Extracting prog: 3m44.01395352s Minimizing prog: 19m42.4198204s Simplifying prog options: 0s Extracting C: 48.619101735s Simplifying C: 2m51.0804392s extracting reproducer from 57 programs testing a last program of every proc single: executing 13 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getrusage-syz_open_dev$tty1-ioctl$TIOCNOTTY-gettid-timer_create-socket$inet6-setsockopt$inet6_buf-setsockopt$inet6_opts-connect$inet6-timer_settime-bpf$BPF_PROG_TEST_RUN-waitid-getrusage-syz_open_dev$tty1-ioctl$TIOCNOTTY-gettid-timer_create-socket$inet6-setsockopt$inet6_buf-setsockopt$inet6_opts-connect$inet6-timer_settime-bpf$BPF_PROG_TEST_RUN-waitid detailed listing: executing program 0: getrusage(0x1, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCNOTTY(r0, 0x5422) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000000040)) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_buf(r2, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffff0700000000ff000207835eeb1317b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4efbfb9b4a128f2dbe2837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab190c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) setsockopt$inet6_opts(r2, 0x29, 0x37, &(0x7f0000000080)=ANY=[], 0x8) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e24, 0xfffffffd, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x1c) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0xa002a0, 0x0, 0x0, 0x0, 0x0, 0x6414, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) waitid(0x2, 0x0, &(0x7f0000000000), 0x1, 0x0) getrusage(0x1, 0x0) (async) syz_open_dev$tty1(0xc, 0x4, 0x1) (async) ioctl$TIOCNOTTY(r0, 0x5422) (async) gettid() (async) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000000040)) (async) socket$inet6(0xa, 0x1, 0x0) (async) setsockopt$inet6_buf(r2, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffff0700000000ff000207835eeb1317b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4efbfb9b4a128f2dbe2837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab190c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) (async) setsockopt$inet6_opts(r2, 0x29, 0x37, &(0x7f0000000080)=ANY=[], 0x8) (async) connect$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e24, 0xfffffffd, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x1c) (async) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0xa002a0, 0x0, 0x0, 0x0, 0x0, 0x6414, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) waitid(0x2, 0x0, &(0x7f0000000000), 0x1, 0x0) (async) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-openat-socket$netlink-socketpair$unix-dup-getsockname$packet-sendmsg$nl_route-syz_mount_image$ext4 detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x40, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) getsockname$packet(r2, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="380000006d000100"/20, @ANYRES32=r3, @ANYBLOB="000000000000000018003480140035006970365f76746930"], 0x38}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000680)='./file0\x00', 0x200010e, &(0x7f0000000100), 0x3, 0x46b, &(0x7f00000006c0)="$eJzs3MtvG8UfAPDvrpO06eOX/Ep59AEECiLikTRpgR44AAKJA0hIXMoxJGlV6jaoCRKtKggIlSOqxB1xROIv4AQXBJyQuMIdVaqgFwono7V3a8e13dQ4cag/H2mdmd2JZ76ZHXt2p9sABtZE9pJE7IqIXyJirJZdW2Ci9uP6tYvzf127OJ9EpfLG70m13J/XLs4XRYvf25lnJtOI9OMkDrSod/n8hdNz5fLiuTw/vXLmnenl8xeeOnVm7uTiycWzs8eOHT0y8+wzs0/3JM7/Z23d//7SwX2vvHn5tfnjl9/64aukiL8pjsK2bisbrb5OdCryaKXS7btvMWPV190Ne5KhvjWG21SKiKy7hqvjfyxKUe+8sXj5o742DthQlVybw6sV4A6WRL9bAPRH8UWfXf8W2+bNPvrv6gu1C6As7uv5VjsyFGnULoyGm65ve2kiIo6v/v15tkWb+xAAAL30TTb/ebLV/C+NexrK/S+/0z+er6XsiYi7ImJvRNwdUS17b0Tcd5v1Ny+S3Dz/Sa90Fdg6ZfO/5/K1rbXzv7QoMl7Kc7urmeHkxKny4uH8bzIZw9uy/EyHOr596edP2x1rnP9lW1Z/MRfM23FlqGkhamFuZe7fxNzo6ocR+4daxZ/cWAlIImJfROzvso5Tj395sN2x5vgrSad3en5ttgfrTJUvIh6r9f9q5PGPVI/UG5J0Xp+c3h7lxcPTxVlxsx9/uvR6u/pv3f8bK+v/HS3P/xvxjyeN67XLt1/HpV8/aXtNM9XV+V/fMZL/fG9uZeXcTMRI8mqt0Y37Z+u/W+SL8ln8k4daj/89Uf9LHIiI7CS+PyIeiIgH8757KCIejohD7QJcjfj+xUfebnd4K/T/QlP/j68t0tT/9cRINO9pnSid/u7rte9YT67n8++PbUerqcl8z3o+/9bTru7OZgAAAPjvSSNiVyTp1I10mk5N1f4N/97YkZaXlleeOLH07tmF2jMC4zGcFne6aveDa/dDZ/LL+iI/25Q/kt83/qw0Ws1PzS+VF/odPAy4nW3Gf+a3Ur9bB2w4z2vB4DL+YXAZ/zC4jH8YXC3G/2g/2gFsvlbf/x/Uk5WxzWwMsKmaxr9lPxggrv9hcBn/MLgax3/H5++BO8nyaNz6IXmJrZzYXnTl5tYe6RaIvVeJZINHwa5+B9iYKP7vz86F+/zBBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0CP/BAAA///GBug8") program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6-setsockopt$inet6_mreq-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-socket$netlink-setsockopt$sock_int detailed listing: executing program 0: r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0xa27}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$netlink(0x10, 0x3, 0xf) setsockopt$sock_int(r4, 0x1, 0x9, &(0x7f0000000000), 0x4) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$cdc_ecm-syz_usb_connect$cdc_ncm detailed listing: executing program 0: syz_usb_connect$cdc_ecm(0x0, 0x56, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000090000102505a1a440000000010109024400010100000009040000120206000005241c0000"], 0x0) syz_usb_connect$cdc_ncm(0x0, 0xdf, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xcd, 0x2, 0x1, 0x72, 0x20, 0xa, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xb, 0x24, 0x6, 0x0, 0x1, "ccfccafe7a71"}, {0x5, 0x24, 0x0, 0xee}, {0xd, 0x24, 0xf, 0x1, 0x4, 0x8c5a, 0x0, 0xd}, {0x6, 0x24, 0x1a, 0x9, 0x8}, [@mdlm_detail={0x63, 0x24, 0x13, 0x7a, "ac7a15550712e1160b90dcf99378a0a62c411c760abec9775c2ba0719366c2a1a9f4be725653f3c5da3115f5ee9975c0cedbb9b14ee543e120b6f900c415dede8b0bb1470573b455494526ccd5346651dd0fb3f30d676b2e05a9bb6c4e5d84"}, @acm={0x4, 0x24, 0x2, 0x9}, @acm={0x4}]}, {{0x9, 0x5, 0x81, 0x3, 0x700, 0x5, 0x7, 0xa5}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x400, 0x2, 0x8, 0x4}}, {{0x9, 0x5, 0x3, 0x2, 0x3ff, 0xc, 0x9, 0x5}}}}}}}]}}, &(0x7f00000002c0)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x110, 0x6, 0x80, 0x2, 0x40, 0xed}, 0x6d, &(0x7f0000000180)={0x5, 0xf, 0x6d, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0xf, 0x81, 0x4}, @ss_container_id={0x14, 0x10, 0x4, 0x6, "919eed78c1c572efd97028e2811fc368"}, @ptm_cap={0x3}, @wireless={0xb, 0x10, 0x1, 0x2, 0x12, 0xfd, 0x1, 0x8000, 0xf9}, @generic={0x39, 0x10, 0x1, "1ec557c2af4cd7b037d3209cc5e0447cf3356916bd94bde72e65647c563a67e068e567dafe192294e0ac88620c418aa0e4cce927b438"}, @ptm_cap={0x3}]}, 0x2, [{0x5f, &(0x7f0000000200)=@string={0x5f, 0x3, "cbb83db880de945d991b32110da97511418a482cc6678aa00a674fac7581457b9f26610e3e44b3b3f3fd0544ac69861a75b9bf8c174cd19df85fcbebedf53414814ef6e4f6a901154c9d2651d13cc76ca6936c5947e8fe34b581217117"}}, {0x4, &(0x7f0000000280)=@lang_id={0x4, 0x3, 0x3009}}]}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-inotify_init1-syz_mount_image$vfat-fcntl$dupfd-setsockopt$inet_mtu-socket-listen-ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL-bpf$PROG_LOAD-syz_genetlink_get_family_id$ethtool-socket$packet-ioctl$sock_SIOCGIFINDEX-setsockopt$packet_add_memb-setsockopt$packet_drop_memb-ioctl$ifreq_SIOCGIFINDEX_team-bpf$BPF_GET_PROG_INFO-getpeername$packet-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendmsg$ETHTOOL_MSG_DEBUG_GET detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x1, 0x0, 0xfffffffc}}, 0x2e) r3 = inotify_init1(0x800) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./bus\x00', 0x1204000, &(0x7f0000000340)=ANY=[@ANYRES64=0x0, @ANYRESHEX=0x0, @ANYRES16, @ANYRESDEC, @ANYRESDEC, @ANYRES16, @ANYRES32, @ANYBLOB="b0529ea9793daee9ef7ad16eb0b00b0ab3ff5f5f31c47edec125043e255d2716dca73eae9fb5", @ANYRES32, @ANYRES16=0x0], 0x2, 0x2c8, &(0x7f0000000840)="$eJzs3T9rZFUUAPDzkpmXCSmSwkoEX7GFjWGzrYVZJIqYSpnCP6CLuwtLMizMwMCqOGzlJ7Cw8HvY2Qs2fgPBwtLORQJX3p/MTCazk010Jkv4/Yrkcu4579773iMTeLw7X7zWO7r/ePDw6Te/R6eTxdp+7MezLKWU4lRqBABwIzxLKf660ud7a21ZcwIAlmvq87/9nJSN8sfmmdDbq5gaALAkH338yQd3Dw8PPiyKTkTvu2E3i/p33X/3YTyK43gQt2M7TibPAlKq2+++f3gQraK0E7d6o2G3rOx9/us4NY+qfi+2Y2d+/V5Rm6ofDVvVfx5ZFvFov5zIndiOV87Vl/0Hd+bURzePNzrNIsvxd2M7fvsyHsdx3K+eaUzG/zaP4p30/d9ff1oml/XZaNjdqPIm0vqqrw0AAAAAAAAAAAAAAAAAAAAAADfXbjG2E7d6Zajef6e7flL1757pr/bXWav66/osIq8aM/sDjVL8eLq/zu2iKFJW54/399lsxautaF3bwgEAAAAAAAAAAAAAAAAAAOAlMnjy1dG94+MH/f+l0bzkP36t/6rH2Z+KvB6LkzcuNVasN+nlXGdz9n75rDeOlIu4yuSH7SJi0Zzb5yKb5XwuPvI/KaWUZRH/7TK1X2Ss+Y33mpPX31qcXOb8/MPWm0f3sovOYef0wv003ZVHf/Bk5ppGtnjQkzORdKnbL1+QkzeLnulK2bzjbL34yWzP63rrj3qwJpJdsIr2VKTdNOJ5t1/nUvfzav7+AAAAAAAAAAAAAAAAAAAAE5OXfud0Pl1Yura0SQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAik2+/3/SiHORmcYo/qyK5+eklEbjSB79wXWvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJvv3wAAAP//8BhuSw==") r4 = fcntl$dupfd(r2, 0x406, r3) setsockopt$inet_mtu(r4, 0x111, 0xa, &(0x7f0000000000), 0x4) r5 = socket(0x2, 0x1, 0x0) listen(r5, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x894b, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x48}, [@ldst={0x3, 0x0, 0x3, 0x1c10a1, 0x0, 0x2c}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r4) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) setsockopt$packet_add_memb(r8, 0x107, 0x1, &(0x7f0000000040)={r9, 0x1, 0x2, @local}, 0x10) setsockopt$packet_drop_memb(r8, 0x107, 0x2, &(0x7f0000000100)={r9, 0x1, 0x6, @random="9468a11acce6"}, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)={'team0\x00', 0x0}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000440)={r6, 0xe0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000140)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x7, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x2f, &(0x7f0000000200)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x50, 0x10, &(0x7f0000000280), &(0x7f00000002c0), 0x8, 0xfa, 0x8, 0x8, &(0x7f0000000300)}}, 0x10) getpeername$packet(r4, &(0x7f0000000480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f00000004c0)=0x14) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000500)={'batadv_slave_0\x00', 0x0}) r13 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f00000001c0)={'veth0_virt_wifi\x00'}) sendmsg$nl_route_sched(r13, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000140)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, r11, {0x0, 0xb}, {0xe, 0xffff}, {0x10, 0xc}}, [@TCA_RATE={0x6, 0x5, {0x6, 0x8a}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4018844}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000540)={'vcan0\x00'}) r14 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r14, 0x8933, &(0x7f00000000c0)={'dummy0\x00', 0x0}) sendmsg$nl_route(r14, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="4c00000100000000000000ff8000000000000000", @ANYRES32=0x0, @ANYBLOB="937b0100ef000000240012800b0001006d616373656300001400028005000d000000000005000c000000000008000500", @ANYRES32=r15, @ANYBLOB], 0x4c}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) sendmsg$ETHTOOL_MSG_DEBUG_GET(r4, &(0x7f00000006c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000c80)=ANY=[@ANYBLOB="40010000", @ANYRES16=r7, @ANYBLOB="100025bd7000fbdbdf25070000003400018014000200766c616e31000000000000000000000008000100", @ANYRES32=r10, @ANYBLOB="140002006d6163736563300000000000000000008c000180140002006d616373656330000000000000000000140002006d6163766c616e310000000000000000080003000000000008000100", @ANYRES32=0x0, @ANYBLOB="1400020076657468310000000000000000000000140002006c6f000000000000000000000000000014000200767863616e310000000000000000000014000200697036677265300000000000000000001c00018008000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=0x0, @ANYBLOB="08000100", @ANYRES32=r11, @ANYBLOB="200001801400020065727370616e3000000000000000000008000100", @ANYRES32=r12, @ANYBLOB="0a79214607a80400018067ff0180140002006272694467655f736c6176655f3100001400020067656e65766530000000"], 0x140}, 0x1, 0x0, 0x0, 0x40000}, 0x4004010) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session single: successfully extracted reproducer found reproducer with 30 syscalls minimizing guilty program testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-inotify_init1-syz_mount_image$vfat-fcntl$dupfd-setsockopt$inet_mtu-socket-listen-ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL-bpf$PROG_LOAD-syz_genetlink_get_family_id$ethtool-socket$packet-ioctl$sock_SIOCGIFINDEX-setsockopt$packet_add_memb-setsockopt$packet_drop_memb-ioctl$ifreq_SIOCGIFINDEX_team-bpf$BPF_GET_PROG_INFO-getpeername$packet-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x1, 0x0, 0xfffffffc}}, 0x2e) r3 = inotify_init1(0x800) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./bus\x00', 0x1204000, &(0x7f0000000340)=ANY=[@ANYRES64=0x0, @ANYRESHEX=0x0, @ANYRES16, @ANYRESDEC, @ANYRESDEC, @ANYRES16, @ANYRES32, @ANYBLOB="b0529ea9793daee9ef7ad16eb0b00b0ab3ff5f5f31c47edec125043e255d2716dca73eae9fb5", @ANYRES32, @ANYRES16=0x0], 0x2, 0x2c8, &(0x7f0000000840)="$eJzs3T9rZFUUAPDzkpmXCSmSwkoEX7GFjWGzrYVZJIqYSpnCP6CLuwtLMizMwMCqOGzlJ7Cw8HvY2Qs2fgPBwtLORQJX3p/MTCazk010Jkv4/Yrkcu4579773iMTeLw7X7zWO7r/ePDw6Te/R6eTxdp+7MezLKWU4lRqBABwIzxLKf660ud7a21ZcwIAlmvq87/9nJSN8sfmmdDbq5gaALAkH338yQd3Dw8PPiyKTkTvu2E3i/p33X/3YTyK43gQt2M7TibPAlKq2+++f3gQraK0E7d6o2G3rOx9/us4NY+qfi+2Y2d+/V5Rm6ofDVvVfx5ZFvFov5zIndiOV87Vl/0Hd+bURzePNzrNIsvxd2M7fvsyHsdx3K+eaUzG/zaP4p30/d9ff1oml/XZaNjdqPIm0vqqrw0AAAAAAAAAAAAAAAAAAAAAADfXbjG2E7d6Zajef6e7flL1757pr/bXWav66/osIq8aM/sDjVL8eLq/zu2iKFJW54/399lsxautaF3bwgEAAAAAAAAAAAAAAAAAAOAlMnjy1dG94+MH/f+l0bzkP36t/6rH2Z+KvB6LkzcuNVasN+nlXGdz9n75rDeOlIu4yuSH7SJi0Zzb5yKb5XwuPvI/KaWUZRH/7TK1X2Ss+Y33mpPX31qcXOb8/MPWm0f3sovOYef0wv003ZVHf/Bk5ppGtnjQkzORdKnbL1+QkzeLnulK2bzjbL34yWzP63rrj3qwJpJdsIr2VKTdNOJ5t1/nUvfzav7+AAAAAAAAAAAAAAAAAAAAE5OXfud0Pl1Yura0SQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAik2+/3/SiHORmcYo/qyK5+eklEbjSB79wXWvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJvv3wAAAP//8BhuSw==") r4 = fcntl$dupfd(r2, 0x406, r3) setsockopt$inet_mtu(r4, 0x111, 0xa, &(0x7f0000000000), 0x4) r5 = socket(0x2, 0x1, 0x0) listen(r5, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x894b, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x48}, [@ldst={0x3, 0x0, 0x3, 0x1c10a1, 0x0, 0x2c}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r4) r7 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) setsockopt$packet_add_memb(r7, 0x107, 0x1, &(0x7f0000000040)={r8, 0x1, 0x2, @local}, 0x10) setsockopt$packet_drop_memb(r7, 0x107, 0x2, &(0x7f0000000100)={r8, 0x1, 0x6, @random="9468a11acce6"}, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000440)={r6, 0xe0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000140)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x7, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x2f, &(0x7f0000000200)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x50, 0x10, &(0x7f0000000280), &(0x7f00000002c0), 0x8, 0xfa, 0x8, 0x8, &(0x7f0000000300)}}, 0x10) getpeername$packet(r4, &(0x7f0000000480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f00000004c0)=0x14) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000500)={'batadv_slave_0\x00'}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f00000001c0)={'veth0_virt_wifi\x00'}) sendmsg$nl_route_sched(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000140)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, r9, {0x0, 0xb}, {0xe, 0xffff}, {0x10, 0xc}}, [@TCA_RATE={0x6, 0x5, {0x6, 0x8a}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4018844}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000540)={'vcan0\x00'}) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f00000000c0)={'dummy0\x00', 0x0}) sendmsg$nl_route(r11, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="4c00000100000000000000ff8000000000000000", @ANYRES32=0x0, @ANYBLOB="937b0100ef000000240012800b0001006d616373656300001400028005000d000000000005000c000000000008000500", @ANYRES32=r12, @ANYBLOB], 0x4c}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-inotify_init1-syz_mount_image$vfat-fcntl$dupfd-setsockopt$inet_mtu-socket-listen-ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL-bpf$PROG_LOAD-syz_genetlink_get_family_id$ethtool-socket$packet-ioctl$sock_SIOCGIFINDEX-setsockopt$packet_add_memb-setsockopt$packet_drop_memb-ioctl$ifreq_SIOCGIFINDEX_team-bpf$BPF_GET_PROG_INFO-getpeername$packet-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$nl_route-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x1, 0x0, 0xfffffffc}}, 0x2e) r3 = inotify_init1(0x800) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./bus\x00', 0x1204000, &(0x7f0000000340)=ANY=[@ANYRES64=0x0, @ANYRESHEX=0x0, @ANYRES16, @ANYRESDEC, @ANYRESDEC, @ANYRES16, @ANYRES32, @ANYBLOB="b0529ea9793daee9ef7ad16eb0b00b0ab3ff5f5f31c47edec125043e255d2716dca73eae9fb5", @ANYRES32, @ANYRES16=0x0], 0x2, 0x2c8, &(0x7f0000000840)="$eJzs3T9rZFUUAPDzkpmXCSmSwkoEX7GFjWGzrYVZJIqYSpnCP6CLuwtLMizMwMCqOGzlJ7Cw8HvY2Qs2fgPBwtLORQJX3p/MTCazk010Jkv4/Yrkcu4579773iMTeLw7X7zWO7r/ePDw6Te/R6eTxdp+7MezLKWU4lRqBABwIzxLKf660ud7a21ZcwIAlmvq87/9nJSN8sfmmdDbq5gaALAkH338yQd3Dw8PPiyKTkTvu2E3i/p33X/3YTyK43gQt2M7TibPAlKq2+++f3gQraK0E7d6o2G3rOx9/us4NY+qfi+2Y2d+/V5Rm6ofDVvVfx5ZFvFov5zIndiOV87Vl/0Hd+bURzePNzrNIsvxd2M7fvsyHsdx3K+eaUzG/zaP4p30/d9ff1oml/XZaNjdqPIm0vqqrw0AAAAAAAAAAAAAAAAAAAAAADfXbjG2E7d6Zajef6e7flL1757pr/bXWav66/osIq8aM/sDjVL8eLq/zu2iKFJW54/399lsxautaF3bwgEAAAAAAAAAAAAAAAAAAOAlMnjy1dG94+MH/f+l0bzkP36t/6rH2Z+KvB6LkzcuNVasN+nlXGdz9n75rDeOlIu4yuSH7SJi0Zzb5yKb5XwuPvI/KaWUZRH/7TK1X2Ss+Y33mpPX31qcXOb8/MPWm0f3sovOYef0wv003ZVHf/Bk5ppGtnjQkzORdKnbL1+QkzeLnulK2bzjbL34yWzP63rrj3qwJpJdsIr2VKTdNOJ5t1/nUvfzav7+AAAAAAAAAAAAAAAAAAAAE5OXfud0Pl1Yura0SQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAik2+/3/SiHORmcYo/qyK5+eklEbjSB79wXWvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJvv3wAAAP//8BhuSw==") r4 = fcntl$dupfd(r2, 0x406, r3) setsockopt$inet_mtu(r4, 0x111, 0xa, &(0x7f0000000000), 0x4) r5 = socket(0x2, 0x1, 0x0) listen(r5, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x894b, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x48}, [@ldst={0x3, 0x0, 0x3, 0x1c10a1, 0x0, 0x2c}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r4) r7 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) setsockopt$packet_add_memb(r7, 0x107, 0x1, &(0x7f0000000040)={r8, 0x1, 0x2, @local}, 0x10) setsockopt$packet_drop_memb(r7, 0x107, 0x2, &(0x7f0000000100)={r8, 0x1, 0x6, @random="9468a11acce6"}, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000440)={r6, 0xe0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000140)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x7, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x2f, &(0x7f0000000200)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x50, 0x10, &(0x7f0000000280), &(0x7f00000002c0), 0x8, 0xfa, 0x8, 0x8, &(0x7f0000000300)}}, 0x10) getpeername$packet(r4, &(0x7f0000000480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f00000004c0)=0x14) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000500)={'batadv_slave_0\x00'}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f00000001c0)={'veth0_virt_wifi\x00'}) sendmsg$nl_route_sched(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000140)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, r9, {0x0, 0xb}, {0xe, 0xffff}, {0x10, 0xc}}, [@TCA_RATE={0x6, 0x5, {0x6, 0x8a}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4018844}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000540)={'vcan0\x00'}) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f00000000c0)={'dummy0\x00'}) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-inotify_init1-syz_mount_image$vfat-fcntl$dupfd-setsockopt$inet_mtu-socket-listen-ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL-bpf$PROG_LOAD-syz_genetlink_get_family_id$ethtool-socket$packet-ioctl$sock_SIOCGIFINDEX-setsockopt$packet_add_memb-setsockopt$packet_drop_memb-ioctl$ifreq_SIOCGIFINDEX_team-bpf$BPF_GET_PROG_INFO-getpeername$packet-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$nl_route detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x1, 0x0, 0xfffffffc}}, 0x2e) r3 = inotify_init1(0x800) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./bus\x00', 0x1204000, &(0x7f0000000340)=ANY=[@ANYRES64=0x0, @ANYRESHEX=0x0, @ANYRES16, @ANYRESDEC, @ANYRESDEC, @ANYRES16, @ANYRES32, @ANYBLOB="b0529ea9793daee9ef7ad16eb0b00b0ab3ff5f5f31c47edec125043e255d2716dca73eae9fb5", @ANYRES32, @ANYRES16=0x0], 0x2, 0x2c8, &(0x7f0000000840)="$eJzs3T9rZFUUAPDzkpmXCSmSwkoEX7GFjWGzrYVZJIqYSpnCP6CLuwtLMizMwMCqOGzlJ7Cw8HvY2Qs2fgPBwtLORQJX3p/MTCazk010Jkv4/Yrkcu4579773iMTeLw7X7zWO7r/ePDw6Te/R6eTxdp+7MezLKWU4lRqBABwIzxLKf660ud7a21ZcwIAlmvq87/9nJSN8sfmmdDbq5gaALAkH338yQd3Dw8PPiyKTkTvu2E3i/p33X/3YTyK43gQt2M7TibPAlKq2+++f3gQraK0E7d6o2G3rOx9/us4NY+qfi+2Y2d+/V5Rm6ofDVvVfx5ZFvFov5zIndiOV87Vl/0Hd+bURzePNzrNIsvxd2M7fvsyHsdx3K+eaUzG/zaP4p30/d9ff1oml/XZaNjdqPIm0vqqrw0AAAAAAAAAAAAAAAAAAAAAADfXbjG2E7d6Zajef6e7flL1757pr/bXWav66/osIq8aM/sDjVL8eLq/zu2iKFJW54/399lsxautaF3bwgEAAAAAAAAAAAAAAAAAAOAlMnjy1dG94+MH/f+l0bzkP36t/6rH2Z+KvB6LkzcuNVasN+nlXGdz9n75rDeOlIu4yuSH7SJi0Zzb5yKb5XwuPvI/KaWUZRH/7TK1X2Ss+Y33mpPX31qcXOb8/MPWm0f3sovOYef0wv003ZVHf/Bk5ppGtnjQkzORdKnbL1+QkzeLnulK2bzjbL34yWzP63rrj3qwJpJdsIr2VKTdNOJ5t1/nUvfzav7+AAAAAAAAAAAAAAAAAAAAE5OXfud0Pl1Yura0SQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAik2+/3/SiHORmcYo/qyK5+eklEbjSB79wXWvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJvv3wAAAP//8BhuSw==") r4 = fcntl$dupfd(r2, 0x406, r3) setsockopt$inet_mtu(r4, 0x111, 0xa, &(0x7f0000000000), 0x4) r5 = socket(0x2, 0x1, 0x0) listen(r5, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x894b, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x48}, [@ldst={0x3, 0x0, 0x3, 0x1c10a1, 0x0, 0x2c}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r4) r7 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) setsockopt$packet_add_memb(r7, 0x107, 0x1, &(0x7f0000000040)={r8, 0x1, 0x2, @local}, 0x10) setsockopt$packet_drop_memb(r7, 0x107, 0x2, &(0x7f0000000100)={r8, 0x1, 0x6, @random="9468a11acce6"}, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000440)={r6, 0xe0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000140)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x7, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x2f, &(0x7f0000000200)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x50, 0x10, &(0x7f0000000280), &(0x7f00000002c0), 0x8, 0xfa, 0x8, 0x8, &(0x7f0000000300)}}, 0x10) getpeername$packet(r4, &(0x7f0000000480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f00000004c0)=0x14) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000500)={'batadv_slave_0\x00'}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f00000001c0)={'veth0_virt_wifi\x00'}) sendmsg$nl_route_sched(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000140)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, r9, {0x0, 0xb}, {0xe, 0xffff}, {0x10, 0xc}}, [@TCA_RATE={0x6, 0x5, {0x6, 0x8a}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4018844}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000540)={'vcan0\x00'}) socket$nl_route(0x10, 0x3, 0x0) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-inotify_init1-syz_mount_image$vfat-fcntl$dupfd-setsockopt$inet_mtu-socket-listen-ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL-bpf$PROG_LOAD-syz_genetlink_get_family_id$ethtool-socket$packet-ioctl$sock_SIOCGIFINDEX-setsockopt$packet_add_memb-setsockopt$packet_drop_memb-ioctl$ifreq_SIOCGIFINDEX_team-bpf$BPF_GET_PROG_INFO-getpeername$packet-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-ioctl$ifreq_SIOCGIFINDEX_vcan detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x1, 0x0, 0xfffffffc}}, 0x2e) r3 = inotify_init1(0x800) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./bus\x00', 0x1204000, &(0x7f0000000340)=ANY=[@ANYRES64=0x0, @ANYRESHEX=0x0, @ANYRES16, @ANYRESDEC, @ANYRESDEC, @ANYRES16, @ANYRES32, @ANYBLOB="b0529ea9793daee9ef7ad16eb0b00b0ab3ff5f5f31c47edec125043e255d2716dca73eae9fb5", @ANYRES32, @ANYRES16=0x0], 0x2, 0x2c8, &(0x7f0000000840)="$eJzs3T9rZFUUAPDzkpmXCSmSwkoEX7GFjWGzrYVZJIqYSpnCP6CLuwtLMizMwMCqOGzlJ7Cw8HvY2Qs2fgPBwtLORQJX3p/MTCazk010Jkv4/Yrkcu4579773iMTeLw7X7zWO7r/ePDw6Te/R6eTxdp+7MezLKWU4lRqBABwIzxLKf660ud7a21ZcwIAlmvq87/9nJSN8sfmmdDbq5gaALAkH338yQd3Dw8PPiyKTkTvu2E3i/p33X/3YTyK43gQt2M7TibPAlKq2+++f3gQraK0E7d6o2G3rOx9/us4NY+qfi+2Y2d+/V5Rm6ofDVvVfx5ZFvFov5zIndiOV87Vl/0Hd+bURzePNzrNIsvxd2M7fvsyHsdx3K+eaUzG/zaP4p30/d9ff1oml/XZaNjdqPIm0vqqrw0AAAAAAAAAAAAAAAAAAAAAADfXbjG2E7d6Zajef6e7flL1757pr/bXWav66/osIq8aM/sDjVL8eLq/zu2iKFJW54/399lsxautaF3bwgEAAAAAAAAAAAAAAAAAAOAlMnjy1dG94+MH/f+l0bzkP36t/6rH2Z+KvB6LkzcuNVasN+nlXGdz9n75rDeOlIu4yuSH7SJi0Zzb5yKb5XwuPvI/KaWUZRH/7TK1X2Ss+Y33mpPX31qcXOb8/MPWm0f3sovOYef0wv003ZVHf/Bk5ppGtnjQkzORdKnbL1+QkzeLnulK2bzjbL34yWzP63rrj3qwJpJdsIr2VKTdNOJ5t1/nUvfzav7+AAAAAAAAAAAAAAAAAAAAE5OXfud0Pl1Yura0SQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAik2+/3/SiHORmcYo/qyK5+eklEbjSB79wXWvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJvv3wAAAP//8BhuSw==") r4 = fcntl$dupfd(r2, 0x406, r3) setsockopt$inet_mtu(r4, 0x111, 0xa, &(0x7f0000000000), 0x4) r5 = socket(0x2, 0x1, 0x0) listen(r5, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x894b, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x48}, [@ldst={0x3, 0x0, 0x3, 0x1c10a1, 0x0, 0x2c}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r4) r7 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) setsockopt$packet_add_memb(r7, 0x107, 0x1, &(0x7f0000000040)={r8, 0x1, 0x2, @local}, 0x10) setsockopt$packet_drop_memb(r7, 0x107, 0x2, &(0x7f0000000100)={r8, 0x1, 0x6, @random="9468a11acce6"}, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000440)={r6, 0xe0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000140)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x7, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x2f, &(0x7f0000000200)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x50, 0x10, &(0x7f0000000280), &(0x7f00000002c0), 0x8, 0xfa, 0x8, 0x8, &(0x7f0000000300)}}, 0x10) getpeername$packet(r4, &(0x7f0000000480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f00000004c0)=0x14) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000500)={'batadv_slave_0\x00'}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f00000001c0)={'veth0_virt_wifi\x00'}) sendmsg$nl_route_sched(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000140)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, r9, {0x0, 0xb}, {0xe, 0xffff}, {0x10, 0xc}}, [@TCA_RATE={0x6, 0x5, {0x6, 0x8a}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4018844}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000540)={'vcan0\x00'}) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-inotify_init1-syz_mount_image$vfat-fcntl$dupfd-setsockopt$inet_mtu-socket-listen-ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL-bpf$PROG_LOAD-syz_genetlink_get_family_id$ethtool-socket$packet-ioctl$sock_SIOCGIFINDEX-setsockopt$packet_add_memb-setsockopt$packet_drop_memb-ioctl$ifreq_SIOCGIFINDEX_team-bpf$BPF_GET_PROG_INFO-getpeername$packet-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x1, 0x0, 0xfffffffc}}, 0x2e) r3 = inotify_init1(0x800) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./bus\x00', 0x1204000, &(0x7f0000000340)=ANY=[@ANYRES64=0x0, @ANYRESHEX=0x0, @ANYRES16, @ANYRESDEC, @ANYRESDEC, @ANYRES16, @ANYRES32, @ANYBLOB="b0529ea9793daee9ef7ad16eb0b00b0ab3ff5f5f31c47edec125043e255d2716dca73eae9fb5", @ANYRES32, @ANYRES16=0x0], 0x2, 0x2c8, &(0x7f0000000840)="$eJzs3T9rZFUUAPDzkpmXCSmSwkoEX7GFjWGzrYVZJIqYSpnCP6CLuwtLMizMwMCqOGzlJ7Cw8HvY2Qs2fgPBwtLORQJX3p/MTCazk010Jkv4/Yrkcu4579773iMTeLw7X7zWO7r/ePDw6Te/R6eTxdp+7MezLKWU4lRqBABwIzxLKf660ud7a21ZcwIAlmvq87/9nJSN8sfmmdDbq5gaALAkH338yQd3Dw8PPiyKTkTvu2E3i/p33X/3YTyK43gQt2M7TibPAlKq2+++f3gQraK0E7d6o2G3rOx9/us4NY+qfi+2Y2d+/V5Rm6ofDVvVfx5ZFvFov5zIndiOV87Vl/0Hd+bURzePNzrNIsvxd2M7fvsyHsdx3K+eaUzG/zaP4p30/d9ff1oml/XZaNjdqPIm0vqqrw0AAAAAAAAAAAAAAAAAAAAAADfXbjG2E7d6Zajef6e7flL1757pr/bXWav66/osIq8aM/sDjVL8eLq/zu2iKFJW54/399lsxautaF3bwgEAAAAAAAAAAAAAAAAAAOAlMnjy1dG94+MH/f+l0bzkP36t/6rH2Z+KvB6LkzcuNVasN+nlXGdz9n75rDeOlIu4yuSH7SJi0Zzb5yKb5XwuPvI/KaWUZRH/7TK1X2Ss+Y33mpPX31qcXOb8/MPWm0f3sovOYef0wv003ZVHf/Bk5ppGtnjQkzORdKnbL1+QkzeLnulK2bzjbL34yWzP63rrj3qwJpJdsIr2VKTdNOJ5t1/nUvfzav7+AAAAAAAAAAAAAAAAAAAAE5OXfud0Pl1Yura0SQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAik2+/3/SiHORmcYo/qyK5+eklEbjSB79wXWvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJvv3wAAAP//8BhuSw==") r4 = fcntl$dupfd(r2, 0x406, r3) setsockopt$inet_mtu(r4, 0x111, 0xa, &(0x7f0000000000), 0x4) r5 = socket(0x2, 0x1, 0x0) listen(r5, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x894b, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x48}, [@ldst={0x3, 0x0, 0x3, 0x1c10a1, 0x0, 0x2c}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r4) r7 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) setsockopt$packet_add_memb(r7, 0x107, 0x1, &(0x7f0000000040)={r8, 0x1, 0x2, @local}, 0x10) setsockopt$packet_drop_memb(r7, 0x107, 0x2, &(0x7f0000000100)={r8, 0x1, 0x6, @random="9468a11acce6"}, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000440)={r6, 0xe0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000140)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x7, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x2f, &(0x7f0000000200)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x50, 0x10, &(0x7f0000000280), &(0x7f00000002c0), 0x8, 0xfa, 0x8, 0x8, &(0x7f0000000300)}}, 0x10) getpeername$packet(r4, &(0x7f0000000480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f00000004c0)=0x14) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000500)={'batadv_slave_0\x00'}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f00000001c0)={'veth0_virt_wifi\x00'}) sendmsg$nl_route_sched(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000140)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, r9, {0x0, 0xb}, {0xe, 0xffff}, {0x10, 0xc}}, [@TCA_RATE={0x6, 0x5, {0x6, 0x8a}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4018844}, 0x0) program crashed: KASAN: use-after-free Read in rcu_cblist_dequeue testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-inotify_init1-syz_mount_image$vfat-fcntl$dupfd-setsockopt$inet_mtu-socket-listen-ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL-bpf$PROG_LOAD-syz_genetlink_get_family_id$ethtool-socket$packet-ioctl$sock_SIOCGIFINDEX-setsockopt$packet_add_memb-setsockopt$packet_drop_memb-ioctl$ifreq_SIOCGIFINDEX_team-bpf$BPF_GET_PROG_INFO-getpeername$packet-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-socket$nl_route-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x1, 0x0, 0xfffffffc}}, 0x2e) r3 = inotify_init1(0x800) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./bus\x00', 0x1204000, &(0x7f0000000340)=ANY=[@ANYRES64=0x0, @ANYRESHEX=0x0, @ANYRES16, @ANYRESDEC, @ANYRESDEC, @ANYRES16, @ANYRES32, @ANYBLOB="b0529ea9793daee9ef7ad16eb0b00b0ab3ff5f5f31c47edec125043e255d2716dca73eae9fb5", @ANYRES32, @ANYRES16=0x0], 0x2, 0x2c8, &(0x7f0000000840)="$eJzs3T9rZFUUAPDzkpmXCSmSwkoEX7GFjWGzrYVZJIqYSpnCP6CLuwtLMizMwMCqOGzlJ7Cw8HvY2Qs2fgPBwtLORQJX3p/MTCazk010Jkv4/Yrkcu4579773iMTeLw7X7zWO7r/ePDw6Te/R6eTxdp+7MezLKWU4lRqBABwIzxLKf660ud7a21ZcwIAlmvq87/9nJSN8sfmmdDbq5gaALAkH338yQd3Dw8PPiyKTkTvu2E3i/p33X/3YTyK43gQt2M7TibPAlKq2+++f3gQraK0E7d6o2G3rOx9/us4NY+qfi+2Y2d+/V5Rm6ofDVvVfx5ZFvFov5zIndiOV87Vl/0Hd+bURzePNzrNIsvxd2M7fvsyHsdx3K+eaUzG/zaP4p30/d9ff1oml/XZaNjdqPIm0vqqrw0AAAAAAAAAAAAAAAAAAAAAADfXbjG2E7d6Zajef6e7flL1757pr/bXWav66/osIq8aM/sDjVL8eLq/zu2iKFJW54/399lsxautaF3bwgEAAAAAAAAAAAAAAAAAAOAlMnjy1dG94+MH/f+l0bzkP36t/6rH2Z+KvB6LkzcuNVasN+nlXGdz9n75rDeOlIu4yuSH7SJi0Zzb5yKb5XwuPvI/KaWUZRH/7TK1X2Ss+Y33mpPX31qcXOb8/MPWm0f3sovOYef0wv003ZVHf/Bk5ppGtnjQkzORdKnbL1+QkzeLnulK2bzjbL34yWzP63rrj3qwJpJdsIr2VKTdNOJ5t1/nUvfzav7+AAAAAAAAAAAAAAAAAAAAE5OXfud0Pl1Yura0SQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAik2+/3/SiHORmcYo/qyK5+eklEbjSB79wXWvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJvv3wAAAP//8BhuSw==") r4 = fcntl$dupfd(r2, 0x406, r3) setsockopt$inet_mtu(r4, 0x111, 0xa, &(0x7f0000000000), 0x4) r5 = socket(0x2, 0x1, 0x0) listen(r5, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x894b, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x48}, [@ldst={0x3, 0x0, 0x3, 0x1c10a1, 0x0, 0x2c}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r4) r7 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) setsockopt$packet_add_memb(r7, 0x107, 0x1, &(0x7f0000000040)={r8, 0x1, 0x2, @local}, 0x10) setsockopt$packet_drop_memb(r7, 0x107, 0x2, &(0x7f0000000100)={r8, 0x1, 0x6, @random="9468a11acce6"}, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000440)={r6, 0xe0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000140)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x7, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x2f, &(0x7f0000000200)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x50, 0x10, &(0x7f0000000280), &(0x7f00000002c0), 0x8, 0xfa, 0x8, 0x8, &(0x7f0000000300)}}, 0x10) getpeername$packet(r4, &(0x7f0000000480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f00000004c0)=0x14) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000500)={'batadv_slave_0\x00'}) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f00000001c0)={'veth0_virt_wifi\x00'}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-inotify_init1-syz_mount_image$vfat-fcntl$dupfd-setsockopt$inet_mtu-socket-listen-ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL-bpf$PROG_LOAD-syz_genetlink_get_family_id$ethtool-socket$packet-ioctl$sock_SIOCGIFINDEX-setsockopt$packet_add_memb-setsockopt$packet_drop_memb-ioctl$ifreq_SIOCGIFINDEX_team-bpf$BPF_GET_PROG_INFO-getpeername$packet-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-socket$nl_route detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x1, 0x0, 0xfffffffc}}, 0x2e) r3 = inotify_init1(0x800) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./bus\x00', 0x1204000, &(0x7f0000000340)=ANY=[@ANYRES64=0x0, @ANYRESHEX=0x0, @ANYRES16, @ANYRESDEC, @ANYRESDEC, @ANYRES16, @ANYRES32, @ANYBLOB="b0529ea9793daee9ef7ad16eb0b00b0ab3ff5f5f31c47edec125043e255d2716dca73eae9fb5", @ANYRES32, @ANYRES16=0x0], 0x2, 0x2c8, &(0x7f0000000840)="$eJzs3T9rZFUUAPDzkpmXCSmSwkoEX7GFjWGzrYVZJIqYSpnCP6CLuwtLMizMwMCqOGzlJ7Cw8HvY2Qs2fgPBwtLORQJX3p/MTCazk010Jkv4/Yrkcu4579773iMTeLw7X7zWO7r/ePDw6Te/R6eTxdp+7MezLKWU4lRqBABwIzxLKf660ud7a21ZcwIAlmvq87/9nJSN8sfmmdDbq5gaALAkH338yQd3Dw8PPiyKTkTvu2E3i/p33X/3YTyK43gQt2M7TibPAlKq2+++f3gQraK0E7d6o2G3rOx9/us4NY+qfi+2Y2d+/V5Rm6ofDVvVfx5ZFvFov5zIndiOV87Vl/0Hd+bURzePNzrNIsvxd2M7fvsyHsdx3K+eaUzG/zaP4p30/d9ff1oml/XZaNjdqPIm0vqqrw0AAAAAAAAAAAAAAAAAAAAAADfXbjG2E7d6Zajef6e7flL1757pr/bXWav66/osIq8aM/sDjVL8eLq/zu2iKFJW54/399lsxautaF3bwgEAAAAAAAAAAAAAAAAAAOAlMnjy1dG94+MH/f+l0bzkP36t/6rH2Z+KvB6LkzcuNVasN+nlXGdz9n75rDeOlIu4yuSH7SJi0Zzb5yKb5XwuPvI/KaWUZRH/7TK1X2Ss+Y33mpPX31qcXOb8/MPWm0f3sovOYef0wv003ZVHf/Bk5ppGtnjQkzORdKnbL1+QkzeLnulK2bzjbL34yWzP63rrj3qwJpJdsIr2VKTdNOJ5t1/nUvfzav7+AAAAAAAAAAAAAAAAAAAAE5OXfud0Pl1Yura0SQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAik2+/3/SiHORmcYo/qyK5+eklEbjSB79wXWvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJvv3wAAAP//8BhuSw==") r4 = fcntl$dupfd(r2, 0x406, r3) setsockopt$inet_mtu(r4, 0x111, 0xa, &(0x7f0000000000), 0x4) r5 = socket(0x2, 0x1, 0x0) listen(r5, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x894b, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x48}, [@ldst={0x3, 0x0, 0x3, 0x1c10a1, 0x0, 0x2c}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r4) r7 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) setsockopt$packet_add_memb(r7, 0x107, 0x1, &(0x7f0000000040)={r8, 0x1, 0x2, @local}, 0x10) setsockopt$packet_drop_memb(r7, 0x107, 0x2, &(0x7f0000000100)={r8, 0x1, 0x6, @random="9468a11acce6"}, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000440)={r6, 0xe0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000140)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x7, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x2f, &(0x7f0000000200)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x50, 0x10, &(0x7f0000000280), &(0x7f00000002c0), 0x8, 0xfa, 0x8, 0x8, &(0x7f0000000300)}}, 0x10) getpeername$packet(r4, &(0x7f0000000480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f00000004c0)=0x14) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000500)={'batadv_slave_0\x00'}) socket$nl_route(0x10, 0x3, 0x0) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-inotify_init1-syz_mount_image$vfat-fcntl$dupfd-setsockopt$inet_mtu-socket-listen-ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL-bpf$PROG_LOAD-syz_genetlink_get_family_id$ethtool-socket$packet-ioctl$sock_SIOCGIFINDEX-setsockopt$packet_add_memb-setsockopt$packet_drop_memb-ioctl$ifreq_SIOCGIFINDEX_team-bpf$BPF_GET_PROG_INFO-getpeername$packet-ioctl$ifreq_SIOCGIFINDEX_batadv_hard detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x1, 0x0, 0xfffffffc}}, 0x2e) r3 = inotify_init1(0x800) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./bus\x00', 0x1204000, &(0x7f0000000340)=ANY=[@ANYRES64=0x0, @ANYRESHEX=0x0, @ANYRES16, @ANYRESDEC, @ANYRESDEC, @ANYRES16, @ANYRES32, @ANYBLOB="b0529ea9793daee9ef7ad16eb0b00b0ab3ff5f5f31c47edec125043e255d2716dca73eae9fb5", @ANYRES32, @ANYRES16=0x0], 0x2, 0x2c8, &(0x7f0000000840)="$eJzs3T9rZFUUAPDzkpmXCSmSwkoEX7GFjWGzrYVZJIqYSpnCP6CLuwtLMizMwMCqOGzlJ7Cw8HvY2Qs2fgPBwtLORQJX3p/MTCazk010Jkv4/Yrkcu4579773iMTeLw7X7zWO7r/ePDw6Te/R6eTxdp+7MezLKWU4lRqBABwIzxLKf660ud7a21ZcwIAlmvq87/9nJSN8sfmmdDbq5gaALAkH338yQd3Dw8PPiyKTkTvu2E3i/p33X/3YTyK43gQt2M7TibPAlKq2+++f3gQraK0E7d6o2G3rOx9/us4NY+qfi+2Y2d+/V5Rm6ofDVvVfx5ZFvFov5zIndiOV87Vl/0Hd+bURzePNzrNIsvxd2M7fvsyHsdx3K+eaUzG/zaP4p30/d9ff1oml/XZaNjdqPIm0vqqrw0AAAAAAAAAAAAAAAAAAAAAADfXbjG2E7d6Zajef6e7flL1757pr/bXWav66/osIq8aM/sDjVL8eLq/zu2iKFJW54/399lsxautaF3bwgEAAAAAAAAAAAAAAAAAAOAlMnjy1dG94+MH/f+l0bzkP36t/6rH2Z+KvB6LkzcuNVasN+nlXGdz9n75rDeOlIu4yuSH7SJi0Zzb5yKb5XwuPvI/KaWUZRH/7TK1X2Ss+Y33mpPX31qcXOb8/MPWm0f3sovOYef0wv003ZVHf/Bk5ppGtnjQkzORdKnbL1+QkzeLnulK2bzjbL34yWzP63rrj3qwJpJdsIr2VKTdNOJ5t1/nUvfzav7+AAAAAAAAAAAAAAAAAAAAE5OXfud0Pl1Yura0SQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAik2+/3/SiHORmcYo/qyK5+eklEbjSB79wXWvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJvv3wAAAP//8BhuSw==") r4 = fcntl$dupfd(r2, 0x406, r3) setsockopt$inet_mtu(r4, 0x111, 0xa, &(0x7f0000000000), 0x4) r5 = socket(0x2, 0x1, 0x0) listen(r5, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x894b, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x48}, [@ldst={0x3, 0x0, 0x3, 0x1c10a1, 0x0, 0x2c}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r4) r7 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) setsockopt$packet_add_memb(r7, 0x107, 0x1, &(0x7f0000000040)={r8, 0x1, 0x2, @local}, 0x10) setsockopt$packet_drop_memb(r7, 0x107, 0x2, &(0x7f0000000100)={r8, 0x1, 0x6, @random="9468a11acce6"}, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000440)={r6, 0xe0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000140)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x7, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x2f, &(0x7f0000000200)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x50, 0x10, &(0x7f0000000280), &(0x7f00000002c0), 0x8, 0xfa, 0x8, 0x8, &(0x7f0000000300)}}, 0x10) getpeername$packet(r4, &(0x7f0000000480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f00000004c0)=0x14) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000500)={'batadv_slave_0\x00'}) program crashed: KASAN: use-after-free Read in rcu_cblist_dequeue testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-inotify_init1-syz_mount_image$vfat-fcntl$dupfd-setsockopt$inet_mtu-socket-listen-ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL-bpf$PROG_LOAD-syz_genetlink_get_family_id$ethtool-socket$packet-ioctl$sock_SIOCGIFINDEX-setsockopt$packet_add_memb-setsockopt$packet_drop_memb-ioctl$ifreq_SIOCGIFINDEX_team-bpf$BPF_GET_PROG_INFO-getpeername$packet detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x1, 0x0, 0xfffffffc}}, 0x2e) r3 = inotify_init1(0x800) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./bus\x00', 0x1204000, &(0x7f0000000340)=ANY=[@ANYRES64=0x0, @ANYRESHEX=0x0, @ANYRES16, @ANYRESDEC, @ANYRESDEC, @ANYRES16, @ANYRES32, @ANYBLOB="b0529ea9793daee9ef7ad16eb0b00b0ab3ff5f5f31c47edec125043e255d2716dca73eae9fb5", @ANYRES32, @ANYRES16=0x0], 0x2, 0x2c8, &(0x7f0000000840)="$eJzs3T9rZFUUAPDzkpmXCSmSwkoEX7GFjWGzrYVZJIqYSpnCP6CLuwtLMizMwMCqOGzlJ7Cw8HvY2Qs2fgPBwtLORQJX3p/MTCazk010Jkv4/Yrkcu4579773iMTeLw7X7zWO7r/ePDw6Te/R6eTxdp+7MezLKWU4lRqBABwIzxLKf660ud7a21ZcwIAlmvq87/9nJSN8sfmmdDbq5gaALAkH338yQd3Dw8PPiyKTkTvu2E3i/p33X/3YTyK43gQt2M7TibPAlKq2+++f3gQraK0E7d6o2G3rOx9/us4NY+qfi+2Y2d+/V5Rm6ofDVvVfx5ZFvFov5zIndiOV87Vl/0Hd+bURzePNzrNIsvxd2M7fvsyHsdx3K+eaUzG/zaP4p30/d9ff1oml/XZaNjdqPIm0vqqrw0AAAAAAAAAAAAAAAAAAAAAADfXbjG2E7d6Zajef6e7flL1757pr/bXWav66/osIq8aM/sDjVL8eLq/zu2iKFJW54/399lsxautaF3bwgEAAAAAAAAAAAAAAAAAAOAlMnjy1dG94+MH/f+l0bzkP36t/6rH2Z+KvB6LkzcuNVasN+nlXGdz9n75rDeOlIu4yuSH7SJi0Zzb5yKb5XwuPvI/KaWUZRH/7TK1X2Ss+Y33mpPX31qcXOb8/MPWm0f3sovOYef0wv003ZVHf/Bk5ppGtnjQkzORdKnbL1+QkzeLnulK2bzjbL34yWzP63rrj3qwJpJdsIr2VKTdNOJ5t1/nUvfzav7+AAAAAAAAAAAAAAAAAAAAE5OXfud0Pl1Yura0SQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAik2+/3/SiHORmcYo/qyK5+eklEbjSB79wXWvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJvv3wAAAP//8BhuSw==") r4 = fcntl$dupfd(r2, 0x406, r3) setsockopt$inet_mtu(r4, 0x111, 0xa, &(0x7f0000000000), 0x4) r5 = socket(0x2, 0x1, 0x0) listen(r5, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x894b, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x48}, [@ldst={0x3, 0x0, 0x3, 0x1c10a1, 0x0, 0x2c}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r4) r7 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) setsockopt$packet_add_memb(r7, 0x107, 0x1, &(0x7f0000000040)={r8, 0x1, 0x2, @local}, 0x10) setsockopt$packet_drop_memb(r7, 0x107, 0x2, &(0x7f0000000100)={r8, 0x1, 0x6, @random="9468a11acce6"}, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000440)={r6, 0xe0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000140)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x7, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x2f, &(0x7f0000000200)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x50, 0x10, &(0x7f0000000280), &(0x7f00000002c0), 0x8, 0xfa, 0x8, 0x8, &(0x7f0000000300)}}, 0x10) getpeername$packet(r4, &(0x7f0000000480)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f00000004c0)=0x14) program crashed: KASAN: use-after-free Read in rcu_cblist_dequeue testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-inotify_init1-syz_mount_image$vfat-fcntl$dupfd-setsockopt$inet_mtu-socket-listen-ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL-bpf$PROG_LOAD-syz_genetlink_get_family_id$ethtool-socket$packet-ioctl$sock_SIOCGIFINDEX-setsockopt$packet_add_memb-setsockopt$packet_drop_memb-ioctl$ifreq_SIOCGIFINDEX_team-bpf$BPF_GET_PROG_INFO detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x1, 0x0, 0xfffffffc}}, 0x2e) r3 = inotify_init1(0x800) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./bus\x00', 0x1204000, &(0x7f0000000340)=ANY=[@ANYRES64=0x0, @ANYRESHEX=0x0, @ANYRES16, @ANYRESDEC, @ANYRESDEC, @ANYRES16, @ANYRES32, @ANYBLOB="b0529ea9793daee9ef7ad16eb0b00b0ab3ff5f5f31c47edec125043e255d2716dca73eae9fb5", @ANYRES32, @ANYRES16=0x0], 0x2, 0x2c8, &(0x7f0000000840)="$eJzs3T9rZFUUAPDzkpmXCSmSwkoEX7GFjWGzrYVZJIqYSpnCP6CLuwtLMizMwMCqOGzlJ7Cw8HvY2Qs2fgPBwtLORQJX3p/MTCazk010Jkv4/Yrkcu4579773iMTeLw7X7zWO7r/ePDw6Te/R6eTxdp+7MezLKWU4lRqBABwIzxLKf660ud7a21ZcwIAlmvq87/9nJSN8sfmmdDbq5gaALAkH338yQd3Dw8PPiyKTkTvu2E3i/p33X/3YTyK43gQt2M7TibPAlKq2+++f3gQraK0E7d6o2G3rOx9/us4NY+qfi+2Y2d+/V5Rm6ofDVvVfx5ZFvFov5zIndiOV87Vl/0Hd+bURzePNzrNIsvxd2M7fvsyHsdx3K+eaUzG/zaP4p30/d9ff1oml/XZaNjdqPIm0vqqrw0AAAAAAAAAAAAAAAAAAAAAADfXbjG2E7d6Zajef6e7flL1757pr/bXWav66/osIq8aM/sDjVL8eLq/zu2iKFJW54/399lsxautaF3bwgEAAAAAAAAAAAAAAAAAAOAlMnjy1dG94+MH/f+l0bzkP36t/6rH2Z+KvB6LkzcuNVasN+nlXGdz9n75rDeOlIu4yuSH7SJi0Zzb5yKb5XwuPvI/KaWUZRH/7TK1X2Ss+Y33mpPX31qcXOb8/MPWm0f3sovOYef0wv003ZVHf/Bk5ppGtnjQkzORdKnbL1+QkzeLnulK2bzjbL34yWzP63rrj3qwJpJdsIr2VKTdNOJ5t1/nUvfzav7+AAAAAAAAAAAAAAAAAAAAE5OXfud0Pl1Yura0SQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAik2+/3/SiHORmcYo/qyK5+eklEbjSB79wXWvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJvv3wAAAP//8BhuSw==") r4 = fcntl$dupfd(r2, 0x406, r3) setsockopt$inet_mtu(r4, 0x111, 0xa, &(0x7f0000000000), 0x4) r5 = socket(0x2, 0x1, 0x0) listen(r5, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x894b, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x48}, [@ldst={0x3, 0x0, 0x3, 0x1c10a1, 0x0, 0x2c}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r4) r7 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) setsockopt$packet_add_memb(r7, 0x107, 0x1, &(0x7f0000000040)={r8, 0x1, 0x2, @local}, 0x10) setsockopt$packet_drop_memb(r7, 0x107, 0x2, &(0x7f0000000100)={r8, 0x1, 0x6, @random="9468a11acce6"}, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000440)={r6, 0xe0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000140)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x7, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x2f, &(0x7f0000000200)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x50, 0x10, &(0x7f0000000280), &(0x7f00000002c0), 0x8, 0xfa, 0x8, 0x8, &(0x7f0000000300)}}, 0x10) program crashed: KASAN: use-after-free Read in rcu_cblist_dequeue testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-inotify_init1-syz_mount_image$vfat-fcntl$dupfd-setsockopt$inet_mtu-socket-listen-ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL-bpf$PROG_LOAD-syz_genetlink_get_family_id$ethtool-socket$packet-ioctl$sock_SIOCGIFINDEX-setsockopt$packet_add_memb-setsockopt$packet_drop_memb-ioctl$ifreq_SIOCGIFINDEX_team detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x1, 0x0, 0xfffffffc}}, 0x2e) r3 = inotify_init1(0x800) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./bus\x00', 0x1204000, &(0x7f0000000340)=ANY=[@ANYRES64=0x0, @ANYRESHEX=0x0, @ANYRES16, @ANYRESDEC, @ANYRESDEC, @ANYRES16, @ANYRES32, @ANYBLOB="b0529ea9793daee9ef7ad16eb0b00b0ab3ff5f5f31c47edec125043e255d2716dca73eae9fb5", @ANYRES32, @ANYRES16=0x0], 0x2, 0x2c8, &(0x7f0000000840)="$eJzs3T9rZFUUAPDzkpmXCSmSwkoEX7GFjWGzrYVZJIqYSpnCP6CLuwtLMizMwMCqOGzlJ7Cw8HvY2Qs2fgPBwtLORQJX3p/MTCazk010Jkv4/Yrkcu4579773iMTeLw7X7zWO7r/ePDw6Te/R6eTxdp+7MezLKWU4lRqBABwIzxLKf660ud7a21ZcwIAlmvq87/9nJSN8sfmmdDbq5gaALAkH338yQd3Dw8PPiyKTkTvu2E3i/p33X/3YTyK43gQt2M7TibPAlKq2+++f3gQraK0E7d6o2G3rOx9/us4NY+qfi+2Y2d+/V5Rm6ofDVvVfx5ZFvFov5zIndiOV87Vl/0Hd+bURzePNzrNIsvxd2M7fvsyHsdx3K+eaUzG/zaP4p30/d9ff1oml/XZaNjdqPIm0vqqrw0AAAAAAAAAAAAAAAAAAAAAADfXbjG2E7d6Zajef6e7flL1757pr/bXWav66/osIq8aM/sDjVL8eLq/zu2iKFJW54/399lsxautaF3bwgEAAAAAAAAAAAAAAAAAAOAlMnjy1dG94+MH/f+l0bzkP36t/6rH2Z+KvB6LkzcuNVasN+nlXGdz9n75rDeOlIu4yuSH7SJi0Zzb5yKb5XwuPvI/KaWUZRH/7TK1X2Ss+Y33mpPX31qcXOb8/MPWm0f3sovOYef0wv003ZVHf/Bk5ppGtnjQkzORdKnbL1+QkzeLnulK2bzjbL34yWzP63rrj3qwJpJdsIr2VKTdNOJ5t1/nUvfzav7+AAAAAAAAAAAAAAAAAAAAE5OXfud0Pl1Yura0SQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAik2+/3/SiHORmcYo/qyK5+eklEbjSB79wXWvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJvv3wAAAP//8BhuSw==") r4 = fcntl$dupfd(r2, 0x406, r3) setsockopt$inet_mtu(r4, 0x111, 0xa, &(0x7f0000000000), 0x4) r5 = socket(0x2, 0x1, 0x0) listen(r5, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x894b, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x48}, [@ldst={0x3, 0x0, 0x3, 0x1c10a1, 0x0, 0x2c}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r4) r6 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) setsockopt$packet_add_memb(r6, 0x107, 0x1, &(0x7f0000000040)={r7, 0x1, 0x2, @local}, 0x10) setsockopt$packet_drop_memb(r6, 0x107, 0x2, &(0x7f0000000100)={r7, 0x1, 0x6, @random="9468a11acce6"}, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-inotify_init1-syz_mount_image$vfat-fcntl$dupfd-setsockopt$inet_mtu-socket-listen-ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL-bpf$PROG_LOAD-syz_genetlink_get_family_id$ethtool-socket$packet-ioctl$sock_SIOCGIFINDEX-setsockopt$packet_add_memb-setsockopt$packet_drop_memb detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x1, 0x0, 0xfffffffc}}, 0x2e) r3 = inotify_init1(0x800) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./bus\x00', 0x1204000, &(0x7f0000000340)=ANY=[@ANYRES64=0x0, @ANYRESHEX=0x0, @ANYRES16, @ANYRESDEC, @ANYRESDEC, @ANYRES16, @ANYRES32, @ANYBLOB="b0529ea9793daee9ef7ad16eb0b00b0ab3ff5f5f31c47edec125043e255d2716dca73eae9fb5", @ANYRES32, @ANYRES16=0x0], 0x2, 0x2c8, &(0x7f0000000840)="$eJzs3T9rZFUUAPDzkpmXCSmSwkoEX7GFjWGzrYVZJIqYSpnCP6CLuwtLMizMwMCqOGzlJ7Cw8HvY2Qs2fgPBwtLORQJX3p/MTCazk010Jkv4/Yrkcu4579773iMTeLw7X7zWO7r/ePDw6Te/R6eTxdp+7MezLKWU4lRqBABwIzxLKf660ud7a21ZcwIAlmvq87/9nJSN8sfmmdDbq5gaALAkH338yQd3Dw8PPiyKTkTvu2E3i/p33X/3YTyK43gQt2M7TibPAlKq2+++f3gQraK0E7d6o2G3rOx9/us4NY+qfi+2Y2d+/V5Rm6ofDVvVfx5ZFvFov5zIndiOV87Vl/0Hd+bURzePNzrNIsvxd2M7fvsyHsdx3K+eaUzG/zaP4p30/d9ff1oml/XZaNjdqPIm0vqqrw0AAAAAAAAAAAAAAAAAAAAAADfXbjG2E7d6Zajef6e7flL1757pr/bXWav66/osIq8aM/sDjVL8eLq/zu2iKFJW54/399lsxautaF3bwgEAAAAAAAAAAAAAAAAAAOAlMnjy1dG94+MH/f+l0bzkP36t/6rH2Z+KvB6LkzcuNVasN+nlXGdz9n75rDeOlIu4yuSH7SJi0Zzb5yKb5XwuPvI/KaWUZRH/7TK1X2Ss+Y33mpPX31qcXOb8/MPWm0f3sovOYef0wv003ZVHf/Bk5ppGtnjQkzORdKnbL1+QkzeLnulK2bzjbL34yWzP63rrj3qwJpJdsIr2VKTdNOJ5t1/nUvfzav7+AAAAAAAAAAAAAAAAAAAAE5OXfud0Pl1Yura0SQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAik2+/3/SiHORmcYo/qyK5+eklEbjSB79wXWvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJvv3wAAAP//8BhuSw==") r4 = fcntl$dupfd(r2, 0x406, r3) setsockopt$inet_mtu(r4, 0x111, 0xa, &(0x7f0000000000), 0x4) r5 = socket(0x2, 0x1, 0x0) listen(r5, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x894b, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x48}, [@ldst={0x3, 0x0, 0x3, 0x1c10a1, 0x0, 0x2c}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r4) r6 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) setsockopt$packet_add_memb(r6, 0x107, 0x1, &(0x7f0000000040)={r7, 0x1, 0x2, @local}, 0x10) setsockopt$packet_drop_memb(r6, 0x107, 0x2, &(0x7f0000000100)={r7, 0x1, 0x6, @random="9468a11acce6"}, 0x10) program did not crash testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-inotify_init1-syz_mount_image$vfat-fcntl$dupfd-setsockopt$inet_mtu-socket-listen-ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL-bpf$PROG_LOAD-syz_genetlink_get_family_id$ethtool-socket$packet-ioctl$sock_SIOCGIFINDEX-setsockopt$packet_add_memb-ioctl$ifreq_SIOCGIFINDEX_team detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x1, 0x0, 0xfffffffc}}, 0x2e) r3 = inotify_init1(0x800) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./bus\x00', 0x1204000, &(0x7f0000000340)=ANY=[@ANYRES64=0x0, @ANYRESHEX=0x0, @ANYRES16, @ANYRESDEC, @ANYRESDEC, @ANYRES16, @ANYRES32, @ANYBLOB="b0529ea9793daee9ef7ad16eb0b00b0ab3ff5f5f31c47edec125043e255d2716dca73eae9fb5", @ANYRES32, @ANYRES16=0x0], 0x2, 0x2c8, &(0x7f0000000840)="$eJzs3T9rZFUUAPDzkpmXCSmSwkoEX7GFjWGzrYVZJIqYSpnCP6CLuwtLMizMwMCqOGzlJ7Cw8HvY2Qs2fgPBwtLORQJX3p/MTCazk010Jkv4/Yrkcu4579773iMTeLw7X7zWO7r/ePDw6Te/R6eTxdp+7MezLKWU4lRqBABwIzxLKf660ud7a21ZcwIAlmvq87/9nJSN8sfmmdDbq5gaALAkH338yQd3Dw8PPiyKTkTvu2E3i/p33X/3YTyK43gQt2M7TibPAlKq2+++f3gQraK0E7d6o2G3rOx9/us4NY+qfi+2Y2d+/V5Rm6ofDVvVfx5ZFvFov5zIndiOV87Vl/0Hd+bURzePNzrNIsvxd2M7fvsyHsdx3K+eaUzG/zaP4p30/d9ff1oml/XZaNjdqPIm0vqqrw0AAAAAAAAAAAAAAAAAAAAAADfXbjG2E7d6Zajef6e7flL1757pr/bXWav66/osIq8aM/sDjVL8eLq/zu2iKFJW54/399lsxautaF3bwgEAAAAAAAAAAAAAAAAAAOAlMnjy1dG94+MH/f+l0bzkP36t/6rH2Z+KvB6LkzcuNVasN+nlXGdz9n75rDeOlIu4yuSH7SJi0Zzb5yKb5XwuPvI/KaWUZRH/7TK1X2Ss+Y33mpPX31qcXOb8/MPWm0f3sovOYef0wv003ZVHf/Bk5ppGtnjQkzORdKnbL1+QkzeLnulK2bzjbL34yWzP63rrj3qwJpJdsIr2VKTdNOJ5t1/nUvfzav7+AAAAAAAAAAAAAAAAAAAAE5OXfud0Pl1Yura0SQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAik2+/3/SiHORmcYo/qyK5+eklEbjSB79wXWvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJvv3wAAAP//8BhuSw==") r4 = fcntl$dupfd(r2, 0x406, r3) setsockopt$inet_mtu(r4, 0x111, 0xa, &(0x7f0000000000), 0x4) r5 = socket(0x2, 0x1, 0x0) listen(r5, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x894b, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x48}, [@ldst={0x3, 0x0, 0x3, 0x1c10a1, 0x0, 0x2c}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r4) r6 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) setsockopt$packet_add_memb(r6, 0x107, 0x1, &(0x7f0000000040)={r7, 0x1, 0x2, @local}, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-inotify_init1-syz_mount_image$vfat-fcntl$dupfd-setsockopt$inet_mtu-socket-listen-ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL-bpf$PROG_LOAD-syz_genetlink_get_family_id$ethtool-socket$packet-ioctl$sock_SIOCGIFINDEX-ioctl$ifreq_SIOCGIFINDEX_team detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x1, 0x0, 0xfffffffc}}, 0x2e) r3 = inotify_init1(0x800) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./bus\x00', 0x1204000, &(0x7f0000000340)=ANY=[@ANYRES64=0x0, @ANYRESHEX=0x0, @ANYRES16, @ANYRESDEC, @ANYRESDEC, @ANYRES16, @ANYRES32, @ANYBLOB="b0529ea9793daee9ef7ad16eb0b00b0ab3ff5f5f31c47edec125043e255d2716dca73eae9fb5", @ANYRES32, @ANYRES16=0x0], 0x2, 0x2c8, &(0x7f0000000840)="$eJzs3T9rZFUUAPDzkpmXCSmSwkoEX7GFjWGzrYVZJIqYSpnCP6CLuwtLMizMwMCqOGzlJ7Cw8HvY2Qs2fgPBwtLORQJX3p/MTCazk010Jkv4/Yrkcu4579773iMTeLw7X7zWO7r/ePDw6Te/R6eTxdp+7MezLKWU4lRqBABwIzxLKf660ud7a21ZcwIAlmvq87/9nJSN8sfmmdDbq5gaALAkH338yQd3Dw8PPiyKTkTvu2E3i/p33X/3YTyK43gQt2M7TibPAlKq2+++f3gQraK0E7d6o2G3rOx9/us4NY+qfi+2Y2d+/V5Rm6ofDVvVfx5ZFvFov5zIndiOV87Vl/0Hd+bURzePNzrNIsvxd2M7fvsyHsdx3K+eaUzG/zaP4p30/d9ff1oml/XZaNjdqPIm0vqqrw0AAAAAAAAAAAAAAAAAAAAAADfXbjG2E7d6Zajef6e7flL1757pr/bXWav66/osIq8aM/sDjVL8eLq/zu2iKFJW54/399lsxautaF3bwgEAAAAAAAAAAAAAAAAAAOAlMnjy1dG94+MH/f+l0bzkP36t/6rH2Z+KvB6LkzcuNVasN+nlXGdz9n75rDeOlIu4yuSH7SJi0Zzb5yKb5XwuPvI/KaWUZRH/7TK1X2Ss+Y33mpPX31qcXOb8/MPWm0f3sovOYef0wv003ZVHf/Bk5ppGtnjQkzORdKnbL1+QkzeLnulK2bzjbL34yWzP63rrj3qwJpJdsIr2VKTdNOJ5t1/nUvfzav7+AAAAAAAAAAAAAAAAAAAAE5OXfud0Pl1Yura0SQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAik2+/3/SiHORmcYo/qyK5+eklEbjSB79wXWvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJvv3wAAAP//8BhuSw==") r4 = fcntl$dupfd(r2, 0x406, r3) setsockopt$inet_mtu(r4, 0x111, 0xa, &(0x7f0000000000), 0x4) r5 = socket(0x2, 0x1, 0x0) listen(r5, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x894b, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x48}, [@ldst={0x3, 0x0, 0x3, 0x1c10a1, 0x0, 0x2c}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r4) r6 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000140)={'bridge0\x00'}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)) program crashed: KASAN: use-after-free Read in rcu_cblist_dequeue testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-inotify_init1-syz_mount_image$vfat-fcntl$dupfd-setsockopt$inet_mtu-socket-listen-ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL-bpf$PROG_LOAD-syz_genetlink_get_family_id$ethtool-socket$packet-ioctl$ifreq_SIOCGIFINDEX_team detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x1, 0x0, 0xfffffffc}}, 0x2e) r3 = inotify_init1(0x800) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./bus\x00', 0x1204000, &(0x7f0000000340)=ANY=[@ANYRES64=0x0, @ANYRESHEX=0x0, @ANYRES16, @ANYRESDEC, @ANYRESDEC, @ANYRES16, @ANYRES32, @ANYBLOB="b0529ea9793daee9ef7ad16eb0b00b0ab3ff5f5f31c47edec125043e255d2716dca73eae9fb5", @ANYRES32, @ANYRES16=0x0], 0x2, 0x2c8, &(0x7f0000000840)="$eJzs3T9rZFUUAPDzkpmXCSmSwkoEX7GFjWGzrYVZJIqYSpnCP6CLuwtLMizMwMCqOGzlJ7Cw8HvY2Qs2fgPBwtLORQJX3p/MTCazk010Jkv4/Yrkcu4579773iMTeLw7X7zWO7r/ePDw6Te/R6eTxdp+7MezLKWU4lRqBABwIzxLKf660ud7a21ZcwIAlmvq87/9nJSN8sfmmdDbq5gaALAkH338yQd3Dw8PPiyKTkTvu2E3i/p33X/3YTyK43gQt2M7TibPAlKq2+++f3gQraK0E7d6o2G3rOx9/us4NY+qfi+2Y2d+/V5Rm6ofDVvVfx5ZFvFov5zIndiOV87Vl/0Hd+bURzePNzrNIsvxd2M7fvsyHsdx3K+eaUzG/zaP4p30/d9ff1oml/XZaNjdqPIm0vqqrw0AAAAAAAAAAAAAAAAAAAAAADfXbjG2E7d6Zajef6e7flL1757pr/bXWav66/osIq8aM/sDjVL8eLq/zu2iKFJW54/399lsxautaF3bwgEAAAAAAAAAAAAAAAAAAOAlMnjy1dG94+MH/f+l0bzkP36t/6rH2Z+KvB6LkzcuNVasN+nlXGdz9n75rDeOlIu4yuSH7SJi0Zzb5yKb5XwuPvI/KaWUZRH/7TK1X2Ss+Y33mpPX31qcXOb8/MPWm0f3sovOYef0wv003ZVHf/Bk5ppGtnjQkzORdKnbL1+QkzeLnulK2bzjbL34yWzP63rrj3qwJpJdsIr2VKTdNOJ5t1/nUvfzav7+AAAAAAAAAAAAAAAAAAAAE5OXfud0Pl1Yura0SQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAik2+/3/SiHORmcYo/qyK5+eklEbjSB79wXWvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJvv3wAAAP//8BhuSw==") r4 = fcntl$dupfd(r2, 0x406, r3) setsockopt$inet_mtu(r4, 0x111, 0xa, &(0x7f0000000000), 0x4) r5 = socket(0x2, 0x1, 0x0) listen(r5, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x894b, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x48}, [@ldst={0x3, 0x0, 0x3, 0x1c10a1, 0x0, 0x2c}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r4) socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)) program crashed: KASAN: use-after-free Read in rcu_cblist_dequeue testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-inotify_init1-syz_mount_image$vfat-fcntl$dupfd-setsockopt$inet_mtu-socket-listen-ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL-bpf$PROG_LOAD-syz_genetlink_get_family_id$ethtool-ioctl$ifreq_SIOCGIFINDEX_team detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x1, 0x0, 0xfffffffc}}, 0x2e) r3 = inotify_init1(0x800) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./bus\x00', 0x1204000, &(0x7f0000000340)=ANY=[@ANYRES64=0x0, @ANYRESHEX=0x0, @ANYRES16, @ANYRESDEC, @ANYRESDEC, @ANYRES16, @ANYRES32, @ANYBLOB="b0529ea9793daee9ef7ad16eb0b00b0ab3ff5f5f31c47edec125043e255d2716dca73eae9fb5", @ANYRES32, @ANYRES16=0x0], 0x2, 0x2c8, &(0x7f0000000840)="$eJzs3T9rZFUUAPDzkpmXCSmSwkoEX7GFjWGzrYVZJIqYSpnCP6CLuwtLMizMwMCqOGzlJ7Cw8HvY2Qs2fgPBwtLORQJX3p/MTCazk010Jkv4/Yrkcu4579773iMTeLw7X7zWO7r/ePDw6Te/R6eTxdp+7MezLKWU4lRqBABwIzxLKf660ud7a21ZcwIAlmvq87/9nJSN8sfmmdDbq5gaALAkH338yQd3Dw8PPiyKTkTvu2E3i/p33X/3YTyK43gQt2M7TibPAlKq2+++f3gQraK0E7d6o2G3rOx9/us4NY+qfi+2Y2d+/V5Rm6ofDVvVfx5ZFvFov5zIndiOV87Vl/0Hd+bURzePNzrNIsvxd2M7fvsyHsdx3K+eaUzG/zaP4p30/d9ff1oml/XZaNjdqPIm0vqqrw0AAAAAAAAAAAAAAAAAAAAAADfXbjG2E7d6Zajef6e7flL1757pr/bXWav66/osIq8aM/sDjVL8eLq/zu2iKFJW54/399lsxautaF3bwgEAAAAAAAAAAAAAAAAAAOAlMnjy1dG94+MH/f+l0bzkP36t/6rH2Z+KvB6LkzcuNVasN+nlXGdz9n75rDeOlIu4yuSH7SJi0Zzb5yKb5XwuPvI/KaWUZRH/7TK1X2Ss+Y33mpPX31qcXOb8/MPWm0f3sovOYef0wv003ZVHf/Bk5ppGtnjQkzORdKnbL1+QkzeLnulK2bzjbL34yWzP63rrj3qwJpJdsIr2VKTdNOJ5t1/nUvfzav7+AAAAAAAAAAAAAAAAAAAAE5OXfud0Pl1Yura0SQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAik2+/3/SiHORmcYo/qyK5+eklEbjSB79wXWvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJvv3wAAAP//8BhuSw==") r4 = fcntl$dupfd(r2, 0x406, r3) setsockopt$inet_mtu(r4, 0x111, 0xa, &(0x7f0000000000), 0x4) r5 = socket(0x2, 0x1, 0x0) listen(r5, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x894b, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x48}, [@ldst={0x3, 0x0, 0x3, 0x1c10a1, 0x0, 0x2c}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r4) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)) program crashed: KASAN: use-after-free Read in rcu_cblist_dequeue testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-inotify_init1-syz_mount_image$vfat-fcntl$dupfd-setsockopt$inet_mtu-socket-listen-ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL-bpf$PROG_LOAD-ioctl$ifreq_SIOCGIFINDEX_team detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x1, 0x0, 0xfffffffc}}, 0x2e) r3 = inotify_init1(0x800) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./bus\x00', 0x1204000, &(0x7f0000000340)=ANY=[@ANYRES64=0x0, @ANYRESHEX=0x0, @ANYRES16, @ANYRESDEC, @ANYRESDEC, @ANYRES16, @ANYRES32, @ANYBLOB="b0529ea9793daee9ef7ad16eb0b00b0ab3ff5f5f31c47edec125043e255d2716dca73eae9fb5", @ANYRES32, @ANYRES16=0x0], 0x2, 0x2c8, &(0x7f0000000840)="$eJzs3T9rZFUUAPDzkpmXCSmSwkoEX7GFjWGzrYVZJIqYSpnCP6CLuwtLMizMwMCqOGzlJ7Cw8HvY2Qs2fgPBwtLORQJX3p/MTCazk010Jkv4/Yrkcu4579773iMTeLw7X7zWO7r/ePDw6Te/R6eTxdp+7MezLKWU4lRqBABwIzxLKf660ud7a21ZcwIAlmvq87/9nJSN8sfmmdDbq5gaALAkH338yQd3Dw8PPiyKTkTvu2E3i/p33X/3YTyK43gQt2M7TibPAlKq2+++f3gQraK0E7d6o2G3rOx9/us4NY+qfi+2Y2d+/V5Rm6ofDVvVfx5ZFvFov5zIndiOV87Vl/0Hd+bURzePNzrNIsvxd2M7fvsyHsdx3K+eaUzG/zaP4p30/d9ff1oml/XZaNjdqPIm0vqqrw0AAAAAAAAAAAAAAAAAAAAAADfXbjG2E7d6Zajef6e7flL1757pr/bXWav66/osIq8aM/sDjVL8eLq/zu2iKFJW54/399lsxautaF3bwgEAAAAAAAAAAAAAAAAAAOAlMnjy1dG94+MH/f+l0bzkP36t/6rH2Z+KvB6LkzcuNVasN+nlXGdz9n75rDeOlIu4yuSH7SJi0Zzb5yKb5XwuPvI/KaWUZRH/7TK1X2Ss+Y33mpPX31qcXOb8/MPWm0f3sovOYef0wv003ZVHf/Bk5ppGtnjQkzORdKnbL1+QkzeLnulK2bzjbL34yWzP63rrj3qwJpJdsIr2VKTdNOJ5t1/nUvfzav7+AAAAAAAAAAAAAAAAAAAAE5OXfud0Pl1Yura0SQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAik2+/3/SiHORmcYo/qyK5+eklEbjSB79wXWvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJvv3wAAAP//8BhuSw==") r4 = fcntl$dupfd(r2, 0x406, r3) setsockopt$inet_mtu(r4, 0x111, 0xa, &(0x7f0000000000), 0x4) r5 = socket(0x2, 0x1, 0x0) listen(r5, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x894b, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x48}, [@ldst={0x3, 0x0, 0x3, 0x1c10a1, 0x0, 0x2c}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-inotify_init1-syz_mount_image$vfat-fcntl$dupfd-setsockopt$inet_mtu-socket-listen-ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL-ioctl$ifreq_SIOCGIFINDEX_team detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x1, 0x0, 0xfffffffc}}, 0x2e) r3 = inotify_init1(0x800) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./bus\x00', 0x1204000, &(0x7f0000000340)=ANY=[@ANYRES64=0x0, @ANYRESHEX=0x0, @ANYRES16, @ANYRESDEC, @ANYRESDEC, @ANYRES16, @ANYRES32, @ANYBLOB="b0529ea9793daee9ef7ad16eb0b00b0ab3ff5f5f31c47edec125043e255d2716dca73eae9fb5", @ANYRES32, @ANYRES16=0x0], 0x2, 0x2c8, &(0x7f0000000840)="$eJzs3T9rZFUUAPDzkpmXCSmSwkoEX7GFjWGzrYVZJIqYSpnCP6CLuwtLMizMwMCqOGzlJ7Cw8HvY2Qs2fgPBwtLORQJX3p/MTCazk010Jkv4/Yrkcu4579773iMTeLw7X7zWO7r/ePDw6Te/R6eTxdp+7MezLKWU4lRqBABwIzxLKf660ud7a21ZcwIAlmvq87/9nJSN8sfmmdDbq5gaALAkH338yQd3Dw8PPiyKTkTvu2E3i/p33X/3YTyK43gQt2M7TibPAlKq2+++f3gQraK0E7d6o2G3rOx9/us4NY+qfi+2Y2d+/V5Rm6ofDVvVfx5ZFvFov5zIndiOV87Vl/0Hd+bURzePNzrNIsvxd2M7fvsyHsdx3K+eaUzG/zaP4p30/d9ff1oml/XZaNjdqPIm0vqqrw0AAAAAAAAAAAAAAAAAAAAAADfXbjG2E7d6Zajef6e7flL1757pr/bXWav66/osIq8aM/sDjVL8eLq/zu2iKFJW54/399lsxautaF3bwgEAAAAAAAAAAAAAAAAAAOAlMnjy1dG94+MH/f+l0bzkP36t/6rH2Z+KvB6LkzcuNVasN+nlXGdz9n75rDeOlIu4yuSH7SJi0Zzb5yKb5XwuPvI/KaWUZRH/7TK1X2Ss+Y33mpPX31qcXOb8/MPWm0f3sovOYef0wv003ZVHf/Bk5ppGtnjQkzORdKnbL1+QkzeLnulK2bzjbL34yWzP63rrj3qwJpJdsIr2VKTdNOJ5t1/nUvfzav7+AAAAAAAAAAAAAAAAAAAAE5OXfud0Pl1Yura0SQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAik2+/3/SiHORmcYo/qyK5+eklEbjSB79wXWvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJvv3wAAAP//8BhuSw==") r4 = fcntl$dupfd(r2, 0x406, r3) setsockopt$inet_mtu(r4, 0x111, 0xa, &(0x7f0000000000), 0x4) r5 = socket(0x2, 0x1, 0x0) listen(r5, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x894b, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-inotify_init1-syz_mount_image$vfat-fcntl$dupfd-setsockopt$inet_mtu-socket-listen-ioctl$ifreq_SIOCGIFINDEX_team detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x1, 0x0, 0xfffffffc}}, 0x2e) r3 = inotify_init1(0x800) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./bus\x00', 0x1204000, &(0x7f0000000340)=ANY=[@ANYRES64=0x0, @ANYRESHEX=0x0, @ANYRES16, @ANYRESDEC, @ANYRESDEC, @ANYRES16, @ANYRES32, @ANYBLOB="b0529ea9793daee9ef7ad16eb0b00b0ab3ff5f5f31c47edec125043e255d2716dca73eae9fb5", @ANYRES32, @ANYRES16=0x0], 0x2, 0x2c8, &(0x7f0000000840)="$eJzs3T9rZFUUAPDzkpmXCSmSwkoEX7GFjWGzrYVZJIqYSpnCP6CLuwtLMizMwMCqOGzlJ7Cw8HvY2Qs2fgPBwtLORQJX3p/MTCazk010Jkv4/Yrkcu4579773iMTeLw7X7zWO7r/ePDw6Te/R6eTxdp+7MezLKWU4lRqBABwIzxLKf660ud7a21ZcwIAlmvq87/9nJSN8sfmmdDbq5gaALAkH338yQd3Dw8PPiyKTkTvu2E3i/p33X/3YTyK43gQt2M7TibPAlKq2+++f3gQraK0E7d6o2G3rOx9/us4NY+qfi+2Y2d+/V5Rm6ofDVvVfx5ZFvFov5zIndiOV87Vl/0Hd+bURzePNzrNIsvxd2M7fvsyHsdx3K+eaUzG/zaP4p30/d9ff1oml/XZaNjdqPIm0vqqrw0AAAAAAAAAAAAAAAAAAAAAADfXbjG2E7d6Zajef6e7flL1757pr/bXWav66/osIq8aM/sDjVL8eLq/zu2iKFJW54/399lsxautaF3bwgEAAAAAAAAAAAAAAAAAAOAlMnjy1dG94+MH/f+l0bzkP36t/6rH2Z+KvB6LkzcuNVasN+nlXGdz9n75rDeOlIu4yuSH7SJi0Zzb5yKb5XwuPvI/KaWUZRH/7TK1X2Ss+Y33mpPX31qcXOb8/MPWm0f3sovOYef0wv003ZVHf/Bk5ppGtnjQkzORdKnbL1+QkzeLnulK2bzjbL34yWzP63rrj3qwJpJdsIr2VKTdNOJ5t1/nUvfzav7+AAAAAAAAAAAAAAAAAAAAE5OXfud0Pl1Yura0SQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAik2+/3/SiHORmcYo/qyK5+eklEbjSB79wXWvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJvv3wAAAP//8BhuSw==") r4 = fcntl$dupfd(r2, 0x406, r3) setsockopt$inet_mtu(r4, 0x111, 0xa, &(0x7f0000000000), 0x4) r5 = socket(0x2, 0x1, 0x0) listen(r5, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)) program crashed: KASAN: use-after-free Write in rcu_segcblist_enqueue testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-inotify_init1-syz_mount_image$vfat-fcntl$dupfd-setsockopt$inet_mtu-socket-ioctl$ifreq_SIOCGIFINDEX_team detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x1, 0x0, 0xfffffffc}}, 0x2e) r3 = inotify_init1(0x800) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./bus\x00', 0x1204000, &(0x7f0000000340)=ANY=[@ANYRES64=0x0, @ANYRESHEX=0x0, @ANYRES16, @ANYRESDEC, @ANYRESDEC, @ANYRES16, @ANYRES32, @ANYBLOB="b0529ea9793daee9ef7ad16eb0b00b0ab3ff5f5f31c47edec125043e255d2716dca73eae9fb5", @ANYRES32, @ANYRES16=0x0], 0x2, 0x2c8, &(0x7f0000000840)="$eJzs3T9rZFUUAPDzkpmXCSmSwkoEX7GFjWGzrYVZJIqYSpnCP6CLuwtLMizMwMCqOGzlJ7Cw8HvY2Qs2fgPBwtLORQJX3p/MTCazk010Jkv4/Yrkcu4579773iMTeLw7X7zWO7r/ePDw6Te/R6eTxdp+7MezLKWU4lRqBABwIzxLKf660ud7a21ZcwIAlmvq87/9nJSN8sfmmdDbq5gaALAkH338yQd3Dw8PPiyKTkTvu2E3i/p33X/3YTyK43gQt2M7TibPAlKq2+++f3gQraK0E7d6o2G3rOx9/us4NY+qfi+2Y2d+/V5Rm6ofDVvVfx5ZFvFov5zIndiOV87Vl/0Hd+bURzePNzrNIsvxd2M7fvsyHsdx3K+eaUzG/zaP4p30/d9ff1oml/XZaNjdqPIm0vqqrw0AAAAAAAAAAAAAAAAAAAAAADfXbjG2E7d6Zajef6e7flL1757pr/bXWav66/osIq8aM/sDjVL8eLq/zu2iKFJW54/399lsxautaF3bwgEAAAAAAAAAAAAAAAAAAOAlMnjy1dG94+MH/f+l0bzkP36t/6rH2Z+KvB6LkzcuNVasN+nlXGdz9n75rDeOlIu4yuSH7SJi0Zzb5yKb5XwuPvI/KaWUZRH/7TK1X2Ss+Y33mpPX31qcXOb8/MPWm0f3sovOYef0wv003ZVHf/Bk5ppGtnjQkzORdKnbL1+QkzeLnulK2bzjbL34yWzP63rrj3qwJpJdsIr2VKTdNOJ5t1/nUvfzav7+AAAAAAAAAAAAAAAAAAAAE5OXfud0Pl1Yura0SQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAik2+/3/SiHORmcYo/qyK5+eklEbjSB79wXWvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJvv3wAAAP//8BhuSw==") r4 = fcntl$dupfd(r2, 0x406, r3) setsockopt$inet_mtu(r4, 0x111, 0xa, &(0x7f0000000000), 0x4) socket(0x2, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-inotify_init1-syz_mount_image$vfat-fcntl$dupfd-setsockopt$inet_mtu-ioctl$ifreq_SIOCGIFINDEX_team detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x1, 0x0, 0xfffffffc}}, 0x2e) r3 = inotify_init1(0x800) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./bus\x00', 0x1204000, &(0x7f0000000340)=ANY=[@ANYRES64=0x0, @ANYRESHEX=0x0, @ANYRES16, @ANYRESDEC, @ANYRESDEC, @ANYRES16, @ANYRES32, @ANYBLOB="b0529ea9793daee9ef7ad16eb0b00b0ab3ff5f5f31c47edec125043e255d2716dca73eae9fb5", @ANYRES32, @ANYRES16=0x0], 0x2, 0x2c8, &(0x7f0000000840)="$eJzs3T9rZFUUAPDzkpmXCSmSwkoEX7GFjWGzrYVZJIqYSpnCP6CLuwtLMizMwMCqOGzlJ7Cw8HvY2Qs2fgPBwtLORQJX3p/MTCazk010Jkv4/Yrkcu4579773iMTeLw7X7zWO7r/ePDw6Te/R6eTxdp+7MezLKWU4lRqBABwIzxLKf660ud7a21ZcwIAlmvq87/9nJSN8sfmmdDbq5gaALAkH338yQd3Dw8PPiyKTkTvu2E3i/p33X/3YTyK43gQt2M7TibPAlKq2+++f3gQraK0E7d6o2G3rOx9/us4NY+qfi+2Y2d+/V5Rm6ofDVvVfx5ZFvFov5zIndiOV87Vl/0Hd+bURzePNzrNIsvxd2M7fvsyHsdx3K+eaUzG/zaP4p30/d9ff1oml/XZaNjdqPIm0vqqrw0AAAAAAAAAAAAAAAAAAAAAADfXbjG2E7d6Zajef6e7flL1757pr/bXWav66/osIq8aM/sDjVL8eLq/zu2iKFJW54/399lsxautaF3bwgEAAAAAAAAAAAAAAAAAAOAlMnjy1dG94+MH/f+l0bzkP36t/6rH2Z+KvB6LkzcuNVasN+nlXGdz9n75rDeOlIu4yuSH7SJi0Zzb5yKb5XwuPvI/KaWUZRH/7TK1X2Ss+Y33mpPX31qcXOb8/MPWm0f3sovOYef0wv003ZVHf/Bk5ppGtnjQkzORdKnbL1+QkzeLnulK2bzjbL34yWzP63rrj3qwJpJdsIr2VKTdNOJ5t1/nUvfzav7+AAAAAAAAAAAAAAAAAAAAE5OXfud0Pl1Yura0SQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAik2+/3/SiHORmcYo/qyK5+eklEbjSB79wXWvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJvv3wAAAP//8BhuSw==") r4 = fcntl$dupfd(r2, 0x406, r3) setsockopt$inet_mtu(r4, 0x111, 0xa, &(0x7f0000000000), 0x4) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-inotify_init1-syz_mount_image$vfat-fcntl$dupfd-ioctl$ifreq_SIOCGIFINDEX_team detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x1, 0x0, 0xfffffffc}}, 0x2e) r3 = inotify_init1(0x800) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./bus\x00', 0x1204000, &(0x7f0000000340)=ANY=[@ANYRES64=0x0, @ANYRESHEX=0x0, @ANYRES16, @ANYRESDEC, @ANYRESDEC, @ANYRES16, @ANYRES32, @ANYBLOB="b0529ea9793daee9ef7ad16eb0b00b0ab3ff5f5f31c47edec125043e255d2716dca73eae9fb5", @ANYRES32, @ANYRES16=0x0], 0x2, 0x2c8, &(0x7f0000000840)="$eJzs3T9rZFUUAPDzkpmXCSmSwkoEX7GFjWGzrYVZJIqYSpnCP6CLuwtLMizMwMCqOGzlJ7Cw8HvY2Qs2fgPBwtLORQJX3p/MTCazk010Jkv4/Yrkcu4579773iMTeLw7X7zWO7r/ePDw6Te/R6eTxdp+7MezLKWU4lRqBABwIzxLKf660ud7a21ZcwIAlmvq87/9nJSN8sfmmdDbq5gaALAkH338yQd3Dw8PPiyKTkTvu2E3i/p33X/3YTyK43gQt2M7TibPAlKq2+++f3gQraK0E7d6o2G3rOx9/us4NY+qfi+2Y2d+/V5Rm6ofDVvVfx5ZFvFov5zIndiOV87Vl/0Hd+bURzePNzrNIsvxd2M7fvsyHsdx3K+eaUzG/zaP4p30/d9ff1oml/XZaNjdqPIm0vqqrw0AAAAAAAAAAAAAAAAAAAAAADfXbjG2E7d6Zajef6e7flL1757pr/bXWav66/osIq8aM/sDjVL8eLq/zu2iKFJW54/399lsxautaF3bwgEAAAAAAAAAAAAAAAAAAOAlMnjy1dG94+MH/f+l0bzkP36t/6rH2Z+KvB6LkzcuNVasN+nlXGdz9n75rDeOlIu4yuSH7SJi0Zzb5yKb5XwuPvI/KaWUZRH/7TK1X2Ss+Y33mpPX31qcXOb8/MPWm0f3sovOYef0wv003ZVHf/Bk5ppGtnjQkzORdKnbL1+QkzeLnulK2bzjbL34yWzP63rrj3qwJpJdsIr2VKTdNOJ5t1/nUvfzav7+AAAAAAAAAAAAAAAAAAAAE5OXfud0Pl1Yura0SQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAik2+/3/SiHORmcYo/qyK5+eklEbjSB79wXWvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJvv3wAAAP//8BhuSw==") fcntl$dupfd(r2, 0x406, r3) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-inotify_init1-syz_mount_image$vfat-ioctl$ifreq_SIOCGIFINDEX_team detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x1, 0x0, 0xfffffffc}}, 0x2e) inotify_init1(0x800) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./bus\x00', 0x1204000, &(0x7f0000000340)=ANY=[@ANYRES64=0x0, @ANYRESHEX=0x0, @ANYRES16, @ANYRESDEC, @ANYRESDEC, @ANYRES16, @ANYRES32, @ANYBLOB="b0529ea9793daee9ef7ad16eb0b00b0ab3ff5f5f31c47edec125043e255d2716dca73eae9fb5", @ANYRES32, @ANYRES16=0x0], 0x2, 0x2c8, &(0x7f0000000840)="$eJzs3T9rZFUUAPDzkpmXCSmSwkoEX7GFjWGzrYVZJIqYSpnCP6CLuwtLMizMwMCqOGzlJ7Cw8HvY2Qs2fgPBwtLORQJX3p/MTCazk010Jkv4/Yrkcu4579773iMTeLw7X7zWO7r/ePDw6Te/R6eTxdp+7MezLKWU4lRqBABwIzxLKf660ud7a21ZcwIAlmvq87/9nJSN8sfmmdDbq5gaALAkH338yQd3Dw8PPiyKTkTvu2E3i/p33X/3YTyK43gQt2M7TibPAlKq2+++f3gQraK0E7d6o2G3rOx9/us4NY+qfi+2Y2d+/V5Rm6ofDVvVfx5ZFvFov5zIndiOV87Vl/0Hd+bURzePNzrNIsvxd2M7fvsyHsdx3K+eaUzG/zaP4p30/d9ff1oml/XZaNjdqPIm0vqqrw0AAAAAAAAAAAAAAAAAAAAAADfXbjG2E7d6Zajef6e7flL1757pr/bXWav66/osIq8aM/sDjVL8eLq/zu2iKFJW54/399lsxautaF3bwgEAAAAAAAAAAAAAAAAAAOAlMnjy1dG94+MH/f+l0bzkP36t/6rH2Z+KvB6LkzcuNVasN+nlXGdz9n75rDeOlIu4yuSH7SJi0Zzb5yKb5XwuPvI/KaWUZRH/7TK1X2Ss+Y33mpPX31qcXOb8/MPWm0f3sovOYef0wv003ZVHf/Bk5ppGtnjQkzORdKnbL1+QkzeLnulK2bzjbL34yWzP63rrj3qwJpJdsIr2VKTdNOJ5t1/nUvfzav7+AAAAAAAAAAAAAAAAAAAAE5OXfud0Pl1Yura0SQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAik2+/3/SiHORmcYo/qyK5+eklEbjSB79wXWvEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgJvv3wAAAP//8BhuSw==") ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-inotify_init1-ioctl$ifreq_SIOCGIFINDEX_team detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x1, 0x0, 0xfffffffc}}, 0x2e) inotify_init1(0x800) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_team detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x1, 0x0, 0xfffffffc}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_team detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) socket$pppl2tp(0x18, 0x1, 0x1) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_team detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-ioctl$ifreq_SIOCGIFINDEX_team detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)) program did not crash testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_team detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)) program did not crash testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_team detailed listing: executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r0, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000100)) program did not crash testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_team detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000100)) program did not crash testing program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_team detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, 0x0) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session extracting C reproducer testing compiled C program (duration=31.855757862s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_team program crashed: KASAN: use-after-free Write in pppol2tp_release simplifying C reproducer testing compiled C program (duration=31.855757862s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_team program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=31.855757862s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_team program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=31.855757862s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_team program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=31.855757862s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_team program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=31.855757862s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_team program did not crash testing compiled C program (duration=31.855757862s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_team program did not crash testing program (duration=31.855757862s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_team detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release validation run: crashed=true testing program (duration=31.855757862s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_team detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release validation run: crashed=true testing program (duration=31.855757862s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_team detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release validation run: crashed=true reproducing took 28m21.75266361s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: use-after-free in atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline] BUG: KASAN: use-after-free in atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline] BUG: KASAN: use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:173 [inline] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298 Write of size 8 at addr ffff88812a4da550 by task syz.2.17/387 CPU: 0 PID: 387 Comm: syz.2.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:77 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:435 [inline] kasan_report+0x100/0x140 mm/kasan/report.c:452 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline] atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline] __mutex_trylock_fast kernel/locking/mutex.c:173 [inline] mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298 pppol2tp_release+0x178/0x2b0 net/l2tp/l2tp_ppp.c:442 __sock_release net/socket.c:597 [inline] sock_close+0xb8/0x200 net/socket.c:1287 __fput+0x2dc/0x730 fs/file_table.c:281 ____fput+0x15/0x20 fs/file_table.c:314 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7fbe0687f0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcbcbecb88 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffcbcbecc70 RCX: 00007fbe0687f0d9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00000000000068c1 R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b32c20000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fbe06b06fac R14: 00007fbe06b06fa8 R15: 00007fbe06b06fa0 Allocated by task 387: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:430 [inline] ____kasan_kmalloc mm/kasan/common.c:509 [inline] __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:518 kasan_kmalloc include/linux/kasan.h:254 [inline] __kmalloc+0x19f/0x330 mm/slub.c:4038 kmalloc include/linux/slab.h:560 [inline] kzalloc include/linux/slab.h:667 [inline] l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772 __sys_connect_file net/socket.c:1867 [inline] __sys_connect+0x3ce/0x450 net/socket.c:1884 __do_sys_connect net/socket.c:1894 [inline] __se_sys_connect net/socket.c:1891 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:1891 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xcb Freed by task 387: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4a/0x70 mm/kasan/common.c:45 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:362 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370 kasan_slab_free include/linux/kasan.h:220 [inline] slab_free_hook mm/slub.c:1600 [inline] slab_free_freelist_hook+0xc5/0x190 mm/slub.c:1626 slab_free mm/slub.c:3208 [inline] kfree+0xc0/0x270 mm/slub.c:4196 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline] l2tp_session_put+0xb2/0x1a0 net/l2tp/l2tp_core.c:193 l2tp_session_delete+0x3a9/0x4a0 net/l2tp/l2tp_core.c:1589 pppol2tp_release+0x169/0x2b0 net/l2tp/l2tp_ppp.c:439 __sock_release net/socket.c:597 [inline] sock_close+0xb8/0x200 net/socket.c:1287 __fput+0x2dc/0x730 fs/file_table.c:281 ____fput+0x15/0x20 fs/file_table.c:314 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb The buggy address belongs to the object at ffff88812a4da400 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 336 bytes inside of 512-byte region [ffff88812a4da400, ffff88812a4da600) The buggy address belongs to the page: page:ffffea0004a93600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12a4d8 head:ffffea0004a93600 order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head) raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x152a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 330, ts 26828844411, free_ts 26825761417 set_page_owner include/linux/page_owner.h:35 [inline] post_alloc_hook mm/page_alloc.c:2456 [inline] prep_new_page+0x176/0x190 mm/page_alloc.c:2462 get_page_from_freelist+0x225f/0x23f0 mm/page_alloc.c:4254 __alloc_pages_nodemask+0x29a/0x640 mm/page_alloc.c:5384 alloc_slab_page mm/slub.c:-1 [inline] allocate_slab mm/slub.c:1813 [inline] new_slab+0x84/0x3f0 mm/slub.c:1874 new_slab_objects mm/slub.c:2632 [inline] ___slab_alloc+0x2f8/0x4c0 mm/slub.c:2796 __slab_alloc+0x63/0xa0 mm/slub.c:2836 slab_alloc_node mm/slub.c:2918 [inline] slab_alloc mm/slub.c:2960 [inline] __kmalloc+0x1f9/0x330 mm/slub.c:4034 kmalloc include/linux/slab.h:560 [inline] kzalloc include/linux/slab.h:667 [inline] neigh_alloc net/core/neighbour.c:439 [inline] ___neigh_create+0x6ec/0x1a70 net/core/neighbour.c:592 __neigh_create+0x31/0x40 net/core/neighbour.c:680 ip6_finish_output2+0x8fe/0x1540 net/ipv6/ip6_output.c:127 __ip6_finish_output+0x5fd/0x790 net/ipv6/ip6_output.c:201 ip6_finish_output+0x33/0x1e0 net/ipv6/ip6_output.c:211 NF_HOOK_COND include/linux/netfilter.h:288 [inline] ip6_output+0x1fa/0x420 net/ipv6/ip6_output.c:234 dst_output include/net/dst.h:451 [inline] NF_HOOK include/linux/netfilter.h:299 [inline] mld_sendpack+0x61e/0xb00 net/ipv6/mcast.c:1676 mld_send_cr net/ipv6/mcast.c:1972 [inline] mld_ifc_timer_expire+0x862/0xc60 net/ipv6/mcast.c:2471 call_timer_fn+0x38/0x290 kernel/time/timer.c:1450 page last free stack trace: reset_page_owner include/linux/page_owner.h:28 [inline] free_pages_prepare mm/page_alloc.c:1349 [inline] __free_pages_ok+0x80b/0x830 mm/page_alloc.c:1629 free_the_page mm/page_alloc.c:5445 [inline] __free_pages+0xd8/0x390 mm/page_alloc.c:5454 kfree+0x1e4/0x270 mm/slub.c:4193 tipc_nametbl_stop+0x120b/0x1270 net/tipc/name_table.c:917 tipc_exit_net+0x99/0x150 net/tipc/core.c:118 ops_exit_list net/core/net_namespace.c:185 [inline] cleanup_net+0x589/0xb80 net/core/net_namespace.c:609 process_one_work+0x6fd/0xbc0 kernel/workqueue.c:2301 worker_thread+0xa8e/0x13c0 kernel/workqueue.c:2447 kthread+0x324/0x3b0 kernel/kthread.c:313 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 Memory state around the buggy address: ffff88812a4da400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88812a4da480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88812a4da500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88812a4da580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88812a4da600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: use-after-free in atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline] BUG: KASAN: use-after-free in atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline] BUG: KASAN: use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:173 [inline] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298 Write of size 8 at addr ffff88812a4da550 by task syz.2.17/387 CPU: 0 PID: 387 Comm: syz.2.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:77 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:435 [inline] kasan_report+0x100/0x140 mm/kasan/report.c:452 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline] atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline] __mutex_trylock_fast kernel/locking/mutex.c:173 [inline] mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298 pppol2tp_release+0x178/0x2b0 net/l2tp/l2tp_ppp.c:442 __sock_release net/socket.c:597 [inline] sock_close+0xb8/0x200 net/socket.c:1287 __fput+0x2dc/0x730 fs/file_table.c:281 ____fput+0x15/0x20 fs/file_table.c:314 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7fbe0687f0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcbcbecb88 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffcbcbecc70 RCX: 00007fbe0687f0d9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00000000000068c1 R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b32c20000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fbe06b06fac R14: 00007fbe06b06fa8 R15: 00007fbe06b06fa0 Allocated by task 387: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:430 [inline] ____kasan_kmalloc mm/kasan/common.c:509 [inline] __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:518 kasan_kmalloc include/linux/kasan.h:254 [inline] __kmalloc+0x19f/0x330 mm/slub.c:4038 kmalloc include/linux/slab.h:560 [inline] kzalloc include/linux/slab.h:667 [inline] l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772 __sys_connect_file net/socket.c:1867 [inline] __sys_connect+0x3ce/0x450 net/socket.c:1884 __do_sys_connect net/socket.c:1894 [inline] __se_sys_connect net/socket.c:1891 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:1891 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xcb Freed by task 387: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4a/0x70 mm/kasan/common.c:45 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:362 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370 kasan_slab_free include/linux/kasan.h:220 [inline] slab_free_hook mm/slub.c:1600 [inline] slab_free_freelist_hook+0xc5/0x190 mm/slub.c:1626 slab_free mm/slub.c:3208 [inline] kfree+0xc0/0x270 mm/slub.c:4196 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline] l2tp_session_put+0xb2/0x1a0 net/l2tp/l2tp_core.c:193 l2tp_session_delete+0x3a9/0x4a0 net/l2tp/l2tp_core.c:1589 pppol2tp_release+0x169/0x2b0 net/l2tp/l2tp_ppp.c:439 __sock_release net/socket.c:597 [inline] sock_close+0xb8/0x200 net/socket.c:1287 __fput+0x2dc/0x730 fs/file_table.c:281 ____fput+0x15/0x20 fs/file_table.c:314 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb The buggy address belongs to the object at ffff88812a4da400 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 336 bytes inside of 512-byte region [ffff88812a4da400, ffff88812a4da600) The buggy address belongs to the page: page:ffffea0004a93600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12a4d8 head:ffffea0004a93600 order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head) raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x152a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 330, ts 26828844411, free_ts 26825761417 set_page_owner include/linux/page_owner.h:35 [inline] post_alloc_hook mm/page_alloc.c:2456 [inline] prep_new_page+0x176/0x190 mm/page_alloc.c:2462 get_page_from_freelist+0x225f/0x23f0 mm/page_alloc.c:4254 __alloc_pages_nodemask+0x29a/0x640 mm/page_alloc.c:5384 alloc_slab_page mm/slub.c:-1 [inline] allocate_slab mm/slub.c:1813 [inline] new_slab+0x84/0x3f0 mm/slub.c:1874 new_slab_objects mm/slub.c:2632 [inline] ___slab_alloc+0x2f8/0x4c0 mm/slub.c:2796 __slab_alloc+0x63/0xa0 mm/slub.c:2836 slab_alloc_node mm/slub.c:2918 [inline] slab_alloc mm/slub.c:2960 [inline] __kmalloc+0x1f9/0x330 mm/slub.c:4034 kmalloc include/linux/slab.h:560 [inline] kzalloc include/linux/slab.h:667 [inline] neigh_alloc net/core/neighbour.c:439 [inline] ___neigh_create+0x6ec/0x1a70 net/core/neighbour.c:592 __neigh_create+0x31/0x40 net/core/neighbour.c:680 ip6_finish_output2+0x8fe/0x1540 net/ipv6/ip6_output.c:127 __ip6_finish_output+0x5fd/0x790 net/ipv6/ip6_output.c:201 ip6_finish_output+0x33/0x1e0 net/ipv6/ip6_output.c:211 NF_HOOK_COND include/linux/netfilter.h:288 [inline] ip6_output+0x1fa/0x420 net/ipv6/ip6_output.c:234 dst_output include/net/dst.h:451 [inline] NF_HOOK include/linux/netfilter.h:299 [inline] mld_sendpack+0x61e/0xb00 net/ipv6/mcast.c:1676 mld_send_cr net/ipv6/mcast.c:1972 [inline] mld_ifc_timer_expire+0x862/0xc60 net/ipv6/mcast.c:2471 call_timer_fn+0x38/0x290 kernel/time/timer.c:1450 page last free stack trace: reset_page_owner include/linux/page_owner.h:28 [inline] free_pages_prepare mm/page_alloc.c:1349 [inline] __free_pages_ok+0x80b/0x830 mm/page_alloc.c:1629 free_the_page mm/page_alloc.c:5445 [inline] __free_pages+0xd8/0x390 mm/page_alloc.c:5454 kfree+0x1e4/0x270 mm/slub.c:4193 tipc_nametbl_stop+0x120b/0x1270 net/tipc/name_table.c:917 tipc_exit_net+0x99/0x150 net/tipc/core.c:118 ops_exit_list net/core/net_namespace.c:185 [inline] cleanup_net+0x589/0xb80 net/core/net_namespace.c:609 process_one_work+0x6fd/0xbc0 kernel/workqueue.c:2301 worker_thread+0xa8e/0x13c0 kernel/workqueue.c:2447 kthread+0x324/0x3b0 kernel/kthread.c:313 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 Memory state around the buggy address: ffff88812a4da400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88812a4da480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88812a4da500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88812a4da580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88812a4da600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================