Extracting prog: 3m12.780196612s Minimizing prog: 26m57.768427836s Simplifying prog options: 0s Extracting C: 52.27980226s Simplifying C: 5m46.671061456s extracting reproducer from 37 programs testing a last program of every proc single: executing 7 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-mount$cgroup-bpf$MAP_CREATE-mkdirat-socket$xdp-mount$overlay detailed listing: executing program 0: prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mount$cgroup(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000100)={[{@name={'name', 0x3d, '@@-'}}]}) bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000700)=ANY=[@ANYBLOB="0a00000016000000b40000000300000000000000", @ANYRES32, @ANYBLOB="00000000000000000000000057e061e7e92b1f89783bc4eff482b2358e72ca943d64eadea71058cd23a96889ab22cece86c842e09ff38e38e723652dd500fc8c24b195590bd3ccc2f1ab71a77c02e7be0300000000000000781413b40a75d64462d76412e9b7ce616bef7e944567a68d56a41bf3e8cc98d3f20f1c383c72c6b7480a12dc046e7f1062861527d0f5a80498d20756a86bb678e2b1c23fb7e13cd8354a7f170012aee012f7460a6ff9d365d6249ab70d50d6288df8e340e9cc468324fa1f6c55a9f3c0d0b5e39c6dd3acff805027a4c51fac4c59a3580a8da3efd8f216f5c537a9a87416be7e558069120c5ca9055905fce1bcceef1ac3d3d326a1b5d555e85f803635e11c1a47da35fed9600c342687fb39a722be1f768fb2c573fb121474c064f6d709ee762e4efa2c98009569b04286d81b6be9d99fdda1f20bbcdce285bd91519d66d643f1c0f8138a3ca6707c5f1197332102b68faa266cfc45131e801b3b0183ccdbfbe5ecea9af9e7c12493d9f7052831de0742959049f619dcef80b6d931e786227795a5cfe31a14d8eb0732ae6467fe9b427f8c93db358b17ac25407d5bce4dc6e1bbdcf35c3bcb73776a109201df520901d2ce7158483832", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) socket$xdp(0x2c, 0x3, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket-sendmsg$SMC_PNETID_GET-sendmsg$nl_route-prctl$PR_SET_MM_MAP-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-utimensat-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-ioctl$ifreq_SIOCGIFINDEX_wireguard-sendmsg$nl_route-sendmsg$nl_route-syz_open_dev$tty1-writev-socket$inet6-bpf$BPF_PROG_TEST_RUN-socket$inet_tcp detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) utimensat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xc8a4000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'wg1\x00'}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000005c0)=@newlink={0x30, 0x10, 0x439, 0x70bd23, 0x25dfdbff, {0x0, 0x0, 0xe403, 0x0, 0x20}, [@IFLA_LINKINFO={0x10, 0x12, 0x0, 0x1, @sit={{0x8}, {0x4}}}]}, 0x30}, 0x1, 0x0, 0x0, 0x10}, 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x3) writev(r5, &(0x7f0000002140)=[{&(0x7f00000000c0)="e2fa0e81ceb3dc4c43c215dc4dade38ff8c84acefa41ae002d4b61ce7602ee69ca59662a7ca071443645c1dc73113beeb9b5a73cd0415b0b37839aa6c68111a458fae5cf2c3a6a3bb8f9e0c32740df61cef926d51a7eff", 0x57}, {&(0x7f0000000140)='\x00', 0x1}], 0x2) socket$inet6(0xa, 0x2, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000d80)={0xffffffffffffffff, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000040)="76ea090000000000009ba56a88ca", 0x0, 0x6400, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$inet_tcp(0x2, 0x1, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-openat$procfs-preadv-setsockopt$inet6_MCAST_MSFILTER-ioctl$BTRFS_IOC_QGROUP_LIMIT-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_VCPU_EVENTS-syz_kvm_setup_cpu$x86-unshare-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_mount_image$vfat-socket$inet6-socket-socket$unix-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-setsockopt$inet6_MCAST_JOIN_GROUP-getsockopt$inet6_IPV6_IPSEC_POLICY-newfstatat-write$FUSE_CREATE_OPEN-setsockopt$inet6_MCAST_MSFILTER-setsockopt$inet6_group_source_req-syz_usb_ep_write-syz_usb_ep_write-ioctl$XFS_IOC_GETBMAPX-ioctl$KVM_RUN detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000010c0)='/proc/bus/input/devices\x00', 0x0, 0x0) preadv(r1, &(0x7f0000000000)=[{&(0x7f0000000080)=""/4094, 0xffe}], 0x1, 0x33, 0x1) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f0000001300)=ANY=[@ANYBLOB="06000000000000000a004e240000000820010000000000000000000000000001070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000a004e2300000000fe8000000000000000000000000000aa0e5a290e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000404742dd79393ea200"], 0x110) ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000080)={0x7b33, {0x2a, 0x6, 0xef, 0x4, 0x4}}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4040aea0, &(0x7f0000000040)=@x86={0x2, 0xd, 0x3, 0x0, 0x1, 0x1, 0x7, 0x0, 0x1f, 0x6, 0xc, 0xc, 0x0, 0x3, 0x3, 0x2, 0x2, 0x3, 0x2, '\x00', 0xc, 0x80000001}) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000009000/0x18000)=nil, &(0x7f00000008c0)=[@textreal={0x8, &(0x7f0000000480)="f466b8d1a8038f0f00d8bafc0cb0e30fc75c4599b00fee0f209a650fbc5d0ff30f09ad2e0f01d1", 0x27}], 0x1, 0x6a, 0x0, 0x0) unshare(0x22020600) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da07000000000001090224000100000000090400000903000000092100000001222200090581030800"], 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io$hid(r4, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="002217000000962313930ada245c782a7800070900be00071ed9c737995c1b5d8c3dda"], 0x0}, 0x0) syz_mount_image$vfat(&(0x7f00000000c0), &(0x7f0000000240)='./file0\x00', 0x220408a, &(0x7f0000000340)=ANY=[@ANYBLOB="756e695f786c6174653d312c6e6f6e756d7461696c3d302c756e695f786c6174653d312c696f636861727365743d6b6f69382d752c636f6465706167653d3933322c696f636861727365743d6575632d6a702c747a3d5554432c73686f72746e616d653d6d697865642c726f6469722c73686f72746e616d653d6c6f7765722c757466383d312c756e695f786c6174653d312c6e66732c73686f72746e616d653d6c6f7765722c73686f72746e616d653d77696e39352c00416786a537fd"], 0x1, 0x377, &(0x7f0000000b40)="$eJzs3U9oHFUYAPBvO0k2KW2zB6HoafUmSGkjHvSUUCoUc9DKUv9cXGyqNbsWsrgQwWz2ohRPghfBnrz14LVn8SDizYNXK0hVvFjwUGhwZHZn/2/6B9xY8fc7hC/vfd+8NzuPzGxI3r7Ris0L83Hx1q2bsbhYiLnV06txuxClOBRJdO3GVB8vTG8HAB5yt9M0/ki77pm8FId7oXs/APx3de7/bx0dNBTvmp4mw99dOTKzeQEAs3Of7/9fnNp6eWbTAgBmaOL+/8RI99iv+edi5P1/LM1+ggDAP+7lV197YW094ly5vBhR/6hZaVbiuUH/2sW4FLXYiJOxHHsR3QeF7tNC9vX5s+tnTpYzv5SiklU0KxH1VrPSfVJYS+LSsVoU41QsRymvT/v1SVZ/qlNfjojdVmf8qBealfnOHxtk4/94ODZiJZbjkYn6iLPrZ1bK+QEq9V59K6Idi72TyOZ/Ipbj+zfjctTiQmS1g/nvnCqXT6frI/XNa8VOHgAAAAAAAAAAAAAAAAAAAAAAzMKJcl8pjuT736T1VvPDc+MJpZH9cSrd7nx/oHZ3f6C0WMx357mSjO8PNLo/T7MyF4f+1TMHAAAAAAAAAAAAAAAAAACAh0djeyGqtdrGVmP7/c3hoDXU8u63X369FL2uubz0nWRQFXnjyHF6iUNHTqI/RNovT5ORnDxIInrJu9Vr1/szHs4p9s9iojwLihNdhXxO1Vrt6OM/fz6t6q8s2O20JDHxsowGhXz8oa76saxhMSL29qvaP1i5R86NNE2zYD4fdzhn57PxqnwrhtYDT2M8KOxOdH1z8+1Hn24cf6bT8lU+0pNPLZ+/8ekXv21Wa9HuzXBhq7GX3n2ItBWxHYWIya5kaP0U8td5ZcpKmB60By3trcZ2Nfnh91ce++S7seRk+vpJh1vemzrEB1f/PN+5GCNdC92gEFGavEyTwfyUxT89eP1Of/U++KU8fnW1en3np1+n5WTreLxq6IeEjToAAAAAAAAAAAAAAAAAAOBADP7pd6wjTdPWvlXPvjTziQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAARp8/v9Q0J5ouZ/gTismu4obW419B1860FMFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOB/7O8AAAD//0URdY4=") r5 = socket$inet6(0xa, 0x80001, 0x0) r6 = socket(0x10, 0x803, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000300)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000001100)={&(0x7f0000000680)=@newtfilter={0x86c, 0x2c, 0xd2b, 0x70bd29, 0x35dfdbfb, {0x0, 0x0, 0x0, r8, {0xffe0}, {0x0, 0xfff1}, {0x7, 0xfff3}}, [@filter_kind_options=@f_fw={{0x7}, {0x840, 0x2, [@TCA_FW_MASK={0x8, 0x5, 0x2}, @TCA_FW_POLICE={0x820, 0x2, [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x6}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x1, 0x6, 0x2, 0x0, 0x7, 0x40, 0x47c6, 0x1000, 0x0, 0x4, 0x5, 0x3, 0x1, 0x3, 0x2, 0x3, 0x6, 0xffffffee, 0x4aa00, 0x80000000, 0x81, 0x10, 0x1, 0x4, 0x51, 0x338, 0x4, 0x7, 0xffffffbe, 0x4, 0x604, 0x0, 0x1, 0xfff, 0x5, 0x5, 0x4, 0x6, 0x9, 0xbbc, 0xac, 0x3c, 0xe36, 0xc6, 0x8, 0xc888, 0x3, 0xbba, 0x4, 0x5, 0x4a43, 0x98, 0x3, 0xd, 0x1, 0x1, 0xaf, 0x0, 0xffffff80, 0x0, 0x4, 0xffff2a7d, 0x3, 0x3c00, 0x8f27, 0xde, 0x80, 0x8001, 0x1200, 0x4, 0xffffffff, 0x8, 0x7, 0x6, 0x8001, 0x5, 0x6, 0x1, 0x2, 0x40a, 0xb22a, 0x1, 0x5, 0x6, 0x4, 0x86c7, 0xffffff9a, 0x12, 0x9, 0xfffffff3, 0x4ef9, 0x6dc598e6, 0x8001, 0x349c, 0x4, 0x4, 0xb, 0xfe, 0x4, 0x5, 0x80000001, 0x10000, 0x20, 0x2c8, 0x9, 0x9, 0x5, 0x8, 0x9, 0x0, 0x0, 0x1, 0x7, 0x0, 0x5, 0x7, 0x2256, 0x0, 0x4, 0x1, 0x2, 0x3, 0x401, 0x4fa, 0x7, 0x0, 0x0, 0x5, 0x3, 0x401, 0xc7a2, 0x2, 0x0, 0x8, 0xf, 0xffff, 0x3, 0x0, 0x0, 0x7, 0x9, 0x2, 0x6bca, 0x4, 0x2, 0x7, 0x1f, 0x6, 0x7ff, 0x1d4, 0x6, 0x1, 0x84a, 0x9, 0x235f, 0xa, 0x9, 0x2, 0xffffff80, 0xc, 0x2, 0x4, 0xa4, 0x9, 0xffffff1c, 0x3d0, 0x0, 0xfffffdfe, 0x153, 0x3ff, 0x4ba1, 0x7fffffff, 0x6, 0x9, 0xfffffff8, 0x5b20, 0xffffffff, 0xfff, 0x411, 0x7, 0x6b6, 0x5, 0xffff7fff, 0xdc08, 0x4, 0x0, 0x8, 0x8, 0x9, 0x0, 0x7f80000, 0x5, 0x1, 0x800, 0x2, 0x8, 0x0, 0x0, 0x8, 0x1, 0x7fffffff, 0x80000000, 0x6, 0x5, 0xa5e7, 0x1, 0x6, 0x34c, 0x88b5, 0x5, 0x168, 0xf, 0x0, 0xfffff691, 0xdee508a, 0x3, 0x1000, 0x8, 0x5, 0x80000001, 0xc3, 0x1, 0x3, 0x5, 0x0, 0x8, 0x9, 0x5, 0x3, 0x3, 0x2, 0x87, 0xaa1d, 0xfffffbff, 0x7, 0x7, 0x7, 0x6, 0x4, 0x0, 0x6, 0x4, 0x4, 0x7fff, 0xef, 0x7fff, 0x0, 0x1, 0x7, 0xfff, 0x10000, 0x9, 0xec, 0x0, 0x58, 0x683]}, @TCA_POLICE_RESULT={0x8, 0x5, 0xffffffff}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x55e4, 0x4, 0x8, 0x6, 0x7, 0x6, 0x9, 0x10001, 0xb, 0x401, 0x2, 0x51e, 0xfff, 0x7, 0x40, 0xd6256e9, 0x3, 0x3, 0x7, 0x5, 0x100, 0x5, 0x200, 0x4, 0x3000000, 0x5, 0x6, 0x3, 0x3eb3, 0x1, 0x314c2368, 0x8, 0x8, 0x8, 0x2, 0x10001, 0x4, 0x0, 0xb, 0x4, 0x7, 0x5, 0x5, 0x1, 0x4, 0x0, 0x7, 0x0, 0x8, 0xd9, 0x40, 0x80000000, 0x2, 0x3, 0x80000000, 0x4, 0x800008, 0x2629, 0x3, 0xffffffc0, 0x2, 0x8, 0x4, 0x5a3, 0x7, 0x9, 0x1e47e68c, 0x600, 0xe0, 0x9f5, 0x80, 0x6, 0x60d, 0x2, 0xca, 0x80, 0xffff, 0xcc, 0x2, 0x9, 0x7dd, 0x6, 0x9, 0x7fffffff, 0x7, 0x7, 0x2, 0x8, 0x401, 0x9, 0x7d0c, 0xd8fc, 0x1, 0x6, 0x94, 0x8, 0x0, 0x7f, 0x7, 0x8, 0x3, 0x4, 0xe, 0x7, 0xb90, 0x2, 0xe16f, 0xfffffffc, 0x1, 0x80000000, 0x3a, 0x1ff80000, 0x3, 0x5, 0x7, 0x6, 0x80000, 0x0, 0x4, 0x0, 0x9, 0x8, 0x9, 0x8, 0xfffffffa, 0x10, 0xffff3d8c, 0xfff, 0x5, 0x8000, 0x7, 0x8, 0x6, 0x8000, 0x4, 0x4, 0x3, 0x1, 0x7fff8000, 0x76d, 0x80000001, 0x10001, 0x4, 0x9, 0x4, 0x0, 0x7, 0x2, 0x25ee, 0x10, 0x5, 0x2, 0x6931, 0x2, 0x2, 0x8, 0x1c00000, 0x9, 0x6, 0xffffca2a, 0x0, 0x7f80000, 0xc, 0x4, 0x4, 0x5d, 0x9, 0x2, 0x10000, 0x8, 0xffff6f38, 0x5, 0x2, 0x4, 0x7, 0x3, 0x8, 0x5, 0x81, 0x7ff, 0x3, 0x800, 0x4, 0xff, 0x24000000, 0x0, 0x1, 0x4, 0x0, 0xffff, 0x7, 0x9, 0x7, 0x5, 0xc8f, 0xe, 0x101, 0xfff, 0xfd44, 0x4375, 0x8, 0x3, 0x800, 0x3, 0x3, 0x5, 0x7697, 0x401, 0x5, 0x2, 0x4, 0x8000, 0x6, 0x2, 0xffff, 0x5, 0x0, 0x1000, 0x7, 0xf, 0x4, 0x800, 0x8, 0xf, 0x1, 0x6, 0x6, 0x9, 0x2, 0x2, 0x3, 0x9, 0x0, 0x10001, 0x1, 0xfffff5d2, 0x80f, 0xc0, 0x80000000, 0x4, 0x2, 0x401, 0x6598, 0x0, 0x6, 0x7, 0x7, 0x6, 0x995, 0x2, 0xf0, 0x0, 0x10, 0x8, 0x9, 0x7]}]}, @TCA_FW_INDEV={0x14, 0x3, 'ip6gre0\x00'}]}}]}, 0x86c}}, 0x24040084) setsockopt$inet6_MCAST_JOIN_GROUP(r5, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000001140)={{{@in=@private, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@dev}}, &(0x7f0000001240)=0xe8) newfstatat(0xffffffffffffff9c, &(0x7f0000001280)='./file0\x00', &(0x7f0000001440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x7400) write$FUSE_CREATE_OPEN(r1, &(0x7f00000014c0)={0xa0, 0xfffffffffffffff5, 0x0, {{0x5, 0x1, 0x8, 0xd19, 0x4, 0x1, {0x4, 0x6, 0xffffffffffffffa8, 0xff, 0x8, 0x2, 0x4, 0x7f, 0xf, 0xc000, 0x5, r9, r10, 0xe7}}, {0x0, 0x2}}}, 0xa0) setsockopt$inet6_MCAST_MSFILTER(r5, 0x29, 0x30, &(0x7f0000000200)=ANY=[@ANYBLOB="01000000000000000a0000000000ff00ff010000000000000000000000000001000001000000000000000000ffff00000000000000bd0000000000000000000000e4ec01000000004000000000fc00000000000000000000000000013da51fd47aa2e2f700000000000000000000000000000000000000000000000000000000000000060000000000000000050000000a004e200e8a34c38f36f0c7eb2700d609bcf41076d88144448ebe7994dd1b33d7c8787734cc315672f62261ceeede940774fd94d2767288cfb3a20882449d601ff878eedd3d57c9eb3a723b62102bd534c8a304a975d752e82cc8d5f969771c94a1d69cfd8694e29b9468fca5df65ece31ed7c209325604001fcd06adc3ac391f60a3523d6d0b4a8a"], 0x310) setsockopt$inet6_group_source_req(r5, 0x29, 0x2c, &(0x7f00000005c0)={0x1, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @empty}}}, 0x108) syz_usb_ep_write(r4, 0x81, 0x0, 0x0) syz_usb_ep_write(r4, 0x81, 0x0, &(0x7f0000000000)) ioctl$XFS_IOC_GETBMAPX(r3, 0xc0205838, &(0x7f0000000000)={0xca, 0x6, 0x9, 0x7, 0x81, 0x1, 0x6}) ioctl$KVM_RUN(r3, 0xae80, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-connect$pppl2tp-socket$inet_udp-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_SET_MESH-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-sendmsg$BATADV_CMD_GET_DAT_CACHE-sendmsg$BATADV_CMD_GET_DAT_CACHE-socket$key-sendmsg$key-bind$inet-connect$inet-setsockopt$inet_IP_XFRM_POLICY-syz_emit_ethernet-sendmmsg-openat2-socket$pppl2tp-socket$pppl2tp-fcntl$dupfd-socket$inet6_tcp-socket$inet6_tcp-ioctl$sock_SIOCGIFCONF-ioctl$sock_SIOCGIFCONF-timer_create-timer_gettime-sendmsg$key-sendmsg$key-setsockopt$inet_mtu detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) r3 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0xfffffffffffffe39, r5, 0x1, 0x4070bd28, 0x1}, 0x14}}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) (async) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast2, @in6=@private2, 0x0, 0x0, 0x4e21, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x6, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x100000000000}, {}, 0x0, 0x0, 0x1, 0x0, 0x3}, {{@in6=@mcast2, 0x0, 0x33}, 0x0, @in=@loopback, 0x0, 0x0, 0x0, 0xb7, 0xfffffffe}}, 0xe8) syz_emit_ethernet(0x6e, &(0x7f0000000040)={@link_local, @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x2f, 0x0, @private, @empty}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x6558, 0x0, 0x0, [0x0, 0x0]}, {0x0, 0x0, 0x0, 0x0, 0x11}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [0x0, 0xffff]}}}}}}, 0x0) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x20) openat2(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', &(0x7f0000000280)={0x8200, 0x0, 0x10}, 0x18) socket$pppl2tp(0x18, 0x1, 0x1) (async) r8 = socket$pppl2tp(0x18, 0x1, 0x1) r9 = fcntl$dupfd(r0, 0x0, r8) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFCONF(r10, 0x890b, &(0x7f0000000000)=@req={0x28, &(0x7f0000000040)={'veth1_vlan\x00', @ifru_map={0x6, 0x7e779edd, 0x100, 0x21, 0xdd, 0x5}}}) (async) ioctl$sock_SIOCGIFCONF(r10, 0x890b, &(0x7f0000000000)=@req={0x28, &(0x7f0000000040)={'veth1_vlan\x00', @ifru_map={0x6, 0x7e779edd, 0x100, 0x21, 0xdd, 0x5}}}) timer_create(0x0, 0x0, &(0x7f0000000300)) timer_gettime(0x0, 0xfffffffffffffffc) sendmsg$key(r9, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000004c0)={0x2, 0xf, 0x8, 0x5, 0x206, 0x0, 0x70bd2b, 0x25dfdbfc, [@sadb_x_sa2={0x2, 0x13, 0x1, 0x0, 0x0, 0x70bd26, 0x3506}, @sadb_x_nat_t_port={0x1, 0x16, 0x4e20}, @sadb_key={0x201, 0x8, 0x8000, 0x0, "fcc070443d5faf4b9734e533c27cfeb97ccf4a8d153b25f8600883cd6acd7ccfc84699891f3aadf45b12d510bcbeee2a73df8bb14fcd187bcd4fa8e881b4727eafcc94a2afd6ddbfeb06e88e90fb9804a1a8c8b52628ea76fb4d810922926e95f2f44deb206001daf0f8d295aa1317d6dbdbc99630fabfdb622af5580abed609644da899ee29f92f785d3eca6fe61c31e8b617f75cadb2fc6f6186914a55dbbf5d250f3f326c7fc085a29d3e49ba20272aeeaa4ce27a4f8fa9b3f3aa2fc25d8bd113b7c9e8327667c6fdbf8838a50172de1b78ab6308f2327e43d2472375f32959506c3c19f05c6ee7ce0366d36ca10ca771c96d5af3a523bbc10db5a5ebb907fde5bffecdb5b229a04bc1048d2b8bfe3cd98e8d784dc58e947b8b11da102f4089e9d8389d1d8e773af3bd3021510a51401280e4679f453b9c3c4c7e018b42cdc63081a08d63ddd3c66b9e29e03ed6bb131c2a7f3515d7f7a6521b4960efc1c66b2ef446561322ce1a6316212516fcc7d426553370c87c4a57c599c9a820919f50263eef4b8936a68572bd138eff610d5826d6f949cc8ff0fece666bd50bf7e09e69510dc3c74eed52835693966db394097f6ee77ada789878f00377867e208e9327a40ad1f1791f6bd8c9dd2c0375980161aef99aef787e9091a84994fcf2fc9040f8a6c708baf2f84888a2c316a3c844863675d50558fbf35cfb5329b495807da796277d80f1dcd3f273f91cd805331a47e25d73dbe9b592bdde9da01de7bb468615a429d8e61fedf7b3de29b2d70a177fd4f70575f1fa12c16d4f6dfda5b29ee4d419d2c889c14404f9d64865e6f775a0a9cd47f205decf42a7c7b713efd27c836068dee4616e2b8b86dec65fa83e95b5bb0a827c0c83d79d3180eea1e6c40d6eb0756e1dbcd75d2dd65588974a057edbd88ebc630504f62d5a3ec8017d10daedc985d0278b7bf6e75cf7676e109988671e7736ad3e4a3bd48d78260402a589566a8f477bb468904a86ae8b9e54fb6a5dbdd40591cddb4a6031d39c020ddae5aafb9c23941ef1dcce5b1830b12ddbb3a7385553790529537fd9d2f89ed500ed53c569e155c5de9e909a450d4adcc06e27f378a1cd0f9a8fc69ca2bb7a63d747d210ca90ea42afb251461642a18fc5d7be3278ad1c0b6563bf3fd7541ddb315a83bcede761e4d9c8152841bc0e0a4c2467522e0d77ec448251b99fc1016de4dc359e7683f91ba529904734f242112cac0b10d9b5a372f5eab79c60eef59f32286eed582710f3467694ce52d2f8f226d68e531814b3595913a9abd7e1ca641135ff7c65f29937cb7094563b7d9fbd902d056cfe9ba71e31ce1230bde629357cc77dad758b587c58ae51f5b38e22ccd7ccde8adb57c3c60c2e2a142ecf1c3da522a84d085e3b38524d0874c0d3fd106500bba34469b2841dc0423a31232891cc4504b5fb1da26658acaa137040ab32df7f5c3a40435aed3dcea20721c42dd970e71232c56a1bed7a7359a4c8a630136539f6ccabb90969d3415b9bdb13359e1f06cf64f981670e04adeb6202edf7e520b891f992f23f5dd735c46851f5528f88f4ba8ed0affe54c036f54ad678c735882bbe9312516cafad63072ee752d9fe57b3c2b039b29cc35fed9d96c513c6ffb7b1fc66f3ce180b0608e4e43b5078ab910baba825e09d749d5d0d7ff33cc7c2d9b2dfcdc457f878060e175c0e4e6d7239138d6d4be2fc164abc54f0f61d8f68cb3183882ff197dc53f6dfd2e45575e6d9467c53f8f8149b2339047f9cc51a21bb81fa37096c633f2e80a8463cc1500eea53ca41736bf42e7b041d39a29f34c11a33647ceba95beca12c3a2239754351bb35eaeb82bcf8c37d88555092bf192943cda4e7375637f637dba42d40cbb30af90f3493ef40d8fa45a29d73cb8c411051c73e24b7728790628387be5aa1c3f8d3747dfadbe7b81dfb67d009759cd212fdb0e733309ebe99e387d2980651dc9f7d5a3b8923fd941c62ffa91e7089e19ed516e53a5d55bd01261e2d74eae3eff75a3b6de94d55b3f1d41b3025a04a5ac5cff85ddab59dcde2f7ee17ad40f5aaab9e0f505550be739da197564c4e5160991e45246723ee54f2000258b4dfecbcc190391fdcb040e5de52e8c432a5dd479cbd68999468ac526daecce4db61672a2b57bbfd6029a2a42fafc3d6e3c4dc7fe13cf0bfc8dd1b8a25fc8d34da20ccd4b08998e1d9074425b49af322edb15b411a1e9abfc542468305f1a89c8420affdbe4bec1aad45738f8a433f5064003edb190bb5b279fca2c4f5ba88ddce97f41e0d56567c3a4159d9df3d0d96f7fe06d3a2772faebe3d35d4f6ec9d6ff1cea37542fa0fe3ad9d4b8b390c3c2b9b3e366441d87426e7432c66685ebd9a8532a62701a4a57adebcc464c1ae11803062e1c90fafeb34ffdc8db28a279884821bf3d9e3b98a872e89b4f18d18ec39ed25082b32d75da263a7bd6d2001a9c53d9e284fb74ce0f55e19c0b1b4e09e981ec7a5eb74728da012abc84cebe737cc00831d88d9a76810bf750621efcabc4cd818292904dd3688c2b8211baa3ec71fe531314eb9f4c95e0aabd931d5e2507e2af7af34a0e20c2011cb9f2079ab7ac6064226421a619aeeb8be56e1a63ef628394a3ad1b8404523241aa9b3bd0aec868d26504dc66cd5f626e5f1d040fad7c27f6eccb53841bad267e39d467b0c772fd06c41588ed8611b317a36f8527e42ee02b1e7ccb8109ef71b04d541c315b0696c66f2415d500d0816271c27ab0bfb30661173b679c8e3c932514355c74535d0dbd126da9c832de60fe695abaef2f7a2fa1eed05d693a1beb7cc474dd515eb843f3e01a7a98c12e6c6603cd9cf20abc836c67fc724cd321b52b4d7c1d7d20d138302b69d46afe077ee675eba2007185c6d4bdde258d10543c65c43e818dee2698ccec3d5c8132e8cd9802bbfbc4194136e3691ca6cfe193182f900cb32d73b055d17b470c5d901e9d051b07e736170ac6be38ac2ff83fa2f566410c4907323d289a0746529733ea64dc7bed96381e1cf4a69a53289b72c9ed4426f16cdcd2eb2e24c437c3ed02293daac0852e16f2e65e12bae5c762997275d77fd3beafa1bc60eb1aea517a42b4c3d8e9360850365156aab420c4c12038604b8ec12e133e8cac75a2f810dcf451d0b8c2b2392d4dc2dcfe1a5c951cc32eb2444ba8b974c62e9719d932f00e6764e5b03578059124186c376a343801db3fa2af2c6a4388dba30fadcee806cc94810d81719986fe9533e7665cbc64d31e3df547b1ae9e2b98b9a776024c19ce35933cc7a4ed1010417cf8f95f9f5ac25b6913497ed4cc06607d1b1978549174df3784a42abb4abd0705acd030228e3527a1494999e9b65aa2e702f886c636a6893b9a55d85ff8f4dbffcebb2ca784360fc005f6ee268182aa0c6017cb75f275315374aad7445f91d4c59aa9280e35f4bf1335e7acc81fe5b3535a7076ec9bd101750e5b458a479e0225410488266e65dc84f66e742506b7289f23cbbf8097822092a6bf5892c0cb9f56838931068c2c7a2ad00a9d2a6300a04ac9a113934a1b3e763665a3d0d0ad93a649a58694c3f9edd915231451b950a7cadedb5b700938d25ca21461971b033bd20416e9368494f937a621b6ce1dea5ba2e0f9c3f68497b18f2c5e926c8dcda5c85b96566fb543da1110013c723e6ec89570e913ca282be0c7df27071bd6c6b2e3d98315ea9174a69462c21038387b9e3f45c84a148d8c3c9687cf354bfa27d069cbb0d6bc4356fab5a16e8459edd71b64ccaae87928c72ecd6808a2e9faaac3e0ffc9346235d408497314b79a61d3423a9705e0345bd6134c1850ff93fe36e07a01932ca6e4cb8406db4f578e9179db2abf585aeabda2403151624c0a6d14c41d45be1ed82c0a5c1dd6cdb0c56fa3a6cd8b47c104e38e55b7d5909fcb3155f6fe5d8486daf5d39da45da6395270725a0491548fe80f16beb1a20e592cb1efb20e6582fc1041397132a820d58fba598fd857b71efa0378e6c9f068d3fffb6bad38910b46591357b663c378074be143ec3cd224d9466e2ca8cfd145794213627724dceb1d4bcbf36b8366fb815a94a279c291987b2ca735f5a415e46ba736ddaf75959284aee7abba31de396dc36792d187efce0ce07a78ea378d464b946a3f54046e1c3a433b84304206d6ed7ee05b17ef0a682dd5e7151b9cfdadcff24778e8ef0ad7387e6973776c95b24aa5fe912df3729859534d7e072e5cb3af40736d7999d5ebffef20bd7246383f98dd8d072134350124114d6d6dd0b8be02005744694166a3560709a2919b9f8258bfa0e4b9417ed46112bc07489bff933080f08297ab19298afe4deb9ba51016236fd3da7ed5ca151393a271dc17f200b3964b59b0136198bd9b267da3c6d48d8336f0aba676e9b49e906441cdecd96748d7e984fa25d258c99d405bf5cde2e5a722a2bb2d5600285b26849e500da7d892ac5dc0848dd97adeffc1906dabc5dca279919270907f69890936a93ae69070a5fb910d5b3d1e363db224549a0a38c9c88a0332c4d4fd71e6627f2c4c0f691de2b445a34ee1721042cf4a8da98e5f1dd6087de5b82eb744ebc5faa619ff2bcafe34ddcf0ae9b44954acba4823a88ce10d8d278ed23644ce5528a64f8ada4edb29837850f8210d697369e555b6e0e5604873d3a97f004756d7a1dd1cfeb9fc9f1646e6816ecad49b7b55ee401e23db4721c20adbbd56f3640448a08e2ced175c20808497f7c493e8fd4fae0e8fa2d5a2d61339f2173b5b32ada1298c2589576458c49ce79a03fb609f9463f1f61b9312c9c95a43998b8a6240c8b40f0da7cc4c02590264b982e8fc48ac5ff5d0f83e7d685d05eda8dc34f874d278a86a6e04a9ccadd53ecb119bc5c29c60fd0cfe5e97bc973f7d4a3d61f78c9bdedd146b5fb20bdbec7a5791b00acda265dabfb30afa688766cf65d089ed4cf9f54031bf62bac51cd62d6b5db13be3d361b4d7f838999e65c7bf56fab7b129df25a47fb0fec88577bc8b9330527f0190bcd69191b13c5a09de803ff2892b3f6a8f00e2a48eb5629ffcbc8889e78fd541255479846c373514e81474d1532deec8c3e56e7ad78a97952f74759332f34334f622d4552ca039bd97b5cc2cd5c7fa3aad0bdf3860e7b32d67a3338ddeb139a743cb17c51ba013f9a9463918d86c834b9bac9de5bec393ba4bf1eea2a505608eb44fa41dcdefbbe633813a83a80c9ffb1e2c1dd308e213a3a6b5f11a74f293ab501c6f4efb97e0cd498bb5a4c62a5626ee2ee9d665a77fa62c39a31c962b94dcf7d4ab0750f6e4be9709c057ca1b215240b5d8579bada6c647eb4d4f5b58dd0e9a62fc078c153456af56bddab74a452a7c9c9b6868ee852f7322ec7530e5735e33bfaeb87ab75288aa816080b238e170bd08d60aafa3e0afbd1d71a202dbea89f8288f41c254cdd075a4eb4fced345dfe74f53a54f6a7c12e3f30e391ab7da9910f78deb5be507cf2401baba51982bf984810d23304633a20e8fd6c9964921ef8063fcb4a8a96b96d6d6a38ae4b65306c43275145431f70a8b08010da453c2619bb9d0793cd0959e95f948e216b95e111cd13ccb79fe70407e2b55ce6c954c3df99ddee385df055da5cde15c4d1293bd2785a5c6b3445c8da4e38fb11555ceba28d44a7ce93f60c9e9b5b53d8ed6f448dbf58c6753535ff713509cb95412c7815821be06d4f3faaca3f0b78247d03b45a704c0f0a158b309957a78599079e6a617899afa002575c49cbd604e6cbd81523b481"}]}, 0x1030}}, 0x4000044) (async) sendmsg$key(r9, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000004c0)={0x2, 0xf, 0x8, 0x5, 0x206, 0x0, 0x70bd2b, 0x25dfdbfc, [@sadb_x_sa2={0x2, 0x13, 0x1, 0x0, 0x0, 0x70bd26, 0x3506}, @sadb_x_nat_t_port={0x1, 0x16, 0x4e20}, @sadb_key={0x201, 0x8, 0x8000, 0x0, "fcc070443d5faf4b9734e533c27cfeb97ccf4a8d153b25f8600883cd6acd7ccfc84699891f3aadf45b12d510bcbeee2a73df8bb14fcd187bcd4fa8e881b4727eafcc94a2afd6ddbfeb06e88e90fb9804a1a8c8b52628ea76fb4d810922926e95f2f44deb206001daf0f8d295aa1317d6dbdbc99630fabfdb622af5580abed609644da899ee29f92f785d3eca6fe61c31e8b617f75cadb2fc6f6186914a55dbbf5d250f3f326c7fc085a29d3e49ba20272aeeaa4ce27a4f8fa9b3f3aa2fc25d8bd113b7c9e8327667c6fdbf8838a50172de1b78ab6308f2327e43d2472375f32959506c3c19f05c6ee7ce0366d36ca10ca771c96d5af3a523bbc10db5a5ebb907fde5bffecdb5b229a04bc1048d2b8bfe3cd98e8d784dc58e947b8b11da102f4089e9d8389d1d8e773af3bd3021510a51401280e4679f453b9c3c4c7e018b42cdc63081a08d63ddd3c66b9e29e03ed6bb131c2a7f3515d7f7a6521b4960efc1c66b2ef446561322ce1a6316212516fcc7d426553370c87c4a57c599c9a820919f50263eef4b8936a68572bd138eff610d5826d6f949cc8ff0fece666bd50bf7e09e69510dc3c74eed52835693966db394097f6ee77ada789878f00377867e208e9327a40ad1f1791f6bd8c9dd2c0375980161aef99aef787e9091a84994fcf2fc9040f8a6c708baf2f84888a2c316a3c844863675d50558fbf35cfb5329b495807da796277d80f1dcd3f273f91cd805331a47e25d73dbe9b592bdde9da01de7bb468615a429d8e61fedf7b3de29b2d70a177fd4f70575f1fa12c16d4f6dfda5b29ee4d419d2c889c14404f9d64865e6f775a0a9cd47f205decf42a7c7b713efd27c836068dee4616e2b8b86dec65fa83e95b5bb0a827c0c83d79d3180eea1e6c40d6eb0756e1dbcd75d2dd65588974a057edbd88ebc630504f62d5a3ec8017d10daedc985d0278b7bf6e75cf7676e109988671e7736ad3e4a3bd48d78260402a589566a8f477bb468904a86ae8b9e54fb6a5dbdd40591cddb4a6031d39c020ddae5aafb9c23941ef1dcce5b1830b12ddbb3a7385553790529537fd9d2f89ed500ed53c569e155c5de9e909a450d4adcc06e27f378a1cd0f9a8fc69ca2bb7a63d747d210ca90ea42afb251461642a18fc5d7be3278ad1c0b6563bf3fd7541ddb315a83bcede761e4d9c8152841bc0e0a4c2467522e0d77ec448251b99fc1016de4dc359e7683f91ba529904734f242112cac0b10d9b5a372f5eab79c60eef59f32286eed582710f3467694ce52d2f8f226d68e531814b3595913a9abd7e1ca641135ff7c65f29937cb7094563b7d9fbd902d056cfe9ba71e31ce1230bde629357cc77dad758b587c58ae51f5b38e22ccd7ccde8adb57c3c60c2e2a142ecf1c3da522a84d085e3b38524d0874c0d3fd106500bba34469b2841dc0423a31232891cc4504b5fb1da26658acaa137040ab32df7f5c3a40435aed3dcea20721c42dd970e71232c56a1bed7a7359a4c8a630136539f6ccabb90969d3415b9bdb13359e1f06cf64f981670e04adeb6202edf7e520b891f992f23f5dd735c46851f5528f88f4ba8ed0affe54c036f54ad678c735882bbe9312516cafad63072ee752d9fe57b3c2b039b29cc35fed9d96c513c6ffb7b1fc66f3ce180b0608e4e43b5078ab910baba825e09d749d5d0d7ff33cc7c2d9b2dfcdc457f878060e175c0e4e6d7239138d6d4be2fc164abc54f0f61d8f68cb3183882ff197dc53f6dfd2e45575e6d9467c53f8f8149b2339047f9cc51a21bb81fa37096c633f2e80a8463cc1500eea53ca41736bf42e7b041d39a29f34c11a33647ceba95beca12c3a2239754351bb35eaeb82bcf8c37d88555092bf192943cda4e7375637f637dba42d40cbb30af90f3493ef40d8fa45a29d73cb8c411051c73e24b7728790628387be5aa1c3f8d3747dfadbe7b81dfb67d009759cd212fdb0e733309ebe99e387d2980651dc9f7d5a3b8923fd941c62ffa91e7089e19ed516e53a5d55bd01261e2d74eae3eff75a3b6de94d55b3f1d41b3025a04a5ac5cff85ddab59dcde2f7ee17ad40f5aaab9e0f505550be739da197564c4e5160991e45246723ee54f2000258b4dfecbcc190391fdcb040e5de52e8c432a5dd479cbd68999468ac526daecce4db61672a2b57bbfd6029a2a42fafc3d6e3c4dc7fe13cf0bfc8dd1b8a25fc8d34da20ccd4b08998e1d9074425b49af322edb15b411a1e9abfc542468305f1a89c8420affdbe4bec1aad45738f8a433f5064003edb190bb5b279fca2c4f5ba88ddce97f41e0d56567c3a4159d9df3d0d96f7fe06d3a2772faebe3d35d4f6ec9d6ff1cea37542fa0fe3ad9d4b8b390c3c2b9b3e366441d87426e7432c66685ebd9a8532a62701a4a57adebcc464c1ae11803062e1c90fafeb34ffdc8db28a279884821bf3d9e3b98a872e89b4f18d18ec39ed25082b32d75da263a7bd6d2001a9c53d9e284fb74ce0f55e19c0b1b4e09e981ec7a5eb74728da012abc84cebe737cc00831d88d9a76810bf750621efcabc4cd818292904dd3688c2b8211baa3ec71fe531314eb9f4c95e0aabd931d5e2507e2af7af34a0e20c2011cb9f2079ab7ac6064226421a619aeeb8be56e1a63ef628394a3ad1b8404523241aa9b3bd0aec868d26504dc66cd5f626e5f1d040fad7c27f6eccb53841bad267e39d467b0c772fd06c41588ed8611b317a36f8527e42ee02b1e7ccb8109ef71b04d541c315b0696c66f2415d500d0816271c27ab0bfb30661173b679c8e3c932514355c74535d0dbd126da9c832de60fe695abaef2f7a2fa1eed05d693a1beb7cc474dd515eb843f3e01a7a98c12e6c6603cd9cf20abc836c67fc724cd321b52b4d7c1d7d20d138302b69d46afe077ee675eba2007185c6d4bdde258d10543c65c43e818dee2698ccec3d5c8132e8cd9802bbfbc4194136e3691ca6cfe193182f900cb32d73b055d17b470c5d901e9d051b07e736170ac6be38ac2ff83fa2f566410c4907323d289a0746529733ea64dc7bed96381e1cf4a69a53289b72c9ed4426f16cdcd2eb2e24c437c3ed02293daac0852e16f2e65e12bae5c762997275d77fd3beafa1bc60eb1aea517a42b4c3d8e9360850365156aab420c4c12038604b8ec12e133e8cac75a2f810dcf451d0b8c2b2392d4dc2dcfe1a5c951cc32eb2444ba8b974c62e9719d932f00e6764e5b03578059124186c376a343801db3fa2af2c6a4388dba30fadcee806cc94810d81719986fe9533e7665cbc64d31e3df547b1ae9e2b98b9a776024c19ce35933cc7a4ed1010417cf8f95f9f5ac25b6913497ed4cc06607d1b1978549174df3784a42abb4abd0705acd030228e3527a1494999e9b65aa2e702f886c636a6893b9a55d85ff8f4dbffcebb2ca784360fc005f6ee268182aa0c6017cb75f275315374aad7445f91d4c59aa9280e35f4bf1335e7acc81fe5b3535a7076ec9bd101750e5b458a479e0225410488266e65dc84f66e742506b7289f23cbbf8097822092a6bf5892c0cb9f56838931068c2c7a2ad00a9d2a6300a04ac9a113934a1b3e763665a3d0d0ad93a649a58694c3f9edd915231451b950a7cadedb5b700938d25ca21461971b033bd20416e9368494f937a621b6ce1dea5ba2e0f9c3f68497b18f2c5e926c8dcda5c85b96566fb543da1110013c723e6ec89570e913ca282be0c7df27071bd6c6b2e3d98315ea9174a69462c21038387b9e3f45c84a148d8c3c9687cf354bfa27d069cbb0d6bc4356fab5a16e8459edd71b64ccaae87928c72ecd6808a2e9faaac3e0ffc9346235d408497314b79a61d3423a9705e0345bd6134c1850ff93fe36e07a01932ca6e4cb8406db4f578e9179db2abf585aeabda2403151624c0a6d14c41d45be1ed82c0a5c1dd6cdb0c56fa3a6cd8b47c104e38e55b7d5909fcb3155f6fe5d8486daf5d39da45da6395270725a0491548fe80f16beb1a20e592cb1efb20e6582fc1041397132a820d58fba598fd857b71efa0378e6c9f068d3fffb6bad38910b46591357b663c378074be143ec3cd224d9466e2ca8cfd145794213627724dceb1d4bcbf36b8366fb815a94a279c291987b2ca735f5a415e46ba736ddaf75959284aee7abba31de396dc36792d187efce0ce07a78ea378d464b946a3f54046e1c3a433b84304206d6ed7ee05b17ef0a682dd5e7151b9cfdadcff24778e8ef0ad7387e6973776c95b24aa5fe912df3729859534d7e072e5cb3af40736d7999d5ebffef20bd7246383f98dd8d072134350124114d6d6dd0b8be02005744694166a3560709a2919b9f8258bfa0e4b9417ed46112bc07489bff933080f08297ab19298afe4deb9ba51016236fd3da7ed5ca151393a271dc17f200b3964b59b0136198bd9b267da3c6d48d8336f0aba676e9b49e906441cdecd96748d7e984fa25d258c99d405bf5cde2e5a722a2bb2d5600285b26849e500da7d892ac5dc0848dd97adeffc1906dabc5dca279919270907f69890936a93ae69070a5fb910d5b3d1e363db224549a0a38c9c88a0332c4d4fd71e6627f2c4c0f691de2b445a34ee1721042cf4a8da98e5f1dd6087de5b82eb744ebc5faa619ff2bcafe34ddcf0ae9b44954acba4823a88ce10d8d278ed23644ce5528a64f8ada4edb29837850f8210d697369e555b6e0e5604873d3a97f004756d7a1dd1cfeb9fc9f1646e6816ecad49b7b55ee401e23db4721c20adbbd56f3640448a08e2ced175c20808497f7c493e8fd4fae0e8fa2d5a2d61339f2173b5b32ada1298c2589576458c49ce79a03fb609f9463f1f61b9312c9c95a43998b8a6240c8b40f0da7cc4c02590264b982e8fc48ac5ff5d0f83e7d685d05eda8dc34f874d278a86a6e04a9ccadd53ecb119bc5c29c60fd0cfe5e97bc973f7d4a3d61f78c9bdedd146b5fb20bdbec7a5791b00acda265dabfb30afa688766cf65d089ed4cf9f54031bf62bac51cd62d6b5db13be3d361b4d7f838999e65c7bf56fab7b129df25a47fb0fec88577bc8b9330527f0190bcd69191b13c5a09de803ff2892b3f6a8f00e2a48eb5629ffcbc8889e78fd541255479846c373514e81474d1532deec8c3e56e7ad78a97952f74759332f34334f622d4552ca039bd97b5cc2cd5c7fa3aad0bdf3860e7b32d67a3338ddeb139a743cb17c51ba013f9a9463918d86c834b9bac9de5bec393ba4bf1eea2a505608eb44fa41dcdefbbe633813a83a80c9ffb1e2c1dd308e213a3a6b5f11a74f293ab501c6f4efb97e0cd498bb5a4c62a5626ee2ee9d665a77fa62c39a31c962b94dcf7d4ab0750f6e4be9709c057ca1b215240b5d8579bada6c647eb4d4f5b58dd0e9a62fc078c153456af56bddab74a452a7c9c9b6868ee852f7322ec7530e5735e33bfaeb87ab75288aa816080b238e170bd08d60aafa3e0afbd1d71a202dbea89f8288f41c254cdd075a4eb4fced345dfe74f53a54f6a7c12e3f30e391ab7da9910f78deb5be507cf2401baba51982bf984810d23304633a20e8fd6c9964921ef8063fcb4a8a96b96d6d6a38ae4b65306c43275145431f70a8b08010da453c2619bb9d0793cd0959e95f948e216b95e111cd13ccb79fe70407e2b55ce6c954c3df99ddee385df055da5cde15c4d1293bd2785a5c6b3445c8da4e38fb11555ceba28d44a7ce93f60c9e9b5b53d8ed6f448dbf58c6753535ff713509cb95412c7815821be06d4f3faaca3f0b78247d03b45a704c0f0a158b309957a78599079e6a617899afa002575c49cbd604e6cbd81523b481"}]}, 0x1030}}, 0x4000044) setsockopt$inet_mtu(r9, 0x111, 0xa, &(0x7f0000000000)=0x3, 0x4) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session single: successfully extracted reproducer found reproducer with 37 syscalls minimizing guilty program testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-connect$pppl2tp-socket$inet_udp-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_SET_MESH-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-sendmsg$BATADV_CMD_GET_DAT_CACHE-sendmsg$BATADV_CMD_GET_DAT_CACHE-socket$key-sendmsg$key-bind$inet-connect$inet-setsockopt$inet_IP_XFRM_POLICY-syz_emit_ethernet-sendmmsg-openat2-socket$pppl2tp-socket$pppl2tp-fcntl$dupfd-socket$inet6_tcp-socket$inet6_tcp-ioctl$sock_SIOCGIFCONF-ioctl$sock_SIOCGIFCONF-timer_create-timer_gettime-sendmsg$key-sendmsg$key detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) r3 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0xfffffffffffffe39, r5, 0x1, 0x4070bd28, 0x1}, 0x14}}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) (async) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast2, @in6=@private2, 0x0, 0x0, 0x4e21, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x6, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x100000000000}, {}, 0x0, 0x0, 0x1, 0x0, 0x3}, {{@in6=@mcast2, 0x0, 0x33}, 0x0, @in=@loopback, 0x0, 0x0, 0x0, 0xb7, 0xfffffffe}}, 0xe8) syz_emit_ethernet(0x6e, &(0x7f0000000040)={@link_local, @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x2f, 0x0, @private, @empty}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x6558, 0x0, 0x0, [0x0, 0x0]}, {0x0, 0x0, 0x0, 0x0, 0x11}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [0x0, 0xffff]}}}}}}, 0x0) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x20) openat2(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', &(0x7f0000000280)={0x8200, 0x0, 0x10}, 0x18) socket$pppl2tp(0x18, 0x1, 0x1) (async) r8 = socket$pppl2tp(0x18, 0x1, 0x1) r9 = fcntl$dupfd(r0, 0x0, r8) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFCONF(r10, 0x890b, &(0x7f0000000000)=@req={0x28, &(0x7f0000000040)={'veth1_vlan\x00', @ifru_map={0x6, 0x7e779edd, 0x100, 0x21, 0xdd, 0x5}}}) (async) ioctl$sock_SIOCGIFCONF(r10, 0x890b, &(0x7f0000000000)=@req={0x28, &(0x7f0000000040)={'veth1_vlan\x00', @ifru_map={0x6, 0x7e779edd, 0x100, 0x21, 0xdd, 0x5}}}) timer_create(0x0, 0x0, &(0x7f0000000300)) timer_gettime(0x0, 0xfffffffffffffffc) sendmsg$key(r9, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000004c0)={0x2, 0xf, 0x8, 0x5, 0x206, 0x0, 0x70bd2b, 0x25dfdbfc, [@sadb_x_sa2={0x2, 0x13, 0x1, 0x0, 0x0, 0x70bd26, 0x3506}, @sadb_x_nat_t_port={0x1, 0x16, 0x4e20}, @sadb_key={0x201, 0x8, 0x8000, 0x0, "fcc070443d5faf4b9734e533c27cfeb97ccf4a8d153b25f8600883cd6acd7ccfc84699891f3aadf45b12d510bcbeee2a73df8bb14fcd187bcd4fa8e881b4727eafcc94a2afd6ddbfeb06e88e90fb9804a1a8c8b52628ea76fb4d810922926e95f2f44deb206001daf0f8d295aa1317d6dbdbc99630fabfdb622af5580abed609644da899ee29f92f785d3eca6fe61c31e8b617f75cadb2fc6f6186914a55dbbf5d250f3f326c7fc085a29d3e49ba20272aeeaa4ce27a4f8fa9b3f3aa2fc25d8bd113b7c9e8327667c6fdbf8838a50172de1b78ab6308f2327e43d2472375f32959506c3c19f05c6ee7ce0366d36ca10ca771c96d5af3a523bbc10db5a5ebb907fde5bffecdb5b229a04bc1048d2b8bfe3cd98e8d784dc58e947b8b11da102f4089e9d8389d1d8e773af3bd3021510a51401280e4679f453b9c3c4c7e018b42cdc63081a08d63ddd3c66b9e29e03ed6bb131c2a7f3515d7f7a6521b4960efc1c66b2ef446561322ce1a6316212516fcc7d426553370c87c4a57c599c9a820919f50263eef4b8936a68572bd138eff610d5826d6f949cc8ff0fece666bd50bf7e09e69510dc3c74eed52835693966db394097f6ee77ada789878f00377867e208e9327a40ad1f1791f6bd8c9dd2c0375980161aef99aef787e9091a84994fcf2fc9040f8a6c708baf2f84888a2c316a3c844863675d50558fbf35cfb5329b495807da796277d80f1dcd3f273f91cd805331a47e25d73dbe9b592bdde9da01de7bb468615a429d8e61fedf7b3de29b2d70a177fd4f70575f1fa12c16d4f6dfda5b29ee4d419d2c889c14404f9d64865e6f775a0a9cd47f205decf42a7c7b713efd27c836068dee4616e2b8b86dec65fa83e95b5bb0a827c0c83d79d3180eea1e6c40d6eb0756e1dbcd75d2dd65588974a057edbd88ebc630504f62d5a3ec8017d10daedc985d0278b7bf6e75cf7676e109988671e7736ad3e4a3bd48d78260402a589566a8f477bb468904a86ae8b9e54fb6a5dbdd40591cddb4a6031d39c020ddae5aafb9c23941ef1dcce5b1830b12ddbb3a7385553790529537fd9d2f89ed500ed53c569e155c5de9e909a450d4adcc06e27f378a1cd0f9a8fc69ca2bb7a63d747d210ca90ea42afb251461642a18fc5d7be3278ad1c0b6563bf3fd7541ddb315a83bcede761e4d9c8152841bc0e0a4c2467522e0d77ec448251b99fc1016de4dc359e7683f91ba529904734f242112cac0b10d9b5a372f5eab79c60eef59f32286eed582710f3467694ce52d2f8f226d68e531814b3595913a9abd7e1ca641135ff7c65f29937cb7094563b7d9fbd902d056cfe9ba71e31ce1230bde629357cc77dad758b587c58ae51f5b38e22ccd7ccde8adb57c3c60c2e2a142ecf1c3da522a84d085e3b38524d0874c0d3fd106500bba34469b2841dc0423a31232891cc4504b5fb1da26658acaa137040ab32df7f5c3a40435aed3dcea20721c42dd970e71232c56a1bed7a7359a4c8a630136539f6ccabb90969d3415b9bdb13359e1f06cf64f981670e04adeb6202edf7e520b891f992f23f5dd735c46851f5528f88f4ba8ed0affe54c036f54ad678c735882bbe9312516cafad63072ee752d9fe57b3c2b039b29cc35fed9d96c513c6ffb7b1fc66f3ce180b0608e4e43b5078ab910baba825e09d749d5d0d7ff33cc7c2d9b2dfcdc457f878060e175c0e4e6d7239138d6d4be2fc164abc54f0f61d8f68cb3183882ff197dc53f6dfd2e45575e6d9467c53f8f8149b2339047f9cc51a21bb81fa37096c633f2e80a8463cc1500eea53ca41736bf42e7b041d39a29f34c11a33647ceba95beca12c3a2239754351bb35eaeb82bcf8c37d88555092bf192943cda4e7375637f637dba42d40cbb30af90f3493ef40d8fa45a29d73cb8c411051c73e24b7728790628387be5aa1c3f8d3747dfadbe7b81dfb67d009759cd212fdb0e733309ebe99e387d2980651dc9f7d5a3b8923fd941c62ffa91e7089e19ed516e53a5d55bd01261e2d74eae3eff75a3b6de94d55b3f1d41b3025a04a5ac5cff85ddab59dcde2f7ee17ad40f5aaab9e0f505550be739da197564c4e5160991e45246723ee54f2000258b4dfecbcc190391fdcb040e5de52e8c432a5dd479cbd68999468ac526daecce4db61672a2b57bbfd6029a2a42fafc3d6e3c4dc7fe13cf0bfc8dd1b8a25fc8d34da20ccd4b08998e1d9074425b49af322edb15b411a1e9abfc542468305f1a89c8420affdbe4bec1aad45738f8a433f5064003edb190bb5b279fca2c4f5ba88ddce97f41e0d56567c3a4159d9df3d0d96f7fe06d3a2772faebe3d35d4f6ec9d6ff1cea37542fa0fe3ad9d4b8b390c3c2b9b3e366441d87426e7432c66685ebd9a8532a62701a4a57adebcc464c1ae11803062e1c90fafeb34ffdc8db28a279884821bf3d9e3b98a872e89b4f18d18ec39ed25082b32d75da263a7bd6d2001a9c53d9e284fb74ce0f55e19c0b1b4e09e981ec7a5eb74728da012abc84cebe737cc00831d88d9a76810bf750621efcabc4cd818292904dd3688c2b8211baa3ec71fe531314eb9f4c95e0aabd931d5e2507e2af7af34a0e20c2011cb9f2079ab7ac6064226421a619aeeb8be56e1a63ef628394a3ad1b8404523241aa9b3bd0aec868d26504dc66cd5f626e5f1d040fad7c27f6eccb53841bad267e39d467b0c772fd06c41588ed8611b317a36f8527e42ee02b1e7ccb8109ef71b04d541c315b0696c66f2415d500d0816271c27ab0bfb30661173b679c8e3c932514355c74535d0dbd126da9c832de60fe695abaef2f7a2fa1eed05d693a1beb7cc474dd515eb843f3e01a7a98c12e6c6603cd9cf20abc836c67fc724cd321b52b4d7c1d7d20d138302b69d46afe077ee675eba2007185c6d4bdde258d10543c65c43e818dee2698ccec3d5c8132e8cd9802bbfbc4194136e3691ca6cfe193182f900cb32d73b055d17b470c5d901e9d051b07e736170ac6be38ac2ff83fa2f566410c4907323d289a0746529733ea64dc7bed96381e1cf4a69a53289b72c9ed4426f16cdcd2eb2e24c437c3ed02293daac0852e16f2e65e12bae5c762997275d77fd3beafa1bc60eb1aea517a42b4c3d8e9360850365156aab420c4c12038604b8ec12e133e8cac75a2f810dcf451d0b8c2b2392d4dc2dcfe1a5c951cc32eb2444ba8b974c62e9719d932f00e6764e5b03578059124186c376a343801db3fa2af2c6a4388dba30fadcee806cc94810d81719986fe9533e7665cbc64d31e3df547b1ae9e2b98b9a776024c19ce35933cc7a4ed1010417cf8f95f9f5ac25b6913497ed4cc06607d1b1978549174df3784a42abb4abd0705acd030228e3527a1494999e9b65aa2e702f886c636a6893b9a55d85ff8f4dbffcebb2ca784360fc005f6ee268182aa0c6017cb75f275315374aad7445f91d4c59aa9280e35f4bf1335e7acc81fe5b3535a7076ec9bd101750e5b458a479e0225410488266e65dc84f66e742506b7289f23cbbf8097822092a6bf5892c0cb9f56838931068c2c7a2ad00a9d2a6300a04ac9a113934a1b3e763665a3d0d0ad93a649a58694c3f9edd915231451b950a7cadedb5b700938d25ca21461971b033bd20416e9368494f937a621b6ce1dea5ba2e0f9c3f68497b18f2c5e926c8dcda5c85b96566fb543da1110013c723e6ec89570e913ca282be0c7df27071bd6c6b2e3d98315ea9174a69462c21038387b9e3f45c84a148d8c3c9687cf354bfa27d069cbb0d6bc4356fab5a16e8459edd71b64ccaae87928c72ecd6808a2e9faaac3e0ffc9346235d408497314b79a61d3423a9705e0345bd6134c1850ff93fe36e07a01932ca6e4cb8406db4f578e9179db2abf585aeabda2403151624c0a6d14c41d45be1ed82c0a5c1dd6cdb0c56fa3a6cd8b47c104e38e55b7d5909fcb3155f6fe5d8486daf5d39da45da6395270725a0491548fe80f16beb1a20e592cb1efb20e6582fc1041397132a820d58fba598fd857b71efa0378e6c9f068d3fffb6bad38910b46591357b663c378074be143ec3cd224d9466e2ca8cfd145794213627724dceb1d4bcbf36b8366fb815a94a279c291987b2ca735f5a415e46ba736ddaf75959284aee7abba31de396dc36792d187efce0ce07a78ea378d464b946a3f54046e1c3a433b84304206d6ed7ee05b17ef0a682dd5e7151b9cfdadcff24778e8ef0ad7387e6973776c95b24aa5fe912df3729859534d7e072e5cb3af40736d7999d5ebffef20bd7246383f98dd8d072134350124114d6d6dd0b8be02005744694166a3560709a2919b9f8258bfa0e4b9417ed46112bc07489bff933080f08297ab19298afe4deb9ba51016236fd3da7ed5ca151393a271dc17f200b3964b59b0136198bd9b267da3c6d48d8336f0aba676e9b49e906441cdecd96748d7e984fa25d258c99d405bf5cde2e5a722a2bb2d5600285b26849e500da7d892ac5dc0848dd97adeffc1906dabc5dca279919270907f69890936a93ae69070a5fb910d5b3d1e363db224549a0a38c9c88a0332c4d4fd71e6627f2c4c0f691de2b445a34ee1721042cf4a8da98e5f1dd6087de5b82eb744ebc5faa619ff2bcafe34ddcf0ae9b44954acba4823a88ce10d8d278ed23644ce5528a64f8ada4edb29837850f8210d697369e555b6e0e5604873d3a97f004756d7a1dd1cfeb9fc9f1646e6816ecad49b7b55ee401e23db4721c20adbbd56f3640448a08e2ced175c20808497f7c493e8fd4fae0e8fa2d5a2d61339f2173b5b32ada1298c2589576458c49ce79a03fb609f9463f1f61b9312c9c95a43998b8a6240c8b40f0da7cc4c02590264b982e8fc48ac5ff5d0f83e7d685d05eda8dc34f874d278a86a6e04a9ccadd53ecb119bc5c29c60fd0cfe5e97bc973f7d4a3d61f78c9bdedd146b5fb20bdbec7a5791b00acda265dabfb30afa688766cf65d089ed4cf9f54031bf62bac51cd62d6b5db13be3d361b4d7f838999e65c7bf56fab7b129df25a47fb0fec88577bc8b9330527f0190bcd69191b13c5a09de803ff2892b3f6a8f00e2a48eb5629ffcbc8889e78fd541255479846c373514e81474d1532deec8c3e56e7ad78a97952f74759332f34334f622d4552ca039bd97b5cc2cd5c7fa3aad0bdf3860e7b32d67a3338ddeb139a743cb17c51ba013f9a9463918d86c834b9bac9de5bec393ba4bf1eea2a505608eb44fa41dcdefbbe633813a83a80c9ffb1e2c1dd308e213a3a6b5f11a74f293ab501c6f4efb97e0cd498bb5a4c62a5626ee2ee9d665a77fa62c39a31c962b94dcf7d4ab0750f6e4be9709c057ca1b215240b5d8579bada6c647eb4d4f5b58dd0e9a62fc078c153456af56bddab74a452a7c9c9b6868ee852f7322ec7530e5735e33bfaeb87ab75288aa816080b238e170bd08d60aafa3e0afbd1d71a202dbea89f8288f41c254cdd075a4eb4fced345dfe74f53a54f6a7c12e3f30e391ab7da9910f78deb5be507cf2401baba51982bf984810d23304633a20e8fd6c9964921ef8063fcb4a8a96b96d6d6a38ae4b65306c43275145431f70a8b08010da453c2619bb9d0793cd0959e95f948e216b95e111cd13ccb79fe70407e2b55ce6c954c3df99ddee385df055da5cde15c4d1293bd2785a5c6b3445c8da4e38fb11555ceba28d44a7ce93f60c9e9b5b53d8ed6f448dbf58c6753535ff713509cb95412c7815821be06d4f3faaca3f0b78247d03b45a704c0f0a158b309957a78599079e6a617899afa002575c49cbd604e6cbd81523b481"}]}, 0x1030}}, 0x4000044) (async) sendmsg$key(r9, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000004c0)={0x2, 0xf, 0x8, 0x5, 0x206, 0x0, 0x70bd2b, 0x25dfdbfc, [@sadb_x_sa2={0x2, 0x13, 0x1, 0x0, 0x0, 0x70bd26, 0x3506}, @sadb_x_nat_t_port={0x1, 0x16, 0x4e20}, @sadb_key={0x201, 0x8, 0x8000, 0x0, "fcc070443d5faf4b9734e533c27cfeb97ccf4a8d153b25f8600883cd6acd7ccfc84699891f3aadf45b12d510bcbeee2a73df8bb14fcd187bcd4fa8e881b4727eafcc94a2afd6ddbfeb06e88e90fb9804a1a8c8b52628ea76fb4d810922926e95f2f44deb206001daf0f8d295aa1317d6dbdbc99630fabfdb622af5580abed609644da899ee29f92f785d3eca6fe61c31e8b617f75cadb2fc6f6186914a55dbbf5d250f3f326c7fc085a29d3e49ba20272aeeaa4ce27a4f8fa9b3f3aa2fc25d8bd113b7c9e8327667c6fdbf8838a50172de1b78ab6308f2327e43d2472375f32959506c3c19f05c6ee7ce0366d36ca10ca771c96d5af3a523bbc10db5a5ebb907fde5bffecdb5b229a04bc1048d2b8bfe3cd98e8d784dc58e947b8b11da102f4089e9d8389d1d8e773af3bd3021510a51401280e4679f453b9c3c4c7e018b42cdc63081a08d63ddd3c66b9e29e03ed6bb131c2a7f3515d7f7a6521b4960efc1c66b2ef446561322ce1a6316212516fcc7d426553370c87c4a57c599c9a820919f50263eef4b8936a68572bd138eff610d5826d6f949cc8ff0fece666bd50bf7e09e69510dc3c74eed52835693966db394097f6ee77ada789878f00377867e208e9327a40ad1f1791f6bd8c9dd2c0375980161aef99aef787e9091a84994fcf2fc9040f8a6c708baf2f84888a2c316a3c844863675d50558fbf35cfb5329b495807da796277d80f1dcd3f273f91cd805331a47e25d73dbe9b592bdde9da01de7bb468615a429d8e61fedf7b3de29b2d70a177fd4f70575f1fa12c16d4f6dfda5b29ee4d419d2c889c14404f9d64865e6f775a0a9cd47f205decf42a7c7b713efd27c836068dee4616e2b8b86dec65fa83e95b5bb0a827c0c83d79d3180eea1e6c40d6eb0756e1dbcd75d2dd65588974a057edbd88ebc630504f62d5a3ec8017d10daedc985d0278b7bf6e75cf7676e109988671e7736ad3e4a3bd48d78260402a589566a8f477bb468904a86ae8b9e54fb6a5dbdd40591cddb4a6031d39c020ddae5aafb9c23941ef1dcce5b1830b12ddbb3a7385553790529537fd9d2f89ed500ed53c569e155c5de9e909a450d4adcc06e27f378a1cd0f9a8fc69ca2bb7a63d747d210ca90ea42afb251461642a18fc5d7be3278ad1c0b6563bf3fd7541ddb315a83bcede761e4d9c8152841bc0e0a4c2467522e0d77ec448251b99fc1016de4dc359e7683f91ba529904734f242112cac0b10d9b5a372f5eab79c60eef59f32286eed582710f3467694ce52d2f8f226d68e531814b3595913a9abd7e1ca641135ff7c65f29937cb7094563b7d9fbd902d056cfe9ba71e31ce1230bde629357cc77dad758b587c58ae51f5b38e22ccd7ccde8adb57c3c60c2e2a142ecf1c3da522a84d085e3b38524d0874c0d3fd106500bba34469b2841dc0423a31232891cc4504b5fb1da26658acaa137040ab32df7f5c3a40435aed3dcea20721c42dd970e71232c56a1bed7a7359a4c8a630136539f6ccabb90969d3415b9bdb13359e1f06cf64f981670e04adeb6202edf7e520b891f992f23f5dd735c46851f5528f88f4ba8ed0affe54c036f54ad678c735882bbe9312516cafad63072ee752d9fe57b3c2b039b29cc35fed9d96c513c6ffb7b1fc66f3ce180b0608e4e43b5078ab910baba825e09d749d5d0d7ff33cc7c2d9b2dfcdc457f878060e175c0e4e6d7239138d6d4be2fc164abc54f0f61d8f68cb3183882ff197dc53f6dfd2e45575e6d9467c53f8f8149b2339047f9cc51a21bb81fa37096c633f2e80a8463cc1500eea53ca41736bf42e7b041d39a29f34c11a33647ceba95beca12c3a2239754351bb35eaeb82bcf8c37d88555092bf192943cda4e7375637f637dba42d40cbb30af90f3493ef40d8fa45a29d73cb8c411051c73e24b7728790628387be5aa1c3f8d3747dfadbe7b81dfb67d009759cd212fdb0e733309ebe99e387d2980651dc9f7d5a3b8923fd941c62ffa91e7089e19ed516e53a5d55bd01261e2d74eae3eff75a3b6de94d55b3f1d41b3025a04a5ac5cff85ddab59dcde2f7ee17ad40f5aaab9e0f505550be739da197564c4e5160991e45246723ee54f2000258b4dfecbcc190391fdcb040e5de52e8c432a5dd479cbd68999468ac526daecce4db61672a2b57bbfd6029a2a42fafc3d6e3c4dc7fe13cf0bfc8dd1b8a25fc8d34da20ccd4b08998e1d9074425b49af322edb15b411a1e9abfc542468305f1a89c8420affdbe4bec1aad45738f8a433f5064003edb190bb5b279fca2c4f5ba88ddce97f41e0d56567c3a4159d9df3d0d96f7fe06d3a2772faebe3d35d4f6ec9d6ff1cea37542fa0fe3ad9d4b8b390c3c2b9b3e366441d87426e7432c66685ebd9a8532a62701a4a57adebcc464c1ae11803062e1c90fafeb34ffdc8db28a279884821bf3d9e3b98a872e89b4f18d18ec39ed25082b32d75da263a7bd6d2001a9c53d9e284fb74ce0f55e19c0b1b4e09e981ec7a5eb74728da012abc84cebe737cc00831d88d9a76810bf750621efcabc4cd818292904dd3688c2b8211baa3ec71fe531314eb9f4c95e0aabd931d5e2507e2af7af34a0e20c2011cb9f2079ab7ac6064226421a619aeeb8be56e1a63ef628394a3ad1b8404523241aa9b3bd0aec868d26504dc66cd5f626e5f1d040fad7c27f6eccb53841bad267e39d467b0c772fd06c41588ed8611b317a36f8527e42ee02b1e7ccb8109ef71b04d541c315b0696c66f2415d500d0816271c27ab0bfb30661173b679c8e3c932514355c74535d0dbd126da9c832de60fe695abaef2f7a2fa1eed05d693a1beb7cc474dd515eb843f3e01a7a98c12e6c6603cd9cf20abc836c67fc724cd321b52b4d7c1d7d20d138302b69d46afe077ee675eba2007185c6d4bdde258d10543c65c43e818dee2698ccec3d5c8132e8cd9802bbfbc4194136e3691ca6cfe193182f900cb32d73b055d17b470c5d901e9d051b07e736170ac6be38ac2ff83fa2f566410c4907323d289a0746529733ea64dc7bed96381e1cf4a69a53289b72c9ed4426f16cdcd2eb2e24c437c3ed02293daac0852e16f2e65e12bae5c762997275d77fd3beafa1bc60eb1aea517a42b4c3d8e9360850365156aab420c4c12038604b8ec12e133e8cac75a2f810dcf451d0b8c2b2392d4dc2dcfe1a5c951cc32eb2444ba8b974c62e9719d932f00e6764e5b03578059124186c376a343801db3fa2af2c6a4388dba30fadcee806cc94810d81719986fe9533e7665cbc64d31e3df547b1ae9e2b98b9a776024c19ce35933cc7a4ed1010417cf8f95f9f5ac25b6913497ed4cc06607d1b1978549174df3784a42abb4abd0705acd030228e3527a1494999e9b65aa2e702f886c636a6893b9a55d85ff8f4dbffcebb2ca784360fc005f6ee268182aa0c6017cb75f275315374aad7445f91d4c59aa9280e35f4bf1335e7acc81fe5b3535a7076ec9bd101750e5b458a479e0225410488266e65dc84f66e742506b7289f23cbbf8097822092a6bf5892c0cb9f56838931068c2c7a2ad00a9d2a6300a04ac9a113934a1b3e763665a3d0d0ad93a649a58694c3f9edd915231451b950a7cadedb5b700938d25ca21461971b033bd20416e9368494f937a621b6ce1dea5ba2e0f9c3f68497b18f2c5e926c8dcda5c85b96566fb543da1110013c723e6ec89570e913ca282be0c7df27071bd6c6b2e3d98315ea9174a69462c21038387b9e3f45c84a148d8c3c9687cf354bfa27d069cbb0d6bc4356fab5a16e8459edd71b64ccaae87928c72ecd6808a2e9faaac3e0ffc9346235d408497314b79a61d3423a9705e0345bd6134c1850ff93fe36e07a01932ca6e4cb8406db4f578e9179db2abf585aeabda2403151624c0a6d14c41d45be1ed82c0a5c1dd6cdb0c56fa3a6cd8b47c104e38e55b7d5909fcb3155f6fe5d8486daf5d39da45da6395270725a0491548fe80f16beb1a20e592cb1efb20e6582fc1041397132a820d58fba598fd857b71efa0378e6c9f068d3fffb6bad38910b46591357b663c378074be143ec3cd224d9466e2ca8cfd145794213627724dceb1d4bcbf36b8366fb815a94a279c291987b2ca735f5a415e46ba736ddaf75959284aee7abba31de396dc36792d187efce0ce07a78ea378d464b946a3f54046e1c3a433b84304206d6ed7ee05b17ef0a682dd5e7151b9cfdadcff24778e8ef0ad7387e6973776c95b24aa5fe912df3729859534d7e072e5cb3af40736d7999d5ebffef20bd7246383f98dd8d072134350124114d6d6dd0b8be02005744694166a3560709a2919b9f8258bfa0e4b9417ed46112bc07489bff933080f08297ab19298afe4deb9ba51016236fd3da7ed5ca151393a271dc17f200b3964b59b0136198bd9b267da3c6d48d8336f0aba676e9b49e906441cdecd96748d7e984fa25d258c99d405bf5cde2e5a722a2bb2d5600285b26849e500da7d892ac5dc0848dd97adeffc1906dabc5dca279919270907f69890936a93ae69070a5fb910d5b3d1e363db224549a0a38c9c88a0332c4d4fd71e6627f2c4c0f691de2b445a34ee1721042cf4a8da98e5f1dd6087de5b82eb744ebc5faa619ff2bcafe34ddcf0ae9b44954acba4823a88ce10d8d278ed23644ce5528a64f8ada4edb29837850f8210d697369e555b6e0e5604873d3a97f004756d7a1dd1cfeb9fc9f1646e6816ecad49b7b55ee401e23db4721c20adbbd56f3640448a08e2ced175c20808497f7c493e8fd4fae0e8fa2d5a2d61339f2173b5b32ada1298c2589576458c49ce79a03fb609f9463f1f61b9312c9c95a43998b8a6240c8b40f0da7cc4c02590264b982e8fc48ac5ff5d0f83e7d685d05eda8dc34f874d278a86a6e04a9ccadd53ecb119bc5c29c60fd0cfe5e97bc973f7d4a3d61f78c9bdedd146b5fb20bdbec7a5791b00acda265dabfb30afa688766cf65d089ed4cf9f54031bf62bac51cd62d6b5db13be3d361b4d7f838999e65c7bf56fab7b129df25a47fb0fec88577bc8b9330527f0190bcd69191b13c5a09de803ff2892b3f6a8f00e2a48eb5629ffcbc8889e78fd541255479846c373514e81474d1532deec8c3e56e7ad78a97952f74759332f34334f622d4552ca039bd97b5cc2cd5c7fa3aad0bdf3860e7b32d67a3338ddeb139a743cb17c51ba013f9a9463918d86c834b9bac9de5bec393ba4bf1eea2a505608eb44fa41dcdefbbe633813a83a80c9ffb1e2c1dd308e213a3a6b5f11a74f293ab501c6f4efb97e0cd498bb5a4c62a5626ee2ee9d665a77fa62c39a31c962b94dcf7d4ab0750f6e4be9709c057ca1b215240b5d8579bada6c647eb4d4f5b58dd0e9a62fc078c153456af56bddab74a452a7c9c9b6868ee852f7322ec7530e5735e33bfaeb87ab75288aa816080b238e170bd08d60aafa3e0afbd1d71a202dbea89f8288f41c254cdd075a4eb4fced345dfe74f53a54f6a7c12e3f30e391ab7da9910f78deb5be507cf2401baba51982bf984810d23304633a20e8fd6c9964921ef8063fcb4a8a96b96d6d6a38ae4b65306c43275145431f70a8b08010da453c2619bb9d0793cd0959e95f948e216b95e111cd13ccb79fe70407e2b55ce6c954c3df99ddee385df055da5cde15c4d1293bd2785a5c6b3445c8da4e38fb11555ceba28d44a7ce93f60c9e9b5b53d8ed6f448dbf58c6753535ff713509cb95412c7815821be06d4f3faaca3f0b78247d03b45a704c0f0a158b309957a78599079e6a617899afa002575c49cbd604e6cbd81523b481"}]}, 0x1030}}, 0x4000044) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-connect$pppl2tp-socket$inet_udp-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_SET_MESH-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-sendmsg$BATADV_CMD_GET_DAT_CACHE-sendmsg$BATADV_CMD_GET_DAT_CACHE-socket$key-sendmsg$key-bind$inet-connect$inet-setsockopt$inet_IP_XFRM_POLICY-syz_emit_ethernet-sendmmsg-openat2-socket$pppl2tp-socket$pppl2tp-fcntl$dupfd-socket$inet6_tcp-socket$inet6_tcp-ioctl$sock_SIOCGIFCONF-ioctl$sock_SIOCGIFCONF-timer_create-timer_gettime-sendmsg$key detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) r3 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0xfffffffffffffe39, r5, 0x1, 0x4070bd28, 0x1}, 0x14}}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) (async) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast2, @in6=@private2, 0x0, 0x0, 0x4e21, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x6, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x100000000000}, {}, 0x0, 0x0, 0x1, 0x0, 0x3}, {{@in6=@mcast2, 0x0, 0x33}, 0x0, @in=@loopback, 0x0, 0x0, 0x0, 0xb7, 0xfffffffe}}, 0xe8) syz_emit_ethernet(0x6e, &(0x7f0000000040)={@link_local, @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x2f, 0x0, @private, @empty}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x6558, 0x0, 0x0, [0x0, 0x0]}, {0x0, 0x0, 0x0, 0x0, 0x11}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [0x0, 0xffff]}}}}}}, 0x0) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x20) openat2(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', &(0x7f0000000280)={0x8200, 0x0, 0x10}, 0x18) socket$pppl2tp(0x18, 0x1, 0x1) (async) r8 = socket$pppl2tp(0x18, 0x1, 0x1) r9 = fcntl$dupfd(r0, 0x0, r8) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFCONF(r10, 0x890b, &(0x7f0000000000)=@req={0x28, &(0x7f0000000040)={'veth1_vlan\x00', @ifru_map={0x6, 0x7e779edd, 0x100, 0x21, 0xdd, 0x5}}}) (async) ioctl$sock_SIOCGIFCONF(r10, 0x890b, &(0x7f0000000000)=@req={0x28, &(0x7f0000000040)={'veth1_vlan\x00', @ifru_map={0x6, 0x7e779edd, 0x100, 0x21, 0xdd, 0x5}}}) timer_create(0x0, 0x0, &(0x7f0000000300)) timer_gettime(0x0, 0xfffffffffffffffc) sendmsg$key(r9, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001540)={&(0x7f00000004c0)={0x2, 0xf, 0x8, 0x5, 0x206, 0x0, 0x70bd2b, 0x25dfdbfc, [@sadb_x_sa2={0x2, 0x13, 0x1, 0x0, 0x0, 0x70bd26, 0x3506}, @sadb_x_nat_t_port={0x1, 0x16, 0x4e20}, @sadb_key={0x201, 0x8, 0x8000, 0x0, "fcc070443d5faf4b9734e533c27cfeb97ccf4a8d153b25f8600883cd6acd7ccfc84699891f3aadf45b12d510bcbeee2a73df8bb14fcd187bcd4fa8e881b4727eafcc94a2afd6ddbfeb06e88e90fb9804a1a8c8b52628ea76fb4d810922926e95f2f44deb206001daf0f8d295aa1317d6dbdbc99630fabfdb622af5580abed609644da899ee29f92f785d3eca6fe61c31e8b617f75cadb2fc6f6186914a55dbbf5d250f3f326c7fc085a29d3e49ba20272aeeaa4ce27a4f8fa9b3f3aa2fc25d8bd113b7c9e8327667c6fdbf8838a50172de1b78ab6308f2327e43d2472375f32959506c3c19f05c6ee7ce0366d36ca10ca771c96d5af3a523bbc10db5a5ebb907fde5bffecdb5b229a04bc1048d2b8bfe3cd98e8d784dc58e947b8b11da102f4089e9d8389d1d8e773af3bd3021510a51401280e4679f453b9c3c4c7e018b42cdc63081a08d63ddd3c66b9e29e03ed6bb131c2a7f3515d7f7a6521b4960efc1c66b2ef446561322ce1a6316212516fcc7d426553370c87c4a57c599c9a820919f50263eef4b8936a68572bd138eff610d5826d6f949cc8ff0fece666bd50bf7e09e69510dc3c74eed52835693966db394097f6ee77ada789878f00377867e208e9327a40ad1f1791f6bd8c9dd2c0375980161aef99aef787e9091a84994fcf2fc9040f8a6c708baf2f84888a2c316a3c844863675d50558fbf35cfb5329b495807da796277d80f1dcd3f273f91cd805331a47e25d73dbe9b592bdde9da01de7bb468615a429d8e61fedf7b3de29b2d70a177fd4f70575f1fa12c16d4f6dfda5b29ee4d419d2c889c14404f9d64865e6f775a0a9cd47f205decf42a7c7b713efd27c836068dee4616e2b8b86dec65fa83e95b5bb0a827c0c83d79d3180eea1e6c40d6eb0756e1dbcd75d2dd65588974a057edbd88ebc630504f62d5a3ec8017d10daedc985d0278b7bf6e75cf7676e109988671e7736ad3e4a3bd48d78260402a589566a8f477bb468904a86ae8b9e54fb6a5dbdd40591cddb4a6031d39c020ddae5aafb9c23941ef1dcce5b1830b12ddbb3a7385553790529537fd9d2f89ed500ed53c569e155c5de9e909a450d4adcc06e27f378a1cd0f9a8fc69ca2bb7a63d747d210ca90ea42afb251461642a18fc5d7be3278ad1c0b6563bf3fd7541ddb315a83bcede761e4d9c8152841bc0e0a4c2467522e0d77ec448251b99fc1016de4dc359e7683f91ba529904734f242112cac0b10d9b5a372f5eab79c60eef59f32286eed582710f3467694ce52d2f8f226d68e531814b3595913a9abd7e1ca641135ff7c65f29937cb7094563b7d9fbd902d056cfe9ba71e31ce1230bde629357cc77dad758b587c58ae51f5b38e22ccd7ccde8adb57c3c60c2e2a142ecf1c3da522a84d085e3b38524d0874c0d3fd106500bba34469b2841dc0423a31232891cc4504b5fb1da26658acaa137040ab32df7f5c3a40435aed3dcea20721c42dd970e71232c56a1bed7a7359a4c8a630136539f6ccabb90969d3415b9bdb13359e1f06cf64f981670e04adeb6202edf7e520b891f992f23f5dd735c46851f5528f88f4ba8ed0affe54c036f54ad678c735882bbe9312516cafad63072ee752d9fe57b3c2b039b29cc35fed9d96c513c6ffb7b1fc66f3ce180b0608e4e43b5078ab910baba825e09d749d5d0d7ff33cc7c2d9b2dfcdc457f878060e175c0e4e6d7239138d6d4be2fc164abc54f0f61d8f68cb3183882ff197dc53f6dfd2e45575e6d9467c53f8f8149b2339047f9cc51a21bb81fa37096c633f2e80a8463cc1500eea53ca41736bf42e7b041d39a29f34c11a33647ceba95beca12c3a2239754351bb35eaeb82bcf8c37d88555092bf192943cda4e7375637f637dba42d40cbb30af90f3493ef40d8fa45a29d73cb8c411051c73e24b7728790628387be5aa1c3f8d3747dfadbe7b81dfb67d009759cd212fdb0e733309ebe99e387d2980651dc9f7d5a3b8923fd941c62ffa91e7089e19ed516e53a5d55bd01261e2d74eae3eff75a3b6de94d55b3f1d41b3025a04a5ac5cff85ddab59dcde2f7ee17ad40f5aaab9e0f505550be739da197564c4e5160991e45246723ee54f2000258b4dfecbcc190391fdcb040e5de52e8c432a5dd479cbd68999468ac526daecce4db61672a2b57bbfd6029a2a42fafc3d6e3c4dc7fe13cf0bfc8dd1b8a25fc8d34da20ccd4b08998e1d9074425b49af322edb15b411a1e9abfc542468305f1a89c8420affdbe4bec1aad45738f8a433f5064003edb190bb5b279fca2c4f5ba88ddce97f41e0d56567c3a4159d9df3d0d96f7fe06d3a2772faebe3d35d4f6ec9d6ff1cea37542fa0fe3ad9d4b8b390c3c2b9b3e366441d87426e7432c66685ebd9a8532a62701a4a57adebcc464c1ae11803062e1c90fafeb34ffdc8db28a279884821bf3d9e3b98a872e89b4f18d18ec39ed25082b32d75da263a7bd6d2001a9c53d9e284fb74ce0f55e19c0b1b4e09e981ec7a5eb74728da012abc84cebe737cc00831d88d9a76810bf750621efcabc4cd818292904dd3688c2b8211baa3ec71fe531314eb9f4c95e0aabd931d5e2507e2af7af34a0e20c2011cb9f2079ab7ac6064226421a619aeeb8be56e1a63ef628394a3ad1b8404523241aa9b3bd0aec868d26504dc66cd5f626e5f1d040fad7c27f6eccb53841bad267e39d467b0c772fd06c41588ed8611b317a36f8527e42ee02b1e7ccb8109ef71b04d541c315b0696c66f2415d500d0816271c27ab0bfb30661173b679c8e3c932514355c74535d0dbd126da9c832de60fe695abaef2f7a2fa1eed05d693a1beb7cc474dd515eb843f3e01a7a98c12e6c6603cd9cf20abc836c67fc724cd321b52b4d7c1d7d20d138302b69d46afe077ee675eba2007185c6d4bdde258d10543c65c43e818dee2698ccec3d5c8132e8cd9802bbfbc4194136e3691ca6cfe193182f900cb32d73b055d17b470c5d901e9d051b07e736170ac6be38ac2ff83fa2f566410c4907323d289a0746529733ea64dc7bed96381e1cf4a69a53289b72c9ed4426f16cdcd2eb2e24c437c3ed02293daac0852e16f2e65e12bae5c762997275d77fd3beafa1bc60eb1aea517a42b4c3d8e9360850365156aab420c4c12038604b8ec12e133e8cac75a2f810dcf451d0b8c2b2392d4dc2dcfe1a5c951cc32eb2444ba8b974c62e9719d932f00e6764e5b03578059124186c376a343801db3fa2af2c6a4388dba30fadcee806cc94810d81719986fe9533e7665cbc64d31e3df547b1ae9e2b98b9a776024c19ce35933cc7a4ed1010417cf8f95f9f5ac25b6913497ed4cc06607d1b1978549174df3784a42abb4abd0705acd030228e3527a1494999e9b65aa2e702f886c636a6893b9a55d85ff8f4dbffcebb2ca784360fc005f6ee268182aa0c6017cb75f275315374aad7445f91d4c59aa9280e35f4bf1335e7acc81fe5b3535a7076ec9bd101750e5b458a479e0225410488266e65dc84f66e742506b7289f23cbbf8097822092a6bf5892c0cb9f56838931068c2c7a2ad00a9d2a6300a04ac9a113934a1b3e763665a3d0d0ad93a649a58694c3f9edd915231451b950a7cadedb5b700938d25ca21461971b033bd20416e9368494f937a621b6ce1dea5ba2e0f9c3f68497b18f2c5e926c8dcda5c85b96566fb543da1110013c723e6ec89570e913ca282be0c7df27071bd6c6b2e3d98315ea9174a69462c21038387b9e3f45c84a148d8c3c9687cf354bfa27d069cbb0d6bc4356fab5a16e8459edd71b64ccaae87928c72ecd6808a2e9faaac3e0ffc9346235d408497314b79a61d3423a9705e0345bd6134c1850ff93fe36e07a01932ca6e4cb8406db4f578e9179db2abf585aeabda2403151624c0a6d14c41d45be1ed82c0a5c1dd6cdb0c56fa3a6cd8b47c104e38e55b7d5909fcb3155f6fe5d8486daf5d39da45da6395270725a0491548fe80f16beb1a20e592cb1efb20e6582fc1041397132a820d58fba598fd857b71efa0378e6c9f068d3fffb6bad38910b46591357b663c378074be143ec3cd224d9466e2ca8cfd145794213627724dceb1d4bcbf36b8366fb815a94a279c291987b2ca735f5a415e46ba736ddaf75959284aee7abba31de396dc36792d187efce0ce07a78ea378d464b946a3f54046e1c3a433b84304206d6ed7ee05b17ef0a682dd5e7151b9cfdadcff24778e8ef0ad7387e6973776c95b24aa5fe912df3729859534d7e072e5cb3af40736d7999d5ebffef20bd7246383f98dd8d072134350124114d6d6dd0b8be02005744694166a3560709a2919b9f8258bfa0e4b9417ed46112bc07489bff933080f08297ab19298afe4deb9ba51016236fd3da7ed5ca151393a271dc17f200b3964b59b0136198bd9b267da3c6d48d8336f0aba676e9b49e906441cdecd96748d7e984fa25d258c99d405bf5cde2e5a722a2bb2d5600285b26849e500da7d892ac5dc0848dd97adeffc1906dabc5dca279919270907f69890936a93ae69070a5fb910d5b3d1e363db224549a0a38c9c88a0332c4d4fd71e6627f2c4c0f691de2b445a34ee1721042cf4a8da98e5f1dd6087de5b82eb744ebc5faa619ff2bcafe34ddcf0ae9b44954acba4823a88ce10d8d278ed23644ce5528a64f8ada4edb29837850f8210d697369e555b6e0e5604873d3a97f004756d7a1dd1cfeb9fc9f1646e6816ecad49b7b55ee401e23db4721c20adbbd56f3640448a08e2ced175c20808497f7c493e8fd4fae0e8fa2d5a2d61339f2173b5b32ada1298c2589576458c49ce79a03fb609f9463f1f61b9312c9c95a43998b8a6240c8b40f0da7cc4c02590264b982e8fc48ac5ff5d0f83e7d685d05eda8dc34f874d278a86a6e04a9ccadd53ecb119bc5c29c60fd0cfe5e97bc973f7d4a3d61f78c9bdedd146b5fb20bdbec7a5791b00acda265dabfb30afa688766cf65d089ed4cf9f54031bf62bac51cd62d6b5db13be3d361b4d7f838999e65c7bf56fab7b129df25a47fb0fec88577bc8b9330527f0190bcd69191b13c5a09de803ff2892b3f6a8f00e2a48eb5629ffcbc8889e78fd541255479846c373514e81474d1532deec8c3e56e7ad78a97952f74759332f34334f622d4552ca039bd97b5cc2cd5c7fa3aad0bdf3860e7b32d67a3338ddeb139a743cb17c51ba013f9a9463918d86c834b9bac9de5bec393ba4bf1eea2a505608eb44fa41dcdefbbe633813a83a80c9ffb1e2c1dd308e213a3a6b5f11a74f293ab501c6f4efb97e0cd498bb5a4c62a5626ee2ee9d665a77fa62c39a31c962b94dcf7d4ab0750f6e4be9709c057ca1b215240b5d8579bada6c647eb4d4f5b58dd0e9a62fc078c153456af56bddab74a452a7c9c9b6868ee852f7322ec7530e5735e33bfaeb87ab75288aa816080b238e170bd08d60aafa3e0afbd1d71a202dbea89f8288f41c254cdd075a4eb4fced345dfe74f53a54f6a7c12e3f30e391ab7da9910f78deb5be507cf2401baba51982bf984810d23304633a20e8fd6c9964921ef8063fcb4a8a96b96d6d6a38ae4b65306c43275145431f70a8b08010da453c2619bb9d0793cd0959e95f948e216b95e111cd13ccb79fe70407e2b55ce6c954c3df99ddee385df055da5cde15c4d1293bd2785a5c6b3445c8da4e38fb11555ceba28d44a7ce93f60c9e9b5b53d8ed6f448dbf58c6753535ff713509cb95412c7815821be06d4f3faaca3f0b78247d03b45a704c0f0a158b309957a78599079e6a617899afa002575c49cbd604e6cbd81523b481"}]}, 0x1030}}, 0x4000044) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-connect$pppl2tp-socket$inet_udp-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_SET_MESH-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-sendmsg$BATADV_CMD_GET_DAT_CACHE-sendmsg$BATADV_CMD_GET_DAT_CACHE-socket$key-sendmsg$key-bind$inet-connect$inet-setsockopt$inet_IP_XFRM_POLICY-syz_emit_ethernet-sendmmsg-openat2-socket$pppl2tp-socket$pppl2tp-fcntl$dupfd-socket$inet6_tcp-socket$inet6_tcp-ioctl$sock_SIOCGIFCONF-ioctl$sock_SIOCGIFCONF-timer_create-timer_gettime detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) r3 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0xfffffffffffffe39, r5, 0x1, 0x4070bd28, 0x1}, 0x14}}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) (async) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast2, @in6=@private2, 0x0, 0x0, 0x4e21, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x6, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x100000000000}, {}, 0x0, 0x0, 0x1, 0x0, 0x3}, {{@in6=@mcast2, 0x0, 0x33}, 0x0, @in=@loopback, 0x0, 0x0, 0x0, 0xb7, 0xfffffffe}}, 0xe8) syz_emit_ethernet(0x6e, &(0x7f0000000040)={@link_local, @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x2f, 0x0, @private, @empty}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x6558, 0x0, 0x0, [0x0, 0x0]}, {0x0, 0x0, 0x0, 0x0, 0x11}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [0x0, 0xffff]}}}}}}, 0x0) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x20) openat2(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', &(0x7f0000000280)={0x8200, 0x0, 0x10}, 0x18) socket$pppl2tp(0x18, 0x1, 0x1) (async) r8 = socket$pppl2tp(0x18, 0x1, 0x1) fcntl$dupfd(r0, 0x0, r8) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFCONF(r9, 0x890b, &(0x7f0000000000)=@req={0x28, &(0x7f0000000040)={'veth1_vlan\x00', @ifru_map={0x6, 0x7e779edd, 0x100, 0x21, 0xdd, 0x5}}}) (async) ioctl$sock_SIOCGIFCONF(r9, 0x890b, &(0x7f0000000000)=@req={0x28, &(0x7f0000000040)={'veth1_vlan\x00', @ifru_map={0x6, 0x7e779edd, 0x100, 0x21, 0xdd, 0x5}}}) timer_create(0x0, 0x0, &(0x7f0000000300)) timer_gettime(0x0, 0xfffffffffffffffc) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-connect$pppl2tp-socket$inet_udp-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_SET_MESH-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-sendmsg$BATADV_CMD_GET_DAT_CACHE-sendmsg$BATADV_CMD_GET_DAT_CACHE-socket$key-sendmsg$key-bind$inet-connect$inet-setsockopt$inet_IP_XFRM_POLICY-syz_emit_ethernet-sendmmsg-openat2-socket$pppl2tp-socket$pppl2tp-fcntl$dupfd-socket$inet6_tcp-socket$inet6_tcp-ioctl$sock_SIOCGIFCONF-ioctl$sock_SIOCGIFCONF-timer_create detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) r3 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0xfffffffffffffe39, r5, 0x1, 0x4070bd28, 0x1}, 0x14}}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) (async) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast2, @in6=@private2, 0x0, 0x0, 0x4e21, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x6, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x100000000000}, {}, 0x0, 0x0, 0x1, 0x0, 0x3}, {{@in6=@mcast2, 0x0, 0x33}, 0x0, @in=@loopback, 0x0, 0x0, 0x0, 0xb7, 0xfffffffe}}, 0xe8) syz_emit_ethernet(0x6e, &(0x7f0000000040)={@link_local, @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x2f, 0x0, @private, @empty}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x6558, 0x0, 0x0, [0x0, 0x0]}, {0x0, 0x0, 0x0, 0x0, 0x11}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [0x0, 0xffff]}}}}}}, 0x0) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x20) openat2(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', &(0x7f0000000280)={0x8200, 0x0, 0x10}, 0x18) socket$pppl2tp(0x18, 0x1, 0x1) (async) r8 = socket$pppl2tp(0x18, 0x1, 0x1) fcntl$dupfd(r0, 0x0, r8) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFCONF(r9, 0x890b, &(0x7f0000000000)=@req={0x28, &(0x7f0000000040)={'veth1_vlan\x00', @ifru_map={0x6, 0x7e779edd, 0x100, 0x21, 0xdd, 0x5}}}) (async) ioctl$sock_SIOCGIFCONF(r9, 0x890b, &(0x7f0000000000)=@req={0x28, &(0x7f0000000040)={'veth1_vlan\x00', @ifru_map={0x6, 0x7e779edd, 0x100, 0x21, 0xdd, 0x5}}}) timer_create(0x0, 0x0, &(0x7f0000000300)) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-connect$pppl2tp-socket$inet_udp-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_SET_MESH-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-sendmsg$BATADV_CMD_GET_DAT_CACHE-sendmsg$BATADV_CMD_GET_DAT_CACHE-socket$key-sendmsg$key-bind$inet-connect$inet-setsockopt$inet_IP_XFRM_POLICY-syz_emit_ethernet-sendmmsg-openat2-socket$pppl2tp-socket$pppl2tp-fcntl$dupfd-socket$inet6_tcp-socket$inet6_tcp-ioctl$sock_SIOCGIFCONF-ioctl$sock_SIOCGIFCONF detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) r3 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0xfffffffffffffe39, r5, 0x1, 0x4070bd28, 0x1}, 0x14}}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) (async) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast2, @in6=@private2, 0x0, 0x0, 0x4e21, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x6, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x100000000000}, {}, 0x0, 0x0, 0x1, 0x0, 0x3}, {{@in6=@mcast2, 0x0, 0x33}, 0x0, @in=@loopback, 0x0, 0x0, 0x0, 0xb7, 0xfffffffe}}, 0xe8) syz_emit_ethernet(0x6e, &(0x7f0000000040)={@link_local, @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x2f, 0x0, @private, @empty}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x6558, 0x0, 0x0, [0x0, 0x0]}, {0x0, 0x0, 0x0, 0x0, 0x11}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [0x0, 0xffff]}}}}}}, 0x0) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x20) openat2(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', &(0x7f0000000280)={0x8200, 0x0, 0x10}, 0x18) socket$pppl2tp(0x18, 0x1, 0x1) (async) r8 = socket$pppl2tp(0x18, 0x1, 0x1) fcntl$dupfd(r0, 0x0, r8) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFCONF(r9, 0x890b, &(0x7f0000000000)=@req={0x28, &(0x7f0000000040)={'veth1_vlan\x00', @ifru_map={0x6, 0x7e779edd, 0x100, 0x21, 0xdd, 0x5}}}) (async) ioctl$sock_SIOCGIFCONF(r9, 0x890b, &(0x7f0000000000)=@req={0x28, &(0x7f0000000040)={'veth1_vlan\x00', @ifru_map={0x6, 0x7e779edd, 0x100, 0x21, 0xdd, 0x5}}}) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-connect$pppl2tp-socket$inet_udp-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_SET_MESH-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-sendmsg$BATADV_CMD_GET_DAT_CACHE-sendmsg$BATADV_CMD_GET_DAT_CACHE-socket$key-sendmsg$key-bind$inet-connect$inet-setsockopt$inet_IP_XFRM_POLICY-syz_emit_ethernet-sendmmsg-openat2-socket$pppl2tp-socket$pppl2tp-fcntl$dupfd-socket$inet6_tcp-socket$inet6_tcp-ioctl$sock_SIOCGIFCONF detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) r3 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0xfffffffffffffe39, r5, 0x1, 0x4070bd28, 0x1}, 0x14}}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) (async) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast2, @in6=@private2, 0x0, 0x0, 0x4e21, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x6, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x100000000000}, {}, 0x0, 0x0, 0x1, 0x0, 0x3}, {{@in6=@mcast2, 0x0, 0x33}, 0x0, @in=@loopback, 0x0, 0x0, 0x0, 0xb7, 0xfffffffe}}, 0xe8) syz_emit_ethernet(0x6e, &(0x7f0000000040)={@link_local, @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x2f, 0x0, @private, @empty}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x6558, 0x0, 0x0, [0x0, 0x0]}, {0x0, 0x0, 0x0, 0x0, 0x11}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [0x0, 0xffff]}}}}}}, 0x0) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x20) openat2(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', &(0x7f0000000280)={0x8200, 0x0, 0x10}, 0x18) socket$pppl2tp(0x18, 0x1, 0x1) (async) r8 = socket$pppl2tp(0x18, 0x1, 0x1) fcntl$dupfd(r0, 0x0, r8) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCGIFCONF(r9, 0x890b, &(0x7f0000000000)=@req={0x28, &(0x7f0000000040)={'veth1_vlan\x00', @ifru_map={0x6, 0x7e779edd, 0x100, 0x21, 0xdd, 0x5}}}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-connect$pppl2tp-socket$inet_udp-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_SET_MESH-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-sendmsg$BATADV_CMD_GET_DAT_CACHE-sendmsg$BATADV_CMD_GET_DAT_CACHE-socket$key-sendmsg$key-bind$inet-connect$inet-setsockopt$inet_IP_XFRM_POLICY-syz_emit_ethernet-sendmmsg-openat2-socket$pppl2tp-socket$pppl2tp-fcntl$dupfd-socket$inet6_tcp-socket$inet6_tcp detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) r3 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0xfffffffffffffe39, r5, 0x1, 0x4070bd28, 0x1}, 0x14}}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) (async) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast2, @in6=@private2, 0x0, 0x0, 0x4e21, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x6, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x100000000000}, {}, 0x0, 0x0, 0x1, 0x0, 0x3}, {{@in6=@mcast2, 0x0, 0x33}, 0x0, @in=@loopback, 0x0, 0x0, 0x0, 0xb7, 0xfffffffe}}, 0xe8) syz_emit_ethernet(0x6e, &(0x7f0000000040)={@link_local, @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x2f, 0x0, @private, @empty}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x6558, 0x0, 0x0, [0x0, 0x0]}, {0x0, 0x0, 0x0, 0x0, 0x11}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [0x0, 0xffff]}}}}}}, 0x0) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x20) openat2(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', &(0x7f0000000280)={0x8200, 0x0, 0x10}, 0x18) socket$pppl2tp(0x18, 0x1, 0x1) (async) r8 = socket$pppl2tp(0x18, 0x1, 0x1) fcntl$dupfd(r0, 0x0, r8) socket$inet6_tcp(0xa, 0x1, 0x0) (async) socket$inet6_tcp(0xa, 0x1, 0x0) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-connect$pppl2tp-socket$inet_udp-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_SET_MESH-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-sendmsg$BATADV_CMD_GET_DAT_CACHE-sendmsg$BATADV_CMD_GET_DAT_CACHE-socket$key-sendmsg$key-bind$inet-connect$inet-setsockopt$inet_IP_XFRM_POLICY-syz_emit_ethernet-sendmmsg-openat2-socket$pppl2tp-socket$pppl2tp-fcntl$dupfd-socket$inet6_tcp detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) r3 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0xfffffffffffffe39, r5, 0x1, 0x4070bd28, 0x1}, 0x14}}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) (async) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast2, @in6=@private2, 0x0, 0x0, 0x4e21, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x6, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x100000000000}, {}, 0x0, 0x0, 0x1, 0x0, 0x3}, {{@in6=@mcast2, 0x0, 0x33}, 0x0, @in=@loopback, 0x0, 0x0, 0x0, 0xb7, 0xfffffffe}}, 0xe8) syz_emit_ethernet(0x6e, &(0x7f0000000040)={@link_local, @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x2f, 0x0, @private, @empty}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x6558, 0x0, 0x0, [0x0, 0x0]}, {0x0, 0x0, 0x0, 0x0, 0x11}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [0x0, 0xffff]}}}}}}, 0x0) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x20) openat2(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', &(0x7f0000000280)={0x8200, 0x0, 0x10}, 0x18) socket$pppl2tp(0x18, 0x1, 0x1) (async) r8 = socket$pppl2tp(0x18, 0x1, 0x1) fcntl$dupfd(r0, 0x0, r8) socket$inet6_tcp(0xa, 0x1, 0x0) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-connect$pppl2tp-socket$inet_udp-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_SET_MESH-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-sendmsg$BATADV_CMD_GET_DAT_CACHE-sendmsg$BATADV_CMD_GET_DAT_CACHE-socket$key-sendmsg$key-bind$inet-connect$inet-setsockopt$inet_IP_XFRM_POLICY-syz_emit_ethernet-sendmmsg-openat2-socket$pppl2tp-socket$pppl2tp-fcntl$dupfd detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) r3 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0xfffffffffffffe39, r5, 0x1, 0x4070bd28, 0x1}, 0x14}}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) (async) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast2, @in6=@private2, 0x0, 0x0, 0x4e21, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x6, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x100000000000}, {}, 0x0, 0x0, 0x1, 0x0, 0x3}, {{@in6=@mcast2, 0x0, 0x33}, 0x0, @in=@loopback, 0x0, 0x0, 0x0, 0xb7, 0xfffffffe}}, 0xe8) syz_emit_ethernet(0x6e, &(0x7f0000000040)={@link_local, @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x2f, 0x0, @private, @empty}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x6558, 0x0, 0x0, [0x0, 0x0]}, {0x0, 0x0, 0x0, 0x0, 0x11}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [0x0, 0xffff]}}}}}}, 0x0) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x20) openat2(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', &(0x7f0000000280)={0x8200, 0x0, 0x10}, 0x18) socket$pppl2tp(0x18, 0x1, 0x1) (async) r8 = socket$pppl2tp(0x18, 0x1, 0x1) fcntl$dupfd(r0, 0x0, r8) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-connect$pppl2tp-socket$inet_udp-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_SET_MESH-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-sendmsg$BATADV_CMD_GET_DAT_CACHE-sendmsg$BATADV_CMD_GET_DAT_CACHE-socket$key-sendmsg$key-bind$inet-connect$inet-setsockopt$inet_IP_XFRM_POLICY-syz_emit_ethernet-sendmmsg-openat2-socket$pppl2tp-socket$pppl2tp detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) r3 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0xfffffffffffffe39, r5, 0x1, 0x4070bd28, 0x1}, 0x14}}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) (async) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast2, @in6=@private2, 0x0, 0x0, 0x4e21, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x6, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x100000000000}, {}, 0x0, 0x0, 0x1, 0x0, 0x3}, {{@in6=@mcast2, 0x0, 0x33}, 0x0, @in=@loopback, 0x0, 0x0, 0x0, 0xb7, 0xfffffffe}}, 0xe8) syz_emit_ethernet(0x6e, &(0x7f0000000040)={@link_local, @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x2f, 0x0, @private, @empty}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x6558, 0x0, 0x0, [0x0, 0x0]}, {0x0, 0x0, 0x0, 0x0, 0x11}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [0x0, 0xffff]}}}}}}, 0x0) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x20) openat2(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', &(0x7f0000000280)={0x8200, 0x0, 0x10}, 0x18) socket$pppl2tp(0x18, 0x1, 0x1) (async) socket$pppl2tp(0x18, 0x1, 0x1) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-connect$pppl2tp-socket$inet_udp-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_SET_MESH-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-sendmsg$BATADV_CMD_GET_DAT_CACHE-sendmsg$BATADV_CMD_GET_DAT_CACHE-socket$key-sendmsg$key-bind$inet-connect$inet-setsockopt$inet_IP_XFRM_POLICY-syz_emit_ethernet-sendmmsg-openat2-socket$pppl2tp detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) r3 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0xfffffffffffffe39, r5, 0x1, 0x4070bd28, 0x1}, 0x14}}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) (async) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast2, @in6=@private2, 0x0, 0x0, 0x4e21, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x6, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x100000000000}, {}, 0x0, 0x0, 0x1, 0x0, 0x3}, {{@in6=@mcast2, 0x0, 0x33}, 0x0, @in=@loopback, 0x0, 0x0, 0x0, 0xb7, 0xfffffffe}}, 0xe8) syz_emit_ethernet(0x6e, &(0x7f0000000040)={@link_local, @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x2f, 0x0, @private, @empty}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x6558, 0x0, 0x0, [0x0, 0x0]}, {0x0, 0x0, 0x0, 0x0, 0x11}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [0x0, 0xffff]}}}}}}, 0x0) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x20) openat2(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', &(0x7f0000000280)={0x8200, 0x0, 0x10}, 0x18) socket$pppl2tp(0x18, 0x1, 0x1) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-connect$pppl2tp-socket$inet_udp-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_SET_MESH-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-sendmsg$BATADV_CMD_GET_DAT_CACHE-sendmsg$BATADV_CMD_GET_DAT_CACHE-socket$key-sendmsg$key-bind$inet-connect$inet-setsockopt$inet_IP_XFRM_POLICY-syz_emit_ethernet-sendmmsg-openat2 detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) r3 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0xfffffffffffffe39, r5, 0x1, 0x4070bd28, 0x1}, 0x14}}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) (async) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast2, @in6=@private2, 0x0, 0x0, 0x4e21, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x6, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x100000000000}, {}, 0x0, 0x0, 0x1, 0x0, 0x3}, {{@in6=@mcast2, 0x0, 0x33}, 0x0, @in=@loopback, 0x0, 0x0, 0x0, 0xb7, 0xfffffffe}}, 0xe8) syz_emit_ethernet(0x6e, &(0x7f0000000040)={@link_local, @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x2f, 0x0, @private, @empty}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x6558, 0x0, 0x0, [0x0, 0x0]}, {0x0, 0x0, 0x0, 0x0, 0x11}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [0x0, 0xffff]}}}}}}, 0x0) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x20) openat2(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', &(0x7f0000000280)={0x8200, 0x0, 0x10}, 0x18) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-connect$pppl2tp-socket$inet_udp-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_SET_MESH-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-sendmsg$BATADV_CMD_GET_DAT_CACHE-sendmsg$BATADV_CMD_GET_DAT_CACHE-socket$key-sendmsg$key-bind$inet-connect$inet-setsockopt$inet_IP_XFRM_POLICY-syz_emit_ethernet-sendmmsg detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) r3 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0xfffffffffffffe39, r5, 0x1, 0x4070bd28, 0x1}, 0x14}}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) (async) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast2, @in6=@private2, 0x0, 0x0, 0x4e21, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x6, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x100000000000}, {}, 0x0, 0x0, 0x1, 0x0, 0x3}, {{@in6=@mcast2, 0x0, 0x33}, 0x0, @in=@loopback, 0x0, 0x0, 0x0, 0xb7, 0xfffffffe}}, 0xe8) syz_emit_ethernet(0x6e, &(0x7f0000000040)={@link_local, @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x2f, 0x0, @private, @empty}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x6558, 0x0, 0x0, [0x0, 0x0]}, {0x0, 0x0, 0x0, 0x0, 0x11}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [0x0, 0xffff]}}}}}}, 0x0) sendmmsg(r3, &(0x7f0000007fc0), 0x800001d, 0x20) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-connect$pppl2tp-socket$inet_udp-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_SET_MESH-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-sendmsg$BATADV_CMD_GET_DAT_CACHE-sendmsg$BATADV_CMD_GET_DAT_CACHE-socket$key-sendmsg$key-bind$inet-connect$inet-setsockopt$inet_IP_XFRM_POLICY-syz_emit_ethernet detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) r3 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0xfffffffffffffe39, r5, 0x1, 0x4070bd28, 0x1}, 0x14}}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) (async) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast2, @in6=@private2, 0x0, 0x0, 0x4e21, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x6, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x100000000000}, {}, 0x0, 0x0, 0x1, 0x0, 0x3}, {{@in6=@mcast2, 0x0, 0x33}, 0x0, @in=@loopback, 0x0, 0x0, 0x0, 0xb7, 0xfffffffe}}, 0xe8) syz_emit_ethernet(0x6e, &(0x7f0000000040)={@link_local, @local, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x2f, 0x0, @private, @empty}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x6558, 0x0, 0x0, [0x0, 0x0]}, {0x0, 0x0, 0x0, 0x0, 0x11}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86dd, [0x0, 0xffff]}}}}}}, 0x0) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-connect$pppl2tp-socket$inet_udp-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_SET_MESH-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-sendmsg$BATADV_CMD_GET_DAT_CACHE-sendmsg$BATADV_CMD_GET_DAT_CACHE-socket$key-sendmsg$key-bind$inet-connect$inet-setsockopt$inet_IP_XFRM_POLICY detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) r3 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0xfffffffffffffe39, r5, 0x1, 0x4070bd28, 0x1}, 0x14}}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) (async) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast2, @in6=@private2, 0x0, 0x0, 0x4e21, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x6, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x100000000000}, {}, 0x0, 0x0, 0x1, 0x0, 0x3}, {{@in6=@mcast2, 0x0, 0x33}, 0x0, @in=@loopback, 0x0, 0x0, 0x0, 0xb7, 0xfffffffe}}, 0xe8) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-connect$pppl2tp-socket$inet_udp-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_SET_MESH-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-sendmsg$BATADV_CMD_GET_DAT_CACHE-sendmsg$BATADV_CMD_GET_DAT_CACHE-socket$key-sendmsg$key-bind$inet-connect$inet detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) r3 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0xfffffffffffffe39, r5, 0x1, 0x4070bd28, 0x1}, 0x14}}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) (async) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r3, &(0x7f0000000480)={0x2, 0x4, @multicast2}, 0x10) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-connect$pppl2tp-socket$inet_udp-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_SET_MESH-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-sendmsg$BATADV_CMD_GET_DAT_CACHE-sendmsg$BATADV_CMD_GET_DAT_CACHE-socket$key-sendmsg$key-bind$inet detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) r3 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0xfffffffffffffe39, r5, 0x1, 0x4070bd28, 0x1}, 0x14}}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) (async) sendmsg$BATADV_CMD_GET_DAT_CACHE(r4, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r5, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-connect$pppl2tp-socket$inet_udp-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_SET_MESH-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-sendmsg$BATADV_CMD_GET_DAT_CACHE-sendmsg$BATADV_CMD_GET_DAT_CACHE-socket$key-sendmsg$key detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0xfffffffffffffe39, r4, 0x1, 0x4070bd28, 0x1}, 0x14}}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r3, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r4, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) (async) sendmsg$BATADV_CMD_GET_DAT_CACHE(r3, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r4, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-connect$pppl2tp-socket$inet_udp-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_SET_MESH-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-sendmsg$BATADV_CMD_GET_DAT_CACHE-sendmsg$BATADV_CMD_GET_DAT_CACHE-socket$key detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0xfffffffffffffe39, r4, 0x1, 0x4070bd28, 0x1}, 0x14}}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r3, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r4, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) (async) sendmsg$BATADV_CMD_GET_DAT_CACHE(r3, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r4, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) socket$key(0xf, 0x3, 0x2) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-connect$pppl2tp-socket$inet_udp-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_SET_MESH-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-sendmsg$BATADV_CMD_GET_DAT_CACHE-sendmsg$BATADV_CMD_GET_DAT_CACHE detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0xfffffffffffffe39, r4, 0x1, 0x4070bd28, 0x1}, 0x14}}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r3, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r4, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) (async) sendmsg$BATADV_CMD_GET_DAT_CACHE(r3, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r4, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-connect$pppl2tp-socket$inet_udp-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_SET_MESH-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-sendmsg$BATADV_CMD_GET_DAT_CACHE detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0xfffffffffffffe39, r4, 0x1, 0x4070bd28, 0x1}, 0x14}}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r3, &(0x7f0000001680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001640)={&(0x7f00000015c0)={0x44, r4, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xdcd}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x44}}, 0x20040010) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-connect$pppl2tp-socket$inet_udp-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_SET_MESH-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0xfffffffffffffe39, r3, 0x1, 0x4070bd28, 0x1}, 0x14}}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-connect$pppl2tp-socket$inet_udp-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_SET_MESH-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0xfffffffffffffe39, r3, 0x1, 0x4070bd28, 0x1}, 0x14}}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-connect$pppl2tp-socket$inet_udp-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_SET_MESH detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0xfffffffffffffe39, r3, 0x1, 0x4070bd28, 0x1}, 0x14}}, 0x18) program did not crash testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-connect$pppl2tp-socket$inet_udp-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$batadv-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) program crashed: KASAN: use-after-free Write in rcu_segcblist_enqueue testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-connect$pppl2tp-socket$inet_udp-socket$nl_generic-socket$nl_generic-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-connect$pppl2tp-socket$inet_udp-socket$nl_generic-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) program crashed: KASAN: use-after-free Write in rcu_segcblist_enqueue testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-connect$pppl2tp-socket$inet_udp-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r2, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r1, 0x0, 0xe40, 0x0, &(0x7f0000000200)="c8bb4e7dbde79f73008865000800b0ad75acd2df", 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) program did not crash testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-bpf$PROG_LOAD-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000008f08000000000000000000008500000061000000850000000800000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) program did not crash testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r0, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000140)) (async) program did not crash testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_procfs-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh detailed listing: executing program 0: syz_open_procfs(0x0, &(0x7f0000005840)='net/snmp6\x00') r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)) program did not crash testing program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release extracting C reproducer testing compiled C program (duration=32.173670842s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh program crashed: KASAN: use-after-free Write in pppol2tp_release simplifying C reproducer testing compiled C program (duration=32.173670842s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=32.173670842s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=32.173670842s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh program did not crash testing compiled C program (duration=32.173670842s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=32.173670842s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=32.173670842s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=32.173670842s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=32.173670842s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=32.173670842s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=32.173670842s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=32.173670842s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=32.173670842s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=32.173670842s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, 0x0) program crashed: KASAN: use-after-free Write in rcu_segcblist_enqueue validation run: crashed=true testing program (duration=32.173670842s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, 0x0) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session validation run: crashed=true testing program (duration=32.173670842s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2, 0x0, 0x3}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, 0x0) program crashed: KASAN: use-after-free Read in rcu_cblist_dequeue validation run: crashed=true reproducing took 38m47.25125417s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x6c/0xb0 kernel/rcu/rcu_segcblist.c:75 Read of size 8 at addr ffff88812d992590 by task ksoftirqd/0/13 CPU: 0 PID: 13 Comm: ksoftirqd/0 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:88 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:427 [inline] kasan_report+0x10f/0x150 mm/kasan/report.c:444 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:309 rcu_cblist_dequeue+0x6c/0xb0 kernel/rcu/rcu_segcblist.c:75 final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in rcu_cblist_dequeue+0x6c/0xb0 kernel/rcu/rcu_segcblist.c:75 Read of size 8 at addr ffff88812d992590 by task ksoftirqd/0/13 CPU: 0 PID: 13 Comm: ksoftirqd/0 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:88 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:427 [inline] kasan_report+0x10f/0x150 mm/kasan/report.c:444 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:309 rcu_cblist_dequeue+0x6c/0xb0 kernel/rcu/rcu_segcblist.c:75