Extracting prog: 48m7.458121297s
Minimizing prog: 24m18.323635161s
Simplifying prog options: 0s
Extracting C: 37.172055524s
Simplifying C: 11m41.787111434s


extracting reproducer from 67 programs
testing a last program of every proc
single: executing 17 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$comedi-openat-openat$sequencer2-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-syz_open_dev$sndmidi-writev-socket$kcm-socket-rseq-socket$rds-setsockopt$sock_int-bind$rds-sendmsg$rds-clock_adjtime-syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_CREATE_BUFS-socket$nl_route-openat$sysfs-sendmmsg$alg
detailed listing:
executing program 0:
openat$comedi(0xffffffffffffff9c, 0x0, 0x80400, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0xc, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7)
r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
socket$kcm(0x2, 0x7, 0x2)
socket(0x10, 0x2, 0x0)
rseq(&(0x7f0000001080)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0)
r1 = socket$rds(0x15, 0x5, 0x0)
setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000000080)=0x1, 0x4)
bind$rds(r1, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10)
sendmsg$rds(r1, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x4e21, @local}, 0x10, &(0x7f0000000540)=[{0x0}], 0x1, &(0x7f0000000400)=[@zcopy_cookie={0x18, 0x114, 0xc, 0x42}], 0x18, 0x40080}, 0x4000000)
clock_adjtime(0x0, 0x0)
r2 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2)
ioctl$vim2m_VIDIOC_CREATE_BUFS(r2, 0xc0f8565c, &(0x7f0000000340)={0x1ff, 0x5, 0x1, {0x1, @pix={0xff, 0xa, 0x31324d4e, 0x0, 0x9, 0xffffff61, 0x9, 0x9, 0x0, 0x7, 0x2, 0x6}}, 0xd5a})
socket$nl_route(0x10, 0x3, 0x0)
r3 = openat$sysfs(0xffffff9c, &(0x7f00000000c0)='/sys/power/pm_test', 0x4000, 0x4)
sendmmsg$alg(r3, &(0x7f0000001240)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=[@iv={0x10}, @iv={0x10}], 0x20, 0x4880}, {0x0, 0x0, &(0x7f0000000840)=[{0x0}, {&(0x7f0000000780)="a27e751b506316d107c78c782937d6f33110862675b0cf4dd973f8161521f90c77ae4f26", 0x24}, {&(0x7f00000007c0)="946bcac2250f0a616e8f94e1baf7b9138cced2ccf8f2b4fe1e1a49f73250e614790249b84c8ee0ac47c0522e6c5da4f2f6b159d442a2d87aea70f7bdaf01436c4dce087aaff4696c77b8e973c587ecd7bb5fb2112e02f5df43bfa918e9f3026c9dff6f89975f76fcbecb71b5e8513c81f57cdeb0f24b6f767bc017ceea83", 0x7e}], 0x3, &(0x7f0000000880)=[@op={0x10, 0x117, 0x3, 0x1}], 0x10}, {0x0, 0x0, &(0x7f0000000900)=[{&(0x7f00000008c0)="3398a4", 0x3}], 0x1, &(0x7f0000000940)=[@assoc={0x10, 0x117, 0x4, 0x9}, @op={0x10, 0x117, 0x3, 0x1}, @op={0x10}], 0x30, 0x804c044}, {0x0, 0x0, &(0x7f00000010c0)=[{&(0x7f0000000a00)="a0ea6ea3427cef817dd7f81fd0efb568b0042fa10ff6e6e4e392e66e8a34d95fe4c9992b92ec54c266480c85ff0a76466f1ce133f0cc4a6590e68fe866b01294bbcd429977fc947d8c9303e5c96ce7a2457b795806086a68f4f32f4b2176d8ba50d133f85ead618af914d9787ba92896babebf4051c3f9e2c84e15ef7a0b9d30129b4d5d9e254dc15d6614384e817bf75584609c24a00c06c9d319", 0x9b}, {&(0x7f0000000ac0)="22509617adb91afa439b1f9b00ab2e15ab77ecc52cf6f6a79073d4a1f8166a86c20833c2527209467f628723fdbb88bad4b80d4c8a63d029eefb08cf461f2d433478", 0x42}, {&(0x7f0000000b40)="059af19a024c264d6e2a18d4bdcf804e2a17fee1863f29cda5134d6197b20382f5ff8b4d346a3bcf96877ea76e6ce26157409b0aca740a4806e568b7b16951be81bc3ea73611fe43127c2a8bb9b80c3b040dd6c4ba23f70ec96b57444fe9ccd69c5d43024e04ab16d43d6b7147ccfc448f573f5427a47cf6e7360ae611cf13d8cf03c736daaadc8187a36c559901c37f67d42921a2c8ff5c2d1f417d40b047b97ee0087bc2b896c44822e3876a58e27b32645bc00ad073733b35f160c47a569b7bb06ad4d65bd64dc2b6295132bb035fce916b5a230d3b6b308b122e360d7b8a28a2", 0xe2}, {0x0}, {&(0x7f0000000d40)="e6195fc805a6f8c49b717a2366b3610d2f1b646ffc85b7155922cdecf64ecd4d21849bcbfe4b8a5e4bbe74ea48beb9330f6ef93d5de44210850678c387ee6fdd0ed5efade60c12cf6cb08c683343934f1fc156a85e2c243d1abb962a425de7a1d2a7fc91e8c8928825204bf4615cf7e06d754e7e42cbca7b3c776c20174c5c8f8324b08633a7e517f6fbde324c557b78280872b174f30ee2fd8c06a7be9cd2", 0x9f}, {&(0x7f0000000e00)="9f151fd0f92644ca6a7fa73237bff578a7875549783e18c77f5d88a2323668c9334e5450243cfff2df0d5d1ebcc6052ae3e0edbc082b6e3163418151b361bd166bbde8b59a67f88095cacb949d0d68753be0ccfe6b51f180b0b71c098bd0049d74ea0ae906f016a3606b1cf40aa4872e9b30f00a7ce7e51b363651be2c6f59b3d656d7627d34afcdad559c475461c394ac41d328cdccc4f11e8fd078c9b1d1207801e6cbf31922692048e3ac4a84", 0xae}, {&(0x7f0000000ec0)="f9bee3476b931125ba7ae463e3c95db05048f2a4a5cd858a744e9058a13c7720eb751bac0f701da57b44befb73d2d5da9e7b9fbd6c544f2cb45df193860fd17352c817740c817af933b1cb9f2a83f81e013b0a369869c6ea4c83e01703d5900be2d6beda7efd6cc05677c70146b3771c5b9a1f0b72fd72fd35dbec03f7201b919810cbc3991b36604f72abc45b7eeae32bb72a0ab1d635ea248b0e75bced85d5a4040b776fd2ecda93974fba7f", 0xad}], 0x7, &(0x7f0000001140)=[@op={0x10}, @iv={0xa4, 0x117, 0x2, 0x91, "ce0faff8d5f8795f6467cda21010882ca780911951398e64c9322a6af2f3b766d1abba4dee1c7c5a883aaadba192581e7a1d2a90d97d3ef1a2d97de1010061888c0b016b9a17bc624b7ac63fd7f4d50a02f58a1c639c4e3a3fb3206ad7326b2eb150391e18285943f0ca2f1703d893ff4b593a9d71358f359b6998c020704356647b5239d7dc96072c2c285ce633fe8c3e"}, @op={0x10}], 0xc4, 0x4800}], 0x4, 0x190)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES-syz_open_dev$tty1-mmap$IORING_OFF_SQ_RING-mkdirat-request_key-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-openat$sequencer-ioctl$COMEDI_DEVCONFIG-syz_open_dev$sndmidi-writev-socketpair$unix-ioctl$sock_SIOCGIFINDEX-socket$netlink-ioctl$sock_SIOCBRDELBR-socket-pipe-writev-syz_ublk_setup_io_uring-ioctl$AUTOFS_DEV_IOCTL_VERSION-sendmsg$kcm
detailed listing:
executing program 0:
r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2)
ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r0, 0xc02c564a, &(0x7f0000000080)={0x9, 0x3831354f, 0x1, @stepwise={0xda, 0x100, 0x8000, 0x80000000, 0x0, 0x9}})
syz_open_dev$tty1(0xc, 0x4, 0x1)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
request_key(0x0, 0x0, &(0x7f0000000340)='\x8e\x00\x9e\xbb\x1e\x1av\xe8M\x00d\xaaI\x00\x00\x00\x00\x00\x00\t<\xe5u\xedA\xa7\aT\xdd\xd1{\xff\xcb\xdb\xb11\xc2s\xcb\xbf\x04\x00\x00\x00<\xfe\xf9\f\xe6E\b\x00\xd7\x85q\xc4\xab\xbd&\x92\x89(\xf3\"\xceJ\x19\x185\xa6- \xe6uK\xe1D\x8f\x9f\x92\xca\x93#\xf5E\xc2\x91Yl\x17\a\x02\t\x17\x7f\xc4\xde\x04\x9b\x89#\xf6&[\xd81\xb3\xdc\x00\x04\x15\x03\x17R\xd24\xeb\xb5\xc2\xff\x1bnF\x8e\xe4\'\x18\xba9.\xd4\xd9\xc6\x98\x8f\xc6D!p\xbeV\xb7x\r@\x1b5\x8br\x11\xdex\x19\x89\xdc\x1el\xcd\x13\xb6\xc2\xdb\x1fr2\x7f?\xfe\x0f\x04\x11\xc3\x8f:uXQ\x0f\v\xfc\xff\x7fL\xfb\xa8]\xd4\xd7\x13?\xe3<#\x1f\x9a\x03C\x8f\xe7\rV1\x99\xaf@Re\x18J\xb6\xee\xeeAnR\n\x8a\xe4\x1a:&\xc7\x15B\x8aG\xa4\a`\xee\xaf\x80T\xddo\xc4D^z\xbf\x1c\x87F?!k\'\xc3\xf9\xa3\xd9\x85\xb1N%\x17\f\xd0#\x05^\xf7\x11\x13\xadKb\x8ck\x10\xd3 >\t\xe0\x16\x80\x82\xb3\xcc\xc7\x05*\x9b\x0eQ\x92\xd7\xbaO\x06\xb2\xdc\xe7/\x1f\x90]IB94(evFMJ\x85\xc4S\xa8\x8b\xbe\xd3\x90\xe9\t\x00\x13\x1e\x9a\x94\x00\x00\x00\x00\x00U\xfbLA\xa6K\xd5\x0eD\xf2Y\xc3,\t4hD\xc4o\xc3\x87$\x9d6\xc8\x93\xa3\x8e:\xfe#\xa0`\xb1k\xacz\xe0\xb3\x95\x17\xdf\xc7\xc2\xedKc\xa3\xbd\xc2\x9f\x86C(/\xe3\xb2\xc6$s^\xd1vU\x9cB)ao\xf1\'', 0xffffffffffffffff)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
ioctl$COMEDI_DEVCONFIG(0xffffffffffffffff, 0x40946400, &(0x7f00000000c0)={'dmm32at\x00', [0x300, 0x1, 0x1, 0x2000, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xffffe]})
r1 = syz_open_dev$sndmidi(&(0x7f0000000180), 0x2, 0x14b102)
writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
socketpair$unix(0x1, 0x5, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'netdevsim0\x00'})
r2 = socket$netlink(0x10, 0x3, 0x0)
ioctl$sock_SIOCBRDELBR(r2, 0x89a2, &(0x7f0000000000)='bridge0\x00')
r3 = socket(0x10, 0x3, 0x0)
pipe(&(0x7f0000000080)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
writev(0xffffffffffffffff, &(0x7f0000000200)=[{&(0x7f0000000280)}], 0x1)
syz_ublk_setup_io_uring(0x735d, &(0x7f0000000500)={0x0, 0x8eb4, 0x1000, 0x3, 0xa1, 0x0, r4}, &(0x7f0000000580), &(0x7f00000005c0), &(0x7f0000000600))
ioctl$AUTOFS_DEV_IOCTL_VERSION(r5, 0xc0189371, &(0x7f0000000140)={{0x1, 0x1, 0x18}, './file0\x00'})
sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0xfc, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480d0000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io
detailed listing:
executing program 0:
r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000000)=ANY=[], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00\"\v'], 0x0}, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f00000000c0)={0x84, &(0x7f0000000180)=ANY=[@ANYBLOB="00140d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$hid(r0, 0x0, &(0x7f00000001c0)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="200119"], 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000940)={0x84, &(0x7f00000004c0)={0x60, 0x16, 0x13, "df521338cfe20598e72c08a3906477c4dec397"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io$hid-syz_usb_control_io$cdc_ncm-syz_usb_control_io-syz_usb_control_io$printer-syz_usb_control_io$cdc_ncm-syz_usb_control_io$sierra_net-syz_usb_control_io$sierra_net-syz_usb_control_io$cdc_ecm-syz_usb_control_io$hid-syz_usb_control_io$lan78xx-syz_usb_control_io$sierra_net
detailed listing:
executing program 0:
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000795d6c08450c3a616dc4010203010902120001000000000904"], 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000400)={0x2c, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x44, &(0x7f0000000040)=ANY=[@ANYBLOB="00000100000012"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$printer(r0, 0x0, 0x0)
syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, &(0x7f00000002c0)={0x10, &(0x7f0000000240)=ANY=[], 0x0, 0x0})
syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0)
syz_usb_control_io$hid(r0, 0x0, 0x0)
syz_usb_control_io$lan78xx(r0, 0x0, 0x0)
syz_usb_control_io$sierra_net(r0, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$nbd-ioctl$EVIOCSMASK-syz_open_dev$I2C-socket$kcm-write$cgroup_pressure-ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB-sendmmsg-prctl$PR_SCHED_CORE-ioctl$FIONREAD-prlimit64-sched_setscheduler-sched_setaffinity-syz_open_dev$MSR-read$msr-socket$inet_tcp-bind$inet-shutdown-ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD-setsockopt$inet_tcp_TCP_CONGESTION-recvfrom$inet-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING
detailed listing:
executing program 0:
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)})
syz_open_dev$I2C(&(0x7f00000007c0), 0x0, 0x40)
r0 = socket$kcm(0x29, 0x5, 0x0)
write$cgroup_pressure(r0, &(0x7f0000000140)={'full'}, 0xfffffdef)
ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(0xffffffffffffffff, 0xc01064bd, &(0x7f0000000280)={0x0})
sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x40080c3)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
ioctl$FIONREAD(0xffffffffffffffff, 0x541b, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x8f}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000480)=0x45)
sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2)
r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x10)
shutdown(0xffffffffffffffff, 0x0)
ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000300)={0x0, 'bond0\x00', {0x3}, 0x7})
setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000040)='bbr', 0x3)
recvfrom$inet(r2, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$comedi-openat-openat$sequencer2-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-syz_open_dev$sndmidi-writev-socket$kcm-socket-rseq-socket$rds-setsockopt$sock_int-bind$rds-sendmsg$rds-clock_adjtime-syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_CREATE_BUFS-socket$nl_route-openat$sysfs-sendmmsg$alg
detailed listing:
executing program 0:
openat$comedi(0xffffffffffffff9c, 0x0, 0x80400, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0xc, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7)
r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
socket$kcm(0x2, 0x7, 0x2)
socket(0x10, 0x2, 0x0)
rseq(&(0x7f0000001080)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0)
r1 = socket$rds(0x15, 0x5, 0x0)
setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000000080)=0x1, 0x4)
bind$rds(r1, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10)
sendmsg$rds(r1, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x4e21, @local}, 0x10, &(0x7f0000000540), 0x0, &(0x7f0000000400)=[@zcopy_cookie={0x18, 0x114, 0xc, 0x42}], 0x18, 0x40080}, 0x4000000)
clock_adjtime(0x0, 0x0)
r2 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2)
ioctl$vim2m_VIDIOC_CREATE_BUFS(r2, 0xc0f8565c, &(0x7f0000000340)={0x1ff, 0x5, 0x1, {0x1, @pix={0xff, 0xa, 0x31324d4e, 0x0, 0x9, 0xffffff61, 0x9, 0x9, 0x0, 0x7, 0x2, 0x6}}, 0xd5a})
socket$nl_route(0x10, 0x3, 0x0)
r3 = openat$sysfs(0xffffff9c, &(0x7f00000000c0)='/sys/power/pm_test', 0x4000, 0x4)
sendmmsg$alg(r3, &(0x7f0000001240)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=[@iv={0x10}, @iv={0x10}], 0x20, 0x4880}, {0x0, 0x0, &(0x7f0000000840)=[{0x0}, {&(0x7f0000000780)="a27e751b506316d107c78c782937d6f33110862675b0cf4dd973f8161521f90c77ae4f26", 0x24}, {&(0x7f00000007c0)="946bcac2250f0a616e8f94e1baf7b9138cced2ccf8f2b4fe1e1a49f73250e614790249b84c8ee0ac47c0522e6c5da4f2f6b159d442a2d87aea70f7bdaf01436c4dce087aaff4696c77b8e973c587ecd7bb5fb2112e02f5df43bfa918e9f3026c9dff6f89975f76fcbecb71b5e8513c81f57cdeb0f24b6f767bc017ceea83", 0x7e}], 0x3, &(0x7f0000000880)=[@op={0x10, 0x117, 0x3, 0x1}], 0x10}, {0x0, 0x0, &(0x7f0000000900)=[{&(0x7f00000008c0)="3398a4", 0x3}], 0x1, &(0x7f0000000940)=[@assoc={0x10, 0x117, 0x4, 0x9}, @op={0x10, 0x117, 0x3, 0x1}, @op={0x10}], 0x30, 0x804c044}, {0x0, 0x0, &(0x7f00000010c0)=[{&(0x7f0000000a00)="a0ea6ea3427cef817dd7f81fd0efb568b0042fa10ff6e6e4e392e66e8a34d95fe4c9992b92ec54c266480c85ff0a76466f1ce133f0cc4a6590e68fe866b01294bbcd429977fc947d8c9303e5c96ce7a2457b795806086a68f4f32f4b2176d8ba50d133f85ead618af914d9787ba92896babebf4051c3f9e2c84e15ef7a0b9d30129b4d5d9e254dc15d6614384e817bf75584609c24a00c06c9d319", 0x9b}, {&(0x7f0000000ac0)="22509617adb91afa439b1f9b00ab2e15ab77ecc52cf6f6a79073d4a1f8166a86c20833c2527209467f628723fdbb88bad4b80d4c8a63d029eefb08cf461f2d433478", 0x42}, {&(0x7f0000000b40)="059af19a024c264d6e2a18d4bdcf804e2a17fee1863f29cda5134d6197b20382f5ff8b4d346a3bcf96877ea76e6ce26157409b0aca740a4806e568b7b16951be81bc3ea73611fe43127c2a8bb9b80c3b040dd6c4ba23f70ec96b57444fe9ccd69c5d43024e04ab16d43d6b7147ccfc448f573f5427a47cf6e7360ae611cf13d8cf03c736daaadc8187a36c559901c37f67d42921a2c8ff5c2d1f417d40b047b97ee0087bc2b896c44822e3876a58e27b32645bc00ad073733b35f160c47a569b7bb06ad4d65bd64dc2b6295132bb035fce916b5a230d3b6b308b122e360d7b8a28a2", 0xe2}, {0x0}, {&(0x7f0000000d40)="e6195fc805a6f8c49b717a2366b3610d2f1b646ffc85b7155922cdecf64ecd4d21849bcbfe4b8a5e4bbe74ea48beb9330f6ef93d5de44210850678c387ee6fdd0ed5efade60c12cf6cb08c683343934f1fc156a85e2c243d1abb962a425de7a1d2a7fc91e8c8928825204bf4615cf7e06d754e7e42cbca7b3c776c20174c5c8f8324b08633a7e517f6fbde324c557b78280872b174f30ee2fd8c06a7be9cd2", 0x9f}, {&(0x7f0000000e00)="9f151fd0f92644ca6a7fa73237bff578a7875549783e18c77f5d88a2323668c9334e5450243cfff2df0d5d1ebcc6052ae3e0edbc082b6e3163418151b361bd166bbde8b59a67f88095cacb949d0d68753be0ccfe6b51f180b0b71c098bd0049d74ea0ae906f016a3606b1cf40aa4872e9b30f00a7ce7e51b363651be2c6f59b3d656d7627d34afcdad559c475461c394ac41d328cdccc4f11e8fd078c9b1d1207801e6cbf31922692048e3ac4a84", 0xae}, {&(0x7f0000000ec0)="f9bee3476b931125ba7ae463e3c95db05048f2a4a5cd858a744e9058a13c7720eb751bac0f701da57b44befb73d2d5da9e7b9fbd6c544f2cb45df193860fd17352c817740c817af933b1cb9f2a83f81e013b0a369869c6ea4c83e01703d5900be2d6beda7efd6cc05677c70146b3771c5b9a1f0b72fd72fd35dbec03f7201b919810cbc3991b36604f72abc45b7eeae32bb72a0ab1d635ea248b0e75bced85d5a4040b776fd2ecda93974fba7f", 0xad}], 0x7, &(0x7f0000001140)=[@op={0x10}, @iv={0xa4, 0x117, 0x2, 0x91, "ce0faff8d5f8795f6467cda21010882ca780911951398e64c9322a6af2f3b766d1abba4dee1c7c5a883aaadba192581e7a1d2a90d97d3ef1a2d97de1010061888c0b016b9a17bc624b7ac63fd7f4d50a02f58a1c639c4e3a3fb3206ad7326b2eb150391e18285943f0ca2f1703d893ff4b593a9d71358f359b6998c020704356647b5239d7dc96072c2c285ce633fe8c3e"}, @op={0x10}], 0xc4, 0x4800}], 0x4, 0x190)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$comedi-openat-openat$sequencer2-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-syz_open_dev$sndmidi-writev-socket$kcm-socket-rseq-socket$rds-setsockopt$sock_int-bind$rds-sendmsg$rds-clock_adjtime-syz_open_dev$vim2m-ioctl$vim2m_VIDIOC_CREATE_BUFS-socket$nl_route-openat$sysfs-sendmmsg$alg
detailed listing:
executing program 0:
openat$comedi(0xffffffffffffff9c, 0x0, 0x80400, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0xc, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7)
r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
socket$kcm(0x2, 0x7, 0x2)
socket(0x10, 0x2, 0x0)
rseq(&(0x7f0000001080)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0)
r1 = socket$rds(0x15, 0x5, 0x0)
setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000000080)=0x1, 0x4)
bind$rds(r1, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10)
sendmsg$rds(r1, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x4e21, @local}, 0x10, &(0x7f0000000540), 0x0, &(0x7f0000000400)=[@zcopy_cookie={0x18, 0x114, 0xc, 0x42}], 0x18, 0x40080}, 0x4000000)
clock_adjtime(0x0, 0x0)
r2 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2)
ioctl$vim2m_VIDIOC_CREATE_BUFS(r2, 0xc0f8565c, &(0x7f0000000340)={0x1ff, 0x5, 0x1, {0x1, @pix={0xff, 0xa, 0x31324d4e, 0x0, 0x9, 0xffffff61, 0x9, 0x9, 0x0, 0x7, 0x2, 0x6}}, 0xd5a})
socket$nl_route(0x10, 0x3, 0x0)
r3 = openat$sysfs(0xffffff9c, &(0x7f00000000c0)='/sys/power/pm_test', 0x4000, 0x4)
sendmmsg$alg(r3, &(0x7f0000001240)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=[@iv={0x10}, @iv={0x10}], 0x20, 0x4880}, {0x0, 0x0, &(0x7f0000000840)=[{0x0}, {&(0x7f0000000780)="a27e751b506316d107c78c782937d6f33110862675b0cf4dd973f8161521f90c77ae4f26", 0x24}, {&(0x7f00000007c0)="946bcac2250f0a616e8f94e1baf7b9138cced2ccf8f2b4fe1e1a49f73250e614790249b84c8ee0ac47c0522e6c5da4f2f6b159d442a2d87aea70f7bdaf01436c4dce087aaff4696c77b8e973c587ecd7bb5fb2112e02f5df43bfa918e9f3026c9dff6f89975f76fcbecb71b5e8513c81f57cdeb0f24b6f767bc017ceea83", 0x7e}], 0x3, &(0x7f0000000880)=[@op={0x10, 0x117, 0x3, 0x1}], 0x10}, {0x0, 0x0, &(0x7f0000000900)=[{&(0x7f00000008c0)="3398a4", 0x3}], 0x1, &(0x7f0000000940)=[@assoc={0x10, 0x117, 0x4, 0x9}, @op={0x10, 0x117, 0x3, 0x1}, @op={0x10}], 0x30, 0x804c044}, {0x0, 0x0, &(0x7f00000010c0)=[{&(0x7f0000000a00)="a0ea6ea3427cef817dd7f81fd0efb568b0042fa10ff6e6e4e392e66e8a34d95fe4c9992b92ec54c266480c85ff0a76466f1ce133f0cc4a6590e68fe866b01294bbcd429977fc947d8c9303e5c96ce7a2457b795806086a68f4f32f4b2176d8ba50d133f85ead618af914d9787ba92896babebf4051c3f9e2c84e15ef7a0b9d30129b4d5d9e254dc15d6614384e817bf75584609c24a00c06c9d319", 0x9b}, {&(0x7f0000000ac0)="22509617adb91afa439b1f9b00ab2e15ab77ecc52cf6f6a79073d4a1f8166a86c20833c2527209467f628723fdbb88bad4b80d4c8a63d029eefb08cf461f2d433478", 0x42}, {&(0x7f0000000b40)="059af19a024c264d6e2a18d4bdcf804e2a17fee1863f29cda5134d6197b20382f5ff8b4d346a3bcf96877ea76e6ce26157409b0aca740a4806e568b7b16951be81bc3ea73611fe43127c2a8bb9b80c3b040dd6c4ba23f70ec96b57444fe9ccd69c5d43024e04ab16d43d6b7147ccfc448f573f5427a47cf6e7360ae611cf13d8cf03c736daaadc8187a36c559901c37f67d42921a2c8ff5c2d1f417d40b047b97ee0087bc2b896c44822e3876a58e27b32645bc00ad073733b35f160c47a569b7bb06ad4d65bd64dc2b6295132bb035fce916b5a230d3b6b308b122e360d7b8a28a2", 0xe2}, {0x0}, {&(0x7f0000000d40)="e6195fc805a6f8c49b717a2366b3610d2f1b646ffc85b7155922cdecf64ecd4d21849bcbfe4b8a5e4bbe74ea48beb9330f6ef93d5de44210850678c387ee6fdd0ed5efade60c12cf6cb08c683343934f1fc156a85e2c243d1abb962a425de7a1d2a7fc91e8c8928825204bf4615cf7e06d754e7e42cbca7b3c776c20174c5c8f8324b08633a7e517f6fbde324c557b78280872b174f30ee2fd8c06a7be9cd2", 0x9f}, {&(0x7f0000000e00)="9f151fd0f92644ca6a7fa73237bff578a7875549783e18c77f5d88a2323668c9334e5450243cfff2df0d5d1ebcc6052ae3e0edbc082b6e3163418151b361bd166bbde8b59a67f88095cacb949d0d68753be0ccfe6b51f180b0b71c098bd0049d74ea0ae906f016a3606b1cf40aa4872e9b30f00a7ce7e51b363651be2c6f59b3d656d7627d34afcdad559c475461c394ac41d328cdccc4f11e8fd078c9b1d1207801e6cbf31922692048e3ac4a84", 0xae}, {&(0x7f0000000ec0)="f9bee3476b931125ba7ae463e3c95db05048f2a4a5cd858a744e9058a13c7720eb751bac0f701da57b44befb73d2d5da9e7b9fbd6c544f2cb45df193860fd17352c817740c817af933b1cb9f2a83f81e013b0a369869c6ea4c83e01703d5900be2d6beda7efd6cc05677c70146b3771c5b9a1f0b72fd72fd35dbec03f7201b919810cbc3991b36604f72abc45b7eeae32bb72a0ab1d635ea248b0e75bced85d5a4040b776fd2ecda93974fba7f", 0xad}], 0x7, &(0x7f0000001140)=[@op={0x10}, @iv={0xa4, 0x117, 0x2, 0x91, "ce0faff8d5f8795f6467cda21010882ca780911951398e64c9322a6af2f3b766d1abba4dee1c7c5a883aaadba192581e7a1d2a90d97d3ef1a2d97de1010061888c0b016b9a17bc624b7ac63fd7f4d50a02f58a1c639c4e3a3fb3206ad7326b2eb150391e18285943f0ca2f1703d893ff4b593a9d71358f359b6998c020704356647b5239d7dc96072c2c285ce633fe8c3e"}, @op={0x10}], 0xc4, 0x4800}], 0x4, 0x190)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000480)='./nfsd\x00', &(0x7f00000004c0)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000700)='./proc\x00', &(0x7f0000000740)='proc\x00', 0x4000, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000780)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000580)='tcp 2', 0x5)

program crashed: kernel BUG in svc_destroy
single: successfully extracted reproducer
found reproducer with 7 syscalls
minimizing guilty program
testing program (duration=1m15.425965636s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000480)='./nfsd\x00', &(0x7f00000004c0)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000700)='./proc\x00', &(0x7f0000000740)='proc\x00', 0x4000, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000780)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000500)='./nfsd/portlist\x00', 0x1, 0x0)

program did not crash
testing program (duration=1m15.425965636s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000480)='./nfsd\x00', &(0x7f00000004c0)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000700)='./proc\x00', &(0x7f0000000740)='proc\x00', 0x4000, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000780)='./proc/thread-self/fail-nth\x00', 0x2, 0x0)
write(0xffffffffffffffff, &(0x7f0000000580)='tcp 2', 0x5)

program did not crash
testing program (duration=1m15.425965636s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000480)='./nfsd\x00', &(0x7f00000004c0)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000700)='./proc\x00', &(0x7f0000000740)='proc\x00', 0x4000, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000580)='tcp 2', 0x5)

program crashed: kernel BUG in svc_destroy
testing program (duration=1m15.425965636s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-mkdirat-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000480)='./nfsd\x00', &(0x7f00000004c0)='nfsd\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000580)='tcp 2', 0x5)

program crashed: kernel BUG in svc_destroy
testing program (duration=1m15.425965636s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000480)='./nfsd\x00', &(0x7f00000004c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000580)='tcp 2', 0x5)

program crashed: kernel BUG in svc_destroy
testing program (duration=1m15.425965636s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./nfsd\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000580)='tcp 2', 0x5)

program did not crash
testing program (duration=1m15.425965636s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000480)='./nfsd\x00', &(0x7f00000004c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000580)='tcp 2', 0x5)

program did not crash
testing program (duration=1m15.425965636s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000480)='./nfsd\x00', &(0x7f00000004c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000580)='tcp 2', 0x5)

program did not crash
testing program (duration=1m15.425965636s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f00000004c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000580)='tcp 2', 0x5)

program did not crash
testing program (duration=1m15.425965636s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000480)='./nfsd\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000580)='tcp 2', 0x5)

program did not crash
testing program (duration=1m15.425965636s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000480)='./nfsd\x00', &(0x7f00000004c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0)
write(r0, &(0x7f0000000580)='tcp 2', 0x5)

program did not crash
testing program (duration=1m15.425965636s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000480)='./nfsd\x00', &(0x7f00000004c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)

program did not crash
testing program (duration=1m15.425965636s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000480)='./nfsd\x00', &(0x7f00000004c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000580), 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m15.425965636s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
simplifying C reproducer
testing compiled C program (duration=1m15.425965636s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=1m15.425965636s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=1m15.425965636s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=1m15.425965636s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=1m15.425965636s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program did not crash
testing compiled C program (duration=1m15.425965636s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing compiled C program (duration=1m15.425965636s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: kernel BUG in svc_destroy
testing program (duration=1m15.425965636s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000480)='./nfsd\x00', &(0x7f00000004c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000580)='tcp 2', 0x5)

program crashed: kernel BUG in svc_destroy
validation run: crashed=true
testing program (duration=1m15.425965636s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000480)='./nfsd\x00', &(0x7f00000004c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000580)='tcp 2', 0x5)

program crashed: kernel BUG in svc_destroy
validation run: crashed=true
testing program (duration=1m15.425965636s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000480)='./nfsd\x00', &(0x7f00000004c0)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./nfsd/portlist\x00', 0x1, 0x0)
write(r0, &(0x7f0000000580)='tcp 2', 0x5)

program crashed: kernel BUG in svc_destroy
validation run: crashed=true
reproducing took 1h29m41.17299011s
repro crashed as (corrupted=false):
------------[ cut here ]------------
kernel BUG at net/sunrpc/svc.c:605!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4462 Comm: syz.0.18 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
RIP: 0010:svc_destroy+0x184/0x190 net/sunrpc/svc.c:605
Code: 5f 5d e9 7f dd 5e f8 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 24 ff ff ff 4c 89 ff e8 66 74 77 f8 e9 17 ff ff ff e8 9c 10 26 f8 <0f> 0b e8 95 10 26 f8 0f 0b 0f 1f 00 55 41 57 41 56 41 55 41 54 53
RSP: 0018:ffffc90003427b10 EFLAGS: 00010293
RAX: ffffffff895c5804 RBX: ffff888023d42450 RCX: ffff8880306e0000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90003427cb8 R08: ffffffff91b6235f R09: 1ffffffff236c46b
R10: dffffc0000000000 R11: fffffbfff236c46c R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff888023d42468 R15: 0000000000000001
FS:  000055559545f500(0000) GS:ffff8880b8d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7ae295da08 CR3: 0000000023da2000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 kref_put include/linux/kref.h:65 [inline]
 svc_put include/linux/sunrpc/svc.h:123 [inline]
 __write_ports_addxprt fs/nfsd/nfsctl.c:768 [inline]
 __write_ports fs/nfsd/nfsctl.c:794 [inline]
 write_ports+0xa26/0xb80 fs/nfsd/nfsctl.c:847
 nfsctl_transaction_write+0x105/0x150 fs/nfsd/nfsctl.c:114
 vfs_write+0x2dc/0x9a0 fs/read_write.c:582
 ksys_write+0x14d/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f7ae1b9fb19
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffec6991188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f7ae1e25fa0 RCX: 00007f7ae1b9fb19
RDX: 0000000000000005 RSI: 0000200000000580 RDI: 0000000000000003
RBP: 00007f7ae1c37b70 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f7ae1e25fac R14: 00007f7ae1e25fa0 R15: 00007f7ae1e25fa0
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:svc_destroy+0x184/0x190 net/sunrpc/svc.c:605
Code: 5f 5d e9 7f dd 5e f8 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 24 ff ff ff 4c 89 ff e8 66 74 77 f8 e9 17 ff ff ff e8 9c 10 26 f8 <0f> 0b e8 95 10 26 f8 0f 0b 0f 1f 00 55 41 57 41 56 41 55 41 54 53
RSP: 0018:ffffc90003427b10 EFLAGS: 00010293
RAX: ffffffff895c5804 RBX: ffff888023d42450 RCX: ffff8880306e0000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90003427cb8 R08: ffffffff91b6235f R09: 1ffffffff236c46b
R10: dffffc0000000000 R11: fffffbfff236c46c R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff888023d42468 R15: 0000000000000001
FS:  000055559545f500(0000) GS:ffff8880b8d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7ae295da08 CR3: 0000000023da2000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

final repro crashed as (corrupted=false):
------------[ cut here ]------------
kernel BUG at net/sunrpc/svc.c:605!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4462 Comm: syz.0.18 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
RIP: 0010:svc_destroy+0x184/0x190 net/sunrpc/svc.c:605
Code: 5f 5d e9 7f dd 5e f8 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 24 ff ff ff 4c 89 ff e8 66 74 77 f8 e9 17 ff ff ff e8 9c 10 26 f8 <0f> 0b e8 95 10 26 f8 0f 0b 0f 1f 00 55 41 57 41 56 41 55 41 54 53
RSP: 0018:ffffc90003427b10 EFLAGS: 00010293
RAX: ffffffff895c5804 RBX: ffff888023d42450 RCX: ffff8880306e0000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90003427cb8 R08: ffffffff91b6235f R09: 1ffffffff236c46b
R10: dffffc0000000000 R11: fffffbfff236c46c R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff888023d42468 R15: 0000000000000001
FS:  000055559545f500(0000) GS:ffff8880b8d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7ae295da08 CR3: 0000000023da2000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 kref_put include/linux/kref.h:65 [inline]
 svc_put include/linux/sunrpc/svc.h:123 [inline]
 __write_ports_addxprt fs/nfsd/nfsctl.c:768 [inline]
 __write_ports fs/nfsd/nfsctl.c:794 [inline]
 write_ports+0xa26/0xb80 fs/nfsd/nfsctl.c:847
 nfsctl_transaction_write+0x105/0x150 fs/nfsd/nfsctl.c:114
 vfs_write+0x2dc/0x9a0 fs/read_write.c:582
 ksys_write+0x14d/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f7ae1b9fb19
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffec6991188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f7ae1e25fa0 RCX: 00007f7ae1b9fb19
RDX: 0000000000000005 RSI: 0000200000000580 RDI: 0000000000000003
RBP: 00007f7ae1c37b70 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f7ae1e25fac R14: 00007f7ae1e25fa0 R15: 00007f7ae1e25fa0
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:svc_destroy+0x184/0x190 net/sunrpc/svc.c:605
Code: 5f 5d e9 7f dd 5e f8 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 24 ff ff ff 4c 89 ff e8 66 74 77 f8 e9 17 ff ff ff e8 9c 10 26 f8 <0f> 0b e8 95 10 26 f8 0f 0b 0f 1f 00 55 41 57 41 56 41 55 41 54 53
RSP: 0018:ffffc90003427b10 EFLAGS: 00010293
RAX: ffffffff895c5804 RBX: ffff888023d42450 RCX: ffff8880306e0000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90003427cb8 R08: ffffffff91b6235f R09: 1ffffffff236c46b
R10: dffffc0000000000 R11: fffffbfff236c46c R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff888023d42468 R15: 0000000000000001
FS:  000055559545f500(0000) GS:ffff8880b8d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7ae295da08 CR3: 0000000023da2000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400