is this observation: "If `rpcb_get_local(net)` is not NULL, it returns 0 immediately!" This is a critical piece of information. It tells me that `rpcb_get_local` isn't just a passive retrieval function; it has conditional execution that can short-circuit further processing.

Then, the clarification comes: "`rpcb_get_local` returns the existing rpcbind client for the net namespace." This is the key insight. It's not just checking for *any* rpcbind client, but specifically the one associated with the given `net` namespace. This implies that a net namespace can have its own distinct rpcbind client.

Now, connecting this to the scenario: "If we already created the rpcbind client (e.g. by a previous call to `nfsd_create_serv`), `rpcb_create_local` will return 0 immediately without allocating anything!" This is the logical consequence of the previous two points. If `rpcb_get_local` finds an *existing* client for the `net` namespace (meaning it was created by a prior `nfsd_create_serv` call for that same namespace), then `rpcb_create_local` – which is presumably the function responsible for the actual creation and allocation – will detect this existing client and, in effect, do nothing. It correctly returns `0`, indicating success without the need for a new allocation. This is an optimization; we don't want to duplicate resources.

Finally, the observation about `svc_unregister` being called. This seems to be the action that follows the successful (and potentially no-op) `rpcb_create_local` call. It suggests that after ensuring an rpcbind client is available for the net namespace, the system proceeds to unregister some service, likely the NFS service itself, from the rpcbind system. This might be part of a cleanup or re-initialization sequence, or perhaps a graceful shutdown phase. The immediate return from `rpcb_get_local` and `rpcb_create_local` means that `svc_unregister` is reached very efficiently if an rpcbind client is already present.

map[ContextFile:net/sunrpc/svc.c Name:svc_unregister]

map[SourceCode:1278:	/*
1279:	 * All netids, bind addresses and ports registered for [program, version]
1280:	 * are removed from the local rpcbind database (if the service is not
1281:	 * hidden) to make way for a new instance of the service.
1282:	 *
1283:	 * The result of unregistration is reported via dprintk for those who want
1284:	 * verification of the result, but is otherwise not important.
1285:	 */
1286:	static void svc_unregister(const struct svc_serv *serv, struct net *net)
1287:	{
1288:		struct sighand_struct *sighand;
1289:		unsigned long flags;
1290:		unsigned int p, i;
1291:	
1292:		clear_thread_flag(TIF_SIGPENDING);
1293:	
1294:		for (p = 0; p < serv->sv_nprogs; p++) {
1295:			struct svc_program *progp = &serv->sv_programs[p];
1296:	
1297:			for (i = 0; i < progp->pg_nvers; i++) {
1298:				if (progp->pg_vers[i] == NULL)
1299:					continue;
1300:				if (progp->pg_vers[i]->vs_hidden)
1301:					continue;
1302:				__svc_unregister(net, progp->pg_prog, i, progp->pg_name);
1303:			}
1304:		}
1305:	
1306:		rcu_read_lock();
1307:		sighand = rcu_dereference(current->sighand);
1308:		spin_lock_irqsave(&sighand->siglock, flags);
1309:		recalc_sigpending();
1310:		spin_unlock_irqrestore(&sighand->siglock, flags);
1311:		rcu_read_unlock();
1312:	}
 SourceFile:net/sunrpc/svc.c]

gemini-3.1-pro-preview

							input: 140493
							output: 36
							thoughts: 13
						

**The Interplay of RPC Service Registration and Unregistration**

My understanding here is about the mechanics of how services are managed within the Remote Procedure Call (RPC) system, specifically focusing on the `__svc_unregister` function. I've noted that this particular function, when invoked, doesn't directly handle the unregistration process itself. Instead, its responsibility is to delegate that task, or a significant part of it, to another function: `rpcb_register`.

This implies a layered approach to service management. The `__svc_register` function, presumably the counterpart to `__svc_unregister`, would likely be the one initiating the registration process. However, the observed behavior of `__svc_unregister` points to `rpcb_register` as the central authority or mechanism for managing the RPC binding database. It's reasonable to infer that `rpcb_register` is the function that actually performs the removal of a service's registration entries from this database.

Therefore, when I see `__svc_unregister` calling `rpcb_register`, my thought process connects this to the broader RPC infrastructure. `__svc_unregister` acts as a higher-level API or a specific component's interface for signaling its intent to disconnect. `rpcb_register`, on the other hand, is likely the lower-level, core function responsible for manipulating the underlying RPC binding information. This separation of concerns is typical in system design, allowing for cleaner interfaces and more modular implementations. My task, as an expert in this domain, is to recognize this delegation and understand its implications for how services are dynamically added and removed from the RPC environment. It suggests that the persistent state of service registrations is managed by `rpcb_register`, and other parts of the system simply interact with it through specific entry points like `__svc_unregister`.

map[ContextFile:net/sunrpc/svc.c Name:__svc_unregister]

map[SourceCode:1254:	/*
1255:	 * If user space is running rpcbind, it should take the v4 UNSET
1256:	 * and clear everything for this [program, version].  If user space
1257:	 * is running portmap, it will reject the v4 UNSET, but won't have
1258:	 * any "inet6" entries anyway.  So a PMAP_UNSET should be sufficient
1259:	 * in this case to clear all existing entries for [program, version].
1260:	 */
1261:	static void __svc_unregister(struct net *net, const u32 program, const u32 version,
1262:				     const char *progname)
1263:	{
1264:		int error;
1265:	
1266:		error = rpcb_v4_register(net, program, version, NULL, "");
1267:	
1268:		/*
1269:		 * User space didn't support rpcbind v4, so retry this
1270:		 * request with the legacy rpcbind v2 protocol.
1271:		 */
1272:		if (error == -EPROTONOSUPPORT)
1273:			error = rpcb_register(net, program, version, 0, 0);
1274:	
1275:		trace_svc_unregister(progname, version, error);
1276:	}
 SourceFile:net/sunrpc/svc.c]

gemini-3.1-pro-preview

							input: 140934
							output: 39
							thoughts: 1684
						

**My Thought Process on Reproducing the Bug**

Okay, let me walk through my reasoning here. I'm trying to understand how to reliably trigger a specific bug, and it seems to be related to memory allocation failures.

First, I recall that `rpcb_v4_register` and `rpcb_register` both involve sending RPC requests, and crucial to that is the allocation of an `rpc_buffer`. I had a fleeting thought that `rpcb_v4_register` *sends* an RPC request, which is correct, but the key takeaway is that it needs that `rpc_buffer`.

Now, the scenario where things go wrong: if `fail_page_alloc` is enabled, and importantly, if `rpc_buffer_slabp` is empty, then `rpc_malloc` (which is used to get `rpc_buffer`s) is going to fail. This is because `rpc_malloc` will attempt to get memory from the slab cache (`rpc_buffer_slabp`), and if it's empty, it will fall back to the page allocator. If `fail_page_alloc` is active, that page allocation will fail, leading to `rpc_malloc` failing.

But, and this is where the idea for a fix emerges, if I can pre-allocate `rpc_buffer_slabp` *before* enabling `fail_page_alloc`, then `rpc_buffer_slabp` will have free objects. This means when `rpc_malloc` is called, it can grab a pre-allocated object from the slab cache.

Let's re-examine the sequence. I see that `rpcb_v4_register` actually allocates an `rpc_buffer`, uses it to send the request, and then *frees* it. This means the `rpc_buffer` is returned to the slab cache. So, if I can arrange for there to be a free `rpc_buffer` in the slab cache, and *then* trigger the failure condition, things might play out differently.

Now, let's consider the reproduder's initial sequence of events. It's creating a large number of BPF maps, specifically `BPF_MAP_TYPE_PERCPU_ARRAY`. The reproducer is failing with `EMFILE`, which means it's hitting the `RLIMIT_NOFILE` limit and hasn't actually managed to exhaust per-CPU memory. It only created about 1024 maps. At 32KB per entry, that's 32MB of per-CPU memory. My internal knowledge tells me per-CPU memory can grow significantly larger, perhaps up to a few hundred MBs. So, 32MB isn't enough to exhaust it.

If per-CPU memory isn't exhausted, then `__alloc_percpu_gfp` within `percpu_counter_init` wouldn't need to call the page allocator. It would likely succeed by just using existing memory or a smaller allocation. If `__alloc_percpu_gfp` succeeds, then `percpu_counter_init` also succeeds. And if `percpu_counter_init` succeeds, then `pool->sp_sockets_queued` gets initialized correctly, and the bug that I'm trying to trigger simply doesn't manifest.

So, the reproducer's failure to trigger the bug seems to stem from two interconnected issues:
1. It hit `EMFILE` and thus failed to exhaust the per-CPU memory pool.
2. Because the per-CPU memory wasn't exhausted, `percpu_counter_init` succeeded.
3. Consequently, the bug condition wasn't met.

But wait, the reproducer *output* shows `rpc_malloc` failing: `[ 223.395668][ T5901] rpc_malloc+0xeb/0x260`. Why would `rpc_malloc` fail if per-CPU memory wasn't exhausted? Ah, it must be because `fail_page_alloc` *was* enabled, and at that point, `rpc_buffer_slabp` *was* empty, forcing `rpc_malloc` to the page allocator, which then failed.

If `rpc_malloc` failed, then `svc_bind` would fail, and `nfsd_create_serv` would return an error. This means `write_ports` would fail, and consequently, `svc_xprt_create` would *never even be called*.

So, the bug was not triggered for *two distinct reasons*:
1. `percpu_counter_init` succeeded because per-CPU memory wasn't exhausted.
2. `svc_bind` failed because `rpc_buffer_slabp` was empty and `fail_page_alloc` intervened.

To *actually* trigger the bug, I need to address both these conditions:
1. I must exhaust the per-CPU memory pool. This will force `percpu_counter_init` to call the page allocator and fail.
2. I must pre-allocate `rpc_buffer_slabp`. This will ensure that `rpc_malloc` does *not* call the page allocator when needed, and thus succeeds.

Let's think about the sequence again, refining it.

**Step 1: Pre-allocate `rpc_buffer_slabp`**
How can I do this? A simple way is to write to `/tmp/nfsd/portlist`. This action will trigger `nfsd_create_serv`, which in turn calls `svc_bind`. `svc_bind` will call `rpcb_v4_register`. As I noted earlier, `rpcb_v4_register` allocates an `rpc_buffer`, uses it, and then frees it. This leaves a free `rpc_buffer` object in the slab cache. Then, `svc_xprt_create` will fail because "fake" isn't a valid transport, and `nfsd_destroy_serv` will be called, cleaning up. The critical outcome here is that the slab cache for `rpc_buffer`s is now populated with at least one free object.

**Step 2: Exhaust per-CPU memory**
To do this effectively and avoid the `EMFILE` problem, I need to increase the `RLIMIT_NOFILE`. I'll set it to a high value, say 100000.
```c
    struct rlimit rlim = { .rlim_cur = 100000, .rlim_max = 100000 };
    setrlimit(RLIMIT_NOFILE, &rlim);
```
Then, I'll repeatedly create `BPF_MAP_TYPE_PERCPU_ARRAY` maps using `bpf(BPF_MAP_CREATE, ...)` in a loop. I'll keep doing this until `bpf()` returns `-ENOMEM`, indicating that I've exhausted the available per-CPU memory.
```c
    while (1) {
        union bpf_attr attr = {
            .map_type = BPF_MAP_TYPE_PERCPU_ARRAY,
            .key_size = 4,
            .value_size = 32768,
            .max_entries = 1,
        };
        int fd = syscall(__NR_bpf, BPF_MAP_CREATE, &attr, sizeof(attr));
        if (fd < 0) {
            break; // Exhausted!
        }
    }
```
Now, the question is, when per-CPU memory is exhausted, does `pcpu_create_chunk` actually fail? Yes, it does. It will try to allocate a new chunk. If it fails to allocate that chunk (e.g., due to lack of vmalloc space or general memory pressure), or if `pcpu_populate_chunk` fails (due to lack of normal memory), then `percpu_counter_init` will fail.

My thought process then goes to the consequence of per-CPU memory exhaustion. If normal memory is also scarce, then `kmalloc` could fail. This is important because `svc_xprt_create` itself might need to allocate memory for the transport layer, like for TCP. I'll need to keep this in mind as I check `svc_xprt_create`'s internal calls, like `svc_xprt_create_from_sa` and `_svc_xprt_create`, and the underlying transport creation function (e.g., `svc_tcp_create` for TCP).

With these two conditions met – pre-allocated `rpc_buffer_slabp` and exhausted per-CPU memory – `rpc_malloc` should succeed (because it uses the pre-allocated slab object), `svc_bind` should succeed, and then `svc_xprt_create` should proceed, hitting the actual bug. This refined sequence seems to cover all the failure points I've identified.

map[ContextFile:net/sunrpc/svcsock.c Name:svc_tcp_create]

map[SourceCode:1328:	static struct svc_xprt *svc_tcp_create(struct svc_serv *serv,
1329:					       struct net *net,
1330:					       struct sockaddr *sa, int salen,
1331:					       int flags)
1332:	{
1333:		return svc_create_socket(serv, IPPROTO_TCP, net, sa, salen, flags);
1334:	}
 SourceFile:net/sunrpc/svcsock.c]

gemini-3.1-pro-preview

							input: 142783
							output: 39
							thoughts: 10
						

**My Thought Process on `svc_create_socket`**

So, I'm looking at `svc_create_socket` here, and the very first thing that jumps out at me is that it's an allocation function. My mind immediately goes to the implications of that: memory management. This isn't just a simple pointer dereference or a bit of logical manipulation; it's about carving out a piece of memory from the heap, or perhaps some other managed pool, to hold the socket's internal state or data structures.

This immediately triggers a cascade of considerations for someone like me, who lives and breathes systems programming. What kind of memory is being allocated? Is it a fixed size, or does it vary depending on the socket type or configuration? Are there any potential for memory leaks if this allocation fails or if the returned handle isn't properly deallocated? What's the expected lifetime of this allocated memory? Is it tied to the socket object's lifecycle, or is there a separate cleanup mechanism?

Furthermore, I'm thinking about the performance characteristics. Memory allocation can be a relatively expensive operation. If `svc_create_socket` is called frequently in a tight loop or under heavy load, that overhead could become a significant bottleneck. Is this allocation optimized? Is it using a fast allocator, or is it something more general-purpose?

And then there's the error handling. What happens if the allocation fails? Does it return `NULL`, or does it throw an exception? How is that failure communicated back to the caller? For a function that's so fundamental to establishing communication, a failed allocation at this stage is a pretty critical failure, so the error reporting mechanism needs to be robust and clear.

I'm also mentally sketching out the data structure that's likely being allocated. It's going to contain all the necessary information to represent and manage this network endpoint – things like file descriptors, protocol information, address structures, buffering mechanisms, and potentially state flags. The size of this allocation is directly tied to the complexity of the socket abstraction being provided.

In short, when I see `svc_create_socket` allocates memory, my brain doesn't just register a fact; it unpacks a whole set of interdependencies and potential issues related to resource management, performance, and error handling. It’s the foundational step before any actual network operations can even be contemplated.

map[ContextFile:net/sunrpc/svcsock.c Name:svc_create_socket]

map[SourceCode:1565:	/*
1566:	 * Create socket for RPC service.
1567:	 */
1568:	static struct svc_xprt *svc_create_socket(struct svc_serv *serv,
1569:						  int protocol,
1570:						  struct net *net,
1571:						  struct sockaddr *sin, int len,
1572:						  int flags)
1573:	{
1574:		struct svc_sock	*svsk;
1575:		struct socket	*sock;
1576:		int		error;
1577:		int		type;
1578:		struct sockaddr_storage addr;
1579:		struct sockaddr *newsin = (struct sockaddr *)&addr;
1580:		int		newlen;
1581:		int		family;
1582:	
1583:		if (protocol != IPPROTO_UDP && protocol != IPPROTO_TCP) {
1584:			printk(KERN_WARNING "svc: only UDP and TCP "
1585:					"sockets supported\n");
1586:			return ERR_PTR(-EINVAL);
1587:		}
1588:	
1589:		type = (protocol == IPPROTO_UDP)? SOCK_DGRAM : SOCK_STREAM;
1590:		switch (sin->sa_family) {
1591:		case AF_INET6:
1592:			family = PF_INET6;
1593:			break;
1594:		case AF_INET:
1595:			family = PF_INET;
1596:			break;
1597:		default:
1598:			return ERR_PTR(-EINVAL);
1599:		}
1600:	
1601:		error = __sock_create(net, family, type, protocol, &sock, 1);
1602:		if (error < 0)
1603:			return ERR_PTR(error);
1604:	
1605:		svc_reclassify_socket(sock);
1606:	
1607:		/*
1608:		 * If this is an PF_INET6 listener, we want to avoid
1609:		 * getting requests from IPv4 remotes.  Those should
1610:		 * be shunted to a PF_INET listener via rpcbind.
1611:		 */
1612:		if (family == PF_INET6)
1613:			ip6_sock_set_v6only(sock->sk);
1614:		if (type == SOCK_STREAM)
1615:			sock->sk->sk_reuse = SK_CAN_REUSE; /* allow address reuse */
1616:		error = kernel_bind(sock, (struct sockaddr_unsized *)sin, len);
1617:		if (error < 0)
1618:			goto bummer;
1619:	
1620:		error = kernel_getsockname(sock, newsin);
1621:		if (error < 0)
1622:			goto bummer;
1623:		newlen = error;
1624:	
1625:		if (protocol == IPPROTO_TCP) {
1626:			sk_net_refcnt_upgrade(sock->sk);
1627:			if ((error = kernel_listen(sock, SOMAXCONN)) < 0)
1628:				goto bummer;
1629:		}
1630:	
1631:		svsk = svc_setup_socket(serv, sock, flags);
1632:		if (IS_ERR(svsk)) {
1633:			error = PTR_ERR(svsk);
1634:			goto bummer;
1635:		}
1636:		svc_xprt_set_local(&svsk->sk_xprt, newsin, newlen);
1637:		return (struct svc_xprt *)svsk;
1638:	bummer:
1639:		sock_release(sock);
1640:		return ERR_PTR(error);
1641:	}
 SourceFile:net/sunrpc/svcsock.c]

gemini-3.1-pro-preview

							input: 143938
							output: 39
							thoughts: 1412
						

**My Thought Process on Navigating Memory Allocation Failures in NFS**

This is quite a puzzle I've been wrestling with, aiming to trigger a very specific failure condition within the NFS server's memory allocation mechanisms. My goal is to make `percpu_counter_init` fail when it's trying to allocate per-CPU memory, but *critically*, I don't want `svc_xprt_create` to fail, as that's a different path I'm trying to avoid.

Initially, I recognized that the core functions I'm concerned with, like `__sock_create` and `svc_setup_socket`, both involve memory allocations. If the system is completely out of normal memory, these will simply fail, and that's not the specific behavior I'm after. I need a more nuanced failure.

My initial thought was to use `fail_page_alloc` to force page allocations to fail. However, I quickly realized a crucial detail: `fail_page_alloc` is task-specific. If I enable it for my current task, *all* page allocations performed by my task will fail. This would almost certainly cause `svc_xprt_create` to fail as well, as it's quite likely to need page allocations. That's a deal-breaker.

So, I started thinking about how allocations actually happen. `__sock_create` allocates an inode and a socket. These might come from slab caches. `svc_setup_socket` allocates `svc_sock` using `kzalloc`. My idea was: what if I could pre-allocate these objects *before* I start forcing page allocations to fail? If these objects are already in their respective slab caches, then `kmem_cache_alloc` wouldn't need to call the page allocator, thus bypassing `fail_page_alloc`.

This led me to the idea of creating a full TCP transport *before* enabling `fail_page_alloc`. If I create a TCP transport, it should allocate `svc_sock`, `socket`, `inode`, and all the other necessary bits. Then, I could destroy the service (which I thought I could do by writing `fake 2049` to `portlist`). This would free all those allocated objects back into their slab caches. After that, I'd enable `fail_page_alloc` and then attempt to create another TCP transport by writing `tcp 2049` again. The hope was that `kmem_cache_alloc` would find pre-allocated objects in the slabs and succeed without touching the page allocator.

Then, I considered the `percpu_counter_init` specifically. This function allocates per-CPU memory. My thought was that if I pre-allocate per-CPU memory and then free it, the per-CPU allocator's free list should have space. When `__alloc_percpu_gfp` is called, it would find free space in the per-CPU allocator and *not* call the page allocator. This would mean `percpu_counter_init` would succeed, which is the opposite of what I want.

I dug into the flow: creating a TCP transport (`tcp 2049`) calls `nfsd_create_serv`, which in turn calls `percpu_counter_init`. When the service is destroyed, that per-CPU memory is freed. So, the per-CPU allocator *should* have free space. Then, when I call `nfsd_create_serv` again, `__alloc_percpu_gfp` would reuse that freed space and succeed, completely bypassing the page allocator and `fail_page_alloc`. This means my initial plan of pre-allocating *everything* to avoid page allocation wouldn't work for per-CPU memory.

This is where the strategy had to shift. I realized I couldn't simply pre-allocate per-CPU memory. Instead, I needed to ensure that by the time I enable `fail_page_alloc`, the per-CPU allocator is *exhausted*. My breakthrough came when I considered BPF maps. If I could exhaust per-CPU memory using BPF maps *after* freeing the memory from the initial transport creation, I could leave the per-CPU allocator with absolutely no free space.

So, the refined sequence emerged:

1.  **Create the initial transport:** Write `tcp 2049` to `portlist`. This is crucial. It creates the service, which *does* allocate per-CPU memory, but more importantly for later, it also allocates `rpc_buffer`, `svc_sock`, `socket`, etc.
2.  **Destroy the service:** Write `fake 2049` to `portlist`. This is intended to destroy the service. The per-CPU memory should be freed, and the `rpc_buffer`, `svc_sock`, `socket`, etc., should be returned to their respective slab caches.
3.  **Exhaust per-CPU memory:** This is the critical step. I need to consume *all* available per-CPU memory, including what was just freed. This is where I planned to use BPF maps for this specific purpose. Now, the per-CPU allocator has zero free space.
4.  **Enable `fail_page_alloc`:** Now that I've set the stage, I enable the task-specific page allocation failure.
5.  **Attempt to create the transport again:** Write `tcp 2049` to `portlist`.
    *   `nfsd_create_serv` is called, which calls `__svc_create` and then `percpu_counter_init`.
    *   `__alloc_percpu_gfp` is called. Because I exhausted per-CPU memory in step 3, it finds *no* free space.
    *   It calls `pcpu_create_chunk`, which *must* call the page allocator.
    *   `fail_page_alloc` intercepts this page allocation and *fails* it.
    *   `percpu_counter_init` fails.
    *   `__svc_create` is designed to ignore this specific error, which is perfect.
    *   `svc_bind` is called, which in turn calls `rpc_malloc`.
    *   `rpc_malloc` will try to allocate from `rpc_buffer_slabp`. Since step 2 freed an `rpc_buffer`, this slab cache should have a free object. `kmem_cache_alloc` succeeds without needing the page allocator.
    *   `svc_xprt_create` proceeds. It needs to allocate `socket`, `svc_sock`, etc. Again, step 2 freed these, so `kmem_cache_alloc` finds free objects in their respective slab caches and succeeds without touching the page allocator.
    *   `svc_xprt_create` successfully completes.
    *   *However*, the very next step, `svc_xprt_enqueue`, calls `percpu_counter_inc`. This function *also* uses per-CPU counters, and since `percpu_counter_init` already failed (or rather, its initial allocation failed and was ignored), the per-CPU counter might be in an inconsistent or uninitialized state, or the subsequent operations on it after a failed init will cause a crash. This is the intended crash scenario.

This detailed sequence feels like a masterpiece for triggering this specific failure.

However, as I was re-reading my logic, I hit a snag regarding the service destruction. I was relying on writing `fake 2049` to `portlist` to destroy the service. But looking closely at `__write_ports`, if the service already exists (which it does from step 1), `nfsd_create_serv` simply returns immediately. This means my `fake 2049` write doesn't actually destroy the service. Instead, `__write_ports_addxprt` would attempt to create an `XPRT_FAKE` transport, fail with `-ENOENT`, and then fall into `out_err`. The `out_err` logic checks if `serv->sv_nrthreads` is zero AND if `list_empty(&nn->nfsd_serv->sv_permsocks)` is true to call `nfsd_destroy_serv`. Since the initial `tcp 2049` transport *did* add a socket to `sv_permsocks`, this condition would be false, and `nfsd_destroy_serv` would *not* be called.

This means my initial assumption about how to destroy the service was flawed. I need a way to actually *close* the socket created by `tcp 2049` to ensure the service is truly destroyed and its resources are freed before I proceed. I can't use a negative number like `-tcp 2049` because `__write_ports` doesn't seem to support that syntax for removal. I need to re-examine the `__write_ports` handler to figure out the correct mechanism for removing or closing an existing transport. This is the current roadblock.