Extracting prog: 2m50.989460448s
Minimizing prog: 30m45.907091555s
Simplifying prog options: 0s
Extracting C: 22.076581467s
Simplifying C: 4m59.600673572s


extracting reproducer from 63 programs
testing a last program of every proc
single: executing 15 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-mmap$IORING_OFF_SQ_RING-mmap$IORING_OFF_SQ_RING-syz_mount_image$ext4-newfstatat-prlimit64-sched_setscheduler-getpid-wait4-pipe-io_setup-eventfd2-write$eventfd-read
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x3000007, 0x4010, 0xffffffffffffffff, 0x0)
syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f0000000040)='./bus\x00', 0x1208002, &(0x7f0000000380)={[{@grpquota}, {@jqfmt_vfsold}, {@resuid}, {@debug}, {@dioread_nolock}, {}, {@acl}, {@noauto_da_alloc}]}, 0x1, 0x5d8, &(0x7f00000005c0)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=")
newfstatat(0xffffffffffffff9c, &(0x7f0000000440)='./bus\x00', &(0x7f0000000bc0), 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x5, &(0x7f0000000200)=0x30a)
getpid()
wait4(0x0, 0x0, 0x0, 0x0)
pipe(&(0x7f0000000040))
io_setup(0x3ff, &(0x7f0000000500))
r0 = eventfd2(0x8, 0x0)
write$eventfd(r0, &(0x7f0000000140)=0xfffffffffffffffc, 0x8)
read(r0, &(0x7f0000000480)=""/82, 0x52)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$hid-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-ioctl$SECCOMP_IOCTL_NOTIF_RECV-poll-socket$packet-syz_mount_image$ext4-syz_init_net_socket$bt_hci-setns-syz_open_procfs-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_DEVICE-ioctl$F2FS_IOC_MOVE_RANGE-preadv-setsockopt$packet_fanout-setsockopt$SO_ATTACH_FILTER-syz_open_procfs-mkdirat-ioctl$FS_IOC_GETFSLABEL-syz_fuse_handle_req
detailed listing:
executing program 0:
syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010007000000404c0568020000000000010902240001000000010904000802030000000921000000"], 0x0)
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000100)={0x1, &(0x7f0000000200)=[{0x0, 0xff, 0x5, 0x7}]})
ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, 0x0)
poll(&(0x7f0000000080)=[{r0, 0x80aa}], 0x1, 0x0)
r1 = socket$packet(0x11, 0x2, 0x300)
syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000b00), 0xff, 0x4d6, &(0x7f0000000b40)="$eJzs3c9vVFsdAPDv3P6kFFqUxB9RQQTREGbaARrCwuBGYwiJkbhyAbUdmqYznaYzRVpZlP/BRBJX+ie4MHFhwsq9O90ZE1yYoBINfclbzMuduYVSZub18coM6Xw+yc3cc8/c+z2Hcs+5fIfOCWBgnY2I7YgYjYh7ETGVHc9lW9xsben7Xr54tLDz4tFCLkbjzn9yzfr0WOw5J3U8u+Z4RPzkhxE/z70dt7a5tTJfLpfWs3KhXlkr1Da3/rFcmV8qLZVWi8W52bmZ61euFQ+tr2cqv3/+g+VbP/3TH7/+7C/b3/1l2qzJrG5vP/aaPtilhzpVtLo+8ipOajgibn2Whn/AhrL+jPa7IbyTJCK+EBHn0vu/0e/WAAC90GhMRWNqbxkAOOqSZg4sl+SzXMBkJEk+38rhnY6JpFyt1S/dr26sLrZyZdMxktxfLpdmslzhdIzk0vJslivbLRf3la9ExKmI+NXYsWY5v1AtL/bzwQcABtjxffP//8da8z8AcMSN97sBAEDPmf8BYPCY/wFg8Jj/AWDwmP8BYPCY/wFg8Jj/AWCg/Pj27XRr7GTff734YHNjpfrg8mKptpKvbCzkF6rra/mlanWp+Z09lU+7XrlaXZu9GhsPC/VSrV6obW7drVQ3Vut3m9/rfbc00pNeAQDdnDrz9G+5iNi+cay5xZ61HMzVcLQl/W4A0DcdF64CjrzhfjcA6Bv/xgfaLNH7yki3/yL0pOtpwAfs4lfk/2FQyf/D4JL/h8El/w+Dq9HIWfMfAAaMHD/Q7fP/eLfP/wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAODIm2xuuSSfrQU+GUmSz0eciIjpGMndXy6XZiLiZET8dWxkLC3PpieO9rvlAMC7S/6Vy9b/ujh1fnJ/7Wjuo7HIpvtf/ObOrx/O1+vrs+nx/44dy95Tf5IdL3YNZKlBAOiT3Xl6dx7f9fLFo4XdrZftef791uKiadydbGvVDMdw83W8+eAw8b9cVm5Jn1eGDiH+9uOI+HK7/ueauZHpbOXT/fHT2Cd6Gj95I37SrGu9pn8WXzyEtsCgeZqOPzfb3X9JnG2+tr//x5sj1Oe3O/7tvDX+Ja/Gv6EO49/Zg8a4+ucfdax7HPHV4Xbxc9nwOn7hex3inz9g/L9/7Rvn3jzztcZvIy5G2/hvnFGoV9YKtc2ty8uV+aXSUmm1WJybnZu5fuVasdDMURd2M9Vv+/eNSye79X+iQ/zWT368Gb9d/y8csP+/+/jez77ZJf53vtX+53+6S/x0Tvz2AePPT/yh4/LdafzF9v3Pzunc/0sHjP/sn1uLB3wrANADtc2tlflyubRup2c76bPbB9AMO33bSf8GHMZ1vvQem9rvkQl4317f9P1uCQAAAAAAAAAAAAAA0EkvfuGp330EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg6PokAAD//zpy1fY=")
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
setns(0xc9, 0x0)
r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='net/hci\x00')
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f0000000040)={0x4, <r5=>0xffffffffffffffff})
ioctl$F2FS_IOC_MOVE_RANGE(r5, 0xc020f509, 0x0)
preadv(r2, &(0x7f00000002c0)=[{&(0x7f0000000000)=""/120, 0x78}], 0x1, 0x8, 0x1)
setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000000)={0x2, 0x8000}, 0x4)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000040)={0x0, &(0x7f0000000340)}, 0x10)
syz_open_procfs(0x0, &(0x7f0000000380)='mounts\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff)
ioctl$FS_IOC_GETFSLABEL(0xffffffffffffffff, 0x400452c8, &(0x7f0000000100))
syz_fuse_handle_req(r2, &(0x7f0000001040)="1196578f4b71dd52c7a4b88c6e1ca97df2882207635a213fa5ec6df29c6268112f02e96425abb6a01b1bb84aefe8052268013e1a943d574ed4b5344cd57f23468c278cdb2ee13089af2ed3c372423e8aa9eb7272b9d043ee2131417f7c1f31cf2e8823758a143e65058a10e06777688e0ac1a6853a4a281b2c6e5c001ad945ef1b23fe36e74614e2c1419943382477838aa1254ef921a3840d8d0dee5dcd0dc4516f48f77e8a8b12053db9189cdcede0c3a6dd9f440dd5bb45fea34ab795cc443158ec506ebb612e0fbd46ac9080263d19673a0e9f6191c983e0b2d4bc713be5c5a331b6db2ac115b703f73eb9fbe742ea598df7467fcc9398b2f4fdc4b3f34babf5fa2abb02c235a75de35b5c572b514b8569e8f39e811d3f8c116455ebab63922f06a24c4e762809902d3f724ba93e0e4399521ff022bdcd877be0f7ff21cfebdf8bebc56d8192b41ddf000e12539ed832ab202a9dd40a28a5e94e3c129e5eeac96a93a0241ec3188399dde5d4cf9bf33293c5ad0d292d925a0a1c66189aadf80b57670c4a24e7c601c0b7c91607c90677c53adcada7507851f076167e6e1dbc19a41f636915c64d1f87c16fd5c9f6fe56eb1c48baa2aa14c10fc4fc90c61a54acec8f3dea5ec0ba1741a57f56931251c27e421cd663b50d1cdcadfaef49efe469a726cfe59cca78079f75f0bf69f76c4119d11d3967b65a21c7184752725d9875865203a26b115a63b63b4610f56329892098b91ad73ea9cd5b0626ab5461cb5a65cd6517326b8df61aa00f24d4c8cac9633ad573f1920cd1f7e4e091488929c1bab52592c05261d6aca2038a6aa71386ff7181a11b7e3c9100eb08d8fd65342fc1f79108f09caee132576ae59091e60dd1cdeec263c3af867635404de6ff9ddc97b97064ad45484ba4f9056b3b03ae3626eca56499f99dfa4e9637ed5d93f19253f31b0d37567f4b1462b9550917082e8c5defa65836f88f9e04e1a1a4f87e21cc7631861fa73424a2773b651fd1dbfa3126da65068b2f17185c7fc546af354ff8668830b825f7a65f15d27273d3910ab7a048736aaa5785f6fd43fe84bb67b439985ca84b6df3133964f4353336047615ca5fd95eb00ffdae6dd0135527bb16da8e531a49e7fcef7aeb864ce96dc90668052ef6e1b54b3fcad7124b0a996bfc7f3e649689a9950310b0e0c7d333e3b6b80034f125590456d37156f6d5169d0eb0bb7444d7c3db20ec5c42342a48ea9e18b49613263029c0458743164822c0edaf1d1b64eb6d54dcc5e880e98cf442372fb6aa93217bccc32b9cf8263b26e23921ec5927f64d177cfb5ca98a8b35c59db37d91f0185ffc689a517557b3f3e173c22d820e6971ba916d84d9b13c982a12e779835bb4b2023f41088fd61217dd33623e71ff4dcc8defcee173868e4c26fb8ad51430813076e71d7693408f2fed35291a0a5e3ab8c9df4765d20df4821153d18152fe535f2f03d836f5bb4f87e2f10652b4be9a19c851a32ec46425a7e93a58f665b7d05604d99d75dbcf3cced7702d38ebcac059bdeab5bb967c4377da85cd9d77cc4de3ca5d1c580252256ca96909bca39f027fbcba911a824c5aff9fbda66ad64c838190372613089796f5a3506b7dccc87eb326436055ac17df13eb242785900df6f73f4cc1a679c973b6b6fdec54496be5835279662f2663ce4face2aba38e75a533de17670434a6efc06587944586828cc6412ec0053605e99a01b240b0efe5d218f730c6add1bfb0da75c2cb58de31a0fcfda7384674cbd9c04e031f07a30af8eac7dc8505cfd01a80de79eea5e24b86007c8a49d6cb9c58985e7a9319c06395324768e42807770573a4ddc9020871a68884d17a139c148c2b821417e0b7bb4ac930e0ad22f40a135bf6e1a0e1271edcc7fd64ee6fe74fa3cdd88e1175ab567518dfb3e8f9b91b37aa2b141d2a46c33a41f704c1118e35892ae2be3368960150127d6b28622dd77315157a4cfa841f337f700a23ac60f1055ffb0b559a74ad7ecaf3f11b72a1b6b04b0f6b628c1c1ab78cfb4ffca16e4dfc566c6efd20466ec4eada26ebbc26fc7a6b5d5d9d1fe866388153cb73aa385eefd95f7e3c2b58acb2b58687b6031b7f27a987b0cf5c15da5326f5bd1947975eb4f311a47875eb00ad6dc02843316db0f1bcfa70f0792e99580f67c2382e905a06e01d92f78096fbab826917dbbf2e7f903a0b20a715272ad44fc3b4ecbdda430f30858b574d5dbc24a8c7c5d90ae9ae2c695ee45289df0587d7b9fec220a882563a5681b7b511a84f52ae1ada81b0777f910302a91bd3e50e3ef82619bb06ae9e49fdfd95702899226944cf3bb7ccddbd6b1be910e827301b1863209aecc6537f5c506d70b2b2547637580e80fe7c9dc0dcd02844416534073cb5a9acb2eee42d8bd0dd08da5969fe81e917a8fff494b9a6c0762ba1c049ee80a46b406e0880fb1a2904c7746c6be7c8b879df7c41ce549229cafb08f3d65fd9f9e7dd621bfb9213cdaf36606a0cd29272b66393100a146af0fef9c1e0d183ffe727586a953bff9e9ea5137feed4cd3727cec66dd57f1b6b67b2d77d0222c1ecb1291c12c4171991ec4cd197fbf943cb7f8962be7d8a1e85f251e3367ffeb92150ff0b4dd5c36f7a6d7decf593d8ef4eb43f0491f1c30335b345269a0098a9ccdcf8f1a51e090fdd0b961c6a7e681756a6dc4f20320b224226c7ff9ee2cf21a63abfe3d7cc59093f7f33c9c8a472f94bf910438ef6daae763ef14f97d08e1c739b477e674e206b996ae19def97da4ce6ef9da265cd268f599fee074f9e94aaf686aa2836357dbe9c64f3dec1a3105b6cecccce6e467b96109476ff4c939feb58d3db26406d472e4f9e7f656fb571a053ca145a7e19cb46a27e303c527b2198cde26f58d1e00d6181d9ee1f3f30a4bb5e25d2e37e660fa75dfc3cc5fce5265521029b79feccc4597ae9a3dd2f29b5d84873672c3891ebc1a142bca8e6724e20388899d1f91c327e30296bc6cf362c6b7a4a933178fdc77f6aeb5ef71b8febe75711ed6e95ecf7a320c7abc5bc95ab1a12e3b8b82024ae431bfeb3ac449453b7db0a939a2964423ca7ce7e145d5b0678e86c13c9cd86f8c36723d2bca9cd2b49b34abc31ec104d1404f7f5a6614020e0cb8e76c82edfcdb16e9b14fd71d5a619440d0958a8146b6f8d56355e30e8c1fdefc6c161f514f2e9da8675dc06f1be29be8c86b995c1c5d8e67e0428b1a10ad7446654daa3dd2e23fe78e2c1cba4bcae55fc76c648624657177f870b96bc79a381e58a6e4d659ab321f7058fdf891f2560c96640ecfe6229d162c4b03268ccef0d9be217bbcd21568345e5abd105898ed23050c9473423ff8f51781d12f244e092efec2ce104309c6f2e232da7a1ba2c53a1a2fec7b4fd651e10ffdde5ef5d220f25d75a431407630ad29e29c7df5798cb3b00ca7c383e403067cf4aa73dd71e37646c5117b483c72ff9b2b4935c1528c8e877619e91f57331e510c85081bd7afef24f4d23af1482c8491d90a7f9eaecbdc4801be738eeabbd05b87e7cd9edfcc0215c2a8bb436ae955456d441ff0a6837aea9982e4f1e32690d4f3d8078eb0923cfd014af6f703b16d7ce9cf940bd7d738be5bb28c348c78edf16d258a6f1a39df39edc946ff1a0f70687d6a92a666f292b0ec1a4cb24371715d6c633f0e48b112d98d487689473bd47621044d15324c3e9c2228502fb70f402aa556143a6dc59e78acee2137ac67dc08ecb98338a12c20248bd0cef65b1765e4e625d4c5d185126852065d65b5b625ad6fbc20c447e25aa9fd627076e814dadb0cd537db8a00b3368395b68f9e082ed10b6bcf65e10a7d036666d4a33b3f19ac082ebc0c78f725c1af05f6610605e8fdc2b583c69148beb60e43a1a523449730fda255214fcd0767ca140957c0aaa70b1fc13cf91c80653bb858ecef0de7c1469b42f4777f3d44b77771e261285563bcaf90bacc29e53df01bc25fc8374320c7e2fdc1921890cea54139bf675b763a2dc87a7ffbf36b0a74b46f000de7ff72d65b7bf6a285635ea8d03d697b4febd8cf1dcb8f119a31798e62d964c407bf1c27014b14ea9978b17c36500b326f9e9d6c376f91ef1fcd9cfadd331296b924605cc258712d60cf74d709523a7a286a87bee2deb7c71bde2b866711ec7002cbd260b08638ffc521a08c15aa3485df1c7325981d3dc0c8ad05bfcb06d7f678931fb0a22a901d7f1ff93fd176a9de7a2e214c76723a6ec1b31155ae1a45ccc2e705d6cc21ab55f783a6346a3f8427e5c07e89dd7ba7cebe038d040f9d97fd5ac717abb593aeaedc92d73a4d33a11961fd72ec9fc10447040dc4bad1608149a446b66041b7bc927c091a22d246b397f4bbe509c2528c606df4d8d053b4c89a232bc1b21586195fb80570cd1d7fa27ae74d34e01a6b7c9d26004df83bc53f4c91d0c0dca7255a4fa3c72e8ac969d06875652bf5e6a546fcc1d2370d3ec28487ab4d8ffa81c1cebc18fef77ac424223c96398cddc7550ee820038050e156047deba9b7e42211ed00783ea7b8dedd9b33abd7420364fd9b6b3c03bdc2a465c9eb952f37288bac47ab965715b2adfc4e846e54ac0c6a35633139af347500a07cf4f5d01307725b481be3e41b635bfb7ffb82e8946592fcf5f348522da396dab66c4cb0ab8b6f054721df613a1099c61d35f58998130775098fb949a63da121d6dc587ba98b0b4bdd8d4e29cf63b0c7d1874f9d348915c57e5deb3abf186673fbe6ec9bfce2bc1783cc3d655c92e46d1c8944ca36d173428f25d02d3139260a5eb052a883c0231ee2fbda7ac7c56a1e2667a1f59d606d51f17434e1c74a4d292217bb962d1ee3b8375f8d90777846ee29effde57b586501bdb2172363bbe9d4221a2c190fd859be07844b8eac609e5ac15459c478d5bfb1238731f1bd0a9233a1a2e2c7fe434e89e834e3fd8ff422af98298a329b7e882d9b67693351f2f5b08307a8ceb16e54db62d400be764dd74b1a956f8d9ef5e63a2263ea1f6a8285487b82c7654944ebcbecbb24e8de434dcb609578bfe643989cd60fded521052771cc95c9154a4a4d9782789fa27977b45af0410a79c8200d45aa9f305f7f6d7df694947e557400bac11b75d1916f1957fa9bd1b75b15ca5e53e631cfca696c207c5a77406c75ec7511f15bc8a7578e7cd723b0bdd59513913755e6f99f259935fb67daae5865ef1829f46d8d4f04998100b126d3a09fff617018a5445660db3d0f885d0bbf9780ee8e5165b787e0812b9c4f095750f92a33c65b3d849976d825cd9753352a91100b09f0d74e608c8664629c17081ebde4e89586aa172afabeb6b73743771a2d2d4046d9b45660be161727fd2931259c78c353c382d7810f6793ebb9063f1771c117c33aaa9291c83960107c175a0968be42873728ced2bb82a917b705b4bfd861ffe0487c56e497cef165f62afa7511a48fb0d8cc17c4278a18215ff6211d813a8b45519e834bc2db58fdf2277d12bb070da0b463c80f34f5f40e66d88252d674df9585b592f9db03224db24ff0e87f8d517e91aaa56ee508a053a37c3c5750906f6eb4a410b8f2e6610772b767e2e17ba49677df983c677b1d7ce7adb2c0834c06e54c560a90f945384998dd2732910ad36da43182f8c1168b7a4c91b1eb211c3926b225a84c5ee0f65c353958d28b0e71fc8e25b915aac9bf967a57ad352da19d2fe5043a8ea341ace0972528f262922f0df8e0d7ba1c97ea39321932410df636cae80f0183e1adb2653012cab7ed21723b4a6cac5f9c5a7d01b36edf584cb7482acc2b164ed6de2241413138403e509f8b57b1afb8e78d8f847daee9abd3768fe294d97a8e120ec532c6bf73c0136774ada93badfdce4813c480b98cc667a6c2ea6bd94c964272c16493df9878967f11a5a5549ac3ff0284fed38b654b32cd24e3e7315d1ee6a953a0a4bdf604775dd61a0df4f3902670ed059bf10cebf39c3cc00c59610755bf65b95e9ef8c89ad1afed270c20740d29c192b0e9399d1f062cc4c96ce8ea873dedaf3afa77470eb2539f0dbbc4ddd584dc5e26d391beb1a328666a0b64cdaf3bca70cd5df84d249f21b5c5396a9b69d041353d92e4c07351108073b078b84b38242942897a3b6b41bc92086c98886c077b59b8753d5bc7e83b631298dd28e600cd1918cb7d9d4d354cced4d346110d8d856994b84b656d8e97693fae125dcefea57cbdbec4862496da43657c6a79f5a5ea8e3905d6e5812b3aaf584bdd76372e689febdab2f584aa2e0a132abc0828fb8a886a589f60da866f6a120c492282f0787b19ddf086efb28e0dafff0584a90ecaa3a6d5db774f029337b88130c66b7f7edf2d1903c7e2f13cf123d45895fd59cdcc91d0f1df4d6a7725a2ca060b872f6773e2b1c1b91a7074be7f6edbcde33791912b6751c7e76e1118332e64c7b4468c5f159eb6733a5649a0460247cc48cca8a21e702e7b993b846e1bcfda63e09229ea0254d585db56bec4b206b949dec6b270caf464ab47a4687eb7b0a8f7795253a0931147c86a49e4b988dbbe77e295a73760c600ab4eda5521d30f51e952ba6e1c9ecdaabe079c8c905a07682ef5b937d795efffd27c5b61b25276f04c27b80b2aa0f3bdb416f366851bf49b79c0a4202c0ecb330facccd4ea25297982d64b4ccbc9a298ddb17a11b71bc1b530b01274e61a0379c3fd7f9512e71a8d17936e3191531a95eeeeb3a04c73667f0f0e8f43ff98b9df7b6eb5eba8da607aab18cebe61ac2a49885e6f101c8a3d8e050e0c1e4aff47fcf4764f646befcc8db26746d8365f116bd925bd881f0d36be8b48914c2850227aba0f771655f9a709ad8bbe75f7410748b95d4928ab7a3c43d78db234dac33bf1f48bf82b7831aaf13087cc75ed7b424b635dab33662a8c8e8e8c55b08a7424dff97b92b04ec4fd996da3bd0664956913353a60901a6b4daacbc9a3efabbf738e2e0f182d0040d2cfa36719e28a61101b6b1438ed6a1efaff5c439301c39fde5f75ac4256792de92d817a8dbd48e78c688034e99ba9bd7b4a77105ba4d1841518066c58d341652e1f843f659f2294ee99ae5ad7c2fa8f419482bd7dfc6a972a00170a2952f88840dca63d672f3fda4baf64158cbffec3966893a6a35728ba4b8b241ebdc92228d36010f576773818efceeca6f44d146ae55126c131ea8f0c2a98aadbc8f530a04dfd2a0ab770793153ea6dbb4c683a2a524d06f7598b07d832e69623c47ecb657037cb06f526179c84e51c7500a69ae71d68e478195d9154cd0a22d17eb366948f4442d508a4c6193a980a5fb532f6511cc9e22a5c6f14e4b3d4ac60bedeabea35a18b6de38df20084f95974cddcef070a1c9e6a199abd7ed5bb630f7ca7a51ac7f278bea74394e4e7a6c9cf910bef44dc51101721c52e0ef827a75a8a1b6ea91f649d217e7843af2ec31fa2e8e93d58cd4d054d674d351294b11609bc8a15617f8dcc3ac8a89d6e44ee170a70ae7efd13baad5a6d833dfb1d4b4c20fa76e5284d294eeee37f10cb53294c9e3074d4e3de0420237a6c914b92b3cc5c3c07243ee80ce494f2c34d999209876e8c0568972f4cfbb95eb7092310df591396e542aa950d55d5a5bb372221cb34f533e0f908f38535c72530255f99896b5bd96c966764cfd02b505facb2b0a63fe0699db0ad431a8ce42120f4f893f4a771660b2cad5aba45909053a02c2d6d21f5895a48d82e1d2f3d92ce413df2798551a0361e89f83aa45aeff715ffba39191e42e2d221a9567ece6f21c7b9b4d1125c7fefd0dcee3a04cd2d965a87222d6217eaa476ac43db2e31112a27b73d5cd227cff93a001860b42f3fe1ae453dffd54ef726a91060dbd15f3c8c487bcdca9a6960e9dc581aa5353b17a67aba539d7025cc94245062b4399a93c4f325e36985957171d9f303623385c2acf18fd5311e942f369665c37aba62816d5a7799b913a0b1848da973d57a62e88e9154d274e4d5c395b8e91338a3f92cde7572bd55e9f2be6609dc69048abc4e5d59151e76306fa8fdc78bc89b911215df5bd75b6b71f8d59a3e0e9a7d2544549a6258d2f1afe3e9a0358efa61a1af1ba82be312b390f66454cfc90fe9141463aa6ad6231eee85f84b2d2bf2dcb2bdb8815bd309ed1a87c1b9775175ec3b7763354b0251bf20d78f7630ed96d054513c427b1e6bde9e10e6868ebc4ddf4911cf132aacb096d19004bef0342cb6dacdc9ed608400a10f41f69c417102d99a78a2d1713012878a3b65403ea8b92abc56f035b572d20af80a312b4d43b50fe5b802d76421f8f30c7e7ebeda974008afaad2f7cf9630fb3acb1e34a815f38fa5831b2edbaf65b0c3845f3071a154112fe7f61689ae901ea5ef5ca8cdf602521797783da9d8abf9f41a779359d7e09937f518ef98ebc8ead26c66cd2cbf88ad3083d55368fdd0d2c9fdfe3e316d5b962673fb5dcd73282c0546d92c4ada8c4037576a52da5dae57b8d4d76d5db34e35b039548909f45f9e7ac7f29ea281fbd308030d65341c8939cd74258256ca7bf2c05ca8682deef7092096d2bc239b97ec60f4b4ec7ea88b8dc4277b3f5eacc97d1cdbd000512d2645e871d61338f87ec111bac4dfed2acd19bf5224c8cdead77198099a6a9b261134d40a1b462d2cd2cdf7e9fd5accd7903422d2aeb7d7912ee34106d22a9ea17ecb1adc67a8cee3080437df9c713cfd86063a21f1c75508e1c4eee21f539a9979f01a347e2b889c46994c478e70c0ed4c10446273810930aa4becab5c6b638d32219f759c41865d3a241efaa21a6f7e1cd77ef1a30d32e02a431fc1e13fcb02b6f4838b827be7a532d5f91f028cb2afe81d01d8dc82055e0330495425efc587a3884a673ad139c6c7c8e1fe86adae286a8ffe13b5ba2a7b2d8ce51dd2693c9f77fb22931e6380e137913724f70ac100d096ed1a37083b1e0d498b8cace0cf815c1c74287c4af86e95dd9170863ae6743c04dbd0bcf34f2bd5218eda3c10b2e707d791810bac2a43d702f90b3ee56cfcd5420c53805c23b3fd372f242c686928a63e5519692d64257067f5001a0cd75f38406b2f8b67dcfb99d2c1f1cd0cf53dae955830ce334857e28c3d81c38093bd20f42b8f74bcd441c702f04c8d33e3a2f8342a858dc0c4be309ff3ff82c08d5c704e900e2466e8d665e9cee1f261a0a06957a29d364b13267fdfc62ae0ccef30b37a88e2bbf42d4bb652bdff259c3b42ce8dfc5e81aa7817a01ac7b191dfb87181a7a2c1fa94a91a500fce0aee2f8977034cfc64e0d269a3185e00ca613b571d6241f920c14fc0ec876e153282c47df92ce5ddb63671d2b76e34a0e5df773e6dd904e14b85c9fe46a44606e609803f4602b6dcce7f6f853afedd248c3f702d3c20c55bc7136266a636976f91736cc453f605d8ef0fa3e7cb906e2bd4009b00f4b67a55d048c7da2da28d33d5106b29fd9510c23142c4605bbcbb9d96c1aa27c2576df78cf99c1e1fd98a85d7ec5ea6a4e2050e46c591d9a70fbeeceda74a1b83e71b16c94d6551e3a17196d62a11620c279b2b07b6e359f0daadc96b632f6f36b6a379a4548b5404eb6ec1d58e8b565920cdaef71e449063d4f2aa3c6ff679776302e07fdf8adb22539cc6242cf55cfa93211d3f0380e1e33e6efa60154dada65e724eaf6213c293f6381ff20a3c3e1e11f5cd8b9ca8e4f3b2707d27cf356466163eceba484bdfe5e7a798c6c5a50ee1f6237c2c1ccf80c61f86449d93b7a8a9d600da827899daa2b7e3eaf6f57c0fa53753586a2aa4539e477dbc56ac447da4fae3101ff74ab1f5052bead8b4d02c6d013a92c21b4126600b340dba1ff6ef660260f17f3481f0357d4b85d9b774913f99f8fef32923dfe522c285c4cd594b8be6fe688e92f955c6ee2ee319460072c1b23c247ff6a18ac25b9671a0d2f160aa4c82bab66f93def3d3ac9f8668686d0ddc0ed447d7ace3368128e085561238875d5c5d23b3e2865766c54f2770539961bb9d987e30a4391bc2579c48e4aa51cd49333f31a5fc6757cd0d50ecc1c5ee06fe010f74ea753a4263bc52f0bee96cf1889ae8897fb9e4ab56607f92b3fa8822e4029d4064c0638000bf693aa68e16908998e576b0c5e9e0c5dd9122cd1d2eabe6c265bb64e24cf2f0c8ae5c325c9971e7307429b9eb80dafc5ca04f2b2a3daa8ad8a95691da021029a611ca4ff34df571f286289c1997cab6122a174a4f3cf22cdf3f60eeb9ccff0291d7b549e4b0b204f5b002658fca068c8264093181ad4181bfed78228ab4e6250a02e3b45705293c181c7d37d0df3d5f8f7b921c0cff05bb0ec40d7acfef9baf61436130902ab47bc39bddd3e5bcbcb10700dce3fcb72a8c5ba312c58d99960653a2e6719bd7707cc266d5e39297da9d593dc66a56a67968743ae624ffed41f59668c41c20fca4ba77a564003e7a25a13581e18c15329dcf3791f6ce102dc9adf09cef892d71fb35d4826ccb4fe2c72cc6d3963ff388b9b196d7f907a2a9285fc03da6706ac37d2e2571c7cf3776333b10caa898606aab77b4bc00d2aedf334b69746f748f8043d95992e1a261bfe9c7c27ce76f5ed53418ee2e92e82cdfa7510abfbdcee2e902f2f761a80ac95c84d2fd98cd315999e8156d6fdaa6b91e018448e9004daf26a824a1cfd4b2d47fba121fd2b7b3d0b40663deea27be6e40da616d498b890b62f166ac8df88f7b056cd7253b0ae5c1cfc4bd6ac6b501b3daef8f46cbce263f889e28e4ea360c1b5477b4f96ce8f6e45d99bca1425d877e54e3711f0a10b7caf0f30c132aaa8a03e3b0fe951cc13c893ec8b39ecf7d00f374fb4e81bae7f3b49c9ffa1c5b45d95467848eed181d33229f3d88ce52b311045bb51eb91fc84081c0c1ece0d87de57efa7625a0ad0f6c6e71c17e2daa5c3d0979e9ff8e1189820561e346504e3bcac74a2593cb0c2859fcb274566699f7a205f1b0a9310d136585ff6edd0e64ef68c20da574e22d7cdafd9edfd568a2d69a47bc5d5d7159cb19cacb8118898719b637841a6e2488043a7b49b170ce0851beb4f4a96023da22aaf1d62608ea0776314638f6ec8b7483dab5fd8fc0961d6ca25c6a17feaeea84ef9683c4ba6d6d2c34cbca6761e34ffd5fd3710a5e065d0cc0c1018981b7dd113ffc1d99b1c91e8a3e56abb472fca1161db6d0bc01d010a56a799f832231f65d61574daa9c4f7ca362cdb025f25f6eaee4baef28eb9d2f10d372ea7de821c399a91a931bffefa43645a8eef90e5c7f8a2ef70b293617d6fd6dd2b0f01c9e74c93069032c491391ba9ab72f1b2f816f9d9ec493212ad8470c4be880e82630aa8555dbe7e858d8d3653794dd1e877cc73d16ee3fa0f5a4f76c8211ea5d65b298ade79e7abcf54720720e108ae76e1829e23b84763335c48a69b8956adf73d2840c83cacf231b03bfbac36eaebc7bed0b49818035ff14278cefa310ed8a019c494376c3b8f087324e28260ed13d05977c1bde797e99221a3813d552dd4ea04ae39dac867b95bc2deb0fe1408b13a9647f90f1f40271789bf0dce87f210d11cc882a2180a837688fc8a", 0x2000, &(0x7f0000006080)={&(0x7f0000003040)={0x50, 0xfffffffffffffff5, 0x3, {0x7, 0x2d, 0x0, 0x21980000, 0x5, 0x1, 0x3, 0x3, 0x0, 0x0, 0x4}}, &(0x7f00000030c0)={0x18, 0x0, 0x7f, {0x1}}, &(0x7f0000003100)={0x18, 0x0, 0x2a, {0x2}}, &(0x7f0000003140)={0x18, 0x0, 0xffff, {0x81}}, &(0x7f0000003180)={0x18, 0xfffffffffffffff5, 0x3}, &(0x7f0000003240)={0x28, 0x0, 0x100, {{0x3, 0x10001, 0x2}}}, &(0x7f0000003280)={0x60, 0x0, 0x10000, {{0xb8f, 0x31a2d71, 0xf48f, 0x7, 0xffffffffffffffff, 0x8, 0x7fffffff, 0x5}}}, &(0x7f0000003300)={0x18, 0x0, 0x100000000, {0x8}}, &(0x7f0000003340)=ANY=[@ANYBLOB="15000000dade78743400"], &(0x7f0000003380)={0x20, 0x0, 0x201, {0x0, 0xb}}, &(0x7f0000003480)={0x78, 0x0, 0x2, {0x8, 0x7, 0x0, {0x3, 0x2e13, 0x4500, 0x9, 0xffffffffffffff7f, 0xc, 0x1, 0x462cb908, 0x6, 0x4000, 0xffff, 0x0, 0x0, 0x1, 0x4}}}, &(0x7f0000003640)={0x90, 0x0, 0x2, {0x1, 0x3, 0x4, 0x101, 0x5, 0x7f2, {0x4, 0x2956, 0x81, 0x4d, 0x7, 0x1a, 0x18c6, 0x0, 0x0, 0x1000, 0x9, 0x0, 0x0, 0x9, 0x8}}}, &(0x7f0000000740)=ANY=[@ANYBLOB="c8000000000000006fc80000000000000000000000000000050000000000a4277ff77105000007000000ffff00006d6f756e7473200005000000000000003d0000000000000005000000030000007666617400000000010000000000000000020000000000000521ed00cca9000023de10b75c000000060000000000000001800000000000000000000000000000030000000000d642439414e9e9b09a19ae325f82cc0000880000000000000001000000020000005c0000000000000080000000000000008000000000000000070000000e4700006d6f756e74730000"], &(0x7f0000003940)={0x298, 0xfffffffffffffff5, 0x3, [{{0x4, 0x2, 0x4, 0x14000000000, 0x81, 0x416, {0x2, 0x0, 0x0, 0x4000000000000000, 0x9, 0x8001, 0x8, 0xfff, 0x3, 0xc000, 0x4, 0x0, 0xffffffffffffffff, 0x4, 0xfffffc00}}, {0x5, 0x4, 0x3, 0x7, '\xc6+:'}}, {{0x0, 0x0, 0x5ba, 0x7, 0x8, 0x1, {0x4, 0xffffffffffffffff, 0x2, 0x4, 0x9, 0x3, 0xe7, 0x0, 0xa, 0x1000, 0xffffffff, 0x0, 0x0, 0x0, 0xfffffffa}}, {0x2, 0x2, 0x9, 0x0, '/dev/kvm\x00'}}, {{0x6, 0x0, 0x5, 0x0, 0x5, 0x7, {0x2, 0x8, 0x7fffffffffffffff, 0x9, 0xa8, 0xc0000000, 0x374, 0x10000, 0x40, 0xc000, 0x7, 0x0, 0x0, 0x45, 0x8}}, {0x5, 0x8001, 0x5, 0x40, 'vfat\x00'}}, {{0x5, 0x0, 0x0, 0xe5b9, 0x0, 0x2, {0x1, 0x7, 0xe241, 0x3, 0x80, 0x1ff, 0x5, 0xffff818c, 0x3, 0x1000, 0xff, 0x0, 0x0, 0x80, 0x5}}, {0x6, 0xfffffffffffffff7, 0x7, 0x0, 'mounts\x00'}}]}, &(0x7f0000003cc0)={0xa0, 0x0, 0x8000, {{0x0, 0x0, 0x1ed, 0x8000, 0x7fff, 0x4, {0x6, 0x50, 0x8000, 0xb, 0x9, 0x7ff, 0x3, 0x3, 0x6, 0xc000, 0x1, 0x0, 0x0, 0x7, 0x6}}, {0x0, 0x4}}}, &(0x7f0000003d80)={0x20, 0x0, 0x4, {0x0, 0x0, 0xd, 0x1ff}}, &(0x7f0000005f40)={0x130, 0x0, 0x2, {0x0, 0x8e, 0x0, '\x00', {0x2000, 0x10, 0xf8c, 0xeb, 0x0, 0x0, 0x1000, '\x00', 0x100000000, 0x0, 0x2, 0x3c, {0x4, 0xffff2d40}, {0x3f1, 0x400}, {0xe6db, 0x5}, {0x200, 0x1}, 0x85964e5, 0xdcd, 0x8e, 0x3e68}}}})

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-mkdirat-open_tree-fchdir-listxattr-openat$binfmt_register-ioctl$EXT4_IOC_GETFSUUID-ioctl$FS_IOC_SETFLAGS-mlockall-mmap$IORING_OFF_SQES-mmap$IORING_OFF_SQ_RING-getpgid-socket$inet6-socket$nl_route-prlimit64-sched_setscheduler-sched_setaffinity-getpid-sched_setscheduler-socketpair$unix-time-connect$unix-sendmmsg$unix-recvmmsg-sched_setaffinity-mkdirat
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000140)='\x00', 0x89901)
fchdir(r3)
listxattr(&(0x7f00000006c0)='./file0/../file0/../file0/../file0\x00', 0x0, 0x0)
openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)
ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000000)=0x4000)
mlockall(0x7)
mmap$IORING_OFF_SQES(0x0, 0x1ff, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000)
mmap$IORING_OFF_SQ_RING(0x0, 0x4bfffff, 0x500000f, 0x20010, r3, 0x0)
getpgid(0x0)
socket$inet6(0xa, 0x80002, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r4 = getpid()
sched_setscheduler(r4, 0x1, &(0x7f0000000100)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
time(&(0x7f00000000c0))
connect$unix(r5, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0)

program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work
single: successfully extracted reproducer
found reproducer with 30 syscalls
minimizing guilty program
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-mkdirat-open_tree-fchdir-listxattr-openat$binfmt_register-ioctl$EXT4_IOC_GETFSUUID-ioctl$FS_IOC_SETFLAGS-mlockall-mmap$IORING_OFF_SQES-mmap$IORING_OFF_SQ_RING-getpgid-socket$inet6-socket$nl_route-prlimit64-sched_setscheduler-sched_setaffinity-getpid-sched_setscheduler-socketpair$unix-time-connect$unix-sendmmsg$unix-recvmmsg-sched_setaffinity
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000140)='\x00', 0x89901)
fchdir(r3)
listxattr(&(0x7f00000006c0)='./file0/../file0/../file0/../file0\x00', 0x0, 0x0)
openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)
ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000000)=0x4000)
mlockall(0x7)
mmap$IORING_OFF_SQES(0x0, 0x1ff, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000)
mmap$IORING_OFF_SQ_RING(0x0, 0x4bfffff, 0x500000f, 0x20010, r3, 0x0)
getpgid(0x0)
socket$inet6(0xa, 0x80002, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r4 = getpid()
sched_setscheduler(r4, 0x1, &(0x7f0000000100)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
time(&(0x7f00000000c0))
connect$unix(r5, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)

program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-mkdirat-open_tree-fchdir-listxattr-openat$binfmt_register-ioctl$EXT4_IOC_GETFSUUID-ioctl$FS_IOC_SETFLAGS-mlockall-mmap$IORING_OFF_SQES-mmap$IORING_OFF_SQ_RING-getpgid-socket$inet6-socket$nl_route-prlimit64-sched_setscheduler-sched_setaffinity-getpid-sched_setscheduler-socketpair$unix-time-connect$unix-sendmmsg$unix-recvmmsg
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000140)='\x00', 0x89901)
fchdir(r3)
listxattr(&(0x7f00000006c0)='./file0/../file0/../file0/../file0\x00', 0x0, 0x0)
openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)
ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000000)=0x4000)
mlockall(0x7)
mmap$IORING_OFF_SQES(0x0, 0x1ff, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000)
mmap$IORING_OFF_SQ_RING(0x0, 0x4bfffff, 0x500000f, 0x20010, r3, 0x0)
getpgid(0x0)
socket$inet6(0xa, 0x80002, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r4 = getpid()
sched_setscheduler(r4, 0x1, &(0x7f0000000100)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
time(&(0x7f00000000c0))
connect$unix(r5, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0)

program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-mkdirat-open_tree-fchdir-listxattr-openat$binfmt_register-ioctl$EXT4_IOC_GETFSUUID-ioctl$FS_IOC_SETFLAGS-mlockall-mmap$IORING_OFF_SQES-mmap$IORING_OFF_SQ_RING-getpgid-socket$inet6-socket$nl_route-prlimit64-sched_setscheduler-sched_setaffinity-getpid-sched_setscheduler-socketpair$unix-time-connect$unix-sendmmsg$unix
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000140)='\x00', 0x89901)
fchdir(r3)
listxattr(&(0x7f00000006c0)='./file0/../file0/../file0/../file0\x00', 0x0, 0x0)
openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)
ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000000)=0x4000)
mlockall(0x7)
mmap$IORING_OFF_SQES(0x0, 0x1ff, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000)
mmap$IORING_OFF_SQ_RING(0x0, 0x4bfffff, 0x500000f, 0x20010, r3, 0x0)
getpgid(0x0)
socket$inet6(0xa, 0x80002, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r4 = getpid()
sched_setscheduler(r4, 0x1, &(0x7f0000000100)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
time(&(0x7f00000000c0))
connect$unix(r5, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-mkdirat-open_tree-fchdir-listxattr-openat$binfmt_register-ioctl$EXT4_IOC_GETFSUUID-ioctl$FS_IOC_SETFLAGS-mlockall-mmap$IORING_OFF_SQES-mmap$IORING_OFF_SQ_RING-getpgid-socket$inet6-socket$nl_route-prlimit64-sched_setscheduler-sched_setaffinity-getpid-sched_setscheduler-socketpair$unix-time-connect$unix
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000140)='\x00', 0x89901)
fchdir(r3)
listxattr(&(0x7f00000006c0)='./file0/../file0/../file0/../file0\x00', 0x0, 0x0)
openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)
ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000000)=0x4000)
mlockall(0x7)
mmap$IORING_OFF_SQES(0x0, 0x1ff, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000)
mmap$IORING_OFF_SQ_RING(0x0, 0x4bfffff, 0x500000f, 0x20010, r3, 0x0)
getpgid(0x0)
socket$inet6(0xa, 0x80002, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r4 = getpid()
sched_setscheduler(r4, 0x1, &(0x7f0000000100)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={<r5=>0xffffffffffffffff})
time(&(0x7f00000000c0))
connect$unix(r5, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e)

program crashed: KASAN: use-after-free Read in l2tp_tunnel_get_session
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-mkdirat-open_tree-fchdir-listxattr-openat$binfmt_register-ioctl$EXT4_IOC_GETFSUUID-ioctl$FS_IOC_SETFLAGS-mlockall-mmap$IORING_OFF_SQES-mmap$IORING_OFF_SQ_RING-getpgid-socket$inet6-socket$nl_route-prlimit64-sched_setscheduler-sched_setaffinity-getpid-sched_setscheduler-socketpair$unix-time
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000140)='\x00', 0x89901)
fchdir(r3)
listxattr(&(0x7f00000006c0)='./file0/../file0/../file0/../file0\x00', 0x0, 0x0)
openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)
ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000000)=0x4000)
mlockall(0x7)
mmap$IORING_OFF_SQES(0x0, 0x1ff, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000)
mmap$IORING_OFF_SQ_RING(0x0, 0x4bfffff, 0x500000f, 0x20010, r3, 0x0)
getpgid(0x0)
socket$inet6(0xa, 0x80002, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r4 = getpid()
sched_setscheduler(r4, 0x1, &(0x7f0000000100)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480))
time(&(0x7f00000000c0))

program crashed: KASAN: use-after-free Read in l2tp_tunnel_get_session
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-mkdirat-open_tree-fchdir-listxattr-openat$binfmt_register-ioctl$EXT4_IOC_GETFSUUID-ioctl$FS_IOC_SETFLAGS-mlockall-mmap$IORING_OFF_SQES-mmap$IORING_OFF_SQ_RING-getpgid-socket$inet6-socket$nl_route-prlimit64-sched_setscheduler-sched_setaffinity-getpid-sched_setscheduler-socketpair$unix
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000140)='\x00', 0x89901)
fchdir(r3)
listxattr(&(0x7f00000006c0)='./file0/../file0/../file0/../file0\x00', 0x0, 0x0)
openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)
ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000000)=0x4000)
mlockall(0x7)
mmap$IORING_OFF_SQES(0x0, 0x1ff, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000)
mmap$IORING_OFF_SQ_RING(0x0, 0x4bfffff, 0x500000f, 0x20010, r3, 0x0)
getpgid(0x0)
socket$inet6(0xa, 0x80002, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r4 = getpid()
sched_setscheduler(r4, 0x1, &(0x7f0000000100)=0x5)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480))

program crashed: KASAN: use-after-free Read in l2tp_tunnel_get_session
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-mkdirat-open_tree-fchdir-listxattr-openat$binfmt_register-ioctl$EXT4_IOC_GETFSUUID-ioctl$FS_IOC_SETFLAGS-mlockall-mmap$IORING_OFF_SQES-mmap$IORING_OFF_SQ_RING-getpgid-socket$inet6-socket$nl_route-prlimit64-sched_setscheduler-sched_setaffinity-getpid-sched_setscheduler
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000140)='\x00', 0x89901)
fchdir(r3)
listxattr(&(0x7f00000006c0)='./file0/../file0/../file0/../file0\x00', 0x0, 0x0)
openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)
ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000000)=0x4000)
mlockall(0x7)
mmap$IORING_OFF_SQES(0x0, 0x1ff, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000)
mmap$IORING_OFF_SQ_RING(0x0, 0x4bfffff, 0x500000f, 0x20010, r3, 0x0)
getpgid(0x0)
socket$inet6(0xa, 0x80002, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r4 = getpid()
sched_setscheduler(r4, 0x1, &(0x7f0000000100)=0x5)

program crashed: KASAN: use-after-free Read in l2tp_tunnel_get_session
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-mkdirat-open_tree-fchdir-listxattr-openat$binfmt_register-ioctl$EXT4_IOC_GETFSUUID-ioctl$FS_IOC_SETFLAGS-mlockall-mmap$IORING_OFF_SQES-mmap$IORING_OFF_SQ_RING-getpgid-socket$inet6-socket$nl_route-prlimit64-sched_setscheduler-sched_setaffinity-getpid
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000140)='\x00', 0x89901)
fchdir(r3)
listxattr(&(0x7f00000006c0)='./file0/../file0/../file0/../file0\x00', 0x0, 0x0)
openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)
ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000000)=0x4000)
mlockall(0x7)
mmap$IORING_OFF_SQES(0x0, 0x1ff, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000)
mmap$IORING_OFF_SQ_RING(0x0, 0x4bfffff, 0x500000f, 0x20010, r3, 0x0)
getpgid(0x0)
socket$inet6(0xa, 0x80002, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
getpid()

program crashed: KASAN: use-after-free Read in l2tp_tunnel_get_session
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-mkdirat-open_tree-fchdir-listxattr-openat$binfmt_register-ioctl$EXT4_IOC_GETFSUUID-ioctl$FS_IOC_SETFLAGS-mlockall-mmap$IORING_OFF_SQES-mmap$IORING_OFF_SQ_RING-getpgid-socket$inet6-socket$nl_route-prlimit64-sched_setscheduler-sched_setaffinity
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000140)='\x00', 0x89901)
fchdir(r3)
listxattr(&(0x7f00000006c0)='./file0/../file0/../file0/../file0\x00', 0x0, 0x0)
openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)
ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000000)=0x4000)
mlockall(0x7)
mmap$IORING_OFF_SQES(0x0, 0x1ff, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000)
mmap$IORING_OFF_SQ_RING(0x0, 0x4bfffff, 0x500000f, 0x20010, r3, 0x0)
getpgid(0x0)
socket$inet6(0xa, 0x80002, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)

program crashed: KASAN: use-after-free Read in l2tp_tunnel_get_session
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-mkdirat-open_tree-fchdir-listxattr-openat$binfmt_register-ioctl$EXT4_IOC_GETFSUUID-ioctl$FS_IOC_SETFLAGS-mlockall-mmap$IORING_OFF_SQES-mmap$IORING_OFF_SQ_RING-getpgid-socket$inet6-socket$nl_route-prlimit64-sched_setscheduler
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000140)='\x00', 0x89901)
fchdir(r3)
listxattr(&(0x7f00000006c0)='./file0/../file0/../file0/../file0\x00', 0x0, 0x0)
openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)
ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000000)=0x4000)
mlockall(0x7)
mmap$IORING_OFF_SQES(0x0, 0x1ff, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000)
mmap$IORING_OFF_SQ_RING(0x0, 0x4bfffff, 0x500000f, 0x20010, r3, 0x0)
getpgid(0x0)
socket$inet6(0xa, 0x80002, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)

program crashed: KASAN: use-after-free Read in l2tp_tunnel_get_session
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-mkdirat-open_tree-fchdir-listxattr-openat$binfmt_register-ioctl$EXT4_IOC_GETFSUUID-ioctl$FS_IOC_SETFLAGS-mlockall-mmap$IORING_OFF_SQES-mmap$IORING_OFF_SQ_RING-getpgid-socket$inet6-socket$nl_route-prlimit64
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000140)='\x00', 0x89901)
fchdir(r3)
listxattr(&(0x7f00000006c0)='./file0/../file0/../file0/../file0\x00', 0x0, 0x0)
openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)
ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000000)=0x4000)
mlockall(0x7)
mmap$IORING_OFF_SQES(0x0, 0x1ff, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000)
mmap$IORING_OFF_SQ_RING(0x0, 0x4bfffff, 0x500000f, 0x20010, r3, 0x0)
getpgid(0x0)
socket$inet6(0xa, 0x80002, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0)

program crashed: KASAN: use-after-free Read in l2tp_tunnel_get_session
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-mkdirat-open_tree-fchdir-listxattr-openat$binfmt_register-ioctl$EXT4_IOC_GETFSUUID-ioctl$FS_IOC_SETFLAGS-mlockall-mmap$IORING_OFF_SQES-mmap$IORING_OFF_SQ_RING-getpgid-socket$inet6-socket$nl_route
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000140)='\x00', 0x89901)
fchdir(r3)
listxattr(&(0x7f00000006c0)='./file0/../file0/../file0/../file0\x00', 0x0, 0x0)
openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)
ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000000)=0x4000)
mlockall(0x7)
mmap$IORING_OFF_SQES(0x0, 0x1ff, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000)
mmap$IORING_OFF_SQ_RING(0x0, 0x4bfffff, 0x500000f, 0x20010, r3, 0x0)
getpgid(0x0)
socket$inet6(0xa, 0x80002, 0x0)
socket$nl_route(0x10, 0x3, 0x0)

program crashed: KASAN: use-after-free Read in l2tp_tunnel_get_session
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-mkdirat-open_tree-fchdir-listxattr-openat$binfmt_register-ioctl$EXT4_IOC_GETFSUUID-ioctl$FS_IOC_SETFLAGS-mlockall-mmap$IORING_OFF_SQES-mmap$IORING_OFF_SQ_RING-getpgid-socket$inet6
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000140)='\x00', 0x89901)
fchdir(r3)
listxattr(&(0x7f00000006c0)='./file0/../file0/../file0/../file0\x00', 0x0, 0x0)
openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)
ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000000)=0x4000)
mlockall(0x7)
mmap$IORING_OFF_SQES(0x0, 0x1ff, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000)
mmap$IORING_OFF_SQ_RING(0x0, 0x4bfffff, 0x500000f, 0x20010, r3, 0x0)
getpgid(0x0)
socket$inet6(0xa, 0x80002, 0x0)

program crashed: KASAN: use-after-free Read in l2tp_tunnel_get_session
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-mkdirat-open_tree-fchdir-listxattr-openat$binfmt_register-ioctl$EXT4_IOC_GETFSUUID-ioctl$FS_IOC_SETFLAGS-mlockall-mmap$IORING_OFF_SQES-mmap$IORING_OFF_SQ_RING-getpgid
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000140)='\x00', 0x89901)
fchdir(r3)
listxattr(&(0x7f00000006c0)='./file0/../file0/../file0/../file0\x00', 0x0, 0x0)
openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)
ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000000)=0x4000)
mlockall(0x7)
mmap$IORING_OFF_SQES(0x0, 0x1ff, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000)
mmap$IORING_OFF_SQ_RING(0x0, 0x4bfffff, 0x500000f, 0x20010, r3, 0x0)
getpgid(0x0)

program crashed: KASAN: use-after-free Read in l2tp_tunnel_get_session
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-mkdirat-open_tree-fchdir-listxattr-openat$binfmt_register-ioctl$EXT4_IOC_GETFSUUID-ioctl$FS_IOC_SETFLAGS-mlockall-mmap$IORING_OFF_SQES-mmap$IORING_OFF_SQ_RING
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000140)='\x00', 0x89901)
fchdir(r3)
listxattr(&(0x7f00000006c0)='./file0/../file0/../file0/../file0\x00', 0x0, 0x0)
openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)
ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000000)=0x4000)
mlockall(0x7)
mmap$IORING_OFF_SQES(0x0, 0x1ff, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000)
mmap$IORING_OFF_SQ_RING(0x0, 0x4bfffff, 0x500000f, 0x20010, r3, 0x0)

program crashed: KASAN: use-after-free Read in l2tp_tunnel_get_session
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-mkdirat-open_tree-fchdir-listxattr-openat$binfmt_register-ioctl$EXT4_IOC_GETFSUUID-ioctl$FS_IOC_SETFLAGS-mlockall-mmap$IORING_OFF_SQES
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000140)='\x00', 0x89901)
fchdir(r3)
listxattr(&(0x7f00000006c0)='./file0/../file0/../file0/../file0\x00', 0x0, 0x0)
openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)
ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000000)=0x4000)
mlockall(0x7)
mmap$IORING_OFF_SQES(0x0, 0x1ff, 0x2, 0x109031, 0xffffffffffffffff, 0x10000000)

program crashed: KASAN: use-after-free Read in l2tp_tunnel_get_session
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-mkdirat-open_tree-fchdir-listxattr-openat$binfmt_register-ioctl$EXT4_IOC_GETFSUUID-ioctl$FS_IOC_SETFLAGS-mlockall
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000140)='\x00', 0x89901)
fchdir(r3)
listxattr(&(0x7f00000006c0)='./file0/../file0/../file0/../file0\x00', 0x0, 0x0)
openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)
ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000000)=0x4000)
mlockall(0x7)

program crashed: KASAN: use-after-free Read in l2tp_tunnel_get_session
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-mkdirat-open_tree-fchdir-listxattr-openat$binfmt_register-ioctl$EXT4_IOC_GETFSUUID-ioctl$FS_IOC_SETFLAGS
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000140)='\x00', 0x89901)
fchdir(r3)
listxattr(&(0x7f00000006c0)='./file0/../file0/../file0/../file0\x00', 0x0, 0x0)
openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)
ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000000)=0x4000)

program crashed: KASAN: use-after-free Read in l2tp_tunnel_get_session
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-mkdirat-open_tree-fchdir-listxattr-openat$binfmt_register-ioctl$EXT4_IOC_GETFSUUID
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000140)='\x00', 0x89901)
fchdir(r3)
listxattr(&(0x7f00000006c0)='./file0/../file0/../file0/../file0\x00', 0x0, 0x0)
openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-mkdirat-open_tree-fchdir-listxattr-openat$binfmt_register
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040), 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1)
r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000140)='\x00', 0x89901)
fchdir(r2)
listxattr(&(0x7f00000006c0)='./file0/../file0/../file0/../file0\x00', 0x0, 0x0)
openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-mkdirat-open_tree-fchdir-listxattr-ioctl$EXT4_IOC_GETFSUUID
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000140)='\x00', 0x89901)
fchdir(r3)
listxattr(&(0x7f00000006c0)='./file0/../file0/../file0/../file0\x00', 0x0, 0x0)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-mkdirat-open_tree-fchdir-ioctl$EXT4_IOC_GETFSUUID
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1)
r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000140)='\x00', 0x89901)
fchdir(r3)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-mkdirat-open_tree-ioctl$EXT4_IOC_GETFSUUID
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1)
open_tree(0xffffffffffffff9c, &(0x7f0000000140)='\x00', 0x89901)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-mkdirat-ioctl$EXT4_IOC_GETFSUUID
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-ioctl$EXT4_IOC_GETFSUUID
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
ioctl$EXT4_IOC_GETFSUUID(0xffffffffffffffff, 0x40047452, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_clone3-ioctl$EXT4_IOC_GETFSUUID
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID
detailed listing:
executing program 0:
socket$pppl2tp(0x18, 0x1, 0x1)
socket$inet6_udp(0xa, 0x2, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r0=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
ioctl$EXT4_IOC_GETFSUUID(r0, 0x40047452, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r1=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
ioctl$EXT4_IOC_GETFSUUID(r1, 0x40047452, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID
detailed listing:
executing program 0:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r1=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
ioctl$EXT4_IOC_GETFSUUID(r1, 0x40047452, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, 0x0, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r1=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
ioctl$EXT4_IOC_GETFSUUID(r1, 0x40047452, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(0x0, 0x0)
ioctl$EXT4_IOC_GETFSUUID(0xffffffffffffffff, 0x40047452, 0x0)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
ioctl$EXT4_IOC_GETFSUUID(0xffffffffffffffff, 0x40047452, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID
program crashed: KASAN: use-after-free Write in pppol2tp_release
simplifying C reproducer
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID
program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID
program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID
program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID
program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID
program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID
program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)

program did not crash
validation run: crashed=false
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)

program crashed: KASAN: use-after-free Write in pppol2tp_release
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r2=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047452, 0x0)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
validation run: crashed=true
reproducing took 42m48.32914703s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: use-after-free in pppol2tp_sock_to_session+0x1a0/0x1b0 net/l2tp/l2tp_ppp.c:156
Read of size 4 at addr ffff888110320c00 by task syz.2.17/369

CPU: 1 PID: 369 Comm: syz.2.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
 __dump_stack+0x21/0x24 lib/dump_stack.c:77
 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:435 [inline]
 kasan_report+0x100/0x140 mm/kasan/report.c:452
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
 pppol2tp_sock_to_session+0x1a0/0x1b0 net/l2tp/l2tp_ppp.c:156
 pppol2tp_release+0x150/0x2b0 net/l2tp/l2tp_ppp.c:435
 __sock_release net/socket.c:597 [inline]
 sock_close+0xb8/0x200 net/socket.c:1287
 __fput+0x2dc/0x730 fs/file_table.c:281
 ____fput+0x15/0x20 fs/file_table.c:314
 task_work_run+0x127/0x190 kernel/task_work.c:189
 exit_task_work include/linux/task_work.h:33 [inline]
 do_exit+0xa7c/0x24e0 kernel/exit.c:879
 do_group_exit+0x149/0x310 kernel/exit.c:993
 get_signal+0xfb1/0x1300 kernel/signal.c:2806
 arch_do_signal_or_restart+0xe7/0x11b0 arch/x86/kernel/signal.c:805
 handle_signal_work kernel/entry/common.c:148 [inline]
 exit_to_user_mode_loop+0xa2/0xe0 kernel/entry/common.c:172
 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:202
 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:277
 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f00f0a84317
Code: Unable to access opcode bytes at RIP 0x7f00f0a842ed.
RSP: 002b:00007ffe928eb3d0 EFLAGS: 00000202 ORIG_RAX: 00000000000000e6
RAX: fffffffffffffdfc RBX: 00005555925e8500 RCX: 00007f00f0a84317
RDX: 00007ffe928eb410 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007f00f0b60888 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 00007f00f0d50fac R14: 00007f00f0d50fa0 R15: 00007f00f0d50fa0

Allocated by task 368:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:430 [inline]
 ____kasan_kmalloc mm/kasan/common.c:509 [inline]
 __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:518
 kasan_kmalloc include/linux/kasan.h:254 [inline]
 __kmalloc+0x19f/0x330 mm/slub.c:4038
 kmalloc include/linux/slab.h:560 [inline]
 kzalloc include/linux/slab.h:667 [inline]
 l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616
 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772
 __sys_connect_file net/socket.c:1867 [inline]
 __sys_connect+0x3ce/0x450 net/socket.c:1884
 __do_sys_connect net/socket.c:1894 [inline]
 __se_sys_connect net/socket.c:1891 [inline]
 __x64_sys_connect+0x7a/0x90 net/socket.c:1891
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

Freed by task 336:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4a/0x70 mm/kasan/common.c:45
 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:362
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370
 kasan_slab_free include/linux/kasan.h:220 [inline]
 slab_free_hook mm/slub.c:1600 [inline]
 slab_free_freelist_hook+0xc5/0x190 mm/slub.c:1626
 slab_free mm/slub.c:3208 [inline]
 kfree+0xc0/0x270 mm/slub.c:4196
 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline]
 l2tp_session_put+0xb2/0x1a0 net/l2tp/l2tp_core.c:193
 l2tp_session_delete+0x3a9/0x4a0 net/l2tp/l2tp_core.c:1589
 l2tp_tunnel_closeall net/l2tp/l2tp_core.c:1235 [inline]
 l2tp_tunnel_del_work+0x180/0x3d0 net/l2tp/l2tp_core.c:1273
 process_one_work+0x6fd/0xbc0 kernel/workqueue.c:2301
 worker_thread+0xa8e/0x13c0 kernel/workqueue.c:2447
 kthread+0x324/0x3b0 kernel/kthread.c:313
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298

The buggy address belongs to the object at ffff888110320c00
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 0 bytes inside of
 512-byte region [ffff888110320c00, ffff888110320e00)
The buggy address belongs to the page:
page:ffffea000440c800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x110320
head:ffffea000440c800 order:2 compound_mapcount:0 compound_pincount:0
flags: 0x4000000000010200(slab|head)
raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 49, ts 23493189259, free_ts 23449555949
 set_page_owner include/linux/page_owner.h:35 [inline]
 post_alloc_hook mm/page_alloc.c:2456 [inline]
 prep_new_page+0x176/0x190 mm/page_alloc.c:2462
 get_page_from_freelist+0x225f/0x23f0 mm/page_alloc.c:4254
 __alloc_pages_nodemask+0x29a/0x640 mm/page_alloc.c:5384
 alloc_slab_page mm/slub.c:-1 [inline]
 allocate_slab mm/slub.c:1813 [inline]
 new_slab+0x84/0x3f0 mm/slub.c:1874
 new_slab_objects mm/slub.c:2632 [inline]
 ___slab_alloc+0x2f8/0x4c0 mm/slub.c:2796
 __slab_alloc+0x63/0xa0 mm/slub.c:2836
 slab_alloc_node mm/slub.c:2918 [inline]
 slab_alloc mm/slub.c:2960 [inline]
 __kmalloc_track_caller+0x1e4/0x310 mm/slub.c:4541
 __kmalloc_reserve net/core/skbuff.c:144 [inline]
 __alloc_skb+0xdc/0x520 net/core/skbuff.c:212
 alloc_skb include/linux/skbuff.h:1126 [inline]
 nlmsg_new include/net/netlink.h:953 [inline]
 inet_netconf_notify_devconf+0x169/0x220 net/ipv4/devinet.c:2120
 __devinet_sysctl_unregister net/ipv4/devinet.c:2625 [inline]
 devinet_sysctl_unregister net/ipv4/devinet.c:2649 [inline]
 inetdev_destroy net/ipv4/devinet.c:326 [inline]
 inetdev_event+0x7b0/0x1010 net/ipv4/devinet.c:1612
 notifier_call_chain kernel/notifier.c:83 [inline]
 raw_notifier_call_chain+0x90/0x100 kernel/notifier.c:410
 call_netdevice_notifiers_info net/core/dev.c:2052 [inline]
 call_netdevice_notifiers_extack net/core/dev.c:2064 [inline]
 call_netdevice_notifiers net/core/dev.c:2078 [inline]
 unregister_netdevice_many+0x100e/0x19f0 net/core/dev.c:10778
 ip_tunnel_delete_nets+0x343/0x390 net/ipv4/ip_tunnel.c:1122
 ipip_exit_batch_net+0x22/0x30 net/ipv4/ipip.c:619
 ops_exit_list net/core/net_namespace.c:190 [inline]
 cleanup_net+0x5fe/0xb80 net/core/net_namespace.c:609
 process_one_work+0x6fd/0xbc0 kernel/workqueue.c:2301
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:28 [inline]
 free_pages_prepare mm/page_alloc.c:1349 [inline]
 __free_pages_ok+0x80b/0x830 mm/page_alloc.c:1629
 free_the_page mm/page_alloc.c:5445 [inline]
 __free_pages+0xd8/0x390 mm/page_alloc.c:5454
 __free_slab+0xcf/0x190 mm/slub.c:1899
 free_slab mm/slub.c:1914 [inline]
 discard_slab mm/slub.c:1920 [inline]
 unfreeze_partials+0x150/0x180 mm/slub.c:2415
 put_cpu_partial+0xc1/0x180 mm/slub.c:2451
 __slab_free+0x2c9/0x3a0 mm/slub.c:3100
 do_slab_free mm/slub.c:3196 [inline]
 ___cache_free+0x10e/0x130 mm/slub.c:3215
 qlink_free+0x50/0x90 mm/kasan/quarantine.c:157
 qlist_free_all+0x5f/0xb0 mm/kasan/quarantine.c:176
 kasan_quarantine_reduce+0x14a/0x160 mm/kasan/quarantine.c:283
 __kasan_slab_alloc+0x2f/0xe0 mm/kasan/common.c:440
 kasan_slab_alloc include/linux/kasan.h:244 [inline]
 slab_post_alloc_hook+0x5d/0x2f0 mm/slab.h:580
 slab_alloc_node mm/slub.c:2952 [inline]
 slab_alloc mm/slub.c:2960 [inline]
 kmem_cache_alloc_trace+0x155/0x2e0 mm/slub.c:2977
 kmalloc include/linux/slab.h:555 [inline]
 kzalloc include/linux/slab.h:667 [inline]
 ____ip_mc_inc_group+0x1b7/0x8b0 net/ipv4/igmp.c:1456
 __ip_mc_inc_group net/ipv4/igmp.c:1491 [inline]
 ip_mc_inc_group net/ipv4/igmp.c:1497 [inline]
 ip_mc_up+0x112/0x1f0 net/ipv4/igmp.c:1796
 inetdev_event+0xbf2/0x1010 net/ipv4/devinet.c:1587

Memory state around the buggy address:
 ffff888110320b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888110320b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888110320c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff888110320c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888110320d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
------------[ cut h

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: use-after-free in pppol2tp_sock_to_session+0x1a0/0x1b0 net/l2tp/l2tp_ppp.c:156
Read of size 4 at addr ffff888110320c00 by task syz.2.17/369

CPU: 1 PID: 369 Comm: syz.2.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
 __dump_stack+0x21/0x24 lib/dump_stack.c:77
 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:435 [inline]
 kasan_report+0x100/0x140 mm/kasan/report.c:452
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
 pppol2tp_sock_to_session+0x1a0/0x1b0 net/l2tp/l2tp_ppp.c:156
 pppol2tp_release+0x150/0x2b0 net/l2tp/l2tp_ppp.c:435
 __sock_release net/socket.c:597 [inline]
 sock_close+0xb8/0x200 net/socket.c:1287
 __fput+0x2dc/0x730 fs/file_table.c:281
 ____fput+0x15/0x20 fs/file_table.c:314
 task_work_run+0x127/0x190 kernel/task_work.c:189
 exit_task_work include/linux/task_work.h:33 [inline]
 do_exit+0xa7c/0x24e0 kernel/exit.c:879
 do_group_exit+0x149/0x310 kernel/exit.c:993
 get_signal+0xfb1/0x1300 kernel/signal.c:2806
 arch_do_signal_or_restart+0xe7/0x11b0 arch/x86/kernel/signal.c:805
 handle_signal_work kernel/entry/common.c:148 [inline]
 exit_to_user_mode_loop+0xa2/0xe0 kernel/entry/common.c:172
 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:202
 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:277
 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f00f0a84317
Code: Unable to access opcode bytes at RIP 0x7f00f0a842ed.
RSP: 002b:00007ffe928eb3d0 EFLAGS: 00000202 ORIG_RAX: 00000000000000e6
RAX: fffffffffffffdfc RBX: 00005555925e8500 RCX: 00007f00f0a84317
RDX: 00007ffe928eb410 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007f00f0b60888 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 00007f00f0d50fac R14: 00007f00f0d50fa0 R15: 00007f00f0d50fa0

Allocated by task 368:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:430 [inline]
 ____kasan_kmalloc mm/kasan/common.c:509 [inline]
 __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:518
 kasan_kmalloc include/linux/kasan.h:254 [inline]
 __kmalloc+0x19f/0x330 mm/slub.c:4038
 kmalloc include/linux/slab.h:560 [inline]
 kzalloc include/linux/slab.h:667 [inline]
 l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616
 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772
 __sys_connect_file net/socket.c:1867 [inline]
 __sys_connect+0x3ce/0x450 net/socket.c:1884
 __do_sys_connect net/socket.c:1894 [inline]
 __se_sys_connect net/socket.c:1891 [inline]
 __x64_sys_connect+0x7a/0x90 net/socket.c:1891
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

Freed by task 336:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4a/0x70 mm/kasan/common.c:45
 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:362
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370
 kasan_slab_free include/linux/kasan.h:220 [inline]
 slab_free_hook mm/slub.c:1600 [inline]
 slab_free_freelist_hook+0xc5/0x190 mm/slub.c:1626
 slab_free mm/slub.c:3208 [inline]
 kfree+0xc0/0x270 mm/slub.c:4196
 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline]
 l2tp_session_put+0xb2/0x1a0 net/l2tp/l2tp_core.c:193
 l2tp_session_delete+0x3a9/0x4a0 net/l2tp/l2tp_core.c:1589
 l2tp_tunnel_closeall net/l2tp/l2tp_core.c:1235 [inline]
 l2tp_tunnel_del_work+0x180/0x3d0 net/l2tp/l2tp_core.c:1273
 process_one_work+0x6fd/0xbc0 kernel/workqueue.c:2301
 worker_thread+0xa8e/0x13c0 kernel/workqueue.c:2447
 kthread+0x324/0x3b0 kernel/kthread.c:313
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298

The buggy address belongs to the object at ffff888110320c00
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 0 bytes inside of
 512-byte region [ffff888110320c00, ffff888110320e00)
The buggy address belongs to the page:
page:ffffea000440c800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x110320
head:ffffea000440c800 order:2 compound_mapcount:0 compound_pincount:0
flags: 0x4000000000010200(slab|head)
raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 49, ts 23493189259, free_ts 23449555949
 set_page_owner include/linux/page_owner.h:35 [inline]
 post_alloc_hook mm/page_alloc.c:2456 [inline]
 prep_new_page+0x176/0x190 mm/page_alloc.c:2462
 get_page_from_freelist+0x225f/0x23f0 mm/page_alloc.c:4254
 __alloc_pages_nodemask+0x29a/0x640 mm/page_alloc.c:5384
 alloc_slab_page mm/slub.c:-1 [inline]
 allocate_slab mm/slub.c:1813 [inline]
 new_slab+0x84/0x3f0 mm/slub.c:1874
 new_slab_objects mm/slub.c:2632 [inline]
 ___slab_alloc+0x2f8/0x4c0 mm/slub.c:2796
 __slab_alloc+0x63/0xa0 mm/slub.c:2836
 slab_alloc_node mm/slub.c:2918 [inline]
 slab_alloc mm/slub.c:2960 [inline]
 __kmalloc_track_caller+0x1e4/0x310 mm/slub.c:4541
 __kmalloc_reserve net/core/skbuff.c:144 [inline]
 __alloc_skb+0xdc/0x520 net/core/skbuff.c:212
 alloc_skb include/linux/skbuff.h:1126 [inline]
 nlmsg_new include/net/netlink.h:953 [inline]
 inet_netconf_notify_devconf+0x169/0x220 net/ipv4/devinet.c:2120
 __devinet_sysctl_unregister net/ipv4/devinet.c:2625 [inline]
 devinet_sysctl_unregister net/ipv4/devinet.c:2649 [inline]
 inetdev_destroy net/ipv4/devinet.c:326 [inline]
 inetdev_event+0x7b0/0x1010 net/ipv4/devinet.c:1612
 notifier_call_chain kernel/notifier.c:83 [inline]
 raw_notifier_call_chain+0x90/0x100 kernel/notifier.c:410
 call_netdevice_notifiers_info net/core/dev.c:2052 [inline]
 call_netdevice_notifiers_extack net/core/dev.c:2064 [inline]
 call_netdevice_notifiers net/core/dev.c:2078 [inline]
 unregister_netdevice_many+0x100e/0x19f0 net/core/dev.c:10778
 ip_tunnel_delete_nets+0x343/0x390 net/ipv4/ip_tunnel.c:1122
 ipip_exit_batch_net+0x22/0x30 net/ipv4/ipip.c:619
 ops_exit_list net/core/net_namespace.c:190 [inline]
 cleanup_net+0x5fe/0xb80 net/core/net_namespace.c:609
 process_one_work+0x6fd/0xbc0 kernel/workqueue.c:2301
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:28 [inline]
 free_pages_prepare mm/page_alloc.c:1349 [inline]
 __free_pages_ok+0x80b/0x830 mm/page_alloc.c:1629
 free_the_page mm/page_alloc.c:5445 [inline]
 __free_pages+0xd8/0x390 mm/page_alloc.c:5454
 __free_slab+0xcf/0x190 mm/slub.c:1899
 free_slab mm/slub.c:1914 [inline]
 discard_slab mm/slub.c:1920 [inline]
 unfreeze_partials+0x150/0x180 mm/slub.c:2415
 put_cpu_partial+0xc1/0x180 mm/slub.c:2451
 __slab_free+0x2c9/0x3a0 mm/slub.c:3100
 do_slab_free mm/slub.c:3196 [inline]
 ___cache_free+0x10e/0x130 mm/slub.c:3215
 qlink_free+0x50/0x90 mm/kasan/quarantine.c:157
 qlist_free_all+0x5f/0xb0 mm/kasan/quarantine.c:176
 kasan_quarantine_reduce+0x14a/0x160 mm/kasan/quarantine.c:283
 __kasan_slab_alloc+0x2f/0xe0 mm/kasan/common.c:440
 kasan_slab_alloc include/linux/kasan.h:244 [inline]
 slab_post_alloc_hook+0x5d/0x2f0 mm/slab.h:580
 slab_alloc_node mm/slub.c:2952 [inline]
 slab_alloc mm/slub.c:2960 [inline]
 kmem_cache_alloc_trace+0x155/0x2e0 mm/slub.c:2977
 kmalloc include/linux/slab.h:555 [inline]
 kzalloc include/linux/slab.h:667 [inline]
 ____ip_mc_inc_group+0x1b7/0x8b0 net/ipv4/igmp.c:1456
 __ip_mc_inc_group net/ipv4/igmp.c:1491 [inline]
 ip_mc_inc_group net/ipv4/igmp.c:1497 [inline]
 ip_mc_up+0x112/0x1f0 net/ipv4/igmp.c:1796
 inetdev_event+0xbf2/0x1010 net/ipv4/devinet.c:1587

Memory state around the buggy address:
 ffff888110320b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888110320b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888110320c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff888110320c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888110320d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
------------[ cut h