Extracting prog: 2m32.16210817s Minimizing prog: 28m54.129465728s Simplifying prog options: 0s Extracting C: 1m7.031398181s Simplifying C: 4m59.35648123s extracting reproducer from 66 programs testing a last program of every proc single: executing 16 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$ext4-fcntl$getownex-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-mmap-socketpair$unix-connect$unix-recvmmsg-getcwd-setsockopt$SO_TIMESTAMPING-setresuid-capset-openat$procfs-read$FUSE-mount-syz_open_procfs-read$FUSE detailed listing: executing program 0: r0 = syz_mount_image$ext4(&(0x7f00000005c0)='ext4\x00', &(0x7f0000000340)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x10c0840, &(0x7f0000000040), 0x1, 0x5d2, &(0x7f0000001240)="$eJzs3W+IHGcdB/Df7N1e8+dq0tiqrbE5DbWB0NvL5RIS8YUl/qk1qRXFF6EQjtx2L2Tv9sxtoLcVbPFNURDBNyIIFfvCimggbyqlti9afKOg1D9UagyoIELRSkEEdWX2T7o2kyZ0726am88H5u6ZZ2bvefaW787szjMzARTWRPojiRiPiPMRsa07+/8rTHR/tfafm0+nJNrtz/4t6aw3t//cfH/V/uO2pj9GIzZFxI4jSewuX97u8krr9Gy9Xj3Tm680F5Yqyyutu04tzNaqterigUMzh6cPzhyaWb3nOvXzLbf8+Y77Lj7x/D///e3fHvxh2t/x3rLB57FaJmKi9z8px00D9aNJxL2r3VhORrovddwxUJeM5tghrlm7veMH6ev3zojY3cn/thiJ7ov30tMP/GNb/PqevPsIrJ12X/biV9vAhlXq7AMnpcmI6JZLpcnJ7j78zbGlVG8sN/c+2Di7ONfdV94e5dKDp+rVqd5nhe1RTtL5fZ3y6/PTb5jfH9HZB35sZHNnfvJkoz633m92QMd4xIXzXzg5tvUN+f/LSDf/wMaV5v9XLzz1bFp+bSTv3gDrKc3/919b+FTIPxSO/ENxDZ//jIP6wHXB9h+KS/5hw7tisuUfikv+objkH4pL/qG45B+Kq5//+48di/uPHWu3eue/LzZqp07PLx2enppcOHty8mTjzNJkrdGodc7YWbj63603Gkv7puPsQ5VmdblZWV5pnVhonF1snuic13+iatQAvD0cv7jp3pt2PfdSEhGPfGhzZ0qN9ZbLKmxs7XYSeZ+DDOTDR38oLpdqg+LyGR9IrrJ805UW1Fe/L8D6KOXdASA3d97q+B8Ule//obh8/w/FdY37+GNr3Q8gP77/h+Lx/T8U1/gV7v9148C9u6Yi4h0R8bOR8g39e30B16/xiAsXvvv5yqX7cL+lQjmGeriCgsLbtJD3OxSw1l4Pfd49AfIyt//cfH9arzafqa1XS0CWV+7uDgJKc9/qTd0lo5eODZTXaJzQy49FTMSPf//4nvmRdIre+9AaNAVkeOTRiHhP1vY/6Rwb2N5bb0d3tbg5Im6JiHdFxLuHbPubn0nz/0J1sE7+Yf1ca/5vjYjbI+K2iHhvROyMiPcN2fYvz6f5/83mwTr5h2L44vN59wDIyyefyrsHQF6OG2MAhfW9h/PuAZCXp3+Udw+AvHztxbx7AMX23N0RMZV1/K/UOd7fV+5dBOSG3rUANkfElojY2juH8MbeOYLbBo4ZXs2JT0dMxO0/Gaxz/A/WT3/8X+uy8X+lS+P/RiJi1xBtPPPh8a9m1c/uTPP/xMP98X/plLbfHwsIrK1XHo24LTP/yaUxv0mkOY14/1tsY+JLF5/Mqn/xvvTvln8h/5CP9nciPhjZ+e9LS5XmwlJleaV1V+c+3rXq4oFDM4enD84cmql0LhFS6V8oJMPRv7+6N6v+5ek0/986IP+Qj3T7v+UK+R/c///AEG0c+cZXjmfVj/8xzf/OZ988/6W/jiWf68z3L0L60GyzeWZfxFhy9PL66SE6ChtcPyP9DKX537M7+/P/jt5j0u3/kYj4aLq/EBH/iYj/RsTHIuLjEfGJiLjnTdr8+p21i1n1f3gyzf/jp23/IR9p/ueusv1Pf/9riDb27vnpl7PqP7Irzf/k7/509IHRdJJ/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgNW3vNI6PVvfFGe6hXp1DQp5P0cAAAAAAAAoiv8FAAD///LbM1c=") fcntl$getownex(r0, 0x10, &(0x7f0000000000)={0x0, 0x0}) prlimit64(r1, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) connect$unix(r3, &(0x7f0000019080)=@file={0x0, './file1\x00'}, 0x6e) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getcwd(0x0, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, 0x0, 0x0) setresuid(0x0, 0xee00, 0x0) capset(&(0x7f0000000500)={0x20080522}, &(0x7f0000000200)={0x200002, 0x200003, 0x803, 0x4, 0x7}) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000002280)='/proc/diskstats\x00', 0x0, 0x0) read$FUSE(r4, &(0x7f0000000200)={0x2020}, 0x2020) mount(&(0x7f0000000300), &(0x7f00000000c0)='.\x00', &(0x7f0000000180)='tmpfs\x00', 0x2200cd0, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000700)='mounts\x00') read$FUSE(r5, &(0x7f00000047c0)={0x2020}, 0x2020) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-mkdirat-renameat2 detailed listing: executing program 0: seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./file7\x00', 0x1c0) renameat2(0xffffffffffffff9c, &(0x7f0000000140)='./file7\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-unshare-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$MAP_CREATE_TAIL_CALL-bpf$MAP_UPDATE_ELEM_TAIL_CALL-getsockopt$sock_buf-getsockopt$sock_buf-syz_mount_image$ext4-creat-creat-write$binfmt_elf64-openat-openat-fallocate-ioctl$EXT4_IOC_MOVE_EXT-memfd_create-mprotect-syz_open_dev$loop-ioctl$IOC_PR_REGISTER-ioctl$IOC_PR_REGISTER-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE-sendmsg$NL80211_CMD_DEL_PMKSA-ioctl$sock_SIOCBRADDBR-ioctl$sock_SIOCBRADDBR detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) unshare(0x2040400) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000280), &(0x7f0000000180)=r2}, 0x20) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) (async) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000380), 0x1, 0x50f, &(0x7f0000000fc0)="$eJzs3UFsI1cZAODfTpw42bRJSw8FQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZELN849ceeC4MalHJAWiEAbJA5GM54k3qy9sTaJncbfJ41m3ryx//9tMu+tX2y/AEbWzYjYj4iJiPggImaz87lsi3fbW3Ldo4MHK4cHD1Zy0Wq9/89cWp+ci47HJG5kz1mMiB9+N+InuSfjNnb3Npar1cp2Vp5v1rbmG7t7d9Zry2uVtcpmuby0uLTw9t23yhfW1ldrE9nRVz774/43f5akNZOd6WzHRWo3vXAcJzEeEd+/jGBDMJa1Z2LYifBM8hHxYkS8lt7/szGW/jQBgOus1ZqN1mxnGQC47vLpHFguX8rmAmYiny+V2nN4L8V0vlpvNG/fr+9srrbnyuaikL+/Xq0sZHOFc1HIJeXF9PikXD5VvhsRL0TELyan0nJppV5dHeZ/fABghN04Nf7/Z7I9/gMA11xx2AkAAANn/AeA0WP8B4DRY/wHgNHTHv+nhp0GADBAXv8DwOgx/gPASPnBe+8lW+sw+/7r1Q93dzbqH95ZrTQ2SrWdldJKfXurtFavr6Xf2VM76/mq9frW4pux89Hct7YazfnG7t69Wn1ns3kv/V7ve5VCetX+AFoGAPTywquf/iWXjMjvTKVbdKzlUBhqZsBlyw87AWBoxoadADA0VvuC0XWO1/imB+DzrsvavN0Uu31AqNVqtS4hJWAwbn3R/D+Mqo75f+8ChhFj/h9Gl/l/GF2tVq7fNf+j3wsBgKvNHD/Q420AL2b732Z/HPjx6ukrPrnMrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBqO1r/t5StBT4T+XypFPFcRMxFIXd/vVpZiIjnI+LPk4XJpLw45JwBgPPK/z2Xrf91a/aNmceqXrlxfDgRET/91fu//Gi52dz+U8RE7l+TR+ebn2Tny4PPHgA429E4ne47Xsg/OniwcrQNMp+H34mIYjv+4cFEHB7HH4/xdF+MQkRM/zuXldtyHXMX57H/cUS83K39uZhJ50DaK5+ejp/Efm6g8fOPxc+nde198m/xhQvIBUbNp0n/8263+y8fN9N95/1/slp6Me2hzi/r/5KnWjlM+8CT+Ef931iP/u9mvzHe/MP32kdT2YNPVnt++HHEl8YjjmIfdvQ/R/FzPeK/0Wf8v375ldd61bV+HXErusfvjDXfrG3NN3b37qzXltcqa5XNcnlpcWnh7btvlefTOer53qPBP965/XyvuqT90z3iF89o/9f6bP9v/vfBj776lPjfeL1b/Hy89JT4yW/i1/uMvzz9+2KvuiT+ao/2n/Xzv91n/M/+tvfEsuEAwPA0dvc2lqvVyvaIHvzuaqQxYgfj8YwPT35lh518r4Nv93/xy+eKNRHdq37+evuePlXVaj1TrF49xkXMugFXwfFNHxH/HXYyAAAAAAAAAAAAAABAV4P4dNSw2wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD19f8AAAD//+7Mzkc=") creat(&(0x7f0000000080)='./file1\x00', 0x8) (async) r4 = creat(&(0x7f0000000080)='./file1\x00', 0x8) write$binfmt_elf64(r4, &(0x7f0000002e40)=ANY=[], 0x78) r5 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0xa0c42, 0x100) openat(0xffffffffffffff9c, 0x0, 0x101042, 0x15) fallocate(0xffffffffffffffff, 0x10, 0x6, 0x7000000) ioctl$EXT4_IOC_MOVE_EXT(r5, 0xc028660f, &(0x7f0000000040)={0xc, r4, 0x2, 0x0, 0x0, 0xfffffffffe000001}) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r6 = syz_open_dev$loop(&(0x7f0000000000), 0x5, 0x400) ioctl$IOC_PR_REGISTER(r6, 0x401870c8, 0x0) (async) ioctl$IOC_PR_REGISTER(r6, 0x401870c8, 0x0) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) (async) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) sendmsg$NL80211_CMD_DEL_PMKSA(r7, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x34, 0x0, 0x300, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xfffffff7, 0x7}}}}, [@NL80211_ATTR_PMKID={0x14, 0x55, "711daf8362c3d634bf6f8744542d5502"}]}, 0x34}, 0x1, 0x0, 0x0, 0x404c810}, 0x880) ioctl$sock_SIOCBRADDBR(r0, 0x89a0, &(0x7f0000000440)='veth0_to_team\x00') (async) ioctl$sock_SIOCBRADDBR(r0, 0x89a0, &(0x7f0000000440)='veth0_to_team\x00') program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session single: successfully extracted reproducer found reproducer with 29 syscalls minimizing guilty program testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-unshare-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$MAP_CREATE_TAIL_CALL-bpf$MAP_UPDATE_ELEM_TAIL_CALL-getsockopt$sock_buf-getsockopt$sock_buf-syz_mount_image$ext4-creat-creat-write$binfmt_elf64-openat-openat-fallocate-ioctl$EXT4_IOC_MOVE_EXT-memfd_create-mprotect-syz_open_dev$loop-ioctl$IOC_PR_REGISTER-ioctl$IOC_PR_REGISTER-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE-sendmsg$NL80211_CMD_DEL_PMKSA-ioctl$sock_SIOCBRADDBR detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) unshare(0x2040400) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000280), &(0x7f0000000180)=r2}, 0x20) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) (async) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000380), 0x1, 0x50f, &(0x7f0000000fc0)="$eJzs3UFsI1cZAODfTpw42bRJSw8FQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZELN849ceeC4MalHJAWiEAbJA5GM54k3qy9sTaJncbfJ41m3ryx//9tMu+tX2y/AEbWzYjYj4iJiPggImaz87lsi3fbW3Ldo4MHK4cHD1Zy0Wq9/89cWp+ci47HJG5kz1mMiB9+N+InuSfjNnb3Npar1cp2Vp5v1rbmG7t7d9Zry2uVtcpmuby0uLTw9t23yhfW1ldrE9nRVz774/43f5akNZOd6WzHRWo3vXAcJzEeEd+/jGBDMJa1Z2LYifBM8hHxYkS8lt7/szGW/jQBgOus1ZqN1mxnGQC47vLpHFguX8rmAmYiny+V2nN4L8V0vlpvNG/fr+9srrbnyuaikL+/Xq0sZHOFc1HIJeXF9PikXD5VvhsRL0TELyan0nJppV5dHeZ/fABghN04Nf7/Z7I9/gMA11xx2AkAAANn/AeA0WP8B4DRY/wHgNHTHv+nhp0GADBAXv8DwOgx/gPASPnBe+8lW+sw+/7r1Q93dzbqH95ZrTQ2SrWdldJKfXurtFavr6Xf2VM76/mq9frW4pux89Hct7YazfnG7t69Wn1ns3kv/V7ve5VCetX+AFoGAPTywquf/iWXjMjvTKVbdKzlUBhqZsBlyw87AWBoxoadADA0VvuC0XWO1/imB+DzrsvavN0Uu31AqNVqtS4hJWAwbn3R/D+Mqo75f+8ChhFj/h9Gl/l/GF2tVq7fNf+j3wsBgKvNHD/Q420AL2b732Z/HPjx6ukrPrnMrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBqO1r/t5StBT4T+XypFPFcRMxFIXd/vVpZiIjnI+LPk4XJpLw45JwBgPPK/z2Xrf91a/aNmceqXrlxfDgRET/91fu//Gi52dz+U8RE7l+TR+ebn2Tny4PPHgA429E4ne47Xsg/OniwcrQNMp+H34mIYjv+4cFEHB7HH4/xdF+MQkRM/zuXldtyHXMX57H/cUS83K39uZhJ50DaK5+ejp/Efm6g8fOPxc+nde198m/xhQvIBUbNp0n/8263+y8fN9N95/1/slp6Me2hzi/r/5KnWjlM+8CT+Ef931iP/u9mvzHe/MP32kdT2YNPVnt++HHEl8YjjmIfdvQ/R/FzPeK/0Wf8v375ldd61bV+HXErusfvjDXfrG3NN3b37qzXltcqa5XNcnlpcWnh7btvlefTOer53qPBP965/XyvuqT90z3iF89o/9f6bP9v/vfBj776lPjfeL1b/Hy89JT4yW/i1/uMvzz9+2KvuiT+ao/2n/Xzv91n/M/+tvfEsuEAwPA0dvc2lqvVyvaIHvzuaqQxYgfj8YwPT35lh518r4Nv93/xy+eKNRHdq37+evuePlXVaj1TrF49xkXMugFXwfFNHxH/HXYyAAAAAAAAAAAAAABAV4P4dNSw2wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD19f8AAAD//+7Mzkc=") creat(&(0x7f0000000080)='./file1\x00', 0x8) (async) r4 = creat(&(0x7f0000000080)='./file1\x00', 0x8) write$binfmt_elf64(r4, &(0x7f0000002e40)=ANY=[], 0x78) r5 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0xa0c42, 0x100) openat(0xffffffffffffff9c, 0x0, 0x101042, 0x15) fallocate(0xffffffffffffffff, 0x10, 0x6, 0x7000000) ioctl$EXT4_IOC_MOVE_EXT(r5, 0xc028660f, &(0x7f0000000040)={0xc, r4, 0x2, 0x0, 0x0, 0xfffffffffe000001}) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r6 = syz_open_dev$loop(&(0x7f0000000000), 0x5, 0x400) ioctl$IOC_PR_REGISTER(r6, 0x401870c8, 0x0) (async) ioctl$IOC_PR_REGISTER(r6, 0x401870c8, 0x0) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) (async) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) sendmsg$NL80211_CMD_DEL_PMKSA(r7, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x34, 0x0, 0x300, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xfffffff7, 0x7}}}}, [@NL80211_ATTR_PMKID={0x14, 0x55, "711daf8362c3d634bf6f8744542d5502"}]}, 0x34}, 0x1, 0x0, 0x0, 0x404c810}, 0x880) ioctl$sock_SIOCBRADDBR(r0, 0x89a0, &(0x7f0000000440)='veth0_to_team\x00') (async) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-unshare-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$MAP_CREATE_TAIL_CALL-bpf$MAP_UPDATE_ELEM_TAIL_CALL-getsockopt$sock_buf-getsockopt$sock_buf-syz_mount_image$ext4-creat-creat-write$binfmt_elf64-openat-openat-fallocate-ioctl$EXT4_IOC_MOVE_EXT-memfd_create-mprotect-syz_open_dev$loop-ioctl$IOC_PR_REGISTER-ioctl$IOC_PR_REGISTER-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE-sendmsg$NL80211_CMD_DEL_PMKSA detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) unshare(0x2040400) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000280), &(0x7f0000000180)=r2}, 0x20) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) (async) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000380), 0x1, 0x50f, &(0x7f0000000fc0)="$eJzs3UFsI1cZAODfTpw42bRJSw8FQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZELN849ceeC4MalHJAWiEAbJA5GM54k3qy9sTaJncbfJ41m3ryx//9tMu+tX2y/AEbWzYjYj4iJiPggImaz87lsi3fbW3Ldo4MHK4cHD1Zy0Wq9/89cWp+ci47HJG5kz1mMiB9+N+InuSfjNnb3Npar1cp2Vp5v1rbmG7t7d9Zry2uVtcpmuby0uLTw9t23yhfW1ldrE9nRVz774/43f5akNZOd6WzHRWo3vXAcJzEeEd+/jGBDMJa1Z2LYifBM8hHxYkS8lt7/szGW/jQBgOus1ZqN1mxnGQC47vLpHFguX8rmAmYiny+V2nN4L8V0vlpvNG/fr+9srrbnyuaikL+/Xq0sZHOFc1HIJeXF9PikXD5VvhsRL0TELyan0nJppV5dHeZ/fABghN04Nf7/Z7I9/gMA11xx2AkAAANn/AeA0WP8B4DRY/wHgNHTHv+nhp0GADBAXv8DwOgx/gPASPnBe+8lW+sw+/7r1Q93dzbqH95ZrTQ2SrWdldJKfXurtFavr6Xf2VM76/mq9frW4pux89Hct7YazfnG7t69Wn1ns3kv/V7ve5VCetX+AFoGAPTywquf/iWXjMjvTKVbdKzlUBhqZsBlyw87AWBoxoadADA0VvuC0XWO1/imB+DzrsvavN0Uu31AqNVqtS4hJWAwbn3R/D+Mqo75f+8ChhFj/h9Gl/l/GF2tVq7fNf+j3wsBgKvNHD/Q420AL2b732Z/HPjx6ukrPrnMrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBqO1r/t5StBT4T+XypFPFcRMxFIXd/vVpZiIjnI+LPk4XJpLw45JwBgPPK/z2Xrf91a/aNmceqXrlxfDgRET/91fu//Gi52dz+U8RE7l+TR+ebn2Tny4PPHgA429E4ne47Xsg/OniwcrQNMp+H34mIYjv+4cFEHB7HH4/xdF+MQkRM/zuXldtyHXMX57H/cUS83K39uZhJ50DaK5+ejp/Efm6g8fOPxc+nde198m/xhQvIBUbNp0n/8263+y8fN9N95/1/slp6Me2hzi/r/5KnWjlM+8CT+Ef931iP/u9mvzHe/MP32kdT2YNPVnt++HHEl8YjjmIfdvQ/R/FzPeK/0Wf8v375ldd61bV+HXErusfvjDXfrG3NN3b37qzXltcqa5XNcnlpcWnh7btvlefTOer53qPBP965/XyvuqT90z3iF89o/9f6bP9v/vfBj776lPjfeL1b/Hy89JT4yW/i1/uMvzz9+2KvuiT+ao/2n/Xzv91n/M/+tvfEsuEAwPA0dvc2lqvVyvaIHvzuaqQxYgfj8YwPT35lh518r4Nv93/xy+eKNRHdq37+evuePlXVaj1TrF49xkXMugFXwfFNHxH/HXYyAAAAAAAAAAAAAABAV4P4dNSw2wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD19f8AAAD//+7Mzkc=") creat(&(0x7f0000000080)='./file1\x00', 0x8) (async) r4 = creat(&(0x7f0000000080)='./file1\x00', 0x8) write$binfmt_elf64(r4, &(0x7f0000002e40)=ANY=[], 0x78) r5 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0xa0c42, 0x100) openat(0xffffffffffffff9c, 0x0, 0x101042, 0x15) fallocate(0xffffffffffffffff, 0x10, 0x6, 0x7000000) ioctl$EXT4_IOC_MOVE_EXT(r5, 0xc028660f, &(0x7f0000000040)={0xc, r4, 0x2, 0x0, 0x0, 0xfffffffffe000001}) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r6 = syz_open_dev$loop(&(0x7f0000000000), 0x5, 0x400) ioctl$IOC_PR_REGISTER(r6, 0x401870c8, 0x0) (async) ioctl$IOC_PR_REGISTER(r6, 0x401870c8, 0x0) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) (async) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) sendmsg$NL80211_CMD_DEL_PMKSA(r7, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x34, 0x0, 0x300, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xfffffff7, 0x7}}}}, [@NL80211_ATTR_PMKID={0x14, 0x55, "711daf8362c3d634bf6f8744542d5502"}]}, 0x34}, 0x1, 0x0, 0x0, 0x404c810}, 0x880) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-unshare-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$MAP_CREATE_TAIL_CALL-bpf$MAP_UPDATE_ELEM_TAIL_CALL-getsockopt$sock_buf-getsockopt$sock_buf-syz_mount_image$ext4-creat-creat-write$binfmt_elf64-openat-openat-fallocate-ioctl$EXT4_IOC_MOVE_EXT-memfd_create-mprotect-syz_open_dev$loop-ioctl$IOC_PR_REGISTER-ioctl$IOC_PR_REGISTER-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) unshare(0x2040400) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000280), &(0x7f0000000180)=r2}, 0x20) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) (async) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000380), 0x1, 0x50f, &(0x7f0000000fc0)="$eJzs3UFsI1cZAODfTpw42bRJSw8FQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZELN849ceeC4MalHJAWiEAbJA5GM54k3qy9sTaJncbfJ41m3ryx//9tMu+tX2y/AEbWzYjYj4iJiPggImaz87lsi3fbW3Ldo4MHK4cHD1Zy0Wq9/89cWp+ci47HJG5kz1mMiB9+N+InuSfjNnb3Npar1cp2Vp5v1rbmG7t7d9Zry2uVtcpmuby0uLTw9t23yhfW1ldrE9nRVz774/43f5akNZOd6WzHRWo3vXAcJzEeEd+/jGBDMJa1Z2LYifBM8hHxYkS8lt7/szGW/jQBgOus1ZqN1mxnGQC47vLpHFguX8rmAmYiny+V2nN4L8V0vlpvNG/fr+9srrbnyuaikL+/Xq0sZHOFc1HIJeXF9PikXD5VvhsRL0TELyan0nJppV5dHeZ/fABghN04Nf7/Z7I9/gMA11xx2AkAAANn/AeA0WP8B4DRY/wHgNHTHv+nhp0GADBAXv8DwOgx/gPASPnBe+8lW+sw+/7r1Q93dzbqH95ZrTQ2SrWdldJKfXurtFavr6Xf2VM76/mq9frW4pux89Hct7YazfnG7t69Wn1ns3kv/V7ve5VCetX+AFoGAPTywquf/iWXjMjvTKVbdKzlUBhqZsBlyw87AWBoxoadADA0VvuC0XWO1/imB+DzrsvavN0Uu31AqNVqtS4hJWAwbn3R/D+Mqo75f+8ChhFj/h9Gl/l/GF2tVq7fNf+j3wsBgKvNHD/Q420AL2b732Z/HPjx6ukrPrnMrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBqO1r/t5StBT4T+XypFPFcRMxFIXd/vVpZiIjnI+LPk4XJpLw45JwBgPPK/z2Xrf91a/aNmceqXrlxfDgRET/91fu//Gi52dz+U8RE7l+TR+ebn2Tny4PPHgA429E4ne47Xsg/OniwcrQNMp+H34mIYjv+4cFEHB7HH4/xdF+MQkRM/zuXldtyHXMX57H/cUS83K39uZhJ50DaK5+ejp/Efm6g8fOPxc+nde198m/xhQvIBUbNp0n/8263+y8fN9N95/1/slp6Me2hzi/r/5KnWjlM+8CT+Ef931iP/u9mvzHe/MP32kdT2YNPVnt++HHEl8YjjmIfdvQ/R/FzPeK/0Wf8v375ldd61bV+HXErusfvjDXfrG3NN3b37qzXltcqa5XNcnlpcWnh7btvlefTOer53qPBP965/XyvuqT90z3iF89o/9f6bP9v/vfBj776lPjfeL1b/Hy89JT4yW/i1/uMvzz9+2KvuiT+ao/2n/Xzv91n/M/+tvfEsuEAwPA0dvc2lqvVyvaIHvzuaqQxYgfj8YwPT35lh518r4Nv93/xy+eKNRHdq37+evuePlXVaj1TrF49xkXMugFXwfFNHxH/HXYyAAAAAAAAAAAAAABAV4P4dNSw2wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD19f8AAAD//+7Mzkc=") creat(&(0x7f0000000080)='./file1\x00', 0x8) (async) r4 = creat(&(0x7f0000000080)='./file1\x00', 0x8) write$binfmt_elf64(r4, &(0x7f0000002e40)=ANY=[], 0x78) r5 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0xa0c42, 0x100) openat(0xffffffffffffff9c, 0x0, 0x101042, 0x15) fallocate(0xffffffffffffffff, 0x10, 0x6, 0x7000000) ioctl$EXT4_IOC_MOVE_EXT(r5, 0xc028660f, &(0x7f0000000040)={0xc, r4, 0x2, 0x0, 0x0, 0xfffffffffe000001}) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r6 = syz_open_dev$loop(&(0x7f0000000000), 0x5, 0x400) ioctl$IOC_PR_REGISTER(r6, 0x401870c8, 0x0) (async) ioctl$IOC_PR_REGISTER(r6, 0x401870c8, 0x0) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) (async) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-unshare-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$MAP_CREATE_TAIL_CALL-bpf$MAP_UPDATE_ELEM_TAIL_CALL-getsockopt$sock_buf-getsockopt$sock_buf-syz_mount_image$ext4-creat-creat-write$binfmt_elf64-openat-openat-fallocate-ioctl$EXT4_IOC_MOVE_EXT-memfd_create-mprotect-syz_open_dev$loop-ioctl$IOC_PR_REGISTER-ioctl$IOC_PR_REGISTER-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) unshare(0x2040400) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000280), &(0x7f0000000180)=r2}, 0x20) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) (async) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000380), 0x1, 0x50f, &(0x7f0000000fc0)="$eJzs3UFsI1cZAODfTpw42bRJSw8FQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZELN849ceeC4MalHJAWiEAbJA5GM54k3qy9sTaJncbfJ41m3ryx//9tMu+tX2y/AEbWzYjYj4iJiPggImaz87lsi3fbW3Ldo4MHK4cHD1Zy0Wq9/89cWp+ci47HJG5kz1mMiB9+N+InuSfjNnb3Npar1cp2Vp5v1rbmG7t7d9Zry2uVtcpmuby0uLTw9t23yhfW1ldrE9nRVz774/43f5akNZOd6WzHRWo3vXAcJzEeEd+/jGBDMJa1Z2LYifBM8hHxYkS8lt7/szGW/jQBgOus1ZqN1mxnGQC47vLpHFguX8rmAmYiny+V2nN4L8V0vlpvNG/fr+9srrbnyuaikL+/Xq0sZHOFc1HIJeXF9PikXD5VvhsRL0TELyan0nJppV5dHeZ/fABghN04Nf7/Z7I9/gMA11xx2AkAAANn/AeA0WP8B4DRY/wHgNHTHv+nhp0GADBAXv8DwOgx/gPASPnBe+8lW+sw+/7r1Q93dzbqH95ZrTQ2SrWdldJKfXurtFavr6Xf2VM76/mq9frW4pux89Hct7YazfnG7t69Wn1ns3kv/V7ve5VCetX+AFoGAPTywquf/iWXjMjvTKVbdKzlUBhqZsBlyw87AWBoxoadADA0VvuC0XWO1/imB+DzrsvavN0Uu31AqNVqtS4hJWAwbn3R/D+Mqo75f+8ChhFj/h9Gl/l/GF2tVq7fNf+j3wsBgKvNHD/Q420AL2b732Z/HPjx6ukrPrnMrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBqO1r/t5StBT4T+XypFPFcRMxFIXd/vVpZiIjnI+LPk4XJpLw45JwBgPPK/z2Xrf91a/aNmceqXrlxfDgRET/91fu//Gi52dz+U8RE7l+TR+ebn2Tny4PPHgA429E4ne47Xsg/OniwcrQNMp+H34mIYjv+4cFEHB7HH4/xdF+MQkRM/zuXldtyHXMX57H/cUS83K39uZhJ50DaK5+ejp/Efm6g8fOPxc+nde198m/xhQvIBUbNp0n/8263+y8fN9N95/1/slp6Me2hzi/r/5KnWjlM+8CT+Ef931iP/u9mvzHe/MP32kdT2YNPVnt++HHEl8YjjmIfdvQ/R/FzPeK/0Wf8v375ldd61bV+HXErusfvjDXfrG3NN3b37qzXltcqa5XNcnlpcWnh7btvlefTOer53qPBP965/XyvuqT90z3iF89o/9f6bP9v/vfBj776lPjfeL1b/Hy89JT4yW/i1/uMvzz9+2KvuiT+ao/2n/Xzv91n/M/+tvfEsuEAwPA0dvc2lqvVyvaIHvzuaqQxYgfj8YwPT35lh518r4Nv93/xy+eKNRHdq37+evuePlXVaj1TrF49xkXMugFXwfFNHxH/HXYyAAAAAAAAAAAAAABAV4P4dNSw2wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD19f8AAAD//+7Mzkc=") creat(&(0x7f0000000080)='./file1\x00', 0x8) (async) r4 = creat(&(0x7f0000000080)='./file1\x00', 0x8) write$binfmt_elf64(r4, &(0x7f0000002e40)=ANY=[], 0x78) r5 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0xa0c42, 0x100) openat(0xffffffffffffff9c, 0x0, 0x101042, 0x15) fallocate(0xffffffffffffffff, 0x10, 0x6, 0x7000000) ioctl$EXT4_IOC_MOVE_EXT(r5, 0xc028660f, &(0x7f0000000040)={0xc, r4, 0x2, 0x0, 0x0, 0xfffffffffe000001}) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r6 = syz_open_dev$loop(&(0x7f0000000000), 0x5, 0x400) ioctl$IOC_PR_REGISTER(r6, 0x401870c8, 0x0) (async) ioctl$IOC_PR_REGISTER(r6, 0x401870c8, 0x0) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-unshare-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$MAP_CREATE_TAIL_CALL-bpf$MAP_UPDATE_ELEM_TAIL_CALL-getsockopt$sock_buf-getsockopt$sock_buf-syz_mount_image$ext4-creat-creat-write$binfmt_elf64-openat-openat-fallocate-ioctl$EXT4_IOC_MOVE_EXT-memfd_create-mprotect-syz_open_dev$loop-ioctl$IOC_PR_REGISTER-ioctl$IOC_PR_REGISTER detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) unshare(0x2040400) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000280), &(0x7f0000000180)=r2}, 0x20) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) (async) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000380), 0x1, 0x50f, &(0x7f0000000fc0)="$eJzs3UFsI1cZAODfTpw42bRJSw8FQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZELN849ceeC4MalHJAWiEAbJA5GM54k3qy9sTaJncbfJ41m3ryx//9tMu+tX2y/AEbWzYjYj4iJiPggImaz87lsi3fbW3Ldo4MHK4cHD1Zy0Wq9/89cWp+ci47HJG5kz1mMiB9+N+InuSfjNnb3Npar1cp2Vp5v1rbmG7t7d9Zry2uVtcpmuby0uLTw9t23yhfW1ldrE9nRVz774/43f5akNZOd6WzHRWo3vXAcJzEeEd+/jGBDMJa1Z2LYifBM8hHxYkS8lt7/szGW/jQBgOus1ZqN1mxnGQC47vLpHFguX8rmAmYiny+V2nN4L8V0vlpvNG/fr+9srrbnyuaikL+/Xq0sZHOFc1HIJeXF9PikXD5VvhsRL0TELyan0nJppV5dHeZ/fABghN04Nf7/Z7I9/gMA11xx2AkAAANn/AeA0WP8B4DRY/wHgNHTHv+nhp0GADBAXv8DwOgx/gPASPnBe+8lW+sw+/7r1Q93dzbqH95ZrTQ2SrWdldJKfXurtFavr6Xf2VM76/mq9frW4pux89Hct7YazfnG7t69Wn1ns3kv/V7ve5VCetX+AFoGAPTywquf/iWXjMjvTKVbdKzlUBhqZsBlyw87AWBoxoadADA0VvuC0XWO1/imB+DzrsvavN0Uu31AqNVqtS4hJWAwbn3R/D+Mqo75f+8ChhFj/h9Gl/l/GF2tVq7fNf+j3wsBgKvNHD/Q420AL2b732Z/HPjx6ukrPrnMrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBqO1r/t5StBT4T+XypFPFcRMxFIXd/vVpZiIjnI+LPk4XJpLw45JwBgPPK/z2Xrf91a/aNmceqXrlxfDgRET/91fu//Gi52dz+U8RE7l+TR+ebn2Tny4PPHgA429E4ne47Xsg/OniwcrQNMp+H34mIYjv+4cFEHB7HH4/xdF+MQkRM/zuXldtyHXMX57H/cUS83K39uZhJ50DaK5+ejp/Efm6g8fOPxc+nde198m/xhQvIBUbNp0n/8263+y8fN9N95/1/slp6Me2hzi/r/5KnWjlM+8CT+Ef931iP/u9mvzHe/MP32kdT2YNPVnt++HHEl8YjjmIfdvQ/R/FzPeK/0Wf8v375ldd61bV+HXErusfvjDXfrG3NN3b37qzXltcqa5XNcnlpcWnh7btvlefTOer53qPBP965/XyvuqT90z3iF89o/9f6bP9v/vfBj776lPjfeL1b/Hy89JT4yW/i1/uMvzz9+2KvuiT+ao/2n/Xzv91n/M/+tvfEsuEAwPA0dvc2lqvVyvaIHvzuaqQxYgfj8YwPT35lh518r4Nv93/xy+eKNRHdq37+evuePlXVaj1TrF49xkXMugFXwfFNHxH/HXYyAAAAAAAAAAAAAABAV4P4dNSw2wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD19f8AAAD//+7Mzkc=") creat(&(0x7f0000000080)='./file1\x00', 0x8) (async) r4 = creat(&(0x7f0000000080)='./file1\x00', 0x8) write$binfmt_elf64(r4, &(0x7f0000002e40)=ANY=[], 0x78) r5 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0xa0c42, 0x100) openat(0xffffffffffffff9c, 0x0, 0x101042, 0x15) fallocate(0xffffffffffffffff, 0x10, 0x6, 0x7000000) ioctl$EXT4_IOC_MOVE_EXT(r5, 0xc028660f, &(0x7f0000000040)={0xc, r4, 0x2, 0x0, 0x0, 0xfffffffffe000001}) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r6 = syz_open_dev$loop(&(0x7f0000000000), 0x5, 0x400) ioctl$IOC_PR_REGISTER(r6, 0x401870c8, 0x0) (async) ioctl$IOC_PR_REGISTER(r6, 0x401870c8, 0x0) program did not crash testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-unshare-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$MAP_CREATE_TAIL_CALL-bpf$MAP_UPDATE_ELEM_TAIL_CALL-getsockopt$sock_buf-getsockopt$sock_buf-syz_mount_image$ext4-creat-creat-write$binfmt_elf64-openat-openat-fallocate-ioctl$EXT4_IOC_MOVE_EXT-memfd_create-mprotect-syz_open_dev$loop-ioctl$IOC_PR_REGISTER-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) unshare(0x2040400) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000280), &(0x7f0000000180)=r2}, 0x20) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) (async) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000380), 0x1, 0x50f, &(0x7f0000000fc0)="$eJzs3UFsI1cZAODfTpw42bRJSw8FQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZELN849ceeC4MalHJAWiEAbJA5GM54k3qy9sTaJncbfJ41m3ryx//9tMu+tX2y/AEbWzYjYj4iJiPggImaz87lsi3fbW3Ldo4MHK4cHD1Zy0Wq9/89cWp+ci47HJG5kz1mMiB9+N+InuSfjNnb3Npar1cp2Vp5v1rbmG7t7d9Zry2uVtcpmuby0uLTw9t23yhfW1ldrE9nRVz774/43f5akNZOd6WzHRWo3vXAcJzEeEd+/jGBDMJa1Z2LYifBM8hHxYkS8lt7/szGW/jQBgOus1ZqN1mxnGQC47vLpHFguX8rmAmYiny+V2nN4L8V0vlpvNG/fr+9srrbnyuaikL+/Xq0sZHOFc1HIJeXF9PikXD5VvhsRL0TELyan0nJppV5dHeZ/fABghN04Nf7/Z7I9/gMA11xx2AkAAANn/AeA0WP8B4DRY/wHgNHTHv+nhp0GADBAXv8DwOgx/gPASPnBe+8lW+sw+/7r1Q93dzbqH95ZrTQ2SrWdldJKfXurtFavr6Xf2VM76/mq9frW4pux89Hct7YazfnG7t69Wn1ns3kv/V7ve5VCetX+AFoGAPTywquf/iWXjMjvTKVbdKzlUBhqZsBlyw87AWBoxoadADA0VvuC0XWO1/imB+DzrsvavN0Uu31AqNVqtS4hJWAwbn3R/D+Mqo75f+8ChhFj/h9Gl/l/GF2tVq7fNf+j3wsBgKvNHD/Q420AL2b732Z/HPjx6ukrPrnMrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBqO1r/t5StBT4T+XypFPFcRMxFIXd/vVpZiIjnI+LPk4XJpLw45JwBgPPK/z2Xrf91a/aNmceqXrlxfDgRET/91fu//Gi52dz+U8RE7l+TR+ebn2Tny4PPHgA429E4ne47Xsg/OniwcrQNMp+H34mIYjv+4cFEHB7HH4/xdF+MQkRM/zuXldtyHXMX57H/cUS83K39uZhJ50DaK5+ejp/Efm6g8fOPxc+nde198m/xhQvIBUbNp0n/8263+y8fN9N95/1/slp6Me2hzi/r/5KnWjlM+8CT+Ef931iP/u9mvzHe/MP32kdT2YNPVnt++HHEl8YjjmIfdvQ/R/FzPeK/0Wf8v375ldd61bV+HXErusfvjDXfrG3NN3b37qzXltcqa5XNcnlpcWnh7btvlefTOer53qPBP965/XyvuqT90z3iF89o/9f6bP9v/vfBj776lPjfeL1b/Hy89JT4yW/i1/uMvzz9+2KvuiT+ao/2n/Xzv91n/M/+tvfEsuEAwPA0dvc2lqvVyvaIHvzuaqQxYgfj8YwPT35lh518r4Nv93/xy+eKNRHdq37+evuePlXVaj1TrF49xkXMugFXwfFNHxH/HXYyAAAAAAAAAAAAAABAV4P4dNSw2wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD19f8AAAD//+7Mzkc=") creat(&(0x7f0000000080)='./file1\x00', 0x8) (async) r4 = creat(&(0x7f0000000080)='./file1\x00', 0x8) write$binfmt_elf64(r4, &(0x7f0000002e40)=ANY=[], 0x78) r5 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0xa0c42, 0x100) openat(0xffffffffffffff9c, 0x0, 0x101042, 0x15) fallocate(0xffffffffffffffff, 0x10, 0x6, 0x7000000) ioctl$EXT4_IOC_MOVE_EXT(r5, 0xc028660f, &(0x7f0000000040)={0xc, r4, 0x2, 0x0, 0x0, 0xfffffffffe000001}) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r6 = syz_open_dev$loop(&(0x7f0000000000), 0x5, 0x400) ioctl$IOC_PR_REGISTER(r6, 0x401870c8, 0x0) (async) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-unshare-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$MAP_CREATE_TAIL_CALL-bpf$MAP_UPDATE_ELEM_TAIL_CALL-getsockopt$sock_buf-getsockopt$sock_buf-syz_mount_image$ext4-creat-creat-write$binfmt_elf64-openat-openat-fallocate-ioctl$EXT4_IOC_MOVE_EXT-memfd_create-mprotect-syz_open_dev$loop-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) unshare(0x2040400) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000280), &(0x7f0000000180)=r2}, 0x20) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) (async) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000380), 0x1, 0x50f, &(0x7f0000000fc0)="$eJzs3UFsI1cZAODfTpw42bRJSw8FQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZELN849ceeC4MalHJAWiEAbJA5GM54k3qy9sTaJncbfJ41m3ryx//9tMu+tX2y/AEbWzYjYj4iJiPggImaz87lsi3fbW3Ldo4MHK4cHD1Zy0Wq9/89cWp+ci47HJG5kz1mMiB9+N+InuSfjNnb3Npar1cp2Vp5v1rbmG7t7d9Zry2uVtcpmuby0uLTw9t23yhfW1ldrE9nRVz774/43f5akNZOd6WzHRWo3vXAcJzEeEd+/jGBDMJa1Z2LYifBM8hHxYkS8lt7/szGW/jQBgOus1ZqN1mxnGQC47vLpHFguX8rmAmYiny+V2nN4L8V0vlpvNG/fr+9srrbnyuaikL+/Xq0sZHOFc1HIJeXF9PikXD5VvhsRL0TELyan0nJppV5dHeZ/fABghN04Nf7/Z7I9/gMA11xx2AkAAANn/AeA0WP8B4DRY/wHgNHTHv+nhp0GADBAXv8DwOgx/gPASPnBe+8lW+sw+/7r1Q93dzbqH95ZrTQ2SrWdldJKfXurtFavr6Xf2VM76/mq9frW4pux89Hct7YazfnG7t69Wn1ns3kv/V7ve5VCetX+AFoGAPTywquf/iWXjMjvTKVbdKzlUBhqZsBlyw87AWBoxoadADA0VvuC0XWO1/imB+DzrsvavN0Uu31AqNVqtS4hJWAwbn3R/D+Mqo75f+8ChhFj/h9Gl/l/GF2tVq7fNf+j3wsBgKvNHD/Q420AL2b732Z/HPjx6ukrPrnMrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBqO1r/t5StBT4T+XypFPFcRMxFIXd/vVpZiIjnI+LPk4XJpLw45JwBgPPK/z2Xrf91a/aNmceqXrlxfDgRET/91fu//Gi52dz+U8RE7l+TR+ebn2Tny4PPHgA429E4ne47Xsg/OniwcrQNMp+H34mIYjv+4cFEHB7HH4/xdF+MQkRM/zuXldtyHXMX57H/cUS83K39uZhJ50DaK5+ejp/Efm6g8fOPxc+nde198m/xhQvIBUbNp0n/8263+y8fN9N95/1/slp6Me2hzi/r/5KnWjlM+8CT+Ef931iP/u9mvzHe/MP32kdT2YNPVnt++HHEl8YjjmIfdvQ/R/FzPeK/0Wf8v375ldd61bV+HXErusfvjDXfrG3NN3b37qzXltcqa5XNcnlpcWnh7btvlefTOer53qPBP965/XyvuqT90z3iF89o/9f6bP9v/vfBj776lPjfeL1b/Hy89JT4yW/i1/uMvzz9+2KvuiT+ao/2n/Xzv91n/M/+tvfEsuEAwPA0dvc2lqvVyvaIHvzuaqQxYgfj8YwPT35lh518r4Nv93/xy+eKNRHdq37+evuePlXVaj1TrF49xkXMugFXwfFNHxH/HXYyAAAAAAAAAAAAAABAV4P4dNSw2wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD19f8AAAD//+7Mzkc=") creat(&(0x7f0000000080)='./file1\x00', 0x8) (async) r4 = creat(&(0x7f0000000080)='./file1\x00', 0x8) write$binfmt_elf64(r4, &(0x7f0000002e40)=ANY=[], 0x78) r5 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0xa0c42, 0x100) openat(0xffffffffffffff9c, 0x0, 0x101042, 0x15) fallocate(0xffffffffffffffff, 0x10, 0x6, 0x7000000) ioctl$EXT4_IOC_MOVE_EXT(r5, 0xc028660f, &(0x7f0000000040)={0xc, r4, 0x2, 0x0, 0x0, 0xfffffffffe000001}) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) syz_open_dev$loop(&(0x7f0000000000), 0x5, 0x400) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-unshare-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$MAP_CREATE_TAIL_CALL-bpf$MAP_UPDATE_ELEM_TAIL_CALL-getsockopt$sock_buf-getsockopt$sock_buf-syz_mount_image$ext4-creat-creat-write$binfmt_elf64-openat-openat-fallocate-ioctl$EXT4_IOC_MOVE_EXT-memfd_create-mprotect-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) unshare(0x2040400) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000280), &(0x7f0000000180)=r2}, 0x20) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) (async) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000380), 0x1, 0x50f, &(0x7f0000000fc0)="$eJzs3UFsI1cZAODfTpw42bRJSw8FQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZELN849ceeC4MalHJAWiEAbJA5GM54k3qy9sTaJncbfJ41m3ryx//9tMu+tX2y/AEbWzYjYj4iJiPggImaz87lsi3fbW3Ldo4MHK4cHD1Zy0Wq9/89cWp+ci47HJG5kz1mMiB9+N+InuSfjNnb3Npar1cp2Vp5v1rbmG7t7d9Zry2uVtcpmuby0uLTw9t23yhfW1ldrE9nRVz774/43f5akNZOd6WzHRWo3vXAcJzEeEd+/jGBDMJa1Z2LYifBM8hHxYkS8lt7/szGW/jQBgOus1ZqN1mxnGQC47vLpHFguX8rmAmYiny+V2nN4L8V0vlpvNG/fr+9srrbnyuaikL+/Xq0sZHOFc1HIJeXF9PikXD5VvhsRL0TELyan0nJppV5dHeZ/fABghN04Nf7/Z7I9/gMA11xx2AkAAANn/AeA0WP8B4DRY/wHgNHTHv+nhp0GADBAXv8DwOgx/gPASPnBe+8lW+sw+/7r1Q93dzbqH95ZrTQ2SrWdldJKfXurtFavr6Xf2VM76/mq9frW4pux89Hct7YazfnG7t69Wn1ns3kv/V7ve5VCetX+AFoGAPTywquf/iWXjMjvTKVbdKzlUBhqZsBlyw87AWBoxoadADA0VvuC0XWO1/imB+DzrsvavN0Uu31AqNVqtS4hJWAwbn3R/D+Mqo75f+8ChhFj/h9Gl/l/GF2tVq7fNf+j3wsBgKvNHD/Q420AL2b732Z/HPjx6ukrPrnMrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBqO1r/t5StBT4T+XypFPFcRMxFIXd/vVpZiIjnI+LPk4XJpLw45JwBgPPK/z2Xrf91a/aNmceqXrlxfDgRET/91fu//Gi52dz+U8RE7l+TR+ebn2Tny4PPHgA429E4ne47Xsg/OniwcrQNMp+H34mIYjv+4cFEHB7HH4/xdF+MQkRM/zuXldtyHXMX57H/cUS83K39uZhJ50DaK5+ejp/Efm6g8fOPxc+nde198m/xhQvIBUbNp0n/8263+y8fN9N95/1/slp6Me2hzi/r/5KnWjlM+8CT+Ef931iP/u9mvzHe/MP32kdT2YNPVnt++HHEl8YjjmIfdvQ/R/FzPeK/0Wf8v375ldd61bV+HXErusfvjDXfrG3NN3b37qzXltcqa5XNcnlpcWnh7btvlefTOer53qPBP965/XyvuqT90z3iF89o/9f6bP9v/vfBj776lPjfeL1b/Hy89JT4yW/i1/uMvzz9+2KvuiT+ao/2n/Xzv91n/M/+tvfEsuEAwPA0dvc2lqvVyvaIHvzuaqQxYgfj8YwPT35lh518r4Nv93/xy+eKNRHdq37+evuePlXVaj1TrF49xkXMugFXwfFNHxH/HXYyAAAAAAAAAAAAAABAV4P4dNSw2wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD19f8AAAD//+7Mzkc=") creat(&(0x7f0000000080)='./file1\x00', 0x8) (async) r4 = creat(&(0x7f0000000080)='./file1\x00', 0x8) write$binfmt_elf64(r4, &(0x7f0000002e40)=ANY=[], 0x78) r5 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0xa0c42, 0x100) openat(0xffffffffffffff9c, 0x0, 0x101042, 0x15) fallocate(0xffffffffffffffff, 0x10, 0x6, 0x7000000) ioctl$EXT4_IOC_MOVE_EXT(r5, 0xc028660f, &(0x7f0000000040)={0xc, r4, 0x2, 0x0, 0x0, 0xfffffffffe000001}) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-unshare-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$MAP_CREATE_TAIL_CALL-bpf$MAP_UPDATE_ELEM_TAIL_CALL-getsockopt$sock_buf-getsockopt$sock_buf-syz_mount_image$ext4-creat-creat-write$binfmt_elf64-openat-openat-fallocate-ioctl$EXT4_IOC_MOVE_EXT-memfd_create-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) unshare(0x2040400) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000280), &(0x7f0000000180)=r2}, 0x20) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) (async) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000380), 0x1, 0x50f, &(0x7f0000000fc0)="$eJzs3UFsI1cZAODfTpw42bRJSw8FQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZELN849ceeC4MalHJAWiEAbJA5GM54k3qy9sTaJncbfJ41m3ryx//9tMu+tX2y/AEbWzYjYj4iJiPggImaz87lsi3fbW3Ldo4MHK4cHD1Zy0Wq9/89cWp+ci47HJG5kz1mMiB9+N+InuSfjNnb3Npar1cp2Vp5v1rbmG7t7d9Zry2uVtcpmuby0uLTw9t23yhfW1ldrE9nRVz774/43f5akNZOd6WzHRWo3vXAcJzEeEd+/jGBDMJa1Z2LYifBM8hHxYkS8lt7/szGW/jQBgOus1ZqN1mxnGQC47vLpHFguX8rmAmYiny+V2nN4L8V0vlpvNG/fr+9srrbnyuaikL+/Xq0sZHOFc1HIJeXF9PikXD5VvhsRL0TELyan0nJppV5dHeZ/fABghN04Nf7/Z7I9/gMA11xx2AkAAANn/AeA0WP8B4DRY/wHgNHTHv+nhp0GADBAXv8DwOgx/gPASPnBe+8lW+sw+/7r1Q93dzbqH95ZrTQ2SrWdldJKfXurtFavr6Xf2VM76/mq9frW4pux89Hct7YazfnG7t69Wn1ns3kv/V7ve5VCetX+AFoGAPTywquf/iWXjMjvTKVbdKzlUBhqZsBlyw87AWBoxoadADA0VvuC0XWO1/imB+DzrsvavN0Uu31AqNVqtS4hJWAwbn3R/D+Mqo75f+8ChhFj/h9Gl/l/GF2tVq7fNf+j3wsBgKvNHD/Q420AL2b732Z/HPjx6ukrPrnMrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBqO1r/t5StBT4T+XypFPFcRMxFIXd/vVpZiIjnI+LPk4XJpLw45JwBgPPK/z2Xrf91a/aNmceqXrlxfDgRET/91fu//Gi52dz+U8RE7l+TR+ebn2Tny4PPHgA429E4ne47Xsg/OniwcrQNMp+H34mIYjv+4cFEHB7HH4/xdF+MQkRM/zuXldtyHXMX57H/cUS83K39uZhJ50DaK5+ejp/Efm6g8fOPxc+nde198m/xhQvIBUbNp0n/8263+y8fN9N95/1/slp6Me2hzi/r/5KnWjlM+8CT+Ef931iP/u9mvzHe/MP32kdT2YNPVnt++HHEl8YjjmIfdvQ/R/FzPeK/0Wf8v375ldd61bV+HXErusfvjDXfrG3NN3b37qzXltcqa5XNcnlpcWnh7btvlefTOer53qPBP965/XyvuqT90z3iF89o/9f6bP9v/vfBj776lPjfeL1b/Hy89JT4yW/i1/uMvzz9+2KvuiT+ao/2n/Xzv91n/M/+tvfEsuEAwPA0dvc2lqvVyvaIHvzuaqQxYgfj8YwPT35lh518r4Nv93/xy+eKNRHdq37+evuePlXVaj1TrF49xkXMugFXwfFNHxH/HXYyAAAAAAAAAAAAAABAV4P4dNSw2wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD19f8AAAD//+7Mzkc=") creat(&(0x7f0000000080)='./file1\x00', 0x8) (async) r4 = creat(&(0x7f0000000080)='./file1\x00', 0x8) write$binfmt_elf64(r4, &(0x7f0000002e40)=ANY=[], 0x78) r5 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0xa0c42, 0x100) openat(0xffffffffffffff9c, 0x0, 0x101042, 0x15) fallocate(0xffffffffffffffff, 0x10, 0x6, 0x7000000) ioctl$EXT4_IOC_MOVE_EXT(r5, 0xc028660f, &(0x7f0000000040)={0xc, r4, 0x2, 0x0, 0x0, 0xfffffffffe000001}) memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-unshare-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$MAP_CREATE_TAIL_CALL-bpf$MAP_UPDATE_ELEM_TAIL_CALL-getsockopt$sock_buf-getsockopt$sock_buf-syz_mount_image$ext4-creat-creat-write$binfmt_elf64-openat-openat-fallocate-ioctl$EXT4_IOC_MOVE_EXT-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) unshare(0x2040400) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000280), &(0x7f0000000180)=r2}, 0x20) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) (async) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000380), 0x1, 0x50f, &(0x7f0000000fc0)="$eJzs3UFsI1cZAODfTpw42bRJSw8FQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZELN849ceeC4MalHJAWiEAbJA5GM54k3qy9sTaJncbfJ41m3ryx//9tMu+tX2y/AEbWzYjYj4iJiPggImaz87lsi3fbW3Ldo4MHK4cHD1Zy0Wq9/89cWp+ci47HJG5kz1mMiB9+N+InuSfjNnb3Npar1cp2Vp5v1rbmG7t7d9Zry2uVtcpmuby0uLTw9t23yhfW1ldrE9nRVz774/43f5akNZOd6WzHRWo3vXAcJzEeEd+/jGBDMJa1Z2LYifBM8hHxYkS8lt7/szGW/jQBgOus1ZqN1mxnGQC47vLpHFguX8rmAmYiny+V2nN4L8V0vlpvNG/fr+9srrbnyuaikL+/Xq0sZHOFc1HIJeXF9PikXD5VvhsRL0TELyan0nJppV5dHeZ/fABghN04Nf7/Z7I9/gMA11xx2AkAAANn/AeA0WP8B4DRY/wHgNHTHv+nhp0GADBAXv8DwOgx/gPASPnBe+8lW+sw+/7r1Q93dzbqH95ZrTQ2SrWdldJKfXurtFavr6Xf2VM76/mq9frW4pux89Hct7YazfnG7t69Wn1ns3kv/V7ve5VCetX+AFoGAPTywquf/iWXjMjvTKVbdKzlUBhqZsBlyw87AWBoxoadADA0VvuC0XWO1/imB+DzrsvavN0Uu31AqNVqtS4hJWAwbn3R/D+Mqo75f+8ChhFj/h9Gl/l/GF2tVq7fNf+j3wsBgKvNHD/Q420AL2b732Z/HPjx6ukrPrnMrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBqO1r/t5StBT4T+XypFPFcRMxFIXd/vVpZiIjnI+LPk4XJpLw45JwBgPPK/z2Xrf91a/aNmceqXrlxfDgRET/91fu//Gi52dz+U8RE7l+TR+ebn2Tny4PPHgA429E4ne47Xsg/OniwcrQNMp+H34mIYjv+4cFEHB7HH4/xdF+MQkRM/zuXldtyHXMX57H/cUS83K39uZhJ50DaK5+ejp/Efm6g8fOPxc+nde198m/xhQvIBUbNp0n/8263+y8fN9N95/1/slp6Me2hzi/r/5KnWjlM+8CT+Ef931iP/u9mvzHe/MP32kdT2YNPVnt++HHEl8YjjmIfdvQ/R/FzPeK/0Wf8v375ldd61bV+HXErusfvjDXfrG3NN3b37qzXltcqa5XNcnlpcWnh7btvlefTOer53qPBP965/XyvuqT90z3iF89o/9f6bP9v/vfBj776lPjfeL1b/Hy89JT4yW/i1/uMvzz9+2KvuiT+ao/2n/Xzv91n/M/+tvfEsuEAwPA0dvc2lqvVyvaIHvzuaqQxYgfj8YwPT35lh518r4Nv93/xy+eKNRHdq37+evuePlXVaj1TrF49xkXMugFXwfFNHxH/HXYyAAAAAAAAAAAAAABAV4P4dNSw2wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD19f8AAAD//+7Mzkc=") creat(&(0x7f0000000080)='./file1\x00', 0x8) (async) r4 = creat(&(0x7f0000000080)='./file1\x00', 0x8) write$binfmt_elf64(r4, &(0x7f0000002e40)=ANY=[], 0x78) r5 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0xa0c42, 0x100) openat(0xffffffffffffff9c, 0x0, 0x101042, 0x15) fallocate(0xffffffffffffffff, 0x10, 0x6, 0x7000000) ioctl$EXT4_IOC_MOVE_EXT(r5, 0xc028660f, &(0x7f0000000040)={0xc, r4, 0x2, 0x0, 0x0, 0xfffffffffe000001}) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-unshare-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$MAP_CREATE_TAIL_CALL-bpf$MAP_UPDATE_ELEM_TAIL_CALL-getsockopt$sock_buf-getsockopt$sock_buf-syz_mount_image$ext4-creat-creat-write$binfmt_elf64-openat-openat-fallocate-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) unshare(0x2040400) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000280), &(0x7f0000000180)=r2}, 0x20) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) (async) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000380), 0x1, 0x50f, &(0x7f0000000fc0)="$eJzs3UFsI1cZAODfTpw42bRJSw8FQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZELN849ceeC4MalHJAWiEAbJA5GM54k3qy9sTaJncbfJ41m3ryx//9tMu+tX2y/AEbWzYjYj4iJiPggImaz87lsi3fbW3Ldo4MHK4cHD1Zy0Wq9/89cWp+ci47HJG5kz1mMiB9+N+InuSfjNnb3Npar1cp2Vp5v1rbmG7t7d9Zry2uVtcpmuby0uLTw9t23yhfW1ldrE9nRVz774/43f5akNZOd6WzHRWo3vXAcJzEeEd+/jGBDMJa1Z2LYifBM8hHxYkS8lt7/szGW/jQBgOus1ZqN1mxnGQC47vLpHFguX8rmAmYiny+V2nN4L8V0vlpvNG/fr+9srrbnyuaikL+/Xq0sZHOFc1HIJeXF9PikXD5VvhsRL0TELyan0nJppV5dHeZ/fABghN04Nf7/Z7I9/gMA11xx2AkAAANn/AeA0WP8B4DRY/wHgNHTHv+nhp0GADBAXv8DwOgx/gPASPnBe+8lW+sw+/7r1Q93dzbqH95ZrTQ2SrWdldJKfXurtFavr6Xf2VM76/mq9frW4pux89Hct7YazfnG7t69Wn1ns3kv/V7ve5VCetX+AFoGAPTywquf/iWXjMjvTKVbdKzlUBhqZsBlyw87AWBoxoadADA0VvuC0XWO1/imB+DzrsvavN0Uu31AqNVqtS4hJWAwbn3R/D+Mqo75f+8ChhFj/h9Gl/l/GF2tVq7fNf+j3wsBgKvNHD/Q420AL2b732Z/HPjx6ukrPrnMrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBqO1r/t5StBT4T+XypFPFcRMxFIXd/vVpZiIjnI+LPk4XJpLw45JwBgPPK/z2Xrf91a/aNmceqXrlxfDgRET/91fu//Gi52dz+U8RE7l+TR+ebn2Tny4PPHgA429E4ne47Xsg/OniwcrQNMp+H34mIYjv+4cFEHB7HH4/xdF+MQkRM/zuXldtyHXMX57H/cUS83K39uZhJ50DaK5+ejp/Efm6g8fOPxc+nde198m/xhQvIBUbNp0n/8263+y8fN9N95/1/slp6Me2hzi/r/5KnWjlM+8CT+Ef931iP/u9mvzHe/MP32kdT2YNPVnt++HHEl8YjjmIfdvQ/R/FzPeK/0Wf8v375ldd61bV+HXErusfvjDXfrG3NN3b37qzXltcqa5XNcnlpcWnh7btvlefTOer53qPBP965/XyvuqT90z3iF89o/9f6bP9v/vfBj776lPjfeL1b/Hy89JT4yW/i1/uMvzz9+2KvuiT+ao/2n/Xzv91n/M/+tvfEsuEAwPA0dvc2lqvVyvaIHvzuaqQxYgfj8YwPT35lh518r4Nv93/xy+eKNRHdq37+evuePlXVaj1TrF49xkXMugFXwfFNHxH/HXYyAAAAAAAAAAAAAABAV4P4dNSw2wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD19f8AAAD//+7Mzkc=") creat(&(0x7f0000000080)='./file1\x00', 0x8) (async) r4 = creat(&(0x7f0000000080)='./file1\x00', 0x8) write$binfmt_elf64(r4, &(0x7f0000002e40)=ANY=[], 0x78) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0xa0c42, 0x100) openat(0xffffffffffffff9c, 0x0, 0x101042, 0x15) fallocate(0xffffffffffffffff, 0x10, 0x6, 0x7000000) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-unshare-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$MAP_CREATE_TAIL_CALL-bpf$MAP_UPDATE_ELEM_TAIL_CALL-getsockopt$sock_buf-getsockopt$sock_buf-syz_mount_image$ext4-creat-creat-write$binfmt_elf64-openat-openat-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) unshare(0x2040400) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000280), &(0x7f0000000180)=r2}, 0x20) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) (async) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000380), 0x1, 0x50f, &(0x7f0000000fc0)="$eJzs3UFsI1cZAODfTpw42bRJSw8FQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZELN849ceeC4MalHJAWiEAbJA5GM54k3qy9sTaJncbfJ41m3ryx//9tMu+tX2y/AEbWzYjYj4iJiPggImaz87lsi3fbW3Ldo4MHK4cHD1Zy0Wq9/89cWp+ci47HJG5kz1mMiB9+N+InuSfjNnb3Npar1cp2Vp5v1rbmG7t7d9Zry2uVtcpmuby0uLTw9t23yhfW1ldrE9nRVz774/43f5akNZOd6WzHRWo3vXAcJzEeEd+/jGBDMJa1Z2LYifBM8hHxYkS8lt7/szGW/jQBgOus1ZqN1mxnGQC47vLpHFguX8rmAmYiny+V2nN4L8V0vlpvNG/fr+9srrbnyuaikL+/Xq0sZHOFc1HIJeXF9PikXD5VvhsRL0TELyan0nJppV5dHeZ/fABghN04Nf7/Z7I9/gMA11xx2AkAAANn/AeA0WP8B4DRY/wHgNHTHv+nhp0GADBAXv8DwOgx/gPASPnBe+8lW+sw+/7r1Q93dzbqH95ZrTQ2SrWdldJKfXurtFavr6Xf2VM76/mq9frW4pux89Hct7YazfnG7t69Wn1ns3kv/V7ve5VCetX+AFoGAPTywquf/iWXjMjvTKVbdKzlUBhqZsBlyw87AWBoxoadADA0VvuC0XWO1/imB+DzrsvavN0Uu31AqNVqtS4hJWAwbn3R/D+Mqo75f+8ChhFj/h9Gl/l/GF2tVq7fNf+j3wsBgKvNHD/Q420AL2b732Z/HPjx6ukrPrnMrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBqO1r/t5StBT4T+XypFPFcRMxFIXd/vVpZiIjnI+LPk4XJpLw45JwBgPPK/z2Xrf91a/aNmceqXrlxfDgRET/91fu//Gi52dz+U8RE7l+TR+ebn2Tny4PPHgA429E4ne47Xsg/OniwcrQNMp+H34mIYjv+4cFEHB7HH4/xdF+MQkRM/zuXldtyHXMX57H/cUS83K39uZhJ50DaK5+ejp/Efm6g8fOPxc+nde198m/xhQvIBUbNp0n/8263+y8fN9N95/1/slp6Me2hzi/r/5KnWjlM+8CT+Ef931iP/u9mvzHe/MP32kdT2YNPVnt++HHEl8YjjmIfdvQ/R/FzPeK/0Wf8v375ldd61bV+HXErusfvjDXfrG3NN3b37qzXltcqa5XNcnlpcWnh7btvlefTOer53qPBP965/XyvuqT90z3iF89o/9f6bP9v/vfBj776lPjfeL1b/Hy89JT4yW/i1/uMvzz9+2KvuiT+ao/2n/Xzv91n/M/+tvfEsuEAwPA0dvc2lqvVyvaIHvzuaqQxYgfj8YwPT35lh518r4Nv93/xy+eKNRHdq37+evuePlXVaj1TrF49xkXMugFXwfFNHxH/HXYyAAAAAAAAAAAAAABAV4P4dNSw2wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD19f8AAAD//+7Mzkc=") creat(&(0x7f0000000080)='./file1\x00', 0x8) (async) r4 = creat(&(0x7f0000000080)='./file1\x00', 0x8) write$binfmt_elf64(r4, &(0x7f0000002e40)=ANY=[], 0x78) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0xa0c42, 0x100) openat(0xffffffffffffff9c, 0x0, 0x101042, 0x15) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-unshare-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$MAP_CREATE_TAIL_CALL-bpf$MAP_UPDATE_ELEM_TAIL_CALL-getsockopt$sock_buf-getsockopt$sock_buf-syz_mount_image$ext4-creat-creat-write$binfmt_elf64-openat-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) unshare(0x2040400) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000280), &(0x7f0000000180)=r2}, 0x20) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) (async) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000380), 0x1, 0x50f, &(0x7f0000000fc0)="$eJzs3UFsI1cZAODfTpw42bRJSw8FQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZELN849ceeC4MalHJAWiEAbJA5GM54k3qy9sTaJncbfJ41m3ryx//9tMu+tX2y/AEbWzYjYj4iJiPggImaz87lsi3fbW3Ldo4MHK4cHD1Zy0Wq9/89cWp+ci47HJG5kz1mMiB9+N+InuSfjNnb3Npar1cp2Vp5v1rbmG7t7d9Zry2uVtcpmuby0uLTw9t23yhfW1ldrE9nRVz774/43f5akNZOd6WzHRWo3vXAcJzEeEd+/jGBDMJa1Z2LYifBM8hHxYkS8lt7/szGW/jQBgOus1ZqN1mxnGQC47vLpHFguX8rmAmYiny+V2nN4L8V0vlpvNG/fr+9srrbnyuaikL+/Xq0sZHOFc1HIJeXF9PikXD5VvhsRL0TELyan0nJppV5dHeZ/fABghN04Nf7/Z7I9/gMA11xx2AkAAANn/AeA0WP8B4DRY/wHgNHTHv+nhp0GADBAXv8DwOgx/gPASPnBe+8lW+sw+/7r1Q93dzbqH95ZrTQ2SrWdldJKfXurtFavr6Xf2VM76/mq9frW4pux89Hct7YazfnG7t69Wn1ns3kv/V7ve5VCetX+AFoGAPTywquf/iWXjMjvTKVbdKzlUBhqZsBlyw87AWBoxoadADA0VvuC0XWO1/imB+DzrsvavN0Uu31AqNVqtS4hJWAwbn3R/D+Mqo75f+8ChhFj/h9Gl/l/GF2tVq7fNf+j3wsBgKvNHD/Q420AL2b732Z/HPjx6ukrPrnMrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBqO1r/t5StBT4T+XypFPFcRMxFIXd/vVpZiIjnI+LPk4XJpLw45JwBgPPK/z2Xrf91a/aNmceqXrlxfDgRET/91fu//Gi52dz+U8RE7l+TR+ebn2Tny4PPHgA429E4ne47Xsg/OniwcrQNMp+H34mIYjv+4cFEHB7HH4/xdF+MQkRM/zuXldtyHXMX57H/cUS83K39uZhJ50DaK5+ejp/Efm6g8fOPxc+nde198m/xhQvIBUbNp0n/8263+y8fN9N95/1/slp6Me2hzi/r/5KnWjlM+8CT+Ef931iP/u9mvzHe/MP32kdT2YNPVnt++HHEl8YjjmIfdvQ/R/FzPeK/0Wf8v375ldd61bV+HXErusfvjDXfrG3NN3b37qzXltcqa5XNcnlpcWnh7btvlefTOer53qPBP965/XyvuqT90z3iF89o/9f6bP9v/vfBj776lPjfeL1b/Hy89JT4yW/i1/uMvzz9+2KvuiT+ao/2n/Xzv91n/M/+tvfEsuEAwPA0dvc2lqvVyvaIHvzuaqQxYgfj8YwPT35lh518r4Nv93/xy+eKNRHdq37+evuePlXVaj1TrF49xkXMugFXwfFNHxH/HXYyAAAAAAAAAAAAAABAV4P4dNSw2wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD19f8AAAD//+7Mzkc=") creat(&(0x7f0000000080)='./file1\x00', 0x8) (async) r4 = creat(&(0x7f0000000080)='./file1\x00', 0x8) write$binfmt_elf64(r4, &(0x7f0000002e40)=ANY=[], 0x78) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file2\x00', 0xa0c42, 0x100) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-unshare-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$MAP_CREATE_TAIL_CALL-bpf$MAP_UPDATE_ELEM_TAIL_CALL-getsockopt$sock_buf-getsockopt$sock_buf-syz_mount_image$ext4-creat-creat-write$binfmt_elf64-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) unshare(0x2040400) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000280), &(0x7f0000000180)=r2}, 0x20) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) (async) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000380), 0x1, 0x50f, &(0x7f0000000fc0)="$eJzs3UFsI1cZAODfTpw42bRJSw8FQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZELN849ceeC4MalHJAWiEAbJA5GM54k3qy9sTaJncbfJ41m3ryx//9tMu+tX2y/AEbWzYjYj4iJiPggImaz87lsi3fbW3Ldo4MHK4cHD1Zy0Wq9/89cWp+ci47HJG5kz1mMiB9+N+InuSfjNnb3Npar1cp2Vp5v1rbmG7t7d9Zry2uVtcpmuby0uLTw9t23yhfW1ldrE9nRVz774/43f5akNZOd6WzHRWo3vXAcJzEeEd+/jGBDMJa1Z2LYifBM8hHxYkS8lt7/szGW/jQBgOus1ZqN1mxnGQC47vLpHFguX8rmAmYiny+V2nN4L8V0vlpvNG/fr+9srrbnyuaikL+/Xq0sZHOFc1HIJeXF9PikXD5VvhsRL0TELyan0nJppV5dHeZ/fABghN04Nf7/Z7I9/gMA11xx2AkAAANn/AeA0WP8B4DRY/wHgNHTHv+nhp0GADBAXv8DwOgx/gPASPnBe+8lW+sw+/7r1Q93dzbqH95ZrTQ2SrWdldJKfXurtFavr6Xf2VM76/mq9frW4pux89Hct7YazfnG7t69Wn1ns3kv/V7ve5VCetX+AFoGAPTywquf/iWXjMjvTKVbdKzlUBhqZsBlyw87AWBoxoadADA0VvuC0XWO1/imB+DzrsvavN0Uu31AqNVqtS4hJWAwbn3R/D+Mqo75f+8ChhFj/h9Gl/l/GF2tVq7fNf+j3wsBgKvNHD/Q420AL2b732Z/HPjx6ukrPrnMrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBqO1r/t5StBT4T+XypFPFcRMxFIXd/vVpZiIjnI+LPk4XJpLw45JwBgPPK/z2Xrf91a/aNmceqXrlxfDgRET/91fu//Gi52dz+U8RE7l+TR+ebn2Tny4PPHgA429E4ne47Xsg/OniwcrQNMp+H34mIYjv+4cFEHB7HH4/xdF+MQkRM/zuXldtyHXMX57H/cUS83K39uZhJ50DaK5+ejp/Efm6g8fOPxc+nde198m/xhQvIBUbNp0n/8263+y8fN9N95/1/slp6Me2hzi/r/5KnWjlM+8CT+Ef931iP/u9mvzHe/MP32kdT2YNPVnt++HHEl8YjjmIfdvQ/R/FzPeK/0Wf8v375ldd61bV+HXErusfvjDXfrG3NN3b37qzXltcqa5XNcnlpcWnh7btvlefTOer53qPBP965/XyvuqT90z3iF89o/9f6bP9v/vfBj776lPjfeL1b/Hy89JT4yW/i1/uMvzz9+2KvuiT+ao/2n/Xzv91n/M/+tvfEsuEAwPA0dvc2lqvVyvaIHvzuaqQxYgfj8YwPT35lh518r4Nv93/xy+eKNRHdq37+evuePlXVaj1TrF49xkXMugFXwfFNHxH/HXYyAAAAAAAAAAAAAABAV4P4dNSw2wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD19f8AAAD//+7Mzkc=") creat(&(0x7f0000000080)='./file1\x00', 0x8) (async) r4 = creat(&(0x7f0000000080)='./file1\x00', 0x8) write$binfmt_elf64(r4, &(0x7f0000002e40)=ANY=[], 0x78) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-unshare-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$MAP_CREATE_TAIL_CALL-bpf$MAP_UPDATE_ELEM_TAIL_CALL-getsockopt$sock_buf-getsockopt$sock_buf-syz_mount_image$ext4-creat-creat-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) unshare(0x2040400) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000280), &(0x7f0000000180)=r2}, 0x20) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) (async) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000380), 0x1, 0x50f, &(0x7f0000000fc0)="$eJzs3UFsI1cZAODfTpw42bRJSw8FQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZELN849ceeC4MalHJAWiEAbJA5GM54k3qy9sTaJncbfJ41m3ryx//9tMu+tX2y/AEbWzYjYj4iJiPggImaz87lsi3fbW3Ldo4MHK4cHD1Zy0Wq9/89cWp+ci47HJG5kz1mMiB9+N+InuSfjNnb3Npar1cp2Vp5v1rbmG7t7d9Zry2uVtcpmuby0uLTw9t23yhfW1ldrE9nRVz774/43f5akNZOd6WzHRWo3vXAcJzEeEd+/jGBDMJa1Z2LYifBM8hHxYkS8lt7/szGW/jQBgOus1ZqN1mxnGQC47vLpHFguX8rmAmYiny+V2nN4L8V0vlpvNG/fr+9srrbnyuaikL+/Xq0sZHOFc1HIJeXF9PikXD5VvhsRL0TELyan0nJppV5dHeZ/fABghN04Nf7/Z7I9/gMA11xx2AkAAANn/AeA0WP8B4DRY/wHgNHTHv+nhp0GADBAXv8DwOgx/gPASPnBe+8lW+sw+/7r1Q93dzbqH95ZrTQ2SrWdldJKfXurtFavr6Xf2VM76/mq9frW4pux89Hct7YazfnG7t69Wn1ns3kv/V7ve5VCetX+AFoGAPTywquf/iWXjMjvTKVbdKzlUBhqZsBlyw87AWBoxoadADA0VvuC0XWO1/imB+DzrsvavN0Uu31AqNVqtS4hJWAwbn3R/D+Mqo75f+8ChhFj/h9Gl/l/GF2tVq7fNf+j3wsBgKvNHD/Q420AL2b732Z/HPjx6ukrPrnMrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBqO1r/t5StBT4T+XypFPFcRMxFIXd/vVpZiIjnI+LPk4XJpLw45JwBgPPK/z2Xrf91a/aNmceqXrlxfDgRET/91fu//Gi52dz+U8RE7l+TR+ebn2Tny4PPHgA429E4ne47Xsg/OniwcrQNMp+H34mIYjv+4cFEHB7HH4/xdF+MQkRM/zuXldtyHXMX57H/cUS83K39uZhJ50DaK5+ejp/Efm6g8fOPxc+nde198m/xhQvIBUbNp0n/8263+y8fN9N95/1/slp6Me2hzi/r/5KnWjlM+8CT+Ef931iP/u9mvzHe/MP32kdT2YNPVnt++HHEl8YjjmIfdvQ/R/FzPeK/0Wf8v375ldd61bV+HXErusfvjDXfrG3NN3b37qzXltcqa5XNcnlpcWnh7btvlefTOer53qPBP965/XyvuqT90z3iF89o/9f6bP9v/vfBj776lPjfeL1b/Hy89JT4yW/i1/uMvzz9+2KvuiT+ao/2n/Xzv91n/M/+tvfEsuEAwPA0dvc2lqvVyvaIHvzuaqQxYgfj8YwPT35lh518r4Nv93/xy+eKNRHdq37+evuePlXVaj1TrF49xkXMugFXwfFNHxH/HXYyAAAAAAAAAAAAAABAV4P4dNSw2wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD19f8AAAD//+7Mzkc=") creat(&(0x7f0000000080)='./file1\x00', 0x8) (async) creat(&(0x7f0000000080)='./file1\x00', 0x8) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-unshare-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$MAP_CREATE_TAIL_CALL-bpf$MAP_UPDATE_ELEM_TAIL_CALL-getsockopt$sock_buf-getsockopt$sock_buf-syz_mount_image$ext4-creat-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) unshare(0x2040400) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000280), &(0x7f0000000180)=r2}, 0x20) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) (async) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000380), 0x1, 0x50f, &(0x7f0000000fc0)="$eJzs3UFsI1cZAODfTpw42bRJSw8FQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZELN849ceeC4MalHJAWiEAbJA5GM54k3qy9sTaJncbfJ41m3ryx//9tMu+tX2y/AEbWzYjYj4iJiPggImaz87lsi3fbW3Ldo4MHK4cHD1Zy0Wq9/89cWp+ci47HJG5kz1mMiB9+N+InuSfjNnb3Npar1cp2Vp5v1rbmG7t7d9Zry2uVtcpmuby0uLTw9t23yhfW1ldrE9nRVz774/43f5akNZOd6WzHRWo3vXAcJzEeEd+/jGBDMJa1Z2LYifBM8hHxYkS8lt7/szGW/jQBgOus1ZqN1mxnGQC47vLpHFguX8rmAmYiny+V2nN4L8V0vlpvNG/fr+9srrbnyuaikL+/Xq0sZHOFc1HIJeXF9PikXD5VvhsRL0TELyan0nJppV5dHeZ/fABghN04Nf7/Z7I9/gMA11xx2AkAAANn/AeA0WP8B4DRY/wHgNHTHv+nhp0GADBAXv8DwOgx/gPASPnBe+8lW+sw+/7r1Q93dzbqH95ZrTQ2SrWdldJKfXurtFavr6Xf2VM76/mq9frW4pux89Hct7YazfnG7t69Wn1ns3kv/V7ve5VCetX+AFoGAPTywquf/iWXjMjvTKVbdKzlUBhqZsBlyw87AWBoxoadADA0VvuC0XWO1/imB+DzrsvavN0Uu31AqNVqtS4hJWAwbn3R/D+Mqo75f+8ChhFj/h9Gl/l/GF2tVq7fNf+j3wsBgKvNHD/Q420AL2b732Z/HPjx6ukrPrnMrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBqO1r/t5StBT4T+XypFPFcRMxFIXd/vVpZiIjnI+LPk4XJpLw45JwBgPPK/z2Xrf91a/aNmceqXrlxfDgRET/91fu//Gi52dz+U8RE7l+TR+ebn2Tny4PPHgA429E4ne47Xsg/OniwcrQNMp+H34mIYjv+4cFEHB7HH4/xdF+MQkRM/zuXldtyHXMX57H/cUS83K39uZhJ50DaK5+ejp/Efm6g8fOPxc+nde198m/xhQvIBUbNp0n/8263+y8fN9N95/1/slp6Me2hzi/r/5KnWjlM+8CT+Ef931iP/u9mvzHe/MP32kdT2YNPVnt++HHEl8YjjmIfdvQ/R/FzPeK/0Wf8v375ldd61bV+HXErusfvjDXfrG3NN3b37qzXltcqa5XNcnlpcWnh7btvlefTOer53qPBP965/XyvuqT90z3iF89o/9f6bP9v/vfBj776lPjfeL1b/Hy89JT4yW/i1/uMvzz9+2KvuiT+ao/2n/Xzv91n/M/+tvfEsuEAwPA0dvc2lqvVyvaIHvzuaqQxYgfj8YwPT35lh518r4Nv93/xy+eKNRHdq37+evuePlXVaj1TrF49xkXMugFXwfFNHxH/HXYyAAAAAAAAAAAAAABAV4P4dNSw2wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD19f8AAAD//+7Mzkc=") creat(&(0x7f0000000080)='./file1\x00', 0x8) (async) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-unshare-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$MAP_CREATE_TAIL_CALL-bpf$MAP_UPDATE_ELEM_TAIL_CALL-getsockopt$sock_buf-getsockopt$sock_buf-syz_mount_image$ext4-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) unshare(0x2040400) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000280), &(0x7f0000000180)=r2}, 0x20) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) (async) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000380), 0x1, 0x50f, &(0x7f0000000fc0)="$eJzs3UFsI1cZAODfTpw42bRJSw8FQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZELN849ceeC4MalHJAWiEAbJA5GM54k3qy9sTaJncbfJ41m3ryx//9tMu+tX2y/AEbWzYjYj4iJiPggImaz87lsi3fbW3Ldo4MHK4cHD1Zy0Wq9/89cWp+ci47HJG5kz1mMiB9+N+InuSfjNnb3Npar1cp2Vp5v1rbmG7t7d9Zry2uVtcpmuby0uLTw9t23yhfW1ldrE9nRVz774/43f5akNZOd6WzHRWo3vXAcJzEeEd+/jGBDMJa1Z2LYifBM8hHxYkS8lt7/szGW/jQBgOus1ZqN1mxnGQC47vLpHFguX8rmAmYiny+V2nN4L8V0vlpvNG/fr+9srrbnyuaikL+/Xq0sZHOFc1HIJeXF9PikXD5VvhsRL0TELyan0nJppV5dHeZ/fABghN04Nf7/Z7I9/gMA11xx2AkAAANn/AeA0WP8B4DRY/wHgNHTHv+nhp0GADBAXv8DwOgx/gPASPnBe+8lW+sw+/7r1Q93dzbqH95ZrTQ2SrWdldJKfXurtFavr6Xf2VM76/mq9frW4pux89Hct7YazfnG7t69Wn1ns3kv/V7ve5VCetX+AFoGAPTywquf/iWXjMjvTKVbdKzlUBhqZsBlyw87AWBoxoadADA0VvuC0XWO1/imB+DzrsvavN0Uu31AqNVqtS4hJWAwbn3R/D+Mqo75f+8ChhFj/h9Gl/l/GF2tVq7fNf+j3wsBgKvNHD/Q420AL2b732Z/HPjx6ukrPrnMrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBqO1r/t5StBT4T+XypFPFcRMxFIXd/vVpZiIjnI+LPk4XJpLw45JwBgPPK/z2Xrf91a/aNmceqXrlxfDgRET/91fu//Gi52dz+U8RE7l+TR+ebn2Tny4PPHgA429E4ne47Xsg/OniwcrQNMp+H34mIYjv+4cFEHB7HH4/xdF+MQkRM/zuXldtyHXMX57H/cUS83K39uZhJ50DaK5+ejp/Efm6g8fOPxc+nde198m/xhQvIBUbNp0n/8263+y8fN9N95/1/slp6Me2hzi/r/5KnWjlM+8CT+Ef931iP/u9mvzHe/MP32kdT2YNPVnt++HHEl8YjjmIfdvQ/R/FzPeK/0Wf8v375ldd61bV+HXErusfvjDXfrG3NN3b37qzXltcqa5XNcnlpcWnh7btvlefTOer53qPBP965/XyvuqT90z3iF89o/9f6bP9v/vfBj776lPjfeL1b/Hy89JT4yW/i1/uMvzz9+2KvuiT+ao/2n/Xzv91n/M/+tvfEsuEAwPA0dvc2lqvVyvaIHvzuaqQxYgfj8YwPT35lh518r4Nv93/xy+eKNRHdq37+evuePlXVaj1TrF49xkXMugFXwfFNHxH/HXYyAAAAAAAAAAAAAABAV4P4dNSw2wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMD19f8AAAD//+7Mzkc=") ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-unshare-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$MAP_CREATE_TAIL_CALL-bpf$MAP_UPDATE_ELEM_TAIL_CALL-getsockopt$sock_buf-getsockopt$sock_buf-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) unshare(0x2040400) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000280), &(0x7f0000000180)=r2}, 0x20) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) (async) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-unshare-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$MAP_CREATE_TAIL_CALL-bpf$MAP_UPDATE_ELEM_TAIL_CALL-getsockopt$sock_buf-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) unshare(0x2040400) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000280), &(0x7f0000000180)=r2}, 0x20) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32) (async) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-unshare-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$MAP_CREATE_TAIL_CALL-bpf$MAP_UPDATE_ELEM_TAIL_CALL-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) unshare(0x2040400) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r3}, &(0x7f0000000280), &(0x7f0000000180)=r2}, 0x20) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-unshare-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$MAP_CREATE_TAIL_CALL-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) unshare(0x2040400) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-unshare-bpf$PROG_LOAD-bpf$PROG_LOAD-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) unshare(0x2040400) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) (async) program did not crash testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-unshare-bpf$PROG_LOAD-bpf$MAP_CREATE_TAIL_CALL-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) unshare(0x2040400) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc11}}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-unshare-bpf$MAP_CREATE_TAIL_CALL-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) unshare(0x2040400) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-bpf$MAP_CREATE_TAIL_CALL-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-bpf$MAP_CREATE_TAIL_CALL-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) (async) program did not crash testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bpf$MAP_CREATE_TAIL_CALL-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{0xffffffffffffffff, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) (async) program did not crash testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bpf$MAP_CREATE_TAIL_CALL-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_udp-connect$pppl2tp-bpf$MAP_CREATE_TAIL_CALL-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(0xffffffffffffffff, 0x4048587b, &(0x7f0000000280)={{r0, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) (async) program did not crash testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bpf$MAP_CREATE_TAIL_CALL-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bpf$MAP_CREATE_TAIL_CALL-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) program did not crash testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bpf$MAP_CREATE_TAIL_CALL-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x50) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000280)={{r1, &(0x7f0000000000)='\x00', 0x48400, &(0x7f0000000040)={@_ha_fsid={[0x40, 0xffffff97]}, {0x400, 0xf, 0x5, 0x8}}, 0xa, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0x165a}, 0x1, &(0x7f0000000200)=[{0x2, 0x3, &(0x7f0000000100)='\x00', &(0x7f0000000140)="a0f9960bce31d30661bbf53762431a3d737c217c9beb5e115540bdea6ff49a67bcc260a660e09dba869677e773038c8c6571659cbd47bec0642cc1ac85e19630876c7fd67e748f24698ce09ffe17a92546e097a186a0864f184db24e7f1b35d415c2d0c20b4d34ec5016478d2143c67871b24ec619ccde8edec773ed798b8fb3843650ca33c616833e0a428e0f88634ffe5eb2bd9fa3ec294f499b760dbcbaa5a851adb6f4f847d1c31a", 0xaa, 0x30}]}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bpf$MAP_CREATE_TAIL_CALL-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x50) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release extracting C reproducer testing compiled C program (duration=31.534484403s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bpf$MAP_CREATE_TAIL_CALL-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE program crashed: KASAN: use-after-free Write in pppol2tp_release simplifying C reproducer testing compiled C program (duration=31.534484403s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bpf$MAP_CREATE_TAIL_CALL-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=31.534484403s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bpf$MAP_CREATE_TAIL_CALL-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=31.534484403s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bpf$MAP_CREATE_TAIL_CALL-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=31.534484403s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bpf$MAP_CREATE_TAIL_CALL-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=31.534484403s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bpf$MAP_CREATE_TAIL_CALL-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=31.534484403s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bpf$MAP_CREATE_TAIL_CALL-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=31.534484403s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bpf$MAP_CREATE_TAIL_CALL-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x50) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release validation run: crashed=true testing program (duration=31.534484403s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bpf$MAP_CREATE_TAIL_CALL-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x50) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release validation run: crashed=true testing program (duration=31.534484403s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bpf$MAP_CREATE_TAIL_CALL-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x50) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release validation run: crashed=true reproducing took 39m59.623975338s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: use-after-free in atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline] BUG: KASAN: use-after-free in atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline] BUG: KASAN: use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:173 [inline] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298 Write of size 8 at addr ffff88811267e150 by task syz.2.17/382 CPU: 1 PID: 382 Comm: syz.2.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:77 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:435 [inline] kasan_report+0x100/0x140 mm/kasan/report.c:452 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline] atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline] __mutex_trylock_fast kernel/locking/mutex.c:173 [inline] mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298 pppol2tp_release+0x178/0x2b0 net/l2tp/l2tp_ppp.c:442 __sock_release net/socket.c:597 [inline] sock_close+0xb8/0x200 net/socket.c:1287 __fput+0x2dc/0x730 fs/file_table.c:281 ____fput+0x15/0x20 fs/file_table.c:314 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f64318440d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff6195fdc8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007fff6195feb0 RCX: 00007f64318440d9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 000000000000db06 R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b32920000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f6431acbfac R14: 00007f6431acbfa8 R15: 00007f6431acbfa0 Allocated by task 382: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:430 [inline] ____kasan_kmalloc mm/kasan/common.c:509 [inline] __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:518 kasan_kmalloc include/linux/kasan.h:254 [inline] __kmalloc+0x19f/0x330 mm/slub.c:4038 kmalloc include/linux/slab.h:560 [inline] kzalloc include/linux/slab.h:667 [inline] l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772 __sys_connect_file net/socket.c:1867 [inline] __sys_connect+0x3ce/0x450 net/socket.c:1884 __do_sys_connect net/socket.c:1894 [inline] __se_sys_connect net/socket.c:1891 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:1891 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xcb Freed by task 382: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4a/0x70 mm/kasan/common.c:45 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:362 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370 kasan_slab_free include/linux/kasan.h:220 [inline] slab_free_hook mm/slub.c:1600 [inline] slab_free_freelist_hook+0xc5/0x190 mm/slub.c:1626 slab_free mm/slub.c:3208 [inline] kfree+0xc0/0x270 mm/slub.c:4196 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline] l2tp_session_put+0xb2/0x1a0 net/l2tp/l2tp_core.c:193 l2tp_session_delete+0x3a9/0x4a0 net/l2tp/l2tp_core.c:1589 pppol2tp_release+0x169/0x2b0 net/l2tp/l2tp_ppp.c:439 __sock_release net/socket.c:597 [inline] sock_close+0xb8/0x200 net/socket.c:1287 __fput+0x2dc/0x730 fs/file_table.c:281 ____fput+0x15/0x20 fs/file_table.c:314 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb The buggy address belongs to the object at ffff88811267e000 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 336 bytes inside of 512-byte region [ffff88811267e000, ffff88811267e200) The buggy address belongs to the page: page:ffffea0004499f00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11267c head:ffffea0004499f00 order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head) raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 362, ts 56090981250, free_ts 56086919795 set_page_owner include/linux/page_owner.h:35 [inline] post_alloc_hook mm/page_alloc.c:2456 [inline] prep_new_page+0x176/0x190 mm/page_alloc.c:2462 get_page_from_freelist+0x225f/0x23f0 mm/page_alloc.c:4254 __alloc_pages_nodemask+0x29a/0x640 mm/page_alloc.c:5384 alloc_slab_page mm/slub.c:-1 [inline] allocate_slab mm/slub.c:1813 [inline] new_slab+0x84/0x3f0 mm/slub.c:1874 new_slab_objects mm/slub.c:2632 [inline] ___slab_alloc+0x2f8/0x4c0 mm/slub.c:2796 __slab_alloc+0x63/0xa0 mm/slub.c:2836 slab_alloc_node mm/slub.c:2918 [inline] slab_alloc mm/slub.c:2960 [inline] __kmalloc+0x1f9/0x330 mm/slub.c:4034 __kmalloc_node include/linux/slab.h:421 [inline] kmalloc_node include/linux/slab.h:578 [inline] kzalloc_node include/linux/slab.h:678 [inline] qdisc_alloc+0x79/0x720 net/sched/sch_generic.c:864 qdisc_create_dflt+0x6b/0x390 net/sched/sch_generic.c:927 attach_one_default_qdisc net/sched/sch_generic.c:1090 [inline] netdev_for_each_tx_queue include/linux/netdevice.h:2321 [inline] attach_default_qdiscs net/sched/sch_generic.c:1108 [inline] dev_activate+0x292/0x11c0 net/sched/sch_generic.c:1167 __dev_open+0x3e9/0x500 net/core/dev.c:1549 __dev_change_flags+0x1e4/0x6a0 net/core/dev.c:8545 dev_change_flags+0x80/0x1a0 net/core/dev.c:8616 do_setlink+0xb19/0x29a0 net/core/rtnetlink.c:2744 __rtnl_newlink net/core/rtnetlink.c:3422 [inline] rtnl_newlink+0x13e6/0x1830 net/core/rtnetlink.c:3542 rtnetlink_rcv_msg+0x9e9/0xca0 net/core/rtnetlink.c:5622 page last free stack trace: reset_page_owner include/linux/page_owner.h:28 [inline] free_pages_prepare mm/page_alloc.c:1349 [inline] __free_pages_ok+0x80b/0x830 mm/page_alloc.c:1629 free_the_page mm/page_alloc.c:5445 [inline] __free_pages+0xd8/0x390 mm/page_alloc.c:5454 __free_slab+0xcf/0x190 mm/slub.c:1899 free_slab mm/slub.c:1914 [inline] discard_slab mm/slub.c:1920 [inline] unfreeze_partials+0x150/0x180 mm/slub.c:2415 put_cpu_partial+0xc1/0x180 mm/slub.c:2451 __slab_free+0x2c9/0x3a0 mm/slub.c:3100 do_slab_free mm/slub.c:3196 [inline] ___cache_free+0x10e/0x130 mm/slub.c:3215 qlink_free+0x50/0x90 mm/kasan/quarantine.c:157 qlist_free_all+0x5f/0xb0 mm/kasan/quarantine.c:176 kasan_quarantine_reduce+0x14a/0x160 mm/kasan/quarantine.c:283 __kasan_slab_alloc+0x2f/0xe0 mm/kasan/common.c:440 kasan_slab_alloc include/linux/kasan.h:244 [inline] slab_post_alloc_hook+0x5d/0x2f0 mm/slab.h:580 slab_alloc_node mm/slub.c:2952 [inline] slab_alloc mm/slub.c:2960 [inline] kmem_cache_alloc+0x15a/0x2d0 mm/slub.c:2965 sock_alloc_inode+0x1b/0xb0 net/socket.c:253 alloc_inode fs/inode.c:233 [inline] new_inode_pseudo+0x62/0x210 fs/inode.c:968 sock_alloc net/socket.c:574 [inline] __sock_create+0x12c/0x770 net/socket.c:1401 Memory state around the buggy address: ffff88811267e000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88811267e080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88811267e100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88811267e180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88811267e200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: use-after-free in atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline] BUG: KASAN: use-after-free in atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline] BUG: KASAN: use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:173 [inline] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298 Write of size 8 at addr ffff88811267e150 by task syz.2.17/382 CPU: 1 PID: 382 Comm: syz.2.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:77 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:435 [inline] kasan_report+0x100/0x140 mm/kasan/report.c:452 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline] atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline] __mutex_trylock_fast kernel/locking/mutex.c:173 [inline] mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298 pppol2tp_release+0x178/0x2b0 net/l2tp/l2tp_ppp.c:442 __sock_release net/socket.c:597 [inline] sock_close+0xb8/0x200 net/socket.c:1287 __fput+0x2dc/0x730 fs/file_table.c:281 ____fput+0x15/0x20 fs/file_table.c:314 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f64318440d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff6195fdc8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007fff6195feb0 RCX: 00007f64318440d9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 000000000000db06 R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b32920000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f6431acbfac R14: 00007f6431acbfa8 R15: 00007f6431acbfa0 Allocated by task 382: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:430 [inline] ____kasan_kmalloc mm/kasan/common.c:509 [inline] __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:518 kasan_kmalloc include/linux/kasan.h:254 [inline] __kmalloc+0x19f/0x330 mm/slub.c:4038 kmalloc include/linux/slab.h:560 [inline] kzalloc include/linux/slab.h:667 [inline] l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772 __sys_connect_file net/socket.c:1867 [inline] __sys_connect+0x3ce/0x450 net/socket.c:1884 __do_sys_connect net/socket.c:1894 [inline] __se_sys_connect net/socket.c:1891 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:1891 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xcb Freed by task 382: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4a/0x70 mm/kasan/common.c:45 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:362 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370 kasan_slab_free include/linux/kasan.h:220 [inline] slab_free_hook mm/slub.c:1600 [inline] slab_free_freelist_hook+0xc5/0x190 mm/slub.c:1626 slab_free mm/slub.c:3208 [inline] kfree+0xc0/0x270 mm/slub.c:4196 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline] l2tp_session_put+0xb2/0x1a0 net/l2tp/l2tp_core.c:193 l2tp_session_delete+0x3a9/0x4a0 net/l2tp/l2tp_core.c:1589 pppol2tp_release+0x169/0x2b0 net/l2tp/l2tp_ppp.c:439 __sock_release net/socket.c:597 [inline] sock_close+0xb8/0x200 net/socket.c:1287 __fput+0x2dc/0x730 fs/file_table.c:281 ____fput+0x15/0x20 fs/file_table.c:314 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb The buggy address belongs to the object at ffff88811267e000 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 336 bytes inside of 512-byte region [ffff88811267e000, ffff88811267e200) The buggy address belongs to the page: page:ffffea0004499f00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11267c head:ffffea0004499f00 order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head) raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 362, ts 56090981250, free_ts 56086919795 set_page_owner include/linux/page_owner.h:35 [inline] post_alloc_hook mm/page_alloc.c:2456 [inline] prep_new_page+0x176/0x190 mm/page_alloc.c:2462 get_page_from_freelist+0x225f/0x23f0 mm/page_alloc.c:4254 __alloc_pages_nodemask+0x29a/0x640 mm/page_alloc.c:5384 alloc_slab_page mm/slub.c:-1 [inline] allocate_slab mm/slub.c:1813 [inline] new_slab+0x84/0x3f0 mm/slub.c:1874 new_slab_objects mm/slub.c:2632 [inline] ___slab_alloc+0x2f8/0x4c0 mm/slub.c:2796 __slab_alloc+0x63/0xa0 mm/slub.c:2836 slab_alloc_node mm/slub.c:2918 [inline] slab_alloc mm/slub.c:2960 [inline] __kmalloc+0x1f9/0x330 mm/slub.c:4034 __kmalloc_node include/linux/slab.h:421 [inline] kmalloc_node include/linux/slab.h:578 [inline] kzalloc_node include/linux/slab.h:678 [inline] qdisc_alloc+0x79/0x720 net/sched/sch_generic.c:864 qdisc_create_dflt+0x6b/0x390 net/sched/sch_generic.c:927 attach_one_default_qdisc net/sched/sch_generic.c:1090 [inline] netdev_for_each_tx_queue include/linux/netdevice.h:2321 [inline] attach_default_qdiscs net/sched/sch_generic.c:1108 [inline] dev_activate+0x292/0x11c0 net/sched/sch_generic.c:1167 __dev_open+0x3e9/0x500 net/core/dev.c:1549 __dev_change_flags+0x1e4/0x6a0 net/core/dev.c:8545 dev_change_flags+0x80/0x1a0 net/core/dev.c:8616 do_setlink+0xb19/0x29a0 net/core/rtnetlink.c:2744 __rtnl_newlink net/core/rtnetlink.c:3422 [inline] rtnl_newlink+0x13e6/0x1830 net/core/rtnetlink.c:3542 rtnetlink_rcv_msg+0x9e9/0xca0 net/core/rtnetlink.c:5622 page last free stack trace: reset_page_owner include/linux/page_owner.h:28 [inline] free_pages_prepare mm/page_alloc.c:1349 [inline] __free_pages_ok+0x80b/0x830 mm/page_alloc.c:1629 free_the_page mm/page_alloc.c:5445 [inline] __free_pages+0xd8/0x390 mm/page_alloc.c:5454 __free_slab+0xcf/0x190 mm/slub.c:1899 free_slab mm/slub.c:1914 [inline] discard_slab mm/slub.c:1920 [inline] unfreeze_partials+0x150/0x180 mm/slub.c:2415 put_cpu_partial+0xc1/0x180 mm/slub.c:2451 __slab_free+0x2c9/0x3a0 mm/slub.c:3100 do_slab_free mm/slub.c:3196 [inline] ___cache_free+0x10e/0x130 mm/slub.c:3215 qlink_free+0x50/0x90 mm/kasan/quarantine.c:157 qlist_free_all+0x5f/0xb0 mm/kasan/quarantine.c:176 kasan_quarantine_reduce+0x14a/0x160 mm/kasan/quarantine.c:283 __kasan_slab_alloc+0x2f/0xe0 mm/kasan/common.c:440 kasan_slab_alloc include/linux/kasan.h:244 [inline] slab_post_alloc_hook+0x5d/0x2f0 mm/slab.h:580 slab_alloc_node mm/slub.c:2952 [inline] slab_alloc mm/slub.c:2960 [inline] kmem_cache_alloc+0x15a/0x2d0 mm/slub.c:2965 sock_alloc_inode+0x1b/0xb0 net/socket.c:253 alloc_inode fs/inode.c:233 [inline] new_inode_pseudo+0x62/0x210 fs/inode.c:968 sock_alloc net/socket.c:574 [inline] __sock_create+0x12c/0x770 net/socket.c:1401 Memory state around the buggy address: ffff88811267e000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88811267e080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88811267e100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88811267e180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88811267e200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================