Extracting prog: 28m21.646907749s
Minimizing prog: 28m49.448020783s
Simplifying prog options: 0s
Extracting C: 1m52.302833102s
Simplifying C: 9m22.867277635s


extracting reproducer from 15 programs
testing a last program of every proc
single: executing 4 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write-close-close-openat-openat-write-close-close
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/devices/pcspkr\x00', 0x0, 0x0)
r1 = openat(r0, &(0x7f0000000300)='driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='ci_hdrc\x00', 0x7)
close(r1)
close(r0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/ci_hdrc\x00', 0x0, 0x0)
r3 = openat(r2, &(0x7f0000000600)='bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000700)='pcspkr\x00', 0x6)
close(r3)
close(r2)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$comedi-ioctl$COMEDI_DEVCONFIG-openat$comedi-ioctl$COMEDI_DEVCONFIG-ioctl$COMEDI_INSN
detailed listing:
executing program 0:
r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi0\x00', 0x2, 0x0)
ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000100)={'comedi_test\x00'})
r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000200)='/dev/comedi1\x00', 0x2, 0x0)
ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000300)={'comedi_bond\x00'})
ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000400)={0xc000002, 0x2, &(0x7f0000000500)=[0x1, 0x1]})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='maxtcpc 0x22\n\x00', 0xd)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/i2c/devices/0-0022\x00', 0x0, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat$dir-openat-write-openat$dir-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/devices/pcspkr\x00', 0x0, 0x0)
r1 = openat(r0, &(0x7f0000000100)='driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='oxu210hp-hcd\x00', 0xe)
r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/oxu210hp-hcd\x00', 0x0, 0x0)
r3 = openat(r2, &(0x7f00000001c0)='bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000200)='pcspkr\x00', 0x7)

program did not crash
single: failed to extract reproducer
bisect: bisecting 15 programs with base timeout 30s
testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [26, 10, 5, 2, 8, 10, 33, 6, 5, 7, 12, 8, 5, 5, 12]
detailed listing:
executing program 0:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000140)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/n\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/n/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r2, &(0x7f00000003c0)='rdma\n', 0x5)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r3, &(0x7f0000000440)='172.20.20.23\n', 0xd)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r4, &(0x7f00000004c0)='4420\n', 0x5)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='ipv4\n', 0x5)
close(r5)
symlinkat(&(0x7f00000005c0)='./config/nvmet/subsystems/n\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/subsystems/n\x00')
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000640), 0x2, 0x0)
write(r6, &(0x7f0000000680)='transport=rdma,traddr=172.20.20.23,trsvcid=4420,nqn=n\n', 0x36)
nanosleep(&(0x7f0000000700)={0x0, 0x50000000}, 0x0)
unlinkat(0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/n\x00', 0x0)
executing program 3:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd26, 0x25dfdbfd, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x41}, 0x4)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000400)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000500)={<r2=>0x0}, 0x106, 0x2}}, 0x20)
write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000700)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @loopback}, r2, 0x3e8}}, 0x48)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, &(0x7f0000000800)={0x4, 0x8, 0xfa00, {r2, 0x3e8}}, 0x10)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
write$RDMA_USER_CM_CMD_CONNECT(r1, &(0x7f0000000900)={0x6, 0x118, 0xfa00, {{0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, r2}}, 0x120)
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302000200"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000001000)={0x84, &(0x7f00000001c0)={0x40, 0x4, 0x2, ' \x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
syz_usb_ep_write(r0, 0x81, 0xa, &(0x7f0000000100)="0a000100010000000001")
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
executing program 1:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e30001000000010902200001010080fa0904000001ff00000007058202000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/target\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/target/core\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/target/core/rd_mcp_0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/target/core/rd_mcp_0/dev0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/target/core/rd_mcp_0/dev0/statistics/scsi_lu/lun\x00', 0x0, 0x0)
read(r0, &(0x7f0000000200)=""/4096, 0x1000)
executing program 2:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000400)="0080002000"/16)
syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000500)='\x00'/16)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/nullb1/zoned\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='1\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='1\n', 0x2)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r2, &(0x7f0000000400)='1\n', 0x2)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000540)='/dev/nullb1\n', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f0000000600)='1\n', 0x2)
close(r4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1\x00', 0x1ff)
r5 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000740)='loop\n', 0x5)
close(r5)
symlinkat(&(0x7f0000000780)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write(r6, &(0x7f0000000900)='transport=loop,nqn=testsubsys\n', 0x1e)
close(r6)
nanosleep(&(0x7f0000000940)={0x0, 0x1dcd6500}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./dev/nvme0n1\x00', 0x2, 0x0)
ioctl(r7, 0xc0101282, &(0x7f0000000a00)="00000000000000000100"/80)
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
sendto$inet(r0, &(0x7f0000000100)="1234", 0x4, 0x0, &(0x7f0000000200)={0x2, 0x1b59, @loopback}, 0x10)
r1 = socket$inet6(0xa, 0x2, 0x0)
sendto$inet6(r1, &(0x7f0000000100)="1234", 0x4, 0x0, &(0x7f0000000240)={0xa, 0x1b59, 0x0, @loopback}, 0x1c)
syz_emit_ethernet(0x6a, &(0x7f0000000000)={@broadcast, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x1b59, 0x48, 0x0, @wg=@cookie={0x3, 0x0, "4b3f7633015aff9fa5e73369ed3ed4f938752184f1af2029", "14ef0f501fd4f4fc0d232b48a86ef0222fb6364766977f816acb8f51148dba1a"}}}}}}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'\x00', 0x1001})
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000100)={'\x00', {0x2, 0x0, @private=0xa010101}})
close(r0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='tcp 2049\n', 0x9)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r1, &(0x7f0000000900)={0x2, 0x801, @loopback}, 0x10)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='md0\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external:test\x00', 0xe)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1:0\x00', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/dev-ram0/state\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='external_bbl\x00', 0xd)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/dev-ram0/bad_blocks\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='0 8\n', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/devices/pcspkr\x00', 0x0, 0x0)
r1 = openat(r0, &(0x7f0000000100)='driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='oxu210hp-hcd\x00', 0xe)
r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/oxu210hp-hcd\x00', 0x0, 0x0)
r3 = openat(r2, &(0x7f00000001c0)='bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000200)='pcspkr\x00', 0x7)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='maxtcpc 0x22\n\x00', 0xd)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/i2c/devices/0-0022\x00', 0x0, 0x0)
executing program 2:
r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi0\x00', 0x2, 0x0)
ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000100)={'comedi_test\x00'})
r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000200)='/dev/comedi1\x00', 0x2, 0x0)
ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000300)={'comedi_bond\x00'})
ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000400)={0xc000002, 0x2, &(0x7f0000000500)=[0x1, 0x1]})
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/devices/pcspkr\x00', 0x0, 0x0)
r1 = openat(r0, &(0x7f0000000300)='driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='ci_hdrc\x00', 0x7)
close(r1)
close(r0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/ci_hdrc\x00', 0x0, 0x0)
r3 = openat(r2, &(0x7f0000000600)='bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000700)='pcspkr\x00', 0x6)
close(r3)
close(r2)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 4 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-openat-write-close-close-openat-openat-write-close-close
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/devices/pcspkr\x00', 0x0, 0x0)
r1 = openat(r0, &(0x7f0000000300)='driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='ci_hdrc\x00', 0x7)
close(r1)
close(r0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/ci_hdrc\x00', 0x0, 0x0)
r3 = openat(r2, &(0x7f0000000600)='bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000700)='pcspkr\x00', 0x6)
close(r3)
close(r2)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$comedi-ioctl$COMEDI_DEVCONFIG-openat$comedi-ioctl$COMEDI_DEVCONFIG-ioctl$COMEDI_INSN
detailed listing:
executing program 0:
r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi0\x00', 0x2, 0x0)
ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000100)={'comedi_test\x00'})
r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000200)='/dev/comedi1\x00', 0x2, 0x0)
ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000300)={'comedi_bond\x00'})
ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000400)={0xc000002, 0x2, &(0x7f0000000500)=[0x1, 0x1]})

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='maxtcpc 0x22\n\x00', 0xd)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/i2c/devices/0-0022\x00', 0x0, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat$dir-openat-write-openat$dir-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/devices/pcspkr\x00', 0x0, 0x0)
r1 = openat(r0, &(0x7f0000000100)='driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='oxu210hp-hcd\x00', 0xe)
r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/oxu210hp-hcd\x00', 0x0, 0x0)
r3 = openat(r2, &(0x7f00000001c0)='bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000200)='pcspkr\x00', 0x7)

program did not crash
single: failed to extract reproducer
bisect: bisecting 15 programs with base timeout 1m40s
testing program (duration=1m43s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [26, 10, 5, 2, 8, 10, 33, 6, 5, 7, 12, 8, 5, 5, 12]
detailed listing:
executing program 0:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2a, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000140)='./config\x00', &(0x7f0000000180)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/nvmet/subsystems/n\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nvmet/subsystems/n/attr_allow_any_host\x00', 0x1, 0x0)
write(r1, &(0x7f00000002c0)='1\n', 0x2)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/nvmet/ports/1\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r2, &(0x7f00000003c0)='rdma\n', 0x5)
close(r2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./config/nvmet/ports/1/addr_traddr\x00', 0x1, 0x0)
write(r3, &(0x7f0000000440)='172.20.20.23\n', 0xd)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000480)='./config/nvmet/ports/1/addr_trsvcid\x00', 0x1, 0x0)
write(r4, &(0x7f00000004c0)='4420\n', 0x5)
close(r4)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/nvmet/ports/1/addr_adrfam\x00', 0x1, 0x0)
write(r5, &(0x7f0000000540)='ipv4\n', 0x5)
close(r5)
symlinkat(&(0x7f00000005c0)='./config/nvmet/subsystems/n\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/nvmet/ports/1/subsystems/n\x00')
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000640), 0x2, 0x0)
write(r6, &(0x7f0000000680)='transport=rdma,traddr=172.20.20.23,trsvcid=4420,nqn=n\n', 0x36)
nanosleep(&(0x7f0000000700)={0x0, 0x50000000}, 0x0)
unlinkat(0xffffffffffffff9c, &(0x7f0000000740)='./config/nvmet/ports/1/subsystems/n\x00', 0x0)
executing program 3:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd26, 0x25dfdbfd, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x41}, 0x4)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000400)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000500)={<r2=>0x0}, 0x106, 0x2}}, 0x20)
write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000700)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @loopback}, r2, 0x3e8}}, 0x48)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, &(0x7f0000000800)={0x4, 0x8, 0xfa00, {r2, 0x3e8}}, 0x10)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
write$RDMA_USER_CM_CMD_CONNECT(r1, &(0x7f0000000900)={0x6, 0x118, 0xfa00, {{0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, r2}}, 0x120)
executing program 0:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040d118af1e0000010203010902270001010080fa0904000003ffffff00070581020002000705820200020007050302000200"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000001000)={0x84, &(0x7f00000001c0)={0x40, 0x4, 0x2, ' \x00'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
syz_usb_ep_write(r0, 0x81, 0xa, &(0x7f0000000100)="0a000100010000000001")
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
executing program 1:
syz_usb_connect(0x3, 0x2b, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000200000040801b09e30001000000010902200001010080fa0904000001ff00000007058202000200"], 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./config/target\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/target/core\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/target/core/rd_mcp_0\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/target/core/rd_mcp_0/dev0\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/target/core/rd_mcp_0/dev0/statistics/scsi_lu/lun\x00', 0x0, 0x0)
read(r0, &(0x7f0000000200)=""/4096, 0x1000)
executing program 2:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000400)="0080002000"/16)
syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000500)='\x00'/16)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/nullb1/zoned\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='1\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='1\n', 0x2)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r2, &(0x7f0000000400)='1\n', 0x2)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000540)='/dev/nullb1\n', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f0000000600)='1\n', 0x2)
close(r4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1\x00', 0x1ff)
r5 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000740)='loop\n', 0x5)
close(r5)
symlinkat(&(0x7f0000000780)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write(r6, &(0x7f0000000900)='transport=loop,nqn=testsubsys\n', 0x1e)
close(r6)
nanosleep(&(0x7f0000000940)={0x0, 0x1dcd6500}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./dev/nvme0n1\x00', 0x2, 0x0)
ioctl(r7, 0xc0101282, &(0x7f0000000a00)="00000000000000000100"/80)
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
sendto$inet(r0, &(0x7f0000000100)="1234", 0x4, 0x0, &(0x7f0000000200)={0x2, 0x1b59, @loopback}, 0x10)
r1 = socket$inet6(0xa, 0x2, 0x0)
sendto$inet6(r1, &(0x7f0000000100)="1234", 0x4, 0x0, &(0x7f0000000240)={0xa, 0x1b59, 0x0, @loopback}, 0x1c)
syz_emit_ethernet(0x6a, &(0x7f0000000000)={@broadcast, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x1b59, 0x48, 0x0, @wg=@cookie={0x3, 0x0, "4b3f7633015aff9fa5e73369ed3ed4f938752184f1af2029", "14ef0f501fd4f4fc0d232b48a86ef0222fb6364766977f816acb8f51148dba1a"}}}}}}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'\x00', 0x1001})
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000100)={'\x00', {0x2, 0x0, @private=0xa010101}})
close(r0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='tcp 2049\n', 0x9)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r1, &(0x7f0000000900)={0x2, 0x801, @loopback}, 0x10)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='md0\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external:test\x00', 0xe)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1:0\x00', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/dev-ram0/state\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='external_bbl\x00', 0xd)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/dev-ram0/bad_blocks\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='0 8\n', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/devices/pcspkr\x00', 0x0, 0x0)
r1 = openat(r0, &(0x7f0000000100)='driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='oxu210hp-hcd\x00', 0xe)
r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/oxu210hp-hcd\x00', 0x0, 0x0)
r3 = openat(r2, &(0x7f00000001c0)='bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000200)='pcspkr\x00', 0x7)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='maxtcpc 0x22\n\x00', 0xd)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/i2c/devices/0-0022\x00', 0x0, 0x0)
executing program 2:
r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi0\x00', 0x2, 0x0)
ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000100)={'comedi_test\x00'})
r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000200)='/dev/comedi1\x00', 0x2, 0x0)
ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000300)={'comedi_bond\x00'})
ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000400)={0xc000002, 0x2, &(0x7f0000000500)=[0x1, 0x1]})
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/devices/pcspkr\x00', 0x0, 0x0)
r1 = openat(r0, &(0x7f0000000300)='driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='ci_hdrc\x00', 0x7)
close(r1)
close(r0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/ci_hdrc\x00', 0x0, 0x0)
r3 = openat(r2, &(0x7f0000000600)='bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000700)='pcspkr\x00', 0x6)
close(r3)
close(r2)

program crashed: KASAN: slab-use-after-free Read in rc_dev_uevent
bisect: bisecting 15 programs
bisect: split chunks (needed=false): <15>
bisect: split chunk #0 of len 15 into 3 parts
bisect: testing without sub-chunk 1/3
testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 33, 6, 5, 7, 12, 8, 5, 5, 12]
detailed listing:
executing program 2:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000400)="0080002000"/16)
syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000500)='\x00'/16)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/nullb1/zoned\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='1\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='1\n', 0x2)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r2, &(0x7f0000000400)='1\n', 0x2)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000540)='/dev/nullb1\n', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f0000000600)='1\n', 0x2)
close(r4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1\x00', 0x1ff)
r5 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000740)='loop\n', 0x5)
close(r5)
symlinkat(&(0x7f0000000780)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write(r6, &(0x7f0000000900)='transport=loop,nqn=testsubsys\n', 0x1e)
close(r6)
nanosleep(&(0x7f0000000940)={0x0, 0x1dcd6500}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./dev/nvme0n1\x00', 0x2, 0x0)
ioctl(r7, 0xc0101282, &(0x7f0000000a00)="00000000000000000100"/80)
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
sendto$inet(r0, &(0x7f0000000100)="1234", 0x4, 0x0, &(0x7f0000000200)={0x2, 0x1b59, @loopback}, 0x10)
r1 = socket$inet6(0xa, 0x2, 0x0)
sendto$inet6(r1, &(0x7f0000000100)="1234", 0x4, 0x0, &(0x7f0000000240)={0xa, 0x1b59, 0x0, @loopback}, 0x1c)
syz_emit_ethernet(0x6a, &(0x7f0000000000)={@broadcast, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x1b59, 0x48, 0x0, @wg=@cookie={0x3, 0x0, "4b3f7633015aff9fa5e73369ed3ed4f938752184f1af2029", "14ef0f501fd4f4fc0d232b48a86ef0222fb6364766977f816acb8f51148dba1a"}}}}}}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'\x00', 0x1001})
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000100)={'\x00', {0x2, 0x0, @private=0xa010101}})
close(r0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='tcp 2049\n', 0x9)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r1, &(0x7f0000000900)={0x2, 0x801, @loopback}, 0x10)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='md0\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external:test\x00', 0xe)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1:0\x00', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/dev-ram0/state\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='external_bbl\x00', 0xd)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/dev-ram0/bad_blocks\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='0 8\n', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/devices/pcspkr\x00', 0x0, 0x0)
r1 = openat(r0, &(0x7f0000000100)='driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='oxu210hp-hcd\x00', 0xe)
r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/oxu210hp-hcd\x00', 0x0, 0x0)
r3 = openat(r2, &(0x7f00000001c0)='bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000200)='pcspkr\x00', 0x7)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='maxtcpc 0x22\n\x00', 0xd)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/i2c/devices/0-0022\x00', 0x0, 0x0)
executing program 2:
r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi0\x00', 0x2, 0x0)
ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000100)={'comedi_test\x00'})
r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000200)='/dev/comedi1\x00', 0x2, 0x0)
ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000300)={'comedi_bond\x00'})
ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000400)={0xc000002, 0x2, &(0x7f0000000500)=[0x1, 0x1]})
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/devices/pcspkr\x00', 0x0, 0x0)
r1 = openat(r0, &(0x7f0000000300)='driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='ci_hdrc\x00', 0x7)
close(r1)
close(r0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/ci_hdrc\x00', 0x0, 0x0)
r3 = openat(r2, &(0x7f0000000600)='bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000700)='pcspkr\x00', 0x6)
close(r3)
close(r2)

program crashed: WARNING in svc_destroy
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/3
testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 8, 5, 5, 12]
detailed listing:
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='md0\x00', 0x4)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0)
write(r1, &(0x7f0000000280)='external:test\x00', 0xe)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0)
write(r2, &(0x7f0000000380)='1:0\x00', 0x4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/block/md0/md/dev-ram0/state\x00', 0x1, 0x0)
write(r3, &(0x7f0000000480)='external_bbl\x00', 0xd)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/dev-ram0/bad_blocks\x00', 0x1, 0x0)
write(r4, &(0x7f0000000580)='0 8\n', 0x4)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/devices/pcspkr\x00', 0x0, 0x0)
r1 = openat(r0, &(0x7f0000000100)='driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='oxu210hp-hcd\x00', 0xe)
r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/oxu210hp-hcd\x00', 0x0, 0x0)
r3 = openat(r2, &(0x7f00000001c0)='bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000200)='pcspkr\x00', 0x7)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000200)='maxtcpc 0x22\n\x00', 0xd)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/i2c/devices/0-0022\x00', 0x0, 0x0)
executing program 2:
r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi0\x00', 0x2, 0x0)
ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000100)={'comedi_test\x00'})
r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000200)='/dev/comedi1\x00', 0x2, 0x0)
ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000300)={'comedi_bond\x00'})
ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000400)={0xc000002, 0x2, &(0x7f0000000500)=[0x1, 0x1]})
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/devices/pcspkr\x00', 0x0, 0x0)
r1 = openat(r0, &(0x7f0000000300)='driver_override\x00', 0x1, 0x0)
write(r1, &(0x7f0000000400)='ci_hdrc\x00', 0x7)
close(r1)
close(r0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/platform/drivers/ci_hdrc\x00', 0x0, 0x0)
r3 = openat(r2, &(0x7f0000000600)='bind\x00', 0x1, 0x0)
write(r3, &(0x7f0000000700)='pcspkr\x00', 0x6)
close(r3)
close(r2)

program did not crash
bisect: testing without sub-chunk 3/3
testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 33, 6, 5, 7]
detailed listing:
executing program 2:
r0 = syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000402a1101000001010200010902270001010080320904000003ff000000070582024000000705810240000007050102400000"], 0x0)
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io(r0, 0x0, &(0x7f0000000100)={0x0, &(0x7f0000000200)={0x0, 0x0, 0x8, "0101010101010101"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000400)="0080002000"/16)
syz_usb_ep_write(r0, 0x82, 0x10, &(0x7f0000000500)='\x00'/16)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./config/nullb/nullb1/zoned\x00', 0x1, 0x0)
write(r0, &(0x7f0000000180)='1\n', 0x2)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/nullb/nullb1/power\x00', 0x1, 0x0)
write(r1, &(0x7f0000000200)='1\n', 0x2)
close(r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/nvmet/subsystems/testsubsys\x00', 0x1ff)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./config/nvmet/subsystems/testsubsys/attr_allow_any_host\x00', 0x1, 0x0)
write(r2, &(0x7f0000000400)='1\n', 0x2)
close(r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/nvmet/subsystems/testsubsys/namespaces/1\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/nvmet/subsystems/testsubsys/namespaces/1/device_path\x00', 0x1, 0x0)
write(r3, &(0x7f0000000540)='/dev/nullb1\n', 0xc)
close(r3)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/nvmet/subsystems/testsubsys/namespaces/1/enable\x00', 0x1, 0x0)
write(r4, &(0x7f0000000600)='1\n', 0x2)
close(r4)
mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='./config/nvmet/ports/1\x00', 0x1ff)
r5 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./config/nvmet/ports/1/addr_trtype\x00', 0x1, 0x0)
write(r5, &(0x7f0000000740)='loop\n', 0x5)
close(r5)
symlinkat(&(0x7f0000000780)='./config/nvmet/subsystems/testsubsys\x00', 0xffffffffffffff9c, &(0x7f0000000800)='./config/nvmet/ports/1/subsystems/testsubsys\x00')
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000880), 0x2, 0x0)
write(r6, &(0x7f0000000900)='transport=loop,nqn=testsubsys\n', 0x1e)
close(r6)
nanosleep(&(0x7f0000000940)={0x0, 0x1dcd6500}, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000980)='./dev/nvme0n1\x00', 0x2, 0x0)
ioctl(r7, 0xc0101282, &(0x7f0000000a00)="00000000000000000100"/80)
executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
sendto$inet(r0, &(0x7f0000000100)="1234", 0x4, 0x0, &(0x7f0000000200)={0x2, 0x1b59, @loopback}, 0x10)
r1 = socket$inet6(0xa, 0x2, 0x0)
sendto$inet6(r1, &(0x7f0000000100)="1234", 0x4, 0x0, &(0x7f0000000240)={0xa, 0x1b59, 0x0, @loopback}, 0x1c)
syz_emit_ethernet(0x6a, &(0x7f0000000000)={@broadcast, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x1b59, 0x48, 0x0, @wg=@cookie={0x3, 0x0, "4b3f7633015aff9fa5e73369ed3ed4f938752184f1af2029", "14ef0f501fd4f4fc0d232b48a86ef0222fb6364766977f816acb8f51148dba1a"}}}}}}, 0x0)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'\x00', 0x1001})
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000100)={'\x00', {0x2, 0x0, @private=0xa010101}})
close(r0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='tcp 2049\n', 0x9)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r1, &(0x7f0000000900)={0x2, 0x801, @loopback}, 0x10)

program crashed: WARNING in svc_destroy
bisect: the chunk can be dropped
bisect: split chunks (needed=true): <5>
bisect: split chunk #0 of len 5 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 7]
detailed listing:
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'\x00', 0x1001})
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000100)={'\x00', {0x2, 0x0, @private=0xa010101}})
close(r0)
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='tcp 2049\n', 0x9)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r1, &(0x7f0000000900)={0x2, 0x801, @loopback}, 0x10)

program crashed: WARNING in svc_destroy
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <2>
bisect: split chunk #0 of len 2 into 2 parts
bisect: testing without sub-chunk 1/2
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-socket$inet_tcp-connect$inet
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='tcp 2049\n', 0x9)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r1, &(0x7f0000000900)={0x2, 0x801, @loopback}, 0x10)

VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying
program crashed: WARNING in svc_destroy
bisect: the chunk can be dropped
bisect: testing without sub-chunk 2/2
bisect: no need to test this chunk, it's definitely needed
bisect: split chunks (needed=true): <1>
bisect: split chunk #0 of len 1 into 2 parts
bisect: no way to further split the chunk
bisect: 1 programs left: 

executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='tcp 2049\n', 0x9)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r1, &(0x7f0000000900)={0x2, 0x801, @loopback}, 0x10)


bisect: trying to concatenate
bisect: concatenate 1 entries
testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-socket$inet_tcp-connect$inet
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='tcp 2049\n', 0x9)
close(r0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
connect$inet(r1, &(0x7f0000000900)={0x2, 0x801, @loopback}, 0x10)

program crashed: WARNING in svc_destroy
bisect: concatenation succeeded
found reproducer with 7 syscalls
minimizing guilty program
testing program (duration=1m14.687811016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close-socket$inet_tcp
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='tcp 2049\n', 0x9)
close(r0)
socket$inet_tcp(0x2, 0x1, 0x0)

program crashed: WARNING in svc_destroy
testing program (duration=1m14.687811016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write-close
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='tcp 2049\n', 0x9)
close(r0)

program crashed: WARNING in svc_destroy
testing program (duration=1m14.687811016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='tcp 2049\n', 0x9)

VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying
program crashed: WARNING in svc_destroy
testing program (duration=1m14.687811016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)

program did not crash
testing program (duration=1m14.687811016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000500)='tcp 2049\n', 0x9)

program did not crash
testing program (duration=1m14.687811016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='tcp 2049\n', 0x9)

program did not crash
testing program (duration=1m14.687811016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mount-openat-write
detailed listing:
executing program 0:
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='tcp 2049\n', 0x9)

program did not crash
testing program (duration=1m14.687811016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='tcp 2049\n', 0x9)

program did not crash
testing program (duration=1m14.687811016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, 0x0, &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='tcp 2049\n', 0x9)

program did not crash
testing program (duration=1m14.687811016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='tcp 2049\n', 0x9)

program did not crash
testing program (duration=1m14.687811016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0)
write(r0, &(0x7f0000000500)='tcp 2049\n', 0x9)

program did not crash
testing program (duration=1m14.687811016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, 0x0, 0x0)

program did not crash
testing program (duration=1m14.687811016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500), 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m14.687811016s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: WARNING in svc_destroy
simplifying C reproducer
testing compiled C program (duration=1m14.687811016s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: WARNING in svc_destroy
testing compiled C program (duration=1m14.687811016s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: WARNING in svc_destroy
testing compiled C program (duration=1m14.687811016s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: WARNING in svc_destroy
testing compiled C program (duration=1m14.687811016s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: WARNING in svc_destroy
testing compiled C program (duration=1m14.687811016s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program did not crash
testing compiled C program (duration=1m14.687811016s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: WARNING in svc_destroy
testing compiled C program (duration=1m14.687811016s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
program crashed: WARNING in svc_destroy
testing program (duration=1m14.687811016s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='tcp 2049\n', 0x9)

program crashed: WARNING in svc_destroy
validation run: crashed=true
testing program (duration=1m14.687811016s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='tcp 2049\n', 0x9)

program crashed: WARNING in svc_destroy
validation run: crashed=true
testing program (duration=1m14.687811016s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-openat-write
detailed listing:
executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./nfsd/portlist\x00', 0x2, 0x0)
write(r0, &(0x7f0000000500)='tcp 2049\n', 0x9)

program crashed: WARNING in svc_destroy
validation run: crashed=true
reproducing took 1h13m12.067872997s
repro crashed as (corrupted=false):
------------[ cut here ]------------
SVC: permsocks remain for nfsd
WARNING: CPU: 1 PID: 5941 at net/sunrpc/svc.c:645 svc_destroy+0x2ed/0x390 net/sunrpc/svc.c:644
Modules linked in:
CPU: 1 PID: 5941 Comm: syz.0.18 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:svc_destroy+0x2ed/0x390 net/sunrpc/svc.c:644
Code: 24 49 83 c7 20 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 f2 d1 31 f8 49 8b 37 48 c7 c7 e0 87 d9 8b e8 c3 09 a3 f7 <0f> 0b e9 78 fd ff ff e8 b7 45 d9 f7 c6 05 73 72 c8 04 01 4c 89 e0
RSP: 0018:ffffc90003397ae0 EFLAGS: 00010246
RAX: bde15397b6c2f500 RBX: ffff88807d055050 RCX: ffff888079568000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
RBP: ffffc90003397cb8 R08: ffffc900033976e7 R09: 1ffff92000672edc
R10: dffffc0000000000 R11: fffff52000672edd R12: ffff88807d055000
R13: dffffc0000000000 R14: ffff88807d055050 R15: ffffffff8d3e1e40
FS:  00005555899ae500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055e415d65f00 CR3: 0000000075ace000 CR4: 00000000003506e0
Call Trace:
 <TASK>
 kref_put include/linux/kref.h:65 [inline]
 svc_put include/linux/sunrpc/svc.h:124 [inline]
 __write_ports_addxprt fs/nfsd/nfsctl.c:765 [inline]
 __write_ports fs/nfsd/nfsctl.c:791 [inline]
 write_ports+0xb99/0xfa0 fs/nfsd/nfsctl.c:844
 nfsctl_transaction_write+0x10c/0x150 fs/nfsd/nfsctl.c:113
 vfs_write+0x299/0x9a0 fs/read_write.c:582
 ksys_write+0x151/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7ff39f99e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc78720cf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007ff39fc25fa0 RCX: 00007ff39f99e159
RDX: 0000000000000009 RSI: 0000200000000500 RDI: 0000000000000003
RBP: 00007ff39fa3503b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ff39fc25fac R14: 00007ff39fc25fa0 R15: 00007ff39fc25fa0
 </TASK>

final repro crashed as (corrupted=false):
------------[ cut here ]------------
SVC: permsocks remain for nfsd
WARNING: CPU: 1 PID: 5941 at net/sunrpc/svc.c:645 svc_destroy+0x2ed/0x390 net/sunrpc/svc.c:644
Modules linked in:
CPU: 1 PID: 5941 Comm: syz.0.18 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:svc_destroy+0x2ed/0x390 net/sunrpc/svc.c:644
Code: 24 49 83 c7 20 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 f2 d1 31 f8 49 8b 37 48 c7 c7 e0 87 d9 8b e8 c3 09 a3 f7 <0f> 0b e9 78 fd ff ff e8 b7 45 d9 f7 c6 05 73 72 c8 04 01 4c 89 e0
RSP: 0018:ffffc90003397ae0 EFLAGS: 00010246
RAX: bde15397b6c2f500 RBX: ffff88807d055050 RCX: ffff888079568000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002
RBP: ffffc90003397cb8 R08: ffffc900033976e7 R09: 1ffff92000672edc
R10: dffffc0000000000 R11: fffff52000672edd R12: ffff88807d055000
R13: dffffc0000000000 R14: ffff88807d055050 R15: ffffffff8d3e1e40
FS:  00005555899ae500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055e415d65f00 CR3: 0000000075ace000 CR4: 00000000003506e0
Call Trace:
 <TASK>
 kref_put include/linux/kref.h:65 [inline]
 svc_put include/linux/sunrpc/svc.h:124 [inline]
 __write_ports_addxprt fs/nfsd/nfsctl.c:765 [inline]
 __write_ports fs/nfsd/nfsctl.c:791 [inline]
 write_ports+0xb99/0xfa0 fs/nfsd/nfsctl.c:844
 nfsctl_transaction_write+0x10c/0x150 fs/nfsd/nfsctl.c:113
 vfs_write+0x299/0x9a0 fs/read_write.c:582
 ksys_write+0x151/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7ff39f99e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc78720cf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007ff39fc25fa0 RCX: 00007ff39f99e159
RDX: 0000000000000009 RSI: 0000200000000500 RDI: 0000000000000003
RBP: 00007ff39fa3503b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ff39fc25fac R14: 00007ff39fc25fa0 R15: 00007ff39fc25fa0
 </TASK>