Extracting prog: 3m19.756936869s Minimizing prog: 34m47.407321226s Simplifying prog options: 0s Extracting C: 43.921041095s Simplifying C: 3m0.738682804s extracting reproducer from 75 programs testing a last program of every proc single: executing 25 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-renameat2-fcntl$dupfd-syz_init_net_socket$nfc_raw-dup-accept4$vsock_stream-io_setup-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_PIT2-ioctl$KVM_CREATE_PIT2-io_pgetevents-sendto$packet-setsockopt$sock_timeval-mount$bind detailed listing: executing program 0: r0 = syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f00000002c0)='./file1\x00', 0x200000, &(0x7f0000000000)={[{@errors_remount}]}, 0xfe, 0x596, &(0x7f00000026c0)="$eJzs3d9rFNceAPDvbLLRGK9GELn3crkEfKhF3Jikthb6YB9LKxXadxuSNUg2rmQ3YlKh+lBf+lKkUEqF0j+g730q0n+gf4WlFaRIqAX7sGU2s7pJdvPL1azZzwdG58ycmXPOznxPzuzZZQPoWSPpP7mI/0TEl0nE4aZ9/ZHtHFnJt/zoxlS6JFGrffRHEkm2rZE/yf4fyhL/joifP484mVtfbmVxaXayVCrOZ+nR6tzV0cri0qnLc5MzxZnilfGJibNnJsbffuvNjrX19QuPv/nw3ntnvzi+/PUPD47cSeJcHMz2NbdjQ/s23HuzOTESI9lrko9zazKObafir4BktyvAjvRlcZ6PtA84HH1Z1AN732cRUdu+Jzs4Bug6yU7iH9gDGuOAxrP9lp+D94iH7648AK1vf7Ly3kjsrz8bHVhOVj0Zpc+7wx0oPy3jx9/v3kmX2M77EADP6eatiDjd39++/1vj79qWz316C3nWlqH/g5fnXjr++WkwYl38556Of6LF+GeoRezuxObxn3uwMgnVZKADBWfS8d87Lce/T4sc7stS/6qP+fLJpculYtq3HYqIE5Hfl6Y3ms85u3y/bafZPP5Ll7T8xlgwq8eD/jVzTtOT1cnnaXOzh7ci/rvJ+Ddpcf3T1+PCFss4Vrz7/3b7Nm//i1X7PuK1ltf/2YxWsvH85Gj9fhht3BXr/Xn72C/tyt/t9qfX/8DG7R9OmudrK9sv47v9T4rt9o0k2aTpNu//geTjes/U6AquT1ar82MRA8kH9fSq7ePPjm2kG/nT9p843jr+N7r/ByPiky22//bR222z1q//4d29/tPbuv4brzw+s3JQ867773/6bbvyt9b/vVFfO5Ft2Ur/17aCA6u37PiFAwAAAAAAgC6UG4g4GEmukM3pH4xcrlBY+XzH0TiQK5Ur1ZOXygtXpqP+XdnhyOcaM91DTZ+HGMuOb6THs8/HNtITEXEkIr7qG6ynC1Pl0vRuNx4AAAAAAAAAAAAAAAAAAAC6xFC0/v5/6re+3a4d8ML5yW/oXavif1+LDJ34pSegK/n7D71L/EPvEv/Qu8Q/9C7xD71L/EPv2ln8/+9QxysCvHT+/gMAAAAAAAAAAAAAAAAAAAAAAAAAAEBHXTh/Pl1qy49uTEXE/ri2uDBbvnZqupifLcwtTBWmyvNXCzPl8kypWJgqz212vlK5fHVsPBauj1aLlepoZXHp4lx54Ur14uW5yZnixWL+5TQLAAAAAAAAAAAAAAAAAAAAXimVxaXZyVKpON+dK/kOn/DXLmnXHlrp745qWJmvDEYHT7i6n/irVqvtVh8FAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP8EAAD//3hONlo=") renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) r1 = fcntl$dupfd(r0, 0x406, r0) r2 = syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) r3 = dup(r2) r4 = accept4$vsock_stream(r3, 0x0, 0x0, 0x80000) io_setup(0x9, &(0x7f00000002c0)=0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r7, 0x4040ae77, &(0x7f00000001c0)={0x2}) ioctl$KVM_CREATE_PIT2(r7, 0x4040ae77, &(0x7f0000000040)={0x8}) io_pgetevents(r5, 0x4, 0x4, &(0x7f0000000300)=[{}, {}, {}, {}], &(0x7f0000000400), &(0x7f0000000480)={&(0x7f0000000440), 0x8}) sendto$packet(r1, &(0x7f00000000c0)="194146538c6bb2266bad131257456317fc9c61191f87e398bdabea4275c5a49c4dcc766b5fa5d06d2615a7dcd5a29744e16a253d818f160e0c7d1ced5de86e438f213f64c17b0ac7e4d51c9d4181e4f6f11acbb3f06ead664bb28f35d621097b1f2969e235f41c09a53431aad7b55f07d57cc1fec02a148136bca670b7d783d34685337df17267d8a28e9fe812ad736e38186f1abfd3ef1779e2b29e8932a305160b21d6b5c2af43be574eaac27b820e389403cb973f2ed343f7e671da4918bac5dfd289698a8065b5293df987f478510fbb5f6a95a2ed3d3192e7841e8e1199d427eb9446b7", 0xe6, 0x40, 0x0, 0x0) setsockopt$sock_timeval(r4, 0x1, 0x14, &(0x7f00000001c0), 0x10) mount$bind(0x0, &(0x7f0000000200)='.\x00', 0x0, 0x41021, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$key-sendmsg$key-sendmsg$key-sendmsg$key-syz_mount_image$f2fs-sendmmsg-syz_clone detailed listing: executing program 0: r0 = socket$key(0xf, 0x3, 0x2) (async) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[], 0x38}}, 0x0) (async) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="020100090e000000030000000000000405000600"], 0x70}}, 0x0) (async) syz_mount_image$f2fs(&(0x7f0000000140), &(0x7f0000000040)='./file0\x00', 0x1f, &(0x7f0000000400)={[{@lazytime}, {}, {@acl}, {@nolazytime}, {@fastboot}, {@discard_unit_section}, {@compress_cache}, {@lazytime}, {@whint_mode_user}, {@noinline_xattr}, {}, {@jqfmt_vfsv1}, {@six_active_logs}, {@background_gc_off}, {@extent_cache}], [{@context={'context', 0x3d, 'unconfined_u'}}, {@smackfstransmute={'smackfstransmute', 0x3d, 'nousep_xattr#\xc5\xf8\xf5\xfe\a\xc7\xa5\x17\xe1\xb8\xd3\'\xe5\xe4\x81b\v\x91aOtR\xdb\xd6u\xfc-\xb3\xf4\xf4A-\xf7\x1f7;:\xa4fZ\xf2\t\xafrkR\xef\xe7w\xfc\xd0J`\xcb\xf48\x895b\xb7n\xfe\x8a\xc6K\xb7g\x99\xca,\xdb\xc3~\xe4\xaa9W\xa2\xfe\xaf\xce\"\xc1m\xc8\xecq\xfbG\x97AK\xdf\xa7D\x8f\xa6\xe2\xc4L7\x8e\xf5%\xac\x84n\xe1\x13\xa1u\xf00\xbe)c\x82I\xe6Pu\xaaG1-\x12\x14\xe7\x12\xd6[\x8a>\xbbc-\x11\x15\x02\xe0bW\xfew\xb3\xe4@\xf9\x94.\xf9\x00\xfa\x17\xeb8>\v\x04|\x0eYZ\xd3\x06\xb4\xdb:fKW\xc9\xebhn\x82`'}}, {@dont_appraise}, {@fsname={'fsname', 0x3d, '\x15x\xd38/vjf\xfa\xb0\xe4\x00>\x85m^\xf4\x16\x18d\a\tA\xa2\xee\xdf\xf4H\xc3{I\xe8\x1c7\x1e\xf8&\xf9\x1db\xc1-\x7f\xc19\xdd\xf7\x90\vW&]\xae\x1c\xfc\xc5\xf8\xbc\xb3yZ\x89\xc4E\xc7I\xb2\xb8\x1d2\x99\xccg9\x92Y\xe3\xec\xdaI\xfc\xe5\xdb\x8b\xd9\xbdy\x80\xee\xa8\xdf\x8bMO\f\xc8\xfcdNJ\x02\x1bj\xd0\x85S\x1c\x8a\x17h!\xde\x19\xc5\xc1\xbf\x9c$\x1a\xea@2o \xc5\x12m\x86\xb5T\xbb\xf0\x8c\xf9\x98#\xcd?\x03\xbc\xd6\xf0\xbd\xbe\x88\x84\f\xacw\x9bl\x1a\xae\x9a;\xf5U\x93\xc4\x06\x13 \xc9\x01\xd1P\x80\xdf[\x97\x84\'Ec\xaaa\xedJ\xb0\xbd \xf0\xad\xe2\xf1\x9f\xbd\xf1-\x95c\b\x00\fc.\x0e\x8d\xfb/\xf0\xa3&\xeblU\xe8A\x174>\xe1\xdd\xbfbV9\x16\xeaY%\xad}\xd2GB\r\xdb\xb3\x14^\xec\xc7\xb5\x86\x0e\x1a\xb6\x12_\t\xdf5l;\xdbY\x88\x8b'}}]}, 0x1, 0x5553, &(0x7f000000b3c0)="$eJzs3M2PU1UUAPDzZhgYPsSJceGOlxCTmYRO6PAR3aGCXxFCUBeutNOWptD2TaaljKxYuDQu/E+MJq5c+je4cO3OuNC4M9H03TfAgChmih3g90tez7v33Z577wshc16bBvDMWsp//zWLo3EwIuYj4kjEnfNse9C5FF6KiGMRMXfPkVX9dzr2R8ShiDg6SX43z+TSlyfGx8/88u5v3/1wYN/hr779cXa7Bmbt5Yjob6Tzm/0Ui06K16r+xrhbxv7pcRXThd5iut4vUv/N9nqZ4WZje1yjjKc6aXyxcWM4iVd7jeYkdrpXy/6NQZpwOO5s5ynfcK2xWbZb7fUydodFGTu30rxbt9L/bbeGo5SnVeX7tEwfo9F2TP3trXbaz8b1MjYHo6o/5S1a7a1JHFexmi6aRa9VrmN9Fzd6j3uvO7ixlY/bm8NuMcjPrNZfWa2frdU3i1Z71D5da/RbZ0/ny53eZFht1G70z3WKotNrrzaL/kq+3Gk2a/V6vny+vd5tDPJ6ffXU6snamZXq7ET+1qUP814rX57E17uDG6Nub5hfLTbz9I6VfG311Ksr+fF6/v7Fy/nlKxcuXLz8wcfnP7r02sV33qgGPbCsfHnt5NparX6ytlZfeYr2vxh39j/5O+CB/X9WLXqK+4ddyWa9AIAnz8Pq/0z9DzxG/1b/Z/9Q//evV+1iHG8eub/+37wS8fjr/1D/T8Weqn9T/T8Xz2r9P4PnH7Ar6n8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgGfWTwtfv12eLKX24ar/uarrhaqdRcRcRPz5N+Zj/46c81WehYeMX7hvDd9nUWaYzHGgOg5FxLnq+OP5x30XAAAA4On1ze1jX6RqPb0szXpB7Fp2+5GHpoc2c0c+mdbUEbGw9PN28/6nPP/R3OTlxd2vKpn8+94XW1PKVm5tcUrJ0iO3fVNI9Oh3fH5HWLwnZCnMTWE5AADAHrOzEphGFQIAAMDe9PmsF8BsZHH3M8PqC/wHUqg+EDy4owUAAAA8Me5+Pzyb6ToAAACA/0NZ//v9PwAAAHi6pd//AwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/mLnbnLTBsIwAH82uNA/FVXd9yrdwTF6hC67rDhAL8EBsuAMuQBnILscIYIIj0OAsEjC2Fai55HMYGNef+ZnMTPSAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQJtuqmUV/37+vzRns71MnrsBAAAAzllXy1n9ZJL2PzfHvzaHvjf7RUSUEXGu7z6ID0eZgyanejz/6vD86qSG64g6YXeNUbN9iohfzXb3re1PAQAAAN6v1XwxTb319DDpuyC6lAZtyi+/M+UVEVFNbk8v8ErlLu9HhrJqu9/3MP5mSqsHsMaZwtKQ2zBX2rPUf/f99zM+aIrUlGffti8y270DAAAdGhw13fZCAAAA6NKfvgugH0U8TGXupwJHqWmm9z4e7QEAAABvUNF3AQAAAEDr6v5/R+v/ba3/BwAAAP1I6/8BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQpnW1nK3mi+mTF4Yvy9lsL5PvjgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAe/bnHQVCIAzCYO/6zmTuf1hp0NDYpAqEj78xGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADe/O4v/yemxplk7rWx9DySrJ0aW6fG3rlx9Ifx9WsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC42J+DFAaBIIiilWSS6E7m/oeVAt14ARHeA+HTTQsDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAT/Q6vrzP+DS2JKPTxrfjmeTXVePfVWPpQWPtwbz+fdzwIgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANjZuZ/XOKo4AOBvZna2tirGKDlERMGDXmy6ra29iQclePBPEEK6rbFbf7Q52FLEXLxJzr2IHkUEJd76P/TcQi/11sMeKojHlTc7k522QTeCM9Pk84E377vDMO/7ZiHkO+8lAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQjd+dxVk8LEzjtDx3+8H19djfeaSPbm7fXY4txkmTST8ZXq5/SJbaSwQAAIDDI6vq+xDCvXxnNfbpQlH/59U1seb//tlpXNXzj9b9VV/V/rH99uv9F3cHWpiOE296fmM0PPF4Kr3/b5bd9ty/XtErnnzx7iUrvpD0g60XxnnxPJNvb916r1+ER5rIFgD4L45XfRlUvw/FftBmYgAcGr1a4V3V/9lCuzkBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANGG8FZ6u4iSEsNybxdGdB9fX9+pvbt9drtqZGze2w9eze8Zb5CGE8xuj4YlGZ9NtV65eu7g2Gg0vNx+8EkJoa/R3yulf/GiOi0No5fnsP/irG2l0LUjLL7sr+TwZQYs/lAAAOJDyssW6/l6+sxrPJYshTH54uP5/vRaHOev/+x+fuV0fq17/DxqbYfetbF76fOXK1WtvblxauzC8MPz0rZODtwenzp4+fXaleFey4o0JAAAA+zaZTCa7H/plq9f/6eLj6//HanGYs/7/4rvBV/WBM/X/nmaLfm1nAgAAcLg9/+qffyR7nE/6/V5Y29y8PPiyOCb9fiiik9NjC6nu25Gy1ev/bLHtrAAAAIAmjLeSh9b/z9XiMOf6/zM/vvRz/Z5ZCOFouf5/fP2z0bnmptNpTfw5cdtzBAAAoF1Hy1Zf/8+L/f/p7paHNITwxmvTuPw3gP9Y/+dl/Z+9/81P9bHq+/9PNTfFTkqXps+j6JdC6C21nREAAAAH2VNli8X+7/nO6ie/HPuwb/8/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQNP+DgAA//+yYT9Y") sendmmsg(r0, &(0x7f0000000180), 0x3ef, 0x0) (async) syz_clone(0xa49a4400, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-setsockopt$inet6_buf-syz_mount_image$vfat-syz_usb_connect$hid-open-open-flock-fcntl$setlease-ioctl$XFS_IOC_START_COMMIT-openat$cgroup_ro-openat$selinux_attr-write$selinux_attr-readv-write$UHID_CREATE2-openat$sndtimer-socket$nl_xfrm-sendmsg$nl_xfrm-ioctl$BTRFS_IOC_GET_SUBVOL_INFO-ioctl$BTRFS_IOC_WAIT_SYNC-ioctl$BTRFS_IOC_RM_DEV_V2-syz_usb_control_io$hid-accept4$inet6-sendto$inet6-syz_usb_control_io$hid-syz_usb_connect-creat detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_buf(r0, 0x29, 0x20, &(0x7f0000000000)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa019600ba9380d412000000000000002900000003001e003203", 0x32) r1 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000340)='./file0\x00', 0x1010000, &(0x7f0000000580)={[{@iocharset={'iocharset', 0x3d, 'cp866'}}, {@numtail}, {@fat=@nfs_nostale_ro}, {@shortname_mixed}, {@shortname_lower}, {@shortname_mixed}, {@utf8no}, {@rodir}, {@uni_xlateno}, {@rodir}, {@fat=@fmask={'fmask', 0x3d, 0x101}}, {@fat=@codepage={'codepage', 0x3d, '1251'}}, {@utf8no}, {@shortname_lower}, {@shortname_win95}, {@rodir}, {@shortname_winnt}]}, 0x3, 0x375, &(0x7f00000009c0)="$eJzs3U2IG1UcAPB/drLJtqCbmygI0Zugpe1NL7bIFop7UQl+HMRgU5VkFXYx2B6argfFo+BRT94U9OBBPIqgiDcPXq0gVfGgvRUsPklmkpkm6fYDWyn+frCzb997//cxMySzw+TlhSPRP7EaJy9cOB9ra7WoH3nsSFysRSuymDobixpL8gCA28PFlOLPlJsvW1seUrsFwwIAbqLJ+/9LEdGOVp7z5td71U/e/QHgtlf8/79vrzpXuA8Q8dpNGRIAcJMt3P+//7LixuSnPv2zXnkqAAC4XT317HOPH92MeLLdXovYenvYGXbikbL86Ml4JQbRi4OxHpci8guF8aY22R47vrlxsN1uj+KXVnQiYqUI7ORXCkezSXwzDsV6tIr44mojpZQd+2xz41B7IiLOjib9x1Zt2FmN/UX/P+6PXnnhMW1k8ivi+ObG4XbRQGdrGj+K2C0fVBiP/0Csx/cvzppJafoE4+bGmUPTQZfxw04zTsz2whXvgAAAAAAAAAAAAAAAAAAAAAAAwA050J5prUTEZP2btDUaFuv3HCgrtKrr64y3Ua4PtJuvD5SaKVL6442HOu9kcdn6QPPr8wwtJAgAAAAAAAAAAAAAAAAAAAAzO6ca0R0Mets7p073q4nR9s6plYgY57z67Sdf7YvFOldJ1PMumhGzLtpFt6f73ZRNK6csYjE8G3c+zfno89mIq3Was1ksHUbzykWDwR33/fx+mXNvNm3577JOFssnmFWG8ehcy1t35kO6nh01Sxyu5jQXez+XUqrkvFUNP/P8YoNRi6hf/4E73V+JxaJ6kUjjnG/Ov3z3dO93v0y5Bx5cf/rcex/+1u8Oxj3H5Ag2tncupX63Nq18Db0XzaXJISjPjVrkiVr1TKjv1eDu5Tnd7Iffn7nn3e+ubSekas7r4/N5rk6WT+fT+fBGnhgPc65oXxm+Wkxi0FtdcvJfLXEDx/SuD774OKWffr3mLkorCy8btX/n1QcAAAAAAAAAAAAAAAAAAKiqfFa8+ND1KC9Y3Svq4Sdu0fAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4JYov/+/ktg9G4NefWnRHom/RrFY1Oxt70Q0/utpAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwP/dPAAAA//+BrGR0") r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000540)={{0x12, 0x1, 0x151, 0x0, 0x0, 0x0, 0x10, 0x458, 0x501a, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x40, 0x5, "", [{{0x9, 0x4, 0x0, 0xb, 0x2, 0x3, 0x0, 0x6, 0x0, {0x9, 0x21, 0x1c, 0x0, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0xb0, 0x9, 0x9}}}}}]}}]}}, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x1607c0, 0x78e22799f4a46ffe) r3 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) flock(r3, 0x2) fcntl$setlease(r3, 0x400, 0x2) ioctl$XFS_IOC_START_COMMIT(r1, 0x80585882, &(0x7f0000000380)={0xffffffffffffffff}) r5 = openat$cgroup_ro(r4, &(0x7f00000001c0)='freezer.state\x00', 0x275a, 0x0) r6 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) write$selinux_attr(r6, &(0x7f0000000100)='system_u:object_r:hugetlbfs_t:s0\x00', 0x1d) readv(r6, &(0x7f0000000840)=[{&(0x7f00000004c0)=""/175, 0xaf}], 0x1) write$UHID_CREATE2(r5, &(0x7f0000000080)=ANY=[@ANYRES16=r6], 0x118) r7 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000280), 0x111402) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in=@multicast1, @in=@initdev={0xac, 0x1e, 0x0, 0x0}}, {@in=@remote, 0x0, 0x33}, @in=@loopback, {}, {}, {}, 0x0, 0x8000000, 0x2, 0x4, 0x0, 0x20}}, 0xf0}}, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r5, 0x81f8943c, &(0x7f0000000880)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_WAIT_SYNC(r7, 0x40089416, &(0x7f0000000a80)=r9) ioctl$BTRFS_IOC_RM_DEV_V2(r1, 0x5000943a, &(0x7f0000001240)={{r1}, r9, 0x0, @unused=[0x9, 0x1, 0x4, 0xffff], @name="15a0f7cbcca952ee69d9fa1ffae19b8d4c29fbc19dda239f61bdf0266ace3323138b3f1f761f9499174a8a89f2a159947d29e6cfca0f9e4afc7e2004b624ae2fad8a8fafeafbf809582b6716b757c39e1fdbf3e298c1ddd3dc5738ba7aca6867c681b3e383c9b3407bf06e016cff21ca3f8fd324f53e38c587ebe13b53d42f4417d81fb24af5aa1c7e0d4727e3d30a4d258ea85c4f223da5e598bf0a70fb40af4ea18e2448d461c6e7434285a363fece36c20cf14a33f5cee8798a2ed776d4af024e4b16d53c2735063969d6ecc05a42285237bdd62c263e1855f803e1effad9557521739526a67c992441c034109d1994c579d3f0257a1fd2d035d45efba42bb6c1cab4bf3aa5a695e915425f47070c675b4c71c5113ae1363ae115542bc536a320b16557952ae70c00dcdb00fc522e1bbc2e426da3f97d1c6665920060666a9197233a7c23b8a3acd7998a209781b54a7b9873f3abd5781ac55c9e90d0cc486363a4b6f61fb1a93d563760ea6cc95800f2db7b280c76533637c9095261d30e45b4d78f25b8381b82998a950e5365f0b3df1a8e20bb7f255d1af493c7830329f2de9b6f17c84e73f70c89a843ff5ca91157e06ea5b0eda8dd12066cc01bea59aa9956f106f02f7ba2caa8eb28739836d8747565c0118587098af17d55a10afe57e9dce7339beae5f4cdf2217e5da16893ef23649b159871c1f4fc41a1a4bb477584bcc9d071390f29b2a5d43c38d41e67dd526af78c08ac39edf132ee695b9b9f33e0332e20147ac3d13256e12864ae85b6a2b4bb9a03ad7ca03b6f0bcbfd0df5746295f820cc393fce7e90accd5449bc098ab9b0eacc12d7ee4aa58c28e797564147651d459a3e5115e457802b5e19715e24419019be13672d7da12f1d8fdce34012519bbca58e9dc0c0bcaaacf551382c83a19ec3023499a39d41babd82127a428e048a18c5d751c430abeb8b222204e6c13330f59b2aca30c60472ac66232bc53a643859f168984c14736be2e629e87ebe4c303fb5b7678405fbbf57b7af0ef726bf5b6a2d049550b2d4515fee2f8d00462b097041d07eb4d8621dbe0cf00921146b38fddc7fb5047a9fa4a072f109817506fdc5402289b3e07d4b11e7d76db3f427a61fc20fe6a3c3def348ac84edd6f0b660555f2ccfbbd41445dc02b923a72a38da62169dd2bd616f7fa8e592d36e4752ba72409e0a75a2dc8b51f90b0b87bd4af4559062fced30aaec94344ff2a2b30d775827d079332a39824562013922c47cd7bb00cb1344097d9d824cab98128280f59539c2f40253c11c111687e85c66ffc45766af0c332dbdd83b72cd8e13b682b05f90df9cad63c07cb8d38586a89db752e19fd9810291b1703b04671607416370aeac28a0625666d43ef12bdec00de304685a3850f11a134f24486a8f2986477bda8f8b1e89e479575488e10d286f5df458e438dc085c1b6279681e47ea90b91c25a5b992bc703abb8ff91d8a5f737cf72d41e3ec329e09f1e347bf4be219b4392ca7cb99d720187ffd47046dc9be24524a3b53fac2dd5371e64496a9470bc54d73d3d892cefe02143af05a178f3718c4f4826950af49df14606f61e85df1b5d6fc02ca4fed201e13482fd482d3d6e12d8bd2eaa2ab8a0b62e7f4e7b8dbd77f16db697d6b4eb314499b8f411ffba77ba0c1ce79907293008e715bd390731517ea90693e9d56d8bae5c0d2c80ed678d3c84b9ee2f48105e3ecdad145e4aaea2dd011f40606fea3c0ce0018e7a82858dc1f163d4ae9601e0113ca8f29576261aca6069df4dbee33d4d1d237c2ad1e2e105f40b2e04f4e35cf047a778dc8cf5c9f538f83af69a20ccec8c89d93e4814ec8120e8e3d06a62fdb1ca1b8e29b49aba3bbace5a867f12e5d60a89356b772a1741e67303c1c4cab71786e2dd504b4f5c895931ab908d225fa117ed74eb8beb343c229f388dc0c6ea2a3872cf9dc8c9635de05160b1c312d95f0fc38dc14dc8598d5980be86d12cc1467c0cc1daa738a36378cb8a2a677c0cfe864a0188ee213b2e12c783b3accbe33bd2e2e62af674e61ede060d9ef324f1e51887c665b4ebe096c7af3662cce00c54e1a10c56bc2e3ef2cef1c17161fbb88294edc0a68a826c2e9d1dc084a107c41431babb0fa2aa84e7259d8314d3c213b132a517885be6126030db5a92708ab0c0f439fc6d664a0de70f01f4f8eb30eb187d8fffd356586af81f26804b1fa537c0acc30b39b25e5be77bf362fa05c0d041a0ecd97a2a92caf0c16e4369a82057d82a813227f3db91c4faef24ec600c503c6014f3afe7311e92079ccf7c164ee8774799c1e384878d06968e385454d4729319ca4b6594f098d621fe9033eba3a1e7837bb84be2e90bec57d64a5bf8d2b4b12aec53ae66997dc8072e0b26484ca32b62dfb4a5f99a86126b5050a0a38cfd26dad8945f2e77f1256704ab1893811647ec0e965c44c0494066f4542544cec140d7dee929841a3117bfedabec3a02b1d6f1e3695e63f283d9d524e4856fd25c5ddd25ccaaca1a5491040d368a4e03cb0ad6efde2ec9ad54cb76d4b520000c291cce20cae9c4e38682a0ed314d09497fb8c581de3a8209357c076f86f0254bb227c22b4d8dbf40204d5b4091f90be5d20ceaa3725f90455d3b6aa0ac024ce56d650ba6bc140ae4d195c018f429cfccfca7d3d8e180a5a136579a328359ace33b650110d80a087118adef8a5e92c742864cbea7f400005f3c53a47c851f56c189bc70c8e73f660a2af25f5ba80f16bffa4ba3f83c9efdc312c709b2ce885897edcb08d7bb30812dd6b8b193ee11678db725999a765d2881c5d186d7c66e2b6ce0160b79dfe414ae5da2d1258b254206154d5da9a99062277db9e33a08036847013820f36c478faf2096a158e89151430e2f40b350c31fa03932a7019c29af4fe8e392ad55831aba442c7aad4782101c511acdca77770803e64584626ea348c1cc14a6963858ccfe27d289d7e42807e95fe3e28d3ae038342745eade6575cb1fa704a2023bce35b2a59e16b5332c9d0da661af0804125e18cbd0a7c511df5abae57a27c3bc47d90099457e2a7d930ee4b3d8380c4a8a68546894a1527454539784372988221e92db5ffdb1f7d63d3fbea9b44db2f0eb0b07df25d17448080b76ec5a50a7a813d01c552a53c92ed4d7411f2554dacb4fc80e346d36e9f832e5da20d0ffe5000b4dc167e7d0171ba211dd547391c3b5c2cd208ab5792b7173f806c73029a1581039dfff84d7ee6050400b626407d5a955d215b18bf6f2098c1e5e79e907d5128f3b10c59047421a2fbab587d4f228f9aa53540aab20cec28c40d15d38f9a6f40b91491b9623305ea8b5fa98bdf80fe49c5b40c80cf77e6d440a54473d19af27f4fa9cd52b532158b379962a7df48021057b9a7e1c72cbd54328c61a748279e1d905e49b7ccde9122b18da73ab0bf60e3e511e7ca0b4f52aa2eec11c7603759a09ca88a1b3e5435b704a35a46eea9be7b253f006ba9e5dfa23129d23a55af9c6fbcfecadaf3ec5ae17c5081eb03342284dc50663ff6ce722cbb802b610463ce4c3b0e0bc23f7957cbf757c26df88e3e5105a7a150c64552662639b89d53c78f32bdcf812ea01112a9823f2426b28663045d34c96f9379676c8f83dc67b4bc3163a83b8ce631fd5136109d58413837e224b1100e25c781da0459c9adb934ec21d1e48b0f6dbc0abe41482662ebae2934756330ef2fed03b33b6efb732c9b15447644b7be76965e00fce97188397f07a72479533df7c3cff5b07f36279bd1b5a133bbfbfc6e8b9ba4de55f89d0d83f09e0f9dcec2a2fdf3c9c5aecd4ef1a41445edb2c88e10688991d229c4eb4fef33e65c24df1ce9c924ab9169fe14a5661266a2d75098e2d6fd17a8720b90ec2ad6f1c25049bcd556450a4f8d2aa824683ff99f14e6e5bd219ea8a31b06beafe2c90c74d2829756d766bf9d05709b34067ab0287ebaa77c6f44a9266110d5fc7882d53fe23ac1df46e5929361f105ca302c08a10523876fac2667b4e1a07632b460702ee38c826055d1817f94b3aa683f89389700c78f8c27383bfc212f10e6d570484ea3ed3667007421fec1b4996485c4ab371363283caed309b83c2522b4aaf5aba2989fd07ee6b6f6c2e1d11018b7d02f9bd586ac416be471f15cd7b376be60504668fba6ae7a78c369ec6bcc2ca8f33157232f8825d503dd542558582d72a25e0aa2bf485e874f5ed2776e37bdeae2b23606f131d11bdfafe32bcca6f4ee6922be5c7e315f0e94514a34d3b2d913c9f482209a0088b3e767bcdc346558e4c923deb1fbb0f00c7348d78f2cce1ee73b69a91d5c9dd5aa0d1ec44160b789ddc4f5d6677f2650624fe6da4f334b2bac15f2913ead14b5cca0c60ee4e3dd08ff52b0e4f26c627d3e1e5323350c027a9683adab3cef4ec1daad9c79d75620a3f67eda3d3fa21855d1799e6236dacc64ad64a2051e251bd778121da43de6db4cebe9c9086cdcd2bcb61540983c198cd770db5854dd2486027b37ec075f3a1348509af5e0abe4ab74c246e9cbba0991e863e03234d2786962b939b90c904e567a56dd699488125e7528893e4c509984f443b619a2c26036debc884b484300a7b6c491072b8943e8f5a0118f2f19526777a98f9cddb958edbdfab373a742d1e136c9b2d89151e33cfd7c7dad158a2b26096c29b6d6a73f0c197a9e46729b7b7bbe51cd988d883a4566fa569f87c356051e9b4466cd260061fc4e7af758e5e02076029ed842dafa826bfad6f053398c074548f8f2c5cad729841be6c16e2af4bbe444a2f77f2dd4452628994ba2e9738a261da7a758f8e61e889a7ba000730bd645e683a48540df0562bc0aa67f9543b10b78f38acf2cf34c7ee21dca2139b24c4038e1093ce06085dbd3fdb781ba0aa252d28832f5a83a70d2acfe420afacbf06658ac2fd62108df69d6db377bc029b3dc3f01147cf8b04f0c4932427b71734d2fe9ee59b14292de1c95b24b2d1a53185f87f32cdcb1368554da1202eb07ccc926d8f9d505d960076836be1d60130efe8a29fb0afcc0d908120159d2d26ee35898acca345895ef9d9368d870bee0d33865a104039e7eba0c6146aa39ca53694af487be02c34b58606f90a0c42c2c98b93440f620f9dcda8336536293cd889fe5eb0f6bd7a3c17bc836f864bd519af912a320ad4b15dccbaaf033465e8c02a0fd68eb137d0ed71e3781d78055f033be36835ad914e2325495d10382198a62724cb05e29d87c3b8f718a9d3541002e3c2de2c4e58d462c2e215f896f768ed8dbad99d1adc67197c090424c4b6078e4c72f9dcbfab24dfb3ddf587cf47f75629c759fc5080a8059ca6c05228aca7e94fd4bbe0a424237d6c8945a5381baaa672d9c68f97cd4d7c15daa489bc3debcf598b52c060a2ea87e42c2c0a1f0caadaf698954679390920f1f4f319b3fa6236bf3d79b4fc66df6b9cbce591cb321b4be888afcf6a8308de167afac72d5d9521cbbe0f483249cbc1b39165b23044707fe0ece82e6188871dc19d8ffb300781df8aea95215c5417ee2cd9442d43ed659cc15b86470b83ad44f2232a446d2cd21e208be98ac52e0a30f381b86fbcfd93bd053353821331befddb5c090a8f3d6531669b894a850eea25464138d715ea36bf4ea217184bc65bb1a715449f9d4125f016301cb407806bf58b6482abdec4cd4"}) syz_usb_control_io$hid(r2, 0x0, 0x0) r10 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4}, &(0x7f00000000c0)=0x1c, 0x80000) sendto$inet6(r10, &(0x7f0000000100)="63b35feae4ce6c8bdee919d60cb0f90900000072dbc16b8a582ea6ad12d83b98e96f298058063f94e51de8d11c2904661a1b6869e9aa388cab52cc926cf048", 0x3f, 0x0, &(0x7f0000000180)={0xa, 0x4e20, 0x7ff, @dev={0xfe, 0x80, '\x00', 0x3c}, 0x6}, 0x1c) syz_usb_control_io$hid(r2, &(0x7f0000001200)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="002228000000b350360009176f4044e6a3"], 0x0}, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x71, 0x80, 0xe4, 0x40, 0x781, 0x2, 0x9, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x1, 0x7, 0x20, 0x7, "", [{{0x9, 0x4, 0x5, 0x6, 0x0, 0xe, 0x8e, 0x59, 0x8}}]}}]}}, &(0x7f0000001040)={0x0, 0x0, 0x0, 0x0}) creat(&(0x7f0000000040)='./bus\x00', 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$PPPIOCGCHAN-socket$nl_route-bpf$PROG_LOAD-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$sock_SIOCGIFINDEX-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-bpf$PROG_BIND_MAP-unshare-unshare-gettid-syz_clone-socket$inet_tcp-socket$inet_tcp-ioctl$sock_SIOCGIFINDEX-ioctl$sock_SIOCGIFINDEX-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-socket-sendmsg$nl_route detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x13, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000020000000000000000000000018010000202070250000000000202020730af9ff00000000bda100000000000007010000f8ffffffb702000008000000b703000000000000850000000500000018010000202070250000000000202020db1af8ff00000000bfa10000e7ffffff0500000000000000b702000008000000b70300000000000085000000060000009500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) (async) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6_vti0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000002d00000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) (async) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) unshare(0x64000600) (async) unshare(0x64000600) gettid() syz_clone(0x42164000, 0x0, 0x0, 0x0, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) (async) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x7, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000000010000000000000000000018110000", @ANYRES64=r6, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', r8, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r9, r8, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x2e, &(0x7f0000001cc0)=ANY=[@ANYBLOB="0180c2000002bbbbbbbbbbbb0800450000200000100000119078000000000000000000004e22000c9078810c0000"], 0x0) r10 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000a40)=ANY=[@ANYBLOB="3c0000620ac9162b97b4496e4c4f3f0010000308001000e0ffffff0000000000b907ffec58e2347fb1223e684d7d0de59b4a", @ANYRES16=r9, @ANYRES32=r2, @ANYRESOCT, @ANYBLOB="96625c7f29388a442d9619615292ea16e0416ee9ff400d95ec315d00992fe71969ceb0cf17d45e3ade2c8bed616905ffda75967daa9e2c5f3a38730a3a9c34d83bf44e867efd8ba82a98f64312f16e76eeb7a5583351b2ae95ba794ddf0ffa765f21f91c2ea20d34216fc6c0702339d9afe686284348b4cd84cf15a1bf6ac532b556016120fe5978b1a5ec22559cbee434d6973d813df5bae75728d1f2a19adeca8023e5aa75d042017fa453bf576d765369cc1c0013e7ef5ff14a334625d32261a24d5cc6d1235986b6ce3d6b0f9f60ff0332022999cd4d4c486427d1dad0a141bd606d286b20ee6ef1499649da254e8d4e619829d2efd0c3601cdbc3162ba74bcdeaa1a5fcd384630fa631b042514b297adae1505ebefe7a524953b0f37a8cf20bd0424a94d096f8f30d32a1fcc9891e107e539c74787426449b6e97981c33a20e9364198f6153d2028ee5980683575745e92b298df406c64d2f20984480d10b"], 0x3c}, 0x1, 0x0, 0x0, 0x4802}, 0x42850) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work single: successfully extracted reproducer found reproducer with 40 syscalls minimizing guilty program testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$PPPIOCGCHAN-socket$nl_route-bpf$PROG_LOAD-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$sock_SIOCGIFINDEX-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-bpf$PROG_BIND_MAP-unshare-unshare-gettid-syz_clone-socket$inet_tcp-socket$inet_tcp-ioctl$sock_SIOCGIFINDEX-ioctl$sock_SIOCGIFINDEX-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet-socket detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x13, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000020000000000000000000000018010000202070250000000000202020730af9ff00000000bda100000000000007010000f8ffffffb702000008000000b703000000000000850000000500000018010000202070250000000000202020db1af8ff00000000bfa10000e7ffffff0500000000000000b702000008000000b70300000000000085000000060000009500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) (async) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6_vti0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000002d00000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) (async) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) unshare(0x64000600) (async) unshare(0x64000600) gettid() syz_clone(0x42164000, 0x0, 0x0, 0x0, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) (async) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x7, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000000010000000000000000000018110000", @ANYRES64=r6, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', r8, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r9, r8, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x2e, &(0x7f0000001cc0)=ANY=[@ANYBLOB="0180c2000002bbbbbbbbbbbb0800450000200000100000119078000000000000000000004e22000c9078810c0000"], 0x0) socket(0x10, 0x803, 0x0) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$PPPIOCGCHAN-socket$nl_route-bpf$PROG_LOAD-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$sock_SIOCGIFINDEX-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-bpf$PROG_BIND_MAP-unshare-unshare-gettid-syz_clone-socket$inet_tcp-socket$inet_tcp-ioctl$sock_SIOCGIFINDEX-ioctl$sock_SIOCGIFINDEX-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_LINK_CREATE_XDP-syz_emit_ethernet detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x13, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000020000000000000000000000018010000202070250000000000202020730af9ff00000000bda100000000000007010000f8ffffffb702000008000000b703000000000000850000000500000018010000202070250000000000202020db1af8ff00000000bfa10000e7ffffff0500000000000000b702000008000000b70300000000000085000000060000009500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) (async) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6_vti0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000002d00000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) (async) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) unshare(0x64000600) (async) unshare(0x64000600) gettid() syz_clone(0x42164000, 0x0, 0x0, 0x0, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) (async) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x7, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000000010000000000000000000018110000", @ANYRES64=r6, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', r8, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r9, r8, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x2e, &(0x7f0000001cc0)=ANY=[@ANYBLOB="0180c2000002bbbbbbbbbbbb0800450000200000100000119078000000000000000000004e22000c9078810c0000"], 0x0) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$PPPIOCGCHAN-socket$nl_route-bpf$PROG_LOAD-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$sock_SIOCGIFINDEX-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-bpf$PROG_BIND_MAP-unshare-unshare-gettid-syz_clone-socket$inet_tcp-socket$inet_tcp-ioctl$sock_SIOCGIFINDEX-ioctl$sock_SIOCGIFINDEX-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_LINK_CREATE_XDP detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x13, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000020000000000000000000000018010000202070250000000000202020730af9ff00000000bda100000000000007010000f8ffffffb702000008000000b703000000000000850000000500000018010000202070250000000000202020db1af8ff00000000bfa10000e7ffffff0500000000000000b702000008000000b70300000000000085000000060000009500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) (async) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6_vti0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000002d00000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) (async) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) unshare(0x64000600) (async) unshare(0x64000600) gettid() syz_clone(0x42164000, 0x0, 0x0, 0x0, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) (async) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x7, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000000010000000000000000000018110000", @ANYRES64=r6, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', r8, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r9, r8, 0x25, 0x0, @void}, 0x10) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$PPPIOCGCHAN-socket$nl_route-bpf$PROG_LOAD-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$sock_SIOCGIFINDEX-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-bpf$PROG_BIND_MAP-unshare-unshare-gettid-syz_clone-socket$inet_tcp-socket$inet_tcp-ioctl$sock_SIOCGIFINDEX-ioctl$sock_SIOCGIFINDEX-bpf$MAP_CREATE-bpf$PROG_LOAD detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x13, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000020000000000000000000000018010000202070250000000000202020730af9ff00000000bda100000000000007010000f8ffffffb702000008000000b703000000000000850000000500000018010000202070250000000000202020db1af8ff00000000bfa10000e7ffffff0500000000000000b702000008000000b70300000000000085000000060000009500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) (async) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6_vti0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000002d00000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) (async) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) unshare(0x64000600) (async) unshare(0x64000600) gettid() syz_clone(0x42164000, 0x0, 0x0, 0x0, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) (async) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x7, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000000010000000000000000000018110000", @ANYRES64=r6, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', r8, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$PPPIOCGCHAN-socket$nl_route-bpf$PROG_LOAD-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$sock_SIOCGIFINDEX-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-bpf$PROG_BIND_MAP-unshare-unshare-gettid-syz_clone-socket$inet_tcp-socket$inet_tcp-ioctl$sock_SIOCGIFINDEX-ioctl$sock_SIOCGIFINDEX-bpf$MAP_CREATE detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x13, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000020000000000000000000000018010000202070250000000000202020730af9ff00000000bda100000000000007010000f8ffffffb702000008000000b703000000000000850000000500000018010000202070250000000000202020db1af8ff00000000bfa10000e7ffffff0500000000000000b702000008000000b70300000000000085000000060000009500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) (async) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6_vti0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000002d00000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) (async) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) unshare(0x64000600) (async) unshare(0x64000600) gettid() syz_clone(0x42164000, 0x0, 0x0, 0x0, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) (async) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$PPPIOCGCHAN-socket$nl_route-bpf$PROG_LOAD-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$sock_SIOCGIFINDEX-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-bpf$PROG_BIND_MAP-unshare-unshare-gettid-syz_clone-socket$inet_tcp-socket$inet_tcp-ioctl$sock_SIOCGIFINDEX-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x13, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000020000000000000000000000018010000202070250000000000202020730af9ff00000000bda100000000000007010000f8ffffffb702000008000000b703000000000000850000000500000018010000202070250000000000202020db1af8ff00000000bfa10000e7ffffff0500000000000000b702000008000000b70300000000000085000000060000009500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) (async) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6_vti0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000002d00000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) (async) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) unshare(0x64000600) (async) unshare(0x64000600) gettid() syz_clone(0x42164000, 0x0, 0x0, 0x0, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) (async) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$PPPIOCGCHAN-socket$nl_route-bpf$PROG_LOAD-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$sock_SIOCGIFINDEX-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-bpf$PROG_BIND_MAP-unshare-unshare-gettid-syz_clone-socket$inet_tcp-socket$inet_tcp-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x13, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000020000000000000000000000018010000202070250000000000202020730af9ff00000000bda100000000000007010000f8ffffffb702000008000000b703000000000000850000000500000018010000202070250000000000202020db1af8ff00000000bfa10000e7ffffff0500000000000000b702000008000000b70300000000000085000000060000009500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) (async) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6_vti0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000002d00000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) (async) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) unshare(0x64000600) (async) unshare(0x64000600) gettid() syz_clone(0x42164000, 0x0, 0x0, 0x0, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) (async) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$PPPIOCGCHAN-socket$nl_route-bpf$PROG_LOAD-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$sock_SIOCGIFINDEX-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-bpf$PROG_BIND_MAP-unshare-unshare-gettid-syz_clone-socket$inet_tcp-socket$inet_tcp detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x13, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000020000000000000000000000018010000202070250000000000202020730af9ff00000000bda100000000000007010000f8ffffffb702000008000000b703000000000000850000000500000018010000202070250000000000202020db1af8ff00000000bfa10000e7ffffff0500000000000000b702000008000000b70300000000000085000000060000009500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) (async) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6_vti0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000002d00000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) (async) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) unshare(0x64000600) (async) unshare(0x64000600) gettid() syz_clone(0x42164000, 0x0, 0x0, 0x0, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) (async) socket$inet_tcp(0x2, 0x1, 0x0) program did not crash testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$PPPIOCGCHAN-socket$nl_route-bpf$PROG_LOAD-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$sock_SIOCGIFINDEX-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-bpf$PROG_BIND_MAP-unshare-unshare-gettid-syz_clone-socket$inet_tcp-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x13, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000020000000000000000000000018010000202070250000000000202020730af9ff00000000bda100000000000007010000f8ffffffb702000008000000b703000000000000850000000500000018010000202070250000000000202020db1af8ff00000000bfa10000e7ffffff0500000000000000b702000008000000b70300000000000085000000060000009500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) (async) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6_vti0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000002d00000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) (async) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) unshare(0x64000600) (async) unshare(0x64000600) gettid() syz_clone(0x42164000, 0x0, 0x0, 0x0, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program crashed: KASAN: use-after-free Read in rcu_cblist_dequeue testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$PPPIOCGCHAN-socket$nl_route-bpf$PROG_LOAD-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$sock_SIOCGIFINDEX-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-bpf$PROG_BIND_MAP-unshare-unshare-gettid-syz_clone-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x13, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000020000000000000000000000018010000202070250000000000202020730af9ff00000000bda100000000000007010000f8ffffffb702000008000000b703000000000000850000000500000018010000202070250000000000202020db1af8ff00000000bfa10000e7ffffff0500000000000000b702000008000000b70300000000000085000000060000009500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) (async) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6_vti0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000002d00000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) (async) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) unshare(0x64000600) (async) unshare(0x64000600) gettid() syz_clone(0x42164000, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$PPPIOCGCHAN-socket$nl_route-bpf$PROG_LOAD-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$sock_SIOCGIFINDEX-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-bpf$PROG_BIND_MAP-unshare-unshare-gettid-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x13, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000020000000000000000000000018010000202070250000000000202020730af9ff00000000bda100000000000007010000f8ffffffb702000008000000b703000000000000850000000500000018010000202070250000000000202020db1af8ff00000000bfa10000e7ffffff0500000000000000b702000008000000b70300000000000085000000060000009500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) (async) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6_vti0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000002d00000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) (async) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) unshare(0x64000600) (async) unshare(0x64000600) gettid() ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$PPPIOCGCHAN-socket$nl_route-bpf$PROG_LOAD-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$sock_SIOCGIFINDEX-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-bpf$PROG_BIND_MAP-unshare-unshare-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x13, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000020000000000000000000000018010000202070250000000000202020730af9ff00000000bda100000000000007010000f8ffffffb702000008000000b703000000000000850000000500000018010000202070250000000000202020db1af8ff00000000bfa10000e7ffffff0500000000000000b702000008000000b70300000000000085000000060000009500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) (async) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6_vti0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000002d00000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) (async) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) unshare(0x64000600) (async) unshare(0x64000600) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$PPPIOCGCHAN-socket$nl_route-bpf$PROG_LOAD-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$sock_SIOCGIFINDEX-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-bpf$PROG_BIND_MAP-unshare-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x13, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000020000000000000000000000018010000202070250000000000202020730af9ff00000000bda100000000000007010000f8ffffffb702000008000000b703000000000000850000000500000018010000202070250000000000202020db1af8ff00000000bfa10000e7ffffff0500000000000000b702000008000000b70300000000000085000000060000009500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) (async) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6_vti0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000002d00000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) (async) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) unshare(0x64000600) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$PPPIOCGCHAN-socket$nl_route-bpf$PROG_LOAD-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$sock_SIOCGIFINDEX-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-bpf$PROG_BIND_MAP-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x13, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000020000000000000000000000018010000202070250000000000202020730af9ff00000000bda100000000000007010000f8ffffffb702000008000000b703000000000000850000000500000018010000202070250000000000202020db1af8ff00000000bfa10000e7ffffff0500000000000000b702000008000000b70300000000000085000000060000009500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) (async) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6_vti0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000002d00000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) (async) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$PPPIOCGCHAN-socket$nl_route-bpf$PROG_LOAD-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$sock_SIOCGIFINDEX-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$PROG_BIND_MAP-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x13, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000020000000000000000000000018010000202070250000000000202020730af9ff00000000bda100000000000007010000f8ffffffb702000008000000b703000000000000850000000500000018010000202070250000000000202020db1af8ff00000000bfa10000e7ffffff0500000000000000b702000008000000b70300000000000085000000060000009500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) (async) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6_vti0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000002d00000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r7}, 0xc) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$PPPIOCGCHAN-socket$nl_route-bpf$PROG_LOAD-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$sock_SIOCGIFINDEX-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$PROG_LOAD-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x13, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000020000000000000000000000018010000202070250000000000202020730af9ff00000000bda100000000000007010000f8ffffffb702000008000000b703000000000000850000000500000018010000202070250000000000202020db1af8ff00000000bfa10000e7ffffff0500000000000000b702000008000000b70300000000000085000000060000009500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) (async) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6_vti0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000002d00000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$PPPIOCGCHAN-socket$nl_route-bpf$PROG_LOAD-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$sock_SIOCGIFINDEX-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_CREATE-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x13, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000020000000000000000000000018010000202070250000000000202020730af9ff00000000bda100000000000007010000f8ffffffb702000008000000b703000000000000850000000500000018010000202070250000000000202020db1af8ff00000000bfa10000e7ffffff0500000000000000b702000008000000b70300000000000085000000060000009500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) (async) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6_vti0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$PPPIOCGCHAN-socket$nl_route-bpf$PROG_LOAD-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$sock_SIOCGIFINDEX-bpf$MAP_CREATE-bpf$MAP_CREATE-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x13, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000020000000000000000000000018010000202070250000000000202020730af9ff00000000bda100000000000007010000f8ffffffb702000008000000b703000000000000850000000500000018010000202070250000000000202020db1af8ff00000000bfa10000e7ffffff0500000000000000b702000008000000b70300000000000085000000060000009500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) (async) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6_vti0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$PPPIOCGCHAN-socket$nl_route-bpf$PROG_LOAD-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$sock_SIOCGIFINDEX-bpf$MAP_CREATE-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x13, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000020000000000000000000000018010000202070250000000000202020730af9ff00000000bda100000000000007010000f8ffffffb702000008000000b703000000000000850000000500000018010000202070250000000000202020db1af8ff00000000bfa10000e7ffffff0500000000000000b702000008000000b70300000000000085000000060000009500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) (async) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6_vti0\x00'}) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="0b00000007000000080000000800000005000000", @ANYRES32, @ANYBLOB="c8c9000000000000000400bfdf63bbcd8c000000000000400000a1dd3eb3433c338b25cd944690986f3450031748af83e17d9c38466f5ce4b1231af754443ad8aaa85ac03ace9fa88b2a4841f7c6510429a32a5783fd0a7371c4c1289294f7f2562c95a7179c6782d7b953cdbf1a7529b67bd65f3dd3bab28289a8eed2ec38c47cb95e000e9231f2d9acf050c0317e515f37162be1b0a66a85f97434a40e5d043c4768330801487191a47dc2bdd702695a2e842df584a47270b2efdf1da68e9e0998848e41909334682a9ba84ae0d515cc5eeddf361ee2898b93fda61cbb84a1856beec67fa0f2da13248ef97f27de30e254878a00d78ce544ad2f0eee311f74f96e50fac4f13217", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$PPPIOCGCHAN-socket$nl_route-bpf$PROG_LOAD-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$sock_SIOCGIFINDEX-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x13, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000020000000000000000000000018010000202070250000000000202020730af9ff00000000bda100000000000007010000f8ffffffb702000008000000b703000000000000850000000500000018010000202070250000000000202020db1af8ff00000000bfa10000e7ffffff0500000000000000b702000008000000b70300000000000085000000060000009500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) (async) sendmsg$nl_route_sched(r4, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6_vti0\x00'}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$PPPIOCGCHAN-socket$nl_route-bpf$PROG_LOAD-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x13, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000020000000000000000000000018010000202070250000000000202020730af9ff00000000bda100000000000007010000f8ffffffb702000008000000b703000000000000850000000500000018010000202070250000000000202020db1af8ff00000000bfa10000e7ffffff0500000000000000b702000008000000b70300000000000085000000060000009500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) (async) sendmsg$nl_route_sched(r3, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$PPPIOCGCHAN-socket$nl_route-bpf$PROG_LOAD-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x13, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000020000000000000000000000018010000202070250000000000202020730af9ff00000000bda100000000000007010000f8ffffffb702000008000000b703000000000000850000000500000018010000202070250000000000202020db1af8ff00000000bfa10000e7ffffff0500000000000000b702000008000000b70300000000000085000000060000009500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000006840)=@newtfilter={0x44, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0xc, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x1a87b}, @TCA_FLOW_MODE={0x8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20041090}, 0x874) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$PPPIOCGCHAN-socket$nl_route-bpf$PROG_LOAD-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x13, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000020000000000000000000000018010000202070250000000000202020730af9ff00000000bda100000000000007010000f8ffffffb702000008000000b703000000000000850000000500000018010000202070250000000000202020db1af8ff00000000bfa10000e7ffffff0500000000000000b702000008000000b70300000000000085000000060000009500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$PPPIOCGCHAN-socket$nl_route-bpf$PROG_LOAD-socket-ioctl$sock_SIOCGIFINDEX-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x13, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000020000000000000000000000018010000202070250000000000202020730af9ff00000000bda100000000000007010000f8ffffffb702000008000000b703000000000000850000000500000018010000202070250000000000202020db1af8ff00000000bfa10000e7ffffff0500000000000000b702000008000000b70300000000000085000000060000009500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00'}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$PPPIOCGCHAN-socket$nl_route-bpf$PROG_LOAD-socket-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x13, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000020000000000000000000000018010000202070250000000000202020730af9ff00000000bda100000000000007010000f8ffffffb702000008000000b703000000000000850000000500000018010000202070250000000000202020db1af8ff00000000bfa10000e7ffffff0500000000000000b702000008000000b70300000000000085000000060000009500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$PPPIOCGCHAN-socket$nl_route-bpf$PROG_LOAD-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x13, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000020000000000000000000000018010000202070250000000000202020730af9ff00000000bda100000000000007010000f8ffffffb702000008000000b703000000000000850000000500000018010000202070250000000000202020db1af8ff00000000bfa10000e7ffffff0500000000000000b702000008000000b70300000000000085000000060000009500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$PPPIOCGCHAN-socket$nl_route-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$PPPIOCGCHAN-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, 0x0) ioctl$PPPIOCGCHAN(r0, 0x80047437, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-socket$inet6_udp-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program did not crash testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program did not crash testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-sendmsg$key-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020d00000a0000000000174700000000000005000600000000000a00008000000000fc0100000000000000000000000000000000000000000000030005000000000002004e220a0101010000000000000000"], 0x50}}, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$key-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) socket$key(0xf, 0x3, 0x2) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$key-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$key(0xf, 0x3, 0x2) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r0, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program did not crash testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYBLOB="1201000000000040c41090ea800000000001090224000100000000090400000103000000092100000001220700090581"], 0x0) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program crashed: KASAN: use-after-free Write in rcu_segcblist_enqueue testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'wg2\x00'}) program did not crash testing program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session extracting C reproducer testing compiled C program (duration=35.544686358s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCGIFINDEX program crashed: KASAN: use-after-free Write in pppol2tp_release simplifying C reproducer testing compiled C program (duration=35.544686358s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCGIFINDEX program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=35.544686358s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCGIFINDEX program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=35.544686358s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCGIFINDEX program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=35.544686358s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCGIFINDEX program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=35.544686358s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCGIFINDEX program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=35.544686358s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCGIFINDEX program did not crash testing program (duration=35.544686358s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release validation run: crashed=true testing program (duration=35.544686358s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release validation run: crashed=true testing program (duration=35.544686358s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release validation run: crashed=true reproducing took 44m29.317310531s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: use-after-free in atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline] BUG: KASAN: use-after-free in atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline] BUG: KASAN: use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:173 [inline] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298 Write of size 8 at addr ffff88811159cd50 by task syz.2.17/390 CPU: 0 PID: 390 Comm: syz.2.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:77 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:435 [inline] kasan_report+0x100/0x140 mm/kasan/report.c:452 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline] atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline] __mutex_trylock_fast kernel/locking/mutex.c:173 [inline] mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298 pppol2tp_release+0x178/0x2b0 net/l2tp/l2tp_ppp.c:442 __sock_release net/socket.c:597 [inline] sock_close+0xb8/0x200 net/socket.c:1286 __fput+0x2dc/0x730 fs/file_table.c:281 ____fput+0x15/0x20 fs/file_table.c:314 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f7e0c1dfe59 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffee9757d28 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffee9757e10 RCX: 00007f7e0c1dfe59 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 0000000000006cab R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b32b20000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f7e0c458fac R14: 00007f7e0c458fa8 R15: 00007f7e0c458fa0 Allocated by task 390: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:430 [inline] ____kasan_kmalloc mm/kasan/common.c:509 [inline] __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:518 kasan_kmalloc include/linux/kasan.h:254 [inline] __kmalloc+0x19f/0x330 mm/slub.c:4038 kmalloc include/linux/slab.h:560 [inline] kzalloc include/linux/slab.h:667 [inline] l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772 __sys_connect_file net/socket.c:1866 [inline] __sys_connect+0x3ce/0x450 net/socket.c:1883 __do_sys_connect net/socket.c:1893 [inline] __se_sys_connect net/socket.c:1890 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:1890 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xcb Freed by task 390: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4a/0x70 mm/kasan/common.c:45 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:362 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370 kasan_slab_free include/linux/kasan.h:220 [inline] slab_free_hook mm/slub.c:1600 [inline] slab_free_freelist_hook+0xc5/0x190 mm/slub.c:1626 slab_free mm/slub.c:3208 [inline] kfree+0xc0/0x270 mm/slub.c:4196 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline] l2tp_session_put+0xb2/0x1a0 net/l2tp/l2tp_core.c:193 l2tp_session_delete+0x3a9/0x4a0 net/l2tp/l2tp_core.c:1589 pppol2tp_release+0x169/0x2b0 net/l2tp/l2tp_ppp.c:439 __sock_release net/socket.c:597 [inline] sock_close+0xb8/0x200 net/socket.c:1286 __fput+0x2dc/0x730 fs/file_table.c:281 ____fput+0x15/0x20 fs/file_table.c:314 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb The buggy address belongs to the object at ffff88811159cc00 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 336 bytes inside of 512-byte region [ffff88811159cc00, ffff88811159ce00) The buggy address belongs to the page: page:ffffea0004456700 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11159c head:ffffea0004456700 order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head) raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 364, ts 27831801510, free_ts 27804357325 set_page_owner include/linux/page_owner.h:35 [inline] post_alloc_hook mm/page_alloc.c:2456 [inline] prep_new_page+0x176/0x190 mm/page_alloc.c:2462 get_page_from_freelist+0x225f/0x23f0 mm/page_alloc.c:4254 __alloc_pages_nodemask+0x29a/0x640 mm/page_alloc.c:5384 alloc_slab_page mm/slub.c:-1 [inline] allocate_slab mm/slub.c:1813 [inline] new_slab+0x84/0x3f0 mm/slub.c:1874 new_slab_objects mm/slub.c:2632 [inline] ___slab_alloc+0x2f8/0x4c0 mm/slub.c:2796 __slab_alloc+0x63/0xa0 mm/slub.c:2836 slab_alloc_node mm/slub.c:2918 [inline] slab_alloc mm/slub.c:2960 [inline] kmem_cache_alloc_trace+0x1a8/0x2e0 mm/slub.c:2977 kmem_cache_alloc_node_trace include/linux/slab.h:443 [inline] kmalloc_node include/linux/slab.h:573 [inline] kzalloc_node include/linux/slab.h:678 [inline] alloc_fair_sched_group+0x1f2/0x6d0 kernel/sched/fair.c:11472 sched_create_group+0x42/0x230 kernel/sched/core.c:7869 cpu_cgroup_css_alloc+0xe/0x30 kernel/sched/core.c:8008 css_create kernel/cgroup/cgroup.c:5363 [inline] cgroup_apply_control_enable+0x338/0x12b0 kernel/cgroup/cgroup.c:3219 cgroup_mkdir+0x143c/0x16d0 kernel/cgroup/cgroup.c:5595 kernfs_iop_mkdir+0x1a3/0x2b0 fs/kernfs/dir.c:1194 vfs_mkdir+0x42c/0x600 fs/namei.c:3798 do_mkdirat+0x14c/0x340 fs/namei.c:3820 __do_sys_mkdirat fs/namei.c:3831 [inline] __se_sys_mkdirat fs/namei.c:3829 [inline] __x64_sys_mkdirat+0x7b/0x90 fs/namei.c:3829 page last free stack trace: reset_page_owner include/linux/page_owner.h:28 [inline] free_pages_prepare mm/page_alloc.c:1349 [inline] __free_pages_ok+0x80b/0x830 mm/page_alloc.c:1629 free_the_page mm/page_alloc.c:5445 [inline] __free_pages+0xd8/0x390 mm/page_alloc.c:5454 __free_slab+0xcf/0x190 mm/slub.c:1899 free_slab mm/slub.c:1914 [inline] discard_slab mm/slub.c:1920 [inline] unfreeze_partials+0x150/0x180 mm/slub.c:2415 put_cpu_partial+0xc1/0x180 mm/slub.c:2451 __slab_free+0x2c9/0x3a0 mm/slub.c:3100 do_slab_free mm/slub.c:3196 [inline] ___cache_free+0x10e/0x130 mm/slub.c:3215 qlink_free+0x50/0x90 mm/kasan/quarantine.c:157 qlist_free_all+0x5f/0xb0 mm/kasan/quarantine.c:176 kasan_quarantine_reduce+0x14a/0x160 mm/kasan/quarantine.c:283 __kasan_slab_alloc+0x2f/0xe0 mm/kasan/common.c:440 kasan_slab_alloc include/linux/kasan.h:244 [inline] slab_post_alloc_hook+0x5d/0x2f0 mm/slab.h:580 slab_alloc_node mm/slub.c:2952 [inline] slab_alloc mm/slub.c:2960 [inline] kmem_cache_alloc+0x15a/0x2d0 mm/slub.c:2965 kmem_cache_alloc_node include/linux/slab.h:426 [inline] __alloc_skb+0x9e/0x520 net/core/skbuff.c:200 alloc_skb include/linux/skbuff.h:1126 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1178 [inline] netlink_sendmsg+0x693/0xb70 net/netlink/af_netlink.c:1889 sock_sendmsg_nosec net/socket.c:652 [inline] __sock_sendmsg net/socket.c:664 [inline] __sys_sendto+0x467/0x620 net/socket.c:2006 Memory state around the buggy address: ffff88811159cc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88811159cc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88811159cd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88811159cd80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88811159ce00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: use-after-free in atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline] BUG: KASAN: use-after-free in atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline] BUG: KASAN: use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:173 [inline] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298 Write of size 8 at addr ffff88811159cd50 by task syz.2.17/390 CPU: 0 PID: 390 Comm: syz.2.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:77 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:435 [inline] kasan_report+0x100/0x140 mm/kasan/report.c:452 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline] atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline] __mutex_trylock_fast kernel/locking/mutex.c:173 [inline] mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298 pppol2tp_release+0x178/0x2b0 net/l2tp/l2tp_ppp.c:442 __sock_release net/socket.c:597 [inline] sock_close+0xb8/0x200 net/socket.c:1286 __fput+0x2dc/0x730 fs/file_table.c:281 ____fput+0x15/0x20 fs/file_table.c:314 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f7e0c1dfe59 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffee9757d28 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffee9757e10 RCX: 00007f7e0c1dfe59 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 0000000000006cab R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b32b20000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f7e0c458fac R14: 00007f7e0c458fa8 R15: 00007f7e0c458fa0 Allocated by task 390: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:430 [inline] ____kasan_kmalloc mm/kasan/common.c:509 [inline] __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:518 kasan_kmalloc include/linux/kasan.h:254 [inline] __kmalloc+0x19f/0x330 mm/slub.c:4038 kmalloc include/linux/slab.h:560 [inline] kzalloc include/linux/slab.h:667 [inline] l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772 __sys_connect_file net/socket.c:1866 [inline] __sys_connect+0x3ce/0x450 net/socket.c:1883 __do_sys_connect net/socket.c:1893 [inline] __se_sys_connect net/socket.c:1890 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:1890 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xcb Freed by task 390: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4a/0x70 mm/kasan/common.c:45 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:362 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370 kasan_slab_free include/linux/kasan.h:220 [inline] slab_free_hook mm/slub.c:1600 [inline] slab_free_freelist_hook+0xc5/0x190 mm/slub.c:1626 slab_free mm/slub.c:3208 [inline] kfree+0xc0/0x270 mm/slub.c:4196 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline] l2tp_session_put+0xb2/0x1a0 net/l2tp/l2tp_core.c:193 l2tp_session_delete+0x3a9/0x4a0 net/l2tp/l2tp_core.c:1589 pppol2tp_release+0x169/0x2b0 net/l2tp/l2tp_ppp.c:439 __sock_release net/socket.c:597 [inline] sock_close+0xb8/0x200 net/socket.c:1286 __fput+0x2dc/0x730 fs/file_table.c:281 ____fput+0x15/0x20 fs/file_table.c:314 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb The buggy address belongs to the object at ffff88811159cc00 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 336 bytes inside of 512-byte region [ffff88811159cc00, ffff88811159ce00) The buggy address belongs to the page: page:ffffea0004456700 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11159c head:ffffea0004456700 order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head) raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 364, ts 27831801510, free_ts 27804357325 set_page_owner include/linux/page_owner.h:35 [inline] post_alloc_hook mm/page_alloc.c:2456 [inline] prep_new_page+0x176/0x190 mm/page_alloc.c:2462 get_page_from_freelist+0x225f/0x23f0 mm/page_alloc.c:4254 __alloc_pages_nodemask+0x29a/0x640 mm/page_alloc.c:5384 alloc_slab_page mm/slub.c:-1 [inline] allocate_slab mm/slub.c:1813 [inline] new_slab+0x84/0x3f0 mm/slub.c:1874 new_slab_objects mm/slub.c:2632 [inline] ___slab_alloc+0x2f8/0x4c0 mm/slub.c:2796 __slab_alloc+0x63/0xa0 mm/slub.c:2836 slab_alloc_node mm/slub.c:2918 [inline] slab_alloc mm/slub.c:2960 [inline] kmem_cache_alloc_trace+0x1a8/0x2e0 mm/slub.c:2977 kmem_cache_alloc_node_trace include/linux/slab.h:443 [inline] kmalloc_node include/linux/slab.h:573 [inline] kzalloc_node include/linux/slab.h:678 [inline] alloc_fair_sched_group+0x1f2/0x6d0 kernel/sched/fair.c:11472 sched_create_group+0x42/0x230 kernel/sched/core.c:7869 cpu_cgroup_css_alloc+0xe/0x30 kernel/sched/core.c:8008 css_create kernel/cgroup/cgroup.c:5363 [inline] cgroup_apply_control_enable+0x338/0x12b0 kernel/cgroup/cgroup.c:3219 cgroup_mkdir+0x143c/0x16d0 kernel/cgroup/cgroup.c:5595 kernfs_iop_mkdir+0x1a3/0x2b0 fs/kernfs/dir.c:1194 vfs_mkdir+0x42c/0x600 fs/namei.c:3798 do_mkdirat+0x14c/0x340 fs/namei.c:3820 __do_sys_mkdirat fs/namei.c:3831 [inline] __se_sys_mkdirat fs/namei.c:3829 [inline] __x64_sys_mkdirat+0x7b/0x90 fs/namei.c:3829 page last free stack trace: reset_page_owner include/linux/page_owner.h:28 [inline] free_pages_prepare mm/page_alloc.c:1349 [inline] __free_pages_ok+0x80b/0x830 mm/page_alloc.c:1629 free_the_page mm/page_alloc.c:5445 [inline] __free_pages+0xd8/0x390 mm/page_alloc.c:5454 __free_slab+0xcf/0x190 mm/slub.c:1899 free_slab mm/slub.c:1914 [inline] discard_slab mm/slub.c:1920 [inline] unfreeze_partials+0x150/0x180 mm/slub.c:2415 put_cpu_partial+0xc1/0x180 mm/slub.c:2451 __slab_free+0x2c9/0x3a0 mm/slub.c:3100 do_slab_free mm/slub.c:3196 [inline] ___cache_free+0x10e/0x130 mm/slub.c:3215 qlink_free+0x50/0x90 mm/kasan/quarantine.c:157 qlist_free_all+0x5f/0xb0 mm/kasan/quarantine.c:176 kasan_quarantine_reduce+0x14a/0x160 mm/kasan/quarantine.c:283 __kasan_slab_alloc+0x2f/0xe0 mm/kasan/common.c:440 kasan_slab_alloc include/linux/kasan.h:244 [inline] slab_post_alloc_hook+0x5d/0x2f0 mm/slab.h:580 slab_alloc_node mm/slub.c:2952 [inline] slab_alloc mm/slub.c:2960 [inline] kmem_cache_alloc+0x15a/0x2d0 mm/slub.c:2965 kmem_cache_alloc_node include/linux/slab.h:426 [inline] __alloc_skb+0x9e/0x520 net/core/skbuff.c:200 alloc_skb include/linux/skbuff.h:1126 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1178 [inline] netlink_sendmsg+0x693/0xb70 net/netlink/af_netlink.c:1889 sock_sendmsg_nosec net/socket.c:652 [inline] __sock_sendmsg net/socket.c:664 [inline] __sys_sendto+0x467/0x620 net/socket.c:2006 Memory state around the buggy address: ffff88811159cc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88811159cc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88811159cd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88811159cd80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88811159ce00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================