Extracting prog: 29.638074456s
Minimizing prog: 33m52.187657525s
Simplifying prog options: 3m44.953742833s
Extracting C: 1m10.119955973s
Simplifying C: 0s


extracting reproducer from 44 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket$pppoe-fsetxattr$security_smack_transmute-bpf$PROG_LOAD-fsopen-prctl$PR_SET_TAGGED_ADDR_CTRL-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-mount$binder-socket$inet_mptcp-setsockopt$SO_TIMESTAMPING-socket-setsockopt-write$uinput_user_dev-openat$sysfs-sendfile-ppoll-openat$smackfs_load-write$binfmt_script-mkdirat-mount$overlay
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket$pppoe(0x18, 0x1, 0x0)
fsetxattr$security_smack_transmute(r0, &(0x7f00000001c0), &(0x7f00000002c0), 0x4, 0x2)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000200)={0x15})
fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0)
r4 = fsmount(r2, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r1, r4, 0x16, 0x0, @void}, 0x10)
mount$binder(0x0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080), 0x200002, &(0x7f0000000240)=ANY=[@ANYBLOB="73746174733d676c2c6d61783d30303030303030303030303030303030303030322c73746174733d676c6f62616c2c6d61736b3b4320e4b315efca41442c7063723d3830303030302f30303030653d6c6f7765726469722c6c615c2551dc54f563d7"])
r5 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$SO_TIMESTAMPING(r5, 0x1, 0xc, &(0x7f0000000000)=0x5402, 0x4)
r6 = socket(0x8, 0x2, 0x0)
setsockopt(r6, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {0x3, 0x3, 0x6, 0xfffa}, 0x3a, [0x20008000, 0x1, 0xf, 0x8, 0x7c, 0xfffffffe, 0xb5d, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x3, 0x5, 0x0, 0x3, 0x400, 0x0, 0x7, 0x40, 0x1, 0x24, 0xd, 0x3fffffe, 0x0, 0xffffffff, 0xe665, 0x204, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x400003, 0xe, 0x4, 0x80008071, 0xffffb8ef, 0x17, 0x200, 0x7, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x7, 0x81, 0x4, 0x3ff, 0x8, 0x0, 0x7, 0x9, 0x8, 0x4, 0x0, 0xfffffffc], [0xc0, 0x9, 0x8000012f, 0x8004, 0x5, 0x8, 0x129432e7, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x6, 0x2, 0x0, 0x45, 0x2f, 0x1782000, 0x313, 0x78, 0xea4, 0x5fa, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x3d, 0x1000005, 0x5bea93c3, 0xd, 0x4e0, 0x2, 0x4, 0x81b, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x4, 0xfe000000, 0xffff, 0x2, 0x4, 0x10009, 0x3, 0x9, 0x9, 0x9, 0x20003, 0xffffffff, 0x100bc45, 0x48c93690, 0x80, 0x3], [0x7, 0xc08, 0x4, 0x5, 0xfffffffd, 0x40, 0x31d, 0x9, 0x5, 0x7fff, 0x9, 0x10001, 0xb, 0x4, 0x5, 0x5, 0x3, 0x1ef, 0x0, 0x8, 0x86, 0x3, 0x1, 0x3e7, 0xb, 0x5, 0x0, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfb1, 0x1000, 0xa2, 0x7, 0x2000a9, 0x5, 0x7, 0xac8, 0xbf, 0x1, 0x3, 0x7ff, 0x12b, 0x6, 0x1, 0xa, 0x20, 0x2, 0x1c, 0x8867, 0x3, 0x2006, 0x80a2ed, 0x40000005, 0x25], [0x9, 0xbb33, 0x7, 0x8, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xcea, 0x6, 0x2, 0x57, 0x7, 0x3, 0x0, 0x10000, 0x4, 0x37f3, 0xffff, 0xa622, 0x1, 0x80000005, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x7f, 0xffffffff, 0x80000000, 0x5, 0x4, 0x4c8, 0x1, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0xfc, 0x40000047, 0xb2, 0x8, 0x6, 0x226, 0x5, 0x5, 0x8, 0x30b1d693, 0x8a1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x8, 0x5, 0xb1e, 0x6, 0x200, 0xffff3441, 0xfff]}, 0x45c)
r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/resume', 0x169a82, 0x109)
sendfile(r7, r7, 0x0, 0xb)
ppoll(&(0x7f00000000c0)=[{}, {0xffffffffffffffff, 0x400}], 0x20000000000000dc, 0x0, 0x0, 0xfffffffffffffcdd)
r8 = openat$smackfs_load(0xffffffffffffff9c, &(0x7f0000000000)='/sys/fs/smackfs/load-self2\x00', 0x2, 0x0)
write$binfmt_script(r8, &(0x7f00000000c0)={'#! ', './file0', [{0x20, ')+'}, {0x20, '[k'}, {0x20, 'no&\x80\x85\xfe\x19\x17y\xb2\x82\x81AR\x86lo-\xc5hX\xbbt\b\x86xookie'}, {0x20, 'B-+'}, {0x20, 'hostdata'}, {0x20, '*'}], 0xa, '\vT'}, 0x42)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0xe4)
mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000340)={[{@lowerdir={'lowerdir', 0x3d, './cgroup'}}]})

program crashed: KASAN: slab-out-of-bounds Read in copy_from_sockptr
single: successfully extracted reproducer
found reproducer with 24 syscalls
minimizing guilty program
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket$pppoe-fsetxattr$security_smack_transmute-bpf$PROG_LOAD-fsopen-prctl$PR_SET_TAGGED_ADDR_CTRL-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-mount$binder-socket$inet_mptcp-setsockopt$SO_TIMESTAMPING-socket-setsockopt-write$uinput_user_dev-openat$sysfs-sendfile-ppoll-openat$smackfs_load-write$binfmt_script-mkdirat
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket$pppoe(0x18, 0x1, 0x0)
fsetxattr$security_smack_transmute(r0, &(0x7f00000001c0), &(0x7f00000002c0), 0x4, 0x2)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000200)={0x15})
fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0)
r4 = fsmount(r2, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r1, r4, 0x16, 0x0, @void}, 0x10)
mount$binder(0x0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080), 0x200002, &(0x7f0000000240)=ANY=[@ANYBLOB="73746174733d676c2c6d61783d30303030303030303030303030303030303030322c73746174733d676c6f62616c2c6d61736b3b4320e4b315efca41442c7063723d3830303030302f30303030653d6c6f7765726469722c6c615c2551dc54f563d7"])
r5 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$SO_TIMESTAMPING(r5, 0x1, 0xc, &(0x7f0000000000)=0x5402, 0x4)
r6 = socket(0x8, 0x2, 0x0)
setsockopt(r6, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {0x3, 0x3, 0x6, 0xfffa}, 0x3a, [0x20008000, 0x1, 0xf, 0x8, 0x7c, 0xfffffffe, 0xb5d, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x3, 0x5, 0x0, 0x3, 0x400, 0x0, 0x7, 0x40, 0x1, 0x24, 0xd, 0x3fffffe, 0x0, 0xffffffff, 0xe665, 0x204, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x400003, 0xe, 0x4, 0x80008071, 0xffffb8ef, 0x17, 0x200, 0x7, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x7, 0x81, 0x4, 0x3ff, 0x8, 0x0, 0x7, 0x9, 0x8, 0x4, 0x0, 0xfffffffc], [0xc0, 0x9, 0x8000012f, 0x8004, 0x5, 0x8, 0x129432e7, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x6, 0x2, 0x0, 0x45, 0x2f, 0x1782000, 0x313, 0x78, 0xea4, 0x5fa, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x3d, 0x1000005, 0x5bea93c3, 0xd, 0x4e0, 0x2, 0x4, 0x81b, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x4, 0xfe000000, 0xffff, 0x2, 0x4, 0x10009, 0x3, 0x9, 0x9, 0x9, 0x20003, 0xffffffff, 0x100bc45, 0x48c93690, 0x80, 0x3], [0x7, 0xc08, 0x4, 0x5, 0xfffffffd, 0x40, 0x31d, 0x9, 0x5, 0x7fff, 0x9, 0x10001, 0xb, 0x4, 0x5, 0x5, 0x3, 0x1ef, 0x0, 0x8, 0x86, 0x3, 0x1, 0x3e7, 0xb, 0x5, 0x0, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfb1, 0x1000, 0xa2, 0x7, 0x2000a9, 0x5, 0x7, 0xac8, 0xbf, 0x1, 0x3, 0x7ff, 0x12b, 0x6, 0x1, 0xa, 0x20, 0x2, 0x1c, 0x8867, 0x3, 0x2006, 0x80a2ed, 0x40000005, 0x25], [0x9, 0xbb33, 0x7, 0x8, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xcea, 0x6, 0x2, 0x57, 0x7, 0x3, 0x0, 0x10000, 0x4, 0x37f3, 0xffff, 0xa622, 0x1, 0x80000005, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x7f, 0xffffffff, 0x80000000, 0x5, 0x4, 0x4c8, 0x1, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0xfc, 0x40000047, 0xb2, 0x8, 0x6, 0x226, 0x5, 0x5, 0x8, 0x30b1d693, 0x8a1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x8, 0x5, 0xb1e, 0x6, 0x200, 0xffff3441, 0xfff]}, 0x45c)
r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/resume', 0x169a82, 0x109)
sendfile(r7, r7, 0x0, 0xb)
ppoll(&(0x7f00000000c0)=[{}, {0xffffffffffffffff, 0x400}], 0x20000000000000dc, 0x0, 0x0, 0xfffffffffffffcdd)
r8 = openat$smackfs_load(0xffffffffffffff9c, &(0x7f0000000000)='/sys/fs/smackfs/load-self2\x00', 0x2, 0x0)
write$binfmt_script(r8, &(0x7f00000000c0)={'#! ', './file0', [{0x20, ')+'}, {0x20, '[k'}, {0x20, 'no&\x80\x85\xfe\x19\x17y\xb2\x82\x81AR\x86lo-\xc5hX\xbbt\b\x86xookie'}, {0x20, 'B-+'}, {0x20, 'hostdata'}, {0x20, '*'}], 0xa, '\vT'}, 0x42)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./bus\x00', 0xe4)

program crashed: KASAN: slab-out-of-bounds Read in copy_from_sockptr
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket$pppoe-fsetxattr$security_smack_transmute-bpf$PROG_LOAD-fsopen-prctl$PR_SET_TAGGED_ADDR_CTRL-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-mount$binder-socket$inet_mptcp-setsockopt$SO_TIMESTAMPING-socket-setsockopt-write$uinput_user_dev-openat$sysfs-sendfile-ppoll-openat$smackfs_load-write$binfmt_script
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket$pppoe(0x18, 0x1, 0x0)
fsetxattr$security_smack_transmute(r0, &(0x7f00000001c0), &(0x7f00000002c0), 0x4, 0x2)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000200)={0x15})
fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0)
r4 = fsmount(r2, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r1, r4, 0x16, 0x0, @void}, 0x10)
mount$binder(0x0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080), 0x200002, &(0x7f0000000240)=ANY=[@ANYBLOB="73746174733d676c2c6d61783d30303030303030303030303030303030303030322c73746174733d676c6f62616c2c6d61736b3b4320e4b315efca41442c7063723d3830303030302f30303030653d6c6f7765726469722c6c615c2551dc54f563d7"])
r5 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$SO_TIMESTAMPING(r5, 0x1, 0xc, &(0x7f0000000000)=0x5402, 0x4)
r6 = socket(0x8, 0x2, 0x0)
setsockopt(r6, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {0x3, 0x3, 0x6, 0xfffa}, 0x3a, [0x20008000, 0x1, 0xf, 0x8, 0x7c, 0xfffffffe, 0xb5d, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x3, 0x5, 0x0, 0x3, 0x400, 0x0, 0x7, 0x40, 0x1, 0x24, 0xd, 0x3fffffe, 0x0, 0xffffffff, 0xe665, 0x204, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x400003, 0xe, 0x4, 0x80008071, 0xffffb8ef, 0x17, 0x200, 0x7, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x7, 0x81, 0x4, 0x3ff, 0x8, 0x0, 0x7, 0x9, 0x8, 0x4, 0x0, 0xfffffffc], [0xc0, 0x9, 0x8000012f, 0x8004, 0x5, 0x8, 0x129432e7, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x6, 0x2, 0x0, 0x45, 0x2f, 0x1782000, 0x313, 0x78, 0xea4, 0x5fa, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x3d, 0x1000005, 0x5bea93c3, 0xd, 0x4e0, 0x2, 0x4, 0x81b, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x4, 0xfe000000, 0xffff, 0x2, 0x4, 0x10009, 0x3, 0x9, 0x9, 0x9, 0x20003, 0xffffffff, 0x100bc45, 0x48c93690, 0x80, 0x3], [0x7, 0xc08, 0x4, 0x5, 0xfffffffd, 0x40, 0x31d, 0x9, 0x5, 0x7fff, 0x9, 0x10001, 0xb, 0x4, 0x5, 0x5, 0x3, 0x1ef, 0x0, 0x8, 0x86, 0x3, 0x1, 0x3e7, 0xb, 0x5, 0x0, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfb1, 0x1000, 0xa2, 0x7, 0x2000a9, 0x5, 0x7, 0xac8, 0xbf, 0x1, 0x3, 0x7ff, 0x12b, 0x6, 0x1, 0xa, 0x20, 0x2, 0x1c, 0x8867, 0x3, 0x2006, 0x80a2ed, 0x40000005, 0x25], [0x9, 0xbb33, 0x7, 0x8, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xcea, 0x6, 0x2, 0x57, 0x7, 0x3, 0x0, 0x10000, 0x4, 0x37f3, 0xffff, 0xa622, 0x1, 0x80000005, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x7f, 0xffffffff, 0x80000000, 0x5, 0x4, 0x4c8, 0x1, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0xfc, 0x40000047, 0xb2, 0x8, 0x6, 0x226, 0x5, 0x5, 0x8, 0x30b1d693, 0x8a1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x8, 0x5, 0xb1e, 0x6, 0x200, 0xffff3441, 0xfff]}, 0x45c)
r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/resume', 0x169a82, 0x109)
sendfile(r7, r7, 0x0, 0xb)
ppoll(&(0x7f00000000c0)=[{}, {0xffffffffffffffff, 0x400}], 0x20000000000000dc, 0x0, 0x0, 0xfffffffffffffcdd)
r8 = openat$smackfs_load(0xffffffffffffff9c, &(0x7f0000000000)='/sys/fs/smackfs/load-self2\x00', 0x2, 0x0)
write$binfmt_script(r8, &(0x7f00000000c0)={'#! ', './file0', [{0x20, ')+'}, {0x20, '[k'}, {0x20, 'no&\x80\x85\xfe\x19\x17y\xb2\x82\x81AR\x86lo-\xc5hX\xbbt\b\x86xookie'}, {0x20, 'B-+'}, {0x20, 'hostdata'}, {0x20, '*'}], 0xa, '\vT'}, 0x42)

program crashed: KASAN: slab-out-of-bounds Read in copy_from_sockptr
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket$pppoe-fsetxattr$security_smack_transmute-bpf$PROG_LOAD-fsopen-prctl$PR_SET_TAGGED_ADDR_CTRL-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-mount$binder-socket$inet_mptcp-setsockopt$SO_TIMESTAMPING-socket-setsockopt-write$uinput_user_dev-openat$sysfs-sendfile-ppoll-openat$smackfs_load
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket$pppoe(0x18, 0x1, 0x0)
fsetxattr$security_smack_transmute(r0, &(0x7f00000001c0), &(0x7f00000002c0), 0x4, 0x2)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000200)={0x15})
fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0)
r4 = fsmount(r2, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r1, r4, 0x16, 0x0, @void}, 0x10)
mount$binder(0x0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080), 0x200002, &(0x7f0000000240)=ANY=[@ANYBLOB="73746174733d676c2c6d61783d30303030303030303030303030303030303030322c73746174733d676c6f62616c2c6d61736b3b4320e4b315efca41442c7063723d3830303030302f30303030653d6c6f7765726469722c6c615c2551dc54f563d7"])
r5 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$SO_TIMESTAMPING(r5, 0x1, 0xc, &(0x7f0000000000)=0x5402, 0x4)
r6 = socket(0x8, 0x2, 0x0)
setsockopt(r6, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {0x3, 0x3, 0x6, 0xfffa}, 0x3a, [0x20008000, 0x1, 0xf, 0x8, 0x7c, 0xfffffffe, 0xb5d, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x3, 0x5, 0x0, 0x3, 0x400, 0x0, 0x7, 0x40, 0x1, 0x24, 0xd, 0x3fffffe, 0x0, 0xffffffff, 0xe665, 0x204, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x400003, 0xe, 0x4, 0x80008071, 0xffffb8ef, 0x17, 0x200, 0x7, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x7, 0x81, 0x4, 0x3ff, 0x8, 0x0, 0x7, 0x9, 0x8, 0x4, 0x0, 0xfffffffc], [0xc0, 0x9, 0x8000012f, 0x8004, 0x5, 0x8, 0x129432e7, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x6, 0x2, 0x0, 0x45, 0x2f, 0x1782000, 0x313, 0x78, 0xea4, 0x5fa, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x3d, 0x1000005, 0x5bea93c3, 0xd, 0x4e0, 0x2, 0x4, 0x81b, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x4, 0xfe000000, 0xffff, 0x2, 0x4, 0x10009, 0x3, 0x9, 0x9, 0x9, 0x20003, 0xffffffff, 0x100bc45, 0x48c93690, 0x80, 0x3], [0x7, 0xc08, 0x4, 0x5, 0xfffffffd, 0x40, 0x31d, 0x9, 0x5, 0x7fff, 0x9, 0x10001, 0xb, 0x4, 0x5, 0x5, 0x3, 0x1ef, 0x0, 0x8, 0x86, 0x3, 0x1, 0x3e7, 0xb, 0x5, 0x0, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfb1, 0x1000, 0xa2, 0x7, 0x2000a9, 0x5, 0x7, 0xac8, 0xbf, 0x1, 0x3, 0x7ff, 0x12b, 0x6, 0x1, 0xa, 0x20, 0x2, 0x1c, 0x8867, 0x3, 0x2006, 0x80a2ed, 0x40000005, 0x25], [0x9, 0xbb33, 0x7, 0x8, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xcea, 0x6, 0x2, 0x57, 0x7, 0x3, 0x0, 0x10000, 0x4, 0x37f3, 0xffff, 0xa622, 0x1, 0x80000005, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x7f, 0xffffffff, 0x80000000, 0x5, 0x4, 0x4c8, 0x1, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0xfc, 0x40000047, 0xb2, 0x8, 0x6, 0x226, 0x5, 0x5, 0x8, 0x30b1d693, 0x8a1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x8, 0x5, 0xb1e, 0x6, 0x200, 0xffff3441, 0xfff]}, 0x45c)
r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/resume', 0x169a82, 0x109)
sendfile(r7, r7, 0x0, 0xb)
ppoll(&(0x7f00000000c0)=[{}, {0xffffffffffffffff, 0x400}], 0x20000000000000dc, 0x0, 0x0, 0xfffffffffffffcdd)
openat$smackfs_load(0xffffffffffffff9c, &(0x7f0000000000)='/sys/fs/smackfs/load-self2\x00', 0x2, 0x0)

program crashed: KASAN: slab-out-of-bounds Read in copy_from_sockptr
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket$pppoe-fsetxattr$security_smack_transmute-bpf$PROG_LOAD-fsopen-prctl$PR_SET_TAGGED_ADDR_CTRL-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-mount$binder-socket$inet_mptcp-setsockopt$SO_TIMESTAMPING-socket-setsockopt-write$uinput_user_dev-openat$sysfs-sendfile-ppoll
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket$pppoe(0x18, 0x1, 0x0)
fsetxattr$security_smack_transmute(r0, &(0x7f00000001c0), &(0x7f00000002c0), 0x4, 0x2)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000200)={0x15})
fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0)
r4 = fsmount(r2, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r1, r4, 0x16, 0x0, @void}, 0x10)
mount$binder(0x0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080), 0x200002, &(0x7f0000000240)=ANY=[@ANYBLOB="73746174733d676c2c6d61783d30303030303030303030303030303030303030322c73746174733d676c6f62616c2c6d61736b3b4320e4b315efca41442c7063723d3830303030302f30303030653d6c6f7765726469722c6c615c2551dc54f563d7"])
r5 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$SO_TIMESTAMPING(r5, 0x1, 0xc, &(0x7f0000000000)=0x5402, 0x4)
r6 = socket(0x8, 0x2, 0x0)
setsockopt(r6, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {0x3, 0x3, 0x6, 0xfffa}, 0x3a, [0x20008000, 0x1, 0xf, 0x8, 0x7c, 0xfffffffe, 0xb5d, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x3, 0x5, 0x0, 0x3, 0x400, 0x0, 0x7, 0x40, 0x1, 0x24, 0xd, 0x3fffffe, 0x0, 0xffffffff, 0xe665, 0x204, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x400003, 0xe, 0x4, 0x80008071, 0xffffb8ef, 0x17, 0x200, 0x7, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x7, 0x81, 0x4, 0x3ff, 0x8, 0x0, 0x7, 0x9, 0x8, 0x4, 0x0, 0xfffffffc], [0xc0, 0x9, 0x8000012f, 0x8004, 0x5, 0x8, 0x129432e7, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x6, 0x2, 0x0, 0x45, 0x2f, 0x1782000, 0x313, 0x78, 0xea4, 0x5fa, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x3d, 0x1000005, 0x5bea93c3, 0xd, 0x4e0, 0x2, 0x4, 0x81b, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x4, 0xfe000000, 0xffff, 0x2, 0x4, 0x10009, 0x3, 0x9, 0x9, 0x9, 0x20003, 0xffffffff, 0x100bc45, 0x48c93690, 0x80, 0x3], [0x7, 0xc08, 0x4, 0x5, 0xfffffffd, 0x40, 0x31d, 0x9, 0x5, 0x7fff, 0x9, 0x10001, 0xb, 0x4, 0x5, 0x5, 0x3, 0x1ef, 0x0, 0x8, 0x86, 0x3, 0x1, 0x3e7, 0xb, 0x5, 0x0, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfb1, 0x1000, 0xa2, 0x7, 0x2000a9, 0x5, 0x7, 0xac8, 0xbf, 0x1, 0x3, 0x7ff, 0x12b, 0x6, 0x1, 0xa, 0x20, 0x2, 0x1c, 0x8867, 0x3, 0x2006, 0x80a2ed, 0x40000005, 0x25], [0x9, 0xbb33, 0x7, 0x8, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xcea, 0x6, 0x2, 0x57, 0x7, 0x3, 0x0, 0x10000, 0x4, 0x37f3, 0xffff, 0xa622, 0x1, 0x80000005, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x7f, 0xffffffff, 0x80000000, 0x5, 0x4, 0x4c8, 0x1, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0xfc, 0x40000047, 0xb2, 0x8, 0x6, 0x226, 0x5, 0x5, 0x8, 0x30b1d693, 0x8a1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x8, 0x5, 0xb1e, 0x6, 0x200, 0xffff3441, 0xfff]}, 0x45c)
r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/resume', 0x169a82, 0x109)
sendfile(r7, r7, 0x0, 0xb)
ppoll(&(0x7f00000000c0)=[{}, {0xffffffffffffffff, 0x400}], 0x20000000000000dc, 0x0, 0x0, 0xfffffffffffffcdd)

program crashed: KASAN: slab-out-of-bounds Read in copy_from_sockptr
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket$pppoe-fsetxattr$security_smack_transmute-bpf$PROG_LOAD-fsopen-prctl$PR_SET_TAGGED_ADDR_CTRL-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-mount$binder-socket$inet_mptcp-setsockopt$SO_TIMESTAMPING-socket-setsockopt-write$uinput_user_dev-openat$sysfs-sendfile
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket$pppoe(0x18, 0x1, 0x0)
fsetxattr$security_smack_transmute(r0, &(0x7f00000001c0), &(0x7f00000002c0), 0x4, 0x2)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000200)={0x15})
fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0)
r4 = fsmount(r2, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r1, r4, 0x16, 0x0, @void}, 0x10)
mount$binder(0x0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080), 0x200002, &(0x7f0000000240)=ANY=[@ANYBLOB="73746174733d676c2c6d61783d30303030303030303030303030303030303030322c73746174733d676c6f62616c2c6d61736b3b4320e4b315efca41442c7063723d3830303030302f30303030653d6c6f7765726469722c6c615c2551dc54f563d7"])
r5 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$SO_TIMESTAMPING(r5, 0x1, 0xc, &(0x7f0000000000)=0x5402, 0x4)
r6 = socket(0x8, 0x2, 0x0)
setsockopt(r6, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {0x3, 0x3, 0x6, 0xfffa}, 0x3a, [0x20008000, 0x1, 0xf, 0x8, 0x7c, 0xfffffffe, 0xb5d, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x3, 0x5, 0x0, 0x3, 0x400, 0x0, 0x7, 0x40, 0x1, 0x24, 0xd, 0x3fffffe, 0x0, 0xffffffff, 0xe665, 0x204, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x400003, 0xe, 0x4, 0x80008071, 0xffffb8ef, 0x17, 0x200, 0x7, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x7, 0x81, 0x4, 0x3ff, 0x8, 0x0, 0x7, 0x9, 0x8, 0x4, 0x0, 0xfffffffc], [0xc0, 0x9, 0x8000012f, 0x8004, 0x5, 0x8, 0x129432e7, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x6, 0x2, 0x0, 0x45, 0x2f, 0x1782000, 0x313, 0x78, 0xea4, 0x5fa, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x3d, 0x1000005, 0x5bea93c3, 0xd, 0x4e0, 0x2, 0x4, 0x81b, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x4, 0xfe000000, 0xffff, 0x2, 0x4, 0x10009, 0x3, 0x9, 0x9, 0x9, 0x20003, 0xffffffff, 0x100bc45, 0x48c93690, 0x80, 0x3], [0x7, 0xc08, 0x4, 0x5, 0xfffffffd, 0x40, 0x31d, 0x9, 0x5, 0x7fff, 0x9, 0x10001, 0xb, 0x4, 0x5, 0x5, 0x3, 0x1ef, 0x0, 0x8, 0x86, 0x3, 0x1, 0x3e7, 0xb, 0x5, 0x0, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfb1, 0x1000, 0xa2, 0x7, 0x2000a9, 0x5, 0x7, 0xac8, 0xbf, 0x1, 0x3, 0x7ff, 0x12b, 0x6, 0x1, 0xa, 0x20, 0x2, 0x1c, 0x8867, 0x3, 0x2006, 0x80a2ed, 0x40000005, 0x25], [0x9, 0xbb33, 0x7, 0x8, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xcea, 0x6, 0x2, 0x57, 0x7, 0x3, 0x0, 0x10000, 0x4, 0x37f3, 0xffff, 0xa622, 0x1, 0x80000005, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x7f, 0xffffffff, 0x80000000, 0x5, 0x4, 0x4c8, 0x1, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0xfc, 0x40000047, 0xb2, 0x8, 0x6, 0x226, 0x5, 0x5, 0x8, 0x30b1d693, 0x8a1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x8, 0x5, 0xb1e, 0x6, 0x200, 0xffff3441, 0xfff]}, 0x45c)
r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/resume', 0x169a82, 0x109)
sendfile(r7, r7, 0x0, 0xb)

program crashed: KASAN: slab-out-of-bounds Read in copy_from_sockptr
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket$pppoe-fsetxattr$security_smack_transmute-bpf$PROG_LOAD-fsopen-prctl$PR_SET_TAGGED_ADDR_CTRL-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-mount$binder-socket$inet_mptcp-setsockopt$SO_TIMESTAMPING-socket-setsockopt-write$uinput_user_dev-openat$sysfs
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket$pppoe(0x18, 0x1, 0x0)
fsetxattr$security_smack_transmute(r0, &(0x7f00000001c0), &(0x7f00000002c0), 0x4, 0x2)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000200)={0x15})
fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0)
r4 = fsmount(r2, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r1, r4, 0x16, 0x0, @void}, 0x10)
mount$binder(0x0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080), 0x200002, &(0x7f0000000240)=ANY=[@ANYBLOB="73746174733d676c2c6d61783d30303030303030303030303030303030303030322c73746174733d676c6f62616c2c6d61736b3b4320e4b315efca41442c7063723d3830303030302f30303030653d6c6f7765726469722c6c615c2551dc54f563d7"])
r5 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$SO_TIMESTAMPING(r5, 0x1, 0xc, &(0x7f0000000000)=0x5402, 0x4)
r6 = socket(0x8, 0x2, 0x0)
setsockopt(r6, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {0x3, 0x3, 0x6, 0xfffa}, 0x3a, [0x20008000, 0x1, 0xf, 0x8, 0x7c, 0xfffffffe, 0xb5d, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x3, 0x5, 0x0, 0x3, 0x400, 0x0, 0x7, 0x40, 0x1, 0x24, 0xd, 0x3fffffe, 0x0, 0xffffffff, 0xe665, 0x204, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x400003, 0xe, 0x4, 0x80008071, 0xffffb8ef, 0x17, 0x200, 0x7, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x7, 0x81, 0x4, 0x3ff, 0x8, 0x0, 0x7, 0x9, 0x8, 0x4, 0x0, 0xfffffffc], [0xc0, 0x9, 0x8000012f, 0x8004, 0x5, 0x8, 0x129432e7, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x6, 0x2, 0x0, 0x45, 0x2f, 0x1782000, 0x313, 0x78, 0xea4, 0x5fa, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x3d, 0x1000005, 0x5bea93c3, 0xd, 0x4e0, 0x2, 0x4, 0x81b, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x4, 0xfe000000, 0xffff, 0x2, 0x4, 0x10009, 0x3, 0x9, 0x9, 0x9, 0x20003, 0xffffffff, 0x100bc45, 0x48c93690, 0x80, 0x3], [0x7, 0xc08, 0x4, 0x5, 0xfffffffd, 0x40, 0x31d, 0x9, 0x5, 0x7fff, 0x9, 0x10001, 0xb, 0x4, 0x5, 0x5, 0x3, 0x1ef, 0x0, 0x8, 0x86, 0x3, 0x1, 0x3e7, 0xb, 0x5, 0x0, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfb1, 0x1000, 0xa2, 0x7, 0x2000a9, 0x5, 0x7, 0xac8, 0xbf, 0x1, 0x3, 0x7ff, 0x12b, 0x6, 0x1, 0xa, 0x20, 0x2, 0x1c, 0x8867, 0x3, 0x2006, 0x80a2ed, 0x40000005, 0x25], [0x9, 0xbb33, 0x7, 0x8, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xcea, 0x6, 0x2, 0x57, 0x7, 0x3, 0x0, 0x10000, 0x4, 0x37f3, 0xffff, 0xa622, 0x1, 0x80000005, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x7f, 0xffffffff, 0x80000000, 0x5, 0x4, 0x4c8, 0x1, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0xfc, 0x40000047, 0xb2, 0x8, 0x6, 0x226, 0x5, 0x5, 0x8, 0x30b1d693, 0x8a1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x8, 0x5, 0xb1e, 0x6, 0x200, 0xffff3441, 0xfff]}, 0x45c)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/resume', 0x169a82, 0x109)

program crashed: KASAN: slab-out-of-bounds Read in copy_from_sockptr
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket$pppoe-fsetxattr$security_smack_transmute-bpf$PROG_LOAD-fsopen-prctl$PR_SET_TAGGED_ADDR_CTRL-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-mount$binder-socket$inet_mptcp-setsockopt$SO_TIMESTAMPING-socket-setsockopt-write$uinput_user_dev
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket$pppoe(0x18, 0x1, 0x0)
fsetxattr$security_smack_transmute(r0, &(0x7f00000001c0), &(0x7f00000002c0), 0x4, 0x2)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000200)={0x15})
fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0)
r4 = fsmount(r2, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r1, r4, 0x16, 0x0, @void}, 0x10)
mount$binder(0x0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080), 0x200002, &(0x7f0000000240)=ANY=[@ANYBLOB="73746174733d676c2c6d61783d30303030303030303030303030303030303030322c73746174733d676c6f62616c2c6d61736b3b4320e4b315efca41442c7063723d3830303030302f30303030653d6c6f7765726469722c6c615c2551dc54f563d7"])
r5 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$SO_TIMESTAMPING(r5, 0x1, 0xc, &(0x7f0000000000)=0x5402, 0x4)
r6 = socket(0x8, 0x2, 0x0)
setsockopt(r6, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)
write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {0x3, 0x3, 0x6, 0xfffa}, 0x3a, [0x20008000, 0x1, 0xf, 0x8, 0x7c, 0xfffffffe, 0xb5d, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x3, 0x5, 0x0, 0x3, 0x400, 0x0, 0x7, 0x40, 0x1, 0x24, 0xd, 0x3fffffe, 0x0, 0xffffffff, 0xe665, 0x204, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x242, 0x400003, 0xe, 0x4, 0x80008071, 0xffffb8ef, 0x17, 0x200, 0x7, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x7, 0x81, 0x4, 0x3ff, 0x8, 0x0, 0x7, 0x9, 0x8, 0x4, 0x0, 0xfffffffc], [0xc0, 0x9, 0x8000012f, 0x8004, 0x5, 0x8, 0x129432e7, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0x6, 0x2, 0x0, 0x45, 0x2f, 0x1782000, 0x313, 0x78, 0xea4, 0x5fa, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x3d, 0x1000005, 0x5bea93c3, 0xd, 0x4e0, 0x2, 0x4, 0x81b, 0x4, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8000, 0x4, 0xfe000000, 0xffff, 0x2, 0x4, 0x10009, 0x3, 0x9, 0x9, 0x9, 0x20003, 0xffffffff, 0x100bc45, 0x48c93690, 0x80, 0x3], [0x7, 0xc08, 0x4, 0x5, 0xfffffffd, 0x40, 0x31d, 0x9, 0x5, 0x7fff, 0x9, 0x10001, 0xb, 0x4, 0x5, 0x5, 0x3, 0x1ef, 0x0, 0x8, 0x86, 0x3, 0x1, 0x3e7, 0xb, 0x5, 0x0, 0x2, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfb1, 0x1000, 0xa2, 0x7, 0x2000a9, 0x5, 0x7, 0xac8, 0xbf, 0x1, 0x3, 0x7ff, 0x12b, 0x6, 0x1, 0xa, 0x20, 0x2, 0x1c, 0x8867, 0x3, 0x2006, 0x80a2ed, 0x40000005, 0x25], [0x9, 0xbb33, 0x7, 0x8, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xcea, 0x6, 0x2, 0x57, 0x7, 0x3, 0x0, 0x10000, 0x4, 0x37f3, 0xffff, 0xa622, 0x1, 0x80000005, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x7f, 0xffffffff, 0x80000000, 0x5, 0x4, 0x4c8, 0x1, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0xfc, 0x40000047, 0xb2, 0x8, 0x6, 0x226, 0x5, 0x5, 0x8, 0x30b1d693, 0x8a1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x8, 0x5, 0xb1e, 0x6, 0x200, 0xffff3441, 0xfff]}, 0x45c)

program crashed: KASAN: slab-out-of-bounds Read in copy_from_sockptr
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket$pppoe-fsetxattr$security_smack_transmute-bpf$PROG_LOAD-fsopen-prctl$PR_SET_TAGGED_ADDR_CTRL-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-mount$binder-socket$inet_mptcp-setsockopt$SO_TIMESTAMPING-socket-setsockopt
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket$pppoe(0x18, 0x1, 0x0)
fsetxattr$security_smack_transmute(r0, &(0x7f00000001c0), &(0x7f00000002c0), 0x4, 0x2)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000200)={0x15})
fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0)
r4 = fsmount(r2, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r1, r4, 0x16, 0x0, @void}, 0x10)
mount$binder(0x0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080), 0x200002, &(0x7f0000000240)=ANY=[@ANYBLOB="73746174733d676c2c6d61783d30303030303030303030303030303030303030322c73746174733d676c6f62616c2c6d61736b3b4320e4b315efca41442c7063723d3830303030302f30303030653d6c6f7765726469722c6c615c2551dc54f563d7"])
r5 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$SO_TIMESTAMPING(r5, 0x1, 0xc, &(0x7f0000000000)=0x5402, 0x4)
r6 = socket(0x8, 0x2, 0x0)
setsockopt(r6, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)

program crashed: KASAN: slab-out-of-bounds Read in copy_from_sockptr
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket$pppoe-fsetxattr$security_smack_transmute-bpf$PROG_LOAD-fsopen-prctl$PR_SET_TAGGED_ADDR_CTRL-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-mount$binder-socket$inet_mptcp-setsockopt$SO_TIMESTAMPING-socket
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket$pppoe(0x18, 0x1, 0x0)
fsetxattr$security_smack_transmute(r0, &(0x7f00000001c0), &(0x7f00000002c0), 0x4, 0x2)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000200)={0x15})
fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0)
r4 = fsmount(r2, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r1, r4, 0x16, 0x0, @void}, 0x10)
mount$binder(0x0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080), 0x200002, &(0x7f0000000240)=ANY=[@ANYBLOB="73746174733d676c2c6d61783d30303030303030303030303030303030303030322c73746174733d676c6f62616c2c6d61736b3b4320e4b315efca41442c7063723d3830303030302f30303030653d6c6f7765726469722c6c615c2551dc54f563d7"])
r5 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$SO_TIMESTAMPING(r5, 0x1, 0xc, &(0x7f0000000000)=0x5402, 0x4)
socket(0x8, 0x2, 0x0)

program did not crash
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket$pppoe-fsetxattr$security_smack_transmute-bpf$PROG_LOAD-fsopen-prctl$PR_SET_TAGGED_ADDR_CTRL-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-mount$binder-socket$inet_mptcp-setsockopt$SO_TIMESTAMPING-setsockopt
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket$pppoe(0x18, 0x1, 0x0)
fsetxattr$security_smack_transmute(r0, &(0x7f00000001c0), &(0x7f00000002c0), 0x4, 0x2)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000200)={0x15})
fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0)
r4 = fsmount(r2, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r1, r4, 0x16, 0x0, @void}, 0x10)
mount$binder(0x0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080), 0x200002, &(0x7f0000000240)=ANY=[@ANYBLOB="73746174733d676c2c6d61783d30303030303030303030303030303030303030322c73746174733d676c6f62616c2c6d61736b3b4320e4b315efca41442c7063723d3830303030302f30303030653d6c6f7765726469722c6c615c2551dc54f563d7"])
r5 = socket$inet_mptcp(0x2, 0x1, 0x106)
setsockopt$SO_TIMESTAMPING(r5, 0x1, 0xc, &(0x7f0000000000)=0x5402, 0x4)
setsockopt(0xffffffffffffffff, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)

program did not crash
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket$pppoe-fsetxattr$security_smack_transmute-bpf$PROG_LOAD-fsopen-prctl$PR_SET_TAGGED_ADDR_CTRL-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-mount$binder-socket$inet_mptcp-socket-setsockopt
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket$pppoe(0x18, 0x1, 0x0)
fsetxattr$security_smack_transmute(r0, &(0x7f00000001c0), &(0x7f00000002c0), 0x4, 0x2)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000200)={0x15})
fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0)
r4 = fsmount(r2, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r1, r4, 0x16, 0x0, @void}, 0x10)
mount$binder(0x0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080), 0x200002, &(0x7f0000000240)=ANY=[@ANYBLOB="73746174733d676c2c6d61783d30303030303030303030303030303030303030322c73746174733d676c6f62616c2c6d61736b3b4320e4b315efca41442c7063723d3830303030302f30303030653d6c6f7765726469722c6c615c2551dc54f563d7"])
socket$inet_mptcp(0x2, 0x1, 0x106)
r5 = socket(0x8, 0x2, 0x0)
setsockopt(r5, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)

program crashed: KASAN: slab-out-of-bounds Read in copy_from_sockptr
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket$pppoe-fsetxattr$security_smack_transmute-bpf$PROG_LOAD-fsopen-prctl$PR_SET_TAGGED_ADDR_CTRL-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-mount$binder-socket-setsockopt
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket$pppoe(0x18, 0x1, 0x0)
fsetxattr$security_smack_transmute(r0, &(0x7f00000001c0), &(0x7f00000002c0), 0x4, 0x2)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000200)={0x15})
fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0)
r4 = fsmount(r2, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r1, r4, 0x16, 0x0, @void}, 0x10)
mount$binder(0x0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080), 0x200002, &(0x7f0000000240)=ANY=[@ANYBLOB="73746174733d676c2c6d61783d30303030303030303030303030303030303030322c73746174733d676c6f62616c2c6d61736b3b4320e4b315efca41442c7063723d3830303030302f30303030653d6c6f7765726469722c6c615c2551dc54f563d7"])
r5 = socket(0x8, 0x2, 0x0)
setsockopt(r5, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)

program crashed: KASAN: slab-out-of-bounds Read in copy_from_sockptr
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket$pppoe-fsetxattr$security_smack_transmute-bpf$PROG_LOAD-fsopen-prctl$PR_SET_TAGGED_ADDR_CTRL-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-socket-setsockopt
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket$pppoe(0x18, 0x1, 0x0)
fsetxattr$security_smack_transmute(r0, &(0x7f00000001c0), &(0x7f00000002c0), 0x4, 0x2)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000200)={0x15})
fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0)
r4 = fsmount(r2, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r1, r4, 0x16, 0x0, @void}, 0x10)
r5 = socket(0x8, 0x2, 0x0)
setsockopt(r5, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)

program crashed: KASAN: slab-out-of-bounds Read in copy_from_sockptr
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket$pppoe-fsetxattr$security_smack_transmute-bpf$PROG_LOAD-fsopen-prctl$PR_SET_TAGGED_ADDR_CTRL-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-fsconfig$FSCONFIG_CMD_CREATE-fsmount-socket-setsockopt
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket$pppoe(0x18, 0x1, 0x0)
fsetxattr$security_smack_transmute(r0, &(0x7f00000001c0), &(0x7f00000002c0), 0x4, 0x2)
bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000200)={0x15})
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0)
fsmount(r1, 0x0, 0x80)
r3 = socket(0x8, 0x2, 0x0)
setsockopt(r3, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)

program did not crash
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket$pppoe-fsetxattr$security_smack_transmute-bpf$PROG_LOAD-fsopen-prctl$PR_SET_TAGGED_ADDR_CTRL-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-fsconfig$FSCONFIG_CMD_CREATE-bpf$BPF_LINK_CREATE-socket-setsockopt
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket$pppoe(0x18, 0x1, 0x0)
fsetxattr$security_smack_transmute(r0, &(0x7f00000001c0), &(0x7f00000002c0), 0x4, 0x2)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000200)={0x15})
fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r1, 0xffffffffffffffff, 0x16, 0x0, @void}, 0x10)
r4 = socket(0x8, 0x2, 0x0)
setsockopt(r4, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)

program did not crash
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket$pppoe-fsetxattr$security_smack_transmute-bpf$PROG_LOAD-fsopen-prctl$PR_SET_TAGGED_ADDR_CTRL-openat$iommufd-ioctl$IOMMU_IOAS_ALLOC-fsmount-bpf$BPF_LINK_CREATE-socket-setsockopt
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket$pppoe(0x18, 0x1, 0x0)
fsetxattr$security_smack_transmute(r0, &(0x7f00000001c0), &(0x7f00000002c0), 0x4, 0x2)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000200)={0x15})
r4 = fsmount(r2, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r1, r4, 0x16, 0x0, @void}, 0x10)
r5 = socket(0x8, 0x2, 0x0)
setsockopt(r5, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)

program did not crash
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket$pppoe-fsetxattr$security_smack_transmute-bpf$PROG_LOAD-fsopen-prctl$PR_SET_TAGGED_ADDR_CTRL-openat$iommufd-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-socket-setsockopt
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket$pppoe(0x18, 0x1, 0x0)
fsetxattr$security_smack_transmute(r0, &(0x7f00000001c0), &(0x7f00000002c0), 0x4, 0x2)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0)
r3 = fsmount(r2, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r1, r3, 0x16, 0x0, @void}, 0x10)
r4 = socket(0x8, 0x2, 0x0)
setsockopt(r4, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)

program crashed: KASAN: slab-out-of-bounds Read in copy_from_sockptr
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket$pppoe-fsetxattr$security_smack_transmute-bpf$PROG_LOAD-fsopen-prctl$PR_SET_TAGGED_ADDR_CTRL-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-socket-setsockopt
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket$pppoe(0x18, 0x1, 0x0)
fsetxattr$security_smack_transmute(r0, &(0x7f00000001c0), &(0x7f00000002c0), 0x4, 0x2)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1)
fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0)
r3 = fsmount(r2, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r1, r3, 0x16, 0x0, @void}, 0x10)
r4 = socket(0x8, 0x2, 0x0)
setsockopt(r4, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)

program crashed: KASAN: slab-out-of-bounds Read in copy_from_sockptr
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket$pppoe-fsetxattr$security_smack_transmute-bpf$PROG_LOAD-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-socket-setsockopt
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket$pppoe(0x18, 0x1, 0x0)
fsetxattr$security_smack_transmute(r0, &(0x7f00000001c0), &(0x7f00000002c0), 0x4, 0x2)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r2 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0)
r3 = fsmount(r2, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r1, r3, 0x16, 0x0, @void}, 0x10)
r4 = socket(0x8, 0x2, 0x0)
setsockopt(r4, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)

program crashed: KASAN: slab-out-of-bounds Read in copy_from_sockptr
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket$pppoe-fsetxattr$security_smack_transmute-bpf$PROG_LOAD-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-socket-setsockopt
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket$pppoe(0x18, 0x1, 0x0)
fsetxattr$security_smack_transmute(r0, &(0x7f00000001c0), &(0x7f00000002c0), 0x4, 0x2)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
r2 = fsmount(0xffffffffffffffff, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r1, r2, 0x16, 0x0, @void}, 0x10)
r3 = socket(0x8, 0x2, 0x0)
setsockopt(r3, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)

program did not crash
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket$pppoe-fsetxattr$security_smack_transmute-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-socket-setsockopt
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = socket$pppoe(0x18, 0x1, 0x0)
fsetxattr$security_smack_transmute(r0, &(0x7f00000001c0), &(0x7f00000002c0), 0x4, 0x2)
r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0)
r2 = fsmount(r1, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={0xffffffffffffffff, r2, 0x16, 0x0, @void}, 0x10)
r3 = socket(0x8, 0x2, 0x0)
setsockopt(r3, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)

program did not crash
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-socket$pppoe-bpf$PROG_LOAD-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-socket-setsockopt
detailed listing:
executing program 0:
setns(0xc9, 0x0)
socket$pppoe(0x18, 0x1, 0x0)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0)
r2 = fsmount(r1, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r0, r2, 0x16, 0x0, @void}, 0x10)
r3 = socket(0x8, 0x2, 0x0)
setsockopt(r3, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)

program crashed: KASAN: slab-out-of-bounds Read in copy_from_sockptr
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-bpf$PROG_LOAD-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-socket-setsockopt
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0)
r2 = fsmount(r1, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r0, r2, 0x16, 0x0, @void}, 0x10)
r3 = socket(0x8, 0x2, 0x0)
setsockopt(r3, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)

program crashed: KASAN: slab-out-of-bounds Read in copy_from_sockptr
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-socket-setsockopt
detailed listing:
executing program 0:
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0)
r2 = fsmount(r1, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r0, r2, 0x16, 0x0, @void}, 0x10)
r3 = socket(0x8, 0x2, 0x0)
setsockopt(r3, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)

program did not crash
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-bpf$PROG_LOAD-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-socket-setsockopt
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0)
r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0)
r2 = fsmount(r1, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r0, r2, 0x16, 0x0, @void}, 0x10)
r3 = socket(0x8, 0x2, 0x0)
setsockopt(r3, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)

program did not crash
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-bpf$PROG_LOAD-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-socket-setsockopt
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0)
r2 = fsmount(r1, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r0, r2, 0x16, 0x0, @void}, 0x10)
r3 = socket(0x8, 0x2, 0x0)
setsockopt(r3, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)

program did not crash
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-bpf$PROG_LOAD-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-socket-setsockopt
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0)
r2 = fsmount(r1, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r0, r2, 0x16, 0x0, @void}, 0x10)
r3 = socket(0x8, 0x2, 0x0)
setsockopt(r3, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)

program did not crash
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-bpf$PROG_LOAD-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-socket-setsockopt
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0)
r2 = fsmount(r1, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r0, r2, 0x16, 0x0, @void}, 0x10)
r3 = socket(0x8, 0x2, 0x0)
setsockopt(r3, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)

program did not crash
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-bpf$PROG_LOAD-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-socket-setsockopt
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = fsopen(0x0, 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0)
r2 = fsmount(r1, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r0, r2, 0x16, 0x0, @void}, 0x10)
r3 = socket(0x8, 0x2, 0x0)
setsockopt(r3, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)

program did not crash
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-bpf$PROG_LOAD-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-socket-setsockopt
detailed listing:
executing program 0:
setns(0xc9, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0)
fsmount(r0, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, 0x0, 0x0)
r1 = socket(0x8, 0x2, 0x0)
setsockopt(r1, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)

program did not crash
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-bpf$PROG_LOAD-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-socket-setsockopt
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0)
r2 = fsmount(r1, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r0, r2, 0x16, 0x0, @void}, 0x10)
r3 = socket(0x8, 0x2, 0x0)
setsockopt(r3, 0x105, 0x42020054, 0x0, 0x0)

program did not crash
testing program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-bpf$PROG_LOAD-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-socket-setsockopt
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0)
r2 = fsmount(r1, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r0, r2, 0x16, 0x0, @void}, 0x10)
r3 = socket(0x8, 0x2, 0x0)
setsockopt(r3, 0x105, 0x42020054, &(0x7f0000000200), 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=40.569733795s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-bpf$PROG_LOAD-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-socket-setsockopt
program did not crash
simplifying guilty program options
testing program (duration=40.569733795s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-bpf$PROG_LOAD-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-socket-setsockopt
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0)
r2 = fsmount(r1, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r0, r2, 0x16, 0x0, @void}, 0x10)
r3 = socket(0x8, 0x2, 0x0)
setsockopt(r3, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)

program crashed: KASAN: slab-out-of-bounds Read in copy_from_sockptr
extracting C reproducer
testing compiled C program (duration=40.569733795s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-bpf$PROG_LOAD-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-socket-setsockopt
program did not crash
testing program (duration=40.569733795s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-bpf$PROG_LOAD-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-socket-setsockopt
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0)
r2 = fsmount(r1, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r0, r2, 0x16, 0x0, @void}, 0x10)
r3 = socket(0x8, 0x2, 0x0)
setsockopt(r3, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)

program crashed: KASAN: slab-out-of-bounds Read in copy_from_sockptr
extracting C reproducer
testing compiled C program (duration=40.569733795s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-bpf$PROG_LOAD-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-socket-setsockopt
program did not crash
testing program (duration=40.569733795s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-bpf$PROG_LOAD-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-socket-setsockopt
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0)
r2 = fsmount(r1, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r0, r2, 0x16, 0x0, @void}, 0x10)
r3 = socket(0x8, 0x2, 0x0)
setsockopt(r3, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)

program crashed: KASAN: slab-out-of-bounds Read in copy_from_sockptr
validation run: crashed=true
testing program (duration=40.569733795s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-bpf$PROG_LOAD-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-socket-setsockopt
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0)
r2 = fsmount(r1, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r0, r2, 0x16, 0x0, @void}, 0x10)
r3 = socket(0x8, 0x2, 0x0)
setsockopt(r3, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)

program crashed: KASAN: slab-out-of-bounds Read in copy_from_sockptr
validation run: crashed=true
testing program (duration=40.569733795s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setns-bpf$PROG_LOAD-fsopen-fsconfig$FSCONFIG_CMD_CREATE-fsmount-bpf$BPF_LINK_CREATE-socket-setsockopt
detailed listing:
executing program 0:
setns(0xc9, 0x0)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0)
r2 = fsmount(r1, 0x0, 0x80)
bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r0, r2, 0x16, 0x0, @void}, 0x10)
r3 = socket(0x8, 0x2, 0x0)
setsockopt(r3, 0x105, 0x42020054, &(0x7f0000000200)="01000000", 0x4)

program crashed: KASAN: slab-out-of-bounds Read in copy_from_sockptr
validation run: crashed=true
reproducing took 41m44.525392164s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]
BUG: KASAN: slab-out-of-bounds in copy_from_sockptr+0x44/0x1b8 include/linux/sockptr.h:61
Read of size 84 at addr ffff0000d23743a0 by task syz.0.17/4925

CPU: 0 UID: 0 PID: 4925 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 print_address_description+0xb0/0x238 mm/kasan/report.c:378
 print_report+0x68/0x84 mm/kasan/report.c:482
 kasan_report+0x8c/0xc4 mm/kasan/report.c:595
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x17c/0x1ac mm/kasan/generic.c:200
 __asan_memcpy+0x3c/0x84 mm/kasan/shadow.c:105
 copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]
 copy_from_sockptr+0x44/0x1b8 include/linux/sockptr.h:61
 vcc_setsockopt+0x174/0x450 net/atm/common.c:725
 pvc_setsockopt+0x84/0xb0 net/atm/pvc.c:72
 do_sock_setsockopt+0x1f0/0x330 net/socket.c:2368
 __sys_setsockopt+0x104/0x170 net/socket.c:2393
 __do_sys_setsockopt net/socket.c:2399 [inline]
 __se_sys_setsockopt net/socket.c:2396 [inline]
 __arm64_sys_setsockopt+0xc8/0xe4 net/socket.c:2396
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736
 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594

Allocated by task 4925:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:78
 kasan_save_alloc_info+0x44/0x54 mm/kasan/generic.c:570
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5334 [inline]
 __kmalloc_noprof+0x340/0x6b8 mm/slub.c:5359
 _kmalloc_noprof include/linux/slab.h:992 [inline]
 __cgroup_bpf_run_filter_setsockopt+0x990/0xbbc kernel/bpf/cgroup.c:2103
 do_sock_setsockopt+0x2e8/0x330 net/socket.c:2350
 __sys_setsockopt+0x104/0x170 net/socket.c:2393
 __do_sys_setsockopt net/socket.c:2399 [inline]
 __se_sys_setsockopt net/socket.c:2396 [inline]
 __arm64_sys_setsockopt+0xc8/0xe4 net/socket.c:2396
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736
 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594

The buggy address belongs to the object at ffff0000d23743a0
 which belongs to the cache kmalloc-8 of size 8
The buggy address is located 0 bytes inside of
 allocated 4-byte region [ffff0000d23743a0, ffff0000d23743a4)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff0000d2374460 pfn:0x112374
flags: 0x5ffc00000000200(workingset|node=0|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 05ffc00000000200 ffff0000c0001500 ffff0000c0000348 fffffdffc32f1f10
raw: ffff0000d2374460 0000000800800041 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000d2374280: 07 fc fc fc 07 fc fc fc 07 fc fc fc 07 fc fc fc
 ffff0000d2374300: 07 fc fc fc 07 fc fc fc 05 fc fc fc 05 fc fc fc
>ffff0000d2374380: fa fc fc fc 04 fc fc fc fa fc fc fc fa fc fc fc
                               ^
 ffff0000d2374400: fa fc fc fc 00 fc fc fc fa fc fc fc fa fc fc fc
 ffff0000d2374480: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]
BUG: KASAN: slab-out-of-bounds in copy_from_sockptr+0x44/0x1b8 include/linux/sockptr.h:61
Read of size 84 at addr ffff0000d23743a0 by task syz.0.17/4925

CPU: 0 UID: 0 PID: 4925 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 print_address_description+0xb0/0x238 mm/kasan/report.c:378
 print_report+0x68/0x84 mm/kasan/report.c:482
 kasan_report+0x8c/0xc4 mm/kasan/report.c:595
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x17c/0x1ac mm/kasan/generic.c:200
 __asan_memcpy+0x3c/0x84 mm/kasan/shadow.c:105
 copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]
 copy_from_sockptr+0x44/0x1b8 include/linux/sockptr.h:61
 vcc_setsockopt+0x174/0x450 net/atm/common.c:725
 pvc_setsockopt+0x84/0xb0 net/atm/pvc.c:72
 do_sock_setsockopt+0x1f0/0x330 net/socket.c:2368
 __sys_setsockopt+0x104/0x170 net/socket.c:2393
 __do_sys_setsockopt net/socket.c:2399 [inline]
 __se_sys_setsockopt net/socket.c:2396 [inline]
 __arm64_sys_setsockopt+0xc8/0xe4 net/socket.c:2396
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736
 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594

Allocated by task 4925:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:78
 kasan_save_alloc_info+0x44/0x54 mm/kasan/generic.c:570
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5334 [inline]
 __kmalloc_noprof+0x340/0x6b8 mm/slub.c:5359
 _kmalloc_noprof include/linux/slab.h:992 [inline]
 __cgroup_bpf_run_filter_setsockopt+0x990/0xbbc kernel/bpf/cgroup.c:2103
 do_sock_setsockopt+0x2e8/0x330 net/socket.c:2350
 __sys_setsockopt+0x104/0x170 net/socket.c:2393
 __do_sys_setsockopt net/socket.c:2399 [inline]
 __se_sys_setsockopt net/socket.c:2396 [inline]
 __arm64_sys_setsockopt+0xc8/0xe4 net/socket.c:2396
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736
 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594

The buggy address belongs to the object at ffff0000d23743a0
 which belongs to the cache kmalloc-8 of size 8
The buggy address is located 0 bytes inside of
 allocated 4-byte region [ffff0000d23743a0, ffff0000d23743a4)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff0000d2374460 pfn:0x112374
flags: 0x5ffc00000000200(workingset|node=0|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 05ffc00000000200 ffff0000c0001500 ffff0000c0000348 fffffdffc32f1f10
raw: ffff0000d2374460 0000000800800041 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000d2374280: 07 fc fc fc 07 fc fc fc 07 fc fc fc 07 fc fc fc
 ffff0000d2374300: 07 fc fc fc 07 fc fc fc 05 fc fc fc 05 fc fc fc
>ffff0000d2374380: fa fc fc fc 04 fc fc fc fa fc fc fc fa fc fc fc
                               ^
 ffff0000d2374400: fa fc fc fc 00 fc fc fc fa fc fc fc fa fc fc fc
 ffff0000d2374480: fa fc fc fc fa fc fc fc fa fc fc fc fa fc fc fc
==================================================================