Extracting prog: 40m0.212651213s
Minimizing prog: 16m32.086159234s
Simplifying prog options: 0s
Extracting C: 32.557258953s
Simplifying C: 10m0.467142529s


extracting reproducer from 18 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat-write-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4\n', 0x3)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000180)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)

program did not crash
single: failed to extract reproducer
bisect: bisecting 18 programs with base timeout 30s
testing program (duration=34s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 27, 4, 5, 2, 8, 6, 5, 3, 5, 14, 7, 16, 5, 1, 8, 8, 2]
detailed listing:
executing program 1:
mkdir(&(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000100)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='1', 0x1)
mkdir(&(0x7f0000000200)='./config/nvmet/ports/1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='tcp', 0x3)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='ipv4', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='127.0.0.1', 0x9)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='4420', 0x4)
symlinkat(&(0x7f0000000440)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0)
nanosleep(&(0x7f0000000580)={0x0, 0x1dcd6500}, 0x0)
executing program 2:
dup2(0xffffffffffffffff, 0xffffffffffffffff)
bpf$PROG_LOAD(0x5, &(0x7f0000001480)={0xe, 0x4, &(0x7f0000000000)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x4, 0x0, 0xffffffffffffffff, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x94)
r0 = syz_mount_image$fuse(0x0, &(0x7f0000000040)='./file0\x00', 0x20, 0x0, 0x0, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r1 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001440)=ANY=[@ANYBLOB="1c0000005e0021"], 0x1c}}, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)
r4 = socket$inet(0x2, 0x3, 0x1)
sendmsg$inet(r4, &(0x7f0000000080)={&(0x7f0000000000)={0x2, 0x4e23, @multicast2}, 0x10, &(0x7f0000001440)=[{&(0x7f0000000400)='\b', 0x1}, {0x0}, {0x0}, {&(0x7f0000000440)="c05af4e3f781bcd7c4491fad9eda95a65f44c8deae4cd1932feaa04eb07537d02dc7967a5c3b7a7bd1c07a0bd2770e3b1cb0604fe0e142a0c2b0d00c568bfe75374778a73e30bf4d5ba325f703d58c3bc67839bec8f1772a4c22788ee17e0c4550b765f5a8dcfa3975c8bfcb9bfa6e770bb172b2955c71fcfe8a8906455f5ad75bc4e1cdc2bbc2723b01bf34de64213b5b71f151068936b848cab162bbf61e264c338908dd32b210360dfa3219aa444368f8d734af5311d4d8b5d6ca213cef75ba320471761b16c1d057e0d96daf2dd12519571044e971dafbcc0748a3796fae5e7d18d9779c1808a6386b00dd6f6971de0788165fdbf0be0e80620d93c25d8890759eec5f255fe3316f3ccbe2af1aa0f72fcdf586d4f2e35df0a5996bc9349d80c28cd2d2da287237d05ede5f0bf9ac6d34a2bf48acbbfe72ba951b5ac4c7b53fab1f3759382454308d018e125210656b408d9b7cdee2ae73be2ce7d539e9b6fd4adec173412e75463d958a51240ff7e398d85f871eaea1b4b0a97aae4374c4b4dc393e6392c50add6bc7fe224b8a07345153afc0106375bd88db58413fb9bc2e9dd1ac56b71bf36c028a430508e2eab564e2beab0d153476267ca7ed5d0e8c73c9c1d3bdd822261a251f9efd27bc8defdd8bd560af3d07aa6a540ada3097a8e2b03b6630ea797a4f26c2a0f060240e1df314bbb0406716f3dad3214abe2496e9eec19fd093ab02f8ed767f598e90583123457dbd0fbce84420d242ca9b8ba17e3f926994c3df27dcdd5cadc93a8d8dab900edeec32b3adca42ec0e712e3ea616d73994a9c3e3972a222e304ff1e20e8eb54d155c9b55528dd6a8f1306010d0c06023851c39b5a6f7936bcbc16ae048fac6298c0d44d55d60e68b46ff89f53dbf7a13349a01997f622fbb7cf2bc7f9175142c1a1fa53388baae781d8a21c0c24facf992df7f5dbf18e280df2dce7a8035675c9a9dcde16815e4916bc2124d32a11a5a8a9aa6468afc35f218a25cd4193de67c562f2fd521b0a32c64fe57ff1752d0ab4e9023217908699f336ffb6bf319d30241f067a3c24501887e960e867142a7fcf1ed62519e24ee0dedcb8e018c8fc12271f2e26783b7ceb798bb48044b8a3594bc98d3d18c4025f93ff2f86db1bbd54fd752069ddbf4e425ff2738e8eb0bc46a857a043a59e63543c97edaa01dad9eed99709a81f1178c2fc2f3ac7972842ca1ad3bbb7f86c1caa28aa04a0008008e56aa590f1c12969d2cd694f607600b8698fb6736b70c2dbec5eb51f936627261395ce156000c3af84a1641b972be3d954b865344fa6315bc3c8a709a862c02dc487570c12dd17e45ca5519178477ca1329cfdbcc4327a5aa6fe28fd10931cb7a7ae1a94948fb3ba6b0a15c162088f67725dfe9f539b28d78a24fb0885f3369a5806b5ff499de01e4c2e17228b79990eb8058f80c5a0fc5cf458e8678f93cd62565a7fe0297c7c4a195fa4ada1a75565194e049150881a9d76db5bf77d6f329160af56bd6da7cf7942fd46f8aa05062f63c80c2cc80ed02b78415604c4706df1f7f1ac5e21b2e34ba578d88a270890b6f3ebe2c1b9c7adf8e0b89518405ab95c9aa5fbdf7a4c4a6930d6d262cec7f4792f7ea6e3936f9eff24af6102284b3f11965852d1ae4814f1acd361a909f4c3aabf6e21fc4ed2a2e6829990723c800748aaba722a896883abdae6ceb806a468c266164af25672564ea108cc0f95f7e3ef4a03714b029a30e31f06f6c840fc9abdeaf14e343c9ab2af723a25edba7969d239144851c7df46005952c70704aaedf62375febbcb4b2c181c4f0afeca9ec01ed861e26da746ff4563a07a0d4ab9a5730b0004d458d93fdb6b937561ff3585cd2a8c40f1f37b925d63c6b0cbe8f28c4d4659b188d50e3e696c79ecfda7dba2465382de7658fc6ee8a351b24e6bd89addb116c7d1780401c41a7231c8a2f004a2ee030a0949f54489626c7d155cf90e02a8642328e84e4e9a0d3006594dea755976a4af00b142add14f2722ef90e8f775c9edf896874cab792e44b10baad4deb2745667da1b605b75e2b1c4681954c2d1638e663a12e5853dc484fb6ec886ad4e2d0bb73cc37fec291c1a582c85a6a05d6ef076dcbbd5762d41c4268a2e7812ae53a906ae44f03a3740e645cd099e42be9a9e589808093b09d8f05c6f69c4d8a27d7a721188e32f78bd7dd07336473002abc61ea6902191a6339cad9aa067614d112594a9640c83aad57154e77a8eacf81b291ba48d1c431c825ecf36bf2f8ce443fc48fb16b52c7a8773ac786740ea6a4bd3139417554953319bb941d2294af1382106f14de44e1b13cf1fd37ff8551df0e2a46a916492bb54be63fa749f8a7eb1ff1190d0b7b791874438a06e4409e91182c1771f916e1622a52be7600edaff77664c2a597a8840f206dee8144b8bd29e672821a1b9593c3e77da14b2d2b16d775f5de0765d5ec61496f7ba26bd0fdcccd3ef4aac527f00d87d1c7067b4c846a5b1d22514d0c72300a36d207ef212d21c75a54580e7d6ccd0e168725d10e6fd691cb8d2009bb515f097b86313d2973ec8c86cd893ef21c071798d667b2a268a161d012140c114b0bd3a54fe873b254c3e5f59d13416ac05d50b5f0f50d450d61c638ae383d32c9c7f4955c3e1ad15a05a42b8144642dd48c992727707375fb2cc2e30cadb169aacf3ab98f3fb77ac45f13d056fca8dbfb9ae99211f08f5b57f9a31e4a7d623c1f672058a5ced00ecd0c87387e6af0f11141b7431d08c108a5d6bf0091a637e7a1167d4e397c00adc8c164f47b42e5b3e92c323cf71d818fe69e5a8706226e642bba8ab8d270dc0d559c1aa88362ec4f75bf61af035a4ac1686816be4a09d5a23ce37fb6cbd595f3a8224ae586961b049f577c1bf17f55db49728845fc0a5dc6dc98ea54971d72fe24a7bcf46dbc785c989aaec0670f9c110b44a8005205870084ddac9a6031d2b77958a9ce9bd06c6fe5674d3b47366a9e978f5350d9ec17e5dfcec1ad868ada392fb7464fb82fcbedcf59cdbb8bf98ca4f932adc6430f765bb8ab6aa15b8be4749fb88ead4c0ec7cbcde39a146395b5cc4bd6b95e6796c5e28952b0370ab9db5edd0a8a5d671b429404445414c497c79e530dd117eaeabcb89a897b7eca921768ad6307f84107fbcd1bbad1116b5c10afc14bd1d3095a86c765251e2f73f6a3d36ef5c9a1301d6b9a1977a1c9601c6983f9758e34b58fdd6667e902ebb5e79ae85380942e2f431fb60566353d2ccbc244eb1e860c8b1d3ea013bfc46a9c353812052fe40a5f179ff189c3158ba0c44889d59a9d9afcd29164bde1092a63d3df9aded9829daa182c780e0caf74a0dc7d5622d475cb1fe8dcde9ff09e1f43375797bf5fe9a8a9e86a84b2ede449d257984a0fc082d36fc2ea1c4cd9d453ecc822ff9186b97a5081029363d04440080d2e4c150188a0c1592013d6a089e9fdd747098f31cc5671a801853fda08a02d18ffe8c0a3423995a44e0c5cf9dab152de6922a3f838535b4e17904433b0a2ef3e0713946f4713a6f370a59d5674615123d6d40fd51c27cfb13682624fb82f200352facc1213131f935a8b023ad04698302a379081ad0c9ea680efa71f2d20f476f03fbf128026d5672bc1cd82b56eb92c798b054f13024e71d128cd46fbbb881ec41eb15fb7eb2dce7ccbab147ce8fc7cd29e25f04221fde92206241f910c84ad944702f497cda67fbb695b8dc37b4935d025796dbafc623bed7c361b0b8f9f9812a10947a4e5b207ae461c9c417c664555bdf2ccb4f08fe81e82b6fb993c6389da2e4339860c80d7828771106aa472dbc5a7a4bed024702ec9067a23dcd11f6775de99e381a643898de05401878e2b08512e9f06f3fa6861911e6529b465aade83635451be7c63d1a9d03cafd40c2ed3b2a7cb231d94226ebe3e89376ad7f606ef21abc93383be9594bfd51286c2e8fb62300457707a2f61285ed0564e95de5fce7d44619898f75a5e1a78229ef7b20bde9da3c70ac22dd034467c9e9420cac9dc3ad7d7221c5cd538364deb756fb22bf133137a01e808996896434ddddc046600cc13b424f8b0da4f89f0260a46f41e96e8c89723c711c636c0d090cbf0460c7abb440079451aa0dc013bfb86a7c4d7ab17d1ed5204fd52f8380a3227e241afce2b588f67b1c3214cdc64bf25fd0f4223b807c6d63124ad50919421840a81ef31e77c1a8aef0d4d0c68f619431f0877fe343d828b2b8eae0d40cd384a5ae5c45361ee22d962bc537ddef7397da12ecdde14e90ecc0efe66650da080efdd195c20c8a854c4dfed438195df132067ae3d107f527720a52bbf1bd399ddb3b4dae8e322d34690061e7d6d8457aa07a173488172767cb5f3e60eeba34e29c58d36ba1e730deadbb1b59e76d19df0ffe544a09eeb10f3fff2ce92589a85061a96730525bd45278d207b63246ad01393760c2f9d904dc0c1c39e30c9f6a91e47febde45e56fa48bef82e3c87034285ff841dc097800a5702c8b7ebc8a94737b70ec589f65c7788d97fd27a1da44c861a235e134df41b9ab0649ae52870fbf5ccaaaba48a26ad9e937db1df16ab1e579ccd405114ab543716ec2bfbca438401a8e3b71a18077ce2683e323df52adc0fb4b09f3b81452da312694adbd634da9175e02a09fb224e701a4ce680edd71d0b2562b9df04c4877878350db749fcb9bbe440ce231ca963d41d632fb9a06fd5216cdebc2c168328c641f967b09bd3ae0c10b280f6abd6c334f818c590de28522335f361e961e9972a7efd1f74dd000807c7f6eb33c249b44377be8762522dad0cc80391d5352a15b5a1bc82a4c1f5c11ea872d5daade1f2e659b81efd4a42194716f90a9c82021d050aecc8638303a2d7a6ca4ef9fb6f582d745f9eef211694bda76a39b7bc0ad67870e1193b1060f129631e895ee060a84092603fe96f1897063cc1c9418c52bed065a543e8a0e63ce947e3dabb0c58abce7c308d08fc063e0aa96dba6332e9f5cfe666902b75005c04f1f5606d66d9d59554d68b97b83af4008e85234ec202e825a23ff9361181f8a115a651ebc781de116885831a203f15fcdaedb7cd58592cefffac123df96ea71f7c52a30f8d05a60229fe4de58f930d2bad3f7f5e0b95e49043f67f2b9e7fa842004f5081b20a3d5b0a6c41a109bd13296f7634fcb314c1d4e9a27ea336ec0b60c1a3eb75f80971a5bcc03af028199fc8c01cba574d235ea7da40c709a1986bded44cb328108fecf8b6c08b3f3520f3a2bcea6bede50b62581f42f2f68aa71caf531b6f5f7402316498ec453da5e07485a06f4d27ef2e216903319109df1836de05faa62898879b7cc894e1cbebe26b3c6e64a4723b17b0ae96341b56b1443ef5186ff7b1bfa972ce4fb9e0aecfc18677285009ad61827486faeebbb308b330c0aa3929ad756fa17ca2531f10e230d9956f56f766961bb8f5fd94804d5da441bedf9208d0d4d53c952d31ea0767d67d5cd01b8d2555bba8b86c74da23196924830cd8487a815a05ffdd29776c02bb8acea5ba2e54453983b69117238a9dc279f8693e9a50a516e8df38185c1e120b0e773f7ecf02f921d0b39f2370d6c3d626b07a4013662d115757c09fd1a631f4bca1d136351512a8ba6af6d634693f3e28bb98a81e2d369a4fd916a7a5452338b4e5b3e5f0a58989b8d3201b90073266ff1df8754afa09e1147a22212edc4bf95f4dd80f97282ab58ca56991f765ce8eba1106bd5e9fe19344240d35233d6c4601e5605226b3bc96", 0x1000}], 0x4, &(0x7f0000000300)=[@ip_tos_u8={{0x11, 0x0, 0x7}}, @ip_retopts={{0x38, 0x0, 0x7, {[@generic={0x89, 0x5, "e63ad7"}, @timestamp={0x44, 0x10, 0xb6, 0x0, 0x4, [0x5, 0x40000000, 0x0]}, @timestamp={0x44, 0x8, 0xa5, 0x0, 0xe, [0x81]}, @cipso={0x86, 0x8, 0x3, [{0x0, 0x2}]}, @end, @end]}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x4ceb}}, @ip_retopts={{0x50, 0x0, 0x7, {[@timestamp_prespec={0x44, 0x1c, 0xea, 0x3, 0x3, [{@multicast1, 0x3}, {@local, 0x3}, {@dev={0xac, 0x14, 0x14, 0x35}}]}, @end, @cipso={0x86, 0x23, 0x0, [{0x0, 0xf, "9f1ffb12a19a4e3fca6f25da37"}, {0x5, 0x9, "c4d737773e2652"}, {0x5, 0x3, "89"}, {0x1, 0x2}]}]}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x2}}], 0xd0}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0)
syz_mount_image$fuse(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYRESHEX=r0], 0x50)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000440)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0)
setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/4096, 0x1000, 0x800}, 0x20)
ioctl(r6, 0x400c4d07, &(0x7f0000000340))
bpf$PROG_BIND_MAP(0xa, &(0x7f00000007c0)={0xffffffffffffffff, r5}, 0x6)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000180)={@loopback, 0x8000000, 0x0, 0xfc, 0x1, 0x1, 0x20}, 0x20)
executing program 0:
syz_usb_connect(0x5, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000b510f210950b2a7773820102030109022400010000000009042200028953950009050a02ff0300fa000905820250"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r0 = socket(0x2, 0x2, 0x0)
ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000100)={'lo\x00', &(0x7f0000000200)=@ethtool_sset_info={0x37, 0x0, 0x2, [0x0, 0x0]}})
executing program 3:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), r0)
ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000100)={'wpan0\x00', <r2=>0x0})
sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000001700)={0x0, 0x0, &(0x7f00000016c0)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000002300000008000300", @ANYRES32=r2, @ANYBLOB="05001f000200000008002100"], 0x2c}}, 0x0)
sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000001800)={0x0, 0x0, &(0x7f00000017c0)={&(0x7f0000000500)=ANY=[], 0x1c}}, 0x0)
executing program 1:
r0 = socket(0x1f, 0x5, 0x8)
bind(r0, &(0x7f0000000140)=@generic={0x1f}, 0x8)
executing program 3:
mkdir(&(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000100)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='1', 0x1)
mkdir(&(0x7f0000000200)='./config/nvmet/ports/1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='ipv4', 0x4)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='tcp 20000\n', 0xa)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
munmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_INTERRUPT(r2, 0x4004ae86, 0x0)
executing program 3:
socket$unix(0x1, 0x5, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000100)={{0xffff0000, 0x0, 0xf000, 0x0, 0x7, 0x80, 0x0, 0x10, 0x0, 0x0, 0x0, 0x1}, {0x0, 0x60000, 0xa, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x1}, {0x0, 0xdddd8000, 0x18, 0x8, 0xd, 0x4, 0x81, 0x0, 0x80, 0xe, 0x4, 0x3}, {0x10b002, 0x2000, 0xb, 0xfd, 0x80, 0x0, 0x3}, {0x2000, 0x0, 0x0, 0x0, 0x0, 0x80, 0xd1, 0x0, 0xfd, 0x1c, 0x1a, 0xa8}, {0xd000, 0x8080000, 0x4, 0x0, 0x0, 0xfa, 0x0, 0x0, 0x0, 0xfc, 0x86, 0x7}, {0xeeee8000, 0x30000, 0xf, 0x0, 0x7, 0x0, 0x0, 0x80, 0x0, 0x4, 0x0, 0xa}, {0xd000, 0xeeee8000, 0x3, 0x82, 0x0, 0x10, 0x4, 0xe, 0x0, 0xfc, 0x4}, {0x1000, 0xfffc}, {0xeeee8000, 0xfffe}, 0x6000000d, 0x0, 0x0, 0x20000, 0x1, 0xc001, 0x900, [0x0, 0x0, 0x10000, 0x5]})
ioctl$KVM_SET_MSRS(r2, 0x4140aecd, &(0x7f0000000100))
executing program 1:
r0 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000000040))
timer_settime(0x0, 0x0, 0x0, 0x0)
fremovexattr(0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, 0x0, 0x240, 0x84)
mount$tmpfs(0x0, 0x0, 0x0, 0x444a, 0x0)
r1 = open(0x0, 0x40, 0x80)
timer_create(0x0, 0x0, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, r1, 0x0)
gettid()
syz_clone(0x6402a200, 0x0, 0x0, 0x0, 0x0, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
write$tcp_mem(0xffffffffffffffff, 0x0, 0x0)
executing program 2:
r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_load_code={0x12e, 0x4d, {0x0, "48b800800000000000000f23c80f21f8350c0020000f23f86d3266b864000f00d03500010000b8050002000f006080000f01b00f30"}}, @nested_vmlaunch={0x12f, 0x18}], 0x95})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f00000001c0)={{0x3000, 0x1, 0x8, 0x8, 0xb, 0xe6, 0x40, 0x0, 0x0, 0x81, 0x80}, {0x5000, 0x3000, 0x3, 0x0, 0x42, 0x5, 0x75, 0x6, 0x36, 0x4, 0x2, 0x83}, {0x0, 0xdddd0000, 0xe, 0x5, 0x3, 0x7, 0x0, 0x9, 0x1, 0xa4, 0x5, 0x5}, {0x1, 0xeeee0000, 0x9, 0x6, 0x5, 0x42, 0xb, 0xff, 0x8, 0x7, 0xe}, {0xf000, 0x3000, 0xf, 0x3, 0x30, 0x7, 0xab, 0x8, 0x9, 0x9, 0xf7, 0x97}, {0xeeefa000, 0xdddd0000, 0xe, 0xa0, 0xb1, 0x8, 0x1, 0xa0, 0x82, 0x2f, 0x1, 0x7}, {0x3000, 0x3000, 0xf, 0x5, 0x7, 0x5, 0x7, 0x3, 0x9d, 0x81, 0x7, 0x70}, {0x8000000, 0x4000, 0x8, 0x5, 0xcd, 0x7, 0xc8, 0x1, 0x42, 0xc, 0xb0, 0x81}, {0xeeee0000, 0x30}, {0x8000000, 0x7}, 0x80000031, 0x0, 0x3000, 0x402004, 0x2, 0x0, 0x100000, [0x6800000000000000, 0xe51, 0x3, 0x8]})
ioctl$KVM_PRE_FAULT_MEMORY(r3, 0xc040aed5, &(0x7f0000000300)={0x5000, 0x2000})
executing program 1:
mkdir(&(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000100)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='1', 0x1)
mkdir(&(0x7f0000000200)='./config/nvmet/ports/1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='tcp', 0x3)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='ipv4', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='127.0.0.1', 0x9)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='4420', 0x4)
symlinkat(&(0x7f0000000440)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
nanosleep(&(0x7f0000000580)={0x0, 0x1dcd6500}, 0x0)
executing program 3:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), r0)
ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000100)={'wpan0\x00', <r2=>0x0})
sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000001700)={0x0, 0x0, &(0x7f00000016c0)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000002300000008000300", @ANYRES32=r2, @ANYBLOB="05001f000200000008002100"], 0x2c}}, 0x0)
sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000001800)={0x0, 0x0, &(0x7f00000017c0)={&(0x7f0000000500)=ANY=[], 0x1c}}, 0x0)
executing program 2:
chmod(0xffffffffffffffff, 0x100)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4\n', 0x3)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000180)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
executing program 3:
mkdir(&(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000100)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='1', 0x1)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='ipv4', 0x4)
executing program 3:
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
getsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000440), &(0x7f0000000480)=0x4)

program crashed: KASAN: slab-use-after-free Read in nfsd_svc
bisect: bisecting 18 programs
bisect: split chunks (needed=false): <17>
bisect: split chunk #0 of len 17 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 5, 3, 5, 14, 7, 16, 5, 1, 8, 8, 2]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='tcp 20000\n', 0xa)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
munmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_INTERRUPT(r2, 0x4004ae86, 0x0)
executing program 3:
socket$unix(0x1, 0x5, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000100)={{0xffff0000, 0x0, 0xf000, 0x0, 0x7, 0x80, 0x0, 0x10, 0x0, 0x0, 0x0, 0x1}, {0x0, 0x60000, 0xa, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x1}, {0x0, 0xdddd8000, 0x18, 0x8, 0xd, 0x4, 0x81, 0x0, 0x80, 0xe, 0x4, 0x3}, {0x10b002, 0x2000, 0xb, 0xfd, 0x80, 0x0, 0x3}, {0x2000, 0x0, 0x0, 0x0, 0x0, 0x80, 0xd1, 0x0, 0xfd, 0x1c, 0x1a, 0xa8}, {0xd000, 0x8080000, 0x4, 0x0, 0x0, 0xfa, 0x0, 0x0, 0x0, 0xfc, 0x86, 0x7}, {0xeeee8000, 0x30000, 0xf, 0x0, 0x7, 0x0, 0x0, 0x80, 0x0, 0x4, 0x0, 0xa}, {0xd000, 0xeeee8000, 0x3, 0x82, 0x0, 0x10, 0x4, 0xe, 0x0, 0xfc, 0x4}, {0x1000, 0xfffc}, {0xeeee8000, 0xfffe}, 0x6000000d, 0x0, 0x0, 0x20000, 0x1, 0xc001, 0x900, [0x0, 0x0, 0x10000, 0x5]})
ioctl$KVM_SET_MSRS(r2, 0x4140aecd, &(0x7f0000000100))
executing program 1:
r0 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000000040))
timer_settime(0x0, 0x0, 0x0, 0x0)
fremovexattr(0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, 0x0, 0x240, 0x84)
mount$tmpfs(0x0, 0x0, 0x0, 0x444a, 0x0)
r1 = open(0x0, 0x40, 0x80)
timer_create(0x0, 0x0, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, r1, 0x0)
gettid()
syz_clone(0x6402a200, 0x0, 0x0, 0x0, 0x0, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
write$tcp_mem(0xffffffffffffffff, 0x0, 0x0)
executing program 2:
r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_load_code={0x12e, 0x4d, {0x0, "48b800800000000000000f23c80f21f8350c0020000f23f86d3266b864000f00d03500010000b8050002000f006080000f01b00f30"}}, @nested_vmlaunch={0x12f, 0x18}], 0x95})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f00000001c0)={{0x3000, 0x1, 0x8, 0x8, 0xb, 0xe6, 0x40, 0x0, 0x0, 0x81, 0x80}, {0x5000, 0x3000, 0x3, 0x0, 0x42, 0x5, 0x75, 0x6, 0x36, 0x4, 0x2, 0x83}, {0x0, 0xdddd0000, 0xe, 0x5, 0x3, 0x7, 0x0, 0x9, 0x1, 0xa4, 0x5, 0x5}, {0x1, 0xeeee0000, 0x9, 0x6, 0x5, 0x42, 0xb, 0xff, 0x8, 0x7, 0xe}, {0xf000, 0x3000, 0xf, 0x3, 0x30, 0x7, 0xab, 0x8, 0x9, 0x9, 0xf7, 0x97}, {0xeeefa000, 0xdddd0000, 0xe, 0xa0, 0xb1, 0x8, 0x1, 0xa0, 0x82, 0x2f, 0x1, 0x7}, {0x3000, 0x3000, 0xf, 0x5, 0x7, 0x5, 0x7, 0x3, 0x9d, 0x81, 0x7, 0x70}, {0x8000000, 0x4000, 0x8, 0x5, 0xcd, 0x7, 0xc8, 0x1, 0x42, 0xc, 0xb0, 0x81}, {0xeeee0000, 0x30}, {0x8000000, 0x7}, 0x80000031, 0x0, 0x3000, 0x402004, 0x2, 0x0, 0x100000, [0x6800000000000000, 0xe51, 0x3, 0x8]})
ioctl$KVM_PRE_FAULT_MEMORY(r3, 0xc040aed5, &(0x7f0000000300)={0x5000, 0x2000})
executing program 1:
mkdir(&(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000100)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='1', 0x1)
mkdir(&(0x7f0000000200)='./config/nvmet/ports/1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='tcp', 0x3)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='ipv4', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='127.0.0.1', 0x9)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='4420', 0x4)
symlinkat(&(0x7f0000000440)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
nanosleep(&(0x7f0000000580)={0x0, 0x1dcd6500}, 0x0)
executing program 3:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), r0)
ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000100)={'wpan0\x00', <r2=>0x0})
sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000001700)={0x0, 0x0, &(0x7f00000016c0)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000002300000008000300", @ANYRES32=r2, @ANYBLOB="05001f000200000008002100"], 0x2c}}, 0x0)
sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000001800)={0x0, 0x0, &(0x7f00000017c0)={&(0x7f0000000500)=ANY=[], 0x1c}}, 0x0)
executing program 2:
chmod(0xffffffffffffffff, 0x100)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4\n', 0x3)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000180)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
executing program 3:
mkdir(&(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000100)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='1', 0x1)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='ipv4', 0x4)
executing program 3:
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
getsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000440), &(0x7f0000000480)=0x4)

program crashed: WARNING in svc_destroy
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/3
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 5, 1, 8, 8, 2]
detailed listing:
executing program 1:
mkdir(&(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000100)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='1', 0x1)
mkdir(&(0x7f0000000200)='./config/nvmet/ports/1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='tcp', 0x3)
r2 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r2, &(0x7f0000000300)='ipv4', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r3, &(0x7f0000000380)='127.0.0.1', 0x9)
r4 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='4420', 0x4)
symlinkat(&(0x7f0000000440)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
nanosleep(&(0x7f0000000580)={0x0, 0x1dcd6500}, 0x0)
executing program 3:
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), r0)
ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000100)={'wpan0\x00', <r2=>0x0})
sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000001700)={0x0, 0x0, &(0x7f00000016c0)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000002300000008000300", @ANYRES32=r2, @ANYBLOB="05001f000200000008002100"], 0x2c}}, 0x0)
sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000001800)={0x0, 0x0, &(0x7f00000017c0)={&(0x7f0000000500)=ANY=[], 0x1c}}, 0x0)
executing program 2:
chmod(0xffffffffffffffff, 0x100)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4\n', 0x3)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000180)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)
executing program 3:
mkdir(&(0x7f0000000040)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0)
mkdir(&(0x7f0000000100)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r0, &(0x7f00000001c0)='1', 0x1)
openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r1, &(0x7f0000000300)='ipv4', 0x4)
executing program 3:
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
getsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000440), &(0x7f0000000480)=0x4)

program did not crash
bisect: testing without sub-chunk 3/3
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 5, 3, 5, 14, 7, 8]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='tcp 20000\n', 0xa)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
munmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_INTERRUPT(r2, 0x4004ae86, 0x0)
executing program 3:
socket$unix(0x1, 0x5, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000100)={{0xffff0000, 0x0, 0xf000, 0x0, 0x7, 0x80, 0x0, 0x10, 0x0, 0x0, 0x0, 0x1}, {0x0, 0x60000, 0xa, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x1}, {0x0, 0xdddd8000, 0x18, 0x8, 0xd, 0x4, 0x81, 0x0, 0x80, 0xe, 0x4, 0x3}, {0x10b002, 0x2000, 0xb, 0xfd, 0x80, 0x0, 0x3}, {0x2000, 0x0, 0x0, 0x0, 0x0, 0x80, 0xd1, 0x0, 0xfd, 0x1c, 0x1a, 0xa8}, {0xd000, 0x8080000, 0x4, 0x0, 0x0, 0xfa, 0x0, 0x0, 0x0, 0xfc, 0x86, 0x7}, {0xeeee8000, 0x30000, 0xf, 0x0, 0x7, 0x0, 0x0, 0x80, 0x0, 0x4, 0x0, 0xa}, {0xd000, 0xeeee8000, 0x3, 0x82, 0x0, 0x10, 0x4, 0xe, 0x0, 0xfc, 0x4}, {0x1000, 0xfffc}, {0xeeee8000, 0xfffe}, 0x6000000d, 0x0, 0x0, 0x20000, 0x1, 0xc001, 0x900, [0x0, 0x0, 0x10000, 0x5]})
ioctl$KVM_SET_MSRS(r2, 0x4140aecd, &(0x7f0000000100))
executing program 1:
r0 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000000040))
timer_settime(0x0, 0x0, 0x0, 0x0)
fremovexattr(0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, 0x0, 0x240, 0x84)
mount$tmpfs(0x0, 0x0, 0x0, 0x444a, 0x0)
r1 = open(0x0, 0x40, 0x80)
timer_create(0x0, 0x0, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, r1, 0x0)
gettid()
syz_clone(0x6402a200, 0x0, 0x0, 0x0, 0x0, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
write$tcp_mem(0xffffffffffffffff, 0x0, 0x0)
executing program 2:
r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_load_code={0x12e, 0x4d, {0x0, "48b800800000000000000f23c80f21f8350c0020000f23f86d3266b864000f00d03500010000b8050002000f006080000f01b00f30"}}, @nested_vmlaunch={0x12f, 0x18}], 0x95})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f00000001c0)={{0x3000, 0x1, 0x8, 0x8, 0xb, 0xe6, 0x40, 0x0, 0x0, 0x81, 0x80}, {0x5000, 0x3000, 0x3, 0x0, 0x42, 0x5, 0x75, 0x6, 0x36, 0x4, 0x2, 0x83}, {0x0, 0xdddd0000, 0xe, 0x5, 0x3, 0x7, 0x0, 0x9, 0x1, 0xa4, 0x5, 0x5}, {0x1, 0xeeee0000, 0x9, 0x6, 0x5, 0x42, 0xb, 0xff, 0x8, 0x7, 0xe}, {0xf000, 0x3000, 0xf, 0x3, 0x30, 0x7, 0xab, 0x8, 0x9, 0x9, 0xf7, 0x97}, {0xeeefa000, 0xdddd0000, 0xe, 0xa0, 0xb1, 0x8, 0x1, 0xa0, 0x82, 0x2f, 0x1, 0x7}, {0x3000, 0x3000, 0xf, 0x5, 0x7, 0x5, 0x7, 0x3, 0x9d, 0x81, 0x7, 0x70}, {0x8000000, 0x4000, 0x8, 0x5, 0xcd, 0x7, 0xc8, 0x1, 0x42, 0xc, 0xb0, 0x81}, {0xeeee0000, 0x30}, {0x8000000, 0x7}, 0x80000031, 0x0, 0x3000, 0x402004, 0x2, 0x0, 0x100000, [0x6800000000000000, 0xe51, 0x3, 0x8]})
ioctl$KVM_PRE_FAULT_MEMORY(r3, 0xc040aed5, &(0x7f0000000300)={0x5000, 0x2000})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4\n', 0x3)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000180)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)

program crashed: KASAN: slab-use-after-free Read in nfsd_svc
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <6>
bisect: split chunk #0 of len 6 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 14, 7, 8]
detailed listing:
executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000100)={{0xffff0000, 0x0, 0xf000, 0x0, 0x7, 0x80, 0x0, 0x10, 0x0, 0x0, 0x0, 0x1}, {0x0, 0x60000, 0xa, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x1}, {0x0, 0xdddd8000, 0x18, 0x8, 0xd, 0x4, 0x81, 0x0, 0x80, 0xe, 0x4, 0x3}, {0x10b002, 0x2000, 0xb, 0xfd, 0x80, 0x0, 0x3}, {0x2000, 0x0, 0x0, 0x0, 0x0, 0x80, 0xd1, 0x0, 0xfd, 0x1c, 0x1a, 0xa8}, {0xd000, 0x8080000, 0x4, 0x0, 0x0, 0xfa, 0x0, 0x0, 0x0, 0xfc, 0x86, 0x7}, {0xeeee8000, 0x30000, 0xf, 0x0, 0x7, 0x0, 0x0, 0x80, 0x0, 0x4, 0x0, 0xa}, {0xd000, 0xeeee8000, 0x3, 0x82, 0x0, 0x10, 0x4, 0xe, 0x0, 0xfc, 0x4}, {0x1000, 0xfffc}, {0xeeee8000, 0xfffe}, 0x6000000d, 0x0, 0x0, 0x20000, 0x1, 0xc001, 0x900, [0x0, 0x0, 0x10000, 0x5]})
ioctl$KVM_SET_MSRS(r2, 0x4140aecd, &(0x7f0000000100))
executing program 1:
r0 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000000040))
timer_settime(0x0, 0x0, 0x0, 0x0)
fremovexattr(0xffffffffffffffff, 0x0)
openat(0xffffffffffffff9c, 0x0, 0x240, 0x84)
mount$tmpfs(0x0, 0x0, 0x0, 0x444a, 0x0)
r1 = open(0x0, 0x40, 0x80)
timer_create(0x0, 0x0, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, r1, 0x0)
gettid()
syz_clone(0x6402a200, 0x0, 0x0, 0x0, 0x0, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
write$tcp_mem(0xffffffffffffffff, 0x0, 0x0)
executing program 2:
r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$x86(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@enable_nested={0x12c, 0x18}, @nested_create_vm={0x12d, 0x18}, @nested_load_code={0x12e, 0x4d, {0x0, "48b800800000000000000f23c80f21f8350c0020000f23f86d3266b864000f00d03500010000b8050002000f006080000f01b00f30"}}, @nested_vmlaunch={0x12f, 0x18}], 0x95})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f00000001c0)={{0x3000, 0x1, 0x8, 0x8, 0xb, 0xe6, 0x40, 0x0, 0x0, 0x81, 0x80}, {0x5000, 0x3000, 0x3, 0x0, 0x42, 0x5, 0x75, 0x6, 0x36, 0x4, 0x2, 0x83}, {0x0, 0xdddd0000, 0xe, 0x5, 0x3, 0x7, 0x0, 0x9, 0x1, 0xa4, 0x5, 0x5}, {0x1, 0xeeee0000, 0x9, 0x6, 0x5, 0x42, 0xb, 0xff, 0x8, 0x7, 0xe}, {0xf000, 0x3000, 0xf, 0x3, 0x30, 0x7, 0xab, 0x8, 0x9, 0x9, 0xf7, 0x97}, {0xeeefa000, 0xdddd0000, 0xe, 0xa0, 0xb1, 0x8, 0x1, 0xa0, 0x82, 0x2f, 0x1, 0x7}, {0x3000, 0x3000, 0xf, 0x5, 0x7, 0x5, 0x7, 0x3, 0x9d, 0x81, 0x7, 0x70}, {0x8000000, 0x4000, 0x8, 0x5, 0xcd, 0x7, 0xc8, 0x1, 0x42, 0xc, 0xb0, 0x81}, {0xeeee0000, 0x30}, {0x8000000, 0x7}, 0x80000031, 0x0, 0x3000, 0x402004, 0x2, 0x0, 0x100000, [0x6800000000000000, 0xe51, 0x3, 0x8]})
ioctl$KVM_PRE_FAULT_MEMORY(r3, 0xc040aed5, &(0x7f0000000300)={0x5000, 0x2000})
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4\n', 0x3)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000180)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 5, 3, 8]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='tcp 20000\n', 0xa)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
munmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_INTERRUPT(r2, 0x4004ae86, 0x0)
executing program 3:
socket$unix(0x1, 0x5, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4\n', 0x3)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000180)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)

program crashed: WARNING in svc_destroy
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <3>
bisect: split chunk #0 of len 3 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 8]
detailed listing:
executing program 3:
socket$unix(0x1, 0x5, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4\n', 0x3)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000180)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 5, 8]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='tcp 20000\n', 0xa)
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
munmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_INTERRUPT(r2, 0x4004ae86, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4\n', 0x3)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000180)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)

program crashed: KASAN: slab-use-after-free Read in nfsd_svc
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <2>
bisect: split chunk #0 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 8]
detailed listing:
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
munmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_INTERRUPT(r2, 0x4004ae86, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4\n', 0x3)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000180)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)

program did not crash
bisect: testing without sub-chunk 2/2
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 8]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='tcp 20000\n', 0xa)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4\n', 0x3)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000180)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)

program crashed: WARNING in svc_destroy
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 2 programs left: 

executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r1, &(0x7f0000000180)='tcp 20000\n', 0xa)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4\n', 0x3)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000180)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)


bisect: trying to concatenate
bisect: concatenate 2 entries
minimizing program #0 before concatenation
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 8]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4', 0x2)
openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4\n', 0x3)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000180)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 8]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4', 0x2)
write(0xffffffffffffffff, &(0x7f0000000180)='tcp 20000\n', 0xa)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4\n', 0x3)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000180)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 8]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='tcp 20000\n', 0xa)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4\n', 0x3)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000180)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)

program crashed: KASAN: slab-use-after-free Read in nfsd_svc
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 8]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='tcp 20000\n', 0xa)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4\n', 0x3)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000180)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)

program crashed: KASAN: slab-use-after-free Read in nfsd_svc
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 8]
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='tcp 20000\n', 0xa)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4\n', 0x3)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000180)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 8]
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='tcp 20000\n', 0xa)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4\n', 0x3)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000180)='tcp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x1, 0x0)
write(r2, &(0x7f0000000200)='1\n', 0x2)

program did not crash
minimized 6 calls -> 4 calls
minimizing program #1 before concatenation
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 7]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='tcp 20000\n', 0xa)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4\n', 0x3)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000180)='tcp 20000\n', 0xa)
openat(0xffffffffffffff9c, &(0x7f00000001c0)='./nfsd/threads\x00', 0x1, 0x0)

program crashed: WARNING in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 6]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='tcp 20000\n', 0xa)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4\n', 0x3)
r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r1, &(0x7f0000000180)='tcp 20000\n', 0xa)

program crashed: WARNING in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 5]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='tcp 20000\n', 0xa)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4\n', 0x3)
openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)

program crashed: WARNING in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 4]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='tcp 20000\n', 0xa)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)
write(r0, &(0x7f0000000100)='-4\n', 0x3)

program crashed: WARNING in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 3]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='tcp 20000\n', 0xa)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x1, 0x0)

program crashed: WARNING in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 2]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='tcp 20000\n', 0xa)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)

program crashed: WARNING in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 1]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='tcp 20000\n', 0xa)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)

program crashed: WARNING in svc_destroy
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 0]
detailed listing:
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='tcp 20000\n', 0xa)
executing program 0:

program crashed: WARNING in svc_destroy
minimized 8 calls -> 0 calls
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='tcp 20000\n', 0xa)

program crashed: WARNING in svc_destroy
bisect: concatenation succeeded
found reproducer with 4 syscalls
minimizing guilty program
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000180)='tcp 20000\n', 0xa)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='tcp 20000\n', 0xa)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='tcp 20000\n', 0xa)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='tcp 20000\n', 0xa)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='tcp 20000\n', 0xa)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='tcp 20000\n', 0xa)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000180)='tcp 20000\n', 0xa)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)

program did not crash
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180), 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: WARNING in svc_destroy
simplifying C reproducer
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: WARNING in svc_destroy
testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program did not crash
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: WARNING in svc_destroy
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: WARNING in svc_destroy
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: WARNING in svc_destroy
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program did not crash
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: WARNING in svc_destroy
testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: WARNING in svc_destroy
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='tcp 20000\n', 0xa)

program crashed: WARNING in svc_destroy
validation run: crashed=true
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='tcp 20000\n', 0xa)

program crashed: WARNING in svc_destroy
validation run: crashed=true
testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='tcp 20000\n', 0xa)

program crashed: WARNING in svc_destroy
validation run: crashed=true
reproducing took 1h11m54.866832239s
repro crashed as (corrupted=false):
------------[ cut here ]------------
SVC: permsocks remain for nfsd
WARNING: CPU: 0 PID: 5939 at net/sunrpc/svc.c:583 svc_destroy+0x2ed/0x390 net/sunrpc/svc.c:582
Modules linked in:
CPU: 0 PID: 5939 Comm: syz.0.18 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:svc_destroy+0x2ed/0x390 net/sunrpc/svc.c:582
Code: 24 49 83 c7 20 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 e2 fa 32 f8 49 8b 37 48 c7 c7 60 57 d9 8b e8 13 46 a4 f7 <0f> 0b e9 78 fd ff ff e8 47 79 da f7 c6 05 85 0c ca 04 01 4c 89 e0
RSP: 0018:ffffc9000335fae0 EFLAGS: 00010246
RAX: 3f211aa4186bf200 RBX: ffff88802d051850 RCX: ffff88807c651e00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: ffffc9000335fcb8 R08: ffffc9000335f6e7 R09: 1ffff9200066bedc
R10: dffffc0000000000 R11: fffff5200066bedd R12: ffff88802d051800
R13: dffffc0000000000 R14: ffff88802d051850 R15: ffffffff8d3e1cc0
FS:  0000555593d99500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f51e6a70050 CR3: 00000000763a3000 CR4: 00000000003506f0
Call Trace:
 <TASK>
 kref_put include/linux/kref.h:65 [inline]
 svc_put include/linux/sunrpc/svc.h:124 [inline]
 __write_ports_addxprt fs/nfsd/nfsctl.c:765 [inline]
 __write_ports fs/nfsd/nfsctl.c:791 [inline]
 write_ports+0xb99/0xfa0 fs/nfsd/nfsctl.c:844
 nfsctl_transaction_write+0x10c/0x150 fs/nfsd/nfsctl.c:113
 vfs_write+0x299/0x9a0 fs/read_write.c:582
 ksys_write+0x151/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f51e6b9e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff44d7d458 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f51e6e25fa0 RCX: 00007f51e6b9e159
RDX: 000000000000000a RSI: 0000200000000180 RDI: 0000000000000003
RBP: 00007f51e6c3503b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f51e6e25fac R14: 00007f51e6e25fa0 R15: 00007f51e6e25fa0
 </TASK>

final repro crashed as (corrupted=false):
------------[ cut here ]------------
SVC: permsocks remain for nfsd
WARNING: CPU: 0 PID: 5939 at net/sunrpc/svc.c:583 svc_destroy+0x2ed/0x390 net/sunrpc/svc.c:582
Modules linked in:
CPU: 0 PID: 5939 Comm: syz.0.18 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:svc_destroy+0x2ed/0x390 net/sunrpc/svc.c:582
Code: 24 49 83 c7 20 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 e2 fa 32 f8 49 8b 37 48 c7 c7 60 57 d9 8b e8 13 46 a4 f7 <0f> 0b e9 78 fd ff ff e8 47 79 da f7 c6 05 85 0c ca 04 01 4c 89 e0
RSP: 0018:ffffc9000335fae0 EFLAGS: 00010246
RAX: 3f211aa4186bf200 RBX: ffff88802d051850 RCX: ffff88807c651e00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000002
RBP: ffffc9000335fcb8 R08: ffffc9000335f6e7 R09: 1ffff9200066bedc
R10: dffffc0000000000 R11: fffff5200066bedd R12: ffff88802d051800
R13: dffffc0000000000 R14: ffff88802d051850 R15: ffffffff8d3e1cc0
FS:  0000555593d99500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f51e6a70050 CR3: 00000000763a3000 CR4: 00000000003506f0
Call Trace:
 <TASK>
 kref_put include/linux/kref.h:65 [inline]
 svc_put include/linux/sunrpc/svc.h:124 [inline]
 __write_ports_addxprt fs/nfsd/nfsctl.c:765 [inline]
 __write_ports fs/nfsd/nfsctl.c:791 [inline]
 write_ports+0xb99/0xfa0 fs/nfsd/nfsctl.c:844
 nfsctl_transaction_write+0x10c/0x150 fs/nfsd/nfsctl.c:113
 vfs_write+0x299/0x9a0 fs/read_write.c:582
 ksys_write+0x151/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f51e6b9e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff44d7d458 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f51e6e25fa0 RCX: 00007f51e6b9e159
RDX: 000000000000000a RSI: 0000200000000180 RDI: 0000000000000003
RBP: 00007f51e6c3503b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f51e6e25fac R14: 00007f51e6e25fa0 R15: 00007f51e6e25fa0
 </TASK>