Extracting prog: 2m34.659518014s Minimizing prog: 24m42.728312737s Simplifying prog options: 0s Extracting C: 35.949429159s Simplifying C: 5m54.525391729s extracting reproducer from 54 programs testing a last program of every proc single: executing 13 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$erofs-syz_open_procfs-syz_usb_connect-syz_genetlink_get_family_id$ethtool-openat$ttyS3-syz_mount_image$exfat-ioctl$TIOCMGET-sendmsg$ETHTOOL_MSG_LINKMODES_GET detailed listing: executing program 0: syz_mount_image$erofs(&(0x7f0000000040), &(0x7f0000000500)='./file0\x00', 0x4, &(0x7f0000001a00)=ANY=[], 0x5, 0x208, &(0x7f0000000080)="$eJzsmb9rFEEUx78zd7t3CYFYWdhYGDGgbnb3jAQkhf4Fgr87g1mDuiZyrpBYeVhbWvgH+E8IdnY2Yp1CBcFmO8UmOPJmZufGu2zcGDiQvA/c3nfevJl583bnbbFgGObQ8uXzj08vLi1dPQNgBnPoWPu31tBHev7br56cfrlMXq/frVtb4PV3Gq9sRulljjijInyvOec05Bqki+kGBE5afRsS163OIHDL6vue3piyIs+iOxv56t17eRbTZdHZe/5abQBlKLAKoIvvOkTh9T/eevpgJc+z/qgIVDXfWNd+xV5Z1PFdlFj2Eki5uRk8H1A7svYY0uQSQAKJxOoeBK5YvYQOoihyKUmAX8qAY63h/K0m+3fiZ92Wmuw/gEn2P2RNzQJnjWXmINn//0XX3qvqbE52dXoMJ7nlHaXU3j5i1ELP2PZb86RtHS3fvB8f9fXggYk/jgy16JdP1Y66MNvkfP1doDty3+kAk/g4vc8JKWDPEtod7epMHR90t2gDp7z61NZVy7BQPHxUtdaytWw9TXvn43NxvJgu6EJkrmN1b8fVvy7KgcC0N39QUytDEWJzpSj6ySZQ9BPXTs2V4ia/vqus5t1XDiTmT5g5KAMh6l901W2V+p/UPIBnNRExDMMwDMMwDMMwDMMwDMM0JgCOQ0CZD2mi+qK2C+llPeB3AAAA//+zWEVP") r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/4\x00') syz_usb_connect(0x6, 0x1e3, &(0x7f0000000540)={{0x12, 0x1, 0x200, 0xfd, 0x85, 0xb6, 0xff, 0x2001, 0x7d03, 0xa669, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1d1, 0x1, 0x1, 0x1, 0xa0, 0x8, "", [{{0x9, 0x4, 0x56, 0xc4, 0xe, 0xff, 0xf3, 0x4c, 0x5, [@cdc_ecm={{0x8, 0x24, 0x6, 0x0, 0x0, '!U<'}, {0x5, 0x24, 0x0, 0x18c}, {0xd, 0x24, 0xf, 0x1, 0x5, 0x61, 0x14}, [@mdlm_detail={0x2f, 0x24, 0x13, 0x9, "568f397dd5ba9932da4770046a71953ce110b067eb35b84b6df15e1dc1f3eade886992bf803d39c6fc2814"}]}, @uac_as={[@as_header={0x7, 0x24, 0x1, 0x48, 0x4}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x1, 0xfe, 0x40, 0x4, 0x7}, @format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x7f, 0x40, 0x3, 0x8, 0x8}, @format_type_i_discrete={0xa, 0x24, 0x2, 0x1, 0x5, 0x3, 0x5, 0xc, "f8b5"}]}], [{{0x9, 0x5, 0xd, 0x3, 0x400, 0xb, 0x7, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x9, 0x4}]}}, {{0x9, 0x5, 0xb, 0x8, 0x20, 0x0, 0xcd, 0x7}}, {{0x9, 0x5, 0x4, 0x0, 0x40, 0x9, 0x7, 0xf7}}, {{0x9, 0x5, 0x0, 0x0, 0x10, 0x1, 0x1, 0x1}}, {{0x9, 0x5, 0xd, 0x4, 0x20, 0x5, 0x0, 0x1d, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x1, 0x2059}]}}, {{0x9, 0x5, 0x80, 0x0, 0x3ff, 0x8, 0x1, 0x8, [@generic={0x5f, 0x10, "fb3d7c2d0b8d844f32b9299cc17338f40a8cca9ff409d63f45b50bb44b13d5f228b760b86ae3e61e0431ee42d4bba6cb71d31f5526eb78c436bb4c46985cf882ef37b9a529524157ce03f19a4929c4a7499c50d40947c1c333f21d976b"}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0x5, 0xfb}]}}, {{0x9, 0x5, 0x8, 0x0, 0x3ff, 0x7f, 0x40, 0x81}}, {{0x9, 0x5, 0x80, 0x0, 0x40, 0x9, 0x0, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x1, 0x5}, @generic={0x30, 0xf, "c96ad9dd134f7ff8676cd397fafd015768e5cb6c124120c24759f2ea3dbebf1637f31fcb36e50db1dbc8359510d5"}]}}, {{0x9, 0x5, 0x0, 0x0, 0x10, 0xcb, 0x21, 0xdb, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x4, 0x6}]}}, {{0x9, 0x5, 0x6, 0x1, 0x340, 0x65, 0x0, 0xfd}}, {{0x9, 0x5, 0x8, 0x10, 0x10, 0xf9, 0x7, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x5, 0x7}, @uac_iso={0x7, 0x25, 0x1, 0x4, 0x2, 0x800}]}}, {{0x9, 0x5, 0x0, 0x0, 0x8, 0xfc, 0x3e, 0x8}}, {{0x9, 0x5, 0x5, 0x8, 0x40, 0x5d, 0x1, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x4, 0x460}]}}, {{0x9, 0x5, 0xc, 0x2, 0x0, 0x2, 0x1, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x1}, @uac_iso={0x7, 0x25, 0x1, 0x8, 0xf, 0x5}]}}]}}]}}]}}, &(0x7f0000000940)={0xa, &(0x7f0000000740)={0xa, 0x6, 0x300, 0x0, 0x6, 0x9c, 0x10, 0x3}, 0x51, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f0f510006141004066ede90396ad53ecc8f072756d8cc577303100b14100406f0599db9361541a095e10f199aea888204100108060005058cf5b60b10010c000007030500020b1001028000000401000632665c19a0ad356f2de484982e81ef0ff4fb9fa500a40e4f0f993151538a8a20ff4388e4fa3980489065f18a8b46536b8d19f3009c3dfcb28bdcb1230aa00037d019433e67a156d338326d61a350a2f724dd24c48b9941c3fa47ea6544826efb2b6466656aa0da768c19ed598af1115f4368a6f1175bea9d21d596ac"], 0x5, [{0x4, &(0x7f0000000800)=@lang_id={0x4, 0x3, 0x827}}, {0x4, &(0x7f0000000840)=@lang_id={0x4, 0x3, 0xfcff}}, {0x4, &(0x7f0000000880)=@lang_id={0x4, 0x3, 0xc04}}, {0x4, &(0x7f00000008c0)=@lang_id={0x4, 0x3, 0x403}}, {0x4, &(0x7f0000000900)=@lang_id={0x4, 0x3, 0x807}}]}) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) syz_mount_image$exfat(&(0x7f00000004c0), &(0x7f0000001900)='./file1\x00', 0x14090, &(0x7f00000024c0)=ANY=[@ANYRES32=0x0, @ANYRES16, @ANYRESOCT=0x0, @ANYBLOB="3a48b1740eb64c9f8350557c864a9a2d845e3e9daaf024be9bd82974c3bc2d6aa4ba3c0929de0643f6271ac86105fc11600eba825f524079cb066c8f3f2108e8471d7fb7ea391d338efbdb3bd344633cdb9459a63d6a35e4363789ddc9f1283498ef14aae2b0a049df1e0bde36fd87e43fca63ba7b97a89639daba7f8e4e0c968116d481865ad3397e334207aeb76d6d2fcd6c5868216cb9985963c5945272971c376b5146a97928e1210e00b93aa9a7a6b0ebea5fb36669af529b4ddd8de205beffbc345cfd740bc7661348a2eca0f375a95bb23ce7a1467b6e4bdc87bc89295fc391228aaa5970445d38a75a4bdd1dcf8010ab11265bad0e6451c0a1c303136962dcc4f617019dc897414dd3798dffc1875dc72e55b16944771bc737dc2c2996d751b1331fce502e47758daed226554c907185596d394d85e2ef0bca09d53f2a1cf3c23c06df135834468df05b23f3e3686ff5b86045a3232f198de42c532e363cba4eb6c71d242a94f8ccc7db50852f29228368c3f0b502119928d77c71e065e7653a6cb60305eeba23432c6c771c669b7da806ac02cdca6f738b3ed68d00e87842beb848abe87da7f81c1fb09c33cdb675b4f3bf35d2cb42a45bc816ec3cb4d83ed223640413730f20b9330c6542cf4f5d3727ef01c1218360f47cd074a479b66463d642db8f8139e10336476f622ee3bbf34df128bd0f85d30d5556234fdefe416d06fa8cfd7ef86012a165c7391b9b2411ec881617ca135f1aa0287a758ad7d25bad9547c000841711f697f00e520eb7425e9832f2004ff67549db2ecfaf442d50eec6491b8b77b826dd0c04d54e632eb5ece6769010b715e9b2abca5e3c94dc7eac04ffc8f479aba0d77f59d78c74d9653eda86b8fd5409bc89f545f5406b334b616f06e6dd1cdafb2dd38dd1ef1f69c48dad30cf0c5a4962653554be39e55268e224e091c9a6ab46d0a1126894411f8028ed2de11f0784c10d47e53423e2615765940815f1d621db584ffb2b071893b96accfb3eee2e8faf0740a3e659a4d1e391fb287ff5648b0facea3ea371e60ecc8443fc73e8e5fe7656a8df8b9a9934029cc61909de1e868d47fffdc900cae9a1216d633c501a463ea0836b8638d7d0810e6193de7ede5c0107411bf01fe5890e424fdbc22f4b619fce80c14fd2e33142edb709764f38f750c127f8fe4fc0f03f764a735880dd3759e9e01f6d372b2825ccee843f275105e9623fab8be5995c0bd35e6d43400f40e37c04a8f0afde260d850d2ab4ff72e2b78eaf4a9285b1f08cb89bbd8bc8cd28a5040312b7eee2e2a5ca6cc0890353e83abe88283827a9db0bc827c703c1e3338f7324cf49a44f8fd5474612577618d34b9d5ecd145e4565ca1a554a0a268afff857c93060126c52ff706ed2e9f91171bb1b7e5d0982d74dd89094c9f3ef69f0c9e539ea271cb4a4c715302b791ae0011e27f2dcac420f4e28c1d299e44c83794ea3333bb2a23e9c0c062681d74b70d37a4a05c63bd6960ef7711023b561ded2d8d27ce595a683495f511ede5dfc114f97e63de2f0338ed67e33157419fb22464ca7e477d6fc912ef7390347f250e0f0d8bfb1193b085c3c15aee3054f53876ca512ddb53562b8f50aa01a1f6dc85821377b6d12fbfe662085a6b7ff2b03f6e82b92bd7efad6b302df5202b7480380f405b109d9611a1d98cf8c41fcd041193c9ae588e764cc0327870fc8f0bc7c6c830a0ecdfb5cbd7eb4ceb0cdfe0fac7fd45c41e3530d809190c739213b272701862dcce49b20807c31e0aca13dde444374d6f0703d97efd53f2ffc702592999bafc06bf8a27f693b34cdb542124b819fa20f660c27ff8ea367b3bcc9e78abb6d5ed29e9e5e42ca35f806d902646f05db1fdbbbedec20e0a77a9ff39a8f1819edee7fc2101f567bb550cda34d91c642fa87a640c6c97d89679073454d1f533881af8d4ba4ae77a1e5324f649d3f970c971f905c2a375212d9de4b7641c1832daf8873e62ecdd41bebc638597cdd4eb92af7efb73dbde5de30a80d3daf2d4e64fa47a9538abbcebac6f3782ac65a37263adadde6d176108d434264bd1181242246039eda9113cdfe280ffbe57d0b30cbbd4f000eb7bdab3ae38c3adcdb81fe828e37630c8b75d9bf711e4963f7ac04f550a68b30df9b89026222fc4c6d2a41312c7d325f19a86440cbe00856c474e675cc2a23e43b4147cef8117c13c79a886354eb3f6e33208544f46e820806d40e15ba66b59bcffe71af1c356974abec5e8177963b5a18f76ef72d7f0a33bc8d7f810ab7d4b8ad373c0a1f7c65fecec7aca64419ae981d730c8cd78f5145de326bd6b1d053c1875651b63df23875e6748b07e012699623650ee820d04f5b99f7236200885befcbc37458644b185637d9d96009c2de2d9a2df073b5afdc22b2c92871aa47ee8eca61b75fe9bd2d7b71b9ab181613998eff0c7f6dc958f048c360d4ac8eeb157b8fc77685f433b01504ebd488ecf5cb6d21b3bc115a6932f1db0685f46bbac9208b854b8dc150714b1a40af85ea5558940940b6a69a32ae3e493e6b5b6dc763ba477e75686852f0d04780f153f9d739f0e097ffc583c7c14a11d7460838b12c22c241a117d5bca8a3442efb0f9be7329937ef7eeee1fce20ab28930a1f54e87ab97afe743375c7c7b594e261a31ca23cc5b2ca0773fed31a71019484b48537fbac01c02b0f38a4b1b2c68edd934836ef120ca2087ae44cb3ada567a6627bccd56834346b562c0c4e9ebb21110507f4a6b0f223e29a832ee65e8fe1cd4e7af02a4f717b7570328f429410501aa213793933d41029c913822cabb09c54337a770c4c6521e584c15cf3209478e843502d2434963e3624c2c8c2cf353a4fe80dcad082a0692edba67a6e11e2a6a803b140d54db594012803a7a37a65166ea60c73b2a0a1acdf9e9fff0c0c06e60b15e0ca1f5ce147d9e7763386edc784cafa3f9e5f1ae8bd1e251bda39dcc0f5ad43f9bbeb8979b0112351e1f9f4f49234bb626181135c0f2e110dd495035f3ba5d1f27ada154fcefb2243fb341ef3fc4f34554af5e0ea2fa9989bc00f941987d9d3687c1b2db4661f71e759352ef3a7da83fea1f3ef0927a3dbc18b9762638d7f1fc6216e54ef23b73356df480766b331bc82438f8a34c2d5ea50d30bd2d94a460ed9648201803a48ee7556dd25baddbb37a74f91aea8ef7408fcaae093f4611a655a03e932ad43b3f299b70682a2da98f0c90f29e07bdbb47ad6482c406ccb3aec05e0948351b79479c968a58ab479c14c72aa3d7b692b829d0aeb6ecf1516a7dfdfa563b368a879751da48b320951aef9d748830bc459a71d128793d59b00139a46e6707a56a9d2c4b83ae7fa35104c58f08bb493ee329c262a66a39dfffce0ea10eba2152eb678c13bf1c938ea04f282483e2f51fc96458051410fac2e092bdca7f458ff60d677e614a0712d088a1b54f63aa83f47c5d36b3c619d780ea4919907183562d6f805b3a9f236bff57dacd40840eae94353672cfb2e84dcf9d8565e6ebf1942444c36d4bd6b540d775e0edb36d51083c1ab4981933709a3b49861037e96619e40b15a6845a05895fbaac386222f7c2d7708a9e00ed855c1b3b3efa0f57fc01c046e6647a9cca6ac222a19b5dc3030060ec737d7091bfcc5dacf1bd4c5abde019b92f4a62f27872f5b694a1256dbe1d8e55e3d3ac200c52fbaf194ff16fb8d194a0a7e69d5d546c91feae81155276920d37575793f265ccaa0ed240da9c5d97a27ef5a9fdddde108b45e92ed5dd39c53b20e4508c037fdc01ee52ad34c578b1099c67dcbb3d82ec720e8f36b6b071f41bc8f0b93b05e7d3212b5de0500d1b411ff58f9255d3666920a436ff40a883b9171f50913984ef585fbab4f9f5ee2562aa84e75ab282f3d88c9390cbba954900361fde4c294ccff7d95413177575202c4f9e11d30eac855fd4b9f2c6fa562756ab5e49d2bf3ed12cc237aca99b790746b412e3c00cf46efcc74e57061f474fa04deea58b71aa5af7ff67838f32a5e31b04047b5ad2de641b7a395f6c324575a86e11f9bf1411fbb8b8065dea426401e9f2c9950d6f1d89377fa53e26e0e30dbf8f50e8554b20225b3945ac6fe01e9aabad877ef4ee1e4a11134623996a7d74142a5ba8c557b4cacf62f6c3e7282c196f50c3b8362ad5b7a0711cdeef22bdf635f6a30e3904347bdc9c744734a41eb7165eb8f43c3dea858b2525f0ece90c57592448b8f239bf0d4568efb2d80efacad6a47eac645055177df9afe3d87cd7e3452c0fdcec6fc27db5b91f505b4aff25400d9e9d4097305ea07f7a0a627a1ff814a9add5c59a2784064a1ed382387ead55c62cb98371e2aad1839c04ec2da9289c7bea84b372f4413d9a4db43df111db74e4115bf06227eb326ddf5536fc83ae2036b89d948e4278a06500499655995f59b384b87e19199a5b73643fbf0c3a26d8597c6895fbf579a472bd9f4d7ddce5ce0675b462f2168be47edbe00932e41ffa982004ef86aeeaa8bd050470f4285e8dcd59a50bb8d026bf86f798e855e749a7c5339764563727b2508a6ccf5fdb8f8ad59d8aab9659a10cda4bf55d861ab0c54db610882ea3b72f99f766cb8846a4fad819f2b5cf17d0998b521d88b548c006f688cf3968d031196c4b5d189ef588ede293eb982af1aef0c44955070bbcf34008fd57d9457f0480cbdc5b5b7096611809383f2a980090a5aa811e132bbb37c57416bdf307603b0a8b3796fada530cd3216344373665cdced12b186ed23b111293c35e853d321ec58780f6caab1db0fdbe478bab4114a24d5957c744ed7df00bb8fc5678bdea455c921f0eda391481daea3d3d748969f140f3c9c4bf95cd7c33bcab01250d4c0d8b4b016a13ae160023ff137bd7cdeac964e11d7137b669d0cc9fc718b91cb389dec6e3e1db4c56d03b715a410782e06ea7578eb14cb36c9b1edabdf2d6ccb8b4da5187bbd67b21c65e4cccabfea679b4cb75bd91d048fc5bce5581df4a6a9ae7328f4e3a46b4ceb711caaebffa0e2071a3354a3a7fd5942a7f90f0ccefcda5ce4b640b7dfa26c3d252f9fd3a95c4ca0a29a6bcc94467c7f08560c12a79eaa545f9945d592d0ef592db43217b0e481fde34b96f1013d2be9938e2fe4fb3f9b41b87ee2186636df77b1eb03103f5b69bd39e4091e371eaa4315aaa930c25d2c61aed6b2cdaffc29bd2b6377280c75a67bcc9f9970c3c8461b0fcc46ff0af69caa68b8da707b5d071416145179c634cf97e7a6aa03867965d3636dc9ca80a1a468b2e652bb4c7d015c38451574532d3b60ffd4306a2ed15722e29b8d9ef3cfcfb84e164f7dc2f29993aa1938e20e4ec579d33b53290edba9a1b5e7f51bb32ac912171d0792d85f9a78a2828fa8c971b90596d2927378f2dfd767d456113153135d2c22ea21a9a5a641f001c1b9c63486eb1a9975a690414d6882009098569387bfaa4210c87518b0bc1c99f5277fa91ba3fd04cb2e50f75cefb8864135ae4df7a384b7f1687af085bab7bcccd967aa5a8a4dfd04429921f6138841c080b4975ba1b9e7a9bec53074bbc3b92eabda525636bc56e893f05bbfa6047cdf4658828967148018f92e78f9034d25f09a62715369977b6a615d9f1e183d524a39cd9956abe05fb616be484465af47e6748ea1ebc93e4862c6fa144c0207b81a7cf031d1913a21d51e1db02964d1967f54d79a5ee3c78ab29b671fca5ccf74c94b42d31f9e3e93520453f04babe1b72fa28891d76f6028f42b0e3eec97429ef41b3", @ANYRES32], 0xfd, 0x1512, &(0x7f0000005080)="$eJzs3Au4TtX2MPA55pyLbbfxtpP7HHMs3rQx7SQJJcklSZKQ3BOSdpIkSWxyS25JyHUnuWw75J522u73S+5JO0eSJCEhyfyeXfqczul8zjn//p/z/+/xe571mONda8w1luF93zXX83i/6TaiZpNa1RoSkfh3qN8G8OsfyUKIGCHEICFEXiFEIIQoH18+Pmt/LgXJ/9ZJ2H+TRqlXuwJ2NXH/szfuf/bG/c/euP/ZG/c/e+P+Z2/c/+yN+89YtpZW6Fresu/Gz///h5P/lWT+/s8W4B/t4P7/b6P+paO5/9kb9z974/5nb9z/7Cy42gWwq4zf/9kb95+xbO1Pf6a84dzVfqbN27+wMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhj/x+c85dpIcRv46tdF2OMMcYYY4wxxv48/r2rXQFjjDHGGGOMMcb++4GQQgktApFD5BQxIpeIFdeIOJFb5BF5RURcK+LFdSKfuF7kFwVEQVFIFBZFRFFhBAorSISimCguouIGUULcKBJESVFKlBZOlBGJ4iZRVtwsyolbRHlxq6ggbhMVRaVfzpnlTlFV3CWqibtFdVFD1BS1xD2itrhX1BH3ibriflFPPCDqiwdFA/GQaCgaicbiYdFEPCKaimaiuWghWopWovUV8lPy/lH+i6KneEn0Er1Fsugj+oqXRT/RXwwQA8Ug8YoYLF4VQ8RQMUwMFyPEa2KkeF2MEm+I0WKMGCveFOPEeDFBTBSTxGSRIt4SU8TbYqp455HcYrqYIWaKVDFLpIl3xWwxR8wV74l5Yr5YIFJyLRKLxRLxvlgqPhDp4kOxTHwkMsRysUKsFKvEarFGrBXrxHqxQWwUm8RmsUVsFdvEx2K72CF2il1it9gj9opPxD7xqdgvPhOZ8Pm/mH/29/miOwgQIEGCBg05IAfEQAzEQizEQRzkgTwQgQjEQzzkg3yQH/JDQSgIyVAYikJRQEAgICgGxSAKUSgBJSABEqAUlAIHDhIhEcrCzVAOykF5KA8VoAJUhEpQCW6H26EKVIGqUBWqQTWoDtWhJtSEe+AeuBfqQB2oC3WhHtSD+lAfGkADaAgNoTE0hibQBJpCU2gOzaEltITW0BraQBtoC22hPbSHDtABOkJHSIIk6ASdoDN0hi7QBbpCV+gG3aA7vAAvwIvwIrwEL0FvqC77QF/oC/2gHwyAgTAQXoHB8Cq8CkNhGAyHEfAavAavwyg4A6NhDIyFsVBFjocJMBFIToYUSIGcYgpMhakwDabDdJgJqTAL0iANZsMcmAPvwTyYD/NhISyExbAElsBS+ADSIR2WwVnIgOWwAlbCKlgNq2AtrIO1sAE2wgbYDJthK2yFj+Fj2AE7YBfsgj2wBz6BT+BT+BSGQSZkwgE4AAfhIByCQ3AYDsMROAJH4Sgcg2NwHI7DCTgJp+AknIbTcAbOwjkhxHk4DxfgAlyEi1lvfplFSy1zyBwyRsbIWBkr42SczCPzyIiMyHgZL/PJfDK/zC8LyoKysCwsi8qiEiVKkqEsJovJqIzKErKETJAJspQsJZ10MlEmyrKyrCwny8ny8lZZQd4mK8pKsp27Xd4uq8j2rqq8S1aT1WR1WUPWlLVkLVlb1pZ1ZB1ZV9aV9WQ9WV8+KBvIPjAAGsmszjSRw6GpHAHNZQvZUraSr8Ojso0cBW1lO9lePi7HwGjoKNu4JPmU7CQnQGf5jJwIz8qucjJ0k8/L7vIF2UO+KHvKtq6X7C2nQR/ZV86EfrK/HCAHytlQQ2Z1rKYcKl/MOVyOkK/JxfC6HCXfkKPlGDlWvinHyfFygpwoJ8nJMkW+JafIt+VU+Y6cJqfLGXKmTJWzZJp8V86Wc+Rc+Z6cJ+fLBXKhXCQXyyXyfblUfiDT5YdymfxIZsjlcoVcKVfJ1XKNXCvXyfVyg9woN8nNcovcKrfJj+V2uUPulLvkbrlH7pWfyH3yU7lffiYz5efygPyLPCi/kIfkl/Kw/EoekV/Lo/IbeUx+K4/L7+QJeVKekt/L0/IHeUaelefkj/K8/ElekD/Li9JLoUBJpZRWgcqhcqoYlUvFqmtUnMqt8qi8KqKuVfHqOpVPXa/yqwKqoC6kCqsiqqgyCpVVpEJVTBVXUXWDKqFuVAmqpCqlSiunyqhEdZMqq25W5dQtqry6VVVQt6mKqpKq7IW6Q1VRd6qq6i5VTd2tqqsaqqaqpe5RtdW9qo66T9VV96t66gFVXz2oGqiHVEPVSDVWD6sm6hHVVDVTzVUL1VK1Uq3Vo6qNeky1Ve1Ue/W46qCeUB3VkypJPaU6qadVZ/WM6qKeVV3Vc6qbel51Vy+oHupndVF51Uv1Vsmqj+qrXlb9VH81QA1Ug9QrarB6VQ1RQ9UwNVyNUK+pkep1NUq9oUarMWqselONU+PVBDVRTVKTVYp6S01Rb6up6h01TU1XM9RMlapmqQGXZpr7T+S//Qf5Q345+1a1TX2stqsdaqfapXarPWqv2qv2qX1qv9qvMlWmOqAOqIPqoDqkDqnD6rA6oo6oo+qoOqaOqePquDqhTqof1ffqtPpBnVFn1Vn1ozqvzqsLl/4OhAYttdJaBzqHzqljdC4dq6/RcTq3zqPz6oi+Vsfr63Q+fb3OrwvogrqQLqyL6KLaaNRWkw51MV1cR/UNuoS+USfokrqULq2dLqMT9U3/5fwr1ddat9ZtdBvdVrfV7XV73UF30B11R52kk3Qn3Ul31p11F91Fd9VddTfdTXfX3XUP3UP31D11L91LJ+tk3Ve/rPvp/nqAHqgH6Vf0YD1YD9FD9DA9TI/QI/RIPVKP0qP0aD1aj9Vj9Tg9Tk/QE/QkPUmn+Lx6ip6ip+qpepqepmcMyqtTdapO02l6tp6t5+q5ep6epxfoBXqRXqSX6CV6qV6q03W6XqaX6Qy9XC/XK/VKvVqv1mv1Wr1er9cb9Ua9WW/WGXqb3qa36+16p96pd+vdeq/eq/fpfXq/3q8zdaY+oA/og/qgPqQP6cP6sD6ij+ij+qg+po/p4/q4PqFP6FP6lD6tT+sz+ow+p8/p8/q8vqAv6Iv6YtZtXyADGehABzmCHEFMEBPEBrFBXBAX5AnyBJEgEsQH8UG+4Pogf1AgKBgUCgoHRYKigQkwsAEFYVAsKB5EgxuCEsGNQUJQMigVlA5cUCZIDG4KygY3B+WCW4Lywa1BheC2oGJQKagc3B7cEVQJ7gyqBncF1YK7g+pBjaBmUCu4J6gd3BvUCe4L6gb3B/WCB4L6wYNBg+ChoGHQKGgcPBw0CR4JmgbNguZBi6Bl0Cpo/afO7/2ZAo+5Xqa3STZ9TF/zsuln+psBZqAZZF4xg82rZogZaoaZ4WaEec2MNK+bUeYNM9qMMWPNm2acGW8mmIlmkplsUsxbZop520w175hpZrqZEcw0qWaWSTPvmtlmjplr3jPzzHyzwCw0i8xiA7/eEot086FZZj4yGWa5WWFWmlVmtVlj1pp1Zr3ZYDaaTWZz+cG/Hmq2mx1mp9lldps9Zq/5xOwzn5r95jOTaT43B8xfzEHzhTlkvjSHzVfmiPnaHDXfmGPmW3PcfGdOmJPmlPnenDY/mDPmrDlnfjTnzU/mgvnZXDQ+6+Y+6+sdNWrMgTkwBmMwFmMxDuMwD+bBCEYwHuMxH+bD/JgfC2JBLIyFsSgWxSyEhMWwGEYxiiWwBCZgApbCUujQYSImYlksi+WwHJbH8lgBK2BFrIiVsTLegXfgnXgn3oV34d14N9bAGlgLa2FtrI11sA7WxbpYD+thfayPDbABNsSG2BgbYxNsgk2xKTbH5tgSW2JrbI1tsA22xbbYHttjB+yAHbEjJmESdsJO2Bk7Yxfsgl2xK3bDbtgdu2MP7IE9sSf2wl6YjMnYF/tiP+yHA3AADsJBOBgH4xAcgsNwGI7AETgSR+IoHIWjcQyOxTdxHI7HCTgRJ+FkTMEUnIJTcCpOxWk4DWfgDEzFVEzDNJyNs3EuzsV5OA8X4AJchItwCS7BpbgU0zEdl+EyzMAMXIErcBWuwjW4BtfhOtyAG3ATbsItuAW34TbcjttxJ+7E3bgb9+Je3If7cD/ux0zMxAN4AA/iQTyEh/AwHsYjeASP4lE8hsfwOB7HE3gCT+EpPI2n8QyewXN4Ds/jT3gBf8aL6DHG5rKx9hobZ3PbPDav/du4oC1kC9sitqg1Nr8t8LsYrbUJtqQtZUtbZ8vYRHvTL7HJ+es/3Ky4oq1kK9vb7R22ir3TVrUVbS7x13Fte6+tY++zde39tpa953dxPfuArW8fsQ1sM9vQtrCNbSvbxD5im9pmtrltYVvaVraDfcJ2tE/aJPuU7WSf/rt4qf3ArrPr7Qa70e6zn9pz9kd71H5jz9ufbC/b2w6yr9jB9lU7xA61w+zw38dC2LH2TTvOjrcT7EQ7yU7+u3iGnWlT7SybZt+1s+2cv4uX2PftPJtuF9iFdpFd/EucVVO6/dAusx/ZDLvcrrAr7Sq72q6xa/9vrSvtZrvFbrV77Sd2u91hd9pddrfd80ucdR377Wc2035uj9iv7UH7hT1kj9nD9qtf4qzrO2a/tcftd/aEPWlP2e/tafuDPWPP/nL9Wdf+vf3ZXrTeCgKSpEhTQDkoJ8VQLoqlayiOclMeyksRupbi6TrKR9dTfipABakQFaYiVJQMIVkiCqkYFaco3UAl6EZKoJJUikqTozKUSDdRWbqZytEtVJ5upQp0G1WkSlSZbqc7qArdSVXpLqpGd1N1qkE1qRbdQ7XpXqpD91Fdup/q0QNUnx6kBvQQNaRG1Jgepib0CDWlZtScWlBLakWt6VFqQ49RW2pH7elx6kBPUEd6kpLoKepET1Nneoa60LPUlZ6jbvQ8dacXqAe9SD3pJepFvSmZ+lBfepn6UX8aQANpEL1Cg+lVGkJDaRgNpxH0Go2k12kUvUGjaQyNpTdpHI2nCTSRJtFkSqG3aAq9TVPpHZpG02kGzaRUmkVp9C7Npjk0l96jeTSfFtBCWkSLaQm9T0vpA0qnD2kZfUQZtJxW0EpaRatpDa2ldbSeNtBG2kSbaQttpW30MW2nHbSTdtFu2kN76RPaR5/SfvqMMulzOkB/oYP0BR2iL+kwfUVH6Gs6St/QMfqWjtN3dIJO0in6nk7TD3SGztI5+pHO0090gX6mi+RJhBDKUIU6DMIcYc4wJswVxobXhHFh7jBPmDeMhNeG8eF1Yb7w+jB/WCAsGBYKC4dFwqKhCTG0IYVhWCwsHkbDG8IS4Y1hQlgyLBWWDl1YJkwMbwrLhjeH5cJbwvLhrWGF8LawYlgprBzeHt4RVgnvDKuGd4XVwrvD6mGNsGZYK7wnrB3eG9YJ7wvrhveH5cIHwvrhg2GD8KGwYdgobBw+HDYJHwmbhs3C5mGLsGXYKmwdPhq2CR8L24btwvbh42GH8ImwY/hkmBQ+FXYKn768v2Tw64fS3+xPDvuE6tITsvvUouji6JLo+9Gl0Q+i6dEPo8uiH0UzosujK6Iro6uiq6Nromuj66LroxuiG6ObopujW6Jbo97XyikcZC2EhXaBy+FyuhiXy8W6a1ycy+3yuLwu4q518e46l89d7/K7Aq6gK+QKuyKuqDMOnXXkQlfMFXdRd4Mr4W50Ca6kK+VKO+fKuETXyrV2rV0b95hr69q59u5x97h7wj3hnoy5VLjr7J5xXdyzrqt7zj3nnnfd3Quuh3vR9XQvuV6ut0t2ya6v6+v6uX5ugBvgBrlBbrAb7Ia4IW6YG+ZGuBFupBvpRrlRbrQb7ca6sW6cG+cmuAlukpvkUlyKm+KmuKluqpvmprkZboZLdakuzaW52W62m+vmunlunlvgFrhFbpFb4pa4pW6pS3fpbplb5jJchlvhVrhVbpVb49a4dW6d2wDCbXKb3Ba3xW1z29x2t93tdDvdbrfb7XV73T63z+13+12my3QH3AF30B10h9yX7rD7yh1xX7uj7ht3zH3rjrvv3Al30p1yXp12P7gz7qw75350591P7oL72V103qVE3opMibwdmRp5JzItMj0yIzIzkhqZFUmLvBuZHZkTmRt5LzIvMj+yILIwsiiyOLIk8n5kaeSDSHrkw8iyyEeRjMjyyIrIysiqyOqI90W2h76YL+6j/gZfwt/oE3xJX8qX9s6X8Yn+Jl/W3+zL+Vt8eX+rr+Bv8xV9JV/ZN/PNfQvf0rfyrf2jvo1/zLf17Xx7/7jv4J/wHf2TPsk/5Tv5p31n/4zv4p/1Xf1zvpt/fv6lLvue/iXfy/f2yb6P7+tf9v18fz/AD/SD/Ct+sH/VD/FD/TA/3I/wr/mR/nU/yr/hR/sxfqx/04/z4/0EP9FP8pN9in/LT/Fv+6n+HT/NT/cz/Eyf6mf5NP+un+3n+Ln+PT/Pz/cL/EK/yC/2S/z7fqn/wKf7D/0y/5HP8Mv9Cr/Sr/Kr/Rq/1q/z6/0Gv9Fv8pv9Fr/Vb/Mf++1+h9/pd/ndfo/f6z/x+/ynfr//zGf6z/0B/xd/0H/hD/kv/WH/lT/iv/ZH/Tf+mP/WH/ff+RP+pD/lv/en/Q/+jD/rz/kf/Xn/k7/gf/YX+f+sMcYYY4z9U9QV9vf5g9fkpS1LXyFE7h2FDv/tnJvy/zruL/d1uvTYRzzVu1ujrK1Ro+Tk5EuvZSgRFF8ohIhczv/l9wcuxctFe/GESBLtRNk/rK+/rOz/eu4/mj96qxCxQuT6LSdreRQr/nb+m//B/M3epyvNv1CIhOKXc7JO9Ft8ef5y/2D+PR2uMH+uL1KEaPtXOXHicnx5/kTxmHhaJP3uSMYYY4wxxhhj7Ff95fnuV1rfZq3PC+vLOVnr+d/iK63Pr6Dqn3ENjDHGGGOMMcYY+3979oUeTz6alNSuy//4wdB/vCvnf0aF/wEDEEL8B5TBg//8wdX+ZGKMMcYYY4z92S7f9F/tShhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMsezr3/+FMPlPH3y1r5ExxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhi72v5PAAAA//+pllJE") ioctl$TIOCMGET(r2, 0x5415, &(0x7f0000001340)) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r0, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r1, 0x4, 0x70bd29, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20008004}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-setsockopt$inet6_IPV6_HOPOPTS-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_open_dev$hiddev-ppoll-syz_usb_disconnect detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0b000000080000000c0000000300000001"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r0}, 0x38) setsockopt$inet6_IPV6_HOPOPTS(0xffffffffffffffff, 0x29, 0x36, &(0x7f0000000300)=ANY=[@ANYBLOB='<'], 0x1b0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000207d1e5a2d00000000000109022400010000000009040000010300000009210000000122080009058103"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000100)={0x24, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="002208000000a20100c3"], 0x0}, 0x0) r2 = syz_open_dev$hiddev(&(0x7f0000000000), 0x0, 0x880) ppoll(&(0x7f0000000080)=[{r2, 0x8000}, {r2, 0x9}, {r2, 0x3100}, {r2, 0x4103}], 0x4, &(0x7f0000000140)={0x77359400}, &(0x7f0000000180), 0x8) syz_usb_disconnect(r1) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-mmap-madvise-openat$tun-prlimit64-socket-listen-recvmsg-sched_setaffinity-sched_setscheduler-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-socket$inet6-ioctl$XFS_IOC_FREE_EOFBLOCKS-ioctl$XFS_IOC_PATH_TO_FSHANDLE-ioctl$BTRFS_IOC_SCRUB_PROGRESS-unshare-setsockopt$IP6T_SO_SET_REPLACE-socket$inet6_tcp-sendmsg$WG_CMD_SET_DEVICE-mprotect-setsockopt$IP6T_SO_SET_REPLACE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) mmap(&(0x7f00009a6000/0x1000)=nil, 0x1000, 0xa, 0x30, r0, 0xc51dd000) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x450000, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r2 = socket(0x1e, 0x1, 0x0) listen(r2, 0x3) recvmsg(r2, &(0x7f00000023c0)={0x0, 0x0, &(0x7f0000002300)=[{&(0x7f0000000080)=""/101, 0x65}], 0x1}, 0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6(0xa, 0x3, 0x7) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, &(0x7f0000000b00)={0x7, 0x9, 0x1cfb, 0xaee, 0x1000, 0x0, 0x8}) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, &(0x7f00000006c0)={r4, &(0x7f00000005c0)='macvtap0\x00', 0x10000, &(0x7f0000000600)={@align=0x5, {0x6, 0x4, 0x0, 0x470}}, 0x6, &(0x7f0000000640), &(0x7f0000000680)}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r5, 0xc400941d, &(0x7f0000000700)={0x0, 0x5, 0x7fffffff, 0x1}) unshare(0x42000000) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8000000, 0x3, 0x2c8, 0x0, 0xffffffff, 0xffffffff, 0x110, 0xffffffff, 0x228, 0xffffffff, 0xffffffff, 0x228, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @private1, [0xff000000, 0xffffff00, 0x6dc8f3d6512d1aed, 0xffffffff], [0xff, 0xff000000, 0xff000000], 'bond_slave_0\x00', 'batadv0\x00', {}, {}, 0x84, 0x2, 0x3, 0xe}, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, '\x00', 'syz1\x00'}}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0x17}, @loopback, [], [], 'veth1\x00', 'wlan1\x00', {}, {0x1fe}}, 0x0, 0xa8, 0xe8}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "4199fc6505f93cb13d0617f57700e5dba5afc775234fe52cca718b1ef125"}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x328) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$WG_CMD_SET_DEVICE(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x800) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x64, 0x6, 0x510, 0x2e0, 0xd0, 0x2e0, 0xd0, 0xd0, 0x5a0, 0x5a0, 0x5a0, 0x5a0, 0x5a0, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x5}}}, {{@ipv6={@mcast1, @local, [], [], 'macvtap0\x00', 'ip6tnl0\x00', {}, {}, 0x11}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@broadcast}}}, {{@ipv6={@mcast2, @loopback, [], [], 'veth0_to_team\x00', 'syzkaller0\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@MARK={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @inet=@DSCP={0x28}}, {{@uncond, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv4=@dev}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x570) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session single: successfully extracted reproducer found reproducer with 26 syscalls minimizing guilty program testing program (duration=34.415969647s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-mmap-madvise-openat$tun-prlimit64-socket-listen-recvmsg-sched_setaffinity-sched_setscheduler-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-socket$inet6-ioctl$XFS_IOC_FREE_EOFBLOCKS-ioctl$XFS_IOC_PATH_TO_FSHANDLE-ioctl$BTRFS_IOC_SCRUB_PROGRESS-unshare-setsockopt$IP6T_SO_SET_REPLACE-socket$inet6_tcp-sendmsg$WG_CMD_SET_DEVICE-mprotect detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) mmap(&(0x7f00009a6000/0x1000)=nil, 0x1000, 0xa, 0x30, r0, 0xc51dd000) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x450000, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r2 = socket(0x1e, 0x1, 0x0) listen(r2, 0x3) recvmsg(r2, &(0x7f00000023c0)={0x0, 0x0, &(0x7f0000002300)=[{&(0x7f0000000080)=""/101, 0x65}], 0x1}, 0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6(0xa, 0x3, 0x7) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, &(0x7f0000000b00)={0x7, 0x9, 0x1cfb, 0xaee, 0x1000, 0x0, 0x8}) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, &(0x7f00000006c0)={r4, &(0x7f00000005c0)='macvtap0\x00', 0x10000, &(0x7f0000000600)={@align=0x5, {0x6, 0x4, 0x0, 0x470}}, 0x6, &(0x7f0000000640), &(0x7f0000000680)}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r5, 0xc400941d, &(0x7f0000000700)={0x0, 0x5, 0x7fffffff, 0x1}) unshare(0x42000000) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8000000, 0x3, 0x2c8, 0x0, 0xffffffff, 0xffffffff, 0x110, 0xffffffff, 0x228, 0xffffffff, 0xffffffff, 0x228, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @private1, [0xff000000, 0xffffff00, 0x6dc8f3d6512d1aed, 0xffffffff], [0xff, 0xff000000, 0xff000000], 'bond_slave_0\x00', 'batadv0\x00', {}, {}, 0x84, 0x2, 0x3, 0xe}, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, '\x00', 'syz1\x00'}}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0x17}, @loopback, [], [], 'veth1\x00', 'wlan1\x00', {}, {0x1fe}}, 0x0, 0xa8, 0xe8}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "4199fc6505f93cb13d0617f57700e5dba5afc775234fe52cca718b1ef125"}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x328) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$WG_CMD_SET_DEVICE(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x800) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=34.415969647s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-mmap-madvise-openat$tun-prlimit64-socket-listen-recvmsg-sched_setaffinity-sched_setscheduler-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-socket$inet6-ioctl$XFS_IOC_FREE_EOFBLOCKS-ioctl$XFS_IOC_PATH_TO_FSHANDLE-ioctl$BTRFS_IOC_SCRUB_PROGRESS-unshare-setsockopt$IP6T_SO_SET_REPLACE-socket$inet6_tcp-sendmsg$WG_CMD_SET_DEVICE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) mmap(&(0x7f00009a6000/0x1000)=nil, 0x1000, 0xa, 0x30, r0, 0xc51dd000) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x450000, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r2 = socket(0x1e, 0x1, 0x0) listen(r2, 0x3) recvmsg(r2, &(0x7f00000023c0)={0x0, 0x0, &(0x7f0000002300)=[{&(0x7f0000000080)=""/101, 0x65}], 0x1}, 0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6(0xa, 0x3, 0x7) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, &(0x7f0000000b00)={0x7, 0x9, 0x1cfb, 0xaee, 0x1000, 0x0, 0x8}) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, &(0x7f00000006c0)={r4, &(0x7f00000005c0)='macvtap0\x00', 0x10000, &(0x7f0000000600)={@align=0x5, {0x6, 0x4, 0x0, 0x470}}, 0x6, &(0x7f0000000640), &(0x7f0000000680)}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r5, 0xc400941d, &(0x7f0000000700)={0x0, 0x5, 0x7fffffff, 0x1}) unshare(0x42000000) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8000000, 0x3, 0x2c8, 0x0, 0xffffffff, 0xffffffff, 0x110, 0xffffffff, 0x228, 0xffffffff, 0xffffffff, 0x228, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @private1, [0xff000000, 0xffffff00, 0x6dc8f3d6512d1aed, 0xffffffff], [0xff, 0xff000000, 0xff000000], 'bond_slave_0\x00', 'batadv0\x00', {}, {}, 0x84, 0x2, 0x3, 0xe}, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, '\x00', 'syz1\x00'}}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0x17}, @loopback, [], [], 'veth1\x00', 'wlan1\x00', {}, {0x1fe}}, 0x0, 0xa8, 0xe8}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "4199fc6505f93cb13d0617f57700e5dba5afc775234fe52cca718b1ef125"}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x328) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$WG_CMD_SET_DEVICE(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x800) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=34.415969647s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-mmap-madvise-openat$tun-prlimit64-socket-listen-recvmsg-sched_setaffinity-sched_setscheduler-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-socket$inet6-ioctl$XFS_IOC_FREE_EOFBLOCKS-ioctl$XFS_IOC_PATH_TO_FSHANDLE-ioctl$BTRFS_IOC_SCRUB_PROGRESS-unshare-setsockopt$IP6T_SO_SET_REPLACE-socket$inet6_tcp detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) mmap(&(0x7f00009a6000/0x1000)=nil, 0x1000, 0xa, 0x30, r0, 0xc51dd000) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x450000, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r2 = socket(0x1e, 0x1, 0x0) listen(r2, 0x3) recvmsg(r2, &(0x7f00000023c0)={0x0, 0x0, &(0x7f0000002300)=[{&(0x7f0000000080)=""/101, 0x65}], 0x1}, 0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6(0xa, 0x3, 0x7) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, &(0x7f0000000b00)={0x7, 0x9, 0x1cfb, 0xaee, 0x1000, 0x0, 0x8}) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, &(0x7f00000006c0)={r4, &(0x7f00000005c0)='macvtap0\x00', 0x10000, &(0x7f0000000600)={@align=0x5, {0x6, 0x4, 0x0, 0x470}}, 0x6, &(0x7f0000000640), &(0x7f0000000680)}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r5, 0xc400941d, &(0x7f0000000700)={0x0, 0x5, 0x7fffffff, 0x1}) unshare(0x42000000) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8000000, 0x3, 0x2c8, 0x0, 0xffffffff, 0xffffffff, 0x110, 0xffffffff, 0x228, 0xffffffff, 0xffffffff, 0x228, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @private1, [0xff000000, 0xffffff00, 0x6dc8f3d6512d1aed, 0xffffffff], [0xff, 0xff000000, 0xff000000], 'bond_slave_0\x00', 'batadv0\x00', {}, {}, 0x84, 0x2, 0x3, 0xe}, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, '\x00', 'syz1\x00'}}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0x17}, @loopback, [], [], 'veth1\x00', 'wlan1\x00', {}, {0x1fe}}, 0x0, 0xa8, 0xe8}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "4199fc6505f93cb13d0617f57700e5dba5afc775234fe52cca718b1ef125"}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x328) socket$inet6_tcp(0xa, 0x1, 0x0) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=34.415969647s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-mmap-madvise-openat$tun-prlimit64-socket-listen-recvmsg-sched_setaffinity-sched_setscheduler-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-socket$inet6-ioctl$XFS_IOC_FREE_EOFBLOCKS-ioctl$XFS_IOC_PATH_TO_FSHANDLE-ioctl$BTRFS_IOC_SCRUB_PROGRESS-unshare-setsockopt$IP6T_SO_SET_REPLACE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) mmap(&(0x7f00009a6000/0x1000)=nil, 0x1000, 0xa, 0x30, r0, 0xc51dd000) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x450000, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r2 = socket(0x1e, 0x1, 0x0) listen(r2, 0x3) recvmsg(r2, &(0x7f00000023c0)={0x0, 0x0, &(0x7f0000002300)=[{&(0x7f0000000080)=""/101, 0x65}], 0x1}, 0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6(0xa, 0x3, 0x7) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, &(0x7f0000000b00)={0x7, 0x9, 0x1cfb, 0xaee, 0x1000, 0x0, 0x8}) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, &(0x7f00000006c0)={r4, &(0x7f00000005c0)='macvtap0\x00', 0x10000, &(0x7f0000000600)={@align=0x5, {0x6, 0x4, 0x0, 0x470}}, 0x6, &(0x7f0000000640), &(0x7f0000000680)}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r5, 0xc400941d, &(0x7f0000000700)={0x0, 0x5, 0x7fffffff, 0x1}) unshare(0x42000000) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8000000, 0x3, 0x2c8, 0x0, 0xffffffff, 0xffffffff, 0x110, 0xffffffff, 0x228, 0xffffffff, 0xffffffff, 0x228, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @private1, [0xff000000, 0xffffff00, 0x6dc8f3d6512d1aed, 0xffffffff], [0xff, 0xff000000, 0xff000000], 'bond_slave_0\x00', 'batadv0\x00', {}, {}, 0x84, 0x2, 0x3, 0xe}, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, '\x00', 'syz1\x00'}}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0x17}, @loopback, [], [], 'veth1\x00', 'wlan1\x00', {}, {0x1fe}}, 0x0, 0xa8, 0xe8}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "4199fc6505f93cb13d0617f57700e5dba5afc775234fe52cca718b1ef125"}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x328) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=34.415969647s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-mmap-madvise-openat$tun-prlimit64-socket-listen-recvmsg-sched_setaffinity-sched_setscheduler-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-socket$inet6-ioctl$XFS_IOC_FREE_EOFBLOCKS-ioctl$XFS_IOC_PATH_TO_FSHANDLE-ioctl$BTRFS_IOC_SCRUB_PROGRESS-unshare detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) mmap(&(0x7f00009a6000/0x1000)=nil, 0x1000, 0xa, 0x30, r0, 0xc51dd000) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x450000, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r2 = socket(0x1e, 0x1, 0x0) listen(r2, 0x3) recvmsg(r2, &(0x7f00000023c0)={0x0, 0x0, &(0x7f0000002300)=[{&(0x7f0000000080)=""/101, 0x65}], 0x1}, 0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6(0xa, 0x3, 0x7) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, &(0x7f0000000b00)={0x7, 0x9, 0x1cfb, 0xaee, 0x1000, 0x0, 0x8}) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, &(0x7f00000006c0)={r4, &(0x7f00000005c0)='macvtap0\x00', 0x10000, &(0x7f0000000600)={@align=0x5, {0x6, 0x4, 0x0, 0x470}}, 0x6, &(0x7f0000000640), &(0x7f0000000680)}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r5, 0xc400941d, &(0x7f0000000700)={0x0, 0x5, 0x7fffffff, 0x1}) unshare(0x42000000) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=34.415969647s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-mmap-madvise-openat$tun-prlimit64-socket-listen-recvmsg-sched_setaffinity-sched_setscheduler-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-socket$inet6-ioctl$XFS_IOC_FREE_EOFBLOCKS-ioctl$XFS_IOC_PATH_TO_FSHANDLE-ioctl$BTRFS_IOC_SCRUB_PROGRESS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) mmap(&(0x7f00009a6000/0x1000)=nil, 0x1000, 0xa, 0x30, r0, 0xc51dd000) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x450000, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r2 = socket(0x1e, 0x1, 0x0) listen(r2, 0x3) recvmsg(r2, &(0x7f00000023c0)={0x0, 0x0, &(0x7f0000002300)=[{&(0x7f0000000080)=""/101, 0x65}], 0x1}, 0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6(0xa, 0x3, 0x7) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, &(0x7f0000000b00)={0x7, 0x9, 0x1cfb, 0xaee, 0x1000, 0x0, 0x8}) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, &(0x7f00000006c0)={r4, &(0x7f00000005c0)='macvtap0\x00', 0x10000, &(0x7f0000000600)={@align=0x5, {0x6, 0x4, 0x0, 0x470}}, 0x6, &(0x7f0000000640), &(0x7f0000000680)}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r5, 0xc400941d, &(0x7f0000000700)={0x0, 0x5, 0x7fffffff, 0x1}) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=34.415969647s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-mmap-madvise-openat$tun-prlimit64-socket-listen-recvmsg-sched_setaffinity-sched_setscheduler-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-socket$inet6-ioctl$XFS_IOC_FREE_EOFBLOCKS-ioctl$XFS_IOC_PATH_TO_FSHANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) mmap(&(0x7f00009a6000/0x1000)=nil, 0x1000, 0xa, 0x30, r0, 0xc51dd000) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x450000, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r2 = socket(0x1e, 0x1, 0x0) listen(r2, 0x3) recvmsg(r2, &(0x7f00000023c0)={0x0, 0x0, &(0x7f0000002300)=[{&(0x7f0000000080)=""/101, 0x65}], 0x1}, 0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6(0xa, 0x3, 0x7) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, &(0x7f0000000b00)={0x7, 0x9, 0x1cfb, 0xaee, 0x1000, 0x0, 0x8}) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, &(0x7f00000006c0)={r4, &(0x7f00000005c0)='macvtap0\x00', 0x10000, &(0x7f0000000600)={@align=0x5, {0x6, 0x4, 0x0, 0x470}}, 0x6, &(0x7f0000000640), &(0x7f0000000680)}) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=34.415969647s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-mmap-madvise-openat$tun-prlimit64-socket-listen-recvmsg-sched_setaffinity-sched_setscheduler-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-socket$inet6-ioctl$XFS_IOC_FREE_EOFBLOCKS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) mmap(&(0x7f00009a6000/0x1000)=nil, 0x1000, 0xa, 0x30, r0, 0xc51dd000) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x450000, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r2 = socket(0x1e, 0x1, 0x0) listen(r2, 0x3) recvmsg(r2, &(0x7f00000023c0)={0x0, 0x0, &(0x7f0000002300)=[{&(0x7f0000000080)=""/101, 0x65}], 0x1}, 0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6(0xa, 0x3, 0x7) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, &(0x7f0000000b00)={0x7, 0x9, 0x1cfb, 0xaee, 0x1000, 0x0, 0x8}) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=34.415969647s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-mmap-madvise-openat$tun-prlimit64-socket-listen-recvmsg-sched_setaffinity-sched_setscheduler-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-socket$inet6 detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) mmap(&(0x7f00009a6000/0x1000)=nil, 0x1000, 0xa, 0x30, r0, 0xc51dd000) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x450000, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r2 = socket(0x1e, 0x1, 0x0) listen(r2, 0x3) recvmsg(r2, &(0x7f00000023c0)={0x0, 0x0, &(0x7f0000002300)=[{&(0x7f0000000080)=""/101, 0x65}], 0x1}, 0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6(0xa, 0x3, 0x7) program did not crash testing program (duration=34.415969647s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-mmap-madvise-openat$tun-prlimit64-socket-listen-recvmsg-sched_setaffinity-sched_setscheduler-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-ioctl$XFS_IOC_FREE_EOFBLOCKS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) mmap(&(0x7f00009a6000/0x1000)=nil, 0x1000, 0xa, 0x30, r0, 0xc51dd000) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x450000, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r2 = socket(0x1e, 0x1, 0x0) listen(r2, 0x3) recvmsg(r2, &(0x7f00000023c0)={0x0, 0x0, &(0x7f0000002300)=[{&(0x7f0000000080)=""/101, 0x65}], 0x1}, 0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, &(0x7f0000000b00)={0x7, 0x9, 0x1cfb, 0xaee, 0x1000, 0x0, 0x8}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=34.415969647s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-mmap-madvise-openat$tun-prlimit64-socket-listen-recvmsg-sched_setaffinity-sched_setscheduler-socketpair$unix-connect$unix-sendmmsg$unix-ioctl$XFS_IOC_FREE_EOFBLOCKS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) mmap(&(0x7f00009a6000/0x1000)=nil, 0x1000, 0xa, 0x30, r0, 0xc51dd000) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x450000, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r2 = socket(0x1e, 0x1, 0x0) listen(r2, 0x3) recvmsg(r2, &(0x7f00000023c0)={0x0, 0x0, &(0x7f0000002300)=[{&(0x7f0000000080)=""/101, 0x65}], 0x1}, 0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, &(0x7f0000000b00)={0x7, 0x9, 0x1cfb, 0xaee, 0x1000, 0x0, 0x8}) program crashed: KASAN: use-after-free Read in rcu_cblist_dequeue testing program (duration=34.415969647s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-mmap-madvise-openat$tun-prlimit64-socket-listen-recvmsg-sched_setaffinity-sched_setscheduler-socketpair$unix-connect$unix-ioctl$XFS_IOC_FREE_EOFBLOCKS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) mmap(&(0x7f00009a6000/0x1000)=nil, 0x1000, 0xa, 0x30, r0, 0xc51dd000) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x450000, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r2 = socket(0x1e, 0x1, 0x0) listen(r2, 0x3) recvmsg(r2, &(0x7f00000023c0)={0x0, 0x0, &(0x7f0000002300)=[{&(0x7f0000000080)=""/101, 0x65}], 0x1}, 0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, &(0x7f0000000b00)={0x7, 0x9, 0x1cfb, 0xaee, 0x1000, 0x0, 0x8}) program crashed: KASAN: use-after-free Read in rcu_cblist_dequeue testing program (duration=34.415969647s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-mmap-madvise-openat$tun-prlimit64-socket-listen-recvmsg-sched_setaffinity-sched_setscheduler-socketpair$unix-ioctl$XFS_IOC_FREE_EOFBLOCKS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) mmap(&(0x7f00009a6000/0x1000)=nil, 0x1000, 0xa, 0x30, r0, 0xc51dd000) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x450000, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r2 = socket(0x1e, 0x1, 0x0) listen(r2, 0x3) recvmsg(r2, &(0x7f00000023c0)={0x0, 0x0, &(0x7f0000002300)=[{&(0x7f0000000080)=""/101, 0x65}], 0x1}, 0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, &(0x7f0000000b00)={0x7, 0x9, 0x1cfb, 0xaee, 0x1000, 0x0, 0x8}) program crashed: KASAN: use-after-free Read in rcu_cblist_dequeue testing program (duration=34.415969647s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-mmap-madvise-openat$tun-prlimit64-socket-listen-recvmsg-sched_setaffinity-sched_setscheduler-ioctl$XFS_IOC_FREE_EOFBLOCKS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) mmap(&(0x7f00009a6000/0x1000)=nil, 0x1000, 0xa, 0x30, r0, 0xc51dd000) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x450000, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r2 = socket(0x1e, 0x1, 0x0) listen(r2, 0x3) recvmsg(r2, &(0x7f00000023c0)={0x0, 0x0, &(0x7f0000002300)=[{&(0x7f0000000080)=""/101, 0x65}], 0x1}, 0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, &(0x7f0000000b00)={0x7, 0x9, 0x1cfb, 0xaee, 0x1000, 0x0, 0x8}) program crashed: KASAN: use-after-free Write in rcu_segcblist_enqueue testing program (duration=34.415969647s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-mmap-madvise-openat$tun-prlimit64-socket-listen-recvmsg-sched_setaffinity-ioctl$XFS_IOC_FREE_EOFBLOCKS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) mmap(&(0x7f00009a6000/0x1000)=nil, 0x1000, 0xa, 0x30, r0, 0xc51dd000) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x450000, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r2 = socket(0x1e, 0x1, 0x0) listen(r2, 0x3) recvmsg(r2, &(0x7f00000023c0)={0x0, 0x0, &(0x7f0000002300)=[{&(0x7f0000000080)=""/101, 0x65}], 0x1}, 0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, &(0x7f0000000b00)={0x7, 0x9, 0x1cfb, 0xaee, 0x1000, 0x0, 0x8}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=34.415969647s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-mmap-madvise-openat$tun-prlimit64-socket-listen-recvmsg-ioctl$XFS_IOC_FREE_EOFBLOCKS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) mmap(&(0x7f00009a6000/0x1000)=nil, 0x1000, 0xa, 0x30, r0, 0xc51dd000) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x450000, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r2 = socket(0x1e, 0x1, 0x0) listen(r2, 0x3) recvmsg(r2, &(0x7f00000023c0)={0x0, 0x0, &(0x7f0000002300)=[{&(0x7f0000000080)=""/101, 0x65}], 0x1}, 0x2) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, &(0x7f0000000b00)={0x7, 0x9, 0x1cfb, 0xaee, 0x1000, 0x0, 0x8}) program crashed: KASAN: use-after-free Write in rcu_segcblist_enqueue testing program (duration=34.415969647s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-mmap-madvise-openat$tun-prlimit64-socket-listen-ioctl$XFS_IOC_FREE_EOFBLOCKS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) mmap(&(0x7f00009a6000/0x1000)=nil, 0x1000, 0xa, 0x30, r0, 0xc51dd000) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x450000, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r2 = socket(0x1e, 0x1, 0x0) listen(r2, 0x3) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, &(0x7f0000000b00)={0x7, 0x9, 0x1cfb, 0xaee, 0x1000, 0x0, 0x8}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=34.415969647s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-mmap-madvise-openat$tun-prlimit64-socket-ioctl$XFS_IOC_FREE_EOFBLOCKS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) mmap(&(0x7f00009a6000/0x1000)=nil, 0x1000, 0xa, 0x30, r0, 0xc51dd000) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x450000, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) socket(0x1e, 0x1, 0x0) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, &(0x7f0000000b00)={0x7, 0x9, 0x1cfb, 0xaee, 0x1000, 0x0, 0x8}) program crashed: KASAN: use-after-free Read in rcu_cblist_dequeue testing program (duration=34.415969647s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-mmap-madvise-openat$tun-prlimit64-ioctl$XFS_IOC_FREE_EOFBLOCKS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) mmap(&(0x7f00009a6000/0x1000)=nil, 0x1000, 0xa, 0x30, r0, 0xc51dd000) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x450000, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, &(0x7f0000000b00)={0x7, 0x9, 0x1cfb, 0xaee, 0x1000, 0x0, 0x8}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=34.415969647s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-mmap-madvise-openat$tun-ioctl$XFS_IOC_FREE_EOFBLOCKS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) mmap(&(0x7f00009a6000/0x1000)=nil, 0x1000, 0xa, 0x30, r0, 0xc51dd000) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x450000, 0x0) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, &(0x7f0000000b00)={0x7, 0x9, 0x1cfb, 0xaee, 0x1000, 0x0, 0x8}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=34.415969647s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-mmap-madvise-ioctl$XFS_IOC_FREE_EOFBLOCKS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) mmap(&(0x7f00009a6000/0x1000)=nil, 0x1000, 0xa, 0x30, r0, 0xc51dd000) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, &(0x7f0000000b00)={0x7, 0x9, 0x1cfb, 0xaee, 0x1000, 0x0, 0x8}) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=34.415969647s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-mmap-ioctl$XFS_IOC_FREE_EOFBLOCKS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) mmap(&(0x7f00009a6000/0x1000)=nil, 0x1000, 0xa, 0x30, r0, 0xc51dd000) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, &(0x7f0000000b00)={0x7, 0x9, 0x1cfb, 0xaee, 0x1000, 0x0, 0x8}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=34.415969647s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FREE_EOFBLOCKS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, &(0x7f0000000b00)={0x7, 0x9, 0x1cfb, 0xaee, 0x1000, 0x0, 0x8}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=34.415969647s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-ioctl$XFS_IOC_FREE_EOFBLOCKS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, &(0x7f0000000b00)={0x7, 0x9, 0x1cfb, 0xaee, 0x1000, 0x0, 0x8}) program did not crash testing program (duration=34.415969647s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-connect$pppl2tp-ioctl$XFS_IOC_FREE_EOFBLOCKS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, &(0x7f0000000b00)={0x7, 0x9, 0x1cfb, 0xaee, 0x1000, 0x0, 0x8}) program did not crash testing program (duration=34.415969647s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FREE_EOFBLOCKS detailed listing: executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) ioctl$XFS_IOC_FREE_EOFBLOCKS(0xffffffffffffffff, 0x8080583a, &(0x7f0000000b00)={0x7, 0x9, 0x1cfb, 0xaee, 0x1000, 0x0, 0x8}) program did not crash testing program (duration=34.415969647s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FREE_EOFBLOCKS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, 0x0, 0x0) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, &(0x7f0000000b00)={0x7, 0x9, 0x1cfb, 0xaee, 0x1000, 0x0, 0x8}) program did not crash testing program (duration=34.415969647s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FREE_EOFBLOCKS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release extracting C reproducer testing compiled C program (duration=34.415969647s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FREE_EOFBLOCKS program crashed: KASAN: use-after-free Write in pppol2tp_release simplifying C reproducer testing compiled C program (duration=34.415969647s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FREE_EOFBLOCKS program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=34.415969647s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FREE_EOFBLOCKS program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=34.415969647s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FREE_EOFBLOCKS program did not crash testing compiled C program (duration=34.415969647s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FREE_EOFBLOCKS program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=34.415969647s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FREE_EOFBLOCKS program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=34.415969647s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FREE_EOFBLOCKS program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=34.415969647s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FREE_EOFBLOCKS program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=34.415969647s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FREE_EOFBLOCKS program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=34.415969647s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FREE_EOFBLOCKS program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=34.415969647s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FREE_EOFBLOCKS program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=34.415969647s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FREE_EOFBLOCKS program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=34.415969647s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FREE_EOFBLOCKS program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=34.415969647s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FREE_EOFBLOCKS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release validation run: crashed=true testing program (duration=34.415969647s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FREE_EOFBLOCKS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release validation run: crashed=true testing program (duration=34.415969647s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_FREE_EOFBLOCKS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) ioctl$XFS_IOC_FREE_EOFBLOCKS(r0, 0x8080583a, 0x0) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session validation run: crashed=true reproducing took 35m47.722506402s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in pppol2tp_sock_to_session+0x1a0/0x1b0 net/l2tp/l2tp_ppp.c:156 Read of size 4 at addr ffff88812cd80800 by task syz.2.17/375 CPU: 1 PID: 375 Comm: syz.2.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:88 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106 print_address_description+0x71/0x200 mm/kasan/report.c:316 print_report+0x4a/0x60 mm/kasan/report.c:420 kasan_report+0x122/0x150 mm/kasan/report.c:524 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:350 pppol2tp_sock_to_session+0x1a0/0x1b0 net/l2tp/l2tp_ppp.c:156 pppol2tp_release+0x150/0x2b0 net/l2tp/l2tp_ppp.c:434 __sock_release net/socket.c:652 [inline] sock_close+0xc9/0x220 net/socket.c:1389 __fput+0x1fd/0x8f0 fs/file_table.c:320 ____fput+0x15/0x20 fs/file_table.c:348 task_work_run+0x1e1/0x250 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0x9b/0xb0 kernel/entry/common.c:177 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7ff05d99de99 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffe3c0779c8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffe3c077ab0 RCX: 00007ff05d99de99 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 0000000000006bf5 R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b33220000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ff05dc25fac R14: 00007ff05dc25fa8 R15: 00007ff05dc25fa0 Allocated by task 375: kasan_save_stack mm/kasan/common.c:46 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:53 kasan_save_alloc_info+0x1f/0x30 mm/kasan/generic.c:505 ____kasan_kmalloc mm/kasan/common.c:380 [inline] __kasan_kmalloc+0x95/0xb0 mm/kasan/common.c:389 kasan_kmalloc include/linux/kasan.h:212 [inline] __do_kmalloc_node mm/slab_common.c:938 [inline] __kmalloc+0xb4/0x1e0 mm/slab_common.c:951 kmalloc include/linux/slab.h:568 [inline] kzalloc include/linux/slab.h:699 [inline] l2tp_session_create+0x38/0xbd0 net/l2tp/l2tp_core.c:1609 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:771 __sys_connect_file net/socket.c:2000 [inline] __sys_connect+0x3da/0x460 net/socket.c:2017 __do_sys_connect net/socket.c:2027 [inline] __se_sys_connect net/socket.c:2024 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:2024 x64_sys_call+0x88d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:43 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Freed by task 10: kasan_save_stack mm/kasan/common.c:46 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:53 kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:516 ____kasan_slab_free+0x132/0x180 mm/kasan/common.c:242 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:250 kasan_slab_free include/linux/kasan.h:178 [inline] slab_free_hook mm/slub.c:1750 [inline] slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1776 slab_free mm/slub.c:3712 [inline] __kmem_cache_free+0xb7/0x1b0 mm/slub.c:3728 kfree+0x6f/0xf0 mm/slab_common.c:990 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline] l2tp_session_put+0xaf/0x1a0 net/l2tp/l2tp_core.c:193 l2tp_session_delete+0x3df/0x4d0 net/l2tp/l2tp_core.c:1582 l2tp_tunnel_closeall net/l2tp/l2tp_core.c:1228 [inline] l2tp_tunnel_del_work+0x199/0x410 net/l2tp/l2tp_core.c:1266 process_one_work+0x717/0xc30 kernel/workqueue.c:2302 worker_thread+0xa4d/0x11d0 kernel/workqueue.c:2449 kthread+0x281/0x320 kernel/kthread.c:386 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 The buggy address belongs to the object at ffff88812cd80800 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 0 bytes inside of 512-byte region [ffff88812cd80800, ffff88812cd80a00) The buggy address belongs to the physical page: page:ffffea0004b36000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12cd80 head:ffffea0004b36000 order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head|zone=1) raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 60, tgid 60 (kworker/1:2), ts 27652905615, free_ts 27005396263 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1f5/0x210 mm/page_alloc.c:2672 prep_new_page+0x1c/0x110 mm/page_alloc.c:2679 get_page_from_freelist+0x2ca9/0x2d20 mm/page_alloc.c:4586 __alloc_pages+0x1fa/0x610 mm/page_alloc.c:5930 alloc_slab_page+0x6e/0xf0 include/linux/gfp.h:-1 allocate_slab mm/slub.c:1967 [inline] new_slab+0x98/0x3e0 mm/slub.c:2020 ___slab_alloc+0x70f/0xb70 mm/slub.c:3177 __slab_alloc+0x5e/0xa0 mm/slub.c:3263 slab_alloc_node mm/slub.c:3348 [inline] __kmem_cache_alloc_node+0x204/0x2d0 mm/slub.c:3423 __do_kmalloc_node mm/slab_common.c:937 [inline] __kmalloc_node_track_caller+0xa1/0x1e0 mm/slab_common.c:958 kmalloc_reserve net/core/skbuff.c:449 [inline] __alloc_skb+0x226/0x4a0 net/core/skbuff.c:518 alloc_skb include/linux/skbuff.h:1322 [inline] nlmsg_new include/net/netlink.h:987 [inline] inet6_ifa_notify net/ipv6/addrconf.c:5569 [inline] __ipv6_ifa_notify+0x200/0xe80 net/ipv6/addrconf.c:6227 ipv6_ifa_notify net/ipv6/addrconf.c:6279 [inline] addrconf_dad_completed+0x192/0xe80 net/ipv6/addrconf.c:4283 addrconf_dad_work+0xc1b/0x14a0 net/ipv6/addrconf.c:-1 process_one_work+0x717/0xc30 kernel/workqueue.c:2302 worker_thread+0xa4d/0x11d0 kernel/workqueue.c:2449 page last free stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] free_pages_prepare mm/page_alloc.c:1580 [inline] free_pcp_prepare mm/page_alloc.c:1654 [inline] free_unref_page_prepare+0x80c/0x820 mm/page_alloc.c:3621 free_unref_page+0x93/0x530 mm/page_alloc.c:3719 free_the_page mm/page_alloc.c:863 [inline] __free_pages+0x67/0x100 mm/page_alloc.c:6020 free_pages+0x82/0x90 mm/page_alloc.c:6031 kasan_depopulate_vmalloc_pte+0x6b/0x90 mm/kasan/shadow.c:375 apply_to_pte_range mm/memory.c:2690 [inline] apply_to_pmd_range mm/memory.c:2734 [inline] apply_to_pud_range mm/memory.c:2770 [inline] apply_to_p4d_range mm/memory.c:2806 [inline] __apply_to_page_range+0x8db/0xc80 mm/memory.c:2842 apply_to_existing_page_range+0x38/0x50 mm/memory.c:2875 kasan_release_vmalloc+0x97/0xb0 mm/kasan/shadow.c:492 __purge_vmap_area_lazy+0xf09/0x1870 mm/vmalloc.c:1791 drain_vmap_area_work+0x3e/0xd0 mm/vmalloc.c:1820 process_one_work+0x717/0xc30 kernel/workqueue.c:2302 worker_thread+0xa4d/0x11d0 kernel/workqueue.c:2449 kthread+0x281/0x320 kernel/kthread.c:386 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Memory state around the buggy address: ffff88812cd80700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88812cd80780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88812cd80800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88812cd80880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88812cd80900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== ------------[ cut here ]------------ WARNING: CPU: 0 PID: 375 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 net/l2tp/l2tp_ppp.c:156 Modules linked in: CPU: 0 PID: 375 Comm: syz.2.17 Tainted: G B syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 net/l2tp/l2tp_ppp.c:156 Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 RSP: 0018:ffffc900037b7cb0 EFLAGS: 00010293 RAX: ffffffff849bb307 RBX: ffff888115a31000 RCX: ffff888114182880 RDX: 0000000000000000 RSI: 0000000015a35000 RDI: 000000000c04eb7d RBP: ffffc900037b7cd0 R08: ffffffff87b757e7 R09: 1ffffffff0f6eafc R10: dffffc0000000000 R11: fffffbfff0f6eafd R12: dffffc0000000000 R13: dffffc0000000000 R14: 0000000015a35000 R15: ffff88812cd80800 FS: 000055559013b500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ff05dc27dac CR3: 0000000115358000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: pppol2tp_release+0x150/0x2b0 net/l2tp/l2tp_ppp.c:434 __sock_release net/socket.c:652 [inline] sock_close+0xc9/0x220 net/socket.c:1389 __fput+0x1fd/0x8f0 fs/file_table.c:320 ____fput+0x15/0x20 fs/file_table.c:348 task_work_run+0x1e1/0x250 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0x9b/0xb0 kernel/entry/common.c:177 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7ff05d99de99 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffe3c0779c8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffe3c077ab0 RCX: 00007ff05d99de99 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 0000000000006bf5 R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b33220000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ff05dc25fac R14: 00007ff05dc25fa8 R15: 00007ff05dc25fa0 ---[ end trace 0000000000000000 ]--- final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in pppol2tp_sock_to_session+0x1a0/0x1b0 net/l2tp/l2tp_ppp.c:156 Read of size 4 at addr ffff88812cd80800 by task syz.2.17/375 CPU: 1 PID: 375 Comm: syz.2.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:88 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106 print_address_description+0x71/0x200 mm/kasan/report.c:316 print_report+0x4a/0x60 mm/kasan/report.c:420 kasan_report+0x122/0x150 mm/kasan/report.c:524 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:350 pppol2tp_sock_to_session+0x1a0/0x1b0 net/l2tp/l2tp_ppp.c:156 pppol2tp_release+0x150/0x2b0 net/l2tp/l2tp_ppp.c:434 __sock_release net/socket.c:652 [inline] sock_close+0xc9/0x220 net/socket.c:1389 __fput+0x1fd/0x8f0 fs/file_table.c:320 ____fput+0x15/0x20 fs/file_table.c:348 task_work_run+0x1e1/0x250 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0x9b/0xb0 kernel/entry/common.c:177 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7ff05d99de99 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffe3c0779c8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffe3c077ab0 RCX: 00007ff05d99de99 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 0000000000006bf5 R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b33220000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ff05dc25fac R14: 00007ff05dc25fa8 R15: 00007ff05dc25fa0 Allocated by task 375: kasan_save_stack mm/kasan/common.c:46 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:53 kasan_save_alloc_info+0x1f/0x30 mm/kasan/generic.c:505 ____kasan_kmalloc mm/kasan/common.c:380 [inline] __kasan_kmalloc+0x95/0xb0 mm/kasan/common.c:389 kasan_kmalloc include/linux/kasan.h:212 [inline] __do_kmalloc_node mm/slab_common.c:938 [inline] __kmalloc+0xb4/0x1e0 mm/slab_common.c:951 kmalloc include/linux/slab.h:568 [inline] kzalloc include/linux/slab.h:699 [inline] l2tp_session_create+0x38/0xbd0 net/l2tp/l2tp_core.c:1609 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:771 __sys_connect_file net/socket.c:2000 [inline] __sys_connect+0x3da/0x460 net/socket.c:2017 __do_sys_connect net/socket.c:2027 [inline] __se_sys_connect net/socket.c:2024 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:2024 x64_sys_call+0x88d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:43 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Freed by task 10: kasan_save_stack mm/kasan/common.c:46 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:53 kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:516 ____kasan_slab_free+0x132/0x180 mm/kasan/common.c:242 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:250 kasan_slab_free include/linux/kasan.h:178 [inline] slab_free_hook mm/slub.c:1750 [inline] slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1776 slab_free mm/slub.c:3712 [inline] __kmem_cache_free+0xb7/0x1b0 mm/slub.c:3728 kfree+0x6f/0xf0 mm/slab_common.c:990 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline] l2tp_session_put+0xaf/0x1a0 net/l2tp/l2tp_core.c:193 l2tp_session_delete+0x3df/0x4d0 net/l2tp/l2tp_core.c:1582 l2tp_tunnel_closeall net/l2tp/l2tp_core.c:1228 [inline] l2tp_tunnel_del_work+0x199/0x410 net/l2tp/l2tp_core.c:1266 process_one_work+0x717/0xc30 kernel/workqueue.c:2302 worker_thread+0xa4d/0x11d0 kernel/workqueue.c:2449 kthread+0x281/0x320 kernel/kthread.c:386 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 The buggy address belongs to the object at ffff88812cd80800 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 0 bytes inside of 512-byte region [ffff88812cd80800, ffff88812cd80a00) The buggy address belongs to the physical page: page:ffffea0004b36000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12cd80 head:ffffea0004b36000 order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head|zone=1) raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 60, tgid 60 (kworker/1:2), ts 27652905615, free_ts 27005396263 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1f5/0x210 mm/page_alloc.c:2672 prep_new_page+0x1c/0x110 mm/page_alloc.c:2679 get_page_from_freelist+0x2ca9/0x2d20 mm/page_alloc.c:4586 __alloc_pages+0x1fa/0x610 mm/page_alloc.c:5930 alloc_slab_page+0x6e/0xf0 include/linux/gfp.h:-1 allocate_slab mm/slub.c:1967 [inline] new_slab+0x98/0x3e0 mm/slub.c:2020 ___slab_alloc+0x70f/0xb70 mm/slub.c:3177 __slab_alloc+0x5e/0xa0 mm/slub.c:3263 slab_alloc_node mm/slub.c:3348 [inline] __kmem_cache_alloc_node+0x204/0x2d0 mm/slub.c:3423 __do_kmalloc_node mm/slab_common.c:937 [inline] __kmalloc_node_track_caller+0xa1/0x1e0 mm/slab_common.c:958 kmalloc_reserve net/core/skbuff.c:449 [inline] __alloc_skb+0x226/0x4a0 net/core/skbuff.c:518 alloc_skb include/linux/skbuff.h:1322 [inline] nlmsg_new include/net/netlink.h:987 [inline] inet6_ifa_notify net/ipv6/addrconf.c:5569 [inline] __ipv6_ifa_notify+0x200/0xe80 net/ipv6/addrconf.c:6227 ipv6_ifa_notify net/ipv6/addrconf.c:6279 [inline] addrconf_dad_completed+0x192/0xe80 net/ipv6/addrconf.c:4283 addrconf_dad_work+0xc1b/0x14a0 net/ipv6/addrconf.c:-1 process_one_work+0x717/0xc30 kernel/workqueue.c:2302 worker_thread+0xa4d/0x11d0 kernel/workqueue.c:2449 page last free stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] free_pages_prepare mm/page_alloc.c:1580 [inline] free_pcp_prepare mm/page_alloc.c:1654 [inline] free_unref_page_prepare+0x80c/0x820 mm/page_alloc.c:3621 free_unref_page+0x93/0x530 mm/page_alloc.c:3719 free_the_page mm/page_alloc.c:863 [inline] __free_pages+0x67/0x100 mm/page_alloc.c:6020 free_pages+0x82/0x90 mm/page_alloc.c:6031 kasan_depopulate_vmalloc_pte+0x6b/0x90 mm/kasan/shadow.c:375 apply_to_pte_range mm/memory.c:2690 [inline] apply_to_pmd_range mm/memory.c:2734 [inline] apply_to_pud_range mm/memory.c:2770 [inline] apply_to_p4d_range mm/memory.c:2806 [inline] __apply_to_page_range+0x8db/0xc80 mm/memory.c:2842 apply_to_existing_page_range+0x38/0x50 mm/memory.c:2875 kasan_release_vmalloc+0x97/0xb0 mm/kasan/shadow.c:492 __purge_vmap_area_lazy+0xf09/0x1870 mm/vmalloc.c:1791 drain_vmap_area_work+0x3e/0xd0 mm/vmalloc.c:1820 process_one_work+0x717/0xc30 kernel/workqueue.c:2302 worker_thread+0xa4d/0x11d0 kernel/workqueue.c:2449 kthread+0x281/0x320 kernel/kthread.c:386 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Memory state around the buggy address: ffff88812cd80700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88812cd80780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88812cd80800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88812cd80880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88812cd80900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== ------------[ cut here ]------------ WARNING: CPU: 0 PID: 375 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 net/l2tp/l2tp_ppp.c:156 Modules linked in: CPU: 0 PID: 375 Comm: syz.2.17 Tainted: G B syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 net/l2tp/l2tp_ppp.c:156 Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 RSP: 0018:ffffc900037b7cb0 EFLAGS: 00010293 RAX: ffffffff849bb307 RBX: ffff888115a31000 RCX: ffff888114182880 RDX: 0000000000000000 RSI: 0000000015a35000 RDI: 000000000c04eb7d RBP: ffffc900037b7cd0 R08: ffffffff87b757e7 R09: 1ffffffff0f6eafc R10: dffffc0000000000 R11: fffffbfff0f6eafd R12: dffffc0000000000 R13: dffffc0000000000 R14: 0000000015a35000 R15: ffff88812cd80800 FS: 000055559013b500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ff05dc27dac CR3: 0000000115358000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: pppol2tp_release+0x150/0x2b0 net/l2tp/l2tp_ppp.c:434 __sock_release net/socket.c:652 [inline] sock_close+0xc9/0x220 net/socket.c:1389 __fput+0x1fd/0x8f0 fs/file_table.c:320 ____fput+0x15/0x20 fs/file_table.c:348 task_work_run+0x1e1/0x250 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0x9b/0xb0 kernel/entry/common.c:177 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7ff05d99de99 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffe3c0779c8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffe3c077ab0 RCX: 00007ff05d99de99 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 0000000000006bf5 R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b33220000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ff05dc25fac R14: 00007ff05dc25fa8 R15: 00007ff05dc25fa0 ---[ end trace 0000000000000000 ]---