Extracting prog: 3m6.322192572s Minimizing prog: 16m23.157295367s Simplifying prog options: 0s Extracting C: 33.963202776s Simplifying C: 3m0.536555496s extracting reproducer from 44 programs testing a last program of every proc single: executing 9 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$packet-syz_open_procfs-setpriority-timer_create-fcntl$lock-mprotect-bpf$TOKEN_CREATE-bpf$BPF_PROG_TEST_RUN-bpf$BPF_PROG_TEST_RUN-socket$inet6_icmp_raw-setsockopt-timer_settime-close_range-bpf$PROG_LOAD-socket$inet_udp-dup2-bind$inet-sendto$inet-recvfrom$inet detailed listing: executing program 0: r0 = socket$packet(0x11, 0x2, 0x300) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ptype\x00') setpriority(0x0, 0x0, 0x2a14b58) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) bpf$TOKEN_CREATE(0x24, &(0x7f0000000080)={0x0, r0}, 0x8) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000540)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2006}, 0x50) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001800)={r1, 0x0, 0x1e, 0x88, &(0x7f0000000000)="805dd455cc2008dc6ba4090ea38ac9bf6ba91286a1dfeff7f7fe9046dee1", &(0x7f0000000240)=""/136, 0x8, 0x0, 0x66, 0x1000, &(0x7f0000000340)="dd33a2a8436d602f712c3c7a86aefe64236c1f399ab2565d29310da83ef50ded90a879a0615b3a3dec28053fb574515a5bd04750cc9d1d03af528432d43e7bc810ebd760f324f7da9d0971f98dbe1fda94103c51414e0db170391b29a812f1f96dc85edde2d8", &(0x7f0000000800)="3f89de6f53a2471c2660e277eb1b2c837782319b1434924f4ace8bf8f756d5a8a29df6e035621dfeaa1d365b96540c1db88f2d92e491ff7c8f6a21e9cd3924a532181019cfdc17656365c8dd0fa1d80670727711e866796b78630c07799c26cdb41f3c8be1b13e8d6a9814036ee4f344deff79fe1db96b1923851b38fea55832be8c650f3be3309d332b506e36b0c2f22fccad22841ad8fc536864adf29a6812be67211ed48f7dd84a5e1fff47af99c84659d32f78d99b69ef246cd427ed2a85463ec64b5ecd44470003a91f710e2831187c715dec1bbe4d0a20fed25ec3f61f984c08551b84de0bcfda318a472592984950f62fef96a915026a553241dc9d85fe5f1adc7b653c59a425f408673bbc5f7141e181d7412d1236e088c2f01901610bed89a4f533968057d6f35d65571f2ed29ddac08715ef4248c237a6f9c698e9edca1b07b4b4d03a1701b50ea34f45f40bda0fc0de4ba8092e87f7e3f2d2b0cd14b38938acbe66f8ede4cf5f11dbb4db5ad2650229869e595a5fdd88996e828480b02c1e14f450b55c62b59c482fc4fdcd4103844ff047f69c87a12d5101de96d8c2d0cdfde4ca38dc9afa107577897682c9b33a9bc91c262e58fc5ab5a069e613d4f6554010298c32a22af2d1456d885a9c0ae7533b39e9500fa634e9317ad2439e1d514ce313bcdd51fee0ae9d4b4c83d0ee5d2a826212ae781d9eea7797bed4c3d6a42d54b915343c0507899f06ce93a79d10ea68f5e4d245864f42a428e564b1f755d3329dfd5a86ac26e0f4c854e53ec1c81fbe448157b8ca18543ff5299fcc2a98e061a9ff7f990385b4aa37d20416722df8ad229899f4e48dc97919857de94a62622568ce6910fee2ff1f552750454f9e6d3e0eb1c779dcc6b6e783567851b29b654685487790bb73dca68b3a13ad4211b01471e01f7e4b82d66dd4f716dd5ad2606655ab5b6464b1ce2a074f0850d4b9337650439ce8a173ac9c443d96be5594ecda5687be425b6a3fa8e547e68cd3130eac2a4d124dda28982a772c15bfac46ca83d96c14a17edde5ab23a99ef0c1a26c25e0672442fef17a16af09b4a5efc3eca85bac70ce77644e843fde18a8f34f7ec9bda839a0112cf5b4254d0d59f3fcdd2eb0f5e87c64f85e6bd54061d50ee3719180a81d59580be9d61361a0ee93dd4dfec9135b8942123ee7d73e7995fb1a2e8976ab6ad4cc4561513036321ef3ed923407c7bd8dfd4bc985d88bc65e6b22a38f389eaff2d3effc00806115dae944d203be6587bbd6411dd51556f453123ab05489cd0bae37b43a758f79042eb5f7c5804e88e2d58cefd21b61e0d2259d381e08708333534857837ff71b02928880789a6f3d276c47b34f60779f0ffbc07f1b8a33b1e69ccbf4d8c12c65f713abe8085f6187afc7e923575d28446d1943fc36127975f3b6cfd0dec441fc6c6ebebe86365ebc011f527468038d31d367df8a8c09ce89046c282c05b76b52b30efd345fa755f04a6493e271633d7fe918404637161801048fb14e29d83d19de7f275bc7854e5df91c3907a8352396328e4bbe5faf10788b79272d89d5a6ac02503a296ee89fabe86fdc56e56820c3ddcf2edd568719d90c44dd40f0f16b3d3dbeb43e55408d92245c18b3e3c454669fd6a209031685161d52d42b8112ffb5221febf29c5a5408670e34ec5e7148938f775cada5e818e77dc6625569eca0dec91d87ff5e86d7da9431354776d8a648615131f5bf864c37b70432fd9bd3b7f0f1c29726c5a0d3ab42a10fa89b63fc40133a245bfc793f8105fb4abf902c543e22c8eca4628bbed5d958679efae5134a4c4128f235d67afba5a393ff11ad4123f029fccb64e3908dcc5fd767d5eafe51df86220ce08af5683d258c2c0de88f533e965e0bca10822da2836c97f94d82dc0a9f219381a7ec729ff80db31e583fd73b21523867ba5b814603de75b2c9b3be54f59fb8f22c90d94cf99bd10b0ab52d1dd1cc0b0c067d0256713c3cabc532cc134ca226d0d5e9abeb7d67028af626f55433b4f007cd2ae19f606412125851784a1e391a7c1306bedd3354963e8fa77ab28364eee2acb0d6757a122bdb4277673d353f2b8f962587cc68213148f73abc224b9603f97eebd4f38d4650d3b02aac4303fd487a4f6dde5a7956491e2add006fc831eadb4b01225691ea1ddbf10c2764c0010aadd30ff12821afeb1df20116ddd4c2a08da514a167ec57e260884c511fb1a81755989477299754af290250f6658b6e2a6c4211a52f2748e489352dfc6c8292941e448575e472534b5b3b49ef4bc85ea8cae064ee92f26d76b7ab89123e1bacde41354460ed6f2fe42d1d1b66cd522aff60481cdb3ddfdc0c3448899e455e1803212508829208bf6515e9df114c3aa76aab1e32e2c724850f38ad8d5883a0f2139f1845b65bc78dede7b80553c98447a7021bbeee2db98a39fe5f52854ae060bb76fc86bc1a53ba021d467fb426f273956c1c2949e3e51c04f69d5dda93c454991a7e940926c7b9c763d2654ccb2ff599a2cf58d4ed8e66b4bb66be6c78cb76d7d2f4327ee8b8e654097bd0d644ecbf5f9185ada4235e6926c4c43a62680eca8127d9ddcba69aeaf2b518793d13b7d76eb72844d6183940ef132542643089e66ba3acc316a07ae7d811de744fc55927f520dc195fce4c104d316e85963073bb947f44db099225f17e23f8cf7a3b3ae611c1d1c310c0c4d704ce2c6ffbecef5f0b8a55b05900ca0ce9f5c39cc834a469e214a452aa05fe9fb9b297c5e9b16ece29119891d2dad5d8a3677784c97ad5d859cefb998bb93a3d40b69b775a49683d3ad393f50ae7c98a9543b38d705616ec6dc1f3fedc2e569066c84f139200c818436a55c814c74ae8a6fb1c92b10d47b45b67446034698ad9cb20b54bb06b044a71aca98d35084124a44462e070f0dcb9598382cba8f9fbe4c19681e30e0b84184ff6b60c7a0c448fb11dfe805cadff11c3ff12add059edeabea2dfc4bd4110ff52bd25079e506f835e1af026b12d6273c2b6a5ce1aa88b97c2ca1e05d90fc663d5c830ce42817e372d3f3284636bf214483994e642f6e90752076f49ef2ce3523caa5648eda8157400071f22d4865b1acb4e9bfae08148af951e22c0094bc63987279a1a361c584afaf4fc8710b20f169809768623c5484b8f4ff189c3e427b4198f125c86fae91e6a5dd20144ac74689d82ef6f32eac3d6bfdecd52d2ce6e1a0e92c97690e5eebca54fa7605fcda832c3619d388f394c59205489751651ff5a5473acfabcfbf678c18426091434b3ac4d8d6b97bbef937b220396e82b5151983055093fe6fcb3fe0208153609007f19856c1f00ef602849864e7ad8132102992b42941cd39712b54e90082c90ec36aaa12115faf42cb6243ec5d95d9e7ca33946b6e924b6d38fdfa13e9bf44ac5cf26f55a76d4f1a0eaa4fbf17995ed7135743b22165f8ddce0dbbd6a80ad5da603520964ee2d6126e80587254983535e6cc6be7711b29b5a6821c0749372856272bb596441fae8822ca67b697a93b8836da496dde47f1848b7c66f871e6bc5feca3876eb52221c4bd1eeed96cdcdee340b7ff2f233496ffdf7adcb827b95867737512fb2e5747b8f84a86f3d149111cd9bd2445bf270126511efc197d952efec2a59294f0d37b4f639362f5cfb80537d72ed7fe082757f857a28bfd590073f413dbe5a2353e66e3c8c19c7511ba837d119c284da3434c73a49cf45a3e02ce65ad65e0070a3c8855e71ded603dcb8989437a8564aaf4b0235515b68a1a5494d7b36fcbdc981911db2b750752322aa00cedd1e1cab67f1e136309cc2f971d643ec83f9744ecfe7b97ac79e7e9d2e3eee6ea5550f2e6b8c7dd1a9471f784cfbb0b6d22f7c63452c5b26f22bebde7a6c814bc647848a32837b66ba5ae5aeeeddfeab97b6dd2ac42675014f09cedfd10e98a95006e2cd3440cb31c0d2f50cb9a2544a4ed7cd8eed13cab8ac8ccbee4284e04db0bf78c9cc1b91d4d97f9c6cc4254321e434dbbae215365bb1a03fb2219d3616a044e83bac94329e15a394015e402dc7e50f706f4fb560435b39078c2863d5ae5c4b51249ae4cb5df931696fb27a76e004dc242112c36e14936924ce18f67ee6b52ad2ac6b5fc47cd63262fc0df0ed4b408436c1e26b3b95b0735eff89d19a9e136652c609678dd0b0ba588b592baa7fe8628a3cab56510a80b6eb3cd285f74585af3b086aa37ecb2f152f86cabf2a25184777252860b934f5e80cf9d5ea7854f019e56587fcffea06946a87d3c4315172bba2fa5e2324660bb54b5f43db4f341fd2d8f48a510355dc0d734e8c2eb49bfb5a6bd1fa9667b43748f73f900c01c0100c4edf41886e33d96d005f60c7e753090a23b9c3b59ebe7a55e817ff7da8b0c57a11c039fa5eed2120285e1ee79b014f17303b5ec8df048c033a62cf4c743847d802a4b8bfb257f026bc8221afdb0cff8bfd369816744f05686f7d00c44811b24838179225297f045501fd2008e2a83fde7adfe41f56fdb2068f5e7d606e5f38c065b93761f0b6be6f49ef06c912d85d6d8aa5ac78a41aea770b743491fdc3426d3dbf7173909ad9c55acb69b8e0cda4851fded1ef01f0a906190c3f625362ce6f9226712b950a8f5d89b2422365ae51ade367f7a5aeb63a7cb78c31d4930f6f8e6709eb40595403cdafbd3587c7d22d9320a8db43cbcaf45baaa28d7b9c59f10b89d75d786710fb57c0433a40c3d3f08d70940b9caf605fc44c7acbe113ae9a8e94553d3f1c58196003d6f5fe284067a3a5d5e7aefcadf7effff96cb690ec0832e4647b29faa0d6820ff4052396c3101566f0b783775fe4bc14fe0702fc8bcc7855ca522aea4ecea2d534a243e52c468e031a2dc881da204308239b571e83ec271a267317bd6ba14707ed9faa28546fa92fb56e98a44befc6fc7153db776f23ae91248a78d59e4c53e6beeeaa7101a0678e5083df872404fe9472c2e79f95f876318a3e966bd8230c0327fc2cad94e604307491acc1467dee5c1383ddc17915a373eccf85765f70930710b7dc537c72facb12603d4ad90bee0a82432dcc4c81699b8b4c5a0efbe024e17562b7a1b5a16830b23717ac5cf90850962eb295b3ecd5f3f8900b86b5f5c94c203ffd3285693d89f37861a5270e65bf47b14432471340982f27ea04d8ba6b3e8c2720528c467403defbe2dd31e8cec19f0106e4a7d05ef5a87826b750cde51b74c6ee550696ef311880f0e965a3b7b9d4b14bf4aaa7574e3d158bb6a2fb48a1260a36596d9a1c6278ef531b4a6edcaad73913e36f2c714de87421f09572ac491d202ee877fa21e42a3afec8da06bbd1e78236bc244ad97f2176ac5e8b7a06fcb57aa590de74725516aa94931edeb26a80876b8ce6554bbd68d6816280b6c7dd62dc96b51ee69f492064749f60d77c073ca2b59f96e9b0ba3d86f1d8249f65ba743a23fb71d2a1486d7a4e4ab802f93020d7b6196f24338fa1decd213bba82bb93b99361e760d03deb9d3fc1c131ac557df4d20da214d1467534d2b5a8f5bd22f5ce781660db34e97372f2b4f933650ecb08c47a4497d04b615663f3d989a812fce0c4dad43441f20144278716151a60e656da9cf0942b446f589c4902c5a78daed2d98c5b4e4c2d35ec1139ad92fb410edd9b23619f7e81dda1e9f3f2cc7ed0affbd0d7f3859361056ceb81d55187ab50201dbab4ef4fec3655254c977cdcef742a686302b24ef4ade9f7877ecf8229970c99287c058e99c92d68ff3566e6a0092aafbf", 0x2, 0x0, 0x40}, 0x50) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt(0xffffffffffffffff, 0x400, 0xf7b5, 0x0, 0x3d5982be18b14245) timer_settime(r2, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x15, 0xa, &(0x7f0000000100)=ANY=[@ANYRES32], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport=0x27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$inet_udp(0x2, 0x2, 0x0) dup2(r3, 0x3) bind$inet(r4, &(0x7f0000000400)={0x2, 0x4e20, @loopback}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f0000000500)='ping1234', 0x8, 0x0, &(0x7f0000000600)={0x2, 0x4e20, @loopback}, 0x10) recvfrom$inet(r4, &(0x7f0000000700)=""/8, 0x8, 0x0, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SET_SECCOMP-socket$inet_udp-bind$inet-setsockopt$inet_udp_encap-syz_emit_ethernet-syz_emit_ethernet-io_setup-socket$nl_route-socket$inet_udp-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-socket$inet_tcp-setsockopt$SO_BINDTODEVICE-getsockopt$sock_buf-io_destroy detailed listing: executing program 0: prctl$PR_SET_SECCOMP(0x16, 0x1, &(0x7f0000000080)={0x0, &(0x7f00000000c0)}) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000000)=0x2, 0x4) syz_emit_ethernet(0x86, &(0x7f00000002c0)={@local, @random="df00004000", @void, {@ipv4={0x800, @tcp={{0x19, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x6, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x11}, {[@ssrr={0x89, 0xb, 0xa2, [@broadcast, @rand_addr=0x64010102]}, @cipso={0x86, 0x3f, 0x3, [{0x2, 0xb, "bbcc7cf78d8ad75478"}, {0x7, 0x11, "5f6d01d84266478c55496a6c9268c8"}, {0x0, 0xb, "b05c7093710b20870f"}, {0x0, 0x12, "c3df1e754586606351dc0052a49e0ed9"}]}, @cipso={0x86, 0x6, 0x1}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, 0x0) syz_emit_ethernet(0x332, &(0x7f0000000540)={@local, @local, @void, {@ipv4={0x800, @gre={{0xb, 0x4, 0x0, 0x15, 0x324, 0x64, 0x0, 0x4, 0x2f, 0x0, @private=0xa010100, @remote, {[@noop, @timestamp_prespec={0x44, 0x14, 0xd0, 0x3, 0xf, [{@rand_addr=0x64010102, 0xa76}, {@private=0xa010102, 0xfffffffb}]}]}}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x880b, 0x50, 0x0, [0x8001, 0x3], "d7397b885fe2d62a48a0a06588c4a5c98dedc0833fcea44d5833b6101260d5dd23ab1ab1fd7f0f49e64b232aa9d1c60ed3c5209cca7bed32c0ad4b8409ce8c0a65f1e2ffa2459a26f807d76bbbfbd286"}, {0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x800, [0x3, 0x7ff], "d30f24f254b7c1fe777ec35cbebdee28f43e425563e318e8eac78a484f1abe817ee8d246c3281c61bdab70f67080abf0b51b649a980ea14189d069c724cfc13d322bb3964b521c20bc54f701b11e523ce150381b041eadeea91d0776bbd919ae65b4bd739f22925d56477041a26c9f2b2a27bad3a69160f20688cdea42c54a8bfce602b88760529fbba67e41123c2b9e239db6a42206fb47e2ae5e7a833e8c38af9ded"}, {0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x86dd, [0xffff, 0x9], "1bc06324ac656c35a4c2685cccdf6e32f8f52e4b22887666cade7ea0720af88341c0a49edfd3f283e61c7aabd48ed37d2718594d100c68a53066d34e6306ef03078c61fa622d2b1f86e15555fc1a3e643649300888b481297bc1bde42e02d0dd209a9cfea789dc145c9f8834f8c585c6552183a5260f5860ce50b9a0573521305d42bc0e0e57f0da9142793291350d7559ad5ecf2c81ed58b9355db5ed887ec54953e747bd8a8d90e8704d413108e65b957c769070fb0514"}, {0x8, 0x88be, 0x1, {{0x8, 0x1, 0x7, 0x1, 0x1, 0x0, 0x1, 0xfc}, 0x1, {0xfffffff8}}}, {0x8, 0x22eb, 0x4, {{0xb, 0x2, 0x6, 0x1, 0x0, 0x2, 0x3, 0x7}, 0x2, {0x2, 0xff85, 0x1, 0x11, 0x1, 0x0, 0x3, 0x1, 0x1}}}, {0x8, 0x6558, 0x4, "631de360c4dccd27b3a713f8e23d7405d1057fffcee04c38fb6accd303a2b3e9280d41eefd8edb43127c9ca1ed24030d6477f4eff4970c7d76dd0e49b076319071edd5edaf713330e5760db28cbd2f886ffe63b9791c5a6e055032de517441107a33d534b1e53c83387cdb8600e0f17400583809bb50357654fdf4784241c83cce9df9f3cbffc9d4399fc58fe473f8de29c05cffaed36f997f531607dfbba12b361138c529f1caff19e90e26cd4bbb12941696267669c3c20ade6230fbbf35c9bb9cd840556eb1275eb4563422860f0605d7cd4d0d4263082684e9b4c0534a9697beeecd807568f3ac4c1fe89faffc5389b0023d7c6d8a87e7b3eccaeb"}}}}}}, 0x0) io_setup(0x3ff, &(0x7f0000000500)=0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=ANY=[@ANYBLOB="3800000054000104000000000000000007000000", @ANYRES32=r4, @ANYBLOB="20000100", @ANYRES32=r4, @ANYBLOB="01000000ef01010100000000000000000000000008"], 0x38}}, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000140)='veth1_to_bridge\x00', 0x10) getsockopt$sock_buf(r5, 0x1, 0x19, &(0x7f0000006080)=""/241, &(0x7f0000000280)=0xf1) io_destroy(r1) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-mremap-syz_mount_image$ext4-madvise-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-write-madvise-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_GUEST_DEBUG_x86-ioctl$KVM_RUN-setsockopt$bt_BT_DEFER_SETUP-syz_usb_connect detailed listing: executing program 0: madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) syz_mount_image$ext4(&(0x7f0000000180)='ext2\x00', &(0x7f0000000540)='./bus\x00', 0x8800, &(0x7f0000000280), 0x1, 0x51a, &(0x7f0000000f00)="$eJzs3c9vI1cdAPCvnThxfnSTlh4AQbu0hQWt1km8bVT1AOWIUCVEjyBtQ+KNothxFDulCXtIz1yRqMSJHvkDOPfEgRsXBDcuywGJHxFog8TBaMaTrDdrb6xNYqfx5yON5r2ZWX+/L868t36O/QIYWTcj4iAiJiLig4iYy47nsi3ebW/JdY8OH6weHT5YzUWr9f4/c+n55Fh0/JvETPaYxYj44acRP8k9Hbext7+5Uq1WdrL6QrO2vdDY27+zUVtZr6xXtsrl5aXlxbfvvlW+sLa+WpvISl99+IeDb/0sSWs2O9LZjovUbnrhJE5iPCK+fxnBhmAsa8/EsBPhueQj4qWIeC29/+diLH02AYDrrNWai9ZcZx0AuO7y6RxYLl/K5gJmI58vldpzeC/HdL5abzRv36/vbq2158rmo5C/v1GtLGZzhfNRyCX1pbT8uF4+Vb8bES9GxC8mp9J6abVeXRvmf3wAYITNnBr//zPZHv8BgGuuOOwEAICB6zH+Hww6DwBgcLz+B4DRY/wHgNFTTL/DYWrYaQAAA+T1PwCMHuM/AIyUH7z3XrK1jrLvv177cG93s/7hnbVKY7NU210trdZ3tkvr9fp6+p09tbMer1qvby+9GbsfzX97u9FcaOzt36vVd7ea99Lv9b5XKaRX+WQBAAzTi69+9udcMiK/M5Vu0bGWQ2GomQGXLT/sBIChGetRBq4/q33B6DrHa3zTA3BNdFmi9wnF6PIBoVar1bq8lIBLdutL5v9hVHXM//srYBgx5vxhdJn/h9HVauX6XfM/+r0QALjazPEDPd7/fynb/yZ7c+DHa6ev+OQyswIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICr7Xj931K2Fvhs5POlUsQLETEfhdz9jWplMSJuRMSfJguTSX1pyDkDAOeV/1suW//r1twbs0+cemXmpDgRET/91fu//Gil2dz5Y8RE7l+Tx8ebn2THy4PPHgA42/E4ne47Xsg/OnywerwNMp+/fzciiu34R4cTcXQSfzzG030xChEx/e9cVm/LdcxdnMfBxxHxxW7tz8VsOgfSXvn0dPwk9gsDjZ9/In4+PdfeJz+LL1xALjBqPkv6n3e73X/5uJnuu9//xbSHOr+s/0seavUo7QMfxz/u/8Z69H83+43x5u++1y5NPX3u44gvj0ccxz7q6H+O4+d6xH+jz/h/+corr/U61/p1xK3oHr8z1kKztr3Q2Nu/s1FbWa+sV7bK5eWl5cW3775VXkjnqBd6jwb/eOf2jV7nkvZP94hfPKP9X++z/Z/+74Mffe0Z8b/5erf4+Xj5GfGTMfEbfcZfmf5tsde5JP5aj/af9fzf7jP+w7/uP7VsOAAwPI29/c2VarWy86zCjaOIs675XBaiv4t/n/2wrkTOI11InoUrkEbXwnc6jszEJcaa6HEz/vz19q/pZETnL3ar9VyxevUYFzHrBlwFJzd9RPx32MkAAAAAAAAAAAAAAABdDeLTUcNuIwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANfX/wMAAP//jMfJaQ==") madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x2, 0x0, &(0x7f0000000140)={0x0, 0x0}) write(r0, &(0x7f0000000000)="fa", 0xfffffdef) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(r3, 0x4048ae9b, &(0x7f0000000080)={0xe0003, 0x0, {[0xffffffffffffffff, 0x1f8, 0x83, 0xffffffffefffff15, 0x3, 0x4, 0x1, 0x4]}}) ioctl$KVM_RUN(r3, 0xae80, 0x0) setsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0x7, 0x0, 0x0) syz_usb_connect(0x3, 0x46, &(0x7f0000000080)=ANY=[@ANYBLOB="92010002508bf5088205cae60bd30102030109023400010301600209042d0202ff6229010a24010c000302010209050101000203ff0609050a0308000301010725"], 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-setsockopt$IP6T_SO_SET_REPLACE-syz_emit_ethernet-socket$inet6-connect$inet6-writev-nanosleep-rmdir-syz_usb_connect-socket$inet6_tcp-setsockopt$IP6T_SO_SET_REPLACE-syz_emit_ethernet-socket$inet6-connect$inet6-writev-nanosleep-rmdir-syz_usb_connect detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x530, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x460, 0xffffffff, 0xffffffff, 0x460, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1d8, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1, [0xff000000, 0xffffffff, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x39a}, 0x100, 0x20}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @local}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x590) syz_emit_ethernet(0x42, &(0x7f00000000c0)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x42}, @val={@void, {0x8100, 0x3}}, {@ipv6={0x86dd, @icmpv6={0x7, 0x6, '\x00', 0x8, 0x3a, 0x0, @empty, @mcast2, {[], @mlv2_report={0x8f, 0x0, 0x0, 0xc50}}}}}}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000080)={0x2, 0x0, 0x0, @rand_addr=' \x01\x00'}, 0x1c) writev(r1, &(0x7f00000007c0)=[{&(0x7f00000005c0)="083fe136bd", 0x5}], 0x1) nanosleep(&(0x7f0000000000)={0x0, 0x3938700}, &(0x7f0000000080)) rmdir(&(0x7f0000000140)='./file0\x00') syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000092ddee10030410600200050003010902120001000000000904", @ANYRES32], 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) (async) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x530, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x460, 0xffffffff, 0xffffffff, 0x460, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1d8, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1, [0xff000000, 0xffffffff, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x39a}, 0x100, 0x20}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @local}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0xe, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x590) (async) syz_emit_ethernet(0x42, &(0x7f00000000c0)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x42}, @val={@void, {0x8100, 0x3}}, {@ipv6={0x86dd, @icmpv6={0x7, 0x6, '\x00', 0x8, 0x3a, 0x0, @empty, @mcast2, {[], @mlv2_report={0x8f, 0x0, 0x0, 0xc50}}}}}}, 0x0) (async) socket$inet6(0xa, 0x2, 0x0) (async) connect$inet6(r1, &(0x7f0000000080)={0x2, 0x0, 0x0, @rand_addr=' \x01\x00'}, 0x1c) (async) writev(r1, &(0x7f00000007c0)=[{&(0x7f00000005c0)="083fe136bd", 0x5}], 0x1) (async) nanosleep(&(0x7f0000000000)={0x0, 0x3938700}, &(0x7f0000000080)) (async) rmdir(&(0x7f0000000140)='./file0\x00') (async) syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000092ddee10030410600200050003010902120001000000000904", @ANYRES32], 0x0) (async) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-ioctl$KVM_SET_CPUID2-ioctl$KVM_RUN-socket$inet6_udp-mprotect-connect$inet6-connect$pppl2tp-sendmmsg-ioctl$sock_inet_SIOCGIFPFLAGS-getpid-ioctl$sock_inet_SIOCGIFPFLAGS-socketpair$unix-pipe-splice-ioctl$TIOCGSID-socketpair$unix-syz_clone3-io_setup-io_submit-sendmmsg$unix detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x6) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f00009b3000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000480)="0f011a66b83c2900000f23c80f21f866350c00d0000f23f866b9800000c00f326635000100000f30ba2100ed3e6664660f54e866660f3881b8cfa8baf80c66b8345dc08966efbafc0c66ed66b9ee0900000f320fb4020f01c4", 0x7e}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000080)) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) mprotect(&(0x7f00009c5000/0x3000)=nil, 0x3000, 0x300000b) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x4e20, 0x2eb, @mcast2, 0xa}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x81, 0x0, 0x0, 0x0, {0xa, 0x4e21, 0xca33, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) sendmmsg(r0, &(0x7f0000004180)=[{{0x0, 0x0, &(0x7f00000024c0)=[{&(0x7f0000000300)="b90d9370bcb6b55124e4c18d4378d5204455503d5689e9f1a4662e3b15178e8160a5e047a301281ef95b0b3056d644afe0ac515acf082e97706d5741910285c9dfe45c728d146cbb40e18dcc67df1d8252252df698e7cb4cd57a2b2f4b1c3b50234cc4d04f3713c3242d5afa092cb492", 0x70}, {&(0x7f00000014c0)="e2ace30410d61649be29c6dc86f7d9b7a4e65beaf8854852ea14dd3935839f6a97bd3b0f7a5ca9a29fcd592ca29c7c8e95f2b4fabcdf35c6500e06b5010f7053e85ef8a57e01d953ce6ee8f261022f1b5ed677c88ab422e3b15d798f1376f09cc1c0c88b3d6bfabd65b0783b5b0762bd23249b33ff5531e5a601d9945f2f101a86f773681c6555d9a5f0de2d24ab96697a93fd924021dbae413ca92654c39420aa4a0cdafc1c850419b3f57441911c9d4b64ae6a9813a9d46966dc3edcadf54471482a3c5ce24d37d011b6257f42086088aa7f2e2686c5fd620344128fd0851f5498f63bf8f3039b8475f42ef1444d6293e0fa9d721f4cd3ddac8eba7d6357a47fed160c1f13678cd807f8a4ca9fec8a72b5261c34476ed424db26ac41d621123a81537a268eee21495f6149fd43f25fa0e491b9db817f89059bec94d1ef4f5e3950672f62b2577bec3f362e32d59d20d49a3905ded3ca6395e44291e08935de694d4e976adb32f36911214f1b6d3e809c009da652acef5098ab679bede7a0b3aa31de7753e79526e9dce36efea22956094fcc77add6f63a996cfd53b8273820554efd76b460526a33e28edaa7f9beba637ec0e397994b7299e5fa8613c556ce653340cc2679a962e2fdd798f491ff1a2833d66db43102928d204e0caf6933adc6b6e69445b50826a3434ae714b8ee7e7b5fc94d113ca2e348d6cfc4371fdbbdcfeb218b9ff8e92cb73a1e1ccee91f97850cba7dec3c96b9b105fe918b96ebc2059ee571396f989220e9ac76e45599463f947b5ca7db210348c267b79e46fe74963d28a2da0757f7a98e051cdffd490619d4c1ab623bc1593c0d867785bd757fccb89f4adbf41d888d5bc0c889b941d9c4c438471cb22e1d08474b57d3bad7d63dd7101802fb4f8f1df2d80938697636a65f2b9b5789aee535f092e47e6ff511b501f54b79862ac4a8815f5f55e84397f7cd16872ad64304c8ad72a2519795807a2c09fd4e9256b1221120568d768379f200674022585f4f63bb9136c805ac85129c9cf3d3090aa8826b4e73b845d3ae40c44826b521644a624c699faba8d899c9873ac5699741bc973d4a115553bd26227e55b99f49cd52929379facac42d91e0af4816603a7366cb672b7ed494f6736d84cc0cf8fe6dfa9565fb3b466974eedf36cf744fab76a5793df159fbeca8915491da9bc227da35a43848828037a1c9f330e1e1bfcac7996135b150167248e735f3d4d3924ac94263b308019faacb7b5b183f5ed60bd4787c6990489ac61a78bacf91eb998284542a0a86a9f988c7af860e8f8e4eae049a256c1ec5ba1b90caacee07d41e43eabfa9ea133fe98ac7ace4466481635dcaad15e9fd8d0f9018318118d25baa3ee3ef5c89ad0d3d2e2a2daad078ba27b77f482c472a90d8f15bb6d5df1349c9c943a41580be079af06629fd3d3bfc87088c972df02710986a633c17896ad25fb409daa192c35ed7ab212259634b7c3349abaf50692c6e8cc9de55c4b71dfc4763cc00871a74dae70841bd2a531812c10124103ddf4c10f335e8ef4da883e1b1f28ebe7c49012879d6aa787d751d7994ab539270c255176c9fce26d5adadce1d5583799f5fc63de702354d861a640d422adcea2b102aec5639f10b0fd775e63af70f1c3ae4212f8f983ab1b5e3716cf3f17a2ee2302766a6438ee18448baf1c90f0841a8ace3a4832f9b5d824c38e3c83ccb771a6ab39cf92b648c701d8e8133917ad2f46040d048e76655099130d457f9cd01e23593e677b364d18dd66ccf43d59db439be2ca8ffce0310b8", 0x501}], 0x2}}], 0x1, 0x44040841) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000040)={'tunl0\x00'}) getpid() ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000100)={'bridge_slave_1\x00'}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r5, 0x0, r6, 0x0, 0x7, 0x0) ioctl$TIOCGSID(r6, 0x5429, &(0x7f0000000140)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x1, &(0x7f0000000600)=0x0) io_submit(r10, 0x1, &(0x7f00000008c0)=[&(0x7f0000000240)={0x0, 0x0, 0x300, 0x0, 0x7fff, r9, 0x0, 0x0, 0x0, 0x0, 0x2}]) sendmmsg$unix(r8, &(0x7f0000001040)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}}, {{&(0x7f0000000940)=@abs={0x0, 0x0, 0x4e20}, 0x6e, 0x0, 0x0, &(0x7f0000000ec0)=[@rights={{0x14, 0x1, 0x1, [r7]}}, @rights={{0x18, 0x1, 0x1, [r8, r7]}}], 0x30, 0x20000800}}], 0x2, 0x0) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work single: successfully extracted reproducer found reproducer with 24 syscalls minimizing guilty program testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-ioctl$KVM_SET_CPUID2-ioctl$KVM_RUN-socket$inet6_udp-mprotect-connect$inet6-connect$pppl2tp-sendmmsg-ioctl$sock_inet_SIOCGIFPFLAGS-getpid-ioctl$sock_inet_SIOCGIFPFLAGS-socketpair$unix-pipe-splice-ioctl$TIOCGSID-socketpair$unix-syz_clone3-io_setup-io_submit detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x6) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f00009b3000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000480)="0f011a66b83c2900000f23c80f21f866350c00d0000f23f866b9800000c00f326635000100000f30ba2100ed3e6664660f54e866660f3881b8cfa8baf80c66b8345dc08966efbafc0c66ed66b9ee0900000f320fb4020f01c4", 0x7e}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000080)) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) mprotect(&(0x7f00009c5000/0x3000)=nil, 0x3000, 0x300000b) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x4e20, 0x2eb, @mcast2, 0xa}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x81, 0x0, 0x0, 0x0, {0xa, 0x4e21, 0xca33, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) sendmmsg(r0, &(0x7f0000004180)=[{{0x0, 0x0, &(0x7f00000024c0)=[{&(0x7f0000000300)="b90d9370bcb6b55124e4c18d4378d5204455503d5689e9f1a4662e3b15178e8160a5e047a301281ef95b0b3056d644afe0ac515acf082e97706d5741910285c9dfe45c728d146cbb40e18dcc67df1d8252252df698e7cb4cd57a2b2f4b1c3b50234cc4d04f3713c3242d5afa092cb492", 0x70}, {&(0x7f00000014c0)="e2ace30410d61649be29c6dc86f7d9b7a4e65beaf8854852ea14dd3935839f6a97bd3b0f7a5ca9a29fcd592ca29c7c8e95f2b4fabcdf35c6500e06b5010f7053e85ef8a57e01d953ce6ee8f261022f1b5ed677c88ab422e3b15d798f1376f09cc1c0c88b3d6bfabd65b0783b5b0762bd23249b33ff5531e5a601d9945f2f101a86f773681c6555d9a5f0de2d24ab96697a93fd924021dbae413ca92654c39420aa4a0cdafc1c850419b3f57441911c9d4b64ae6a9813a9d46966dc3edcadf54471482a3c5ce24d37d011b6257f42086088aa7f2e2686c5fd620344128fd0851f5498f63bf8f3039b8475f42ef1444d6293e0fa9d721f4cd3ddac8eba7d6357a47fed160c1f13678cd807f8a4ca9fec8a72b5261c34476ed424db26ac41d621123a81537a268eee21495f6149fd43f25fa0e491b9db817f89059bec94d1ef4f5e3950672f62b2577bec3f362e32d59d20d49a3905ded3ca6395e44291e08935de694d4e976adb32f36911214f1b6d3e809c009da652acef5098ab679bede7a0b3aa31de7753e79526e9dce36efea22956094fcc77add6f63a996cfd53b8273820554efd76b460526a33e28edaa7f9beba637ec0e397994b7299e5fa8613c556ce653340cc2679a962e2fdd798f491ff1a2833d66db43102928d204e0caf6933adc6b6e69445b50826a3434ae714b8ee7e7b5fc94d113ca2e348d6cfc4371fdbbdcfeb218b9ff8e92cb73a1e1ccee91f97850cba7dec3c96b9b105fe918b96ebc2059ee571396f989220e9ac76e45599463f947b5ca7db210348c267b79e46fe74963d28a2da0757f7a98e051cdffd490619d4c1ab623bc1593c0d867785bd757fccb89f4adbf41d888d5bc0c889b941d9c4c438471cb22e1d08474b57d3bad7d63dd7101802fb4f8f1df2d80938697636a65f2b9b5789aee535f092e47e6ff511b501f54b79862ac4a8815f5f55e84397f7cd16872ad64304c8ad72a2519795807a2c09fd4e9256b1221120568d768379f200674022585f4f63bb9136c805ac85129c9cf3d3090aa8826b4e73b845d3ae40c44826b521644a624c699faba8d899c9873ac5699741bc973d4a115553bd26227e55b99f49cd52929379facac42d91e0af4816603a7366cb672b7ed494f6736d84cc0cf8fe6dfa9565fb3b466974eedf36cf744fab76a5793df159fbeca8915491da9bc227da35a43848828037a1c9f330e1e1bfcac7996135b150167248e735f3d4d3924ac94263b308019faacb7b5b183f5ed60bd4787c6990489ac61a78bacf91eb998284542a0a86a9f988c7af860e8f8e4eae049a256c1ec5ba1b90caacee07d41e43eabfa9ea133fe98ac7ace4466481635dcaad15e9fd8d0f9018318118d25baa3ee3ef5c89ad0d3d2e2a2daad078ba27b77f482c472a90d8f15bb6d5df1349c9c943a41580be079af06629fd3d3bfc87088c972df02710986a633c17896ad25fb409daa192c35ed7ab212259634b7c3349abaf50692c6e8cc9de55c4b71dfc4763cc00871a74dae70841bd2a531812c10124103ddf4c10f335e8ef4da883e1b1f28ebe7c49012879d6aa787d751d7994ab539270c255176c9fce26d5adadce1d5583799f5fc63de702354d861a640d422adcea2b102aec5639f10b0fd775e63af70f1c3ae4212f8f983ab1b5e3716cf3f17a2ee2302766a6438ee18448baf1c90f0841a8ace3a4832f9b5d824c38e3c83ccb771a6ab39cf92b648c701d8e8133917ad2f46040d048e76655099130d457f9cd01e23593e677b364d18dd66ccf43d59db439be2ca8ffce0310b8", 0x501}], 0x2}}], 0x1, 0x44040841) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000040)={'tunl0\x00'}) getpid() ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000100)={'bridge_slave_1\x00'}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r5, 0x0, r6, 0x0, 0x7, 0x0) ioctl$TIOCGSID(r6, 0x5429, &(0x7f0000000140)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x1, &(0x7f0000000600)=0x0) io_submit(r8, 0x1, &(0x7f00000008c0)=[&(0x7f0000000240)={0x0, 0x0, 0x300, 0x0, 0x7fff, r7, 0x0, 0x0, 0x0, 0x0, 0x2}]) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-ioctl$KVM_SET_CPUID2-ioctl$KVM_RUN-socket$inet6_udp-mprotect-connect$inet6-connect$pppl2tp-sendmmsg-ioctl$sock_inet_SIOCGIFPFLAGS-getpid-ioctl$sock_inet_SIOCGIFPFLAGS-socketpair$unix-pipe-splice-ioctl$TIOCGSID-socketpair$unix-syz_clone3-io_setup detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x6) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f00009b3000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000480)="0f011a66b83c2900000f23c80f21f866350c00d0000f23f866b9800000c00f326635000100000f30ba2100ed3e6664660f54e866660f3881b8cfa8baf80c66b8345dc08966efbafc0c66ed66b9ee0900000f320fb4020f01c4", 0x7e}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000080)) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) mprotect(&(0x7f00009c5000/0x3000)=nil, 0x3000, 0x300000b) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x4e20, 0x2eb, @mcast2, 0xa}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x81, 0x0, 0x0, 0x0, {0xa, 0x4e21, 0xca33, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) sendmmsg(r0, &(0x7f0000004180)=[{{0x0, 0x0, &(0x7f00000024c0)=[{&(0x7f0000000300)="b90d9370bcb6b55124e4c18d4378d5204455503d5689e9f1a4662e3b15178e8160a5e047a301281ef95b0b3056d644afe0ac515acf082e97706d5741910285c9dfe45c728d146cbb40e18dcc67df1d8252252df698e7cb4cd57a2b2f4b1c3b50234cc4d04f3713c3242d5afa092cb492", 0x70}, {&(0x7f00000014c0)="e2ace30410d61649be29c6dc86f7d9b7a4e65beaf8854852ea14dd3935839f6a97bd3b0f7a5ca9a29fcd592ca29c7c8e95f2b4fabcdf35c6500e06b5010f7053e85ef8a57e01d953ce6ee8f261022f1b5ed677c88ab422e3b15d798f1376f09cc1c0c88b3d6bfabd65b0783b5b0762bd23249b33ff5531e5a601d9945f2f101a86f773681c6555d9a5f0de2d24ab96697a93fd924021dbae413ca92654c39420aa4a0cdafc1c850419b3f57441911c9d4b64ae6a9813a9d46966dc3edcadf54471482a3c5ce24d37d011b6257f42086088aa7f2e2686c5fd620344128fd0851f5498f63bf8f3039b8475f42ef1444d6293e0fa9d721f4cd3ddac8eba7d6357a47fed160c1f13678cd807f8a4ca9fec8a72b5261c34476ed424db26ac41d621123a81537a268eee21495f6149fd43f25fa0e491b9db817f89059bec94d1ef4f5e3950672f62b2577bec3f362e32d59d20d49a3905ded3ca6395e44291e08935de694d4e976adb32f36911214f1b6d3e809c009da652acef5098ab679bede7a0b3aa31de7753e79526e9dce36efea22956094fcc77add6f63a996cfd53b8273820554efd76b460526a33e28edaa7f9beba637ec0e397994b7299e5fa8613c556ce653340cc2679a962e2fdd798f491ff1a2833d66db43102928d204e0caf6933adc6b6e69445b50826a3434ae714b8ee7e7b5fc94d113ca2e348d6cfc4371fdbbdcfeb218b9ff8e92cb73a1e1ccee91f97850cba7dec3c96b9b105fe918b96ebc2059ee571396f989220e9ac76e45599463f947b5ca7db210348c267b79e46fe74963d28a2da0757f7a98e051cdffd490619d4c1ab623bc1593c0d867785bd757fccb89f4adbf41d888d5bc0c889b941d9c4c438471cb22e1d08474b57d3bad7d63dd7101802fb4f8f1df2d80938697636a65f2b9b5789aee535f092e47e6ff511b501f54b79862ac4a8815f5f55e84397f7cd16872ad64304c8ad72a2519795807a2c09fd4e9256b1221120568d768379f200674022585f4f63bb9136c805ac85129c9cf3d3090aa8826b4e73b845d3ae40c44826b521644a624c699faba8d899c9873ac5699741bc973d4a115553bd26227e55b99f49cd52929379facac42d91e0af4816603a7366cb672b7ed494f6736d84cc0cf8fe6dfa9565fb3b466974eedf36cf744fab76a5793df159fbeca8915491da9bc227da35a43848828037a1c9f330e1e1bfcac7996135b150167248e735f3d4d3924ac94263b308019faacb7b5b183f5ed60bd4787c6990489ac61a78bacf91eb998284542a0a86a9f988c7af860e8f8e4eae049a256c1ec5ba1b90caacee07d41e43eabfa9ea133fe98ac7ace4466481635dcaad15e9fd8d0f9018318118d25baa3ee3ef5c89ad0d3d2e2a2daad078ba27b77f482c472a90d8f15bb6d5df1349c9c943a41580be079af06629fd3d3bfc87088c972df02710986a633c17896ad25fb409daa192c35ed7ab212259634b7c3349abaf50692c6e8cc9de55c4b71dfc4763cc00871a74dae70841bd2a531812c10124103ddf4c10f335e8ef4da883e1b1f28ebe7c49012879d6aa787d751d7994ab539270c255176c9fce26d5adadce1d5583799f5fc63de702354d861a640d422adcea2b102aec5639f10b0fd775e63af70f1c3ae4212f8f983ab1b5e3716cf3f17a2ee2302766a6438ee18448baf1c90f0841a8ace3a4832f9b5d824c38e3c83ccb771a6ab39cf92b648c701d8e8133917ad2f46040d048e76655099130d457f9cd01e23593e677b364d18dd66ccf43d59db439be2ca8ffce0310b8", 0x501}], 0x2}}], 0x1, 0x44040841) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000040)={'tunl0\x00'}) getpid() ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000100)={'bridge_slave_1\x00'}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r5, 0x0, r6, 0x0, 0x7, 0x0) ioctl$TIOCGSID(r6, 0x5429, &(0x7f0000000140)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040), 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x1, &(0x7f0000000600)) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-ioctl$KVM_SET_CPUID2-ioctl$KVM_RUN-socket$inet6_udp-mprotect-connect$inet6-connect$pppl2tp-sendmmsg-ioctl$sock_inet_SIOCGIFPFLAGS-getpid-ioctl$sock_inet_SIOCGIFPFLAGS-socketpair$unix-pipe-splice-ioctl$TIOCGSID-socketpair$unix-syz_clone3 detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x6) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f00009b3000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000480)="0f011a66b83c2900000f23c80f21f866350c00d0000f23f866b9800000c00f326635000100000f30ba2100ed3e6664660f54e866660f3881b8cfa8baf80c66b8345dc08966efbafc0c66ed66b9ee0900000f320fb4020f01c4", 0x7e}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000080)) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) mprotect(&(0x7f00009c5000/0x3000)=nil, 0x3000, 0x300000b) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x4e20, 0x2eb, @mcast2, 0xa}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x81, 0x0, 0x0, 0x0, {0xa, 0x4e21, 0xca33, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) sendmmsg(r0, &(0x7f0000004180)=[{{0x0, 0x0, &(0x7f00000024c0)=[{&(0x7f0000000300)="b90d9370bcb6b55124e4c18d4378d5204455503d5689e9f1a4662e3b15178e8160a5e047a301281ef95b0b3056d644afe0ac515acf082e97706d5741910285c9dfe45c728d146cbb40e18dcc67df1d8252252df698e7cb4cd57a2b2f4b1c3b50234cc4d04f3713c3242d5afa092cb492", 0x70}, {&(0x7f00000014c0)="e2ace30410d61649be29c6dc86f7d9b7a4e65beaf8854852ea14dd3935839f6a97bd3b0f7a5ca9a29fcd592ca29c7c8e95f2b4fabcdf35c6500e06b5010f7053e85ef8a57e01d953ce6ee8f261022f1b5ed677c88ab422e3b15d798f1376f09cc1c0c88b3d6bfabd65b0783b5b0762bd23249b33ff5531e5a601d9945f2f101a86f773681c6555d9a5f0de2d24ab96697a93fd924021dbae413ca92654c39420aa4a0cdafc1c850419b3f57441911c9d4b64ae6a9813a9d46966dc3edcadf54471482a3c5ce24d37d011b6257f42086088aa7f2e2686c5fd620344128fd0851f5498f63bf8f3039b8475f42ef1444d6293e0fa9d721f4cd3ddac8eba7d6357a47fed160c1f13678cd807f8a4ca9fec8a72b5261c34476ed424db26ac41d621123a81537a268eee21495f6149fd43f25fa0e491b9db817f89059bec94d1ef4f5e3950672f62b2577bec3f362e32d59d20d49a3905ded3ca6395e44291e08935de694d4e976adb32f36911214f1b6d3e809c009da652acef5098ab679bede7a0b3aa31de7753e79526e9dce36efea22956094fcc77add6f63a996cfd53b8273820554efd76b460526a33e28edaa7f9beba637ec0e397994b7299e5fa8613c556ce653340cc2679a962e2fdd798f491ff1a2833d66db43102928d204e0caf6933adc6b6e69445b50826a3434ae714b8ee7e7b5fc94d113ca2e348d6cfc4371fdbbdcfeb218b9ff8e92cb73a1e1ccee91f97850cba7dec3c96b9b105fe918b96ebc2059ee571396f989220e9ac76e45599463f947b5ca7db210348c267b79e46fe74963d28a2da0757f7a98e051cdffd490619d4c1ab623bc1593c0d867785bd757fccb89f4adbf41d888d5bc0c889b941d9c4c438471cb22e1d08474b57d3bad7d63dd7101802fb4f8f1df2d80938697636a65f2b9b5789aee535f092e47e6ff511b501f54b79862ac4a8815f5f55e84397f7cd16872ad64304c8ad72a2519795807a2c09fd4e9256b1221120568d768379f200674022585f4f63bb9136c805ac85129c9cf3d3090aa8826b4e73b845d3ae40c44826b521644a624c699faba8d899c9873ac5699741bc973d4a115553bd26227e55b99f49cd52929379facac42d91e0af4816603a7366cb672b7ed494f6736d84cc0cf8fe6dfa9565fb3b466974eedf36cf744fab76a5793df159fbeca8915491da9bc227da35a43848828037a1c9f330e1e1bfcac7996135b150167248e735f3d4d3924ac94263b308019faacb7b5b183f5ed60bd4787c6990489ac61a78bacf91eb998284542a0a86a9f988c7af860e8f8e4eae049a256c1ec5ba1b90caacee07d41e43eabfa9ea133fe98ac7ace4466481635dcaad15e9fd8d0f9018318118d25baa3ee3ef5c89ad0d3d2e2a2daad078ba27b77f482c472a90d8f15bb6d5df1349c9c943a41580be079af06629fd3d3bfc87088c972df02710986a633c17896ad25fb409daa192c35ed7ab212259634b7c3349abaf50692c6e8cc9de55c4b71dfc4763cc00871a74dae70841bd2a531812c10124103ddf4c10f335e8ef4da883e1b1f28ebe7c49012879d6aa787d751d7994ab539270c255176c9fce26d5adadce1d5583799f5fc63de702354d861a640d422adcea2b102aec5639f10b0fd775e63af70f1c3ae4212f8f983ab1b5e3716cf3f17a2ee2302766a6438ee18448baf1c90f0841a8ace3a4832f9b5d824c38e3c83ccb771a6ab39cf92b648c701d8e8133917ad2f46040d048e76655099130d457f9cd01e23593e677b364d18dd66ccf43d59db439be2ca8ffce0310b8", 0x501}], 0x2}}], 0x1, 0x44040841) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000040)={'tunl0\x00'}) getpid() ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000100)={'bridge_slave_1\x00'}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r5, 0x0, r6, 0x0, 0x7, 0x0) ioctl$TIOCGSID(r6, 0x5429, &(0x7f0000000140)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040), 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-ioctl$KVM_SET_CPUID2-ioctl$KVM_RUN-socket$inet6_udp-mprotect-connect$inet6-connect$pppl2tp-sendmmsg-ioctl$sock_inet_SIOCGIFPFLAGS-getpid-ioctl$sock_inet_SIOCGIFPFLAGS-socketpair$unix-pipe-splice-ioctl$TIOCGSID-socketpair$unix detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x6) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f00009b3000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000480)="0f011a66b83c2900000f23c80f21f866350c00d0000f23f866b9800000c00f326635000100000f30ba2100ed3e6664660f54e866660f3881b8cfa8baf80c66b8345dc08966efbafc0c66ed66b9ee0900000f320fb4020f01c4", 0x7e}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000080)) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) mprotect(&(0x7f00009c5000/0x3000)=nil, 0x3000, 0x300000b) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x4e20, 0x2eb, @mcast2, 0xa}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x81, 0x0, 0x0, 0x0, {0xa, 0x4e21, 0xca33, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) sendmmsg(r0, &(0x7f0000004180)=[{{0x0, 0x0, &(0x7f00000024c0)=[{&(0x7f0000000300)="b90d9370bcb6b55124e4c18d4378d5204455503d5689e9f1a4662e3b15178e8160a5e047a301281ef95b0b3056d644afe0ac515acf082e97706d5741910285c9dfe45c728d146cbb40e18dcc67df1d8252252df698e7cb4cd57a2b2f4b1c3b50234cc4d04f3713c3242d5afa092cb492", 0x70}, {&(0x7f00000014c0)="e2ace30410d61649be29c6dc86f7d9b7a4e65beaf8854852ea14dd3935839f6a97bd3b0f7a5ca9a29fcd592ca29c7c8e95f2b4fabcdf35c6500e06b5010f7053e85ef8a57e01d953ce6ee8f261022f1b5ed677c88ab422e3b15d798f1376f09cc1c0c88b3d6bfabd65b0783b5b0762bd23249b33ff5531e5a601d9945f2f101a86f773681c6555d9a5f0de2d24ab96697a93fd924021dbae413ca92654c39420aa4a0cdafc1c850419b3f57441911c9d4b64ae6a9813a9d46966dc3edcadf54471482a3c5ce24d37d011b6257f42086088aa7f2e2686c5fd620344128fd0851f5498f63bf8f3039b8475f42ef1444d6293e0fa9d721f4cd3ddac8eba7d6357a47fed160c1f13678cd807f8a4ca9fec8a72b5261c34476ed424db26ac41d621123a81537a268eee21495f6149fd43f25fa0e491b9db817f89059bec94d1ef4f5e3950672f62b2577bec3f362e32d59d20d49a3905ded3ca6395e44291e08935de694d4e976adb32f36911214f1b6d3e809c009da652acef5098ab679bede7a0b3aa31de7753e79526e9dce36efea22956094fcc77add6f63a996cfd53b8273820554efd76b460526a33e28edaa7f9beba637ec0e397994b7299e5fa8613c556ce653340cc2679a962e2fdd798f491ff1a2833d66db43102928d204e0caf6933adc6b6e69445b50826a3434ae714b8ee7e7b5fc94d113ca2e348d6cfc4371fdbbdcfeb218b9ff8e92cb73a1e1ccee91f97850cba7dec3c96b9b105fe918b96ebc2059ee571396f989220e9ac76e45599463f947b5ca7db210348c267b79e46fe74963d28a2da0757f7a98e051cdffd490619d4c1ab623bc1593c0d867785bd757fccb89f4adbf41d888d5bc0c889b941d9c4c438471cb22e1d08474b57d3bad7d63dd7101802fb4f8f1df2d80938697636a65f2b9b5789aee535f092e47e6ff511b501f54b79862ac4a8815f5f55e84397f7cd16872ad64304c8ad72a2519795807a2c09fd4e9256b1221120568d768379f200674022585f4f63bb9136c805ac85129c9cf3d3090aa8826b4e73b845d3ae40c44826b521644a624c699faba8d899c9873ac5699741bc973d4a115553bd26227e55b99f49cd52929379facac42d91e0af4816603a7366cb672b7ed494f6736d84cc0cf8fe6dfa9565fb3b466974eedf36cf744fab76a5793df159fbeca8915491da9bc227da35a43848828037a1c9f330e1e1bfcac7996135b150167248e735f3d4d3924ac94263b308019faacb7b5b183f5ed60bd4787c6990489ac61a78bacf91eb998284542a0a86a9f988c7af860e8f8e4eae049a256c1ec5ba1b90caacee07d41e43eabfa9ea133fe98ac7ace4466481635dcaad15e9fd8d0f9018318118d25baa3ee3ef5c89ad0d3d2e2a2daad078ba27b77f482c472a90d8f15bb6d5df1349c9c943a41580be079af06629fd3d3bfc87088c972df02710986a633c17896ad25fb409daa192c35ed7ab212259634b7c3349abaf50692c6e8cc9de55c4b71dfc4763cc00871a74dae70841bd2a531812c10124103ddf4c10f335e8ef4da883e1b1f28ebe7c49012879d6aa787d751d7994ab539270c255176c9fce26d5adadce1d5583799f5fc63de702354d861a640d422adcea2b102aec5639f10b0fd775e63af70f1c3ae4212f8f983ab1b5e3716cf3f17a2ee2302766a6438ee18448baf1c90f0841a8ace3a4832f9b5d824c38e3c83ccb771a6ab39cf92b648c701d8e8133917ad2f46040d048e76655099130d457f9cd01e23593e677b364d18dd66ccf43d59db439be2ca8ffce0310b8", 0x501}], 0x2}}], 0x1, 0x44040841) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000040)={'tunl0\x00'}) getpid() ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000100)={'bridge_slave_1\x00'}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r5, 0x0, r6, 0x0, 0x7, 0x0) ioctl$TIOCGSID(r6, 0x5429, &(0x7f0000000140)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-ioctl$KVM_SET_CPUID2-ioctl$KVM_RUN-socket$inet6_udp-mprotect-connect$inet6-connect$pppl2tp-sendmmsg-ioctl$sock_inet_SIOCGIFPFLAGS-getpid-ioctl$sock_inet_SIOCGIFPFLAGS-socketpair$unix-pipe-splice-ioctl$TIOCGSID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x6) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f00009b3000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000480)="0f011a66b83c2900000f23c80f21f866350c00d0000f23f866b9800000c00f326635000100000f30ba2100ed3e6664660f54e866660f3881b8cfa8baf80c66b8345dc08966efbafc0c66ed66b9ee0900000f320fb4020f01c4", 0x7e}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000080)) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) mprotect(&(0x7f00009c5000/0x3000)=nil, 0x3000, 0x300000b) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x4e20, 0x2eb, @mcast2, 0xa}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x81, 0x0, 0x0, 0x0, {0xa, 0x4e21, 0xca33, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) sendmmsg(r0, &(0x7f0000004180)=[{{0x0, 0x0, &(0x7f00000024c0)=[{&(0x7f0000000300)="b90d9370bcb6b55124e4c18d4378d5204455503d5689e9f1a4662e3b15178e8160a5e047a301281ef95b0b3056d644afe0ac515acf082e97706d5741910285c9dfe45c728d146cbb40e18dcc67df1d8252252df698e7cb4cd57a2b2f4b1c3b50234cc4d04f3713c3242d5afa092cb492", 0x70}, {&(0x7f00000014c0)="e2ace30410d61649be29c6dc86f7d9b7a4e65beaf8854852ea14dd3935839f6a97bd3b0f7a5ca9a29fcd592ca29c7c8e95f2b4fabcdf35c6500e06b5010f7053e85ef8a57e01d953ce6ee8f261022f1b5ed677c88ab422e3b15d798f1376f09cc1c0c88b3d6bfabd65b0783b5b0762bd23249b33ff5531e5a601d9945f2f101a86f773681c6555d9a5f0de2d24ab96697a93fd924021dbae413ca92654c39420aa4a0cdafc1c850419b3f57441911c9d4b64ae6a9813a9d46966dc3edcadf54471482a3c5ce24d37d011b6257f42086088aa7f2e2686c5fd620344128fd0851f5498f63bf8f3039b8475f42ef1444d6293e0fa9d721f4cd3ddac8eba7d6357a47fed160c1f13678cd807f8a4ca9fec8a72b5261c34476ed424db26ac41d621123a81537a268eee21495f6149fd43f25fa0e491b9db817f89059bec94d1ef4f5e3950672f62b2577bec3f362e32d59d20d49a3905ded3ca6395e44291e08935de694d4e976adb32f36911214f1b6d3e809c009da652acef5098ab679bede7a0b3aa31de7753e79526e9dce36efea22956094fcc77add6f63a996cfd53b8273820554efd76b460526a33e28edaa7f9beba637ec0e397994b7299e5fa8613c556ce653340cc2679a962e2fdd798f491ff1a2833d66db43102928d204e0caf6933adc6b6e69445b50826a3434ae714b8ee7e7b5fc94d113ca2e348d6cfc4371fdbbdcfeb218b9ff8e92cb73a1e1ccee91f97850cba7dec3c96b9b105fe918b96ebc2059ee571396f989220e9ac76e45599463f947b5ca7db210348c267b79e46fe74963d28a2da0757f7a98e051cdffd490619d4c1ab623bc1593c0d867785bd757fccb89f4adbf41d888d5bc0c889b941d9c4c438471cb22e1d08474b57d3bad7d63dd7101802fb4f8f1df2d80938697636a65f2b9b5789aee535f092e47e6ff511b501f54b79862ac4a8815f5f55e84397f7cd16872ad64304c8ad72a2519795807a2c09fd4e9256b1221120568d768379f200674022585f4f63bb9136c805ac85129c9cf3d3090aa8826b4e73b845d3ae40c44826b521644a624c699faba8d899c9873ac5699741bc973d4a115553bd26227e55b99f49cd52929379facac42d91e0af4816603a7366cb672b7ed494f6736d84cc0cf8fe6dfa9565fb3b466974eedf36cf744fab76a5793df159fbeca8915491da9bc227da35a43848828037a1c9f330e1e1bfcac7996135b150167248e735f3d4d3924ac94263b308019faacb7b5b183f5ed60bd4787c6990489ac61a78bacf91eb998284542a0a86a9f988c7af860e8f8e4eae049a256c1ec5ba1b90caacee07d41e43eabfa9ea133fe98ac7ace4466481635dcaad15e9fd8d0f9018318118d25baa3ee3ef5c89ad0d3d2e2a2daad078ba27b77f482c472a90d8f15bb6d5df1349c9c943a41580be079af06629fd3d3bfc87088c972df02710986a633c17896ad25fb409daa192c35ed7ab212259634b7c3349abaf50692c6e8cc9de55c4b71dfc4763cc00871a74dae70841bd2a531812c10124103ddf4c10f335e8ef4da883e1b1f28ebe7c49012879d6aa787d751d7994ab539270c255176c9fce26d5adadce1d5583799f5fc63de702354d861a640d422adcea2b102aec5639f10b0fd775e63af70f1c3ae4212f8f983ab1b5e3716cf3f17a2ee2302766a6438ee18448baf1c90f0841a8ace3a4832f9b5d824c38e3c83ccb771a6ab39cf92b648c701d8e8133917ad2f46040d048e76655099130d457f9cd01e23593e677b364d18dd66ccf43d59db439be2ca8ffce0310b8", 0x501}], 0x2}}], 0x1, 0x44040841) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000040)={'tunl0\x00'}) getpid() ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000100)={'bridge_slave_1\x00'}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r5, 0x0, r6, 0x0, 0x7, 0x0) ioctl$TIOCGSID(r6, 0x5429, &(0x7f0000000140)) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-ioctl$KVM_SET_CPUID2-ioctl$KVM_RUN-socket$inet6_udp-mprotect-connect$inet6-connect$pppl2tp-sendmmsg-ioctl$sock_inet_SIOCGIFPFLAGS-getpid-ioctl$sock_inet_SIOCGIFPFLAGS-socketpair$unix-pipe-splice detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x6) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f00009b3000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000480)="0f011a66b83c2900000f23c80f21f866350c00d0000f23f866b9800000c00f326635000100000f30ba2100ed3e6664660f54e866660f3881b8cfa8baf80c66b8345dc08966efbafc0c66ed66b9ee0900000f320fb4020f01c4", 0x7e}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000080)) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) mprotect(&(0x7f00009c5000/0x3000)=nil, 0x3000, 0x300000b) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x4e20, 0x2eb, @mcast2, 0xa}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x81, 0x0, 0x0, 0x0, {0xa, 0x4e21, 0xca33, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) sendmmsg(r0, &(0x7f0000004180)=[{{0x0, 0x0, &(0x7f00000024c0)=[{&(0x7f0000000300)="b90d9370bcb6b55124e4c18d4378d5204455503d5689e9f1a4662e3b15178e8160a5e047a301281ef95b0b3056d644afe0ac515acf082e97706d5741910285c9dfe45c728d146cbb40e18dcc67df1d8252252df698e7cb4cd57a2b2f4b1c3b50234cc4d04f3713c3242d5afa092cb492", 0x70}, {&(0x7f00000014c0)="e2ace30410d61649be29c6dc86f7d9b7a4e65beaf8854852ea14dd3935839f6a97bd3b0f7a5ca9a29fcd592ca29c7c8e95f2b4fabcdf35c6500e06b5010f7053e85ef8a57e01d953ce6ee8f261022f1b5ed677c88ab422e3b15d798f1376f09cc1c0c88b3d6bfabd65b0783b5b0762bd23249b33ff5531e5a601d9945f2f101a86f773681c6555d9a5f0de2d24ab96697a93fd924021dbae413ca92654c39420aa4a0cdafc1c850419b3f57441911c9d4b64ae6a9813a9d46966dc3edcadf54471482a3c5ce24d37d011b6257f42086088aa7f2e2686c5fd620344128fd0851f5498f63bf8f3039b8475f42ef1444d6293e0fa9d721f4cd3ddac8eba7d6357a47fed160c1f13678cd807f8a4ca9fec8a72b5261c34476ed424db26ac41d621123a81537a268eee21495f6149fd43f25fa0e491b9db817f89059bec94d1ef4f5e3950672f62b2577bec3f362e32d59d20d49a3905ded3ca6395e44291e08935de694d4e976adb32f36911214f1b6d3e809c009da652acef5098ab679bede7a0b3aa31de7753e79526e9dce36efea22956094fcc77add6f63a996cfd53b8273820554efd76b460526a33e28edaa7f9beba637ec0e397994b7299e5fa8613c556ce653340cc2679a962e2fdd798f491ff1a2833d66db43102928d204e0caf6933adc6b6e69445b50826a3434ae714b8ee7e7b5fc94d113ca2e348d6cfc4371fdbbdcfeb218b9ff8e92cb73a1e1ccee91f97850cba7dec3c96b9b105fe918b96ebc2059ee571396f989220e9ac76e45599463f947b5ca7db210348c267b79e46fe74963d28a2da0757f7a98e051cdffd490619d4c1ab623bc1593c0d867785bd757fccb89f4adbf41d888d5bc0c889b941d9c4c438471cb22e1d08474b57d3bad7d63dd7101802fb4f8f1df2d80938697636a65f2b9b5789aee535f092e47e6ff511b501f54b79862ac4a8815f5f55e84397f7cd16872ad64304c8ad72a2519795807a2c09fd4e9256b1221120568d768379f200674022585f4f63bb9136c805ac85129c9cf3d3090aa8826b4e73b845d3ae40c44826b521644a624c699faba8d899c9873ac5699741bc973d4a115553bd26227e55b99f49cd52929379facac42d91e0af4816603a7366cb672b7ed494f6736d84cc0cf8fe6dfa9565fb3b466974eedf36cf744fab76a5793df159fbeca8915491da9bc227da35a43848828037a1c9f330e1e1bfcac7996135b150167248e735f3d4d3924ac94263b308019faacb7b5b183f5ed60bd4787c6990489ac61a78bacf91eb998284542a0a86a9f988c7af860e8f8e4eae049a256c1ec5ba1b90caacee07d41e43eabfa9ea133fe98ac7ace4466481635dcaad15e9fd8d0f9018318118d25baa3ee3ef5c89ad0d3d2e2a2daad078ba27b77f482c472a90d8f15bb6d5df1349c9c943a41580be079af06629fd3d3bfc87088c972df02710986a633c17896ad25fb409daa192c35ed7ab212259634b7c3349abaf50692c6e8cc9de55c4b71dfc4763cc00871a74dae70841bd2a531812c10124103ddf4c10f335e8ef4da883e1b1f28ebe7c49012879d6aa787d751d7994ab539270c255176c9fce26d5adadce1d5583799f5fc63de702354d861a640d422adcea2b102aec5639f10b0fd775e63af70f1c3ae4212f8f983ab1b5e3716cf3f17a2ee2302766a6438ee18448baf1c90f0841a8ace3a4832f9b5d824c38e3c83ccb771a6ab39cf92b648c701d8e8133917ad2f46040d048e76655099130d457f9cd01e23593e677b364d18dd66ccf43d59db439be2ca8ffce0310b8", 0x501}], 0x2}}], 0x1, 0x44040841) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000040)={'tunl0\x00'}) getpid() ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000100)={'bridge_slave_1\x00'}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r5, 0x0, r6, 0x0, 0x7, 0x0) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-ioctl$KVM_SET_CPUID2-ioctl$KVM_RUN-socket$inet6_udp-mprotect-connect$inet6-connect$pppl2tp-sendmmsg-ioctl$sock_inet_SIOCGIFPFLAGS-getpid-ioctl$sock_inet_SIOCGIFPFLAGS-socketpair$unix-pipe detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x6) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f00009b3000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000480)="0f011a66b83c2900000f23c80f21f866350c00d0000f23f866b9800000c00f326635000100000f30ba2100ed3e6664660f54e866660f3881b8cfa8baf80c66b8345dc08966efbafc0c66ed66b9ee0900000f320fb4020f01c4", 0x7e}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000080)) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) mprotect(&(0x7f00009c5000/0x3000)=nil, 0x3000, 0x300000b) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x4e20, 0x2eb, @mcast2, 0xa}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x81, 0x0, 0x0, 0x0, {0xa, 0x4e21, 0xca33, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) sendmmsg(r0, &(0x7f0000004180)=[{{0x0, 0x0, &(0x7f00000024c0)=[{&(0x7f0000000300)="b90d9370bcb6b55124e4c18d4378d5204455503d5689e9f1a4662e3b15178e8160a5e047a301281ef95b0b3056d644afe0ac515acf082e97706d5741910285c9dfe45c728d146cbb40e18dcc67df1d8252252df698e7cb4cd57a2b2f4b1c3b50234cc4d04f3713c3242d5afa092cb492", 0x70}, {&(0x7f00000014c0)="e2ace30410d61649be29c6dc86f7d9b7a4e65beaf8854852ea14dd3935839f6a97bd3b0f7a5ca9a29fcd592ca29c7c8e95f2b4fabcdf35c6500e06b5010f7053e85ef8a57e01d953ce6ee8f261022f1b5ed677c88ab422e3b15d798f1376f09cc1c0c88b3d6bfabd65b0783b5b0762bd23249b33ff5531e5a601d9945f2f101a86f773681c6555d9a5f0de2d24ab96697a93fd924021dbae413ca92654c39420aa4a0cdafc1c850419b3f57441911c9d4b64ae6a9813a9d46966dc3edcadf54471482a3c5ce24d37d011b6257f42086088aa7f2e2686c5fd620344128fd0851f5498f63bf8f3039b8475f42ef1444d6293e0fa9d721f4cd3ddac8eba7d6357a47fed160c1f13678cd807f8a4ca9fec8a72b5261c34476ed424db26ac41d621123a81537a268eee21495f6149fd43f25fa0e491b9db817f89059bec94d1ef4f5e3950672f62b2577bec3f362e32d59d20d49a3905ded3ca6395e44291e08935de694d4e976adb32f36911214f1b6d3e809c009da652acef5098ab679bede7a0b3aa31de7753e79526e9dce36efea22956094fcc77add6f63a996cfd53b8273820554efd76b460526a33e28edaa7f9beba637ec0e397994b7299e5fa8613c556ce653340cc2679a962e2fdd798f491ff1a2833d66db43102928d204e0caf6933adc6b6e69445b50826a3434ae714b8ee7e7b5fc94d113ca2e348d6cfc4371fdbbdcfeb218b9ff8e92cb73a1e1ccee91f97850cba7dec3c96b9b105fe918b96ebc2059ee571396f989220e9ac76e45599463f947b5ca7db210348c267b79e46fe74963d28a2da0757f7a98e051cdffd490619d4c1ab623bc1593c0d867785bd757fccb89f4adbf41d888d5bc0c889b941d9c4c438471cb22e1d08474b57d3bad7d63dd7101802fb4f8f1df2d80938697636a65f2b9b5789aee535f092e47e6ff511b501f54b79862ac4a8815f5f55e84397f7cd16872ad64304c8ad72a2519795807a2c09fd4e9256b1221120568d768379f200674022585f4f63bb9136c805ac85129c9cf3d3090aa8826b4e73b845d3ae40c44826b521644a624c699faba8d899c9873ac5699741bc973d4a115553bd26227e55b99f49cd52929379facac42d91e0af4816603a7366cb672b7ed494f6736d84cc0cf8fe6dfa9565fb3b466974eedf36cf744fab76a5793df159fbeca8915491da9bc227da35a43848828037a1c9f330e1e1bfcac7996135b150167248e735f3d4d3924ac94263b308019faacb7b5b183f5ed60bd4787c6990489ac61a78bacf91eb998284542a0a86a9f988c7af860e8f8e4eae049a256c1ec5ba1b90caacee07d41e43eabfa9ea133fe98ac7ace4466481635dcaad15e9fd8d0f9018318118d25baa3ee3ef5c89ad0d3d2e2a2daad078ba27b77f482c472a90d8f15bb6d5df1349c9c943a41580be079af06629fd3d3bfc87088c972df02710986a633c17896ad25fb409daa192c35ed7ab212259634b7c3349abaf50692c6e8cc9de55c4b71dfc4763cc00871a74dae70841bd2a531812c10124103ddf4c10f335e8ef4da883e1b1f28ebe7c49012879d6aa787d751d7994ab539270c255176c9fce26d5adadce1d5583799f5fc63de702354d861a640d422adcea2b102aec5639f10b0fd775e63af70f1c3ae4212f8f983ab1b5e3716cf3f17a2ee2302766a6438ee18448baf1c90f0841a8ace3a4832f9b5d824c38e3c83ccb771a6ab39cf92b648c701d8e8133917ad2f46040d048e76655099130d457f9cd01e23593e677b364d18dd66ccf43d59db439be2ca8ffce0310b8", 0x501}], 0x2}}], 0x1, 0x44040841) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000040)={'tunl0\x00'}) getpid() ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000100)={'bridge_slave_1\x00'}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) pipe(&(0x7f00000000c0)) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-ioctl$KVM_SET_CPUID2-ioctl$KVM_RUN-socket$inet6_udp-mprotect-connect$inet6-connect$pppl2tp-sendmmsg-ioctl$sock_inet_SIOCGIFPFLAGS-getpid-ioctl$sock_inet_SIOCGIFPFLAGS-socketpair$unix detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x6) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f00009b3000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000480)="0f011a66b83c2900000f23c80f21f866350c00d0000f23f866b9800000c00f326635000100000f30ba2100ed3e6664660f54e866660f3881b8cfa8baf80c66b8345dc08966efbafc0c66ed66b9ee0900000f320fb4020f01c4", 0x7e}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000080)) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) mprotect(&(0x7f00009c5000/0x3000)=nil, 0x3000, 0x300000b) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x4e20, 0x2eb, @mcast2, 0xa}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x81, 0x0, 0x0, 0x0, {0xa, 0x4e21, 0xca33, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) sendmmsg(r0, &(0x7f0000004180)=[{{0x0, 0x0, &(0x7f00000024c0)=[{&(0x7f0000000300)="b90d9370bcb6b55124e4c18d4378d5204455503d5689e9f1a4662e3b15178e8160a5e047a301281ef95b0b3056d644afe0ac515acf082e97706d5741910285c9dfe45c728d146cbb40e18dcc67df1d8252252df698e7cb4cd57a2b2f4b1c3b50234cc4d04f3713c3242d5afa092cb492", 0x70}, {&(0x7f00000014c0)="e2ace30410d61649be29c6dc86f7d9b7a4e65beaf8854852ea14dd3935839f6a97bd3b0f7a5ca9a29fcd592ca29c7c8e95f2b4fabcdf35c6500e06b5010f7053e85ef8a57e01d953ce6ee8f261022f1b5ed677c88ab422e3b15d798f1376f09cc1c0c88b3d6bfabd65b0783b5b0762bd23249b33ff5531e5a601d9945f2f101a86f773681c6555d9a5f0de2d24ab96697a93fd924021dbae413ca92654c39420aa4a0cdafc1c850419b3f57441911c9d4b64ae6a9813a9d46966dc3edcadf54471482a3c5ce24d37d011b6257f42086088aa7f2e2686c5fd620344128fd0851f5498f63bf8f3039b8475f42ef1444d6293e0fa9d721f4cd3ddac8eba7d6357a47fed160c1f13678cd807f8a4ca9fec8a72b5261c34476ed424db26ac41d621123a81537a268eee21495f6149fd43f25fa0e491b9db817f89059bec94d1ef4f5e3950672f62b2577bec3f362e32d59d20d49a3905ded3ca6395e44291e08935de694d4e976adb32f36911214f1b6d3e809c009da652acef5098ab679bede7a0b3aa31de7753e79526e9dce36efea22956094fcc77add6f63a996cfd53b8273820554efd76b460526a33e28edaa7f9beba637ec0e397994b7299e5fa8613c556ce653340cc2679a962e2fdd798f491ff1a2833d66db43102928d204e0caf6933adc6b6e69445b50826a3434ae714b8ee7e7b5fc94d113ca2e348d6cfc4371fdbbdcfeb218b9ff8e92cb73a1e1ccee91f97850cba7dec3c96b9b105fe918b96ebc2059ee571396f989220e9ac76e45599463f947b5ca7db210348c267b79e46fe74963d28a2da0757f7a98e051cdffd490619d4c1ab623bc1593c0d867785bd757fccb89f4adbf41d888d5bc0c889b941d9c4c438471cb22e1d08474b57d3bad7d63dd7101802fb4f8f1df2d80938697636a65f2b9b5789aee535f092e47e6ff511b501f54b79862ac4a8815f5f55e84397f7cd16872ad64304c8ad72a2519795807a2c09fd4e9256b1221120568d768379f200674022585f4f63bb9136c805ac85129c9cf3d3090aa8826b4e73b845d3ae40c44826b521644a624c699faba8d899c9873ac5699741bc973d4a115553bd26227e55b99f49cd52929379facac42d91e0af4816603a7366cb672b7ed494f6736d84cc0cf8fe6dfa9565fb3b466974eedf36cf744fab76a5793df159fbeca8915491da9bc227da35a43848828037a1c9f330e1e1bfcac7996135b150167248e735f3d4d3924ac94263b308019faacb7b5b183f5ed60bd4787c6990489ac61a78bacf91eb998284542a0a86a9f988c7af860e8f8e4eae049a256c1ec5ba1b90caacee07d41e43eabfa9ea133fe98ac7ace4466481635dcaad15e9fd8d0f9018318118d25baa3ee3ef5c89ad0d3d2e2a2daad078ba27b77f482c472a90d8f15bb6d5df1349c9c943a41580be079af06629fd3d3bfc87088c972df02710986a633c17896ad25fb409daa192c35ed7ab212259634b7c3349abaf50692c6e8cc9de55c4b71dfc4763cc00871a74dae70841bd2a531812c10124103ddf4c10f335e8ef4da883e1b1f28ebe7c49012879d6aa787d751d7994ab539270c255176c9fce26d5adadce1d5583799f5fc63de702354d861a640d422adcea2b102aec5639f10b0fd775e63af70f1c3ae4212f8f983ab1b5e3716cf3f17a2ee2302766a6438ee18448baf1c90f0841a8ace3a4832f9b5d824c38e3c83ccb771a6ab39cf92b648c701d8e8133917ad2f46040d048e76655099130d457f9cd01e23593e677b364d18dd66ccf43d59db439be2ca8ffce0310b8", 0x501}], 0x2}}], 0x1, 0x44040841) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000040)={'tunl0\x00'}) getpid() ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000100)={'bridge_slave_1\x00'}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-ioctl$KVM_SET_CPUID2-ioctl$KVM_RUN-socket$inet6_udp-mprotect-connect$inet6-connect$pppl2tp-sendmmsg-ioctl$sock_inet_SIOCGIFPFLAGS-getpid-ioctl$sock_inet_SIOCGIFPFLAGS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x6) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f00009b3000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000480)="0f011a66b83c2900000f23c80f21f866350c00d0000f23f866b9800000c00f326635000100000f30ba2100ed3e6664660f54e866660f3881b8cfa8baf80c66b8345dc08966efbafc0c66ed66b9ee0900000f320fb4020f01c4", 0x7e}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000080)) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) mprotect(&(0x7f00009c5000/0x3000)=nil, 0x3000, 0x300000b) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x4e20, 0x2eb, @mcast2, 0xa}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x81, 0x0, 0x0, 0x0, {0xa, 0x4e21, 0xca33, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) sendmmsg(r0, &(0x7f0000004180)=[{{0x0, 0x0, &(0x7f00000024c0)=[{&(0x7f0000000300)="b90d9370bcb6b55124e4c18d4378d5204455503d5689e9f1a4662e3b15178e8160a5e047a301281ef95b0b3056d644afe0ac515acf082e97706d5741910285c9dfe45c728d146cbb40e18dcc67df1d8252252df698e7cb4cd57a2b2f4b1c3b50234cc4d04f3713c3242d5afa092cb492", 0x70}, {&(0x7f00000014c0)="e2ace30410d61649be29c6dc86f7d9b7a4e65beaf8854852ea14dd3935839f6a97bd3b0f7a5ca9a29fcd592ca29c7c8e95f2b4fabcdf35c6500e06b5010f7053e85ef8a57e01d953ce6ee8f261022f1b5ed677c88ab422e3b15d798f1376f09cc1c0c88b3d6bfabd65b0783b5b0762bd23249b33ff5531e5a601d9945f2f101a86f773681c6555d9a5f0de2d24ab96697a93fd924021dbae413ca92654c39420aa4a0cdafc1c850419b3f57441911c9d4b64ae6a9813a9d46966dc3edcadf54471482a3c5ce24d37d011b6257f42086088aa7f2e2686c5fd620344128fd0851f5498f63bf8f3039b8475f42ef1444d6293e0fa9d721f4cd3ddac8eba7d6357a47fed160c1f13678cd807f8a4ca9fec8a72b5261c34476ed424db26ac41d621123a81537a268eee21495f6149fd43f25fa0e491b9db817f89059bec94d1ef4f5e3950672f62b2577bec3f362e32d59d20d49a3905ded3ca6395e44291e08935de694d4e976adb32f36911214f1b6d3e809c009da652acef5098ab679bede7a0b3aa31de7753e79526e9dce36efea22956094fcc77add6f63a996cfd53b8273820554efd76b460526a33e28edaa7f9beba637ec0e397994b7299e5fa8613c556ce653340cc2679a962e2fdd798f491ff1a2833d66db43102928d204e0caf6933adc6b6e69445b50826a3434ae714b8ee7e7b5fc94d113ca2e348d6cfc4371fdbbdcfeb218b9ff8e92cb73a1e1ccee91f97850cba7dec3c96b9b105fe918b96ebc2059ee571396f989220e9ac76e45599463f947b5ca7db210348c267b79e46fe74963d28a2da0757f7a98e051cdffd490619d4c1ab623bc1593c0d867785bd757fccb89f4adbf41d888d5bc0c889b941d9c4c438471cb22e1d08474b57d3bad7d63dd7101802fb4f8f1df2d80938697636a65f2b9b5789aee535f092e47e6ff511b501f54b79862ac4a8815f5f55e84397f7cd16872ad64304c8ad72a2519795807a2c09fd4e9256b1221120568d768379f200674022585f4f63bb9136c805ac85129c9cf3d3090aa8826b4e73b845d3ae40c44826b521644a624c699faba8d899c9873ac5699741bc973d4a115553bd26227e55b99f49cd52929379facac42d91e0af4816603a7366cb672b7ed494f6736d84cc0cf8fe6dfa9565fb3b466974eedf36cf744fab76a5793df159fbeca8915491da9bc227da35a43848828037a1c9f330e1e1bfcac7996135b150167248e735f3d4d3924ac94263b308019faacb7b5b183f5ed60bd4787c6990489ac61a78bacf91eb998284542a0a86a9f988c7af860e8f8e4eae049a256c1ec5ba1b90caacee07d41e43eabfa9ea133fe98ac7ace4466481635dcaad15e9fd8d0f9018318118d25baa3ee3ef5c89ad0d3d2e2a2daad078ba27b77f482c472a90d8f15bb6d5df1349c9c943a41580be079af06629fd3d3bfc87088c972df02710986a633c17896ad25fb409daa192c35ed7ab212259634b7c3349abaf50692c6e8cc9de55c4b71dfc4763cc00871a74dae70841bd2a531812c10124103ddf4c10f335e8ef4da883e1b1f28ebe7c49012879d6aa787d751d7994ab539270c255176c9fce26d5adadce1d5583799f5fc63de702354d861a640d422adcea2b102aec5639f10b0fd775e63af70f1c3ae4212f8f983ab1b5e3716cf3f17a2ee2302766a6438ee18448baf1c90f0841a8ace3a4832f9b5d824c38e3c83ccb771a6ab39cf92b648c701d8e8133917ad2f46040d048e76655099130d457f9cd01e23593e677b364d18dd66ccf43d59db439be2ca8ffce0310b8", 0x501}], 0x2}}], 0x1, 0x44040841) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000040)={'tunl0\x00'}) getpid() ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000100)={'bridge_slave_1\x00'}) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-ioctl$KVM_SET_CPUID2-ioctl$KVM_RUN-socket$inet6_udp-mprotect-connect$inet6-connect$pppl2tp-sendmmsg-ioctl$sock_inet_SIOCGIFPFLAGS-getpid detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x6) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f00009b3000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000480)="0f011a66b83c2900000f23c80f21f866350c00d0000f23f866b9800000c00f326635000100000f30ba2100ed3e6664660f54e866660f3881b8cfa8baf80c66b8345dc08966efbafc0c66ed66b9ee0900000f320fb4020f01c4", 0x7e}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000080)) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) mprotect(&(0x7f00009c5000/0x3000)=nil, 0x3000, 0x300000b) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x4e20, 0x2eb, @mcast2, 0xa}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x81, 0x0, 0x0, 0x0, {0xa, 0x4e21, 0xca33, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) sendmmsg(r0, &(0x7f0000004180)=[{{0x0, 0x0, &(0x7f00000024c0)=[{&(0x7f0000000300)="b90d9370bcb6b55124e4c18d4378d5204455503d5689e9f1a4662e3b15178e8160a5e047a301281ef95b0b3056d644afe0ac515acf082e97706d5741910285c9dfe45c728d146cbb40e18dcc67df1d8252252df698e7cb4cd57a2b2f4b1c3b50234cc4d04f3713c3242d5afa092cb492", 0x70}, {&(0x7f00000014c0)="e2ace30410d61649be29c6dc86f7d9b7a4e65beaf8854852ea14dd3935839f6a97bd3b0f7a5ca9a29fcd592ca29c7c8e95f2b4fabcdf35c6500e06b5010f7053e85ef8a57e01d953ce6ee8f261022f1b5ed677c88ab422e3b15d798f1376f09cc1c0c88b3d6bfabd65b0783b5b0762bd23249b33ff5531e5a601d9945f2f101a86f773681c6555d9a5f0de2d24ab96697a93fd924021dbae413ca92654c39420aa4a0cdafc1c850419b3f57441911c9d4b64ae6a9813a9d46966dc3edcadf54471482a3c5ce24d37d011b6257f42086088aa7f2e2686c5fd620344128fd0851f5498f63bf8f3039b8475f42ef1444d6293e0fa9d721f4cd3ddac8eba7d6357a47fed160c1f13678cd807f8a4ca9fec8a72b5261c34476ed424db26ac41d621123a81537a268eee21495f6149fd43f25fa0e491b9db817f89059bec94d1ef4f5e3950672f62b2577bec3f362e32d59d20d49a3905ded3ca6395e44291e08935de694d4e976adb32f36911214f1b6d3e809c009da652acef5098ab679bede7a0b3aa31de7753e79526e9dce36efea22956094fcc77add6f63a996cfd53b8273820554efd76b460526a33e28edaa7f9beba637ec0e397994b7299e5fa8613c556ce653340cc2679a962e2fdd798f491ff1a2833d66db43102928d204e0caf6933adc6b6e69445b50826a3434ae714b8ee7e7b5fc94d113ca2e348d6cfc4371fdbbdcfeb218b9ff8e92cb73a1e1ccee91f97850cba7dec3c96b9b105fe918b96ebc2059ee571396f989220e9ac76e45599463f947b5ca7db210348c267b79e46fe74963d28a2da0757f7a98e051cdffd490619d4c1ab623bc1593c0d867785bd757fccb89f4adbf41d888d5bc0c889b941d9c4c438471cb22e1d08474b57d3bad7d63dd7101802fb4f8f1df2d80938697636a65f2b9b5789aee535f092e47e6ff511b501f54b79862ac4a8815f5f55e84397f7cd16872ad64304c8ad72a2519795807a2c09fd4e9256b1221120568d768379f200674022585f4f63bb9136c805ac85129c9cf3d3090aa8826b4e73b845d3ae40c44826b521644a624c699faba8d899c9873ac5699741bc973d4a115553bd26227e55b99f49cd52929379facac42d91e0af4816603a7366cb672b7ed494f6736d84cc0cf8fe6dfa9565fb3b466974eedf36cf744fab76a5793df159fbeca8915491da9bc227da35a43848828037a1c9f330e1e1bfcac7996135b150167248e735f3d4d3924ac94263b308019faacb7b5b183f5ed60bd4787c6990489ac61a78bacf91eb998284542a0a86a9f988c7af860e8f8e4eae049a256c1ec5ba1b90caacee07d41e43eabfa9ea133fe98ac7ace4466481635dcaad15e9fd8d0f9018318118d25baa3ee3ef5c89ad0d3d2e2a2daad078ba27b77f482c472a90d8f15bb6d5df1349c9c943a41580be079af06629fd3d3bfc87088c972df02710986a633c17896ad25fb409daa192c35ed7ab212259634b7c3349abaf50692c6e8cc9de55c4b71dfc4763cc00871a74dae70841bd2a531812c10124103ddf4c10f335e8ef4da883e1b1f28ebe7c49012879d6aa787d751d7994ab539270c255176c9fce26d5adadce1d5583799f5fc63de702354d861a640d422adcea2b102aec5639f10b0fd775e63af70f1c3ae4212f8f983ab1b5e3716cf3f17a2ee2302766a6438ee18448baf1c90f0841a8ace3a4832f9b5d824c38e3c83ccb771a6ab39cf92b648c701d8e8133917ad2f46040d048e76655099130d457f9cd01e23593e677b364d18dd66ccf43d59db439be2ca8ffce0310b8", 0x501}], 0x2}}], 0x1, 0x44040841) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000040)={'tunl0\x00'}) getpid() program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-ioctl$KVM_SET_CPUID2-ioctl$KVM_RUN-socket$inet6_udp-mprotect-connect$inet6-connect$pppl2tp-sendmmsg-ioctl$sock_inet_SIOCGIFPFLAGS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x6) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f00009b3000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000480)="0f011a66b83c2900000f23c80f21f866350c00d0000f23f866b9800000c00f326635000100000f30ba2100ed3e6664660f54e866660f3881b8cfa8baf80c66b8345dc08966efbafc0c66ed66b9ee0900000f320fb4020f01c4", 0x7e}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000080)) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) mprotect(&(0x7f00009c5000/0x3000)=nil, 0x3000, 0x300000b) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x4e20, 0x2eb, @mcast2, 0xa}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x81, 0x0, 0x0, 0x0, {0xa, 0x4e21, 0xca33, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) sendmmsg(r0, &(0x7f0000004180)=[{{0x0, 0x0, &(0x7f00000024c0)=[{&(0x7f0000000300)="b90d9370bcb6b55124e4c18d4378d5204455503d5689e9f1a4662e3b15178e8160a5e047a301281ef95b0b3056d644afe0ac515acf082e97706d5741910285c9dfe45c728d146cbb40e18dcc67df1d8252252df698e7cb4cd57a2b2f4b1c3b50234cc4d04f3713c3242d5afa092cb492", 0x70}, {&(0x7f00000014c0)="e2ace30410d61649be29c6dc86f7d9b7a4e65beaf8854852ea14dd3935839f6a97bd3b0f7a5ca9a29fcd592ca29c7c8e95f2b4fabcdf35c6500e06b5010f7053e85ef8a57e01d953ce6ee8f261022f1b5ed677c88ab422e3b15d798f1376f09cc1c0c88b3d6bfabd65b0783b5b0762bd23249b33ff5531e5a601d9945f2f101a86f773681c6555d9a5f0de2d24ab96697a93fd924021dbae413ca92654c39420aa4a0cdafc1c850419b3f57441911c9d4b64ae6a9813a9d46966dc3edcadf54471482a3c5ce24d37d011b6257f42086088aa7f2e2686c5fd620344128fd0851f5498f63bf8f3039b8475f42ef1444d6293e0fa9d721f4cd3ddac8eba7d6357a47fed160c1f13678cd807f8a4ca9fec8a72b5261c34476ed424db26ac41d621123a81537a268eee21495f6149fd43f25fa0e491b9db817f89059bec94d1ef4f5e3950672f62b2577bec3f362e32d59d20d49a3905ded3ca6395e44291e08935de694d4e976adb32f36911214f1b6d3e809c009da652acef5098ab679bede7a0b3aa31de7753e79526e9dce36efea22956094fcc77add6f63a996cfd53b8273820554efd76b460526a33e28edaa7f9beba637ec0e397994b7299e5fa8613c556ce653340cc2679a962e2fdd798f491ff1a2833d66db43102928d204e0caf6933adc6b6e69445b50826a3434ae714b8ee7e7b5fc94d113ca2e348d6cfc4371fdbbdcfeb218b9ff8e92cb73a1e1ccee91f97850cba7dec3c96b9b105fe918b96ebc2059ee571396f989220e9ac76e45599463f947b5ca7db210348c267b79e46fe74963d28a2da0757f7a98e051cdffd490619d4c1ab623bc1593c0d867785bd757fccb89f4adbf41d888d5bc0c889b941d9c4c438471cb22e1d08474b57d3bad7d63dd7101802fb4f8f1df2d80938697636a65f2b9b5789aee535f092e47e6ff511b501f54b79862ac4a8815f5f55e84397f7cd16872ad64304c8ad72a2519795807a2c09fd4e9256b1221120568d768379f200674022585f4f63bb9136c805ac85129c9cf3d3090aa8826b4e73b845d3ae40c44826b521644a624c699faba8d899c9873ac5699741bc973d4a115553bd26227e55b99f49cd52929379facac42d91e0af4816603a7366cb672b7ed494f6736d84cc0cf8fe6dfa9565fb3b466974eedf36cf744fab76a5793df159fbeca8915491da9bc227da35a43848828037a1c9f330e1e1bfcac7996135b150167248e735f3d4d3924ac94263b308019faacb7b5b183f5ed60bd4787c6990489ac61a78bacf91eb998284542a0a86a9f988c7af860e8f8e4eae049a256c1ec5ba1b90caacee07d41e43eabfa9ea133fe98ac7ace4466481635dcaad15e9fd8d0f9018318118d25baa3ee3ef5c89ad0d3d2e2a2daad078ba27b77f482c472a90d8f15bb6d5df1349c9c943a41580be079af06629fd3d3bfc87088c972df02710986a633c17896ad25fb409daa192c35ed7ab212259634b7c3349abaf50692c6e8cc9de55c4b71dfc4763cc00871a74dae70841bd2a531812c10124103ddf4c10f335e8ef4da883e1b1f28ebe7c49012879d6aa787d751d7994ab539270c255176c9fce26d5adadce1d5583799f5fc63de702354d861a640d422adcea2b102aec5639f10b0fd775e63af70f1c3ae4212f8f983ab1b5e3716cf3f17a2ee2302766a6438ee18448baf1c90f0841a8ace3a4832f9b5d824c38e3c83ccb771a6ab39cf92b648c701d8e8133917ad2f46040d048e76655099130d457f9cd01e23593e677b364d18dd66ccf43d59db439be2ca8ffce0310b8", 0x501}], 0x2}}], 0x1, 0x44040841) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000040)={'tunl0\x00'}) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-ioctl$KVM_SET_CPUID2-ioctl$KVM_RUN-socket$inet6_udp-mprotect-connect$inet6-connect$pppl2tp-sendmmsg detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x6) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f00009b3000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000480)="0f011a66b83c2900000f23c80f21f866350c00d0000f23f866b9800000c00f326635000100000f30ba2100ed3e6664660f54e866660f3881b8cfa8baf80c66b8345dc08966efbafc0c66ed66b9ee0900000f320fb4020f01c4", 0x7e}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000080)) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) mprotect(&(0x7f00009c5000/0x3000)=nil, 0x3000, 0x300000b) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x4e20, 0x2eb, @mcast2, 0xa}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x81, 0x0, 0x0, 0x0, {0xa, 0x4e21, 0xca33, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) sendmmsg(r0, &(0x7f0000004180)=[{{0x0, 0x0, &(0x7f00000024c0)=[{&(0x7f0000000300)="b90d9370bcb6b55124e4c18d4378d5204455503d5689e9f1a4662e3b15178e8160a5e047a301281ef95b0b3056d644afe0ac515acf082e97706d5741910285c9dfe45c728d146cbb40e18dcc67df1d8252252df698e7cb4cd57a2b2f4b1c3b50234cc4d04f3713c3242d5afa092cb492", 0x70}, {&(0x7f00000014c0)="e2ace30410d61649be29c6dc86f7d9b7a4e65beaf8854852ea14dd3935839f6a97bd3b0f7a5ca9a29fcd592ca29c7c8e95f2b4fabcdf35c6500e06b5010f7053e85ef8a57e01d953ce6ee8f261022f1b5ed677c88ab422e3b15d798f1376f09cc1c0c88b3d6bfabd65b0783b5b0762bd23249b33ff5531e5a601d9945f2f101a86f773681c6555d9a5f0de2d24ab96697a93fd924021dbae413ca92654c39420aa4a0cdafc1c850419b3f57441911c9d4b64ae6a9813a9d46966dc3edcadf54471482a3c5ce24d37d011b6257f42086088aa7f2e2686c5fd620344128fd0851f5498f63bf8f3039b8475f42ef1444d6293e0fa9d721f4cd3ddac8eba7d6357a47fed160c1f13678cd807f8a4ca9fec8a72b5261c34476ed424db26ac41d621123a81537a268eee21495f6149fd43f25fa0e491b9db817f89059bec94d1ef4f5e3950672f62b2577bec3f362e32d59d20d49a3905ded3ca6395e44291e08935de694d4e976adb32f36911214f1b6d3e809c009da652acef5098ab679bede7a0b3aa31de7753e79526e9dce36efea22956094fcc77add6f63a996cfd53b8273820554efd76b460526a33e28edaa7f9beba637ec0e397994b7299e5fa8613c556ce653340cc2679a962e2fdd798f491ff1a2833d66db43102928d204e0caf6933adc6b6e69445b50826a3434ae714b8ee7e7b5fc94d113ca2e348d6cfc4371fdbbdcfeb218b9ff8e92cb73a1e1ccee91f97850cba7dec3c96b9b105fe918b96ebc2059ee571396f989220e9ac76e45599463f947b5ca7db210348c267b79e46fe74963d28a2da0757f7a98e051cdffd490619d4c1ab623bc1593c0d867785bd757fccb89f4adbf41d888d5bc0c889b941d9c4c438471cb22e1d08474b57d3bad7d63dd7101802fb4f8f1df2d80938697636a65f2b9b5789aee535f092e47e6ff511b501f54b79862ac4a8815f5f55e84397f7cd16872ad64304c8ad72a2519795807a2c09fd4e9256b1221120568d768379f200674022585f4f63bb9136c805ac85129c9cf3d3090aa8826b4e73b845d3ae40c44826b521644a624c699faba8d899c9873ac5699741bc973d4a115553bd26227e55b99f49cd52929379facac42d91e0af4816603a7366cb672b7ed494f6736d84cc0cf8fe6dfa9565fb3b466974eedf36cf744fab76a5793df159fbeca8915491da9bc227da35a43848828037a1c9f330e1e1bfcac7996135b150167248e735f3d4d3924ac94263b308019faacb7b5b183f5ed60bd4787c6990489ac61a78bacf91eb998284542a0a86a9f988c7af860e8f8e4eae049a256c1ec5ba1b90caacee07d41e43eabfa9ea133fe98ac7ace4466481635dcaad15e9fd8d0f9018318118d25baa3ee3ef5c89ad0d3d2e2a2daad078ba27b77f482c472a90d8f15bb6d5df1349c9c943a41580be079af06629fd3d3bfc87088c972df02710986a633c17896ad25fb409daa192c35ed7ab212259634b7c3349abaf50692c6e8cc9de55c4b71dfc4763cc00871a74dae70841bd2a531812c10124103ddf4c10f335e8ef4da883e1b1f28ebe7c49012879d6aa787d751d7994ab539270c255176c9fce26d5adadce1d5583799f5fc63de702354d861a640d422adcea2b102aec5639f10b0fd775e63af70f1c3ae4212f8f983ab1b5e3716cf3f17a2ee2302766a6438ee18448baf1c90f0841a8ace3a4832f9b5d824c38e3c83ccb771a6ab39cf92b648c701d8e8133917ad2f46040d048e76655099130d457f9cd01e23593e677b364d18dd66ccf43d59db439be2ca8ffce0310b8", 0x501}], 0x2}}], 0x1, 0x44040841) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-ioctl$KVM_SET_CPUID2-ioctl$KVM_RUN-socket$inet6_udp-mprotect-connect$inet6-connect$pppl2tp-ioctl$sock_inet_SIOCGIFPFLAGS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x6) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f00009b3000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000480)="0f011a66b83c2900000f23c80f21f866350c00d0000f23f866b9800000c00f326635000100000f30ba2100ed3e6664660f54e866660f3881b8cfa8baf80c66b8345dc08966efbafc0c66ed66b9ee0900000f320fb4020f01c4", 0x7e}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000080)) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) mprotect(&(0x7f00009c5000/0x3000)=nil, 0x3000, 0x300000b) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x4e20, 0x2eb, @mcast2, 0xa}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x81, 0x0, 0x0, 0x0, {0xa, 0x4e21, 0xca33, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000040)={'tunl0\x00'}) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-ioctl$KVM_SET_CPUID2-ioctl$KVM_RUN-socket$inet6_udp-mprotect-connect$inet6-ioctl$sock_inet_SIOCGIFPFLAGS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x6) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f00009b3000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000480)="0f011a66b83c2900000f23c80f21f866350c00d0000f23f866b9800000c00f326635000100000f30ba2100ed3e6664660f54e866660f3881b8cfa8baf80c66b8345dc08966efbafc0c66ed66b9ee0900000f320fb4020f01c4", 0x7e}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000080)) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) mprotect(&(0x7f00009c5000/0x3000)=nil, 0x3000, 0x300000b) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x4e20, 0x2eb, @mcast2, 0xa}, 0x1c) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000040)={'tunl0\x00'}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-ioctl$KVM_SET_CPUID2-ioctl$KVM_RUN-socket$inet6_udp-mprotect-connect$pppl2tp-ioctl$sock_inet_SIOCGIFPFLAGS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x6) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f00009b3000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000480)="0f011a66b83c2900000f23c80f21f866350c00d0000f23f866b9800000c00f326635000100000f30ba2100ed3e6664660f54e866660f3881b8cfa8baf80c66b8345dc08966efbafc0c66ed66b9ee0900000f320fb4020f01c4", 0x7e}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000080)) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) mprotect(&(0x7f00009c5000/0x3000)=nil, 0x3000, 0x300000b) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x81, 0x0, 0x0, 0x0, {0xa, 0x4e21, 0xca33, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000040)={'tunl0\x00'}) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-ioctl$KVM_SET_CPUID2-ioctl$KVM_RUN-socket$inet6_udp-connect$pppl2tp-ioctl$sock_inet_SIOCGIFPFLAGS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x6) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f00009b3000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000480)="0f011a66b83c2900000f23c80f21f866350c00d0000f23f866b9800000c00f326635000100000f30ba2100ed3e6664660f54e866660f3881b8cfa8baf80c66b8345dc08966efbafc0c66ed66b9ee0900000f320fb4020f01c4", 0x7e}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000080)) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x81, 0x0, 0x0, 0x0, {0xa, 0x4e21, 0xca33, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000040)={'tunl0\x00'}) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-ioctl$KVM_SET_CPUID2-ioctl$KVM_RUN-connect$pppl2tp-ioctl$sock_inet_SIOCGIFPFLAGS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x6) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f00009b3000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000480)="0f011a66b83c2900000f23c80f21f866350c00d0000f23f866b9800000c00f326635000100000f30ba2100ed3e6664660f54e866660f3881b8cfa8baf80c66b8345dc08966efbafc0c66ed66b9ee0900000f320fb4020f01c4", 0x7e}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000080)) ioctl$KVM_RUN(r3, 0xae80, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x81, 0x0, 0x0, 0x0, {0xa, 0x4e21, 0xca33, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000040)={'tunl0\x00'}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-ioctl$KVM_SET_CPUID2-socket$inet6_udp-connect$pppl2tp-ioctl$sock_inet_SIOCGIFPFLAGS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x6) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f00009b3000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000480)="0f011a66b83c2900000f23c80f21f866350c00d0000f23f866b9800000c00f326635000100000f30ba2100ed3e6664660f54e866660f3881b8cfa8baf80c66b8345dc08966efbafc0c66ed66b9ee0900000f320fb4020f01c4", 0x7e}], 0x1, 0x1, 0x0, 0x0) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000080)) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x81, 0x0, 0x0, 0x0, {0xa, 0x4e21, 0xca33, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000040)={'tunl0\x00'}) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-syz_kvm_setup_cpu$x86-socket$inet6_udp-connect$pppl2tp-ioctl$sock_inet_SIOCGIFPFLAGS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x6) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f00009b3000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, &(0x7f0000000480)="0f011a66b83c2900000f23c80f21f866350c00d0000f23f866b9800000c00f326635000100000f30ba2100ed3e6664660f54e866660f3881b8cfa8baf80c66b8345dc08966efbafc0c66ed66b9ee0900000f320fb4020f01c4", 0x7e}], 0x1, 0x1, 0x0, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x81, 0x0, 0x0, 0x0, {0xa, 0x4e21, 0xca33, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000040)={'tunl0\x00'}) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-socket$inet6_udp-connect$pppl2tp-ioctl$sock_inet_SIOCGIFPFLAGS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x6) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x81, 0x0, 0x0, 0x0, {0xa, 0x4e21, 0xca33, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000040)={'tunl0\x00'}) program crashed: KASAN: use-after-free Read in rcu_cblist_dequeue testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-openat$kvm-ioctl$KVM_CREATE_VM-socket$inet6_udp-connect$pppl2tp-ioctl$sock_inet_SIOCGIFPFLAGS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20100, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x81, 0x0, 0x0, 0x0, {0xa, 0x4e21, 0xca33, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000040)={'tunl0\x00'}) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-openat$kvm-socket$inet6_udp-connect$pppl2tp-ioctl$sock_inet_SIOCGIFPFLAGS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20100, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x81, 0x0, 0x0, 0x0, {0xa, 0x4e21, 0xca33, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000040)={'tunl0\x00'}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_inet_SIOCGIFPFLAGS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x81, 0x0, 0x0, 0x0, {0xa, 0x4e21, 0xca33, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000040)={'tunl0\x00'}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_udp-connect$pppl2tp-ioctl$sock_inet_SIOCGIFPFLAGS detailed listing: executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x81, 0x0, 0x0, 0x0, {0xa, 0x4e21, 0xca33, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) ioctl$sock_inet_SIOCGIFPFLAGS(0xffffffffffffffff, 0x8935, &(0x7f0000000040)={'tunl0\x00'}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_inet_SIOCGIFPFLAGS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, 0x0, 0x0) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000040)={'tunl0\x00'}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_inet_SIOCGIFPFLAGS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x81, 0x0, 0x0, 0x0, {0xa, 0x4e21, 0xca33, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release extracting C reproducer testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_inet_SIOCGIFPFLAGS program crashed: KASAN: use-after-free Write in pppol2tp_release simplifying C reproducer testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_inet_SIOCGIFPFLAGS program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_inet_SIOCGIFPFLAGS program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_inet_SIOCGIFPFLAGS program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_inet_SIOCGIFPFLAGS program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_inet_SIOCGIFPFLAGS program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_inet_SIOCGIFPFLAGS program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_inet_SIOCGIFPFLAGS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x81, 0x0, 0x0, 0x0, {0xa, 0x4e21, 0xca33, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, 0x0) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session validation run: crashed=true testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_inet_SIOCGIFPFLAGS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x81, 0x0, 0x0, 0x0, {0xa, 0x4e21, 0xca33, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, 0x0) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session validation run: crashed=true testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_inet_SIOCGIFPFLAGS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x81, 0x0, 0x0, 0x0, {0xa, 0x4e21, 0xca33, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, 0x32) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release validation run: crashed=true reproducing took 24m55.932105423s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: use-after-free in atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline] BUG: KASAN: use-after-free in atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline] BUG: KASAN: use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:173 [inline] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298 Write of size 8 at addr ffff888110acd150 by task syz.2.17/394 CPU: 1 PID: 394 Comm: syz.2.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:77 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:435 [inline] kasan_report+0x100/0x140 mm/kasan/report.c:452 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline] atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline] __mutex_trylock_fast kernel/locking/mutex.c:173 [inline] mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298 pppol2tp_release+0x178/0x2b0 net/l2tp/l2tp_ppp.c:442 __sock_release net/socket.c:597 [inline] sock_close+0xb8/0x200 net/socket.c:1287 __fput+0x2dc/0x730 fs/file_table.c:281 ____fput+0x15/0x20 fs/file_table.c:314 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:175 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:202 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:277 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f3f4fc8f159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff0c0d5ed8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007fff0c0d5fc0 RCX: 00007f3f4fc8f159 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 0000000000007285 R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b32a20000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f3f4ff16fac R14: 00007f3f4ff16fa8 R15: 00007f3f4ff16fa0 Allocated by task 394: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:430 [inline] ____kasan_kmalloc mm/kasan/common.c:509 [inline] __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:518 kasan_kmalloc include/linux/kasan.h:254 [inline] __kmalloc+0x19f/0x330 mm/slub.c:4038 kmalloc include/linux/slab.h:560 [inline] kzalloc include/linux/slab.h:667 [inline] l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772 __sys_connect_file net/socket.c:1867 [inline] __sys_connect+0x3ce/0x450 net/socket.c:1884 __do_sys_connect net/socket.c:1894 [inline] __se_sys_connect net/socket.c:1891 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:1891 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xcb Freed by task 394: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4a/0x70 mm/kasan/common.c:45 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:362 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370 kasan_slab_free include/linux/kasan.h:220 [inline] slab_free_hook mm/slub.c:1600 [inline] slab_free_freelist_hook+0xc5/0x190 mm/slub.c:1626 slab_free mm/slub.c:3208 [inline] kfree+0xc0/0x270 mm/slub.c:4196 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline] l2tp_session_put+0xb2/0x1a0 net/l2tp/l2tp_core.c:193 l2tp_session_delete+0x3a9/0x4a0 net/l2tp/l2tp_core.c:1589 pppol2tp_release+0x169/0x2b0 net/l2tp/l2tp_ppp.c:439 __sock_release net/socket.c:597 [inline] sock_close+0xb8/0x200 net/socket.c:1287 __fput+0x2dc/0x730 fs/file_table.c:281 ____fput+0x15/0x20 fs/file_table.c:314 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:175 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:202 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:277 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb The buggy address belongs to the object at ffff888110acd000 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 336 bytes inside of 512-byte region [ffff888110acd000, ffff888110acd200) The buggy address belongs to the page: page:ffffea000442b300 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x110acc head:ffffea000442b300 order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head) raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 363, ts 29346081592, free_ts 29319687084 set_page_owner include/linux/page_owner.h:35 [inline] post_alloc_hook mm/page_alloc.c:2456 [inline] prep_new_page+0x176/0x190 mm/page_alloc.c:2462 get_page_from_freelist+0x225f/0x23f0 mm/page_alloc.c:4254 __alloc_pages_nodemask+0x29a/0x640 mm/page_alloc.c:5384 alloc_slab_page mm/slub.c:-1 [inline] allocate_slab mm/slub.c:1813 [inline] new_slab+0x84/0x3f0 mm/slub.c:1874 new_slab_objects mm/slub.c:2632 [inline] ___slab_alloc+0x2f8/0x4c0 mm/slub.c:2796 __slab_alloc+0x63/0xa0 mm/slub.c:2836 slab_alloc_node mm/slub.c:2918 [inline] slab_alloc mm/slub.c:2960 [inline] __kmalloc_track_caller+0x1e4/0x310 mm/slub.c:4541 __kmalloc_reserve net/core/skbuff.c:144 [inline] __alloc_skb+0xdc/0x520 net/core/skbuff.c:212 alloc_skb include/linux/skbuff.h:1126 [inline] nlmsg_new include/net/netlink.h:953 [inline] netlink_ack+0x35c/0xb30 net/netlink/af_netlink.c:2443 netlink_rcv_skb+0x267/0x430 net/netlink/af_netlink.c:2514 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:5640 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] netlink_unicast+0x86c/0xa30 net/netlink/af_netlink.c:1340 netlink_sendmsg+0x949/0xb70 net/netlink/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:652 [inline] __sock_sendmsg net/socket.c:664 [inline] __sys_sendto+0x467/0x620 net/socket.c:2007 __do_sys_sendto net/socket.c:2019 [inline] __se_sys_sendto net/socket.c:2015 [inline] __x64_sys_sendto+0xe5/0x100 net/socket.c:2015 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46 page last free stack trace: reset_page_owner include/linux/page_owner.h:28 [inline] free_pages_prepare mm/page_alloc.c:1349 [inline] __free_pages_ok+0x80b/0x830 mm/page_alloc.c:1629 free_the_page mm/page_alloc.c:5445 [inline] __free_pages+0xd8/0x390 mm/page_alloc.c:5454 __free_slab+0xcf/0x190 mm/slub.c:1899 free_slab mm/slub.c:1914 [inline] discard_slab mm/slub.c:1920 [inline] unfreeze_partials+0x150/0x180 mm/slub.c:2415 put_cpu_partial+0xc1/0x180 mm/slub.c:2451 __slab_free+0x2c9/0x3a0 mm/slub.c:3100 do_slab_free mm/slub.c:3196 [inline] ___cache_free+0x10e/0x130 mm/slub.c:3215 qlink_free+0x50/0x90 mm/kasan/quarantine.c:157 qlist_free_all+0x5f/0xb0 mm/kasan/quarantine.c:176 kasan_quarantine_reduce+0x14a/0x160 mm/kasan/quarantine.c:283 __kasan_slab_alloc+0x2f/0xe0 mm/kasan/common.c:440 kasan_slab_alloc include/linux/kasan.h:244 [inline] slab_post_alloc_hook+0x5d/0x2f0 mm/slab.h:580 slab_alloc_node mm/slub.c:2952 [inline] slab_alloc mm/slub.c:2960 [inline] kmem_cache_alloc+0x15a/0x2d0 mm/slub.c:2965 kmem_cache_alloc_node include/linux/slab.h:426 [inline] __alloc_skb+0x9e/0x520 net/core/skbuff.c:200 alloc_skb include/linux/skbuff.h:1126 [inline] nlmsg_new include/net/netlink.h:953 [inline] rtmsg_ifa+0xfa/0x1d0 net/ipv4/devinet.c:1927 __inet_del_ifa+0x80b/0xd90 net/ipv4/devinet.c:441 Memory state around the buggy address: ffff888110acd000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888110acd080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888110acd100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888110acd180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888110acd200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: use-after-free in atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline] BUG: KASAN: use-after-free in atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline] BUG: KASAN: use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:173 [inline] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298 Write of size 8 at addr ffff888110acd150 by task syz.2.17/394 CPU: 1 PID: 394 Comm: syz.2.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:77 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:435 [inline] kasan_report+0x100/0x140 mm/kasan/report.c:452 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline] atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline] __mutex_trylock_fast kernel/locking/mutex.c:173 [inline] mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298 pppol2tp_release+0x178/0x2b0 net/l2tp/l2tp_ppp.c:442 __sock_release net/socket.c:597 [inline] sock_close+0xb8/0x200 net/socket.c:1287 __fput+0x2dc/0x730 fs/file_table.c:281 ____fput+0x15/0x20 fs/file_table.c:314 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:175 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:202 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:277 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f3f4fc8f159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff0c0d5ed8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007fff0c0d5fc0 RCX: 00007f3f4fc8f159 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 0000000000007285 R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b32a20000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f3f4ff16fac R14: 00007f3f4ff16fa8 R15: 00007f3f4ff16fa0 Allocated by task 394: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:430 [inline] ____kasan_kmalloc mm/kasan/common.c:509 [inline] __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:518 kasan_kmalloc include/linux/kasan.h:254 [inline] __kmalloc+0x19f/0x330 mm/slub.c:4038 kmalloc include/linux/slab.h:560 [inline] kzalloc include/linux/slab.h:667 [inline] l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772 __sys_connect_file net/socket.c:1867 [inline] __sys_connect+0x3ce/0x450 net/socket.c:1884 __do_sys_connect net/socket.c:1894 [inline] __se_sys_connect net/socket.c:1891 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:1891 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xcb Freed by task 394: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4a/0x70 mm/kasan/common.c:45 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:362 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370 kasan_slab_free include/linux/kasan.h:220 [inline] slab_free_hook mm/slub.c:1600 [inline] slab_free_freelist_hook+0xc5/0x190 mm/slub.c:1626 slab_free mm/slub.c:3208 [inline] kfree+0xc0/0x270 mm/slub.c:4196 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline] l2tp_session_put+0xb2/0x1a0 net/l2tp/l2tp_core.c:193 l2tp_session_delete+0x3a9/0x4a0 net/l2tp/l2tp_core.c:1589 pppol2tp_release+0x169/0x2b0 net/l2tp/l2tp_ppp.c:439 __sock_release net/socket.c:597 [inline] sock_close+0xb8/0x200 net/socket.c:1287 __fput+0x2dc/0x730 fs/file_table.c:281 ____fput+0x15/0x20 fs/file_table.c:314 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:175 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:202 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:277 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb The buggy address belongs to the object at ffff888110acd000 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 336 bytes inside of 512-byte region [ffff888110acd000, ffff888110acd200) The buggy address belongs to the page: page:ffffea000442b300 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x110acc head:ffffea000442b300 order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head) raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 363, ts 29346081592, free_ts 29319687084 set_page_owner include/linux/page_owner.h:35 [inline] post_alloc_hook mm/page_alloc.c:2456 [inline] prep_new_page+0x176/0x190 mm/page_alloc.c:2462 get_page_from_freelist+0x225f/0x23f0 mm/page_alloc.c:4254 __alloc_pages_nodemask+0x29a/0x640 mm/page_alloc.c:5384 alloc_slab_page mm/slub.c:-1 [inline] allocate_slab mm/slub.c:1813 [inline] new_slab+0x84/0x3f0 mm/slub.c:1874 new_slab_objects mm/slub.c:2632 [inline] ___slab_alloc+0x2f8/0x4c0 mm/slub.c:2796 __slab_alloc+0x63/0xa0 mm/slub.c:2836 slab_alloc_node mm/slub.c:2918 [inline] slab_alloc mm/slub.c:2960 [inline] __kmalloc_track_caller+0x1e4/0x310 mm/slub.c:4541 __kmalloc_reserve net/core/skbuff.c:144 [inline] __alloc_skb+0xdc/0x520 net/core/skbuff.c:212 alloc_skb include/linux/skbuff.h:1126 [inline] nlmsg_new include/net/netlink.h:953 [inline] netlink_ack+0x35c/0xb30 net/netlink/af_netlink.c:2443 netlink_rcv_skb+0x267/0x430 net/netlink/af_netlink.c:2514 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:5640 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] netlink_unicast+0x86c/0xa30 net/netlink/af_netlink.c:1340 netlink_sendmsg+0x949/0xb70 net/netlink/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:652 [inline] __sock_sendmsg net/socket.c:664 [inline] __sys_sendto+0x467/0x620 net/socket.c:2007 __do_sys_sendto net/socket.c:2019 [inline] __se_sys_sendto net/socket.c:2015 [inline] __x64_sys_sendto+0xe5/0x100 net/socket.c:2015 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46 page last free stack trace: reset_page_owner include/linux/page_owner.h:28 [inline] free_pages_prepare mm/page_alloc.c:1349 [inline] __free_pages_ok+0x80b/0x830 mm/page_alloc.c:1629 free_the_page mm/page_alloc.c:5445 [inline] __free_pages+0xd8/0x390 mm/page_alloc.c:5454 __free_slab+0xcf/0x190 mm/slub.c:1899 free_slab mm/slub.c:1914 [inline] discard_slab mm/slub.c:1920 [inline] unfreeze_partials+0x150/0x180 mm/slub.c:2415 put_cpu_partial+0xc1/0x180 mm/slub.c:2451 __slab_free+0x2c9/0x3a0 mm/slub.c:3100 do_slab_free mm/slub.c:3196 [inline] ___cache_free+0x10e/0x130 mm/slub.c:3215 qlink_free+0x50/0x90 mm/kasan/quarantine.c:157 qlist_free_all+0x5f/0xb0 mm/kasan/quarantine.c:176 kasan_quarantine_reduce+0x14a/0x160 mm/kasan/quarantine.c:283 __kasan_slab_alloc+0x2f/0xe0 mm/kasan/common.c:440 kasan_slab_alloc include/linux/kasan.h:244 [inline] slab_post_alloc_hook+0x5d/0x2f0 mm/slab.h:580 slab_alloc_node mm/slub.c:2952 [inline] slab_alloc mm/slub.c:2960 [inline] kmem_cache_alloc+0x15a/0x2d0 mm/slub.c:2965 kmem_cache_alloc_node include/linux/slab.h:426 [inline] __alloc_skb+0x9e/0x520 net/core/skbuff.c:200 alloc_skb include/linux/skbuff.h:1126 [inline] nlmsg_new include/net/netlink.h:953 [inline] rtmsg_ifa+0xfa/0x1d0 net/ipv4/devinet.c:1927 __inet_del_ifa+0x80b/0xd90 net/ipv4/devinet.c:441 Memory state around the buggy address: ffff888110acd000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888110acd080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888110acd100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888110acd180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888110acd200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================