Extracting prog: 3m33.737550615s
Minimizing prog: 21m21.105983101s
Simplifying prog options: 0s
Extracting C: 44.093561103s
Simplifying C: 2m39.926144632s


extracting reproducer from 72 programs
testing a last program of every proc
single: executing 23 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-bpf$BPF_BTF_LOAD-writev-ioctl$XFS_IOC_ATTRLIST_BY_HANDLE-writev
detailed listing:
executing program 0:
r0 = socket$netlink(0x10, 0x3, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x34, 0x34, 0x6, [@var={0x4, 0x0, 0x0, 0xe, 0x2}, @func_proto={0x0, 0x0, 0x0, 0x9, 0x4}, @func_proto, @func={0x4, 0x0, 0x0, 0x8, 0x3}]}, {0x0, [0x30, 0x0, 0x0, 0x61]}}, 0x0, 0x52}, 0x28)
writev(r0, &(0x7f0000000040)=[{&(0x7f0000000380)="3900000013000318680907070000000f0000ff3f04000000170a001700000000040037000f00030001332564aaee7b1d58b9a64411f6bbf44d", 0x39}], 0x1)
ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f0000000180)={{<r1=>r0, &(0x7f0000000000)='&,\xcd,^*\x7f}\x00', 0x101000, &(0x7f0000000080)={@_ha_fsid={[0x3, 0x8]}, {0xc2da, 0x3, 0xfffffff8, 0x4}}, 0x9, &(0x7f00000000c0), &(0x7f0000000100)=0x41}, {[0x6, 0x7, 0x9, 0x2]}, 0x2, 0x35, &(0x7f0000000140)=""/53})
writev(r1, &(0x7f0000001640)=[{&(0x7f0000000200)="2582a39bb348327eb10bbdb77586fc0d8e3d778ccfb1f7f4bc3c83a788b892e2d3f9afb773d2ff4c450a9f96d4c549e2e84dcbe0d3b50119200659bb32ebd84b516fe2f0c04d095d98f6b7e5dce54f244a0f0f43370fd19b049481e1d8ff26f27b7ae7189e76fa8a8de8e009e0b11a402dff5994a2fecb8c43f60bdaa5bc73bbea1b76746dd46fb73f3c7b6a635b5e963641f0d37f776cf76fbaedb182ab9cdaee32e2d79513bf7d49bb68a2eae6379fe66e1af940b8422c33c33029b8065f6daca93f15951e3ea6831f3172813258d0091a", 0xd2}, {&(0x7f0000000300)="f6e481ae464817fa91e39fb9feaaf383217c7a78b2b0019daecea8c90309b04a5100b78ad487517d2a8bc0d22ce5aaa3491b7b85a4b8813bc8e7e3f7e836f3b96679663f39cae87575057005de634a63b53a2d9854f797e27bde6bf5b451bf02", 0x60}, {&(0x7f00000003c0)="3bfad8aaf482aa6a763d3eea1202b084165e5b8fc777add6471f7cb6589ea343ed3e2e75fb1ecf265ed5487b503c4a63a3441780f1701126d60bc171a927a16067a0f37698b7b14125f123c475fc4fb4590068a71b6c99edaa45bb3829b441e3379cbb4353adb3077cdc297a1b8d358cd75f7e444bd16392ad3933ad31f5bfc2fed9a56bbc53130d2cb86afa0edd53d6b2ce390b102a6ed67d9801", 0x9b}, {&(0x7f0000000480)="ec30933b25fc63b4b2fda07e4a8730ffdfcfbfb815222feac313e01c955400a494dccb3d0b18ce4e28a0d192069691574394362e14bbf01a40c0c63b2270f430f8ce317eff6b469c7e44286646190497e81a5ca582a53cda81600ae9aa975116de4ef071b05e91889c77f29a9422f0891f9b3f7d6073827cda2d3730dc2ac5844158ba135468df4549d359ebba2ffe8a1c544eabf5a3fbf72b5d63d561182d4730079f27eb9f388453e41f", 0xab}, {&(0x7f0000000540)="44a874e66b0636c83be29a998ff0d1f779771570bbb2bb9b92f3b7ea5c8c357c853212d9d9ef829729a2d2fe178c1f6089ec2939205840574372c3de0c9452d2232b804daadee2851dd694410c864d0df8d96996cdbda9dfc883e658f2f30c6fd962632b6c0fa68958c24be93f9052cafe9df74e89ad6997cecbc5b146c3f42b68bf21de9733e0f5ff06ee0e0feb8b464fd38377586757ccc25087ed690550b78f32d77bee62f0819d9f6c875f665fa610e8199761a4bc7c3620793a5eb5dd2db8cd915601a0724e0d6031657afb4adf73f041a96fc7cfde9e0d3dac591cdb8074e100c7fc72959031c62941bc8fde739678f15c8e19936b190067313cc720c5ce6875c95b97bece1a16ef49997145c52fad43b0e144b12a4ae64d11d7cddbe4f92afb2cce1742821340caff09d8428e1a2876001808647db6f8c830d35f076f9cd350cc7e37d832c8559899e9ce06fbfac58ce7ed9e557b3cce18ba32304ac209478ec2963665c44b6170909dad2c36231a459bc82853f9360cc9c8c5680a6d573429ceae07f1b568315d72eb79702520288220b73d9f9c4912131ac779e59923a2aa3645927367f7302605856b0a43637b626bb6135f5436509c0c05aaee8fa6efb8d84f76c7eb67f9335a57f40addd14daa5c940cb9419c350002f88092db37b78578d88382c0f8dfce03e77b8ccfb16cb03245fcdedc2caf0b52a702a9e30a7e924d0210bfd0469a61721be65e71dcacb6653a0bf55057b78ee1e32e93364f4e48832d41b733a724138442b4f8a0683a83b640228022c85c1323eac4084118377dc5ab0dab6075e1562c06357835b7cddbf0f369d710b61b3ab820ac034ba36eacf8ee2466905ed768a7aa0427c43a1fb84a7551d2f7b8034ccc1dd329b16836f41e8a4abf7d9b080ae054e5c8945a806e4a27ee5f35272c106a063d4b9451a0752cff9ac2bc72de5420a11486de728d3877f4ee723cebdd8818f991dae3a5c7a6cf7a5d9cb8178239db9d5774ed2d9d3d4186b90d95b72cab791d4b1f729df32b418f7402b8488a4310ee83c6e2afba2ededf3050441080cc380938331b0288e89e94367e7c7c99366ab907a8b9cb2316f3f1bf8df5f0c0d5bf27f814173e6d03b706ad5a02b0881d08dd2e0d062790f8b84afd1f5641e5d16ca01d346d8169027f29d5b2b1e8f19dcfb3c9379eb90a930cdf3f79c560dd1392f326fa469d2d963687b237f127a664d329657233f9e71e8d3d9f4eb176abe8407585e821ee364b8661b7d3e537830256a55f6144dadf360c26efc876756439de405b556468ab4dec82ff21278abfc6fa380d384559de8863ca5415ff8b8b988751ebd79026014fcfae59b3be9e5c6d26c625c7fefdea626ff7ce56d3c4e04aff44a8c5cc21566ceb49776e76c6159e96f38e71409a1f14e27f2f114bcb5ca50b8ad31cea8459f1737153984775378551a4137c979665f39fb2f48bb4cc18a63c15a7974ea883fc6569b9aaf5ee241a2cb331d6e664e8c997c4bfeef638b18b15896f0a44beac08d13bcdbd173510e9b9e82dede5da319b487c07b2df60f44345d15dac421d4c57961d9e10bf5fc14f2e795298d6f25492d0427d028ea9b6874801bc9bc182416b4ccff5d3f6d6892f2af46e26515c72ec8ba9e1d99c424aa7ed1baea17a7b58a4e21ad24f3d57cb913f13b8910c31439b40565910d842c477e6a63c58dcb406d7768731e474d6f332438b79af11afde4bc42080506cc1eb298bfaf0d73035f109ecb9b74bf2dccfc09ee40c3d204d90a193daa8ac96a3d77fa5d43e22c2e0104c137d41ec842a1f7d462010b18f77bdd1e562e38f8325fe507ee37ff6225e3d356efc4eaca23606f444948995c4ece6c5821e774f6221999d3777d3a474d9902a590cc67737817cc179985052b9ffec8be8018b12cd980148f2f21c48f06ec2d0307efa832e79975ffc4c7a16776633404955aa94017f348176278d6ad643f60c997d9c80b317c6bf64770fc3c3527bf9b649ee4b14dba7f6d04828dba8ba5ef115615b92c28ee01a5bb6534c5a840f6584229397af1a6b5e84660dff2e3ac77922f28d4b387ea797a14c196f51c4d3941416d6e25b1fbf33a8c9749a9e48fb64ac7cf46687f0c441ceea5b35b2106bfe30dc822dc15615ad01fa3a71a5cb9a7d2393fccf365669d1b8b30c847ca1687317679241770fc3a6ce32f7a1d790c78c7f3f16a12ee0922416a4ab7df40cc0ac2d3d53227182800539ec5a55b71b59d10ffa8dee1677c03090c5e8133f94ee72aa881d12429327874b4cb53bd712f060fd3b9ad387051d53ed056eb3df566161822409af4f471fd474a4e4c9bffb6398a903009f8225996135a8fe74cfbf0c8dd0586c93b865a2db48d48253816f5a4c358306068025c461defd360eb5d955a66e1c133bf3b6d225ecb8629669a7dca682233353f7716a9ad7d7fee4f283cd98bc9ff51cf4ee06f0995de8daf1932f206309e9ccb8e44fe92816efc5f61034870d8d5590a8d297b15d7c8cd6b10ab54e18032bc0858ce755c1ba8b47a2e867dad37ca3d412facd5078f50ce9388279dffa484c07176b42063247e20951b5dc8cad0090836319091e1f077bdcb2e616ad66e58845fe41431eea452a7ba247bcedacb8a62391edf76604cfe8abf44fe001efeb74a13c62106ea75cfe45b294e3d6c3e0cb1ef886559c376cfc90111d8bd05dd0d1ace5553c6368fd39a8b6a5c1e6b7215262c11cc3d1d8084c724e5fea659996d0a31534261c7498273b536dfb434ec196d49e826db753fa46267c77a98524689f42b48b16cf7267cedafc9de725fb2cb734d22cf3e0c16442d527e88f66165920a834baad6b68a821ab2d6c8de5695255fea860db203251f19780540249e86920181e88edf267b0c9e75bc0703970ac9adbdbf1ea6cbbcfb9ba816a6289cd61c7db52ba926e9c91645ead0c168df5d12ba726d69feacfa6e180514d1a8808a1661873275bd8097b3c2eec1ee44689e813499b14ee451924b6cf473cc4df80a888dc79fabeb0191153644d5dc3f769822decb1ff08dfa09ffed6d67a216316d982f9fe8bab6b40e2eaf09dd2c9b90db1f2422e665b7550c353f0c31077d1e0440f68da824d5397c11c8c063cd294eeb7a912373cbc726829d3fe4e44cef87fe8941ed9bcd65abcc2ad267dded92caa2e17ef89d35f8a7356308dd560369129fbcc3a596c8d2889c0d81194347560be82ecd80dd696f540eafca21b88b9c3697059d5236dc1b91d685fa671d5fb7066fca414cff1aed9abc946338e3766f25ca3ff924d458bc244bab3ac3d4e021f29c37dbcca59aa2bcc856b56f2dd2c7a97de9ee48c76c0c700be6cd79186d427165e320fea0ad9b8559551ed39a16cfc49b4a899d6836ab0ffa46b59b8ae17975b247c9bd7474b36a526fb8ce7c63cbe40b6894557f3063b2682a84f8cb207cf63a65de61208a9ca72bcbe9cd6b37f2f9e96f6f183728545ba7a3ef5387ffd23898667a155d1e851237f6d10dbe73dc2806358e67547ab63cf676f8693321a91d94a068ca42e590dc7b952bf4308af37fc7bdafd45c637c888adffe7339746edb37b5d8e561c3d6631d53227717f9a0ff78f25010d34f20a8e6726501016cb0784ff45f858912414b4648fdc1e1b5b20d9063f599fe5c0214079a443d0755d621f13d8d2bf40264d27868fdb94cdb41878496bb27777c412d4ed3099c37fc295ccecdd46446796f218f256ec2c93d0bc9036775197d7fd41681e7cadaea9dbdda8e490838ac1ef267fb95eedc41b37e5f82300cf556ab6e7c70984a898fe54328f6b5eb01cf6ddd5e20803fa9ca63a0f70cabed00e6de0b245afeaabbbbbfa0918b1e0920672b79e6a714a8632fc5e7ecc1263e19b1481026377e4bb6d9fdea745ad4f09e67e274c03cd3e4501b595316b5c4305184f9a99efb1a9f0910cc2bde8efbe0964a03b888bdb9ec2f7aa682731c2e43710a470d5284e613863431389c7a0a25c3ec9a75b3462657494de0f4af0191d1eb42eece0d7618a0cbbf847064ef0f6c82dfe6f3478710779a30707875deb4d313e4d69af0d0098230f0a2d739b652279880d6d04fdd1904b217d432b0625c200b30621b45a7899c7c2270436b9354a464246b1a80bae520ae5159b3781a877ddc9168334e032659c3bc73a61a876e0ca28ff95826c33607686c578eb102d4feb27dcbede944ee0948171cd506ea3d9a9dbe7253547969c234c28b744bec14bb7157022b643d6cb02344a94baa348ad3b28e64a26285e03cc81aa5d1e5dcef3a7fdecb94ecfac1dcaf70884f9d7c843560dc1190d56ae4e80a4113c6054dee1417beae6f602cad1d642f5cef2ae99633909f9f69354965f3d1fa00594ec1f8617a4ea2d76c3a3e8f9a6af6fe995f7a6c14d0d3cb39a2921cd156a2f448129ee3b8f64c7f7e177583a11eaf4ba02bb7aa44d7cb49b85402709a3aa1a2402c1662fae7b18fb6b2321a062ec84c82a4b1d1a91d71bd518ea55b8e21d47dd3df88eea2b0367f122aff123804277ba4b597a371def63aaba6f0dfa69f0e0b3ab14285742ec126a709dcc24f6495b45d8ed749452bdcfd7d0ea3a0c28512d5e87e6f47180d9298e54c4434acc280560294e45d5790596a26fa2c38f1e6c2f8ddea31802a5dece1230ad079ccad5dced8abb7f0f9edac19b57d2a6ba703118f5c3969851c4ee735ebc4159093b9f1b55123470e7b4338850684d5004d2a1739a05127aff4e8bfb590a3851cdddfe474a423c296c95cc36304401e9eaae3ce0da45d8fcbe10e8a72c644319b3dad7271733403253dccaed52d3803950e57a11267ce6f38a49be51dce9e6788a4cb633e1c4a51da5f956d74d5ed197b67e723775e1486ad2497eb8f237a2f610b0292496ce33c1bbe99b37df632929952a87c9d4a6998ab884869e71aa52931d0496647b18cd8eb165b0f0103b00e9eda13974616b9aee279a74712a506ab2fc342c87e793d22c37b83282343da6cf295f68608709a12b0eecfd3977d4d53eff5659cdd703be6e41023b603b4691248d6143c1ed1bdaa6a6ec5cb956e93767282b3e8287989d3f7439e924bbf55964a631f3e3da165dec8658d7e9cc26334f844e675c16e3b24da2e698b124b70e05d2773b1da41935e326584e1a05dd62cce0f23236b8a2882f0a7f2af5fedab2c4bec516387bf61581ae3dc2c0ef1da5567c45b46cbfbfe020fc833f51a5734824982a524b20014bbcc28f26cd9bf147ca3e65ee5bcc6c8709b8e08631521c586f0b7adf6ea6c0bc6e5020b0931956bb643a7f1e42cc8f203ed834382223b1d25b36c81fbb673c7ffc3c2d7dab5c335da04bda26029fad88b580ffb6498914a522941a7c0ac5df22bc583a1f23a4e32fca4f6cd722abe083d849fd4fa8f4e6e2cfa7f0360c78ec2c16b12d15a6d1d812b51ad6bc8999db8f6ef964bb348a4024449079599d0a6d8c0fc04d6278797f39a331ce36540d285c33658bee79596eeac36df17ef43abafcb5f381b5abe2d1bfabcfa85428a860994481011aea71d8841d3d120b27f94e3bdaf3f9f389b23f34bc005de06c4ab067fc36e2c512283d6da9291db94e72d139e06e877f985cdec4150297729d8d5c2bb8518ec657119dda31787b46c8a0a4694619a087b29696360b4ae2a1f7a1e6f30f4a1a0d036699900c4ab49144bfb382ab879686150b0a2a5ca8edfc00800c5a25f59305ca0a2dcb131fbd119be3e7175bfffeb8a8802c0ab5d2be3e12d8f8a1dda5f371ff86ce0cc4f4d7", 0x1000}, {&(0x7f0000001540)="456b3c5cd09cc153477a00d43e54b225457ade7b611e25e2d1c10056544b1ef434c9b7096dd5e585f4f22179bd014130dc99c4c7f2cf96b51f4e6203992ebe5dae546a1f62c5664e2facea1ac6bf56f7f9293db82ee2f0f173f64c0c136a414382064030debb70d4a940ac487c9492c0978daf13dd1dae7f0ba4dbedf340ba83a89ced550dcb91395c8cf2f89079d032241fdcc70739a4506be3978d3db417b7c23f5210a0a9cb347469ba24abb1fe6b29d474c54495858c495bf4d1611b1deeb768a14c0cdbfd20", 0xc8}], 0x6)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$key-sendmsg$key-sendmsg$key-openat$sndtimer-mkdirat$cgroup_root-openat$cgroup_root-openat$cgroup_procs-unshare-socket$inet6-bind$inet6-write$cgroup_int-socket$tipc-socket$tipc-bind$tipc-setsockopt$TIPC_GROUP_JOIN-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$OCFS2_IOC_MOVE_EXT-socket$tipc-pidfd_getfd-setsockopt$TIPC_GROUP_JOIN-socket$tipc-setsockopt$TIPC_GROUP_JOIN-sendmsg$tipc-ptrace-socket-exit-tkill-waitid-syz_usb_connect
detailed listing:
executing program 0:
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(0xffffffffffffffff, &(0x7f0000001440)={0x0, 0x0, &(0x7f0000001400)={&(0x7f00000003c0)=ANY=[@ANYBLOB="0a1fe12e46d11473e73cd7154eac2cec0299b5ffe06c7509819b11debc8c2aecf7a7015e0951058ca8572d1ed13d6933a9cf0685b6edcb7fb3ae07f2e3ae62ff3638d571a8380c8ea4cc6773fd92eca5015437eaa55a87944954a52c73167eb5667515dbd054ab889ab3da46f85a499650320d4a546cdca5d57d78d5a0034b5e6595a1b9ceca79ea3849114c62ffd9040b4bc45fc1a9"], 0x20}}, 0x8000)
sendmsg$key(r0, &(0x7f0000000180)={0x700, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="020d000014000000000000000000000005000600000000000a0080ff00000020fc010000000000000000000000000000000000000000000005000500000000000a000000000000000000000000000000000000000000000080000000000000000800120002000200000000000000000030002b0002"], 0xa0}}, 0x0)
openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x24ca01)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff)
r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0), 0x200002, 0x0)
r2 = openat$cgroup_procs(r1, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0)
unshare(0x20000400)
socket$inet6(0xa, 0x2, 0x0)
bind$inet6(r2, &(0x7f0000000000)={0x2, 0x0, 0x0, @mcast1}, 0x1c)
write$cgroup_int(r2, &(0x7f0000000340)=0xffffffff80000002, 0x12)
r3 = socket$tipc(0x1e, 0x2, 0x0)
r4 = socket$tipc(0x1e, 0x5, 0x0)
bind$tipc(r4, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10)
setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f00000001c0)={0x8000042}, 0x10)
r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x1, 0x0)
r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0)
ioctl$OCFS2_IOC_MOVE_EXT(r5, 0x40406f06, &(0x7f0000000040)={0x0, 0xbc40, 0x5, 0xa})
r7 = socket$tipc(0x1e, 0x5, 0x0)
pidfd_getfd(0xffffffffffffffff, r6, 0x0)
setsockopt$TIPC_GROUP_JOIN(r7, 0x10f, 0x87, &(0x7f00000002c0)={0x80042, 0x1, 0x2}, 0x10)
r8 = socket$tipc(0x1e, 0x5, 0x0)
setsockopt$TIPC_GROUP_JOIN(r8, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0xfffffffe}, 0x10)
sendmsg$tipc(r8, &(0x7f0000000080)={&(0x7f0000000240)=@name={0x1e, 0x2, 0x3, {{0x40}, 0x1}}, 0x10, 0x0}, 0x84c)
ptrace(0x10, 0x0)
socket(0x5, 0x3, 0x32ed)
exit(0xc1)
tkill(0x0, 0x9)
waitid(0x0, 0x0, 0x0, 0x4100000c, 0x0)
syz_usb_connect(0x3, 0x24, &(0x7f0000000480)=ANY=[@ANYRESHEX=r7, @ANYRES16, @ANYBLOB="e65d162b24a89c072517edc6dfdc21edbce34bd29de934601e3dafa3931c8cd3bc5478d10b749eb77ced0f1f978c48ee7b0b8a503622d829e8bed9b46df6ee16ea382b1da3744b5664281710b8eace622589fec123043653a996dd8fb8edc576f7408369f0072d4316be656e16cc40941f9808895615200a2d72c7658c01ae227be1397a95063519cff5c7195336c0051a63f686decb043fbba486dc71939754a33d9fe0dddb4a3ab24211dc6e31f79201c0"], 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): add_key$keyring-openat$ppp-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-ioctl$TUNSETOFFLOAD-openat$ppp-ioctl$TUNSETOFFLOAD-close-openat$ppp-ioctl$TUNSETOFFLOAD-close-keyctl$set_timeout-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN
detailed listing:
executing program 0:
r0 = add_key$keyring(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) (async)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x6, 0x4, 0x4, 0xf, 0x0, 0x1}, 0x50)
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r2}, 0xc)
ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6)
r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x140, 0x0)
ioctl$TUNSETOFFLOAD(r3, 0xc004743e, 0x110c230000)
close(0x3)
r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x42340, 0x0)
ioctl$TUNSETOFFLOAD(r4, 0xc004743e, 0x110c230006) (async, rerun: 32)
close(r4) (async, rerun: 32)
keyctl$set_timeout(0xf, r0, 0x7ff) (async)
r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x8}, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}, 0x94) (async)
r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r6, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-signalfd-mkdir-close-setresuid-pipe-write-close-inotify_init1-fcntl$setstatus-getpid-setsockopt$packet_rx_ring-fcntl$setstatus-fcntl$setown-rt_sigtimedwait-inotify_add_watch-rmdir-mkdirat-mount-bpf$PROG_LOAD-bpf$BPF_LINK_CREATE_XDP-socket-sendmsg$inet-openat-ioctl$TCSETSW2-open_tree-ioctl$BTRFS_IOC_RM_DEV_V2-openat-lsetxattr$security_capability-ioctl$FS_IOC_SET_ENCRYPTION_POLICY
detailed listing:
executing program 0:
r0 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000280)='./file0\x00', 0x20000406, &(0x7f0000000440)={[{@dioread_lock}, {@noblock_validity}, {@grpquota}, {@jqfmt_vfsold}, {@nolazytime}, {@grpjquota, 0x2e}, {@errors_continue}, {@resuid}, {@bh}, {@noload}], [], 0x2c}, 0x84, 0x4f0, &(0x7f0000001e00)="$eJzs3M1vFOUfAPDvTOkLUGjhR37Ki1JFYyPa0oLKwYMaTbhoTPSAx1oqQQoYWhMhRIoxeDT+BerRxMSTF71ooka9qPGqd2NCDBdQE7Nmdmfa3XZ3u91CK+znk0z7PDPPvHyfmWd2Zp/ZCaBjDWV/koj+iPglIgYq2doCQ5V/169emPzz6oXJJEqlF/5IyuWuXb0wWRQt5tucZ4bTiPTtJHbXWe/MufMnJ6anp87m+dHZU6+Nzpw7//CJUxPHp45PnR4/fPjQwbHHHh1/pKU4Li4zPYvr2q43z+zZeeSl956dLMXL332cbW9/Pr06jorBltbbzFAMRSm3MLan/Pf+VS/9v2VLRPTm6WTDOm8MLeuKiGx3dZfb/0B0xcLOG4hn3prPfLVOGwjcNNln07YlY7vy/+n85xdwO0q0cehQxSd+dv9bDGt5/bHerjyZ/Z0qx389H354rlI3aXYvO1i5Y+9qMP//64zrW0iWBpZZf39EHJ376/1siLrfQzSRtFwSAGDeF9n1z0P1rv/SmmubrXkfymBE7I+I7RHxv4jYEel8mTsi4s4Vrn9oUX7p9c9PG1e4yBXJrv8ez/u2iqEypYgrmc9tKcffnbxyYnrqQF4nw9Hdm+XHmqzjy6d/frfRtKGq679syNZfXAvm2/H7ht7aeY5NzE6sIuQaVy5FEhvqxZ/M9wRkNbAzIna1sfyszk48+NGeLL1189Lpy8ffxA3oZyp9GPFAZf/PxaL4C0llTY36J0f7YnrqwGhxVCz1/Y+Xn6/Od1ela+Lvay2mvnaDrePKpYhNdY//PP6iGRT9tTN5/uv+ltdx+dd3Gt7TLN3/SRydqy6RH/8bF6otO/57khfL6Z583BsTs7NnxyI+z0fUjB9fWFqRL8pn8Q/vq42/cl+cZue4fz7I59sdEdlBfFdE3B0Re/Ntvyci7o2IfU3i//ap+15tXkNtHv83QBb/sWb7P2Iwqe6vbyPRdfKbzxqtv7Xz36FyajgfU33+62mw3FY3cLX1BwAAALeCtNwHnaQjVc9vF3bEpnT6zMzs/qF4/fSxSl/1YHSnxTddA1Xfh47l3w0X+fFF+YMRsa38pNHGcn5k8sz0lnWKGajYXNX+K+eCNB0ZqUz7rdFDL8DtY0X9aNUPnX3y6Y3fGGBN+b0mdC7tHzqX9g+dS/uHzlWv/V+MuL4OmwKssXY//xc/MADccko176cEOor7f+hc2j90pKU/ic9ft5KdE9r/yf/09iOreWPAzU+UBtqfPRpPmlv5ArtaK1y8/aLlJbdWOIkowkmbxFUnEenCmL/zt0mWx3RXyvS0vqlrn0iXLfPEcrXRvaJ3YvTVqY29eaI3IlpdzsU1q9XiDJF4yyQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHBL+zcAAP//Flvq9A==")
r1 = signalfd(0xffffffffffffffff, &(0x7f00000001c0)={[0x5]}, 0x8)
mkdir(&(0x7f0000000140)='./control\x00', 0x111)
close(r1)
setresuid(0xee01, 0xee01, 0x0)
pipe(&(0x7f0000000c80)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
write(r3, &(0x7f0000000700)="fc0000001d000724ab09254ec100100007ab08001b000000f0ffff002100057e0000000000000e000039000000039815fad151ba0101f59cecb94b46fe0000000a000200254975c121405a1c57179bb25e7e94527f2707d75eb2bdc275aeedad3d179018782ddc4ee4ca54bd6a891088629c86cbb99977118c7bb256c14d39167360efb72a137364813b0c6b83a14b5939425abc14a5cfc1a34aed1220bf400c18c7c14afc7ea9e784969b15c6b48da1c4097342ef5dc817122b4592cc04843cfa8e5536d5e2a685a1f558d38f87dbeb154c1fa0089478ba7554f62a38084fad88dab571c9f042257c739e0aee27f750c8be93ded3b2eedbf596889448aa3b0b8902c32069146ba714e8088552afab3aa25b32ed7beb140c24a2b1648afd2d3a65c543c28161d4e5bd77d68e4b354ccf142ff659cb0f5850d1221c33ad448bcc14f06f3facef9f9fed552c3d8054871f041af1dc5de5af784c5043363f0b7b", 0x15f)
close(r2)
r4 = inotify_init1(0x800)
fcntl$setstatus(r1, 0x4, 0x2c00)
r5 = getpid()
setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0)
fcntl$setstatus(r0, 0x4, 0x40000)
fcntl$setown(r1, 0x8, r5)
rt_sigtimedwait(&(0x7f0000000040)={[0xfbffffffffff7ff8]}, 0x0, 0x0, 0x8)
inotify_add_watch(r4, &(0x7f0000000180)='./control\x00', 0xa2000b60)
rmdir(&(0x7f00000000c0)='./control\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc\x00', 0x0, 0x0, 0x0)
r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f00000006c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94)
r7 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000002380)={r6, 0x0, 0x2d, 0x0, @val=@netfilter={0x2, 0x4, 0xfffffe71, 0x1}}, 0x20)
r8 = socket(0x840000000002, 0x3, 0xff)
sendmsg$inet(r8, &(0x7f0000000300)={&(0x7f00000006c0)={0x2, 0x4e20, @multicast1}, 0x10, &(0x7f0000000240)=[{&(0x7f0000000640)="97452a300c000000010000000000000000", 0x11}, {&(0x7f00000000c0)="9e762d2f24d02a99cb0aa5", 0xb}], 0x2, &(0x7f00000001c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x44}, @private=0xa010102}}}], 0x20}, 0x2400c804)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0)
ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0)
r9 = open_tree(r6, &(0x7f0000000200)='./proc\x00', 0x81501)
ioctl$BTRFS_IOC_RM_DEV_V2(r9, 0x5000943a, &(0x7f0000000cc0)={{r7}, 0x0, 0x10, @unused=[0xffff, 0xfffffffffffffffb, 0x3fe, 0x2], @subvolid=0xfff})
r10 = openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x83)
lsetxattr$security_capability(&(0x7f0000000340)='./cgroup.cpu/cpuset.cpus\x00', 0x0, 0x0, 0x5c, 0x0)
ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r10, 0x800c6613, &(0x7f00000002c0)=@v2={0x2, @adiantum, 0x3, '\x00', @d})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-openat$kvm-getrandom-openat-openat-openat-write-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_mount_image$ext4-lchown-quotactl$Q_SETQUOTA-quotactl$Q_SETQUOTA-chown-socket$inet-connect$inet-connect$inet-sendfile-ioctl$FS_IOC_GET_ENCRYPTION_POLICY-ioctl$FS_IOC_GET_ENCRYPTION_POLICY-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-syz_kvm_setup_cpu$x86-getsockopt$sock_buf-ioctl$KVM_RUN-ioctl$KVM_RUN
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0) (async)
r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r2, &(0x7f0000000200)="c7", 0x1)
socket$pppl2tp(0x18, 0x1, 0x1) (async)
r3 = socket$pppl2tp(0x18, 0x1, 0x1)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f0000000040)='./bus\x00', 0x1208002, &(0x7f0000000380)={[{@grpquota}, {@jqfmt_vfsold}, {@resuid}, {@debug}, {@dioread_nolock}, {}, {@acl}, {@noauto_da_alloc}]}, 0x1, 0x5d8, &(0x7f00000005c0)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=")
lchown(&(0x7f00000006c0)='./file0\x00', 0x0, 0xee01)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401}) (async)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401})
chown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0)
r5 = socket$inet(0x2, 0x2, 0x0)
connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e24, @local}, 0x10)
connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x28)
sendfile(r3, r1, 0x0, 0x1)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r3, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3}) (async)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r3, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3})
r6 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) (async)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0)
getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240))
ioctl$KVM_RUN(r7, 0xae80, 0x0) (async)
ioctl$KVM_RUN(r7, 0xae80, 0x0)

program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work
single: successfully extracted reproducer
found reproducer with 30 syscalls
minimizing guilty program
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-openat$kvm-getrandom-openat-openat-openat-write-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_mount_image$ext4-lchown-quotactl$Q_SETQUOTA-quotactl$Q_SETQUOTA-chown-socket$inet-connect$inet-connect$inet-sendfile-ioctl$FS_IOC_GET_ENCRYPTION_POLICY-ioctl$FS_IOC_GET_ENCRYPTION_POLICY-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-syz_kvm_setup_cpu$x86-getsockopt$sock_buf-ioctl$KVM_RUN
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0) (async)
r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r2, &(0x7f0000000200)="c7", 0x1)
socket$pppl2tp(0x18, 0x1, 0x1) (async)
r3 = socket$pppl2tp(0x18, 0x1, 0x1)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f0000000040)='./bus\x00', 0x1208002, &(0x7f0000000380)={[{@grpquota}, {@jqfmt_vfsold}, {@resuid}, {@debug}, {@dioread_nolock}, {}, {@acl}, {@noauto_da_alloc}]}, 0x1, 0x5d8, &(0x7f00000005c0)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=")
lchown(&(0x7f00000006c0)='./file0\x00', 0x0, 0xee01)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401}) (async)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401})
chown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0)
r5 = socket$inet(0x2, 0x2, 0x0)
connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e24, @local}, 0x10)
connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x28)
sendfile(r3, r1, 0x0, 0x1)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r3, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3}) (async)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r3, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3})
r6 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) (async)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0)
getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240))
ioctl$KVM_RUN(r7, 0xae80, 0x0) (async)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-openat$kvm-getrandom-openat-openat-openat-write-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_mount_image$ext4-lchown-quotactl$Q_SETQUOTA-quotactl$Q_SETQUOTA-chown-socket$inet-connect$inet-connect$inet-sendfile-ioctl$FS_IOC_GET_ENCRYPTION_POLICY-ioctl$FS_IOC_GET_ENCRYPTION_POLICY-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-syz_kvm_setup_cpu$x86-getsockopt$sock_buf
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0) (async)
r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r2, &(0x7f0000000200)="c7", 0x1)
socket$pppl2tp(0x18, 0x1, 0x1) (async)
r3 = socket$pppl2tp(0x18, 0x1, 0x1)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f0000000040)='./bus\x00', 0x1208002, &(0x7f0000000380)={[{@grpquota}, {@jqfmt_vfsold}, {@resuid}, {@debug}, {@dioread_nolock}, {}, {@acl}, {@noauto_da_alloc}]}, 0x1, 0x5d8, &(0x7f00000005c0)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=")
lchown(&(0x7f00000006c0)='./file0\x00', 0x0, 0xee01)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401}) (async)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401})
chown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0)
r5 = socket$inet(0x2, 0x2, 0x0)
connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e24, @local}, 0x10)
connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x28)
sendfile(r3, r1, 0x0, 0x1)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r3, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3}) (async)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r3, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3})
r6 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) (async)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0)
getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240))

program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-openat$kvm-getrandom-openat-openat-openat-write-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_mount_image$ext4-lchown-quotactl$Q_SETQUOTA-quotactl$Q_SETQUOTA-chown-socket$inet-connect$inet-connect$inet-sendfile-ioctl$FS_IOC_GET_ENCRYPTION_POLICY-ioctl$FS_IOC_GET_ENCRYPTION_POLICY-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-syz_kvm_setup_cpu$x86
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0) (async)
r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r2, &(0x7f0000000200)="c7", 0x1)
socket$pppl2tp(0x18, 0x1, 0x1) (async)
r3 = socket$pppl2tp(0x18, 0x1, 0x1)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f0000000040)='./bus\x00', 0x1208002, &(0x7f0000000380)={[{@grpquota}, {@jqfmt_vfsold}, {@resuid}, {@debug}, {@dioread_nolock}, {}, {@acl}, {@noauto_da_alloc}]}, 0x1, 0x5d8, &(0x7f00000005c0)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=")
lchown(&(0x7f00000006c0)='./file0\x00', 0x0, 0xee01)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401}) (async)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401})
chown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0)
r5 = socket$inet(0x2, 0x2, 0x0)
connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e24, @local}, 0x10)
connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x28)
sendfile(r3, r1, 0x0, 0x1)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r3, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3}) (async)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r3, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3})
r6 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) (async)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0)

program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-openat$kvm-getrandom-openat-openat-openat-write-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_mount_image$ext4-lchown-quotactl$Q_SETQUOTA-quotactl$Q_SETQUOTA-chown-socket$inet-connect$inet-connect$inet-sendfile-ioctl$FS_IOC_GET_ENCRYPTION_POLICY-ioctl$FS_IOC_GET_ENCRYPTION_POLICY-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0) (async)
r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r2, &(0x7f0000000200)="c7", 0x1)
socket$pppl2tp(0x18, 0x1, 0x1) (async)
r3 = socket$pppl2tp(0x18, 0x1, 0x1)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f0000000040)='./bus\x00', 0x1208002, &(0x7f0000000380)={[{@grpquota}, {@jqfmt_vfsold}, {@resuid}, {@debug}, {@dioread_nolock}, {}, {@acl}, {@noauto_da_alloc}]}, 0x1, 0x5d8, &(0x7f00000005c0)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=")
lchown(&(0x7f00000006c0)='./file0\x00', 0x0, 0xee01)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401}) (async)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401})
chown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0)
r5 = socket$inet(0x2, 0x2, 0x0)
connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e24, @local}, 0x10)
connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x28)
sendfile(r3, r1, 0x0, 0x1)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r3, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3}) (async)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r3, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3})
r6 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) (async)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-openat$kvm-getrandom-openat-openat-openat-write-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_mount_image$ext4-lchown-quotactl$Q_SETQUOTA-quotactl$Q_SETQUOTA-chown-socket$inet-connect$inet-connect$inet-sendfile-ioctl$FS_IOC_GET_ENCRYPTION_POLICY-ioctl$FS_IOC_GET_ENCRYPTION_POLICY-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_CREATE_VCPU
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0) (async)
r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r2, &(0x7f0000000200)="c7", 0x1)
socket$pppl2tp(0x18, 0x1, 0x1) (async)
r3 = socket$pppl2tp(0x18, 0x1, 0x1)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f0000000040)='./bus\x00', 0x1208002, &(0x7f0000000380)={[{@grpquota}, {@jqfmt_vfsold}, {@resuid}, {@debug}, {@dioread_nolock}, {}, {@acl}, {@noauto_da_alloc}]}, 0x1, 0x5d8, &(0x7f00000005c0)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=")
lchown(&(0x7f00000006c0)='./file0\x00', 0x0, 0xee01)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401}) (async)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401})
chown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0)
r5 = socket$inet(0x2, 0x2, 0x0)
connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e24, @local}, 0x10)
connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x28)
sendfile(r3, r1, 0x0, 0x1)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r3, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3}) (async)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r3, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3})
r6 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-openat$kvm-getrandom-openat-openat-openat-write-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_mount_image$ext4-lchown-quotactl$Q_SETQUOTA-quotactl$Q_SETQUOTA-chown-socket$inet-connect$inet-connect$inet-sendfile-ioctl$FS_IOC_GET_ENCRYPTION_POLICY-ioctl$FS_IOC_GET_ENCRYPTION_POLICY-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0) (async)
r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r2, &(0x7f0000000200)="c7", 0x1)
socket$pppl2tp(0x18, 0x1, 0x1) (async)
r3 = socket$pppl2tp(0x18, 0x1, 0x1)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f0000000040)='./bus\x00', 0x1208002, &(0x7f0000000380)={[{@grpquota}, {@jqfmt_vfsold}, {@resuid}, {@debug}, {@dioread_nolock}, {}, {@acl}, {@noauto_da_alloc}]}, 0x1, 0x5d8, &(0x7f00000005c0)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=")
lchown(&(0x7f00000006c0)='./file0\x00', 0x0, 0xee01)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401}) (async)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401})
chown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0)
r5 = socket$inet(0x2, 0x2, 0x0)
connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e24, @local}, 0x10)
connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x28)
sendfile(r3, r1, 0x0, 0x1)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r3, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3}) (async)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r3, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3})
r6 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})

program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-openat$kvm-getrandom-openat-openat-openat-write-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_mount_image$ext4-lchown-quotactl$Q_SETQUOTA-quotactl$Q_SETQUOTA-chown-socket$inet-connect$inet-connect$inet-sendfile-ioctl$FS_IOC_GET_ENCRYPTION_POLICY-ioctl$FS_IOC_GET_ENCRYPTION_POLICY-ioctl$KVM_CREATE_VM
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0) (async)
r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r2, &(0x7f0000000200)="c7", 0x1)
socket$pppl2tp(0x18, 0x1, 0x1) (async)
r3 = socket$pppl2tp(0x18, 0x1, 0x1)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f0000000040)='./bus\x00', 0x1208002, &(0x7f0000000380)={[{@grpquota}, {@jqfmt_vfsold}, {@resuid}, {@debug}, {@dioread_nolock}, {}, {@acl}, {@noauto_da_alloc}]}, 0x1, 0x5d8, &(0x7f00000005c0)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=")
lchown(&(0x7f00000006c0)='./file0\x00', 0x0, 0xee01)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401}) (async)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401})
chown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0)
r5 = socket$inet(0x2, 0x2, 0x0)
connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e24, @local}, 0x10)
connect$inet(r5, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x28)
sendfile(r3, r1, 0x0, 0x1)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r3, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3}) (async)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r3, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3})
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-openat$kvm-getrandom-openat-openat-openat-write-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_mount_image$ext4-lchown-quotactl$Q_SETQUOTA-quotactl$Q_SETQUOTA-chown-socket$inet-connect$inet-connect$inet-sendfile-ioctl$FS_IOC_GET_ENCRYPTION_POLICY-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0) (async)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r1, &(0x7f0000000200)="c7", 0x1)
socket$pppl2tp(0x18, 0x1, 0x1) (async)
r2 = socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f0000000040)='./bus\x00', 0x1208002, &(0x7f0000000380)={[{@grpquota}, {@jqfmt_vfsold}, {@resuid}, {@debug}, {@dioread_nolock}, {}, {@acl}, {@noauto_da_alloc}]}, 0x1, 0x5d8, &(0x7f00000005c0)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=")
lchown(&(0x7f00000006c0)='./file0\x00', 0x0, 0xee01)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401}) (async)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401})
chown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0)
r4 = socket$inet(0x2, 0x2, 0x0)
connect$inet(r4, &(0x7f0000000080)={0x2, 0x4e24, @local}, 0x10)
connect$inet(r4, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x28)
sendfile(r2, r0, 0x0, 0x1)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r2, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3}) (async)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r2, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3})

program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-openat$kvm-getrandom-openat-openat-openat-write-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_mount_image$ext4-lchown-quotactl$Q_SETQUOTA-quotactl$Q_SETQUOTA-chown-socket$inet-connect$inet-connect$inet-sendfile-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0) (async)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r1, &(0x7f0000000200)="c7", 0x1)
socket$pppl2tp(0x18, 0x1, 0x1) (async)
r2 = socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f0000000040)='./bus\x00', 0x1208002, &(0x7f0000000380)={[{@grpquota}, {@jqfmt_vfsold}, {@resuid}, {@debug}, {@dioread_nolock}, {}, {@acl}, {@noauto_da_alloc}]}, 0x1, 0x5d8, &(0x7f00000005c0)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=")
lchown(&(0x7f00000006c0)='./file0\x00', 0x0, 0xee01)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401}) (async)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401})
chown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0)
r4 = socket$inet(0x2, 0x2, 0x0)
connect$inet(r4, &(0x7f0000000080)={0x2, 0x4e24, @local}, 0x10)
connect$inet(r4, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x28)
sendfile(r2, r0, 0x0, 0x1)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r2, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3}) (async)

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-openat$kvm-getrandom-openat-openat-openat-write-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_mount_image$ext4-lchown-quotactl$Q_SETQUOTA-quotactl$Q_SETQUOTA-chown-socket$inet-connect$inet-connect$inet-sendfile
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0) (async)
r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r1, &(0x7f0000000200)="c7", 0x1)
socket$pppl2tp(0x18, 0x1, 0x1) (async)
r2 = socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f0000000040)='./bus\x00', 0x1208002, &(0x7f0000000380)={[{@grpquota}, {@jqfmt_vfsold}, {@resuid}, {@debug}, {@dioread_nolock}, {}, {@acl}, {@noauto_da_alloc}]}, 0x1, 0x5d8, &(0x7f00000005c0)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=")
lchown(&(0x7f00000006c0)='./file0\x00', 0x0, 0xee01)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401}) (async)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401})
chown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0)
r4 = socket$inet(0x2, 0x2, 0x0)
connect$inet(r4, &(0x7f0000000080)={0x2, 0x4e24, @local}, 0x10)
connect$inet(r4, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x28)
sendfile(r2, r0, 0x0, 0x1)

program did not crash
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-openat$kvm-getrandom-openat-openat-openat-write-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_mount_image$ext4-lchown-quotactl$Q_SETQUOTA-quotactl$Q_SETQUOTA-chown-socket$inet-connect$inet-connect$inet-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r0, &(0x7f0000000200)="c7", 0x1)
socket$pppl2tp(0x18, 0x1, 0x1) (async)
r1 = socket$pppl2tp(0x18, 0x1, 0x1)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f0000000040)='./bus\x00', 0x1208002, &(0x7f0000000380)={[{@grpquota}, {@jqfmt_vfsold}, {@resuid}, {@debug}, {@dioread_nolock}, {}, {@acl}, {@noauto_da_alloc}]}, 0x1, 0x5d8, &(0x7f00000005c0)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=")
lchown(&(0x7f00000006c0)='./file0\x00', 0x0, 0xee01)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401}) (async)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401})
chown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0)
r3 = socket$inet(0x2, 0x2, 0x0)
connect$inet(r3, &(0x7f0000000080)={0x2, 0x4e24, @local}, 0x10)
connect$inet(r3, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x28)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3}) (async)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-openat$kvm-getrandom-openat-openat-openat-write-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_mount_image$ext4-lchown-quotactl$Q_SETQUOTA-quotactl$Q_SETQUOTA-chown-socket$inet-connect$inet-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r0, &(0x7f0000000200)="c7", 0x1)
socket$pppl2tp(0x18, 0x1, 0x1) (async)
r1 = socket$pppl2tp(0x18, 0x1, 0x1)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f0000000040)='./bus\x00', 0x1208002, &(0x7f0000000380)={[{@grpquota}, {@jqfmt_vfsold}, {@resuid}, {@debug}, {@dioread_nolock}, {}, {@acl}, {@noauto_da_alloc}]}, 0x1, 0x5d8, &(0x7f00000005c0)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=")
lchown(&(0x7f00000006c0)='./file0\x00', 0x0, 0xee01)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401}) (async)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401})
chown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0)
r3 = socket$inet(0x2, 0x2, 0x0)
connect$inet(r3, &(0x7f0000000080)={0x2, 0x4e24, @local}, 0x10)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3}) (async)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-openat$kvm-getrandom-openat-openat-openat-write-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_mount_image$ext4-lchown-quotactl$Q_SETQUOTA-quotactl$Q_SETQUOTA-chown-socket$inet-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r0, &(0x7f0000000200)="c7", 0x1)
socket$pppl2tp(0x18, 0x1, 0x1) (async)
r1 = socket$pppl2tp(0x18, 0x1, 0x1)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f0000000040)='./bus\x00', 0x1208002, &(0x7f0000000380)={[{@grpquota}, {@jqfmt_vfsold}, {@resuid}, {@debug}, {@dioread_nolock}, {}, {@acl}, {@noauto_da_alloc}]}, 0x1, 0x5d8, &(0x7f00000005c0)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=")
lchown(&(0x7f00000006c0)='./file0\x00', 0x0, 0xee01)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401}) (async)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401})
chown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0)
socket$inet(0x2, 0x2, 0x0)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3}) (async)

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-openat$kvm-getrandom-openat-openat-openat-write-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_mount_image$ext4-lchown-quotactl$Q_SETQUOTA-quotactl$Q_SETQUOTA-chown-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r0, &(0x7f0000000200)="c7", 0x1)
socket$pppl2tp(0x18, 0x1, 0x1) (async)
r1 = socket$pppl2tp(0x18, 0x1, 0x1)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f0000000040)='./bus\x00', 0x1208002, &(0x7f0000000380)={[{@grpquota}, {@jqfmt_vfsold}, {@resuid}, {@debug}, {@dioread_nolock}, {}, {@acl}, {@noauto_da_alloc}]}, 0x1, 0x5d8, &(0x7f00000005c0)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=")
lchown(&(0x7f00000006c0)='./file0\x00', 0x0, 0xee01)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401}) (async)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401})
chown(&(0x7f0000000140)='./file0\x00', 0x0, 0x0)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3}) (async)

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-openat$kvm-getrandom-openat-openat-openat-write-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_mount_image$ext4-lchown-quotactl$Q_SETQUOTA-quotactl$Q_SETQUOTA-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r0, &(0x7f0000000200)="c7", 0x1)
socket$pppl2tp(0x18, 0x1, 0x1) (async)
r1 = socket$pppl2tp(0x18, 0x1, 0x1)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f0000000040)='./bus\x00', 0x1208002, &(0x7f0000000380)={[{@grpquota}, {@jqfmt_vfsold}, {@resuid}, {@debug}, {@dioread_nolock}, {}, {@acl}, {@noauto_da_alloc}]}, 0x1, 0x5d8, &(0x7f00000005c0)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=")
lchown(&(0x7f00000006c0)='./file0\x00', 0x0, 0xee01)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401}) (async)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401})
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3}) (async)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-openat$kvm-getrandom-openat-openat-openat-write-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_mount_image$ext4-lchown-quotactl$Q_SETQUOTA-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r0, &(0x7f0000000200)="c7", 0x1)
socket$pppl2tp(0x18, 0x1, 0x1) (async)
r1 = socket$pppl2tp(0x18, 0x1, 0x1)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f0000000040)='./bus\x00', 0x1208002, &(0x7f0000000380)={[{@grpquota}, {@jqfmt_vfsold}, {@resuid}, {@debug}, {@dioread_nolock}, {}, {@acl}, {@noauto_da_alloc}]}, 0x1, 0x5d8, &(0x7f00000005c0)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=")
lchown(&(0x7f00000006c0)='./file0\x00', 0x0, 0xee01)
quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000480)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)={0x2, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0xfffffffffffffffc, 0x0, 0x401}) (async)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3}) (async)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-openat$kvm-getrandom-openat-openat-openat-write-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_mount_image$ext4-lchown-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r0, &(0x7f0000000200)="c7", 0x1)
socket$pppl2tp(0x18, 0x1, 0x1) (async)
r1 = socket$pppl2tp(0x18, 0x1, 0x1)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f0000000040)='./bus\x00', 0x1208002, &(0x7f0000000380)={[{@grpquota}, {@jqfmt_vfsold}, {@resuid}, {@debug}, {@dioread_nolock}, {}, {@acl}, {@noauto_da_alloc}]}, 0x1, 0x5d8, &(0x7f00000005c0)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=")
lchown(&(0x7f00000006c0)='./file0\x00', 0x0, 0xee01)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3}) (async)

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-openat$kvm-getrandom-openat-openat-openat-write-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_mount_image$ext4-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r0, &(0x7f0000000200)="c7", 0x1)
socket$pppl2tp(0x18, 0x1, 0x1) (async)
r1 = socket$pppl2tp(0x18, 0x1, 0x1)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f0000000040)='./bus\x00', 0x1208002, &(0x7f0000000380)={[{@grpquota}, {@jqfmt_vfsold}, {@resuid}, {@debug}, {@dioread_nolock}, {}, {@acl}, {@noauto_da_alloc}]}, 0x1, 0x5d8, &(0x7f00000005c0)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=")
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3}) (async)

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-openat$kvm-getrandom-openat-openat-openat-write-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r0, &(0x7f0000000200)="c7", 0x1)
socket$pppl2tp(0x18, 0x1, 0x1) (async)
r1 = socket$pppl2tp(0x18, 0x1, 0x1)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3}) (async)

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-openat$kvm-getrandom-openat-openat-openat-write-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r0, &(0x7f0000000200)="c7", 0x1)
socket$pppl2tp(0x18, 0x1, 0x1) (async)
r1 = socket$pppl2tp(0x18, 0x1, 0x1)
socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3}) (async)

program did not crash
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-openat$kvm-getrandom-openat-openat-openat-write-socket$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r0, &(0x7f0000000200)="c7", 0x1)
socket$pppl2tp(0x18, 0x1, 0x1) (async)
r1 = socket$pppl2tp(0x18, 0x1, 0x1)
connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3}) (async)

program did not crash
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-openat$kvm-getrandom-openat-openat-openat-write-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r0, &(0x7f0000000200)="c7", 0x1)
socket$pppl2tp(0x18, 0x1, 0x1) (async)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3}) (async)

program did not crash
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-openat$kvm-getrandom-openat-openat-openat-write-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
write(r0, &(0x7f0000000200)="c7", 0x1)
r1 = socket$pppl2tp(0x18, 0x1, 0x1)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3}) (async)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-openat$kvm-getrandom-openat-openat-openat-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x1c1002, 0x12)
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3}) (async)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-openat$kvm-getrandom-openat-openat-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0)
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3}) (async)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-openat$kvm-getrandom-openat-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x40, 0x0) (async)
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3}) (async)

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-openat$kvm-getrandom-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0)
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3}) (async)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-openat$kvm-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0)
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3}) (async)

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) (async)
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3}) (async)

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3}) (async)

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3})

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, 0x0, 0x0)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000180)={0x0, @aes128, 0x0, @desc3})

program did not crash
testing program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, 0x0)

program crashed: KASAN: use-after-free Read in rcu_cblist_dequeue
extracting C reproducer
testing compiled C program (duration=33.243666348s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
program crashed: KASAN: use-after-free Write in pppol2tp_release
simplifying C reproducer
testing compiled C program (duration=33.243666348s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
program crashed: KASAN: use-after-free Write in pppol2tp_release
testing compiled C program (duration=33.243666348s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
program crashed: KASAN: use-after-free Write in pppol2tp_release
testing compiled C program (duration=33.243666348s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing compiled C program (duration=33.243666348s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing compiled C program (duration=33.243666348s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing compiled C program (duration=33.243666348s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=33.243666348s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, 0x0)

program crashed: KASAN: use-after-free Read in rcu_cblist_dequeue
validation run: crashed=true
testing program (duration=33.243666348s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, 0x0)

program crashed: KASAN: use-after-free Write in pppol2tp_release
validation run: crashed=true
testing program (duration=33.243666348s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$FS_IOC_GET_ENCRYPTION_POLICY
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @empty}, 0x2}}, 0x2e)
ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, 0x0)

program crashed: KASAN: use-after-free Write in pppol2tp_release
validation run: crashed=true
reproducing took 29m54.4649325s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
BUG: KASAN: use-after-free in atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline]
BUG: KASAN: use-after-free in atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline]
BUG: KASAN: use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:173 [inline]
BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298
Write of size 8 at addr ffff888111772d50 by task syz.2.17/383

CPU: 0 PID: 383 Comm: syz.2.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 __dump_stack+0x21/0x24 lib/dump_stack.c:77
 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:435 [inline]
 kasan_report+0x100/0x140 mm/kasan/report.c:452
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189
 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37
 instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
 atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline]
 atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline]
 __mutex_trylock_fast kernel/locking/mutex.c:173 [inline]
 mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298
 pppol2tp_release+0x178/0x2b0 net/l2tp/l2tp_ppp.c:442
 __sock_release net/socket.c:597 [inline]
 sock_close+0xb8/0x200 net/socket.c:1287
 __fput+0x2dc/0x730 fs/file_table.c:281
 ____fput+0x15/0x20 fs/file_table.c:314
 task_work_run+0x127/0x190 kernel/task_work.c:189
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172
 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199
 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274
 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f7e621a0159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc86f3fca8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007ffc86f3fd90 RCX: 00007f7e621a0159
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 0000000000006f01 R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b32c20000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f7e62427fac R14: 00007f7e62427fa8 R15: 00007f7e62427fa0

Allocated by task 383:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:430 [inline]
 ____kasan_kmalloc mm/kasan/common.c:509 [inline]
 __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:518
 kasan_kmalloc include/linux/kasan.h:254 [inline]
 __kmalloc+0x19f/0x330 mm/slub.c:4038
 kmalloc include/linux/slab.h:560 [inline]
 kzalloc include/linux/slab.h:667 [inline]
 l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616
 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772
 __sys_connect_file net/socket.c:1867 [inline]
 __sys_connect+0x3ce/0x450 net/socket.c:1884
 __do_sys_connect net/socket.c:1894 [inline]
 __se_sys_connect net/socket.c:1891 [inline]
 __x64_sys_connect+0x7a/0x90 net/socket.c:1891
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

Freed by task 383:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4a/0x70 mm/kasan/common.c:45
 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:362
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370
 kasan_slab_free include/linux/kasan.h:220 [inline]
 slab_free_hook mm/slub.c:1600 [inline]
 slab_free_freelist_hook+0xc5/0x190 mm/slub.c:1626
 slab_free mm/slub.c:3208 [inline]
 kfree+0xc0/0x270 mm/slub.c:4196
 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline]
 l2tp_session_put+0xb2/0x1a0 net/l2tp/l2tp_core.c:193
 l2tp_session_delete+0x3a9/0x4a0 net/l2tp/l2tp_core.c:1589
 pppol2tp_release+0x169/0x2b0 net/l2tp/l2tp_ppp.c:439
 __sock_release net/socket.c:597 [inline]
 sock_close+0xb8/0x200 net/socket.c:1287
 __fput+0x2dc/0x730 fs/file_table.c:281
 ____fput+0x15/0x20 fs/file_table.c:314
 task_work_run+0x127/0x190 kernel/task_work.c:189
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172
 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199
 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274
 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

The buggy address belongs to the object at ffff888111772c00
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 336 bytes inside of
 512-byte region [ffff888111772c00, ffff888111772e00)
The buggy address belongs to the page:
page:ffffea000445dc00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x111770
head:ffffea000445dc00 order:2 compound_mapcount:0 compound_pincount:0
flags: 0x4000000000010200(slab|head)
raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x152a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 365, ts 28441845311, free_ts 28414528345
 set_page_owner include/linux/page_owner.h:35 [inline]
 post_alloc_hook mm/page_alloc.c:2456 [inline]
 prep_new_page+0x176/0x190 mm/page_alloc.c:2462
 get_page_from_freelist+0x225f/0x23f0 mm/page_alloc.c:4254
 __alloc_pages_nodemask+0x29a/0x640 mm/page_alloc.c:5384
 alloc_slab_page mm/slub.c:-1 [inline]
 allocate_slab mm/slub.c:1813 [inline]
 new_slab+0x84/0x3f0 mm/slub.c:1874
 new_slab_objects mm/slub.c:2632 [inline]
 ___slab_alloc+0x2f8/0x4c0 mm/slub.c:2796
 __slab_alloc+0x63/0xa0 mm/slub.c:2836
 slab_alloc_node mm/slub.c:2918 [inline]
 slab_alloc mm/slub.c:2960 [inline]
 __kmalloc+0x1f9/0x330 mm/slub.c:4034
 kmalloc include/linux/slab.h:560 [inline]
 kzalloc include/linux/slab.h:667 [inline]
 fib6_info_alloc+0x34/0xe0 net/ipv6/ip6_fib.c:154
 ip6_route_info_create+0x4c7/0x1450 net/ipv6/route.c:3671
 ip6_route_add+0x27/0x130 net/ipv6/route.c:3767
 addrconf_prefix_route net/ipv6/addrconf.c:2469 [inline]
 fixup_permanent_addr net/ipv6/addrconf.c:3525 [inline]
 addrconf_permanent_addr+0x635/0x940 net/ipv6/addrconf.c:3549
 addrconf_notify+0x752/0xea0 net/ipv6/addrconf.c:3617
 notifier_call_chain kernel/notifier.c:83 [inline]
 raw_notifier_call_chain+0x90/0x100 kernel/notifier.c:410
 call_netdevice_notifiers_info net/core/dev.c:2052 [inline]
 call_netdevice_notifiers_extack net/core/dev.c:2064 [inline]
 call_netdevice_notifiers net/core/dev.c:2078 [inline]
 __dev_notify_flags+0x2f4/0x5b0 net/core/dev.c:8583
 dev_change_flags+0xe3/0x1a0 net/core/dev.c:8621
 do_setlink+0xb19/0x29a0 net/core/rtnetlink.c:2744
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:28 [inline]
 free_pages_prepare mm/page_alloc.c:1349 [inline]
 __free_pages_ok+0x80b/0x830 mm/page_alloc.c:1629
 free_the_page mm/page_alloc.c:5445 [inline]
 __free_pages+0xd8/0x390 mm/page_alloc.c:5454
 __free_slab+0xcf/0x190 mm/slub.c:1899
 free_slab mm/slub.c:1914 [inline]
 discard_slab+0x29/0x40 mm/slub.c:1920
 __slab_free+0x313/0x3a0 mm/slub.c:3136
 do_slab_free mm/slub.c:3196 [inline]
 ___cache_free+0x10e/0x130 mm/slub.c:3215
 qlink_free+0x50/0x90 mm/kasan/quarantine.c:157
 qlist_free_all+0x5f/0xb0 mm/kasan/quarantine.c:176
 kasan_quarantine_reduce+0x14a/0x160 mm/kasan/quarantine.c:283
 __kasan_slab_alloc+0x2f/0xe0 mm/kasan/common.c:440
 kasan_slab_alloc include/linux/kasan.h:244 [inline]
 slab_post_alloc_hook+0x5d/0x2f0 mm/slab.h:580
 slab_alloc_node mm/slub.c:2952 [inline]
 slab_alloc mm/slub.c:2960 [inline]
 kmem_cache_alloc_trace+0x155/0x2e0 mm/slub.c:2977
 kmalloc include/linux/slab.h:555 [inline]
 syslog_print+0x127/0x720 kernel/printk/printk.c:1487
 do_syslog+0x94c/0x9a0 kernel/printk/printk.c:1644
 __do_sys_syslog kernel/printk/printk.c:1736 [inline]
 __se_sys_syslog kernel/printk/printk.c:1734 [inline]
 __x64_sys_syslog+0x7c/0x90 kernel/printk/printk.c:1734
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46

Memory state around the buggy address:
 ffff888111772c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888111772c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888111772d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                 ^
 ffff888111772d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888111772e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
BUG: KASAN: use-after-free in atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline]
BUG: KASAN: use-after-free in atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline]
BUG: KASAN: use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:173 [inline]
BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298
Write of size 8 at addr ffff888111772d50 by task syz.2.17/383

CPU: 0 PID: 383 Comm: syz.2.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 __dump_stack+0x21/0x24 lib/dump_stack.c:77
 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:435 [inline]
 kasan_report+0x100/0x140 mm/kasan/report.c:452
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189
 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37
 instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
 atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline]
 atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline]
 __mutex_trylock_fast kernel/locking/mutex.c:173 [inline]
 mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298
 pppol2tp_release+0x178/0x2b0 net/l2tp/l2tp_ppp.c:442
 __sock_release net/socket.c:597 [inline]
 sock_close+0xb8/0x200 net/socket.c:1287
 __fput+0x2dc/0x730 fs/file_table.c:281
 ____fput+0x15/0x20 fs/file_table.c:314
 task_work_run+0x127/0x190 kernel/task_work.c:189
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172
 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199
 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274
 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f7e621a0159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc86f3fca8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007ffc86f3fd90 RCX: 00007f7e621a0159
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 0000000000006f01 R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b32c20000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f7e62427fac R14: 00007f7e62427fa8 R15: 00007f7e62427fa0

Allocated by task 383:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:430 [inline]
 ____kasan_kmalloc mm/kasan/common.c:509 [inline]
 __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:518
 kasan_kmalloc include/linux/kasan.h:254 [inline]
 __kmalloc+0x19f/0x330 mm/slub.c:4038
 kmalloc include/linux/slab.h:560 [inline]
 kzalloc include/linux/slab.h:667 [inline]
 l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616
 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772
 __sys_connect_file net/socket.c:1867 [inline]
 __sys_connect+0x3ce/0x450 net/socket.c:1884
 __do_sys_connect net/socket.c:1894 [inline]
 __se_sys_connect net/socket.c:1891 [inline]
 __x64_sys_connect+0x7a/0x90 net/socket.c:1891
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

Freed by task 383:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4a/0x70 mm/kasan/common.c:45
 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:362
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370
 kasan_slab_free include/linux/kasan.h:220 [inline]
 slab_free_hook mm/slub.c:1600 [inline]
 slab_free_freelist_hook+0xc5/0x190 mm/slub.c:1626
 slab_free mm/slub.c:3208 [inline]
 kfree+0xc0/0x270 mm/slub.c:4196
 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline]
 l2tp_session_put+0xb2/0x1a0 net/l2tp/l2tp_core.c:193
 l2tp_session_delete+0x3a9/0x4a0 net/l2tp/l2tp_core.c:1589
 pppol2tp_release+0x169/0x2b0 net/l2tp/l2tp_ppp.c:439
 __sock_release net/socket.c:597 [inline]
 sock_close+0xb8/0x200 net/socket.c:1287
 __fput+0x2dc/0x730 fs/file_table.c:281
 ____fput+0x15/0x20 fs/file_table.c:314
 task_work_run+0x127/0x190 kernel/task_work.c:189
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172
 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199
 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274
 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

The buggy address belongs to the object at ffff888111772c00
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 336 bytes inside of
 512-byte region [ffff888111772c00, ffff888111772e00)
The buggy address belongs to the page:
page:ffffea000445dc00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x111770
head:ffffea000445dc00 order:2 compound_mapcount:0 compound_pincount:0
flags: 0x4000000000010200(slab|head)
raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x152a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 365, ts 28441845311, free_ts 28414528345
 set_page_owner include/linux/page_owner.h:35 [inline]
 post_alloc_hook mm/page_alloc.c:2456 [inline]
 prep_new_page+0x176/0x190 mm/page_alloc.c:2462
 get_page_from_freelist+0x225f/0x23f0 mm/page_alloc.c:4254
 __alloc_pages_nodemask+0x29a/0x640 mm/page_alloc.c:5384
 alloc_slab_page mm/slub.c:-1 [inline]
 allocate_slab mm/slub.c:1813 [inline]
 new_slab+0x84/0x3f0 mm/slub.c:1874
 new_slab_objects mm/slub.c:2632 [inline]
 ___slab_alloc+0x2f8/0x4c0 mm/slub.c:2796
 __slab_alloc+0x63/0xa0 mm/slub.c:2836
 slab_alloc_node mm/slub.c:2918 [inline]
 slab_alloc mm/slub.c:2960 [inline]
 __kmalloc+0x1f9/0x330 mm/slub.c:4034
 kmalloc include/linux/slab.h:560 [inline]
 kzalloc include/linux/slab.h:667 [inline]
 fib6_info_alloc+0x34/0xe0 net/ipv6/ip6_fib.c:154
 ip6_route_info_create+0x4c7/0x1450 net/ipv6/route.c:3671
 ip6_route_add+0x27/0x130 net/ipv6/route.c:3767
 addrconf_prefix_route net/ipv6/addrconf.c:2469 [inline]
 fixup_permanent_addr net/ipv6/addrconf.c:3525 [inline]
 addrconf_permanent_addr+0x635/0x940 net/ipv6/addrconf.c:3549
 addrconf_notify+0x752/0xea0 net/ipv6/addrconf.c:3617
 notifier_call_chain kernel/notifier.c:83 [inline]
 raw_notifier_call_chain+0x90/0x100 kernel/notifier.c:410
 call_netdevice_notifiers_info net/core/dev.c:2052 [inline]
 call_netdevice_notifiers_extack net/core/dev.c:2064 [inline]
 call_netdevice_notifiers net/core/dev.c:2078 [inline]
 __dev_notify_flags+0x2f4/0x5b0 net/core/dev.c:8583
 dev_change_flags+0xe3/0x1a0 net/core/dev.c:8621
 do_setlink+0xb19/0x29a0 net/core/rtnetlink.c:2744
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:28 [inline]
 free_pages_prepare mm/page_alloc.c:1349 [inline]
 __free_pages_ok+0x80b/0x830 mm/page_alloc.c:1629
 free_the_page mm/page_alloc.c:5445 [inline]
 __free_pages+0xd8/0x390 mm/page_alloc.c:5454
 __free_slab+0xcf/0x190 mm/slub.c:1899
 free_slab mm/slub.c:1914 [inline]
 discard_slab+0x29/0x40 mm/slub.c:1920
 __slab_free+0x313/0x3a0 mm/slub.c:3136
 do_slab_free mm/slub.c:3196 [inline]
 ___cache_free+0x10e/0x130 mm/slub.c:3215
 qlink_free+0x50/0x90 mm/kasan/quarantine.c:157
 qlist_free_all+0x5f/0xb0 mm/kasan/quarantine.c:176
 kasan_quarantine_reduce+0x14a/0x160 mm/kasan/quarantine.c:283
 __kasan_slab_alloc+0x2f/0xe0 mm/kasan/common.c:440
 kasan_slab_alloc include/linux/kasan.h:244 [inline]
 slab_post_alloc_hook+0x5d/0x2f0 mm/slab.h:580
 slab_alloc_node mm/slub.c:2952 [inline]
 slab_alloc mm/slub.c:2960 [inline]
 kmem_cache_alloc_trace+0x155/0x2e0 mm/slub.c:2977
 kmalloc include/linux/slab.h:555 [inline]
 syslog_print+0x127/0x720 kernel/printk/printk.c:1487
 do_syslog+0x94c/0x9a0 kernel/printk/printk.c:1644
 __do_sys_syslog kernel/printk/printk.c:1736 [inline]
 __se_sys_syslog kernel/printk/printk.c:1734 [inline]
 __x64_sys_syslog+0x7c/0x90 kernel/printk/printk.c:1734
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46

Memory state around the buggy address:
 ffff888111772c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888111772c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888111772d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                 ^
 ffff888111772d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888111772e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================