Extracting prog: 3m36.660476609s Minimizing prog: 22m56.576312545s Simplifying prog options: 49.587294209s Extracting C: 25.87089039s Simplifying C: 2m58.274773576s extracting reproducer from 67 programs testing a last program of every proc single: executing 17 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_mount_image$f2fs-syz_usb_connect$uac1-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-mmap-socketpair$unix-connect$unix-recvmmsg-capget-openat$rtc-socket$inet-setsockopt$inet_mreqsrc-ioctl$TCSETSW2-syz_emit_ethernet-socket$inet_icmp_raw-setsockopt$inet_mreq-setsockopt$MRT6_TABLE-openat-ioctl$FS_IOC_RESVSP-ioctl$FS_IOC_FIEMAP detailed listing: executing program 0: syz_mount_image$f2fs(&(0x7f0000000140), &(0x7f0000000000)='./file0\x00', 0x1000800, &(0x7f0000000380)=ANY=[@ANYBLOB="6e6f646973636172642c6261636b67726f756e645f67633d73796e632c6261636b67726f756e645f67633d6f6e2c6e6f757365725f78617474722c6e6f71756f74612c64697361626c655f726f6c6c5f666f72776172642c67635f6d657267652c6e6f757365725f78617474722c636865636b706f696e743d64697361626c652c757365725f78617474722c6673796e635f6d6f64653d7374726963742c646973636172645f756e69743d73656374696f6e2c636865636b706f696e743d64697361626c652c6e6f696e6c696e655f64656e7472792c00ec6da92d1c80a6c720380e3c2c55bf27596d2776ce408c4bb19b149757508e1c7e919c6c2047023baa412d14fa75c8cac6e5f103e13ea52708af0a7c5da8af4ecb6612"], 0x2, 0x5524, &(0x7f00000108c0)="$eJzs3L9vG3UUAPDnpGnTH5QIMbD1pAopkWqrTpsKtgCt+CFSRQUGJnBsx3Jr+6LYcUImBkbEwH+CQGJi5G9gYGZDDCA2JJDvzqUpFCHFjZvk85HO7+7rr9+9rxWd9O4iB3BqLSS//1qKy3E+ImYj4lJEtl+KiLnxpNU8vBQRVyJi5pGtVIw/HDgbERci4vIoeZ6zVLz15bXh1ZVf3vntux/Onbn41bc/Tm/VwLS9HBHdrXx/t5vHtJXH+8V4bdjOYvfmsIj5G90HxXGax93mRpZhtzaeV8vijVY+P93a6Y/iZqdWH8VWezMb3+rlJ+wPW+M82Qfu17az40ZzI4vtfprF1n5e195+fm3b7w/yPI0i3ydZ+hgMxjEfb+418/VsPchivTcoxvO8aaO5N4rDIhani3raaWR1bBzmm362vdvu7ewlw+Z2v532kpVK9ZVK9Va5up02moPmzXKt27h1M1lsdUbTyoNmrbvaStNWp1mpp92lZLFVr5er1WTxdnOjXesl1WrlRuV6eWWp2LuWvHn3g6TTSBZH8fV2b2fQ7vSTzXQ7yT+xlCxXbry6lFytJu+trSfr9+7cWVt//6PbH959be3tN4pJ/ygrWVy+vrxcrl4vL1eXTtH6PyuKnuD64VBK0y4A4Pj5r/7/4WVV/w9M2BP7/9EF6FD9//a9iKff/4f+fyKOVf/7zPT/83FS1g+Hov8HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADi1fpr7+q1sZyE/vliMP1cMvVAclyJiJiL+/BezcfZAztkiz9wT5s89VsP3pcgyjM5xrtguRMRqsf3x/NP+FgAAAODk+ubTK1/k3Xr+sjDtgjhK+U2bmUsfTyjffETMLfw8oWwzo5cXJ5Qs+/s+E3sTypbdwJqfULL8ltuZSWX7X2YPhPlHQikPM0daDgAAcCQOdgJH24UAAABwlD6fdgFMRynGjzLHz4Kz/7z/+4Hg+QNHAAAAwDFUmnYBAAAAwMQ9/hw/6//9/h8AAACcbPnv/wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD8xc7946gNRHEAfjYYyD8FRelzlXRwjBwhZcqIA+QSHCAFuUK6VJyBdDlChCPsCQu7FKwY26vV90nGeGT/eIOgmBlpAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADo0u9qs/zx9cO3W3P29bV+RcTD1jy9AQAAAC7ZVZtl82beXr9K7W9S07t0XUREeXHkXtejmJxljlJOdXf/99P7q3s1/IxoEg6fMU3Hy4j4mI6/b7v+FgAAAOD52q7Wi3a03r7Mhy6IPrWTNuXrT5nyioio5n8ypZWHvPc5kibp9z2OLzni0sRWzDKFtVNu41xpV2n+7sdZu9nJqWhP5cXHjkVm6zsAANCj0dmp31EIAAAAffo8dAHkdt3yXBH/lzKPS4HTs+dfPCYNAAAAeIqKoQsAAAAAOteM/3va/6+2/x8AAAAMo93/DwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgC7tqs1yu1ovbs3Z17fJ0xsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPjH/ryjQAiEQRjsXd+ZzP0PKw2amppUgfDxNwYDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAb373l/8TU+NMMvfaWHoeSdZOja1TY+/cOPrD+Po1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABf785ICIRAEUTBn/O+k739YSdAziBABDY8qatEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAX/e6X/xNT40wyd9pYOh5J1q4aW1eNvQeNowfj7d8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABc79+8bNxUHAPzZPl9pAXEEdEMQAokBFnq9lpZuiAEUMfAnIEXptYRe+dFmoFWFuIUNZe6CYEQICRS2/g+dWylL2DLcECRmkM92zvkhcUBkX5LPR3p+Xzsnv++zpShfP+cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKI3fncZJtunkcVwce7xzfyXrn+zrMw/XNxezlsVRnUkfDy9Xd6Juc4kAAABwoo2qO0lZ34cQttKNpayPO5P6Py0/k9X83z+bx2U9v7/uL/uy9s/ab79uv7g7UCcfJzvp9dXh4MLBvFpHPtNj4rl/+Hl+YaL82UsyuSHxB6MXxunkekbfPnr0XnsSnqkjWwDgvzhf9kVQ/j2U9f0mEwPg1GhVCu+y/k86zeYEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUIfxKDxdxlEIYbE1jTNPdu6vHNY/XN9cLNuVBw/Ww9fTc2anSEMI11eHgwu1zma+3bl77+bycDi4XX/wSgihqdHfKaZ/86MZPhxCI9dHcERBXNzsecnneAQN/lICAOBESouW1fVb6cZSdixaCOGvH/bW/69X4jBj/b/98ZXH1bGq9X+/thnOv97arc97d+7ee3P11vKNwY3Bp29d7L/dv3T18uWrvcmzkp4nJgAAAPw/7aJV6/944eD6/7lKHGas/7/4rv9VdaxE/X+o6aJf05kAAACcbs+/+ucf0SHHo3Y7fLm8tna7n2939y/m2wZS/dfOFK1a/ycLTWcFAAAA1GE8ivas/1+rxGHG9f9nfnzp5+o5kxDC2WL9//zKZ8Nr9U1nrtXx78RNzxEAAIBmnS1adf0/nbz/H+++8hCHEN54LY+LrwGcqf5P3v/mp+pY1ff/L9U3xbkUd/PrMem7IbS6TWcEAADASfZU0bJi//d0Y+mTX8592Pb+PwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEDd/g4AAP//MY062g==") syz_usb_connect$uac1(0x2, 0xaa, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902980003010000000904000000010100000a2401000000020102132406040006030000000000000000000000000924030000010000ff0924050000f8431cfd0924030604030204001b24040402", @ANYBLOB="062c077685"], 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf84fe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) capget(0x0, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x20040, 0x0) r2 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r2, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, &(0x7f0000000040)={0x7, 0xdfb3, 0x1000, 0x87, 0x1c, "88a00d4dfe1e8d9cb25618108ca7f290fff5b7", 0x8, 0x3fd}) syz_emit_ethernet(0x0, 0x0, 0x0) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mreq(r3, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) setsockopt$MRT6_TABLE(0xffffffffffffffff, 0x29, 0xcf, &(0x7f0000000080)=0xff, 0x4) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x183b41, 0x16b) ioctl$FS_IOC_RESVSP(r4, 0x40305828, &(0x7f00000000c0)={0x0, 0x2, 0x1000, 0x2}) ioctl$FS_IOC_FIEMAP(r4, 0xc020660b, &(0x7f00000004c0)={0x8, 0x7, 0x0, 0xfffffffa}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-prlimit64-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-socket$inet_tcp-socket$inet6_udp-setsockopt$IP6T_SO_SET_REPLACE-syz_clone3-prctl$PR_SET_CHILD_SUBREAPER-prctl$PR_SET_CHILD_SUBREAPER-close-bpf$MAP_CREATE-getrandom-mprotect-execveat detailed listing: executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYRES32, @ANYBLOB], 0x50) (async, rerun: 64) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async, rerun: 64) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) (async) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async, rerun: 32) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) (async, rerun: 32) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async, rerun: 64) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 64) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) (async, rerun: 32) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) (async, rerun: 32) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000e40)=@raw={'raw\x00', 0x3c1, 0x3, 0x4e0, 0x320, 0x18c, 0x203, 0x0, 0x19030000, 0x410, 0x2e0, 0x2e0, 0x410, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x2d8, 0x320, 0x0, {}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{0x0, 0x0, 0x8}, {0x1d}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x8}, {0x1}, {0x0, 0x0, 0x0, 0xe}, {}, {0x0, 0x0, 0x3}, {0x2}, {}, {0x0, 0x0, 0x0, 0x1}, {}, {}, {0x16}, {0x0, 0xff}, {}, {0x7}, {}, {0x0, 0x0, 0x0, 0x101}, {}, {0x0, 0x0, 0x5}, {}, {}, {0xfffc}, {0x0, 0x8}, {0xfffe}, {}, {}, {}, {0x0, 0xfb}, {}, {0x7a04}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x800}, {0x0, 0x46}, {0xb8c, 0x0, 0x0, 0xf00}, {0x0, 0x1, 0x0, 0x3}, {0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {0x0, 0x0, 0x0, 0xfffffffd}, {0x2000}, {}, {0x4}]}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x2, 'syz0\x00', {0x8001}}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xb, 'syz1\x00', {0x6c8}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x540) (async) syz_clone3(&(0x7f0000000080)={0x180801600, &(0x7f0000000000), 0x0, 0x0, {0x3d}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) prctl$PR_SET_CHILD_SUBREAPER(0x24, 0x1) (async) prctl$PR_SET_CHILD_SUBREAPER(0x24, 0x1) (async) close(0x3) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0600000004000000080000000800000000000000", @ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/17], 0x50) (async) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) (async) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x9) (async) execveat(0xffffffffffffffff, &(0x7f0000000f00)='./file1\x00', &(0x7f00000010c0), 0x0, 0x1000) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_inet6_udp_SIOCINQ-bpf$MAP_CREATE-openat$vga_arbiter-write$vga_arbiter-write$vga_arbiter-ioctl$sock_SIOCOUTQ-ioctl$sock_SIOCOUTQ-socket$pppl2tp-creat-close-socket$inet_udp-socket$inet_udp-setsockopt$SO_TIMESTAMPING-bind$inet-connect$inet-syz_usb_control_io$uac1-syz_usb_control_io$uac1-sendmmsg-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-mount$9p_fd-connect$pppl2tp-connect$pppl2tp-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket(0x10, 0x3, 0x3) socket$pppl2tp(0x18, 0x1, 0x1) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) (async) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) bpf$MAP_CREATE(0x0, 0x0, 0x50) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0102, 0x0) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) (async) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) (async) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = creat(&(0x7f0000000100)='./file0\x00', 0x0) close(r5) socket$inet_udp(0x2, 0x2, 0x0) (async) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r6, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r6, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r6, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) (async) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r6, &(0x7f0000007fc0), 0x800001d, 0x300) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000001c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) mount$9p_fd(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r7}}) connect$pppl2tp(r4, &(0x7f0000000100)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x4, 0x4, 0x3, 0x1, {0xa, 0x4e21, 0x1, @mcast2, 0x3}}}, 0x32) (async) connect$pppl2tp(r4, &(0x7f0000000100)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x4, 0x4, 0x3, 0x1, {0xa, 0x4e21, 0x1, @mcast2, 0x3}}}, 0x32) sendmsg$nl_route_sched(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000002c0)=@newqdisc={0x68, 0x14, 0xf0b, 0xfffffffe, 0x0, {0x2, 0x0, 0x0, 0x0, {0x0, 0xb}, {0x1, 0x5}, {0xe, 0xd}}, [@TCA_STAB={0x44, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x5, 0x2, 0xffff, 0x1ffe, 0x0, 0x1d64765e, 0x8}}, {0x4}}, {{0x1c, 0x1, {0xc, 0x1, 0xc, 0x2000800, 0x1, 0x0, 0x8}}, {0x4}}]}]}, 0x68}}, 0x8000) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session single: successfully extracted reproducer found reproducer with 30 syscalls minimizing guilty program testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_inet6_udp_SIOCINQ-bpf$MAP_CREATE-openat$vga_arbiter-write$vga_arbiter-write$vga_arbiter-ioctl$sock_SIOCOUTQ-ioctl$sock_SIOCOUTQ-socket$pppl2tp-creat-close-socket$inet_udp-socket$inet_udp-setsockopt$SO_TIMESTAMPING-bind$inet-connect$inet-syz_usb_control_io$uac1-syz_usb_control_io$uac1-sendmmsg-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-mount$9p_fd-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: r0 = socket(0x10, 0x3, 0x3) socket$pppl2tp(0x18, 0x1, 0x1) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) (async) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) bpf$MAP_CREATE(0x0, 0x0, 0x50) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0102, 0x0) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) (async) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) (async) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = creat(&(0x7f0000000100)='./file0\x00', 0x0) close(r5) socket$inet_udp(0x2, 0x2, 0x0) (async) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r6, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r6, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r6, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) (async) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r6, &(0x7f0000007fc0), 0x800001d, 0x300) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000001c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) mount$9p_fd(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r7}}) connect$pppl2tp(r4, &(0x7f0000000100)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x4, 0x4, 0x3, 0x1, {0xa, 0x4e21, 0x1, @mcast2, 0x3}}}, 0x32) (async) connect$pppl2tp(r4, &(0x7f0000000100)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x4, 0x4, 0x3, 0x1, {0xa, 0x4e21, 0x1, @mcast2, 0x3}}}, 0x32) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_inet6_udp_SIOCINQ-bpf$MAP_CREATE-openat$vga_arbiter-write$vga_arbiter-write$vga_arbiter-ioctl$sock_SIOCOUTQ-ioctl$sock_SIOCOUTQ-socket$pppl2tp-creat-close-socket$inet_udp-socket$inet_udp-setsockopt$SO_TIMESTAMPING-bind$inet-connect$inet-syz_usb_control_io$uac1-syz_usb_control_io$uac1-sendmmsg-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-mount$9p_fd-connect$pppl2tp detailed listing: executing program 0: r0 = socket(0x10, 0x3, 0x3) socket$pppl2tp(0x18, 0x1, 0x1) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) (async) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) bpf$MAP_CREATE(0x0, 0x0, 0x50) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0102, 0x0) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) (async) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) (async) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = creat(&(0x7f0000000100)='./file0\x00', 0x0) close(r5) socket$inet_udp(0x2, 0x2, 0x0) (async) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r6, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r6, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r6, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) (async) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r6, &(0x7f0000007fc0), 0x800001d, 0x300) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000001c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) mount$9p_fd(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r7}}) connect$pppl2tp(r4, &(0x7f0000000100)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x4, 0x4, 0x3, 0x1, {0xa, 0x4e21, 0x1, @mcast2, 0x3}}}, 0x32) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_inet6_udp_SIOCINQ-bpf$MAP_CREATE-openat$vga_arbiter-write$vga_arbiter-write$vga_arbiter-ioctl$sock_SIOCOUTQ-ioctl$sock_SIOCOUTQ-socket$pppl2tp-creat-close-socket$inet_udp-socket$inet_udp-setsockopt$SO_TIMESTAMPING-bind$inet-connect$inet-syz_usb_control_io$uac1-syz_usb_control_io$uac1-sendmmsg-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-mount$9p_fd detailed listing: executing program 0: r0 = socket(0x10, 0x3, 0x3) socket$pppl2tp(0x18, 0x1, 0x1) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) (async) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) bpf$MAP_CREATE(0x0, 0x0, 0x50) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0102, 0x0) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) (async) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) (async) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) socket$pppl2tp(0x18, 0x1, 0x1) r4 = creat(&(0x7f0000000100)='./file0\x00', 0x0) close(r4) socket$inet_udp(0x2, 0x2, 0x0) (async) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r5, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r5, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) (async) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r5, &(0x7f0000007fc0), 0x800001d, 0x300) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000001c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) mount$9p_fd(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r6}}) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_inet6_udp_SIOCINQ-bpf$MAP_CREATE-openat$vga_arbiter-write$vga_arbiter-write$vga_arbiter-ioctl$sock_SIOCOUTQ-ioctl$sock_SIOCOUTQ-socket$pppl2tp-creat-close-socket$inet_udp-socket$inet_udp-setsockopt$SO_TIMESTAMPING-bind$inet-connect$inet-syz_usb_control_io$uac1-syz_usb_control_io$uac1-sendmmsg-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER detailed listing: executing program 0: r0 = socket(0x10, 0x3, 0x3) socket$pppl2tp(0x18, 0x1, 0x1) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) (async) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) bpf$MAP_CREATE(0x0, 0x0, 0x50) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0102, 0x0) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) (async) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) (async) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) socket$pppl2tp(0x18, 0x1, 0x1) r4 = creat(&(0x7f0000000100)='./file0\x00', 0x0) close(r4) socket$inet_udp(0x2, 0x2, 0x0) (async) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r5, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r5, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) (async) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r5, &(0x7f0000007fc0), 0x800001d, 0x300) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f00000001c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_inet6_udp_SIOCINQ-bpf$MAP_CREATE-openat$vga_arbiter-write$vga_arbiter-write$vga_arbiter-ioctl$sock_SIOCOUTQ-ioctl$sock_SIOCOUTQ-socket$pppl2tp-creat-close-socket$inet_udp-socket$inet_udp-setsockopt$SO_TIMESTAMPING-bind$inet-connect$inet-syz_usb_control_io$uac1-syz_usb_control_io$uac1-sendmmsg detailed listing: executing program 0: r0 = socket(0x10, 0x3, 0x3) socket$pppl2tp(0x18, 0x1, 0x1) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) (async) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) bpf$MAP_CREATE(0x0, 0x0, 0x50) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0102, 0x0) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) (async) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) (async) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) socket$pppl2tp(0x18, 0x1, 0x1) r4 = creat(&(0x7f0000000100)='./file0\x00', 0x0) close(r4) socket$inet_udp(0x2, 0x2, 0x0) (async) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r5, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r5, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) (async) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r5, &(0x7f0000007fc0), 0x800001d, 0x300) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_inet6_udp_SIOCINQ-bpf$MAP_CREATE-openat$vga_arbiter-write$vga_arbiter-write$vga_arbiter-ioctl$sock_SIOCOUTQ-ioctl$sock_SIOCOUTQ-socket$pppl2tp-creat-close-socket$inet_udp-socket$inet_udp-setsockopt$SO_TIMESTAMPING-bind$inet-connect$inet-syz_usb_control_io$uac1-syz_usb_control_io$uac1 detailed listing: executing program 0: r0 = socket(0x10, 0x3, 0x3) socket$pppl2tp(0x18, 0x1, 0x1) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) (async) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) bpf$MAP_CREATE(0x0, 0x0, 0x50) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0102, 0x0) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) (async) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) (async) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) socket$pppl2tp(0x18, 0x1, 0x1) r4 = creat(&(0x7f0000000100)='./file0\x00', 0x0) close(r4) socket$inet_udp(0x2, 0x2, 0x0) (async) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r5, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r5, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) (async) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_inet6_udp_SIOCINQ-bpf$MAP_CREATE-openat$vga_arbiter-write$vga_arbiter-write$vga_arbiter-ioctl$sock_SIOCOUTQ-ioctl$sock_SIOCOUTQ-socket$pppl2tp-creat-close-socket$inet_udp-socket$inet_udp-setsockopt$SO_TIMESTAMPING-bind$inet-connect$inet-syz_usb_control_io$uac1 detailed listing: executing program 0: r0 = socket(0x10, 0x3, 0x3) socket$pppl2tp(0x18, 0x1, 0x1) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) (async) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) bpf$MAP_CREATE(0x0, 0x0, 0x50) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0102, 0x0) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) (async) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) (async) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) socket$pppl2tp(0x18, 0x1, 0x1) r4 = creat(&(0x7f0000000100)='./file0\x00', 0x0) close(r4) socket$inet_udp(0x2, 0x2, 0x0) (async) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r5, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r5, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) syz_usb_control_io$uac1(0xffffffffffffffff, 0x0, 0x0) (async) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_inet6_udp_SIOCINQ-bpf$MAP_CREATE-openat$vga_arbiter-write$vga_arbiter-write$vga_arbiter-ioctl$sock_SIOCOUTQ-ioctl$sock_SIOCOUTQ-socket$pppl2tp-creat-close-socket$inet_udp-socket$inet_udp-setsockopt$SO_TIMESTAMPING-bind$inet-connect$inet detailed listing: executing program 0: r0 = socket(0x10, 0x3, 0x3) socket$pppl2tp(0x18, 0x1, 0x1) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) (async) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) bpf$MAP_CREATE(0x0, 0x0, 0x50) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0102, 0x0) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) (async) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) (async) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) socket$pppl2tp(0x18, 0x1, 0x1) r4 = creat(&(0x7f0000000100)='./file0\x00', 0x0) close(r4) socket$inet_udp(0x2, 0x2, 0x0) (async) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r5, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) connect$inet(r5, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_inet6_udp_SIOCINQ-bpf$MAP_CREATE-openat$vga_arbiter-write$vga_arbiter-write$vga_arbiter-ioctl$sock_SIOCOUTQ-ioctl$sock_SIOCOUTQ-socket$pppl2tp-creat-close-socket$inet_udp-socket$inet_udp-setsockopt$SO_TIMESTAMPING-bind$inet detailed listing: executing program 0: r0 = socket(0x10, 0x3, 0x3) socket$pppl2tp(0x18, 0x1, 0x1) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) (async) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) bpf$MAP_CREATE(0x0, 0x0, 0x50) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0102, 0x0) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) (async) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) (async) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) socket$pppl2tp(0x18, 0x1, 0x1) r4 = creat(&(0x7f0000000100)='./file0\x00', 0x0) close(r4) socket$inet_udp(0x2, 0x2, 0x0) (async) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r5, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_inet6_udp_SIOCINQ-bpf$MAP_CREATE-openat$vga_arbiter-write$vga_arbiter-write$vga_arbiter-ioctl$sock_SIOCOUTQ-ioctl$sock_SIOCOUTQ-socket$pppl2tp-creat-close-socket$inet_udp-socket$inet_udp-setsockopt$SO_TIMESTAMPING detailed listing: executing program 0: r0 = socket(0x10, 0x3, 0x3) socket$pppl2tp(0x18, 0x1, 0x1) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) (async) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) bpf$MAP_CREATE(0x0, 0x0, 0x50) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0102, 0x0) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) (async) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) (async) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) socket$pppl2tp(0x18, 0x1, 0x1) r4 = creat(&(0x7f0000000100)='./file0\x00', 0x0) close(r4) socket$inet_udp(0x2, 0x2, 0x0) (async) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_inet6_udp_SIOCINQ-bpf$MAP_CREATE-openat$vga_arbiter-write$vga_arbiter-write$vga_arbiter-ioctl$sock_SIOCOUTQ-ioctl$sock_SIOCOUTQ-socket$pppl2tp-creat-close-socket$inet_udp-socket$inet_udp detailed listing: executing program 0: r0 = socket(0x10, 0x3, 0x3) socket$pppl2tp(0x18, 0x1, 0x1) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) (async) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) bpf$MAP_CREATE(0x0, 0x0, 0x50) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0102, 0x0) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) (async) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) (async) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) socket$pppl2tp(0x18, 0x1, 0x1) r4 = creat(&(0x7f0000000100)='./file0\x00', 0x0) close(r4) socket$inet_udp(0x2, 0x2, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_inet6_udp_SIOCINQ-bpf$MAP_CREATE-openat$vga_arbiter-write$vga_arbiter-write$vga_arbiter-ioctl$sock_SIOCOUTQ-ioctl$sock_SIOCOUTQ-socket$pppl2tp-creat-close-socket$inet_udp detailed listing: executing program 0: r0 = socket(0x10, 0x3, 0x3) socket$pppl2tp(0x18, 0x1, 0x1) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) (async) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) bpf$MAP_CREATE(0x0, 0x0, 0x50) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0102, 0x0) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) (async) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) (async) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) socket$pppl2tp(0x18, 0x1, 0x1) r4 = creat(&(0x7f0000000100)='./file0\x00', 0x0) close(r4) socket$inet_udp(0x2, 0x2, 0x0) (async) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_inet6_udp_SIOCINQ-bpf$MAP_CREATE-openat$vga_arbiter-write$vga_arbiter-write$vga_arbiter-ioctl$sock_SIOCOUTQ-ioctl$sock_SIOCOUTQ-socket$pppl2tp-creat-close detailed listing: executing program 0: r0 = socket(0x10, 0x3, 0x3) socket$pppl2tp(0x18, 0x1, 0x1) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) (async) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) bpf$MAP_CREATE(0x0, 0x0, 0x50) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0102, 0x0) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) (async) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) (async) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) socket$pppl2tp(0x18, 0x1, 0x1) r4 = creat(&(0x7f0000000100)='./file0\x00', 0x0) close(r4) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_inet6_udp_SIOCINQ-bpf$MAP_CREATE-openat$vga_arbiter-write$vga_arbiter-write$vga_arbiter-ioctl$sock_SIOCOUTQ-ioctl$sock_SIOCOUTQ-socket$pppl2tp-creat detailed listing: executing program 0: r0 = socket(0x10, 0x3, 0x3) socket$pppl2tp(0x18, 0x1, 0x1) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) (async) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) bpf$MAP_CREATE(0x0, 0x0, 0x50) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0102, 0x0) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) (async) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) (async) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) socket$pppl2tp(0x18, 0x1, 0x1) creat(&(0x7f0000000100)='./file0\x00', 0x0) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_inet6_udp_SIOCINQ-bpf$MAP_CREATE-openat$vga_arbiter-write$vga_arbiter-write$vga_arbiter-ioctl$sock_SIOCOUTQ-ioctl$sock_SIOCOUTQ-socket$pppl2tp detailed listing: executing program 0: r0 = socket(0x10, 0x3, 0x3) socket$pppl2tp(0x18, 0x1, 0x1) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) (async) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) bpf$MAP_CREATE(0x0, 0x0, 0x50) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0102, 0x0) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) (async) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) (async) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) socket$pppl2tp(0x18, 0x1, 0x1) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_inet6_udp_SIOCINQ-bpf$MAP_CREATE-openat$vga_arbiter-write$vga_arbiter-write$vga_arbiter-ioctl$sock_SIOCOUTQ-ioctl$sock_SIOCOUTQ detailed listing: executing program 0: r0 = socket(0x10, 0x3, 0x3) socket$pppl2tp(0x18, 0x1, 0x1) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) (async) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) bpf$MAP_CREATE(0x0, 0x0, 0x50) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0102, 0x0) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) (async) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) (async) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_inet6_udp_SIOCINQ-bpf$MAP_CREATE-openat$vga_arbiter-write$vga_arbiter-write$vga_arbiter-ioctl$sock_SIOCOUTQ detailed listing: executing program 0: r0 = socket(0x10, 0x3, 0x3) socket$pppl2tp(0x18, 0x1, 0x1) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) (async) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) bpf$MAP_CREATE(0x0, 0x0, 0x50) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0102, 0x0) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) (async) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_inet6_udp_SIOCINQ-bpf$MAP_CREATE-openat$vga_arbiter-write$vga_arbiter-write$vga_arbiter detailed listing: executing program 0: r0 = socket(0x10, 0x3, 0x3) socket$pppl2tp(0x18, 0x1, 0x1) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) (async) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) bpf$MAP_CREATE(0x0, 0x0, 0x50) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0102, 0x0) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) (async) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) program did not crash testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_inet6_udp_SIOCINQ-bpf$MAP_CREATE-openat$vga_arbiter-write$vga_arbiter-ioctl$sock_SIOCOUTQ detailed listing: executing program 0: r0 = socket(0x10, 0x3, 0x3) socket$pppl2tp(0x18, 0x1, 0x1) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) (async) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) bpf$MAP_CREATE(0x0, 0x0, 0x50) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0102, 0x0) write$vga_arbiter(r3, &(0x7f0000000040)=ANY=[@ANYBLOB='lock '], 0x3c) (async) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_inet6_udp_SIOCINQ-bpf$MAP_CREATE-openat$vga_arbiter-ioctl$sock_SIOCOUTQ detailed listing: executing program 0: r0 = socket(0x10, 0x3, 0x3) socket$pppl2tp(0x18, 0x1, 0x1) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) (async) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) bpf$MAP_CREATE(0x0, 0x0, 0x50) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1c0102, 0x0) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) (async) program crashed: KASAN: use-after-free Read in rcu_cblist_dequeue testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_inet6_udp_SIOCINQ-bpf$MAP_CREATE-ioctl$sock_SIOCOUTQ detailed listing: executing program 0: r0 = socket(0x10, 0x3, 0x3) socket$pppl2tp(0x18, 0x1, 0x1) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) (async) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) bpf$MAP_CREATE(0x0, 0x0, 0x50) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) (async) program crashed: KASAN: use-after-free Read in rcu_cblist_dequeue testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_inet6_udp_SIOCINQ-ioctl$sock_SIOCOUTQ detailed listing: executing program 0: r0 = socket(0x10, 0x3, 0x3) socket$pppl2tp(0x18, 0x1, 0x1) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) (async) connect$pppl2tp(r1, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000080)) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCOUTQ detailed listing: executing program 0: socket(0x10, 0x3, 0x3) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) connect$pppl2tp(r0, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r1, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) (async) connect$pppl2tp(r0, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r1, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000180)) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCOUTQ detailed listing: executing program 0: socket(0x10, 0x3, 0x3) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) connect$pppl2tp(r0, &(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r1, 0x1, 0x4, 0x0, 0x1, {0xa, 0x4e20, 0x0, @local}}}, 0x3a) (async) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000180)) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCOUTQ detailed listing: executing program 0: socket(0x10, 0x3, 0x3) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000180)) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$pppl2tp-socket$pppl2tp-socket$inet6_udp-ioctl$sock_SIOCOUTQ detailed listing: executing program 0: socket(0x10, 0x3, 0x3) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000180)) (async) program did not crash testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$sock_SIOCOUTQ detailed listing: executing program 0: socket(0x10, 0x3, 0x3) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000180)) (async) program did not crash testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCOUTQ detailed listing: executing program 0: socket(0x10, 0x3, 0x3) socket$pppl2tp(0x18, 0x1, 0x1) (async) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r0, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000180)) (async) program did not crash testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCOUTQ detailed listing: executing program 0: socket(0x10, 0x3, 0x3) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000180)) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCOUTQ detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000180)) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCOUTQ detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000180)) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCOUTQ detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, 0x0, 0x0) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000180)) program did not crash testing program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCOUTQ detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCOUTQ(r0, 0x5411, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release extracting C reproducer testing compiled C program (duration=36.308228181s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCOUTQ program did not crash simplifying guilty program options testing program (duration=36.308228181s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCOUTQ detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCOUTQ(r0, 0x5411, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release extracting C reproducer testing compiled C program (duration=36.308228181s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCOUTQ program crashed: KASAN: use-after-free Write in pppol2tp_release simplifying C reproducer testing compiled C program (duration=36.308228181s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCOUTQ program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=36.308228181s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCOUTQ program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=36.308228181s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCOUTQ program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=36.308228181s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCOUTQ program did not crash testing compiled C program (duration=36.308228181s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCOUTQ program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=36.308228181s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCOUTQ detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCOUTQ(r0, 0x5411, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release validation run: crashed=true testing program (duration=36.308228181s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCOUTQ detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCOUTQ(r0, 0x5411, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release validation run: crashed=true testing program (duration=36.308228181s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$sock_SIOCOUTQ detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1}}, 0x2}}, 0x2e) ioctl$sock_SIOCOUTQ(r0, 0x5411, 0x0) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session validation run: crashed=true reproducing took 33m16.328115933s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in pppol2tp_sock_to_session+0x1a0/0x1b0 net/l2tp/l2tp_ppp.c:156 Read of size 4 at addr ffff88810fc85000 by task syz.2.17/369 CPU: 0 PID: 369 Comm: syz.2.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:77 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:435 [inline] kasan_report+0x100/0x140 mm/kasan/report.c:452 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308 pppol2tp_sock_to_session+0x1a0/0x1b0 net/l2tp/l2tp_ppp.c:156 pppol2tp_release+0x150/0x2b0 net/l2tp/l2tp_ppp.c:435 __sock_release net/socket.c:597 [inline] sock_close+0xb8/0x200 net/socket.c:1287 __fput+0x2dc/0x730 fs/file_table.c:281 ____fput+0x15/0x20 fs/file_table.c:314 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f9e918d9e59 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc6c8cd0b8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffc6c8cd1a0 RCX: 00007f9e918d9e59 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 0000000000006ac6 R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b32c20000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f9e91b61fac R14: 00007f9e91b61fa8 R15: 00007f9e91b61fa0 Allocated by task 369: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:430 [inline] ____kasan_kmalloc mm/kasan/common.c:509 [inline] __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:518 kasan_kmalloc include/linux/kasan.h:254 [inline] __kmalloc+0x19f/0x330 mm/slub.c:4038 kmalloc include/linux/slab.h:560 [inline] kzalloc include/linux/slab.h:667 [inline] l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772 __sys_connect_file net/socket.c:1867 [inline] __sys_connect+0x3ce/0x450 net/socket.c:1884 __do_sys_connect net/socket.c:1894 [inline] __se_sys_connect net/socket.c:1891 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:1891 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xcb Freed by task 320: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4a/0x70 mm/kasan/common.c:45 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:362 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370 kasan_slab_free include/linux/kasan.h:220 [inline] slab_free_hook mm/slub.c:1600 [inline] slab_free_freelist_hook+0xc5/0x190 mm/slub.c:1626 slab_free mm/slub.c:3208 [inline] kfree+0xc0/0x270 mm/slub.c:4196 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline] l2tp_session_put+0xb2/0x1a0 net/l2tp/l2tp_core.c:193 l2tp_session_delete+0x3a9/0x4a0 net/l2tp/l2tp_core.c:1589 l2tp_tunnel_closeall net/l2tp/l2tp_core.c:1235 [inline] l2tp_tunnel_del_work+0x180/0x3d0 net/l2tp/l2tp_core.c:1273 process_one_work+0x6fd/0xbc0 kernel/workqueue.c:2301 worker_thread+0xa8e/0x13c0 kernel/workqueue.c:2447 kthread+0x324/0x3b0 kernel/kthread.c:313 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 The buggy address belongs to the object at ffff88810fc85000 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 0 bytes inside of 512-byte region [ffff88810fc85000, ffff88810fc85200) The buggy address belongs to the page: page:ffffea00043f2100 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10fc84 head:ffffea00043f2100 order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head) raw: 4000000000010200 ffffea000445b300 0000000400000004 ffff888100043080 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 96, ts 4228496800, free_ts 0 set_page_owner include/linux/page_owner.h:35 [inline] post_alloc_hook mm/page_alloc.c:2456 [inline] prep_new_page+0x176/0x190 mm/page_alloc.c:2462 get_page_from_freelist+0x225f/0x23f0 mm/page_alloc.c:4254 __alloc_pages_nodemask+0x29a/0x640 mm/page_alloc.c:5384 alloc_slab_page mm/slub.c:-1 [inline] allocate_slab mm/slub.c:1813 [inline] new_slab+0x84/0x3f0 mm/slub.c:1874 new_slab_objects mm/slub.c:2632 [inline] ___slab_alloc+0x2f8/0x4c0 mm/slub.c:2796 __slab_alloc+0x63/0xa0 mm/slub.c:2836 slab_alloc_node mm/slub.c:2918 [inline] slab_alloc mm/slub.c:2960 [inline] __kmalloc_track_caller+0x1e4/0x310 mm/slub.c:4541 __kmalloc_reserve net/core/skbuff.c:144 [inline] __alloc_skb+0xdc/0x520 net/core/skbuff.c:212 alloc_skb include/linux/skbuff.h:1126 [inline] alloc_uevent_skb+0x85/0x240 lib/kobject_uevent.c:290 uevent_net_broadcast_untagged lib/kobject_uevent.c:326 [inline] kobject_uevent_net_broadcast+0x335/0x5a0 lib/kobject_uevent.c:409 kobject_uevent_env+0x52b/0x700 lib/kobject_uevent.c:608 kobject_synth_uevent+0x452/0x940 lib/kobject_uevent.c:208 store_uevent+0x16/0x30 kernel/module.c:1233 module_attr_store+0x5f/0x80 kernel/params.c:921 sysfs_kf_write+0x129/0x150 fs/sysfs/file.c:139 kernfs_fop_write_iter+0x2bd/0x400 fs/kernfs/file.c:296 page_owner free stack trace missing Memory state around the buggy address: ffff88810fc84f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88810fc84f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88810fc85000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88810fc85080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88810fc85100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== ------------[ cut here ]------------ WARNING: CPU: 0 PID: 369 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 net/l2tp/l2tp_ppp.c:156 Modules linked in: CPU: 0 PID: 369 Comm: syz.2.17 Tainted: G B syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 net/l2tp/l2tp_ppp.c:156 Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 RSP: 0018:ffffc90002167d68 EFLAGS: 00010293 RAX: ffffffff842ec3a7 RBX: ffff888111755800 RCX: ffff88810c08bb40 RDX: 0000000000000000 RSI: 000000000ccd9560 RDI: 000000000c04eb7d RBP: ffffc90002167d88 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0dcf648 R12: dffffc0000000000 R13: dffffc0000000000 R14: 000000000ccd9560 R15: ffff88810fc85000 FS: 0000555590410500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000000 CR3: 0000000110c14000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: pppol2tp_release+0x150/0x2b0 net/l2tp/l2tp_ppp.c:435 __sock_release net/socket.c:597 [inline] sock_close+0xb8/0x200 net/socket.c:1287 __fput+0x2dc/0x730 fs/file_table.c:281 ____fput+0x15/0x20 fs/file_table.c:314 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f9e918d9e59 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc6c8cd0b8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffc6c8cd1a0 RCX: 00007f9e918d9e59 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 0000000000006ac6 R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b32c20000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f9e91b61fac R14: 00007f9e91b61fa8 R15: 00007f9e91b61fa0 ---[ end trace 1a17fda6e1c9dd08 ]--- final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in pppol2tp_sock_to_session+0x1a0/0x1b0 net/l2tp/l2tp_ppp.c:156 Read of size 4 at addr ffff88810fc85000 by task syz.2.17/369 CPU: 0 PID: 369 Comm: syz.2.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:77 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:435 [inline] kasan_report+0x100/0x140 mm/kasan/report.c:452 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308 pppol2tp_sock_to_session+0x1a0/0x1b0 net/l2tp/l2tp_ppp.c:156 pppol2tp_release+0x150/0x2b0 net/l2tp/l2tp_ppp.c:435 __sock_release net/socket.c:597 [inline] sock_close+0xb8/0x200 net/socket.c:1287 __fput+0x2dc/0x730 fs/file_table.c:281 ____fput+0x15/0x20 fs/file_table.c:314 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f9e918d9e59 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc6c8cd0b8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffc6c8cd1a0 RCX: 00007f9e918d9e59 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 0000000000006ac6 R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b32c20000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f9e91b61fac R14: 00007f9e91b61fa8 R15: 00007f9e91b61fa0 Allocated by task 369: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:430 [inline] ____kasan_kmalloc mm/kasan/common.c:509 [inline] __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:518 kasan_kmalloc include/linux/kasan.h:254 [inline] __kmalloc+0x19f/0x330 mm/slub.c:4038 kmalloc include/linux/slab.h:560 [inline] kzalloc include/linux/slab.h:667 [inline] l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772 __sys_connect_file net/socket.c:1867 [inline] __sys_connect+0x3ce/0x450 net/socket.c:1884 __do_sys_connect net/socket.c:1894 [inline] __se_sys_connect net/socket.c:1891 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:1891 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xcb Freed by task 320: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4a/0x70 mm/kasan/common.c:45 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:362 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370 kasan_slab_free include/linux/kasan.h:220 [inline] slab_free_hook mm/slub.c:1600 [inline] slab_free_freelist_hook+0xc5/0x190 mm/slub.c:1626 slab_free mm/slub.c:3208 [inline] kfree+0xc0/0x270 mm/slub.c:4196 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline] l2tp_session_put+0xb2/0x1a0 net/l2tp/l2tp_core.c:193 l2tp_session_delete+0x3a9/0x4a0 net/l2tp/l2tp_core.c:1589 l2tp_tunnel_closeall net/l2tp/l2tp_core.c:1235 [inline] l2tp_tunnel_del_work+0x180/0x3d0 net/l2tp/l2tp_core.c:1273 process_one_work+0x6fd/0xbc0 kernel/workqueue.c:2301 worker_thread+0xa8e/0x13c0 kernel/workqueue.c:2447 kthread+0x324/0x3b0 kernel/kthread.c:313 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 The buggy address belongs to the object at ffff88810fc85000 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 0 bytes inside of 512-byte region [ffff88810fc85000, ffff88810fc85200) The buggy address belongs to the page: page:ffffea00043f2100 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10fc84 head:ffffea00043f2100 order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head) raw: 4000000000010200 ffffea000445b300 0000000400000004 ffff888100043080 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 96, ts 4228496800, free_ts 0 set_page_owner include/linux/page_owner.h:35 [inline] post_alloc_hook mm/page_alloc.c:2456 [inline] prep_new_page+0x176/0x190 mm/page_alloc.c:2462 get_page_from_freelist+0x225f/0x23f0 mm/page_alloc.c:4254 __alloc_pages_nodemask+0x29a/0x640 mm/page_alloc.c:5384 alloc_slab_page mm/slub.c:-1 [inline] allocate_slab mm/slub.c:1813 [inline] new_slab+0x84/0x3f0 mm/slub.c:1874 new_slab_objects mm/slub.c:2632 [inline] ___slab_alloc+0x2f8/0x4c0 mm/slub.c:2796 __slab_alloc+0x63/0xa0 mm/slub.c:2836 slab_alloc_node mm/slub.c:2918 [inline] slab_alloc mm/slub.c:2960 [inline] __kmalloc_track_caller+0x1e4/0x310 mm/slub.c:4541 __kmalloc_reserve net/core/skbuff.c:144 [inline] __alloc_skb+0xdc/0x520 net/core/skbuff.c:212 alloc_skb include/linux/skbuff.h:1126 [inline] alloc_uevent_skb+0x85/0x240 lib/kobject_uevent.c:290 uevent_net_broadcast_untagged lib/kobject_uevent.c:326 [inline] kobject_uevent_net_broadcast+0x335/0x5a0 lib/kobject_uevent.c:409 kobject_uevent_env+0x52b/0x700 lib/kobject_uevent.c:608 kobject_synth_uevent+0x452/0x940 lib/kobject_uevent.c:208 store_uevent+0x16/0x30 kernel/module.c:1233 module_attr_store+0x5f/0x80 kernel/params.c:921 sysfs_kf_write+0x129/0x150 fs/sysfs/file.c:139 kernfs_fop_write_iter+0x2bd/0x400 fs/kernfs/file.c:296 page_owner free stack trace missing Memory state around the buggy address: ffff88810fc84f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88810fc84f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88810fc85000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88810fc85080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88810fc85100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== ------------[ cut here ]------------ WARNING: CPU: 0 PID: 369 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 net/l2tp/l2tp_ppp.c:156 Modules linked in: CPU: 0 PID: 369 Comm: syz.2.17 Tainted: G B syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 net/l2tp/l2tp_ppp.c:156 Code: 5d c3 e8 dc df 35 fd be 02 00 00 00 eb 0a e8 d0 df 35 fd be 01 00 00 00 4c 89 f7 e8 43 55 0f fe e9 0f ff ff ff e8 b9 df 35 fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 a8 df 35 fd 4c 89 f7 be 03 RSP: 0018:ffffc90002167d68 EFLAGS: 00010293 RAX: ffffffff842ec3a7 RBX: ffff888111755800 RCX: ffff88810c08bb40 RDX: 0000000000000000 RSI: 000000000ccd9560 RDI: 000000000c04eb7d RBP: ffffc90002167d88 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffffbfff0dcf648 R12: dffffc0000000000 R13: dffffc0000000000 R14: 000000000ccd9560 R15: ffff88810fc85000 FS: 0000555590410500(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000000 CR3: 0000000110c14000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: pppol2tp_release+0x150/0x2b0 net/l2tp/l2tp_ppp.c:435 __sock_release net/socket.c:597 [inline] sock_close+0xb8/0x200 net/socket.c:1287 __fput+0x2dc/0x730 fs/file_table.c:281 ____fput+0x15/0x20 fs/file_table.c:314 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f9e918d9e59 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc6c8cd0b8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffc6c8cd1a0 RCX: 00007f9e918d9e59 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 0000000000006ac6 R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b32c20000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f9e91b61fac R14: 00007f9e91b61fa8 R15: 00007f9e91b61fa0 ---[ end trace 1a17fda6e1c9dd08 ]---