Extracting prog: 5m8.781769926s Minimizing prog: 11m58.75748119s Simplifying prog options: 0s Extracting C: 57.401209982s Simplifying C: 8m16.653244354s extracting reproducer from 95 programs testing a last program of every proc single: executing 45 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_BTF_LOAD-syz_mount_image$fuse-bpf$MAP_CREATE_RINGBUF-open-mount-open-syz_open_dev$tty1-ioctl$KDENABIO-ioctl$KDDELIO-io_setup-syz_mount_image$ext4-sendmsg$inet-socketpair$unix-sendmsg$inet-recvmsg-socketpair$nbd-close_range-close_range-syz_usb_connect-io_submit-bpf$PROG_LOAD_XDP-socket$nl_route-sendmsg$nl_route detailed listing: executing program 0: r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[@ANYBLOB="9feb010018000000000000003400000034000000020000000000000002000004000000000000000002000000000000000000000002000000000000000100000000000001"], 0x0, 0x4e}, 0x20) syz_mount_image$fuse(&(0x7f0000002240), &(0x7f0000002280)='./file0\x00', 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c67726f75705f69643d211f233e0ea63d476be91d8570c4bac4e8706679803db76a4a6b8b80390cc3a4206b8828eb7baada90dc10172288c1debb29b3bdbdc3091fc6a807c2f85743f43fe957fcb04e59c38e09037ba98c28d79b663f", @ANYRESDEC=0x0, @ANYBLOB=',fscontext=unconfined_u\"obj_type=fsconte\"\",\x00'], 0x0, 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000440)={0x1b, 0x0, 0x0, 0x1000, 0x0, 0xffffffffffffffff, 0xfffffffe, '\x00', 0x0, r0, 0x0, 0x1}, 0x50) open(&(0x7f0000000780)='./bus\x00', 0x14507e, 0x0) mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1000, 0x0) r1 = open(&(0x7f0000000300)='./file0\x00', 0x2f77e, 0x67) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDENABIO(r2, 0x4b36) ioctl$KDDELIO(r2, 0x4b35, 0x3c7) io_setup(0x80, &(0x7f0000000480)=0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x88e, &(0x7f0000000240)={[{@usrjquota}, {@mblk_io_submit}, {@init_itable_val={'init_itable', 0x3d, 0x81}}, {@min_batch_time={'min_batch_time', 0x3d, 0x1000}}, {@barrier}, {@mblk_io_submit}, {@nogrpid}]}, 0x3, 0x44d, &(0x7f0000000c80)="$eJzs281rXFUbAPDnziRp06Zv8pb60bRqtIrBj6RJa+3CjaLgQkHQRV3GJC2x00aaCLYEjSJ1KQXBpbgU/Atc6UbUleBW91Iokk2ruBi5M/cmM5PJx8RJp3Z+P7jtOfee4Zxn7j13zrknN4CuNZL+k0QMRMSvETFYzdYXGKn+d2tlafrPlaXpJMrl1/9IKuVurixN50Xzz+3PMz0RhY+TONKk3oXLV85PlUqzl7L8+OKFd8YXLl95eu7C1LnZc7MXJ0+fPnli4tlTk8+0Jc40rpvD788fPfzym9denT5z7a0fv07y+BviaJORzQ4+Vi63ubrOOlCTTno62BBaUqx20+it9P/BKMbayRuMlz7qaOOAXVUul8v3bnx4uQzcxZLodAuAzsh/6NP5b75tPmBo6/Cj4248X50ApXHfyrbqkZ4oZGV6G+a37TQSEWeW//oi3WJ3nkMAANT5Nh3/PNVs/FeI2udC/8vWUIYi4v8RcTAiTkXEoYi4J6JS9r6IuL/F+hsXSdaPfwrXdxTYNqXjv+eyta368V8++ouhYpY7UIm/Nzk7V5o9nn0no9G7J81PbFLHdy/+8unnSfNjteO/dEvrz8eCWTuu9+yp/8zM1OLUv4t6zY0PI4Z7msWfrK4EpE0/HBHDO6xj7omvjm50bOv4m6t8JW1YZyp/GfF49fwvR0P8uWTz9cnxvVGaPT6eXxXr/fTz1dc2qn+n8bdLev73Nb3+V+MfSmrXaxdar+Pqb59sOKfZ6fXfl7xRt++9qcXFSxMRfckr1UbX7p9sKDe5Vj6Nf/RY8/5/MNa+iSMRkV7ED0TEgxHxUNb2hyPikYg4tkn8P7zw6Nt1O0YHWoh/d6Xxz7R0/tcSfdG4p3mieP77b+oqHYoW4k/P/8lKajTbs53733batbOrGQAAAP57ChExEElhbDVdKIyNVf+G/1DsK5TmFxafPDv/7sWZ6jsCQ9FbyJ90DdY8D53IpvV5frIhfyJ7bvxZsb+SH5ueL810Onjocvs36P+p34udbh2w67yvBd1L/4fupf9D99L/oXs16f/963f93fDKIHA3aPb7/0EH2gHcfg3937IfdBHzf+he+j90L/0futJCf2z9kvxtTKS3ojugGRJbJqJwRzRj9xN7u/OC7PSdCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoD3+CQAA//9Kze3x") sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg(r4, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x40000002) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000005e00)={0xffffffffffffffff}) close_range(r5, r6, 0x0) close_range(r6, 0xffffffffffffffff, 0x2) syz_usb_connect(0x3, 0x2d, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000049ffe840e5130100534e0000000109021b000100000000090400000101", @ANYRES8], 0x0) io_submit(r3, 0x1, &(0x7f0000001d00)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, r1, &(0x7f0000000000)="96", 0x1}]) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x5, 0x4, &(0x7f00000001c0)=@framed={{}, [@ldst={0x6, 0x0, 0x6, 0x0, 0x0, 0xfffffffffffffffe, 0xa000000}]}, &(0x7f0000000000)='syzkaller\x00', 0x5, 0x93, &(0x7f0000000100)=""/147}, 0x90) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@newlink={0x3c, 0x10, 0xffffffffffffffff, 0x70bd26, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x31e7d, 0x51a23}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LOCAL={0x8, 0x2, @rand_addr=0xc0586300}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x85}, 0x20040040) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETQUEUE-socket$inet6_icmp_raw-ioctl$sock_SIOCGIFINDEX-socket$netlink-sendmsg$nl_route-socket$nl_xfrm-sendmsg$nl_xfrm-syz_usb_connect$cdc_ecm-syz_emit_ethernet detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000140)={'veth0_macvtap\x00', 0x200}) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'gretap0\x00', 0x0}) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000000)=@newlink={0x44, 0x10, 0x503, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x1, 0x1424}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macsec={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACSEC_ENCRYPT={0x5, 0xf, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x44}}, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2d, 0x0, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0x0, 0x0, 0x4, 0xffffffffffffffff}, {0x0, 0xa00, 0x407ffffffffffe, 0x800000000000002}, 0xffffffff, 0x0, 0x1, 0x0, 0x6}, [@tmpl={0x44, 0x5, [{{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x0, 0x3c}, 0x2, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x6, 0x4, 0x3}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x0) syz_usb_connect$cdc_ecm(0x0, 0x4d, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x0, 0x0, 0xffffffffffff8001, 0x1, [{{0x9, 0x2, 0x96, 0x1, 0x1, 0x0, 0x50, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0xf, 0x2, 0x6, 0x0, 0x0, {{0x2}, {0x5}, {0xd, 0x24, 0xf, 0x1, 0x2, 0x8, 0x4, 0x81}}, {[], {{0x9, 0x5, 0x82, 0x2, 0x40, 0x0, 0x4, 0x2}}, {{0x9, 0x5, 0x3, 0x2, 0x200, 0x0, 0x0, 0x87}}}}}]}}]}}, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @void, {@ipv4={0x800, @tcp={{0x7, 0x4, 0x0, 0x2, 0x30, 0x0, 0x0, 0x0, 0x5, 0x0, @dev={0xac, 0x14, 0x14, 0x41}, @rand_addr=0x640100ff, {[@timestamp_addr={0x44, 0x4, 0x5, 0x3}, @generic={0x82, 0x2}]}}, {{0x4e22, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x1, 0x3, 0x0, 0xd5c0}}}}}}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-syz_usb_control_io-fsconfig$FSCONFIG_CMD_CREATE-pipe2-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000000c0)=ANY=[], 0x0) syz_usb_control_io(r0, 0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) pipe2(&(0x7f0000000340), 0x0) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f0000000200)=ANY=[@ANYBLOB="200e020000003391e35967b10224458b9bc90a006ccbaa07df2d5166d3559da765f77cc7b3d7fd387aff32f7272278a72fba0af823efef1c66f5804f87bc7a7b753f00c5fb68cbef3cdcc920afe164135dafc4a7a911d3883f71f374e113e1cc0bab2c3d795718f90af9153d97f5db56b5b357279ef12d4fe80d03a64f082b6e4baac50c647a969b11d9b3ad718121fab863f77f1d8d5908fe2101d3d9590912d20250b84e0f11ff99eb6ad68329b9630f73ebd12b5e3a7d"], 0x0, 0x0, 0x0, 0x0}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socket$inet-listen-accept4-bpf$PROG_LOAD detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000000c0)=@newlink={0x3c, 0x10, 0x1, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5b5d}, [@IFLA_GSO_MAX_SIZE={0x8, 0x29, 0x13d68}, @IFLA_ALT_IFNAME={0x14, 0x35, 'wg1\x00'}]}, 0x3c}, 0x1, 0x0, 0x0, 0x884}, 0x44) (async) r1 = socket$inet(0x2, 0x801, 0x0) listen(r1, 0x540) (async) accept4(r1, 0x0, 0x0, 0x80000) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x17, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x4}, [@generic={0x73, 0x1, 0x1}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @cgroup_sysctl=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socket$inet-listen-accept4-bpf$PROG_LOAD detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000000c0)=@newlink={0x3c, 0x10, 0x1, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5b5d}, [@IFLA_GSO_MAX_SIZE={0x8, 0x29, 0x13d68}, @IFLA_ALT_IFNAME={0x14, 0x35, 'wg1\x00'}]}, 0x3c}, 0x1, 0x0, 0x0, 0x884}, 0x44) (async) r1 = socket$inet(0x2, 0x801, 0x0) listen(r1, 0x540) (async) accept4(r1, 0x0, 0x0, 0x80000) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x17, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x4}, [@generic={0x73, 0x1, 0x1}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @cgroup_sysctl=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$vfat-open-getdents64-syz_usb_connect$uac1 detailed listing: executing program 0: syz_mount_image$vfat(&(0x7f0000000ec0), &(0x7f0000000180)='./file2\x00', 0x420c, &(0x7f0000003240)=ANY=[], 0x7, 0x36e, &(0x7f00000007c0)="$eJzs3U1oM0UYwPEnaZImeXmbHERRkA6+CHpZ2uhZDNKCELC0jdgKwrbdaMialGyoRsS2J4+Kd0+Ch9KbBQ8F7VnoxZteRPDWi6BgBXVlv5LNV9PGpMH2/4OSycw8uzPZSXk27WYv3vj03UrJ0kp6Q6JJJRERkUuRrEQlEPEfo245IfLJd622A3n+wW8/PL22UUx6FWo5v/5CTik1N//Nex+m/G6ns3Kefevi19wv54+fP3nxz/o7ZUuVLVWtNZSutmo/NfQt01A7ZauiKbViGrplqHLVMupe+1f+dsza7m5T6dWdh+ndumFZSq82VcVoqkZNNepNpb+tl6tK0zT1MC0Ypni0uqrnRwzeHvNgMCH1el6fEZFUT0vxaCoDAgAAU9Wd/0edlH5Y/h/Syv83Za5QWFpVTud2/n/8zFnjwesnc37+f5rol/+/+KO3rY783zmdaOf/Ne/8oDQ8//9cbpD/92ZE98vI+X92AoPBaOYTPVWRjmdO/p/237+uwzePF9wC+T8AAAAAAAAAAAAAAAAAAAAAAP8Hl7adsW07EzwGP+1LCPznuJMGHf9ZEUk6R9/m+N9laxubknQv3HOOsfnxXnGv6D36Hc5ExBTjb7ubszaCK4+UIyvfmvt+/P5eccZtyZek7MTLomQk666nULxtL79aWFpUHj++dZlSOhyfk4w8Fo7/2l2dTnyuM97ff0KeexSK1yQj329LTUzZcSPb+/9oUalXXit0xafcfiLy860fFAAAAAAAxkxTLX3P3zVtULv3LSP5kvsxkSELkpG/+p/fL/Q9P49lnopNe/YAAAAAANwPVvODii5Ro+4WTLNfISUDm8ZQiHXUxEWkb+dEV038qi3PhGZ43fEkxLuDyX+d1xfBq3qTqOAfKZyBt5r8O6rIaOMJ5u/WRGLP/u43/XnTeUUOxF0AB+GmqFwjPNY9+HmnQvXt/Gjgdg79ibRqgo+NEgNeZ1np3U70ipUQ76mxI6MtgCc++/KP8b1BXjrxV8D7wzsfmoa9L9c5KF0FZxe9TfGJ/+IBAAAAcOvaSX9Q83K4OXwjkfDNcvjLPQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYzSRr/TrKgze++xtThUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACYun8DAAD//7ct9c4=") r0 = open(&(0x7f0000000040)='.\x00', 0x8c00, 0x0) getdents64(r0, &(0x7f0000000fc0)=""/224, 0xe0) syz_usb_connect$uac1(0x5, 0x84, &(0x7f00000000c0)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0x2b73, 0x3c, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x72, 0x3, 0x1, 0x9, 0x70, 0x8, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x6, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x8, 0x9, 0x1002}, @format_type_i_discrete={0xb, 0x24, 0x2, 0x1, 0x40, 0x4, 0x9, 0x1, "b04f42"}]}, {{0x9, 0x5, 0x1, 0x9, 0x400, 0x5, 0xf7, 0x5, {0x7, 0x25, 0x1, 0xc, 0x9, 0x2}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x5, 0x3, 0x8, {0x7, 0x25, 0x1, 0x4, 0x6, 0x4}}}}}}}}]}}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_emit_ethernet-socket$nl_generic-syz_usb_connect$printer-ioctl$BTRFS_IOC_GET_DEV_STATS-ioctl$BTRFS_IOC_BALANCE_V2-recvfrom-ioctl$BTRFS_IOC_BALANCE_V2-ioctl$BTRFS_IOC_BALANCE_V2-sendmsg$nl_generic-syz_genetlink_get_family_id$batadv detailed listing: executing program 0: syz_usb_connect(0x0, 0x6b, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000385352608f20446b76e8e01020301090259000104e9000909049300000e0100ff0a2401020005028a010209240603040001a53011240606040508000400050006000100050924030506030501f909240702020005cbad092403060101"], &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x1609}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) syz_emit_ethernet(0x26, &(0x7f00000000c0)=ANY=[], 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect$printer(0x4, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x0, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x18, 0x80, 0x2, "", [{{0x9, 0x4, 0x0, 0x1, 0x1, 0x7, 0x1, 0x2, 0x2, "", {{{0x9, 0x5, 0x1, 0x2, 0x400, 0x0, 0x7, 0x51}}}}}]}}]}}, &(0x7f0000001840)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x310, 0xb, 0x7, 0xe, 0x0, 0xf}, 0x3f, &(0x7f00000001c0)={0x5, 0xf, 0x3f, 0x4, [@ssp_cap={0x20, 0x10, 0xa, 0x2, 0x5, 0x7fffffb, 0x0, 0x3, [0xc0, 0x0, 0xc0, 0x3fc0, 0x11]}, @ptm_cap={0x3}, @ssp_cap={0x14, 0x10, 0xa, 0x0, 0x2, 0x7, 0xf000, 0x2, [0x0, 0xffc030]}, @ptm_cap={0x3}]}, 0x9, [{0xca, &(0x7f0000000280)=@string={0xca, 0x3, "4129fca8c09d7522c8eb99fb9c8267b5dd75fce8d0779a01d1579ddfbc2b96128cb18b53e0440c5ece41080d336e00fe8685751466ee11aeb03f0847fe3c19d79c3be34e77af4efd971aa5eb793ee1b62dc57ed6ad3e90347c6f7de6a116830dba5e57cf949bb2d7ca465d9f5dc22377fc8c468cfb924ee4b59f0aa619f31c3671b6dfcc8a4e584ce7d4c1279e3abd4d89ea205a0b7666678ca671f3a37440798305c1e9e31538bc74ae14d945a58805ac1bf2b59b90324fc80d366b693938695f496f2e8628ac56"}}, {0x52, &(0x7f0000000380)=@string={0x52, 0x3, "b28ca5b945c9b93e0f135072af6c5e2976d583751020c0b848b81aeb7210e3a15b718f9b2f7f96b555ed8f93544e964e031a536acec9c82bc162b3651d3edfe6057db11acd01f6952d144e6761699d1b"}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x809}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x140c}}, {0xed, &(0x7f00000015c0)=@string={0xed, 0x3, "4f4061b9a68a71ec741d64eb6dd4f0735685520b8e5385eab7c142ad991b2d8a64a1b4a9c4873b6f3e12f9cf0fbf5c74abeefd0e45949d050b9193dbcfdbfc572f4ebcec5cfe5604085bf0f3131c4d0925539031989c28d14226e6dae4157930fb44469f5bffa8a75cdd28c7a10d4cb45f9ae30d2656e1303eec4e62d09deb4fa06f35140d49f2709bb9e7332c16261c79878ba7b94a4349f07cfe7184f1dcb0c015948275d8f8ee9490c3ea8eae8cee42638a31d8e988f9c6a858eb7009a0c2187269a951f7c8213b7ee77df8a2e3079cab6bd38f4b6e23177cfc7bcf3f8f602bf5dd89ed976253d6bf07"}}, {0x4, &(0x7f00000016c0)=@lang_id={0x4, 0x3, 0x83e}}, {0x23, &(0x7f0000001700)=@string={0x23, 0x3, "b195097743a5ecdd60dcd69830f9c062662f81bd46d0019706c2608488fff7da6b"}}, {0x7b, &(0x7f0000001740)=@string={0x7b, 0x3, "f3a7590ef67992eeec0890c176e0a1d5cfd62e226da5cab1518424b09107fe92cbab42c3298863f9f6160c3807dce931bb8c079369bcff473f3d426262d69cf801478b4e07acd80546fe8a3a80f366ee22e2529308978029edd2aff6a5f4f8ceb21a4b2d6a8d6062e4d4957164bb5bcc4871b36f5c5bcd8de3"}}, {0x61, &(0x7f00000017c0)=@string={0x61, 0x3, "ff45d289d949937614d134b4dd912ea51b08179de5f9e732cb744eff26503b7b6584122de94a3bcb4eaa8ce360ef60524fcadf147ee03b9c782b93350c01ddb02cfb573d486c0c48c75e882adca172df8932e63979c7ca8a3e4db774c00faa"}}]}) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f0000000580)={0x0, 0x9, 0x0, [0x2, 0x81, 0x8000000000000000, 0x1, 0x1], [0x5, 0x4, 0x3, 0x401, 0x0, 0x8000000000000001, 0x10b330b0, 0xfff, 0x0, 0x2, 0x5, 0x6, 0xc, 0xcee, 0x2, 0x0, 0x7, 0x0, 0x80, 0xfffffffffffffffc, 0x8, 0x6, 0x8, 0x8, 0xff, 0x2, 0x3, 0x0, 0x4, 0x8001, 0x5, 0x9, 0xd, 0xfffffffffffffff8, 0x6, 0x200, 0x2, 0xf78, 0xfffffffffffffffa, 0xc, 0x4, 0x0, 0x502, 0x9, 0x0, 0x40, 0x2, 0xfffffffffffffff8, 0x9, 0x2, 0x10001, 0x0, 0x100, 0xff, 0x1, 0x723, 0x6, 0x3, 0x9, 0xfffffffffffffff9, 0xffffffffffffffff, 0x0, 0x7, 0x7, 0x1, 0xfffffffffffffffe, 0x4, 0xbcd4, 0x1ff, 0x5, 0x100000000, 0x2, 0xc, 0x4, 0x7ff, 0x4, 0xffffffffffffff10, 0x36b54f64, 0x3, 0x6, 0x100000000, 0x8, 0x5, 0x3, 0x7aad, 0x5, 0x1ff, 0x0, 0xfb, 0x71, 0x80000000, 0x2, 0x7, 0x6, 0x60, 0x8, 0x6, 0x8, 0x4, 0x10, 0x2, 0x8, 0x8, 0xfffffffffffffe01, 0x5b, 0x7, 0x1, 0x100000000, 0x4, 0xc, 0x8000000000000001, 0x1bd, 0x100000001, 0x0, 0x3, 0x2, 0xb0, 0xb877, 0x7, 0x5, 0x3]}) ioctl$BTRFS_IOC_BALANCE_V2(r0, 0xc4009420, &(0x7f00000009c0)={0x10, 0x3, {0x9, @usage=0x2, 0x0, 0xe, 0x86, 0x5, 0x3, 0x9, 0x1, @struct={0x2, 0xfffffb31}, 0x7f, 0x100, [0x7, 0x400, 0x1, 0x7, 0xa0000000000000, 0x80]}, {0x8, @usage=0x100000000, 0x0, 0x4, 0x1a9a, 0x2, 0x1, 0x2, 0x9, @usage=0x5, 0x0, 0x3, [0x6376, 0x72, 0x800000, 0x46e, 0x100000000, 0xfd05]}, {0x6, @struct={0x4, 0x2}, 0x0, 0x7, 0x24, 0x8, 0x1, 0x7fff, 0x8, @usage=0xc9b7, 0x9, 0x0, [0x8, 0x10, 0x8, 0x0, 0x9, 0x4]}, {0x96, 0xcd84, 0x2}}) recvfrom(r0, &(0x7f0000000480)=""/6, 0x6, 0x40002000, &(0x7f00000004c0)=@ieee802154={0x24, @none={0x0, 0x1}}, 0x80) ioctl$BTRFS_IOC_BALANCE_V2(r1, 0xc4009420, &(0x7f0000000dc0)={0x0, 0x5, {0x2, @usage=0x6ee, 0x0, 0x0, 0x0, 0x2, 0x0, 0xffff, 0x81, @struct={0x0, 0x8}, 0x7, 0xfffffffc, [0xd9, 0x8, 0xf, 0x5, 0xb0, 0x8]}, {0x9, @usage=0x9, 0x0, 0x3, 0x1, 0xbeb, 0x1, 0xfffffffffffffe01, 0xa0, @usage=0x8, 0xff, 0xc8, [0x4, 0x7, 0x0, 0x9, 0x6, 0x9]}, {0x48f, @struct={0x4, 0x2475}, 0x0, 0x7, 0x7fff, 0x8, 0x9, 0x8, 0x4, @struct={0x7, 0x74d6}, 0x0, 0xfffffffc, [0xd3d3, 0x9, 0x7, 0x3ff, 0x2, 0x6]}, {0x4, 0x5, 0x9}}) ioctl$BTRFS_IOC_BALANCE_V2(r2, 0xc4009420, &(0x7f00000011c0)={0x3, 0x4, {0x3, @usage=0x6, r3, 0x1, 0x5, 0x4, 0x10000, 0x50f2, 0x1, @usage=0xce0, 0x1, 0x4, [0x6, 0x1, 0x7, 0x80000000000, 0x2, 0x9]}, {0x5, @struct={0x8, 0xb}, r4, 0x9, 0x100000000, 0x8, 0x715700000000, 0x5, 0x400, @usage=0x2, 0x7, 0x3, [0x9, 0x5, 0xd1, 0x0, 0x6, 0x8]}, {0x8, @struct={0x200, 0x9}, r5, 0x0, 0x8, 0x6, 0x25c1, 0x40, 0x400, @usage, 0x8, 0x7f, [0x0, 0x34, 0x3, 0x7, 0x3, 0x800]}, {0x6, 0x0, 0x100}}) sendmsg$nl_generic(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="702300001d00"], 0x2370}, 0x1, 0x0, 0x0, 0x8800}, 0x20048104) syz_genetlink_get_family_id$batadv(&(0x7f0000000040), r2) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work single: successfully extracted reproducer found reproducer with 14 syscalls minimizing guilty program testing program (duration=37.581661716s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_emit_ethernet-socket$nl_generic-syz_usb_connect$printer-ioctl$BTRFS_IOC_GET_DEV_STATS-ioctl$BTRFS_IOC_BALANCE_V2-recvfrom-ioctl$BTRFS_IOC_BALANCE_V2-ioctl$BTRFS_IOC_BALANCE_V2-sendmsg$nl_generic detailed listing: executing program 0: syz_usb_connect(0x0, 0x6b, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000385352608f20446b76e8e01020301090259000104e9000909049300000e0100ff0a2401020005028a010209240603040001a53011240606040508000400050006000100050924030506030501f909240702020005cbad092403060101"], &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x1609}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) syz_emit_ethernet(0x26, &(0x7f00000000c0)=ANY=[], 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect$printer(0x4, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x0, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x18, 0x80, 0x2, "", [{{0x9, 0x4, 0x0, 0x1, 0x1, 0x7, 0x1, 0x2, 0x2, "", {{{0x9, 0x5, 0x1, 0x2, 0x400, 0x0, 0x7, 0x51}}}}}]}}]}}, &(0x7f0000001840)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x310, 0xb, 0x7, 0xe, 0x0, 0xf}, 0x3f, &(0x7f00000001c0)={0x5, 0xf, 0x3f, 0x4, [@ssp_cap={0x20, 0x10, 0xa, 0x2, 0x5, 0x7fffffb, 0x0, 0x3, [0xc0, 0x0, 0xc0, 0x3fc0, 0x11]}, @ptm_cap={0x3}, @ssp_cap={0x14, 0x10, 0xa, 0x0, 0x2, 0x7, 0xf000, 0x2, [0x0, 0xffc030]}, @ptm_cap={0x3}]}, 0x9, [{0xca, &(0x7f0000000280)=@string={0xca, 0x3, "4129fca8c09d7522c8eb99fb9c8267b5dd75fce8d0779a01d1579ddfbc2b96128cb18b53e0440c5ece41080d336e00fe8685751466ee11aeb03f0847fe3c19d79c3be34e77af4efd971aa5eb793ee1b62dc57ed6ad3e90347c6f7de6a116830dba5e57cf949bb2d7ca465d9f5dc22377fc8c468cfb924ee4b59f0aa619f31c3671b6dfcc8a4e584ce7d4c1279e3abd4d89ea205a0b7666678ca671f3a37440798305c1e9e31538bc74ae14d945a58805ac1bf2b59b90324fc80d366b693938695f496f2e8628ac56"}}, {0x52, &(0x7f0000000380)=@string={0x52, 0x3, "b28ca5b945c9b93e0f135072af6c5e2976d583751020c0b848b81aeb7210e3a15b718f9b2f7f96b555ed8f93544e964e031a536acec9c82bc162b3651d3edfe6057db11acd01f6952d144e6761699d1b"}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x809}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x140c}}, {0xed, &(0x7f00000015c0)=@string={0xed, 0x3, "4f4061b9a68a71ec741d64eb6dd4f0735685520b8e5385eab7c142ad991b2d8a64a1b4a9c4873b6f3e12f9cf0fbf5c74abeefd0e45949d050b9193dbcfdbfc572f4ebcec5cfe5604085bf0f3131c4d0925539031989c28d14226e6dae4157930fb44469f5bffa8a75cdd28c7a10d4cb45f9ae30d2656e1303eec4e62d09deb4fa06f35140d49f2709bb9e7332c16261c79878ba7b94a4349f07cfe7184f1dcb0c015948275d8f8ee9490c3ea8eae8cee42638a31d8e988f9c6a858eb7009a0c2187269a951f7c8213b7ee77df8a2e3079cab6bd38f4b6e23177cfc7bcf3f8f602bf5dd89ed976253d6bf07"}}, {0x4, &(0x7f00000016c0)=@lang_id={0x4, 0x3, 0x83e}}, {0x23, &(0x7f0000001700)=@string={0x23, 0x3, "b195097743a5ecdd60dcd69830f9c062662f81bd46d0019706c2608488fff7da6b"}}, {0x7b, &(0x7f0000001740)=@string={0x7b, 0x3, "f3a7590ef67992eeec0890c176e0a1d5cfd62e226da5cab1518424b09107fe92cbab42c3298863f9f6160c3807dce931bb8c079369bcff473f3d426262d69cf801478b4e07acd80546fe8a3a80f366ee22e2529308978029edd2aff6a5f4f8ceb21a4b2d6a8d6062e4d4957164bb5bcc4871b36f5c5bcd8de3"}}, {0x61, &(0x7f00000017c0)=@string={0x61, 0x3, "ff45d289d949937614d134b4dd912ea51b08179de5f9e732cb744eff26503b7b6584122de94a3bcb4eaa8ce360ef60524fcadf147ee03b9c782b93350c01ddb02cfb573d486c0c48c75e882adca172df8932e63979c7ca8a3e4db774c00faa"}}]}) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f0000000580)={0x0, 0x9, 0x0, [0x2, 0x81, 0x8000000000000000, 0x1, 0x1], [0x5, 0x4, 0x3, 0x401, 0x0, 0x8000000000000001, 0x10b330b0, 0xfff, 0x0, 0x2, 0x5, 0x6, 0xc, 0xcee, 0x2, 0x0, 0x7, 0x0, 0x80, 0xfffffffffffffffc, 0x8, 0x6, 0x8, 0x8, 0xff, 0x2, 0x3, 0x0, 0x4, 0x8001, 0x5, 0x9, 0xd, 0xfffffffffffffff8, 0x6, 0x200, 0x2, 0xf78, 0xfffffffffffffffa, 0xc, 0x4, 0x0, 0x502, 0x9, 0x0, 0x40, 0x2, 0xfffffffffffffff8, 0x9, 0x2, 0x10001, 0x0, 0x100, 0xff, 0x1, 0x723, 0x6, 0x3, 0x9, 0xfffffffffffffff9, 0xffffffffffffffff, 0x0, 0x7, 0x7, 0x1, 0xfffffffffffffffe, 0x4, 0xbcd4, 0x1ff, 0x5, 0x100000000, 0x2, 0xc, 0x4, 0x7ff, 0x4, 0xffffffffffffff10, 0x36b54f64, 0x3, 0x6, 0x100000000, 0x8, 0x5, 0x3, 0x7aad, 0x5, 0x1ff, 0x0, 0xfb, 0x71, 0x80000000, 0x2, 0x7, 0x6, 0x60, 0x8, 0x6, 0x8, 0x4, 0x10, 0x2, 0x8, 0x8, 0xfffffffffffffe01, 0x5b, 0x7, 0x1, 0x100000000, 0x4, 0xc, 0x8000000000000001, 0x1bd, 0x100000001, 0x0, 0x3, 0x2, 0xb0, 0xb877, 0x7, 0x5, 0x3]}) ioctl$BTRFS_IOC_BALANCE_V2(r0, 0xc4009420, &(0x7f00000009c0)={0x10, 0x3, {0x9, @usage=0x2, 0x0, 0xe, 0x86, 0x5, 0x3, 0x9, 0x1, @struct={0x2, 0xfffffb31}, 0x7f, 0x100, [0x7, 0x400, 0x1, 0x7, 0xa0000000000000, 0x80]}, {0x8, @usage=0x100000000, 0x0, 0x4, 0x1a9a, 0x2, 0x1, 0x2, 0x9, @usage=0x5, 0x0, 0x3, [0x6376, 0x72, 0x800000, 0x46e, 0x100000000, 0xfd05]}, {0x6, @struct={0x4, 0x2}, 0x0, 0x7, 0x24, 0x8, 0x1, 0x7fff, 0x8, @usage=0xc9b7, 0x9, 0x0, [0x8, 0x10, 0x8, 0x0, 0x9, 0x4]}, {0x96, 0xcd84, 0x2}}) recvfrom(r0, &(0x7f0000000480)=""/6, 0x6, 0x40002000, &(0x7f00000004c0)=@ieee802154={0x24, @none={0x0, 0x1}}, 0x80) ioctl$BTRFS_IOC_BALANCE_V2(r1, 0xc4009420, &(0x7f0000000dc0)={0x0, 0x5, {0x2, @usage=0x6ee, 0x0, 0x0, 0x0, 0x2, 0x0, 0xffff, 0x81, @struct={0x0, 0x8}, 0x7, 0xfffffffc, [0xd9, 0x8, 0xf, 0x5, 0xb0, 0x8]}, {0x9, @usage=0x9, 0x0, 0x3, 0x1, 0xbeb, 0x1, 0xfffffffffffffe01, 0xa0, @usage=0x8, 0xff, 0xc8, [0x4, 0x7, 0x0, 0x9, 0x6, 0x9]}, {0x48f, @struct={0x4, 0x2475}, 0x0, 0x7, 0x7fff, 0x8, 0x9, 0x8, 0x4, @struct={0x7, 0x74d6}, 0x0, 0xfffffffc, [0xd3d3, 0x9, 0x7, 0x3ff, 0x2, 0x6]}, {0x4, 0x5, 0x9}}) ioctl$BTRFS_IOC_BALANCE_V2(r2, 0xc4009420, &(0x7f00000011c0)={0x3, 0x4, {0x3, @usage=0x6, r3, 0x1, 0x5, 0x4, 0x10000, 0x50f2, 0x1, @usage=0xce0, 0x1, 0x4, [0x6, 0x1, 0x7, 0x80000000000, 0x2, 0x9]}, {0x5, @struct={0x8, 0xb}, r4, 0x9, 0x100000000, 0x8, 0x715700000000, 0x5, 0x400, @usage=0x2, 0x7, 0x3, [0x9, 0x5, 0xd1, 0x0, 0x6, 0x8]}, {0x8, @struct={0x200, 0x9}, r5, 0x0, 0x8, 0x6, 0x25c1, 0x40, 0x400, @usage, 0x8, 0x7f, [0x0, 0x34, 0x3, 0x7, 0x3, 0x800]}, {0x6, 0x0, 0x100}}) sendmsg$nl_generic(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="702300001d00"], 0x2370}, 0x1, 0x0, 0x0, 0x8800}, 0x20048104) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=37.581661716s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_emit_ethernet-socket$nl_generic-syz_usb_connect$printer-ioctl$BTRFS_IOC_GET_DEV_STATS-ioctl$BTRFS_IOC_BALANCE_V2-recvfrom-ioctl$BTRFS_IOC_BALANCE_V2-ioctl$BTRFS_IOC_BALANCE_V2 detailed listing: executing program 0: syz_usb_connect(0x0, 0x6b, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000385352608f20446b76e8e01020301090259000104e9000909049300000e0100ff0a2401020005028a010209240603040001a53011240606040508000400050006000100050924030506030501f909240702020005cbad092403060101"], &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x1609}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) syz_emit_ethernet(0x26, &(0x7f00000000c0)=ANY=[], 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect$printer(0x4, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x0, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x18, 0x80, 0x2, "", [{{0x9, 0x4, 0x0, 0x1, 0x1, 0x7, 0x1, 0x2, 0x2, "", {{{0x9, 0x5, 0x1, 0x2, 0x400, 0x0, 0x7, 0x51}}}}}]}}]}}, &(0x7f0000001840)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x310, 0xb, 0x7, 0xe, 0x0, 0xf}, 0x3f, &(0x7f00000001c0)={0x5, 0xf, 0x3f, 0x4, [@ssp_cap={0x20, 0x10, 0xa, 0x2, 0x5, 0x7fffffb, 0x0, 0x3, [0xc0, 0x0, 0xc0, 0x3fc0, 0x11]}, @ptm_cap={0x3}, @ssp_cap={0x14, 0x10, 0xa, 0x0, 0x2, 0x7, 0xf000, 0x2, [0x0, 0xffc030]}, @ptm_cap={0x3}]}, 0x9, [{0xca, &(0x7f0000000280)=@string={0xca, 0x3, "4129fca8c09d7522c8eb99fb9c8267b5dd75fce8d0779a01d1579ddfbc2b96128cb18b53e0440c5ece41080d336e00fe8685751466ee11aeb03f0847fe3c19d79c3be34e77af4efd971aa5eb793ee1b62dc57ed6ad3e90347c6f7de6a116830dba5e57cf949bb2d7ca465d9f5dc22377fc8c468cfb924ee4b59f0aa619f31c3671b6dfcc8a4e584ce7d4c1279e3abd4d89ea205a0b7666678ca671f3a37440798305c1e9e31538bc74ae14d945a58805ac1bf2b59b90324fc80d366b693938695f496f2e8628ac56"}}, {0x52, &(0x7f0000000380)=@string={0x52, 0x3, "b28ca5b945c9b93e0f135072af6c5e2976d583751020c0b848b81aeb7210e3a15b718f9b2f7f96b555ed8f93544e964e031a536acec9c82bc162b3651d3edfe6057db11acd01f6952d144e6761699d1b"}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x809}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x140c}}, {0xed, &(0x7f00000015c0)=@string={0xed, 0x3, "4f4061b9a68a71ec741d64eb6dd4f0735685520b8e5385eab7c142ad991b2d8a64a1b4a9c4873b6f3e12f9cf0fbf5c74abeefd0e45949d050b9193dbcfdbfc572f4ebcec5cfe5604085bf0f3131c4d0925539031989c28d14226e6dae4157930fb44469f5bffa8a75cdd28c7a10d4cb45f9ae30d2656e1303eec4e62d09deb4fa06f35140d49f2709bb9e7332c16261c79878ba7b94a4349f07cfe7184f1dcb0c015948275d8f8ee9490c3ea8eae8cee42638a31d8e988f9c6a858eb7009a0c2187269a951f7c8213b7ee77df8a2e3079cab6bd38f4b6e23177cfc7bcf3f8f602bf5dd89ed976253d6bf07"}}, {0x4, &(0x7f00000016c0)=@lang_id={0x4, 0x3, 0x83e}}, {0x23, &(0x7f0000001700)=@string={0x23, 0x3, "b195097743a5ecdd60dcd69830f9c062662f81bd46d0019706c2608488fff7da6b"}}, {0x7b, &(0x7f0000001740)=@string={0x7b, 0x3, "f3a7590ef67992eeec0890c176e0a1d5cfd62e226da5cab1518424b09107fe92cbab42c3298863f9f6160c3807dce931bb8c079369bcff473f3d426262d69cf801478b4e07acd80546fe8a3a80f366ee22e2529308978029edd2aff6a5f4f8ceb21a4b2d6a8d6062e4d4957164bb5bcc4871b36f5c5bcd8de3"}}, {0x61, &(0x7f00000017c0)=@string={0x61, 0x3, "ff45d289d949937614d134b4dd912ea51b08179de5f9e732cb744eff26503b7b6584122de94a3bcb4eaa8ce360ef60524fcadf147ee03b9c782b93350c01ddb02cfb573d486c0c48c75e882adca172df8932e63979c7ca8a3e4db774c00faa"}}]}) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f0000000580)={0x0, 0x9, 0x0, [0x2, 0x81, 0x8000000000000000, 0x1, 0x1], [0x5, 0x4, 0x3, 0x401, 0x0, 0x8000000000000001, 0x10b330b0, 0xfff, 0x0, 0x2, 0x5, 0x6, 0xc, 0xcee, 0x2, 0x0, 0x7, 0x0, 0x80, 0xfffffffffffffffc, 0x8, 0x6, 0x8, 0x8, 0xff, 0x2, 0x3, 0x0, 0x4, 0x8001, 0x5, 0x9, 0xd, 0xfffffffffffffff8, 0x6, 0x200, 0x2, 0xf78, 0xfffffffffffffffa, 0xc, 0x4, 0x0, 0x502, 0x9, 0x0, 0x40, 0x2, 0xfffffffffffffff8, 0x9, 0x2, 0x10001, 0x0, 0x100, 0xff, 0x1, 0x723, 0x6, 0x3, 0x9, 0xfffffffffffffff9, 0xffffffffffffffff, 0x0, 0x7, 0x7, 0x1, 0xfffffffffffffffe, 0x4, 0xbcd4, 0x1ff, 0x5, 0x100000000, 0x2, 0xc, 0x4, 0x7ff, 0x4, 0xffffffffffffff10, 0x36b54f64, 0x3, 0x6, 0x100000000, 0x8, 0x5, 0x3, 0x7aad, 0x5, 0x1ff, 0x0, 0xfb, 0x71, 0x80000000, 0x2, 0x7, 0x6, 0x60, 0x8, 0x6, 0x8, 0x4, 0x10, 0x2, 0x8, 0x8, 0xfffffffffffffe01, 0x5b, 0x7, 0x1, 0x100000000, 0x4, 0xc, 0x8000000000000001, 0x1bd, 0x100000001, 0x0, 0x3, 0x2, 0xb0, 0xb877, 0x7, 0x5, 0x3]}) ioctl$BTRFS_IOC_BALANCE_V2(r0, 0xc4009420, &(0x7f00000009c0)={0x10, 0x3, {0x9, @usage=0x2, 0x0, 0xe, 0x86, 0x5, 0x3, 0x9, 0x1, @struct={0x2, 0xfffffb31}, 0x7f, 0x100, [0x7, 0x400, 0x1, 0x7, 0xa0000000000000, 0x80]}, {0x8, @usage=0x100000000, 0x0, 0x4, 0x1a9a, 0x2, 0x1, 0x2, 0x9, @usage=0x5, 0x0, 0x3, [0x6376, 0x72, 0x800000, 0x46e, 0x100000000, 0xfd05]}, {0x6, @struct={0x4, 0x2}, 0x0, 0x7, 0x24, 0x8, 0x1, 0x7fff, 0x8, @usage=0xc9b7, 0x9, 0x0, [0x8, 0x10, 0x8, 0x0, 0x9, 0x4]}, {0x96, 0xcd84, 0x2}}) recvfrom(r0, &(0x7f0000000480)=""/6, 0x6, 0x40002000, &(0x7f00000004c0)=@ieee802154={0x24, @none={0x0, 0x1}}, 0x80) ioctl$BTRFS_IOC_BALANCE_V2(r1, 0xc4009420, &(0x7f0000000dc0)={0x0, 0x5, {0x2, @usage=0x6ee, 0x0, 0x0, 0x0, 0x2, 0x0, 0xffff, 0x81, @struct={0x0, 0x8}, 0x7, 0xfffffffc, [0xd9, 0x8, 0xf, 0x5, 0xb0, 0x8]}, {0x9, @usage=0x9, 0x0, 0x3, 0x1, 0xbeb, 0x1, 0xfffffffffffffe01, 0xa0, @usage=0x8, 0xff, 0xc8, [0x4, 0x7, 0x0, 0x9, 0x6, 0x9]}, {0x48f, @struct={0x4, 0x2475}, 0x0, 0x7, 0x7fff, 0x8, 0x9, 0x8, 0x4, @struct={0x7, 0x74d6}, 0x0, 0xfffffffc, [0xd3d3, 0x9, 0x7, 0x3ff, 0x2, 0x6]}, {0x4, 0x5, 0x9}}) ioctl$BTRFS_IOC_BALANCE_V2(r2, 0xc4009420, &(0x7f00000011c0)={0x3, 0x4, {0x3, @usage=0x6, r3, 0x1, 0x5, 0x4, 0x10000, 0x50f2, 0x1, @usage=0xce0, 0x1, 0x4, [0x6, 0x1, 0x7, 0x80000000000, 0x2, 0x9]}, {0x5, @struct={0x8, 0xb}, r4, 0x9, 0x100000000, 0x8, 0x715700000000, 0x5, 0x400, @usage=0x2, 0x7, 0x3, [0x9, 0x5, 0xd1, 0x0, 0x6, 0x8]}, {0x8, @struct={0x200, 0x9}, r5, 0x0, 0x8, 0x6, 0x25c1, 0x40, 0x400, @usage, 0x8, 0x7f, [0x0, 0x34, 0x3, 0x7, 0x3, 0x800]}, {0x6, 0x0, 0x100}}) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=37.581661716s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_emit_ethernet-socket$nl_generic-syz_usb_connect$printer-ioctl$BTRFS_IOC_GET_DEV_STATS-ioctl$BTRFS_IOC_BALANCE_V2-recvfrom-ioctl$BTRFS_IOC_BALANCE_V2 detailed listing: executing program 0: syz_usb_connect(0x0, 0x6b, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000385352608f20446b76e8e01020301090259000104e9000909049300000e0100ff0a2401020005028a010209240603040001a53011240606040508000400050006000100050924030506030501f909240702020005cbad092403060101"], &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x1609}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) syz_emit_ethernet(0x26, &(0x7f00000000c0)=ANY=[], 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect$printer(0x4, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x0, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x18, 0x80, 0x2, "", [{{0x9, 0x4, 0x0, 0x1, 0x1, 0x7, 0x1, 0x2, 0x2, "", {{{0x9, 0x5, 0x1, 0x2, 0x400, 0x0, 0x7, 0x51}}}}}]}}]}}, &(0x7f0000001840)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x310, 0xb, 0x7, 0xe, 0x0, 0xf}, 0x3f, &(0x7f00000001c0)={0x5, 0xf, 0x3f, 0x4, [@ssp_cap={0x20, 0x10, 0xa, 0x2, 0x5, 0x7fffffb, 0x0, 0x3, [0xc0, 0x0, 0xc0, 0x3fc0, 0x11]}, @ptm_cap={0x3}, @ssp_cap={0x14, 0x10, 0xa, 0x0, 0x2, 0x7, 0xf000, 0x2, [0x0, 0xffc030]}, @ptm_cap={0x3}]}, 0x9, [{0xca, &(0x7f0000000280)=@string={0xca, 0x3, "4129fca8c09d7522c8eb99fb9c8267b5dd75fce8d0779a01d1579ddfbc2b96128cb18b53e0440c5ece41080d336e00fe8685751466ee11aeb03f0847fe3c19d79c3be34e77af4efd971aa5eb793ee1b62dc57ed6ad3e90347c6f7de6a116830dba5e57cf949bb2d7ca465d9f5dc22377fc8c468cfb924ee4b59f0aa619f31c3671b6dfcc8a4e584ce7d4c1279e3abd4d89ea205a0b7666678ca671f3a37440798305c1e9e31538bc74ae14d945a58805ac1bf2b59b90324fc80d366b693938695f496f2e8628ac56"}}, {0x52, &(0x7f0000000380)=@string={0x52, 0x3, "b28ca5b945c9b93e0f135072af6c5e2976d583751020c0b848b81aeb7210e3a15b718f9b2f7f96b555ed8f93544e964e031a536acec9c82bc162b3651d3edfe6057db11acd01f6952d144e6761699d1b"}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x809}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x140c}}, {0xed, &(0x7f00000015c0)=@string={0xed, 0x3, "4f4061b9a68a71ec741d64eb6dd4f0735685520b8e5385eab7c142ad991b2d8a64a1b4a9c4873b6f3e12f9cf0fbf5c74abeefd0e45949d050b9193dbcfdbfc572f4ebcec5cfe5604085bf0f3131c4d0925539031989c28d14226e6dae4157930fb44469f5bffa8a75cdd28c7a10d4cb45f9ae30d2656e1303eec4e62d09deb4fa06f35140d49f2709bb9e7332c16261c79878ba7b94a4349f07cfe7184f1dcb0c015948275d8f8ee9490c3ea8eae8cee42638a31d8e988f9c6a858eb7009a0c2187269a951f7c8213b7ee77df8a2e3079cab6bd38f4b6e23177cfc7bcf3f8f602bf5dd89ed976253d6bf07"}}, {0x4, &(0x7f00000016c0)=@lang_id={0x4, 0x3, 0x83e}}, {0x23, &(0x7f0000001700)=@string={0x23, 0x3, "b195097743a5ecdd60dcd69830f9c062662f81bd46d0019706c2608488fff7da6b"}}, {0x7b, &(0x7f0000001740)=@string={0x7b, 0x3, "f3a7590ef67992eeec0890c176e0a1d5cfd62e226da5cab1518424b09107fe92cbab42c3298863f9f6160c3807dce931bb8c079369bcff473f3d426262d69cf801478b4e07acd80546fe8a3a80f366ee22e2529308978029edd2aff6a5f4f8ceb21a4b2d6a8d6062e4d4957164bb5bcc4871b36f5c5bcd8de3"}}, {0x61, &(0x7f00000017c0)=@string={0x61, 0x3, "ff45d289d949937614d134b4dd912ea51b08179de5f9e732cb744eff26503b7b6584122de94a3bcb4eaa8ce360ef60524fcadf147ee03b9c782b93350c01ddb02cfb573d486c0c48c75e882adca172df8932e63979c7ca8a3e4db774c00faa"}}]}) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f0000000580)={0x0, 0x9, 0x0, [0x2, 0x81, 0x8000000000000000, 0x1, 0x1], [0x5, 0x4, 0x3, 0x401, 0x0, 0x8000000000000001, 0x10b330b0, 0xfff, 0x0, 0x2, 0x5, 0x6, 0xc, 0xcee, 0x2, 0x0, 0x7, 0x0, 0x80, 0xfffffffffffffffc, 0x8, 0x6, 0x8, 0x8, 0xff, 0x2, 0x3, 0x0, 0x4, 0x8001, 0x5, 0x9, 0xd, 0xfffffffffffffff8, 0x6, 0x200, 0x2, 0xf78, 0xfffffffffffffffa, 0xc, 0x4, 0x0, 0x502, 0x9, 0x0, 0x40, 0x2, 0xfffffffffffffff8, 0x9, 0x2, 0x10001, 0x0, 0x100, 0xff, 0x1, 0x723, 0x6, 0x3, 0x9, 0xfffffffffffffff9, 0xffffffffffffffff, 0x0, 0x7, 0x7, 0x1, 0xfffffffffffffffe, 0x4, 0xbcd4, 0x1ff, 0x5, 0x100000000, 0x2, 0xc, 0x4, 0x7ff, 0x4, 0xffffffffffffff10, 0x36b54f64, 0x3, 0x6, 0x100000000, 0x8, 0x5, 0x3, 0x7aad, 0x5, 0x1ff, 0x0, 0xfb, 0x71, 0x80000000, 0x2, 0x7, 0x6, 0x60, 0x8, 0x6, 0x8, 0x4, 0x10, 0x2, 0x8, 0x8, 0xfffffffffffffe01, 0x5b, 0x7, 0x1, 0x100000000, 0x4, 0xc, 0x8000000000000001, 0x1bd, 0x100000001, 0x0, 0x3, 0x2, 0xb0, 0xb877, 0x7, 0x5, 0x3]}) ioctl$BTRFS_IOC_BALANCE_V2(r0, 0xc4009420, &(0x7f00000009c0)={0x10, 0x3, {0x9, @usage=0x2, 0x0, 0xe, 0x86, 0x5, 0x3, 0x9, 0x1, @struct={0x2, 0xfffffb31}, 0x7f, 0x100, [0x7, 0x400, 0x1, 0x7, 0xa0000000000000, 0x80]}, {0x8, @usage=0x100000000, 0x0, 0x4, 0x1a9a, 0x2, 0x1, 0x2, 0x9, @usage=0x5, 0x0, 0x3, [0x6376, 0x72, 0x800000, 0x46e, 0x100000000, 0xfd05]}, {0x6, @struct={0x4, 0x2}, 0x0, 0x7, 0x24, 0x8, 0x1, 0x7fff, 0x8, @usage=0xc9b7, 0x9, 0x0, [0x8, 0x10, 0x8, 0x0, 0x9, 0x4]}, {0x96, 0xcd84, 0x2}}) recvfrom(r0, &(0x7f0000000480)=""/6, 0x6, 0x40002000, &(0x7f00000004c0)=@ieee802154={0x24, @none={0x0, 0x1}}, 0x80) ioctl$BTRFS_IOC_BALANCE_V2(r1, 0xc4009420, &(0x7f0000000dc0)={0x0, 0x5, {0x2, @usage=0x6ee, 0x0, 0x0, 0x0, 0x2, 0x0, 0xffff, 0x81, @struct={0x0, 0x8}, 0x7, 0xfffffffc, [0xd9, 0x8, 0xf, 0x5, 0xb0, 0x8]}, {0x9, @usage=0x9, 0x0, 0x3, 0x1, 0xbeb, 0x1, 0xfffffffffffffe01, 0xa0, @usage=0x8, 0xff, 0xc8, [0x4, 0x7, 0x0, 0x9, 0x6, 0x9]}, {0x48f, @struct={0x4, 0x2475}, 0x0, 0x7, 0x7fff, 0x8, 0x9, 0x8, 0x4, @struct={0x7, 0x74d6}, 0x0, 0xfffffffc, [0xd3d3, 0x9, 0x7, 0x3ff, 0x2, 0x6]}, {0x4, 0x5, 0x9}}) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=37.581661716s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_emit_ethernet-socket$nl_generic-syz_usb_connect$printer-ioctl$BTRFS_IOC_GET_DEV_STATS-ioctl$BTRFS_IOC_BALANCE_V2-recvfrom detailed listing: executing program 0: syz_usb_connect(0x0, 0x6b, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000385352608f20446b76e8e01020301090259000104e9000909049300000e0100ff0a2401020005028a010209240603040001a53011240606040508000400050006000100050924030506030501f909240702020005cbad092403060101"], &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x1609}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) syz_emit_ethernet(0x26, &(0x7f00000000c0)=ANY=[], 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect$printer(0x4, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x0, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x18, 0x80, 0x2, "", [{{0x9, 0x4, 0x0, 0x1, 0x1, 0x7, 0x1, 0x2, 0x2, "", {{{0x9, 0x5, 0x1, 0x2, 0x400, 0x0, 0x7, 0x51}}}}}]}}]}}, &(0x7f0000001840)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x310, 0xb, 0x7, 0xe, 0x0, 0xf}, 0x3f, &(0x7f00000001c0)={0x5, 0xf, 0x3f, 0x4, [@ssp_cap={0x20, 0x10, 0xa, 0x2, 0x5, 0x7fffffb, 0x0, 0x3, [0xc0, 0x0, 0xc0, 0x3fc0, 0x11]}, @ptm_cap={0x3}, @ssp_cap={0x14, 0x10, 0xa, 0x0, 0x2, 0x7, 0xf000, 0x2, [0x0, 0xffc030]}, @ptm_cap={0x3}]}, 0x9, [{0xca, &(0x7f0000000280)=@string={0xca, 0x3, "4129fca8c09d7522c8eb99fb9c8267b5dd75fce8d0779a01d1579ddfbc2b96128cb18b53e0440c5ece41080d336e00fe8685751466ee11aeb03f0847fe3c19d79c3be34e77af4efd971aa5eb793ee1b62dc57ed6ad3e90347c6f7de6a116830dba5e57cf949bb2d7ca465d9f5dc22377fc8c468cfb924ee4b59f0aa619f31c3671b6dfcc8a4e584ce7d4c1279e3abd4d89ea205a0b7666678ca671f3a37440798305c1e9e31538bc74ae14d945a58805ac1bf2b59b90324fc80d366b693938695f496f2e8628ac56"}}, {0x52, &(0x7f0000000380)=@string={0x52, 0x3, "b28ca5b945c9b93e0f135072af6c5e2976d583751020c0b848b81aeb7210e3a15b718f9b2f7f96b555ed8f93544e964e031a536acec9c82bc162b3651d3edfe6057db11acd01f6952d144e6761699d1b"}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x809}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x140c}}, {0xed, &(0x7f00000015c0)=@string={0xed, 0x3, "4f4061b9a68a71ec741d64eb6dd4f0735685520b8e5385eab7c142ad991b2d8a64a1b4a9c4873b6f3e12f9cf0fbf5c74abeefd0e45949d050b9193dbcfdbfc572f4ebcec5cfe5604085bf0f3131c4d0925539031989c28d14226e6dae4157930fb44469f5bffa8a75cdd28c7a10d4cb45f9ae30d2656e1303eec4e62d09deb4fa06f35140d49f2709bb9e7332c16261c79878ba7b94a4349f07cfe7184f1dcb0c015948275d8f8ee9490c3ea8eae8cee42638a31d8e988f9c6a858eb7009a0c2187269a951f7c8213b7ee77df8a2e3079cab6bd38f4b6e23177cfc7bcf3f8f602bf5dd89ed976253d6bf07"}}, {0x4, &(0x7f00000016c0)=@lang_id={0x4, 0x3, 0x83e}}, {0x23, &(0x7f0000001700)=@string={0x23, 0x3, "b195097743a5ecdd60dcd69830f9c062662f81bd46d0019706c2608488fff7da6b"}}, {0x7b, &(0x7f0000001740)=@string={0x7b, 0x3, "f3a7590ef67992eeec0890c176e0a1d5cfd62e226da5cab1518424b09107fe92cbab42c3298863f9f6160c3807dce931bb8c079369bcff473f3d426262d69cf801478b4e07acd80546fe8a3a80f366ee22e2529308978029edd2aff6a5f4f8ceb21a4b2d6a8d6062e4d4957164bb5bcc4871b36f5c5bcd8de3"}}, {0x61, &(0x7f00000017c0)=@string={0x61, 0x3, "ff45d289d949937614d134b4dd912ea51b08179de5f9e732cb744eff26503b7b6584122de94a3bcb4eaa8ce360ef60524fcadf147ee03b9c782b93350c01ddb02cfb573d486c0c48c75e882adca172df8932e63979c7ca8a3e4db774c00faa"}}]}) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f0000000580)={0x0, 0x9, 0x0, [0x2, 0x81, 0x8000000000000000, 0x1, 0x1], [0x5, 0x4, 0x3, 0x401, 0x0, 0x8000000000000001, 0x10b330b0, 0xfff, 0x0, 0x2, 0x5, 0x6, 0xc, 0xcee, 0x2, 0x0, 0x7, 0x0, 0x80, 0xfffffffffffffffc, 0x8, 0x6, 0x8, 0x8, 0xff, 0x2, 0x3, 0x0, 0x4, 0x8001, 0x5, 0x9, 0xd, 0xfffffffffffffff8, 0x6, 0x200, 0x2, 0xf78, 0xfffffffffffffffa, 0xc, 0x4, 0x0, 0x502, 0x9, 0x0, 0x40, 0x2, 0xfffffffffffffff8, 0x9, 0x2, 0x10001, 0x0, 0x100, 0xff, 0x1, 0x723, 0x6, 0x3, 0x9, 0xfffffffffffffff9, 0xffffffffffffffff, 0x0, 0x7, 0x7, 0x1, 0xfffffffffffffffe, 0x4, 0xbcd4, 0x1ff, 0x5, 0x100000000, 0x2, 0xc, 0x4, 0x7ff, 0x4, 0xffffffffffffff10, 0x36b54f64, 0x3, 0x6, 0x100000000, 0x8, 0x5, 0x3, 0x7aad, 0x5, 0x1ff, 0x0, 0xfb, 0x71, 0x80000000, 0x2, 0x7, 0x6, 0x60, 0x8, 0x6, 0x8, 0x4, 0x10, 0x2, 0x8, 0x8, 0xfffffffffffffe01, 0x5b, 0x7, 0x1, 0x100000000, 0x4, 0xc, 0x8000000000000001, 0x1bd, 0x100000001, 0x0, 0x3, 0x2, 0xb0, 0xb877, 0x7, 0x5, 0x3]}) ioctl$BTRFS_IOC_BALANCE_V2(r0, 0xc4009420, &(0x7f00000009c0)={0x10, 0x3, {0x9, @usage=0x2, 0x0, 0xe, 0x86, 0x5, 0x3, 0x9, 0x1, @struct={0x2, 0xfffffb31}, 0x7f, 0x100, [0x7, 0x400, 0x1, 0x7, 0xa0000000000000, 0x80]}, {0x8, @usage=0x100000000, 0x0, 0x4, 0x1a9a, 0x2, 0x1, 0x2, 0x9, @usage=0x5, 0x0, 0x3, [0x6376, 0x72, 0x800000, 0x46e, 0x100000000, 0xfd05]}, {0x6, @struct={0x4, 0x2}, 0x0, 0x7, 0x24, 0x8, 0x1, 0x7fff, 0x8, @usage=0xc9b7, 0x9, 0x0, [0x8, 0x10, 0x8, 0x0, 0x9, 0x4]}, {0x96, 0xcd84, 0x2}}) recvfrom(r0, &(0x7f0000000480)=""/6, 0x6, 0x40002000, &(0x7f00000004c0)=@ieee802154={0x24, @none={0x0, 0x1}}, 0x80) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=37.581661716s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_emit_ethernet-socket$nl_generic-syz_usb_connect$printer-ioctl$BTRFS_IOC_GET_DEV_STATS-ioctl$BTRFS_IOC_BALANCE_V2 detailed listing: executing program 0: syz_usb_connect(0x0, 0x6b, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000385352608f20446b76e8e01020301090259000104e9000909049300000e0100ff0a2401020005028a010209240603040001a53011240606040508000400050006000100050924030506030501f909240702020005cbad092403060101"], &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x1609}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) syz_emit_ethernet(0x26, &(0x7f00000000c0)=ANY=[], 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect$printer(0x4, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x0, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x18, 0x80, 0x2, "", [{{0x9, 0x4, 0x0, 0x1, 0x1, 0x7, 0x1, 0x2, 0x2, "", {{{0x9, 0x5, 0x1, 0x2, 0x400, 0x0, 0x7, 0x51}}}}}]}}]}}, &(0x7f0000001840)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x310, 0xb, 0x7, 0xe, 0x0, 0xf}, 0x3f, &(0x7f00000001c0)={0x5, 0xf, 0x3f, 0x4, [@ssp_cap={0x20, 0x10, 0xa, 0x2, 0x5, 0x7fffffb, 0x0, 0x3, [0xc0, 0x0, 0xc0, 0x3fc0, 0x11]}, @ptm_cap={0x3}, @ssp_cap={0x14, 0x10, 0xa, 0x0, 0x2, 0x7, 0xf000, 0x2, [0x0, 0xffc030]}, @ptm_cap={0x3}]}, 0x9, [{0xca, &(0x7f0000000280)=@string={0xca, 0x3, "4129fca8c09d7522c8eb99fb9c8267b5dd75fce8d0779a01d1579ddfbc2b96128cb18b53e0440c5ece41080d336e00fe8685751466ee11aeb03f0847fe3c19d79c3be34e77af4efd971aa5eb793ee1b62dc57ed6ad3e90347c6f7de6a116830dba5e57cf949bb2d7ca465d9f5dc22377fc8c468cfb924ee4b59f0aa619f31c3671b6dfcc8a4e584ce7d4c1279e3abd4d89ea205a0b7666678ca671f3a37440798305c1e9e31538bc74ae14d945a58805ac1bf2b59b90324fc80d366b693938695f496f2e8628ac56"}}, {0x52, &(0x7f0000000380)=@string={0x52, 0x3, "b28ca5b945c9b93e0f135072af6c5e2976d583751020c0b848b81aeb7210e3a15b718f9b2f7f96b555ed8f93544e964e031a536acec9c82bc162b3651d3edfe6057db11acd01f6952d144e6761699d1b"}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x809}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x140c}}, {0xed, &(0x7f00000015c0)=@string={0xed, 0x3, "4f4061b9a68a71ec741d64eb6dd4f0735685520b8e5385eab7c142ad991b2d8a64a1b4a9c4873b6f3e12f9cf0fbf5c74abeefd0e45949d050b9193dbcfdbfc572f4ebcec5cfe5604085bf0f3131c4d0925539031989c28d14226e6dae4157930fb44469f5bffa8a75cdd28c7a10d4cb45f9ae30d2656e1303eec4e62d09deb4fa06f35140d49f2709bb9e7332c16261c79878ba7b94a4349f07cfe7184f1dcb0c015948275d8f8ee9490c3ea8eae8cee42638a31d8e988f9c6a858eb7009a0c2187269a951f7c8213b7ee77df8a2e3079cab6bd38f4b6e23177cfc7bcf3f8f602bf5dd89ed976253d6bf07"}}, {0x4, &(0x7f00000016c0)=@lang_id={0x4, 0x3, 0x83e}}, {0x23, &(0x7f0000001700)=@string={0x23, 0x3, "b195097743a5ecdd60dcd69830f9c062662f81bd46d0019706c2608488fff7da6b"}}, {0x7b, &(0x7f0000001740)=@string={0x7b, 0x3, "f3a7590ef67992eeec0890c176e0a1d5cfd62e226da5cab1518424b09107fe92cbab42c3298863f9f6160c3807dce931bb8c079369bcff473f3d426262d69cf801478b4e07acd80546fe8a3a80f366ee22e2529308978029edd2aff6a5f4f8ceb21a4b2d6a8d6062e4d4957164bb5bcc4871b36f5c5bcd8de3"}}, {0x61, &(0x7f00000017c0)=@string={0x61, 0x3, "ff45d289d949937614d134b4dd912ea51b08179de5f9e732cb744eff26503b7b6584122de94a3bcb4eaa8ce360ef60524fcadf147ee03b9c782b93350c01ddb02cfb573d486c0c48c75e882adca172df8932e63979c7ca8a3e4db774c00faa"}}]}) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f0000000580)={0x0, 0x9, 0x0, [0x2, 0x81, 0x8000000000000000, 0x1, 0x1], [0x5, 0x4, 0x3, 0x401, 0x0, 0x8000000000000001, 0x10b330b0, 0xfff, 0x0, 0x2, 0x5, 0x6, 0xc, 0xcee, 0x2, 0x0, 0x7, 0x0, 0x80, 0xfffffffffffffffc, 0x8, 0x6, 0x8, 0x8, 0xff, 0x2, 0x3, 0x0, 0x4, 0x8001, 0x5, 0x9, 0xd, 0xfffffffffffffff8, 0x6, 0x200, 0x2, 0xf78, 0xfffffffffffffffa, 0xc, 0x4, 0x0, 0x502, 0x9, 0x0, 0x40, 0x2, 0xfffffffffffffff8, 0x9, 0x2, 0x10001, 0x0, 0x100, 0xff, 0x1, 0x723, 0x6, 0x3, 0x9, 0xfffffffffffffff9, 0xffffffffffffffff, 0x0, 0x7, 0x7, 0x1, 0xfffffffffffffffe, 0x4, 0xbcd4, 0x1ff, 0x5, 0x100000000, 0x2, 0xc, 0x4, 0x7ff, 0x4, 0xffffffffffffff10, 0x36b54f64, 0x3, 0x6, 0x100000000, 0x8, 0x5, 0x3, 0x7aad, 0x5, 0x1ff, 0x0, 0xfb, 0x71, 0x80000000, 0x2, 0x7, 0x6, 0x60, 0x8, 0x6, 0x8, 0x4, 0x10, 0x2, 0x8, 0x8, 0xfffffffffffffe01, 0x5b, 0x7, 0x1, 0x100000000, 0x4, 0xc, 0x8000000000000001, 0x1bd, 0x100000001, 0x0, 0x3, 0x2, 0xb0, 0xb877, 0x7, 0x5, 0x3]}) ioctl$BTRFS_IOC_BALANCE_V2(r0, 0xc4009420, &(0x7f00000009c0)={0x10, 0x3, {0x9, @usage=0x2, 0x0, 0xe, 0x86, 0x5, 0x3, 0x9, 0x1, @struct={0x2, 0xfffffb31}, 0x7f, 0x100, [0x7, 0x400, 0x1, 0x7, 0xa0000000000000, 0x80]}, {0x8, @usage=0x100000000, 0x0, 0x4, 0x1a9a, 0x2, 0x1, 0x2, 0x9, @usage=0x5, 0x0, 0x3, [0x6376, 0x72, 0x800000, 0x46e, 0x100000000, 0xfd05]}, {0x6, @struct={0x4, 0x2}, 0x0, 0x7, 0x24, 0x8, 0x1, 0x7fff, 0x8, @usage=0xc9b7, 0x9, 0x0, [0x8, 0x10, 0x8, 0x0, 0x9, 0x4]}, {0x96, 0xcd84, 0x2}}) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=37.581661716s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_emit_ethernet-socket$nl_generic-syz_usb_connect$printer-ioctl$BTRFS_IOC_GET_DEV_STATS detailed listing: executing program 0: syz_usb_connect(0x0, 0x6b, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000385352608f20446b76e8e01020301090259000104e9000909049300000e0100ff0a2401020005028a010209240603040001a53011240606040508000400050006000100050924030506030501f909240702020005cbad092403060101"], &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x1609}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) syz_emit_ethernet(0x26, &(0x7f00000000c0)=ANY=[], 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect$printer(0x4, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x0, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x18, 0x80, 0x2, "", [{{0x9, 0x4, 0x0, 0x1, 0x1, 0x7, 0x1, 0x2, 0x2, "", {{{0x9, 0x5, 0x1, 0x2, 0x400, 0x0, 0x7, 0x51}}}}}]}}]}}, &(0x7f0000001840)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x310, 0xb, 0x7, 0xe, 0x0, 0xf}, 0x3f, &(0x7f00000001c0)={0x5, 0xf, 0x3f, 0x4, [@ssp_cap={0x20, 0x10, 0xa, 0x2, 0x5, 0x7fffffb, 0x0, 0x3, [0xc0, 0x0, 0xc0, 0x3fc0, 0x11]}, @ptm_cap={0x3}, @ssp_cap={0x14, 0x10, 0xa, 0x0, 0x2, 0x7, 0xf000, 0x2, [0x0, 0xffc030]}, @ptm_cap={0x3}]}, 0x9, [{0xca, &(0x7f0000000280)=@string={0xca, 0x3, "4129fca8c09d7522c8eb99fb9c8267b5dd75fce8d0779a01d1579ddfbc2b96128cb18b53e0440c5ece41080d336e00fe8685751466ee11aeb03f0847fe3c19d79c3be34e77af4efd971aa5eb793ee1b62dc57ed6ad3e90347c6f7de6a116830dba5e57cf949bb2d7ca465d9f5dc22377fc8c468cfb924ee4b59f0aa619f31c3671b6dfcc8a4e584ce7d4c1279e3abd4d89ea205a0b7666678ca671f3a37440798305c1e9e31538bc74ae14d945a58805ac1bf2b59b90324fc80d366b693938695f496f2e8628ac56"}}, {0x52, &(0x7f0000000380)=@string={0x52, 0x3, "b28ca5b945c9b93e0f135072af6c5e2976d583751020c0b848b81aeb7210e3a15b718f9b2f7f96b555ed8f93544e964e031a536acec9c82bc162b3651d3edfe6057db11acd01f6952d144e6761699d1b"}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x809}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x140c}}, {0xed, &(0x7f00000015c0)=@string={0xed, 0x3, "4f4061b9a68a71ec741d64eb6dd4f0735685520b8e5385eab7c142ad991b2d8a64a1b4a9c4873b6f3e12f9cf0fbf5c74abeefd0e45949d050b9193dbcfdbfc572f4ebcec5cfe5604085bf0f3131c4d0925539031989c28d14226e6dae4157930fb44469f5bffa8a75cdd28c7a10d4cb45f9ae30d2656e1303eec4e62d09deb4fa06f35140d49f2709bb9e7332c16261c79878ba7b94a4349f07cfe7184f1dcb0c015948275d8f8ee9490c3ea8eae8cee42638a31d8e988f9c6a858eb7009a0c2187269a951f7c8213b7ee77df8a2e3079cab6bd38f4b6e23177cfc7bcf3f8f602bf5dd89ed976253d6bf07"}}, {0x4, &(0x7f00000016c0)=@lang_id={0x4, 0x3, 0x83e}}, {0x23, &(0x7f0000001700)=@string={0x23, 0x3, "b195097743a5ecdd60dcd69830f9c062662f81bd46d0019706c2608488fff7da6b"}}, {0x7b, &(0x7f0000001740)=@string={0x7b, 0x3, "f3a7590ef67992eeec0890c176e0a1d5cfd62e226da5cab1518424b09107fe92cbab42c3298863f9f6160c3807dce931bb8c079369bcff473f3d426262d69cf801478b4e07acd80546fe8a3a80f366ee22e2529308978029edd2aff6a5f4f8ceb21a4b2d6a8d6062e4d4957164bb5bcc4871b36f5c5bcd8de3"}}, {0x61, &(0x7f00000017c0)=@string={0x61, 0x3, "ff45d289d949937614d134b4dd912ea51b08179de5f9e732cb744eff26503b7b6584122de94a3bcb4eaa8ce360ef60524fcadf147ee03b9c782b93350c01ddb02cfb573d486c0c48c75e882adca172df8932e63979c7ca8a3e4db774c00faa"}}]}) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f0000000580)={0x0, 0x9, 0x0, [0x2, 0x81, 0x8000000000000000, 0x1, 0x1], [0x5, 0x4, 0x3, 0x401, 0x0, 0x8000000000000001, 0x10b330b0, 0xfff, 0x0, 0x2, 0x5, 0x6, 0xc, 0xcee, 0x2, 0x0, 0x7, 0x0, 0x80, 0xfffffffffffffffc, 0x8, 0x6, 0x8, 0x8, 0xff, 0x2, 0x3, 0x0, 0x4, 0x8001, 0x5, 0x9, 0xd, 0xfffffffffffffff8, 0x6, 0x200, 0x2, 0xf78, 0xfffffffffffffffa, 0xc, 0x4, 0x0, 0x502, 0x9, 0x0, 0x40, 0x2, 0xfffffffffffffff8, 0x9, 0x2, 0x10001, 0x0, 0x100, 0xff, 0x1, 0x723, 0x6, 0x3, 0x9, 0xfffffffffffffff9, 0xffffffffffffffff, 0x0, 0x7, 0x7, 0x1, 0xfffffffffffffffe, 0x4, 0xbcd4, 0x1ff, 0x5, 0x100000000, 0x2, 0xc, 0x4, 0x7ff, 0x4, 0xffffffffffffff10, 0x36b54f64, 0x3, 0x6, 0x100000000, 0x8, 0x5, 0x3, 0x7aad, 0x5, 0x1ff, 0x0, 0xfb, 0x71, 0x80000000, 0x2, 0x7, 0x6, 0x60, 0x8, 0x6, 0x8, 0x4, 0x10, 0x2, 0x8, 0x8, 0xfffffffffffffe01, 0x5b, 0x7, 0x1, 0x100000000, 0x4, 0xc, 0x8000000000000001, 0x1bd, 0x100000001, 0x0, 0x3, 0x2, 0xb0, 0xb877, 0x7, 0x5, 0x3]}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=37.581661716s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_emit_ethernet-socket$nl_generic-syz_usb_connect$printer detailed listing: executing program 0: syz_usb_connect(0x0, 0x6b, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000385352608f20446b76e8e01020301090259000104e9000909049300000e0100ff0a2401020005028a010209240603040001a53011240606040508000400050006000100050924030506030501f909240702020005cbad092403060101"], &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x1609}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) syz_emit_ethernet(0x26, &(0x7f00000000c0)=ANY=[], 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect$printer(0x4, 0x2d, &(0x7f00000000c0)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x0, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x1, 0x18, 0x80, 0x2, "", [{{0x9, 0x4, 0x0, 0x1, 0x1, 0x7, 0x1, 0x2, 0x2, "", {{{0x9, 0x5, 0x1, 0x2, 0x400, 0x0, 0x7, 0x51}}}}}]}}]}}, &(0x7f0000001840)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x310, 0xb, 0x7, 0xe, 0x0, 0xf}, 0x3f, &(0x7f00000001c0)={0x5, 0xf, 0x3f, 0x4, [@ssp_cap={0x20, 0x10, 0xa, 0x2, 0x5, 0x7fffffb, 0x0, 0x3, [0xc0, 0x0, 0xc0, 0x3fc0, 0x11]}, @ptm_cap={0x3}, @ssp_cap={0x14, 0x10, 0xa, 0x0, 0x2, 0x7, 0xf000, 0x2, [0x0, 0xffc030]}, @ptm_cap={0x3}]}, 0x9, [{0xca, &(0x7f0000000280)=@string={0xca, 0x3, "4129fca8c09d7522c8eb99fb9c8267b5dd75fce8d0779a01d1579ddfbc2b96128cb18b53e0440c5ece41080d336e00fe8685751466ee11aeb03f0847fe3c19d79c3be34e77af4efd971aa5eb793ee1b62dc57ed6ad3e90347c6f7de6a116830dba5e57cf949bb2d7ca465d9f5dc22377fc8c468cfb924ee4b59f0aa619f31c3671b6dfcc8a4e584ce7d4c1279e3abd4d89ea205a0b7666678ca671f3a37440798305c1e9e31538bc74ae14d945a58805ac1bf2b59b90324fc80d366b693938695f496f2e8628ac56"}}, {0x52, &(0x7f0000000380)=@string={0x52, 0x3, "b28ca5b945c9b93e0f135072af6c5e2976d583751020c0b848b81aeb7210e3a15b718f9b2f7f96b555ed8f93544e964e031a536acec9c82bc162b3651d3edfe6057db11acd01f6952d144e6761699d1b"}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x809}}, {0x4, &(0x7f0000000440)=@lang_id={0x4, 0x3, 0x140c}}, {0xed, &(0x7f00000015c0)=@string={0xed, 0x3, "4f4061b9a68a71ec741d64eb6dd4f0735685520b8e5385eab7c142ad991b2d8a64a1b4a9c4873b6f3e12f9cf0fbf5c74abeefd0e45949d050b9193dbcfdbfc572f4ebcec5cfe5604085bf0f3131c4d0925539031989c28d14226e6dae4157930fb44469f5bffa8a75cdd28c7a10d4cb45f9ae30d2656e1303eec4e62d09deb4fa06f35140d49f2709bb9e7332c16261c79878ba7b94a4349f07cfe7184f1dcb0c015948275d8f8ee9490c3ea8eae8cee42638a31d8e988f9c6a858eb7009a0c2187269a951f7c8213b7ee77df8a2e3079cab6bd38f4b6e23177cfc7bcf3f8f602bf5dd89ed976253d6bf07"}}, {0x4, &(0x7f00000016c0)=@lang_id={0x4, 0x3, 0x83e}}, {0x23, &(0x7f0000001700)=@string={0x23, 0x3, "b195097743a5ecdd60dcd69830f9c062662f81bd46d0019706c2608488fff7da6b"}}, {0x7b, &(0x7f0000001740)=@string={0x7b, 0x3, "f3a7590ef67992eeec0890c176e0a1d5cfd62e226da5cab1518424b09107fe92cbab42c3298863f9f6160c3807dce931bb8c079369bcff473f3d426262d69cf801478b4e07acd80546fe8a3a80f366ee22e2529308978029edd2aff6a5f4f8ceb21a4b2d6a8d6062e4d4957164bb5bcc4871b36f5c5bcd8de3"}}, {0x61, &(0x7f00000017c0)=@string={0x61, 0x3, "ff45d289d949937614d134b4dd912ea51b08179de5f9e732cb744eff26503b7b6584122de94a3bcb4eaa8ce360ef60524fcadf147ee03b9c782b93350c01ddb02cfb573d486c0c48c75e882adca172df8932e63979c7ca8a3e4db774c00faa"}}]}) program did not crash testing program (duration=37.581661716s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_emit_ethernet-socket$nl_generic-ioctl$BTRFS_IOC_GET_DEV_STATS detailed listing: executing program 0: syz_usb_connect(0x0, 0x6b, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000385352608f20446b76e8e01020301090259000104e9000909049300000e0100ff0a2401020005028a010209240603040001a53011240606040508000400050006000100050924030506030501f909240702020005cbad092403060101"], &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x1609}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) syz_emit_ethernet(0x26, &(0x7f00000000c0)=ANY=[], 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f0000000580)={0x0, 0x9, 0x0, [0x2, 0x81, 0x8000000000000000, 0x1, 0x1], [0x5, 0x4, 0x3, 0x401, 0x0, 0x8000000000000001, 0x10b330b0, 0xfff, 0x0, 0x2, 0x5, 0x6, 0xc, 0xcee, 0x2, 0x0, 0x7, 0x0, 0x80, 0xfffffffffffffffc, 0x8, 0x6, 0x8, 0x8, 0xff, 0x2, 0x3, 0x0, 0x4, 0x8001, 0x5, 0x9, 0xd, 0xfffffffffffffff8, 0x6, 0x200, 0x2, 0xf78, 0xfffffffffffffffa, 0xc, 0x4, 0x0, 0x502, 0x9, 0x0, 0x40, 0x2, 0xfffffffffffffff8, 0x9, 0x2, 0x10001, 0x0, 0x100, 0xff, 0x1, 0x723, 0x6, 0x3, 0x9, 0xfffffffffffffff9, 0xffffffffffffffff, 0x0, 0x7, 0x7, 0x1, 0xfffffffffffffffe, 0x4, 0xbcd4, 0x1ff, 0x5, 0x100000000, 0x2, 0xc, 0x4, 0x7ff, 0x4, 0xffffffffffffff10, 0x36b54f64, 0x3, 0x6, 0x100000000, 0x8, 0x5, 0x3, 0x7aad, 0x5, 0x1ff, 0x0, 0xfb, 0x71, 0x80000000, 0x2, 0x7, 0x6, 0x60, 0x8, 0x6, 0x8, 0x4, 0x10, 0x2, 0x8, 0x8, 0xfffffffffffffe01, 0x5b, 0x7, 0x1, 0x100000000, 0x4, 0xc, 0x8000000000000001, 0x1bd, 0x100000001, 0x0, 0x3, 0x2, 0xb0, 0xb877, 0x7, 0x5, 0x3]}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=37.581661716s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_emit_ethernet-ioctl$BTRFS_IOC_GET_DEV_STATS detailed listing: executing program 0: syz_usb_connect(0x0, 0x6b, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000385352608f20446b76e8e01020301090259000104e9000909049300000e0100ff0a2401020005028a010209240603040001a53011240606040508000400050006000100050924030506030501f909240702020005cbad092403060101"], &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x1609}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) syz_emit_ethernet(0x26, &(0x7f00000000c0)=ANY=[], 0x0) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f0000000580)={0x0, 0x9, 0x0, [0x2, 0x81, 0x8000000000000000, 0x1, 0x1], [0x5, 0x4, 0x3, 0x401, 0x0, 0x8000000000000001, 0x10b330b0, 0xfff, 0x0, 0x2, 0x5, 0x6, 0xc, 0xcee, 0x2, 0x0, 0x7, 0x0, 0x80, 0xfffffffffffffffc, 0x8, 0x6, 0x8, 0x8, 0xff, 0x2, 0x3, 0x0, 0x4, 0x8001, 0x5, 0x9, 0xd, 0xfffffffffffffff8, 0x6, 0x200, 0x2, 0xf78, 0xfffffffffffffffa, 0xc, 0x4, 0x0, 0x502, 0x9, 0x0, 0x40, 0x2, 0xfffffffffffffff8, 0x9, 0x2, 0x10001, 0x0, 0x100, 0xff, 0x1, 0x723, 0x6, 0x3, 0x9, 0xfffffffffffffff9, 0xffffffffffffffff, 0x0, 0x7, 0x7, 0x1, 0xfffffffffffffffe, 0x4, 0xbcd4, 0x1ff, 0x5, 0x100000000, 0x2, 0xc, 0x4, 0x7ff, 0x4, 0xffffffffffffff10, 0x36b54f64, 0x3, 0x6, 0x100000000, 0x8, 0x5, 0x3, 0x7aad, 0x5, 0x1ff, 0x0, 0xfb, 0x71, 0x80000000, 0x2, 0x7, 0x6, 0x60, 0x8, 0x6, 0x8, 0x4, 0x10, 0x2, 0x8, 0x8, 0xfffffffffffffe01, 0x5b, 0x7, 0x1, 0x100000000, 0x4, 0xc, 0x8000000000000001, 0x1bd, 0x100000001, 0x0, 0x3, 0x2, 0xb0, 0xb877, 0x7, 0x5, 0x3]}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=37.581661716s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_DEV_STATS detailed listing: executing program 0: syz_usb_connect(0x0, 0x6b, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000385352608f20446b76e8e01020301090259000104e9000909049300000e0100ff0a2401020005028a010209240603040001a53011240606040508000400050006000100050924030506030501f909240702020005cbad092403060101"], &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x1609}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f0000000580)={0x0, 0x9, 0x0, [0x2, 0x81, 0x8000000000000000, 0x1, 0x1], [0x5, 0x4, 0x3, 0x401, 0x0, 0x8000000000000001, 0x10b330b0, 0xfff, 0x0, 0x2, 0x5, 0x6, 0xc, 0xcee, 0x2, 0x0, 0x7, 0x0, 0x80, 0xfffffffffffffffc, 0x8, 0x6, 0x8, 0x8, 0xff, 0x2, 0x3, 0x0, 0x4, 0x8001, 0x5, 0x9, 0xd, 0xfffffffffffffff8, 0x6, 0x200, 0x2, 0xf78, 0xfffffffffffffffa, 0xc, 0x4, 0x0, 0x502, 0x9, 0x0, 0x40, 0x2, 0xfffffffffffffff8, 0x9, 0x2, 0x10001, 0x0, 0x100, 0xff, 0x1, 0x723, 0x6, 0x3, 0x9, 0xfffffffffffffff9, 0xffffffffffffffff, 0x0, 0x7, 0x7, 0x1, 0xfffffffffffffffe, 0x4, 0xbcd4, 0x1ff, 0x5, 0x100000000, 0x2, 0xc, 0x4, 0x7ff, 0x4, 0xffffffffffffff10, 0x36b54f64, 0x3, 0x6, 0x100000000, 0x8, 0x5, 0x3, 0x7aad, 0x5, 0x1ff, 0x0, 0xfb, 0x71, 0x80000000, 0x2, 0x7, 0x6, 0x60, 0x8, 0x6, 0x8, 0x4, 0x10, 0x2, 0x8, 0x8, 0xfffffffffffffe01, 0x5b, 0x7, 0x1, 0x100000000, 0x4, 0xc, 0x8000000000000001, 0x1bd, 0x100000001, 0x0, 0x3, 0x2, 0xb0, 0xb877, 0x7, 0x5, 0x3]}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=37.581661716s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$pppl2tp-socket$inet6_udp-ioctl$BTRFS_IOC_GET_DEV_STATS detailed listing: executing program 0: syz_usb_connect(0x0, 0x6b, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000385352608f20446b76e8e01020301090259000104e9000909049300000e0100ff0a2401020005028a010209240603040001a53011240606040508000400050006000100050924030506030501f909240702020005cbad092403060101"], &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x1609}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f0000000580)={0x0, 0x9, 0x0, [0x2, 0x81, 0x8000000000000000, 0x1, 0x1], [0x5, 0x4, 0x3, 0x401, 0x0, 0x8000000000000001, 0x10b330b0, 0xfff, 0x0, 0x2, 0x5, 0x6, 0xc, 0xcee, 0x2, 0x0, 0x7, 0x0, 0x80, 0xfffffffffffffffc, 0x8, 0x6, 0x8, 0x8, 0xff, 0x2, 0x3, 0x0, 0x4, 0x8001, 0x5, 0x9, 0xd, 0xfffffffffffffff8, 0x6, 0x200, 0x2, 0xf78, 0xfffffffffffffffa, 0xc, 0x4, 0x0, 0x502, 0x9, 0x0, 0x40, 0x2, 0xfffffffffffffff8, 0x9, 0x2, 0x10001, 0x0, 0x100, 0xff, 0x1, 0x723, 0x6, 0x3, 0x9, 0xfffffffffffffff9, 0xffffffffffffffff, 0x0, 0x7, 0x7, 0x1, 0xfffffffffffffffe, 0x4, 0xbcd4, 0x1ff, 0x5, 0x100000000, 0x2, 0xc, 0x4, 0x7ff, 0x4, 0xffffffffffffff10, 0x36b54f64, 0x3, 0x6, 0x100000000, 0x8, 0x5, 0x3, 0x7aad, 0x5, 0x1ff, 0x0, 0xfb, 0x71, 0x80000000, 0x2, 0x7, 0x6, 0x60, 0x8, 0x6, 0x8, 0x4, 0x10, 0x2, 0x8, 0x8, 0xfffffffffffffe01, 0x5b, 0x7, 0x1, 0x100000000, 0x4, 0xc, 0x8000000000000001, 0x1bd, 0x100000001, 0x0, 0x3, 0x2, 0xb0, 0xb877, 0x7, 0x5, 0x3]}) program did not crash testing program (duration=37.581661716s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$pppl2tp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_DEV_STATS detailed listing: executing program 0: syz_usb_connect(0x0, 0x6b, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000385352608f20446b76e8e01020301090259000104e9000909049300000e0100ff0a2401020005028a010209240603040001a53011240606040508000400050006000100050924030506030501f909240702020005cbad092403060101"], &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x1609}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @dev}, 0x2}}, 0x2e) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f0000000580)={0x0, 0x9, 0x0, [0x2, 0x81, 0x8000000000000000, 0x1, 0x1], [0x5, 0x4, 0x3, 0x401, 0x0, 0x8000000000000001, 0x10b330b0, 0xfff, 0x0, 0x2, 0x5, 0x6, 0xc, 0xcee, 0x2, 0x0, 0x7, 0x0, 0x80, 0xfffffffffffffffc, 0x8, 0x6, 0x8, 0x8, 0xff, 0x2, 0x3, 0x0, 0x4, 0x8001, 0x5, 0x9, 0xd, 0xfffffffffffffff8, 0x6, 0x200, 0x2, 0xf78, 0xfffffffffffffffa, 0xc, 0x4, 0x0, 0x502, 0x9, 0x0, 0x40, 0x2, 0xfffffffffffffff8, 0x9, 0x2, 0x10001, 0x0, 0x100, 0xff, 0x1, 0x723, 0x6, 0x3, 0x9, 0xfffffffffffffff9, 0xffffffffffffffff, 0x0, 0x7, 0x7, 0x1, 0xfffffffffffffffe, 0x4, 0xbcd4, 0x1ff, 0x5, 0x100000000, 0x2, 0xc, 0x4, 0x7ff, 0x4, 0xffffffffffffff10, 0x36b54f64, 0x3, 0x6, 0x100000000, 0x8, 0x5, 0x3, 0x7aad, 0x5, 0x1ff, 0x0, 0xfb, 0x71, 0x80000000, 0x2, 0x7, 0x6, 0x60, 0x8, 0x6, 0x8, 0x4, 0x10, 0x2, 0x8, 0x8, 0xfffffffffffffe01, 0x5b, 0x7, 0x1, 0x100000000, 0x4, 0xc, 0x8000000000000001, 0x1bd, 0x100000001, 0x0, 0x3, 0x2, 0xb0, 0xb877, 0x7, 0x5, 0x3]}) program did not crash testing program (duration=37.581661716s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_DEV_STATS detailed listing: executing program 0: syz_usb_connect(0x0, 0x6b, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000385352608f20446b76e8e01020301090259000104e9000909049300000e0100ff0a2401020005028a010209240603040001a53011240606040508000400050006000100050924030506030501f909240702020005cbad092403060101"], &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x1609}) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r0, {0x2, 0x0, @dev}, 0x2}}, 0x2e) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000580)={0x0, 0x9, 0x0, [0x2, 0x81, 0x8000000000000000, 0x1, 0x1], [0x5, 0x4, 0x3, 0x401, 0x0, 0x8000000000000001, 0x10b330b0, 0xfff, 0x0, 0x2, 0x5, 0x6, 0xc, 0xcee, 0x2, 0x0, 0x7, 0x0, 0x80, 0xfffffffffffffffc, 0x8, 0x6, 0x8, 0x8, 0xff, 0x2, 0x3, 0x0, 0x4, 0x8001, 0x5, 0x9, 0xd, 0xfffffffffffffff8, 0x6, 0x200, 0x2, 0xf78, 0xfffffffffffffffa, 0xc, 0x4, 0x0, 0x502, 0x9, 0x0, 0x40, 0x2, 0xfffffffffffffff8, 0x9, 0x2, 0x10001, 0x0, 0x100, 0xff, 0x1, 0x723, 0x6, 0x3, 0x9, 0xfffffffffffffff9, 0xffffffffffffffff, 0x0, 0x7, 0x7, 0x1, 0xfffffffffffffffe, 0x4, 0xbcd4, 0x1ff, 0x5, 0x100000000, 0x2, 0xc, 0x4, 0x7ff, 0x4, 0xffffffffffffff10, 0x36b54f64, 0x3, 0x6, 0x100000000, 0x8, 0x5, 0x3, 0x7aad, 0x5, 0x1ff, 0x0, 0xfb, 0x71, 0x80000000, 0x2, 0x7, 0x6, 0x60, 0x8, 0x6, 0x8, 0x4, 0x10, 0x2, 0x8, 0x8, 0xfffffffffffffe01, 0x5b, 0x7, 0x1, 0x100000000, 0x4, 0xc, 0x8000000000000001, 0x1bd, 0x100000001, 0x0, 0x3, 0x2, 0xb0, 0xb877, 0x7, 0x5, 0x3]}) program did not crash testing program (duration=37.581661716s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_DEV_STATS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f0000000580)={0x0, 0x9, 0x0, [0x2, 0x81, 0x8000000000000000, 0x1, 0x1], [0x5, 0x4, 0x3, 0x401, 0x0, 0x8000000000000001, 0x10b330b0, 0xfff, 0x0, 0x2, 0x5, 0x6, 0xc, 0xcee, 0x2, 0x0, 0x7, 0x0, 0x80, 0xfffffffffffffffc, 0x8, 0x6, 0x8, 0x8, 0xff, 0x2, 0x3, 0x0, 0x4, 0x8001, 0x5, 0x9, 0xd, 0xfffffffffffffff8, 0x6, 0x200, 0x2, 0xf78, 0xfffffffffffffffa, 0xc, 0x4, 0x0, 0x502, 0x9, 0x0, 0x40, 0x2, 0xfffffffffffffff8, 0x9, 0x2, 0x10001, 0x0, 0x100, 0xff, 0x1, 0x723, 0x6, 0x3, 0x9, 0xfffffffffffffff9, 0xffffffffffffffff, 0x0, 0x7, 0x7, 0x1, 0xfffffffffffffffe, 0x4, 0xbcd4, 0x1ff, 0x5, 0x100000000, 0x2, 0xc, 0x4, 0x7ff, 0x4, 0xffffffffffffff10, 0x36b54f64, 0x3, 0x6, 0x100000000, 0x8, 0x5, 0x3, 0x7aad, 0x5, 0x1ff, 0x0, 0xfb, 0x71, 0x80000000, 0x2, 0x7, 0x6, 0x60, 0x8, 0x6, 0x8, 0x4, 0x10, 0x2, 0x8, 0x8, 0xfffffffffffffe01, 0x5b, 0x7, 0x1, 0x100000000, 0x4, 0xc, 0x8000000000000001, 0x1bd, 0x100000001, 0x0, 0x3, 0x2, 0xb0, 0xb877, 0x7, 0x5, 0x3]}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=37.581661716s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_DEV_STATS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, 0x0, 0x0) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, &(0x7f0000000580)={0x0, 0x9, 0x0, [0x2, 0x81, 0x8000000000000000, 0x1, 0x1], [0x5, 0x4, 0x3, 0x401, 0x0, 0x8000000000000001, 0x10b330b0, 0xfff, 0x0, 0x2, 0x5, 0x6, 0xc, 0xcee, 0x2, 0x0, 0x7, 0x0, 0x80, 0xfffffffffffffffc, 0x8, 0x6, 0x8, 0x8, 0xff, 0x2, 0x3, 0x0, 0x4, 0x8001, 0x5, 0x9, 0xd, 0xfffffffffffffff8, 0x6, 0x200, 0x2, 0xf78, 0xfffffffffffffffa, 0xc, 0x4, 0x0, 0x502, 0x9, 0x0, 0x40, 0x2, 0xfffffffffffffff8, 0x9, 0x2, 0x10001, 0x0, 0x100, 0xff, 0x1, 0x723, 0x6, 0x3, 0x9, 0xfffffffffffffff9, 0xffffffffffffffff, 0x0, 0x7, 0x7, 0x1, 0xfffffffffffffffe, 0x4, 0xbcd4, 0x1ff, 0x5, 0x100000000, 0x2, 0xc, 0x4, 0x7ff, 0x4, 0xffffffffffffff10, 0x36b54f64, 0x3, 0x6, 0x100000000, 0x8, 0x5, 0x3, 0x7aad, 0x5, 0x1ff, 0x0, 0xfb, 0x71, 0x80000000, 0x2, 0x7, 0x6, 0x60, 0x8, 0x6, 0x8, 0x4, 0x10, 0x2, 0x8, 0x8, 0xfffffffffffffe01, 0x5b, 0x7, 0x1, 0x100000000, 0x4, 0xc, 0x8000000000000001, 0x1bd, 0x100000001, 0x0, 0x3, 0x2, 0xb0, 0xb877, 0x7, 0x5, 0x3]}) program did not crash testing program (duration=37.581661716s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_DEV_STATS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release extracting C reproducer testing compiled C program (duration=37.581661716s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_DEV_STATS program crashed: KASAN: use-after-free Write in pppol2tp_release simplifying C reproducer testing compiled C program (duration=37.581661716s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_DEV_STATS program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=37.581661716s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_DEV_STATS program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=37.581661716s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_DEV_STATS program crashed: KASAN: use-after-free Write in rcu_segcblist_enqueue a never seen crash title: KASAN: use-after-free Write in rcu_segcblist_enqueue, ignore testing compiled C program (duration=37.581661716s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_DEV_STATS program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=37.581661716s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_DEV_STATS program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=37.581661716s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_DEV_STATS program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=37.581661716s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_DEV_STATS program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=37.581661716s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_DEV_STATS program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=37.581661716s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_DEV_STATS program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=37.581661716s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_DEV_STATS program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=37.581661716s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_DEV_STATS program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=37.581661716s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_DEV_STATS program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=37.581661716s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_DEV_STATS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release validation run: crashed=true testing program (duration=37.581661716s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_DEV_STATS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release validation run: crashed=true testing program (duration=37.581661716s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_DEV_STATS detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) ioctl$BTRFS_IOC_GET_DEV_STATS(r0, 0xc4089434, 0x0) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session validation run: crashed=true reproducing took 29m41.033487108s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in pppol2tp_sock_to_session+0x1a0/0x1b0 net/l2tp/l2tp_ppp.c:156 Read of size 4 at addr ffff888112a0a000 by task syz.2.17/372 CPU: 1 PID: 372 Comm: syz.2.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:88 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106 print_address_description+0x71/0x200 mm/kasan/report.c:316 print_report+0x4a/0x60 mm/kasan/report.c:420 kasan_report+0x122/0x150 mm/kasan/report.c:524 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:350 pppol2tp_sock_to_session+0x1a0/0x1b0 net/l2tp/l2tp_ppp.c:156 pppol2tp_release+0x150/0x2b0 net/l2tp/l2tp_ppp.c:434 __sock_release net/socket.c:652 [inline] sock_close+0xc9/0x220 net/socket.c:1389 __fput+0x1fd/0x8f0 fs/file_table.c:320 ____fput+0x15/0x20 fs/file_table.c:348 task_work_run+0x1e1/0x250 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0x9b/0xb0 kernel/entry/common.c:177 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f1ba559de99 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff6af668a8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007fff6af66990 RCX: 00007f1ba559de99 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 0000000000006c44 R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b32f20000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f1ba5825fac R14: 00007f1ba5825fa8 R15: 00007f1ba5825fa0 Allocated by task 372: kasan_save_stack mm/kasan/common.c:46 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:53 kasan_save_alloc_info+0x1f/0x30 mm/kasan/generic.c:505 ____kasan_kmalloc mm/kasan/common.c:380 [inline] __kasan_kmalloc+0x95/0xb0 mm/kasan/common.c:389 kasan_kmalloc include/linux/kasan.h:212 [inline] __do_kmalloc_node mm/slab_common.c:938 [inline] __kmalloc+0xb4/0x1e0 mm/slab_common.c:951 kmalloc include/linux/slab.h:568 [inline] kzalloc include/linux/slab.h:699 [inline] l2tp_session_create+0x38/0xbd0 net/l2tp/l2tp_core.c:1609 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:771 __sys_connect_file net/socket.c:2000 [inline] __sys_connect+0x3da/0x460 net/socket.c:2017 __do_sys_connect net/socket.c:2027 [inline] __se_sys_connect net/socket.c:2024 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:2024 x64_sys_call+0x88d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:43 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Freed by task 10: kasan_save_stack mm/kasan/common.c:46 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:53 kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:516 ____kasan_slab_free+0x132/0x180 mm/kasan/common.c:242 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:250 kasan_slab_free include/linux/kasan.h:178 [inline] slab_free_hook mm/slub.c:1750 [inline] slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1776 slab_free mm/slub.c:3712 [inline] __kmem_cache_free+0xb7/0x1b0 mm/slub.c:3728 kfree+0x6f/0xf0 mm/slab_common.c:990 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline] l2tp_session_put+0xaf/0x1a0 net/l2tp/l2tp_core.c:193 l2tp_session_delete+0x3df/0x4d0 net/l2tp/l2tp_core.c:1582 l2tp_tunnel_closeall net/l2tp/l2tp_core.c:1228 [inline] l2tp_tunnel_del_work+0x199/0x410 net/l2tp/l2tp_core.c:1266 process_one_work+0x717/0xc30 kernel/workqueue.c:2302 worker_thread+0xa4d/0x11d0 kernel/workqueue.c:2449 kthread+0x281/0x320 kernel/kthread.c:386 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 The buggy address belongs to the object at ffff888112a0a000 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 0 bytes inside of 512-byte region [ffff888112a0a000, ffff888112a0a200) The buggy address belongs to the physical page: page:ffffea00044a8200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112a08 head:ffffea00044a8200 order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head|zone=1) raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 368, tgid 368 (syz-executor), ts 27735899448, free_ts 26759976324 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1f5/0x210 mm/page_alloc.c:2672 prep_new_page+0x1c/0x110 mm/page_alloc.c:2679 get_page_from_freelist+0x2ca9/0x2d20 mm/page_alloc.c:4586 __alloc_pages+0x1fa/0x610 mm/page_alloc.c:5930 alloc_slab_page+0x6e/0xf0 include/linux/gfp.h:-1 allocate_slab mm/slub.c:1967 [inline] new_slab+0x98/0x3e0 mm/slub.c:2020 ___slab_alloc+0x70f/0xb70 mm/slub.c:3177 __slab_alloc+0x5e/0xa0 mm/slub.c:3263 slab_alloc_node mm/slub.c:3348 [inline] __kmem_cache_alloc_node+0x204/0x2d0 mm/slub.c:3423 __do_kmalloc_node mm/slab_common.c:937 [inline] __kmalloc+0xa4/0x1e0 mm/slab_common.c:951 kmalloc include/linux/slab.h:568 [inline] kzalloc include/linux/slab.h:699 [inline] fib6_info_alloc+0x34/0xe0 net/ipv6/ip6_fib.c:156 ip6_route_info_create+0x51b/0x14d0 net/ipv6/route.c:3796 ip6_route_add+0x27/0x130 net/ipv6/route.c:3892 addrconf_prefix_route+0x233/0x310 net/ipv6/addrconf.c:2466 inet6_addr_add+0x527/0x9c0 net/ipv6/addrconf.c:3042 inet6_rtm_newaddr+0x74a/0xa10 net/ipv6/addrconf.c:4999 page last free stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] free_pages_prepare mm/page_alloc.c:1580 [inline] free_pcp_prepare mm/page_alloc.c:1654 [inline] free_unref_page_prepare+0x80c/0x820 mm/page_alloc.c:3621 free_unref_page+0x93/0x530 mm/page_alloc.c:3719 free_the_page mm/page_alloc.c:863 [inline] __free_pages+0x67/0x100 mm/page_alloc.c:6020 __vunmap+0xa3c/0xc00 mm/vmalloc.c:2739 __vfree mm/vmalloc.c:2788 [inline] vfree+0x61/0x90 mm/vmalloc.c:2819 kcov_put kernel/kcov.c:437 [inline] kcov_close+0x2b/0x50 kernel/kcov.c:533 __fput+0x1fd/0x8f0 fs/file_table.c:320 ____fput+0x15/0x20 fs/file_table.c:348 task_work_run+0x1e1/0x250 kernel/task_work.c:203 exit_task_work include/linux/task_work.h:39 [inline] do_exit+0xaf2/0x2850 kernel/exit.c:887 do_group_exit+0x21b/0x2e0 kernel/exit.c:1030 get_signal+0x167c/0x1700 kernel/signal.c:2895 arch_do_signal_or_restart+0xd1/0x11c0 arch/x86/kernel/signal.c:871 exit_to_user_mode_loop+0x7a/0xb0 kernel/entry/common.c:174 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303 Memory state around the buggy address: ffff888112a09f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888112a09f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888112a0a000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888112a0a080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888112a0a100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== ------------[ cut here ]------------ WARNING: CPU: 0 PID: 372 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 net/l2tp/l2tp_ppp.c:156 Modules linked in: CPU: 0 PID: 372 Comm: syz.2.17 Tainted: G B syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 net/l2tp/l2tp_ppp.c:156 Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 RSP: 0018:ffffc90000787cb0 EFLAGS: 00010293 RAX: ffffffff849bb307 RBX: ffff888115c3d000 RCX: ffff88811355bcc0 RDX: 0000000000000000 RSI: 00000000128b1640 RDI: 000000000c04eb7d RBP: ffffc90000787cd0 R08: ffffffff87b757e7 R09: 1ffffffff0f6eafc R10: dffffc0000000000 R11: fffffbfff0f6eafd R12: dffffc0000000000 R13: dffffc0000000000 R14: 00000000128b1640 R15: ffff888112a0a000 FS: 000055557f33c500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f1ba55eb580 CR3: 0000000122e36000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: pppol2tp_release+0x150/0x2b0 net/l2tp/l2tp_ppp.c:434 __sock_release net/socket.c:652 [inline] sock_close+0xc9/0x220 net/socket.c:1389 __fput+0x1fd/0x8f0 fs/file_table.c:320 ____fput+0x15/0x20 fs/file_table.c:348 task_work_run+0x1e1/0x250 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0x9b/0xb0 kernel/entry/common.c:177 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f1ba559de99 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff6af668a8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007fff6af66990 RCX: 00007f1ba559de99 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 0000000000006c44 R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b32f20000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f1ba5825fac R14: 00007f1ba5825fa8 R15: 00007f1ba5825fa0 ---[ end trace 0000000000000000 ]--- final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in pppol2tp_sock_to_session+0x1a0/0x1b0 net/l2tp/l2tp_ppp.c:156 Read of size 4 at addr ffff888112a0a000 by task syz.2.17/372 CPU: 1 PID: 372 Comm: syz.2.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:88 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106 print_address_description+0x71/0x200 mm/kasan/report.c:316 print_report+0x4a/0x60 mm/kasan/report.c:420 kasan_report+0x122/0x150 mm/kasan/report.c:524 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:350 pppol2tp_sock_to_session+0x1a0/0x1b0 net/l2tp/l2tp_ppp.c:156 pppol2tp_release+0x150/0x2b0 net/l2tp/l2tp_ppp.c:434 __sock_release net/socket.c:652 [inline] sock_close+0xc9/0x220 net/socket.c:1389 __fput+0x1fd/0x8f0 fs/file_table.c:320 ____fput+0x15/0x20 fs/file_table.c:348 task_work_run+0x1e1/0x250 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0x9b/0xb0 kernel/entry/common.c:177 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f1ba559de99 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff6af668a8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007fff6af66990 RCX: 00007f1ba559de99 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 0000000000006c44 R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b32f20000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f1ba5825fac R14: 00007f1ba5825fa8 R15: 00007f1ba5825fa0 Allocated by task 372: kasan_save_stack mm/kasan/common.c:46 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:53 kasan_save_alloc_info+0x1f/0x30 mm/kasan/generic.c:505 ____kasan_kmalloc mm/kasan/common.c:380 [inline] __kasan_kmalloc+0x95/0xb0 mm/kasan/common.c:389 kasan_kmalloc include/linux/kasan.h:212 [inline] __do_kmalloc_node mm/slab_common.c:938 [inline] __kmalloc+0xb4/0x1e0 mm/slab_common.c:951 kmalloc include/linux/slab.h:568 [inline] kzalloc include/linux/slab.h:699 [inline] l2tp_session_create+0x38/0xbd0 net/l2tp/l2tp_core.c:1609 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:771 __sys_connect_file net/socket.c:2000 [inline] __sys_connect+0x3da/0x460 net/socket.c:2017 __do_sys_connect net/socket.c:2027 [inline] __se_sys_connect net/socket.c:2024 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:2024 x64_sys_call+0x88d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:43 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Freed by task 10: kasan_save_stack mm/kasan/common.c:46 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:53 kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:516 ____kasan_slab_free+0x132/0x180 mm/kasan/common.c:242 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:250 kasan_slab_free include/linux/kasan.h:178 [inline] slab_free_hook mm/slub.c:1750 [inline] slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1776 slab_free mm/slub.c:3712 [inline] __kmem_cache_free+0xb7/0x1b0 mm/slub.c:3728 kfree+0x6f/0xf0 mm/slab_common.c:990 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline] l2tp_session_put+0xaf/0x1a0 net/l2tp/l2tp_core.c:193 l2tp_session_delete+0x3df/0x4d0 net/l2tp/l2tp_core.c:1582 l2tp_tunnel_closeall net/l2tp/l2tp_core.c:1228 [inline] l2tp_tunnel_del_work+0x199/0x410 net/l2tp/l2tp_core.c:1266 process_one_work+0x717/0xc30 kernel/workqueue.c:2302 worker_thread+0xa4d/0x11d0 kernel/workqueue.c:2449 kthread+0x281/0x320 kernel/kthread.c:386 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 The buggy address belongs to the object at ffff888112a0a000 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 0 bytes inside of 512-byte region [ffff888112a0a000, ffff888112a0a200) The buggy address belongs to the physical page: page:ffffea00044a8200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112a08 head:ffffea00044a8200 order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head|zone=1) raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 368, tgid 368 (syz-executor), ts 27735899448, free_ts 26759976324 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1f5/0x210 mm/page_alloc.c:2672 prep_new_page+0x1c/0x110 mm/page_alloc.c:2679 get_page_from_freelist+0x2ca9/0x2d20 mm/page_alloc.c:4586 __alloc_pages+0x1fa/0x610 mm/page_alloc.c:5930 alloc_slab_page+0x6e/0xf0 include/linux/gfp.h:-1 allocate_slab mm/slub.c:1967 [inline] new_slab+0x98/0x3e0 mm/slub.c:2020 ___slab_alloc+0x70f/0xb70 mm/slub.c:3177 __slab_alloc+0x5e/0xa0 mm/slub.c:3263 slab_alloc_node mm/slub.c:3348 [inline] __kmem_cache_alloc_node+0x204/0x2d0 mm/slub.c:3423 __do_kmalloc_node mm/slab_common.c:937 [inline] __kmalloc+0xa4/0x1e0 mm/slab_common.c:951 kmalloc include/linux/slab.h:568 [inline] kzalloc include/linux/slab.h:699 [inline] fib6_info_alloc+0x34/0xe0 net/ipv6/ip6_fib.c:156 ip6_route_info_create+0x51b/0x14d0 net/ipv6/route.c:3796 ip6_route_add+0x27/0x130 net/ipv6/route.c:3892 addrconf_prefix_route+0x233/0x310 net/ipv6/addrconf.c:2466 inet6_addr_add+0x527/0x9c0 net/ipv6/addrconf.c:3042 inet6_rtm_newaddr+0x74a/0xa10 net/ipv6/addrconf.c:4999 page last free stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] free_pages_prepare mm/page_alloc.c:1580 [inline] free_pcp_prepare mm/page_alloc.c:1654 [inline] free_unref_page_prepare+0x80c/0x820 mm/page_alloc.c:3621 free_unref_page+0x93/0x530 mm/page_alloc.c:3719 free_the_page mm/page_alloc.c:863 [inline] __free_pages+0x67/0x100 mm/page_alloc.c:6020 __vunmap+0xa3c/0xc00 mm/vmalloc.c:2739 __vfree mm/vmalloc.c:2788 [inline] vfree+0x61/0x90 mm/vmalloc.c:2819 kcov_put kernel/kcov.c:437 [inline] kcov_close+0x2b/0x50 kernel/kcov.c:533 __fput+0x1fd/0x8f0 fs/file_table.c:320 ____fput+0x15/0x20 fs/file_table.c:348 task_work_run+0x1e1/0x250 kernel/task_work.c:203 exit_task_work include/linux/task_work.h:39 [inline] do_exit+0xaf2/0x2850 kernel/exit.c:887 do_group_exit+0x21b/0x2e0 kernel/exit.c:1030 get_signal+0x167c/0x1700 kernel/signal.c:2895 arch_do_signal_or_restart+0xd1/0x11c0 arch/x86/kernel/signal.c:871 exit_to_user_mode_loop+0x7a/0xb0 kernel/entry/common.c:174 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303 Memory state around the buggy address: ffff888112a09f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888112a09f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888112a0a000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888112a0a080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888112a0a100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== ------------[ cut here ]------------ WARNING: CPU: 0 PID: 372 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 net/l2tp/l2tp_ppp.c:156 Modules linked in: CPU: 0 PID: 372 Comm: syz.2.17 Tainted: G B syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 net/l2tp/l2tp_ppp.c:156 Code: 5d c3 e8 5c b3 d5 fc be 02 00 00 00 eb 0a e8 50 b3 d5 fc be 01 00 00 00 4c 89 f7 e8 23 18 cd fd e9 0f ff ff ff e8 39 b3 d5 fc <0f> 0b 48 89 df e8 ff 00 00 00 eb bd e8 28 b3 d5 fc 4c 89 f7 be 03 RSP: 0018:ffffc90000787cb0 EFLAGS: 00010293 RAX: ffffffff849bb307 RBX: ffff888115c3d000 RCX: ffff88811355bcc0 RDX: 0000000000000000 RSI: 00000000128b1640 RDI: 000000000c04eb7d RBP: ffffc90000787cd0 R08: ffffffff87b757e7 R09: 1ffffffff0f6eafc R10: dffffc0000000000 R11: fffffbfff0f6eafd R12: dffffc0000000000 R13: dffffc0000000000 R14: 00000000128b1640 R15: ffff888112a0a000 FS: 000055557f33c500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f1ba55eb580 CR3: 0000000122e36000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: pppol2tp_release+0x150/0x2b0 net/l2tp/l2tp_ppp.c:434 __sock_release net/socket.c:652 [inline] sock_close+0xc9/0x220 net/socket.c:1389 __fput+0x1fd/0x8f0 fs/file_table.c:320 ____fput+0x15/0x20 fs/file_table.c:348 task_work_run+0x1e1/0x250 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0x9b/0xb0 kernel/entry/common.c:177 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f1ba559de99 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff6af668a8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007fff6af66990 RCX: 00007f1ba559de99 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 0000000000006c44 R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b32f20000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f1ba5825fac R14: 00007f1ba5825fa8 R15: 00007f1ba5825fa0 ---[ end trace 0000000000000000 ]---