Extracting prog: 1m9.674189864s Minimizing prog: 15m19.668594855s Simplifying prog options: 0s Extracting C: 47.598659896s Simplifying C: 2m47.90494766s extracting reproducer from 70 programs testing a last program of every proc single: executing 20 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$IPCTNL_MSG_EXP_NEW-socket-getsockname$packet-syz_genetlink_get_family_id$nl80211-socket$nl_generic-syz_genetlink_get_family_id$tipc2-mmap-mmap$IORING_OFF_SQ_RING-unshare-userfaultfd-ioctl$UFFDIO_API-ioctl$UFFDIO_WAKE-sendmsg$TIPC_NL_NET_SET-sendmsg$TIPC_NL_KEY_SET-sendmsg$NL80211_CMD_FRAME-sendmsg$nl_route-socket-bpf$PROG_LOAD-sendmmsg-syz_genetlink_get_family_id$team-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$ifreq_SIOCGIFINDEX_team-getpeername$packet-sendmsg$TEAM_CMD_NOOP detailed listing: executing program 0: sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="840000000002010400000000000000000a00000004000180300003802c00018014000300fc00000000000000000000100000000014004400fe800000001f610000000000000000bb3c0002800c00028005000100000000002c00018014000300fc0200000000000000000000000000001400"], 0x84}}, 0x0) r0 = socket(0x10, 0x803, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x9) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) unshare(0x400) r5 = userfaultfd(0x1) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000280)) ioctl$UFFDIO_WAKE(r5, 0x8010aa02, &(0x7f0000000180)={&(0x7f0000359000/0x4000)=nil, 0x4000}) sendmsg$TIPC_NL_NET_SET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x38, r4, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_NET={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x1}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1000}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x2000}]}]}, 0x38}}, 0x0) sendmsg$TIPC_NL_KEY_SET(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000170000005400068014000300303132333435363738393031323334353c00040067636d2861657329000000000000000000000000000000000000000000000000140000003031323334353637383930313233343536373839"], 0x68}}, 0x0) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0x28, r2, 0x2, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8}, @val={0xc, 0x99, {0x6, 0x5}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x8000}, 0x81) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="a000000010003b0e2a1a86eb2636037f00000000", @ANYRES32=r1, @ANYBLOB="0200000000008000800012000800010076746936740002"], 0xa0}}, 0x0) r6 = socket(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x6, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000030000000000000003002000ccee79ca2ada1f2740"], &(0x7f0000001440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmmsg(r6, &(0x7f0000000000), 0x4000000000001f2, 0x0) r7 = syz_genetlink_get_family_id$team(&(0x7f0000000280), r6) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f00000002c0)={'wg0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000000300)={'team0\x00', 0x0}) getpeername$packet(r6, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000400)=0x14) sendmsg$TEAM_CMD_NOOP(r0, &(0x7f0000000c40)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000c00)={&(0x7f0000000540)={0x6c0, r7, 0x1, 0x70bd2b, 0x25dfdbfb, {}, [{{0x8, 0x1, r1}, {0x7c, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8, 0x6, r1}}}]}}, {{0x8, 0x1, r1}, {0x230, 0x2, 0x0, 0x1, [{0x40, 0x1, @name={{0x24}, {0x5}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r1}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0xffffff82}}, {0x8, 0x6, r1}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r8}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r1}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r1}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r1}}}]}}, {{0x8, 0x1, r1}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x9}}, {0x8}}}]}}, {{0x8, 0x1, r9}, {0xb4, 0x2, 0x0, 0x1, [{0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x3, 0x13, 0x8, 0x4}]}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r1}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}]}}, {{0x8, 0x1, r1}, {0x40, 0x2, 0x0, 0x1, [{0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x7, 0x2, 0x8, 0x6}]}}}]}}, {{0x8, 0x1, r1}, {0x1e0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0xac}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r1}}}, {0x54, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x24, 0x4, [{0x3, 0x7, 0x8, 0xfffffe01}, {0x9, 0xb, 0xfb, 0x1}, {0x5, 0xb, 0x6, 0x8a4}, {0x400, 0x7, 0x4, 0x2}]}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x401}}, {0x8, 0x6, r1}}}, {0x5c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x2c, 0x4, [{0x1, 0x1, 0x8, 0x7}, {0x6, 0x40, 0x4e, 0x8}, {0x4, 0xc, 0x7, 0x8}, {0xfff9, 0x5, 0xc1, 0x5}, {0xfff9, 0x5, 0xf, 0x8131}]}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8, 0x6, r10}}}]}}, {{0x8, 0x1, r1}, {0xb0, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r1}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r1}}}]}}]}, 0x6c0}, 0x1, 0x0, 0x0, 0xc4800}, 0x44) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$midi-bpf$PROG_LOAD-syz_usb_connect$uac3-socket$pppl2tp-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-socket$inet6_udp-connect$inet6-connect$pppl2tp-setsockopt$inet6_opts-openat$cgroup_ro-write$binfmt_misc-syz_genetlink_get_family_id$tipc2-sendmsg$TIPC_NL_NET_SET-writev-writev-ioctl$BTRFS_IOC_DEV_INFO-setsockopt$inet6_IPV6_FLOWLABEL_MGR-ioctl$BTRFS_IOC_SCRUB_PROGRESS-bpf$BPF_BTF_LOAD detailed listing: executing program 0: syz_usb_connect$midi(0x2, 0x52, &(0x7f0000000040)=ANY=[@ANYBLOB="120110010000002082054501400001020301090240000101181004090400000301030006090509022000000405072501033c375309050602ff030600050525080b01072501"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x12, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000ff0f00000000000000000000850000005600000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect$uac3(0x3, 0xf0, &(0x7f0000000800)=ANY=[@ANYBLOB="120100020000002099040750400001020301000000000000000408080b0102012630060904000000010130000a2401032e000700000019240702050800000005000000050000000d0000000a0000000b240c09060eb69bf82b770904010000010230000904010101010230000a2402024000ffff00040a24020200000800000409050109000005028b0a252505007c85f1764f7a1296453abb00000400000904020000010230000904020101010230000924020100080003ff0c24020104020106c645783006240201020609db0002f95d9b635691cf2402017f030305090b24020109030709c532840924020101f0a108b3c82989d6db1b522848"], &(0x7f00000005c0)={0xa, &(0x7f0000000540)={0xa, 0x6, 0x201, 0x45, 0x1, 0x2f, 0x20, 0x4}, 0x13, &(0x7f0000000580)={0x5, 0xf, 0x13, 0x2, [@ptm_cap={0x3}, @wireless={0x56, 0x10, 0x1, 0x2, 0x4, 0xba, 0xfc, 0x8f27, 0xa}]}}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r1, &(0x7f00000007c0)={0x24, &(0x7f0000000a40)=ANY=[@ANYBLOB="400896000000960b982bfe2a6d1b263d410328f57412cb124220f559516c52350fd968e09833b2263d0818a18b94957d5fcbca5b8fe5eaff8a4bb40dae272060c6b2f08eb64476d712d0b1fe86851707cc9d7f81565938ff8dd0a22e7c2ad9f7b63bca1030a9b4d5558513d875ec0900584631da522f1a9c01f0c4147b86d5ff2cf1a8cb6266455bfaf212f26d750500d35428005ed83d48e595350675b579c5a911f2f13039"], 0x0, &(0x7f0000000740)={0x0, 0x22, 0x1, {[@main=@item_012={0x0, 0x0, 0x8}]}}, 0x0}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f00000002c0)={0xa, 0x4e23, 0x9, @mcast1, 0x4}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x0, 0xfffc, 0x0, {0xa, 0x4e22, 0xffff, @mcast2}}}, 0x32) setsockopt$inet6_opts(r2, 0x29, 0x37, &(0x7f0000000000)=ANY=[], 0x8) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_mems\x00', 0x275a, 0x0) write$binfmt_misc(r3, 0x0, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r3, &(0x7f0000000740)={&(0x7f0000000000), 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0xe8, r4, 0x20a, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_SOCK={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xcfcf}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}]}]}, @TIPC_NLA_NET={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x2}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x8}]}, @TIPC_NLA_PUBL={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x6}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xb14c}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x80}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x10001}]}, @TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xfffffff9}]}, @TIPC_NLA_NODE={0x4}]}, 0xe8}, 0x1, 0x0, 0x0, 0x4000814}, 0x404c090) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000400)="ee", 0x1}], 0x1) writev(r2, &(0x7f00000001c0)=[{&(0x7f0000000280)='l', 0x1}], 0x1) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000001f40)={0x0, "1500489adfb95b45420de2438b8d0239"}) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000140)={@ipv4={'\x00', '\xff\xff', @loopback}, 0x4, 0x2, 0x0, 0x4e79064427b8d89d, 0x8001, 0xfff8}, 0x20) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000002f40)={r5, 0x3, 0x3}) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f00000003c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x14, 0x14, 0x7, [@enum={0x0, 0x1, 0x0, 0x6, 0x4, [{0x5, 0x4}]}]}, {0x0, [0x0, 0x30, 0x30, 0x5f, 0x2e]}}, &(0x7f0000000f40)=""/4073, 0x33, 0xfe9, 0x4}, 0x28) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session single: successfully extracted reproducer found reproducer with 21 syscalls minimizing guilty program testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$midi-bpf$PROG_LOAD-syz_usb_connect$uac3-socket$pppl2tp-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-socket$inet6_udp-connect$inet6-connect$pppl2tp-setsockopt$inet6_opts-openat$cgroup_ro-write$binfmt_misc-syz_genetlink_get_family_id$tipc2-sendmsg$TIPC_NL_NET_SET-writev-writev-ioctl$BTRFS_IOC_DEV_INFO-setsockopt$inet6_IPV6_FLOWLABEL_MGR-ioctl$BTRFS_IOC_SCRUB_PROGRESS detailed listing: executing program 0: syz_usb_connect$midi(0x2, 0x52, &(0x7f0000000040)=ANY=[@ANYBLOB="120110010000002082054501400001020301090240000101181004090400000301030006090509022000000405072501033c375309050602ff030600050525080b01072501"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x12, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000ff0f00000000000000000000850000005600000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect$uac3(0x3, 0xf0, &(0x7f0000000800)=ANY=[@ANYBLOB="120100020000002099040750400001020301000000000000000408080b0102012630060904000000010130000a2401032e000700000019240702050800000005000000050000000d0000000a0000000b240c09060eb69bf82b770904010000010230000904010101010230000a2402024000ffff00040a24020200000800000409050109000005028b0a252505007c85f1764f7a1296453abb00000400000904020000010230000904020101010230000924020100080003ff0c24020104020106c645783006240201020609db0002f95d9b635691cf2402017f030305090b24020109030709c532840924020101f0a108b3c82989d6db1b522848"], &(0x7f00000005c0)={0xa, &(0x7f0000000540)={0xa, 0x6, 0x201, 0x45, 0x1, 0x2f, 0x20, 0x4}, 0x13, &(0x7f0000000580)={0x5, 0xf, 0x13, 0x2, [@ptm_cap={0x3}, @wireless={0x56, 0x10, 0x1, 0x2, 0x4, 0xba, 0xfc, 0x8f27, 0xa}]}}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r1, &(0x7f00000007c0)={0x24, &(0x7f0000000a40)=ANY=[@ANYBLOB="400896000000960b982bfe2a6d1b263d410328f57412cb124220f559516c52350fd968e09833b2263d0818a18b94957d5fcbca5b8fe5eaff8a4bb40dae272060c6b2f08eb64476d712d0b1fe86851707cc9d7f81565938ff8dd0a22e7c2ad9f7b63bca1030a9b4d5558513d875ec0900584631da522f1a9c01f0c4147b86d5ff2cf1a8cb6266455bfaf212f26d750500d35428005ed83d48e595350675b579c5a911f2f13039"], 0x0, &(0x7f0000000740)={0x0, 0x22, 0x1, {[@main=@item_012={0x0, 0x0, 0x8}]}}, 0x0}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f00000002c0)={0xa, 0x4e23, 0x9, @mcast1, 0x4}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x0, 0xfffc, 0x0, {0xa, 0x4e22, 0xffff, @mcast2}}}, 0x32) setsockopt$inet6_opts(r2, 0x29, 0x37, &(0x7f0000000000)=ANY=[], 0x8) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_mems\x00', 0x275a, 0x0) write$binfmt_misc(r3, 0x0, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r3, &(0x7f0000000740)={&(0x7f0000000000), 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0xe8, r4, 0x20a, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_SOCK={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xcfcf}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}]}]}, @TIPC_NLA_NET={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x2}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x8}]}, @TIPC_NLA_PUBL={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x6}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xb14c}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x80}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x10001}]}, @TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xfffffff9}]}, @TIPC_NLA_NODE={0x4}]}, 0xe8}, 0x1, 0x0, 0x0, 0x4000814}, 0x404c090) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000400)="ee", 0x1}], 0x1) writev(r2, &(0x7f00000001c0)=[{&(0x7f0000000280)='l', 0x1}], 0x1) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000001f40)={0x0, "1500489adfb95b45420de2438b8d0239"}) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000140)={@ipv4={'\x00', '\xff\xff', @loopback}, 0x4, 0x2, 0x0, 0x4e79064427b8d89d, 0x8001, 0xfff8}, 0x20) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000002f40)={r5, 0x3, 0x3}) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$midi-bpf$PROG_LOAD-syz_usb_connect$uac3-socket$pppl2tp-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-socket$inet6_udp-connect$inet6-connect$pppl2tp-setsockopt$inet6_opts-openat$cgroup_ro-write$binfmt_misc-syz_genetlink_get_family_id$tipc2-sendmsg$TIPC_NL_NET_SET-writev-writev-ioctl$BTRFS_IOC_DEV_INFO-setsockopt$inet6_IPV6_FLOWLABEL_MGR detailed listing: executing program 0: syz_usb_connect$midi(0x2, 0x52, &(0x7f0000000040)=ANY=[@ANYBLOB="120110010000002082054501400001020301090240000101181004090400000301030006090509022000000405072501033c375309050602ff030600050525080b01072501"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x12, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000ff0f00000000000000000000850000005600000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect$uac3(0x3, 0xf0, &(0x7f0000000800)=ANY=[@ANYBLOB="120100020000002099040750400001020301000000000000000408080b0102012630060904000000010130000a2401032e000700000019240702050800000005000000050000000d0000000a0000000b240c09060eb69bf82b770904010000010230000904010101010230000a2402024000ffff00040a24020200000800000409050109000005028b0a252505007c85f1764f7a1296453abb00000400000904020000010230000904020101010230000924020100080003ff0c24020104020106c645783006240201020609db0002f95d9b635691cf2402017f030305090b24020109030709c532840924020101f0a108b3c82989d6db1b522848"], &(0x7f00000005c0)={0xa, &(0x7f0000000540)={0xa, 0x6, 0x201, 0x45, 0x1, 0x2f, 0x20, 0x4}, 0x13, &(0x7f0000000580)={0x5, 0xf, 0x13, 0x2, [@ptm_cap={0x3}, @wireless={0x56, 0x10, 0x1, 0x2, 0x4, 0xba, 0xfc, 0x8f27, 0xa}]}}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r1, &(0x7f00000007c0)={0x24, &(0x7f0000000a40)=ANY=[@ANYBLOB="400896000000960b982bfe2a6d1b263d410328f57412cb124220f559516c52350fd968e09833b2263d0818a18b94957d5fcbca5b8fe5eaff8a4bb40dae272060c6b2f08eb64476d712d0b1fe86851707cc9d7f81565938ff8dd0a22e7c2ad9f7b63bca1030a9b4d5558513d875ec0900584631da522f1a9c01f0c4147b86d5ff2cf1a8cb6266455bfaf212f26d750500d35428005ed83d48e595350675b579c5a911f2f13039"], 0x0, &(0x7f0000000740)={0x0, 0x22, 0x1, {[@main=@item_012={0x0, 0x0, 0x8}]}}, 0x0}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f00000002c0)={0xa, 0x4e23, 0x9, @mcast1, 0x4}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x0, 0xfffc, 0x0, {0xa, 0x4e22, 0xffff, @mcast2}}}, 0x32) setsockopt$inet6_opts(r2, 0x29, 0x37, &(0x7f0000000000)=ANY=[], 0x8) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_mems\x00', 0x275a, 0x0) write$binfmt_misc(r3, 0x0, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r3, &(0x7f0000000740)={&(0x7f0000000000), 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0xe8, r4, 0x20a, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_SOCK={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xcfcf}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}]}]}, @TIPC_NLA_NET={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x2}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x8}]}, @TIPC_NLA_PUBL={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x6}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xb14c}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x80}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x10001}]}, @TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xfffffff9}]}, @TIPC_NLA_NODE={0x4}]}, 0xe8}, 0x1, 0x0, 0x0, 0x4000814}, 0x404c090) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000400)="ee", 0x1}], 0x1) writev(r2, &(0x7f00000001c0)=[{&(0x7f0000000280)='l', 0x1}], 0x1) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000001f40)={0x0, "1500489adfb95b45420de2438b8d0239"}) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000140)={@ipv4={'\x00', '\xff\xff', @loopback}, 0x4, 0x2, 0x0, 0x4e79064427b8d89d, 0x8001, 0xfff8}, 0x20) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$midi-bpf$PROG_LOAD-syz_usb_connect$uac3-socket$pppl2tp-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-socket$inet6_udp-connect$inet6-connect$pppl2tp-setsockopt$inet6_opts-openat$cgroup_ro-write$binfmt_misc-syz_genetlink_get_family_id$tipc2-sendmsg$TIPC_NL_NET_SET-writev-writev-ioctl$BTRFS_IOC_DEV_INFO detailed listing: executing program 0: syz_usb_connect$midi(0x2, 0x52, &(0x7f0000000040)=ANY=[@ANYBLOB="120110010000002082054501400001020301090240000101181004090400000301030006090509022000000405072501033c375309050602ff030600050525080b01072501"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x12, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000ff0f00000000000000000000850000005600000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect$uac3(0x3, 0xf0, &(0x7f0000000800)=ANY=[@ANYBLOB="120100020000002099040750400001020301000000000000000408080b0102012630060904000000010130000a2401032e000700000019240702050800000005000000050000000d0000000a0000000b240c09060eb69bf82b770904010000010230000904010101010230000a2402024000ffff00040a24020200000800000409050109000005028b0a252505007c85f1764f7a1296453abb00000400000904020000010230000904020101010230000924020100080003ff0c24020104020106c645783006240201020609db0002f95d9b635691cf2402017f030305090b24020109030709c532840924020101f0a108b3c82989d6db1b522848"], &(0x7f00000005c0)={0xa, &(0x7f0000000540)={0xa, 0x6, 0x201, 0x45, 0x1, 0x2f, 0x20, 0x4}, 0x13, &(0x7f0000000580)={0x5, 0xf, 0x13, 0x2, [@ptm_cap={0x3}, @wireless={0x56, 0x10, 0x1, 0x2, 0x4, 0xba, 0xfc, 0x8f27, 0xa}]}}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r1, &(0x7f00000007c0)={0x24, &(0x7f0000000a40)=ANY=[@ANYBLOB="400896000000960b982bfe2a6d1b263d410328f57412cb124220f559516c52350fd968e09833b2263d0818a18b94957d5fcbca5b8fe5eaff8a4bb40dae272060c6b2f08eb64476d712d0b1fe86851707cc9d7f81565938ff8dd0a22e7c2ad9f7b63bca1030a9b4d5558513d875ec0900584631da522f1a9c01f0c4147b86d5ff2cf1a8cb6266455bfaf212f26d750500d35428005ed83d48e595350675b579c5a911f2f13039"], 0x0, &(0x7f0000000740)={0x0, 0x22, 0x1, {[@main=@item_012={0x0, 0x0, 0x8}]}}, 0x0}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f00000002c0)={0xa, 0x4e23, 0x9, @mcast1, 0x4}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x0, 0xfffc, 0x0, {0xa, 0x4e22, 0xffff, @mcast2}}}, 0x32) setsockopt$inet6_opts(r2, 0x29, 0x37, &(0x7f0000000000)=ANY=[], 0x8) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_mems\x00', 0x275a, 0x0) write$binfmt_misc(r3, 0x0, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r3, &(0x7f0000000740)={&(0x7f0000000000), 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0xe8, r4, 0x20a, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_SOCK={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xcfcf}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}]}]}, @TIPC_NLA_NET={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x2}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x8}]}, @TIPC_NLA_PUBL={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x6}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xb14c}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x80}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x10001}]}, @TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xfffffff9}]}, @TIPC_NLA_NODE={0x4}]}, 0xe8}, 0x1, 0x0, 0x0, 0x4000814}, 0x404c090) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000400)="ee", 0x1}], 0x1) writev(r2, &(0x7f00000001c0)=[{&(0x7f0000000280)='l', 0x1}], 0x1) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000001f40)={0x0, "1500489adfb95b45420de2438b8d0239"}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$midi-bpf$PROG_LOAD-syz_usb_connect$uac3-socket$pppl2tp-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-socket$inet6_udp-connect$inet6-connect$pppl2tp-setsockopt$inet6_opts-openat$cgroup_ro-write$binfmt_misc-syz_genetlink_get_family_id$tipc2-sendmsg$TIPC_NL_NET_SET-writev-writev detailed listing: executing program 0: syz_usb_connect$midi(0x2, 0x52, &(0x7f0000000040)=ANY=[@ANYBLOB="120110010000002082054501400001020301090240000101181004090400000301030006090509022000000405072501033c375309050602ff030600050525080b01072501"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x12, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000ff0f00000000000000000000850000005600000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect$uac3(0x3, 0xf0, &(0x7f0000000800)=ANY=[@ANYBLOB="120100020000002099040750400001020301000000000000000408080b0102012630060904000000010130000a2401032e000700000019240702050800000005000000050000000d0000000a0000000b240c09060eb69bf82b770904010000010230000904010101010230000a2402024000ffff00040a24020200000800000409050109000005028b0a252505007c85f1764f7a1296453abb00000400000904020000010230000904020101010230000924020100080003ff0c24020104020106c645783006240201020609db0002f95d9b635691cf2402017f030305090b24020109030709c532840924020101f0a108b3c82989d6db1b522848"], &(0x7f00000005c0)={0xa, &(0x7f0000000540)={0xa, 0x6, 0x201, 0x45, 0x1, 0x2f, 0x20, 0x4}, 0x13, &(0x7f0000000580)={0x5, 0xf, 0x13, 0x2, [@ptm_cap={0x3}, @wireless={0x56, 0x10, 0x1, 0x2, 0x4, 0xba, 0xfc, 0x8f27, 0xa}]}}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r1, &(0x7f00000007c0)={0x24, &(0x7f0000000a40)=ANY=[@ANYBLOB="400896000000960b982bfe2a6d1b263d410328f57412cb124220f559516c52350fd968e09833b2263d0818a18b94957d5fcbca5b8fe5eaff8a4bb40dae272060c6b2f08eb64476d712d0b1fe86851707cc9d7f81565938ff8dd0a22e7c2ad9f7b63bca1030a9b4d5558513d875ec0900584631da522f1a9c01f0c4147b86d5ff2cf1a8cb6266455bfaf212f26d750500d35428005ed83d48e595350675b579c5a911f2f13039"], 0x0, &(0x7f0000000740)={0x0, 0x22, 0x1, {[@main=@item_012={0x0, 0x0, 0x8}]}}, 0x0}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f00000002c0)={0xa, 0x4e23, 0x9, @mcast1, 0x4}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x0, 0xfffc, 0x0, {0xa, 0x4e22, 0xffff, @mcast2}}}, 0x32) setsockopt$inet6_opts(r2, 0x29, 0x37, &(0x7f0000000000)=ANY=[], 0x8) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_mems\x00', 0x275a, 0x0) write$binfmt_misc(r3, 0x0, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r3, &(0x7f0000000740)={&(0x7f0000000000), 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0xe8, r4, 0x20a, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_SOCK={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xcfcf}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}]}]}, @TIPC_NLA_NET={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x2}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x8}]}, @TIPC_NLA_PUBL={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x6}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xb14c}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x80}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x10001}]}, @TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xfffffff9}]}, @TIPC_NLA_NODE={0x4}]}, 0xe8}, 0x1, 0x0, 0x0, 0x4000814}, 0x404c090) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000400)="ee", 0x1}], 0x1) writev(r2, &(0x7f00000001c0)=[{&(0x7f0000000280)='l', 0x1}], 0x1) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$midi-bpf$PROG_LOAD-syz_usb_connect$uac3-socket$pppl2tp-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-socket$inet6_udp-connect$inet6-connect$pppl2tp-setsockopt$inet6_opts-openat$cgroup_ro-write$binfmt_misc-syz_genetlink_get_family_id$tipc2-sendmsg$TIPC_NL_NET_SET-writev-ioctl$BTRFS_IOC_DEV_INFO detailed listing: executing program 0: syz_usb_connect$midi(0x2, 0x52, &(0x7f0000000040)=ANY=[@ANYBLOB="120110010000002082054501400001020301090240000101181004090400000301030006090509022000000405072501033c375309050602ff030600050525080b01072501"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x12, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000ff0f00000000000000000000850000005600000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect$uac3(0x3, 0xf0, &(0x7f0000000800)=ANY=[@ANYBLOB="120100020000002099040750400001020301000000000000000408080b0102012630060904000000010130000a2401032e000700000019240702050800000005000000050000000d0000000a0000000b240c09060eb69bf82b770904010000010230000904010101010230000a2402024000ffff00040a24020200000800000409050109000005028b0a252505007c85f1764f7a1296453abb00000400000904020000010230000904020101010230000924020100080003ff0c24020104020106c645783006240201020609db0002f95d9b635691cf2402017f030305090b24020109030709c532840924020101f0a108b3c82989d6db1b522848"], &(0x7f00000005c0)={0xa, &(0x7f0000000540)={0xa, 0x6, 0x201, 0x45, 0x1, 0x2f, 0x20, 0x4}, 0x13, &(0x7f0000000580)={0x5, 0xf, 0x13, 0x2, [@ptm_cap={0x3}, @wireless={0x56, 0x10, 0x1, 0x2, 0x4, 0xba, 0xfc, 0x8f27, 0xa}]}}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r1, &(0x7f00000007c0)={0x24, &(0x7f0000000a40)=ANY=[@ANYBLOB="400896000000960b982bfe2a6d1b263d410328f57412cb124220f559516c52350fd968e09833b2263d0818a18b94957d5fcbca5b8fe5eaff8a4bb40dae272060c6b2f08eb64476d712d0b1fe86851707cc9d7f81565938ff8dd0a22e7c2ad9f7b63bca1030a9b4d5558513d875ec0900584631da522f1a9c01f0c4147b86d5ff2cf1a8cb6266455bfaf212f26d750500d35428005ed83d48e595350675b579c5a911f2f13039"], 0x0, &(0x7f0000000740)={0x0, 0x22, 0x1, {[@main=@item_012={0x0, 0x0, 0x8}]}}, 0x0}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f00000002c0)={0xa, 0x4e23, 0x9, @mcast1, 0x4}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x0, 0xfffc, 0x0, {0xa, 0x4e22, 0xffff, @mcast2}}}, 0x32) setsockopt$inet6_opts(r2, 0x29, 0x37, &(0x7f0000000000)=ANY=[], 0x8) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_mems\x00', 0x275a, 0x0) write$binfmt_misc(r3, 0x0, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r3, &(0x7f0000000740)={&(0x7f0000000000), 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0xe8, r4, 0x20a, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_SOCK={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xcfcf}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}]}]}, @TIPC_NLA_NET={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x2}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x8}]}, @TIPC_NLA_PUBL={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x6}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xb14c}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x80}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x10001}]}, @TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xfffffff9}]}, @TIPC_NLA_NODE={0x4}]}, 0xe8}, 0x1, 0x0, 0x0, 0x4000814}, 0x404c090) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000400)="ee", 0x1}], 0x1) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000001f40)={0x0, "1500489adfb95b45420de2438b8d0239"}) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$midi-bpf$PROG_LOAD-syz_usb_connect$uac3-socket$pppl2tp-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-socket$inet6_udp-connect$inet6-connect$pppl2tp-setsockopt$inet6_opts-openat$cgroup_ro-write$binfmt_misc-syz_genetlink_get_family_id$tipc2-sendmsg$TIPC_NL_NET_SET-ioctl$BTRFS_IOC_DEV_INFO detailed listing: executing program 0: syz_usb_connect$midi(0x2, 0x52, &(0x7f0000000040)=ANY=[@ANYBLOB="120110010000002082054501400001020301090240000101181004090400000301030006090509022000000405072501033c375309050602ff030600050525080b01072501"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x12, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000ff0f00000000000000000000850000005600000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect$uac3(0x3, 0xf0, &(0x7f0000000800)=ANY=[@ANYBLOB="120100020000002099040750400001020301000000000000000408080b0102012630060904000000010130000a2401032e000700000019240702050800000005000000050000000d0000000a0000000b240c09060eb69bf82b770904010000010230000904010101010230000a2402024000ffff00040a24020200000800000409050109000005028b0a252505007c85f1764f7a1296453abb00000400000904020000010230000904020101010230000924020100080003ff0c24020104020106c645783006240201020609db0002f95d9b635691cf2402017f030305090b24020109030709c532840924020101f0a108b3c82989d6db1b522848"], &(0x7f00000005c0)={0xa, &(0x7f0000000540)={0xa, 0x6, 0x201, 0x45, 0x1, 0x2f, 0x20, 0x4}, 0x13, &(0x7f0000000580)={0x5, 0xf, 0x13, 0x2, [@ptm_cap={0x3}, @wireless={0x56, 0x10, 0x1, 0x2, 0x4, 0xba, 0xfc, 0x8f27, 0xa}]}}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r1, &(0x7f00000007c0)={0x24, &(0x7f0000000a40)=ANY=[@ANYBLOB="400896000000960b982bfe2a6d1b263d410328f57412cb124220f559516c52350fd968e09833b2263d0818a18b94957d5fcbca5b8fe5eaff8a4bb40dae272060c6b2f08eb64476d712d0b1fe86851707cc9d7f81565938ff8dd0a22e7c2ad9f7b63bca1030a9b4d5558513d875ec0900584631da522f1a9c01f0c4147b86d5ff2cf1a8cb6266455bfaf212f26d750500d35428005ed83d48e595350675b579c5a911f2f13039"], 0x0, &(0x7f0000000740)={0x0, 0x22, 0x1, {[@main=@item_012={0x0, 0x0, 0x8}]}}, 0x0}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f00000002c0)={0xa, 0x4e23, 0x9, @mcast1, 0x4}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x0, 0xfffc, 0x0, {0xa, 0x4e22, 0xffff, @mcast2}}}, 0x32) setsockopt$inet6_opts(r2, 0x29, 0x37, &(0x7f0000000000)=ANY=[], 0x8) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_mems\x00', 0x275a, 0x0) write$binfmt_misc(r3, 0x0, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r3, &(0x7f0000000740)={&(0x7f0000000000), 0xc, &(0x7f0000000700)={&(0x7f0000000600)={0xe8, r4, 0x20a, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_SOCK={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x3}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x4}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x5}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xcfcf}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x9}]}]}, @TIPC_NLA_NET={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x2}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x8}]}, @TIPC_NLA_PUBL={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x6}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0xb14c}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x5}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x80}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x10001}]}, @TIPC_NLA_PUBL={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x4}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x9}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xfffffff9}]}, @TIPC_NLA_NODE={0x4}]}, 0xe8}, 0x1, 0x0, 0x0, 0x4000814}, 0x404c090) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000001f40)={0x0, "1500489adfb95b45420de2438b8d0239"}) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$midi-bpf$PROG_LOAD-syz_usb_connect$uac3-socket$pppl2tp-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-socket$inet6_udp-connect$inet6-connect$pppl2tp-setsockopt$inet6_opts-openat$cgroup_ro-write$binfmt_misc-syz_genetlink_get_family_id$tipc2-ioctl$BTRFS_IOC_DEV_INFO detailed listing: executing program 0: syz_usb_connect$midi(0x2, 0x52, &(0x7f0000000040)=ANY=[@ANYBLOB="120110010000002082054501400001020301090240000101181004090400000301030006090509022000000405072501033c375309050602ff030600050525080b01072501"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x12, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000ff0f00000000000000000000850000005600000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect$uac3(0x3, 0xf0, &(0x7f0000000800)=ANY=[@ANYBLOB="120100020000002099040750400001020301000000000000000408080b0102012630060904000000010130000a2401032e000700000019240702050800000005000000050000000d0000000a0000000b240c09060eb69bf82b770904010000010230000904010101010230000a2402024000ffff00040a24020200000800000409050109000005028b0a252505007c85f1764f7a1296453abb00000400000904020000010230000904020101010230000924020100080003ff0c24020104020106c645783006240201020609db0002f95d9b635691cf2402017f030305090b24020109030709c532840924020101f0a108b3c82989d6db1b522848"], &(0x7f00000005c0)={0xa, &(0x7f0000000540)={0xa, 0x6, 0x201, 0x45, 0x1, 0x2f, 0x20, 0x4}, 0x13, &(0x7f0000000580)={0x5, 0xf, 0x13, 0x2, [@ptm_cap={0x3}, @wireless={0x56, 0x10, 0x1, 0x2, 0x4, 0xba, 0xfc, 0x8f27, 0xa}]}}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r1, &(0x7f00000007c0)={0x24, &(0x7f0000000a40)=ANY=[@ANYBLOB="400896000000960b982bfe2a6d1b263d410328f57412cb124220f559516c52350fd968e09833b2263d0818a18b94957d5fcbca5b8fe5eaff8a4bb40dae272060c6b2f08eb64476d712d0b1fe86851707cc9d7f81565938ff8dd0a22e7c2ad9f7b63bca1030a9b4d5558513d875ec0900584631da522f1a9c01f0c4147b86d5ff2cf1a8cb6266455bfaf212f26d750500d35428005ed83d48e595350675b579c5a911f2f13039"], 0x0, &(0x7f0000000740)={0x0, 0x22, 0x1, {[@main=@item_012={0x0, 0x0, 0x8}]}}, 0x0}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f00000002c0)={0xa, 0x4e23, 0x9, @mcast1, 0x4}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x0, 0xfffc, 0x0, {0xa, 0x4e22, 0xffff, @mcast2}}}, 0x32) setsockopt$inet6_opts(r2, 0x29, 0x37, &(0x7f0000000000)=ANY=[], 0x8) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_mems\x00', 0x275a, 0x0) write$binfmt_misc(r3, 0x0, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000001f40)={0x0, "1500489adfb95b45420de2438b8d0239"}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$midi-bpf$PROG_LOAD-syz_usb_connect$uac3-socket$pppl2tp-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-socket$inet6_udp-connect$inet6-connect$pppl2tp-setsockopt$inet6_opts-openat$cgroup_ro-write$binfmt_misc-ioctl$BTRFS_IOC_DEV_INFO detailed listing: executing program 0: syz_usb_connect$midi(0x2, 0x52, &(0x7f0000000040)=ANY=[@ANYBLOB="120110010000002082054501400001020301090240000101181004090400000301030006090509022000000405072501033c375309050602ff030600050525080b01072501"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x12, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000ff0f00000000000000000000850000005600000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect$uac3(0x3, 0xf0, &(0x7f0000000800)=ANY=[@ANYBLOB="120100020000002099040750400001020301000000000000000408080b0102012630060904000000010130000a2401032e000700000019240702050800000005000000050000000d0000000a0000000b240c09060eb69bf82b770904010000010230000904010101010230000a2402024000ffff00040a24020200000800000409050109000005028b0a252505007c85f1764f7a1296453abb00000400000904020000010230000904020101010230000924020100080003ff0c24020104020106c645783006240201020609db0002f95d9b635691cf2402017f030305090b24020109030709c532840924020101f0a108b3c82989d6db1b522848"], &(0x7f00000005c0)={0xa, &(0x7f0000000540)={0xa, 0x6, 0x201, 0x45, 0x1, 0x2f, 0x20, 0x4}, 0x13, &(0x7f0000000580)={0x5, 0xf, 0x13, 0x2, [@ptm_cap={0x3}, @wireless={0x56, 0x10, 0x1, 0x2, 0x4, 0xba, 0xfc, 0x8f27, 0xa}]}}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r1, &(0x7f00000007c0)={0x24, &(0x7f0000000a40)=ANY=[@ANYBLOB="400896000000960b982bfe2a6d1b263d410328f57412cb124220f559516c52350fd968e09833b2263d0818a18b94957d5fcbca5b8fe5eaff8a4bb40dae272060c6b2f08eb64476d712d0b1fe86851707cc9d7f81565938ff8dd0a22e7c2ad9f7b63bca1030a9b4d5558513d875ec0900584631da522f1a9c01f0c4147b86d5ff2cf1a8cb6266455bfaf212f26d750500d35428005ed83d48e595350675b579c5a911f2f13039"], 0x0, &(0x7f0000000740)={0x0, 0x22, 0x1, {[@main=@item_012={0x0, 0x0, 0x8}]}}, 0x0}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f00000002c0)={0xa, 0x4e23, 0x9, @mcast1, 0x4}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x0, 0xfffc, 0x0, {0xa, 0x4e22, 0xffff, @mcast2}}}, 0x32) setsockopt$inet6_opts(r2, 0x29, 0x37, &(0x7f0000000000)=ANY=[], 0x8) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_mems\x00', 0x275a, 0x0) write$binfmt_misc(r3, 0x0, 0x0) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000001f40)={0x0, "1500489adfb95b45420de2438b8d0239"}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$midi-bpf$PROG_LOAD-syz_usb_connect$uac3-socket$pppl2tp-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-socket$inet6_udp-connect$inet6-connect$pppl2tp-setsockopt$inet6_opts-openat$cgroup_ro-ioctl$BTRFS_IOC_DEV_INFO detailed listing: executing program 0: syz_usb_connect$midi(0x2, 0x52, &(0x7f0000000040)=ANY=[@ANYBLOB="120110010000002082054501400001020301090240000101181004090400000301030006090509022000000405072501033c375309050602ff030600050525080b01072501"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x12, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000ff0f00000000000000000000850000005600000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect$uac3(0x3, 0xf0, &(0x7f0000000800)=ANY=[@ANYBLOB="120100020000002099040750400001020301000000000000000408080b0102012630060904000000010130000a2401032e000700000019240702050800000005000000050000000d0000000a0000000b240c09060eb69bf82b770904010000010230000904010101010230000a2402024000ffff00040a24020200000800000409050109000005028b0a252505007c85f1764f7a1296453abb00000400000904020000010230000904020101010230000924020100080003ff0c24020104020106c645783006240201020609db0002f95d9b635691cf2402017f030305090b24020109030709c532840924020101f0a108b3c82989d6db1b522848"], &(0x7f00000005c0)={0xa, &(0x7f0000000540)={0xa, 0x6, 0x201, 0x45, 0x1, 0x2f, 0x20, 0x4}, 0x13, &(0x7f0000000580)={0x5, 0xf, 0x13, 0x2, [@ptm_cap={0x3}, @wireless={0x56, 0x10, 0x1, 0x2, 0x4, 0xba, 0xfc, 0x8f27, 0xa}]}}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r1, &(0x7f00000007c0)={0x24, &(0x7f0000000a40)=ANY=[@ANYBLOB="400896000000960b982bfe2a6d1b263d410328f57412cb124220f559516c52350fd968e09833b2263d0818a18b94957d5fcbca5b8fe5eaff8a4bb40dae272060c6b2f08eb64476d712d0b1fe86851707cc9d7f81565938ff8dd0a22e7c2ad9f7b63bca1030a9b4d5558513d875ec0900584631da522f1a9c01f0c4147b86d5ff2cf1a8cb6266455bfaf212f26d750500d35428005ed83d48e595350675b579c5a911f2f13039"], 0x0, &(0x7f0000000740)={0x0, 0x22, 0x1, {[@main=@item_012={0x0, 0x0, 0x8}]}}, 0x0}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f00000002c0)={0xa, 0x4e23, 0x9, @mcast1, 0x4}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x0, 0xfffc, 0x0, {0xa, 0x4e22, 0xffff, @mcast2}}}, 0x32) setsockopt$inet6_opts(r2, 0x29, 0x37, &(0x7f0000000000)=ANY=[], 0x8) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_mems\x00', 0x275a, 0x0) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000001f40)={0x0, "1500489adfb95b45420de2438b8d0239"}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$midi-bpf$PROG_LOAD-syz_usb_connect$uac3-socket$pppl2tp-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-socket$inet6_udp-connect$inet6-connect$pppl2tp-setsockopt$inet6_opts-ioctl$BTRFS_IOC_DEV_INFO detailed listing: executing program 0: syz_usb_connect$midi(0x2, 0x52, &(0x7f0000000040)=ANY=[@ANYBLOB="120110010000002082054501400001020301090240000101181004090400000301030006090509022000000405072501033c375309050602ff030600050525080b01072501"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x12, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000ff0f00000000000000000000850000005600000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect$uac3(0x3, 0xf0, &(0x7f0000000800)=ANY=[@ANYBLOB="120100020000002099040750400001020301000000000000000408080b0102012630060904000000010130000a2401032e000700000019240702050800000005000000050000000d0000000a0000000b240c09060eb69bf82b770904010000010230000904010101010230000a2402024000ffff00040a24020200000800000409050109000005028b0a252505007c85f1764f7a1296453abb00000400000904020000010230000904020101010230000924020100080003ff0c24020104020106c645783006240201020609db0002f95d9b635691cf2402017f030305090b24020109030709c532840924020101f0a108b3c82989d6db1b522848"], &(0x7f00000005c0)={0xa, &(0x7f0000000540)={0xa, 0x6, 0x201, 0x45, 0x1, 0x2f, 0x20, 0x4}, 0x13, &(0x7f0000000580)={0x5, 0xf, 0x13, 0x2, [@ptm_cap={0x3}, @wireless={0x56, 0x10, 0x1, 0x2, 0x4, 0xba, 0xfc, 0x8f27, 0xa}]}}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r1, &(0x7f00000007c0)={0x24, &(0x7f0000000a40)=ANY=[@ANYBLOB="400896000000960b982bfe2a6d1b263d410328f57412cb124220f559516c52350fd968e09833b2263d0818a18b94957d5fcbca5b8fe5eaff8a4bb40dae272060c6b2f08eb64476d712d0b1fe86851707cc9d7f81565938ff8dd0a22e7c2ad9f7b63bca1030a9b4d5558513d875ec0900584631da522f1a9c01f0c4147b86d5ff2cf1a8cb6266455bfaf212f26d750500d35428005ed83d48e595350675b579c5a911f2f13039"], 0x0, &(0x7f0000000740)={0x0, 0x22, 0x1, {[@main=@item_012={0x0, 0x0, 0x8}]}}, 0x0}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f00000002c0)={0xa, 0x4e23, 0x9, @mcast1, 0x4}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x0, 0xfffc, 0x0, {0xa, 0x4e22, 0xffff, @mcast2}}}, 0x32) setsockopt$inet6_opts(r2, 0x29, 0x37, &(0x7f0000000000)=ANY=[], 0x8) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000001f40)={0x0, "1500489adfb95b45420de2438b8d0239"}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$midi-bpf$PROG_LOAD-syz_usb_connect$uac3-socket$pppl2tp-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-socket$inet6_udp-connect$inet6-connect$pppl2tp-ioctl$BTRFS_IOC_DEV_INFO detailed listing: executing program 0: syz_usb_connect$midi(0x2, 0x52, &(0x7f0000000040)=ANY=[@ANYBLOB="120110010000002082054501400001020301090240000101181004090400000301030006090509022000000405072501033c375309050602ff030600050525080b01072501"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x12, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000ff0f00000000000000000000850000005600000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect$uac3(0x3, 0xf0, &(0x7f0000000800)=ANY=[@ANYBLOB="120100020000002099040750400001020301000000000000000408080b0102012630060904000000010130000a2401032e000700000019240702050800000005000000050000000d0000000a0000000b240c09060eb69bf82b770904010000010230000904010101010230000a2402024000ffff00040a24020200000800000409050109000005028b0a252505007c85f1764f7a1296453abb00000400000904020000010230000904020101010230000924020100080003ff0c24020104020106c645783006240201020609db0002f95d9b635691cf2402017f030305090b24020109030709c532840924020101f0a108b3c82989d6db1b522848"], &(0x7f00000005c0)={0xa, &(0x7f0000000540)={0xa, 0x6, 0x201, 0x45, 0x1, 0x2f, 0x20, 0x4}, 0x13, &(0x7f0000000580)={0x5, 0xf, 0x13, 0x2, [@ptm_cap={0x3}, @wireless={0x56, 0x10, 0x1, 0x2, 0x4, 0xba, 0xfc, 0x8f27, 0xa}]}}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r1, &(0x7f00000007c0)={0x24, &(0x7f0000000a40)=ANY=[@ANYBLOB="400896000000960b982bfe2a6d1b263d410328f57412cb124220f559516c52350fd968e09833b2263d0818a18b94957d5fcbca5b8fe5eaff8a4bb40dae272060c6b2f08eb64476d712d0b1fe86851707cc9d7f81565938ff8dd0a22e7c2ad9f7b63bca1030a9b4d5558513d875ec0900584631da522f1a9c01f0c4147b86d5ff2cf1a8cb6266455bfaf212f26d750500d35428005ed83d48e595350675b579c5a911f2f13039"], 0x0, &(0x7f0000000740)={0x0, 0x22, 0x1, {[@main=@item_012={0x0, 0x0, 0x8}]}}, 0x0}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f00000002c0)={0xa, 0x4e23, 0x9, @mcast1, 0x4}, 0x1c) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x0, 0xfffc, 0x0, {0xa, 0x4e22, 0xffff, @mcast2}}}, 0x32) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000001f40)={0x0, "1500489adfb95b45420de2438b8d0239"}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$midi-bpf$PROG_LOAD-syz_usb_connect$uac3-socket$pppl2tp-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-socket$inet6_udp-connect$inet6-ioctl$BTRFS_IOC_DEV_INFO detailed listing: executing program 0: syz_usb_connect$midi(0x2, 0x52, &(0x7f0000000040)=ANY=[@ANYBLOB="120110010000002082054501400001020301090240000101181004090400000301030006090509022000000405072501033c375309050602ff030600050525080b01072501"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x12, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000ff0f00000000000000000000850000005600000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect$uac3(0x3, 0xf0, &(0x7f0000000800)=ANY=[@ANYBLOB="120100020000002099040750400001020301000000000000000408080b0102012630060904000000010130000a2401032e000700000019240702050800000005000000050000000d0000000a0000000b240c09060eb69bf82b770904010000010230000904010101010230000a2402024000ffff00040a24020200000800000409050109000005028b0a252505007c85f1764f7a1296453abb00000400000904020000010230000904020101010230000924020100080003ff0c24020104020106c645783006240201020609db0002f95d9b635691cf2402017f030305090b24020109030709c532840924020101f0a108b3c82989d6db1b522848"], &(0x7f00000005c0)={0xa, &(0x7f0000000540)={0xa, 0x6, 0x201, 0x45, 0x1, 0x2f, 0x20, 0x4}, 0x13, &(0x7f0000000580)={0x5, 0xf, 0x13, 0x2, [@ptm_cap={0x3}, @wireless={0x56, 0x10, 0x1, 0x2, 0x4, 0xba, 0xfc, 0x8f27, 0xa}]}}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r1, &(0x7f00000007c0)={0x24, &(0x7f0000000a40)=ANY=[@ANYBLOB="400896000000960b982bfe2a6d1b263d410328f57412cb124220f559516c52350fd968e09833b2263d0818a18b94957d5fcbca5b8fe5eaff8a4bb40dae272060c6b2f08eb64476d712d0b1fe86851707cc9d7f81565938ff8dd0a22e7c2ad9f7b63bca1030a9b4d5558513d875ec0900584631da522f1a9c01f0c4147b86d5ff2cf1a8cb6266455bfaf212f26d750500d35428005ed83d48e595350675b579c5a911f2f13039"], 0x0, &(0x7f0000000740)={0x0, 0x22, 0x1, {[@main=@item_012={0x0, 0x0, 0x8}]}}, 0x0}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f00000002c0)={0xa, 0x4e23, 0x9, @mcast1, 0x4}, 0x1c) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000001f40)={0x0, "1500489adfb95b45420de2438b8d0239"}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$midi-bpf$PROG_LOAD-syz_usb_connect$uac3-socket$pppl2tp-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_DEV_INFO detailed listing: executing program 0: syz_usb_connect$midi(0x2, 0x52, &(0x7f0000000040)=ANY=[@ANYBLOB="120110010000002082054501400001020301090240000101181004090400000301030006090509022000000405072501033c375309050602ff030600050525080b01072501"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x12, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000ff0f00000000000000000000850000005600000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect$uac3(0x3, 0xf0, &(0x7f0000000800)=ANY=[@ANYBLOB="120100020000002099040750400001020301000000000000000408080b0102012630060904000000010130000a2401032e000700000019240702050800000005000000050000000d0000000a0000000b240c09060eb69bf82b770904010000010230000904010101010230000a2402024000ffff00040a24020200000800000409050109000005028b0a252505007c85f1764f7a1296453abb00000400000904020000010230000904020101010230000924020100080003ff0c24020104020106c645783006240201020609db0002f95d9b635691cf2402017f030305090b24020109030709c532840924020101f0a108b3c82989d6db1b522848"], &(0x7f00000005c0)={0xa, &(0x7f0000000540)={0xa, 0x6, 0x201, 0x45, 0x1, 0x2f, 0x20, 0x4}, 0x13, &(0x7f0000000580)={0x5, 0xf, 0x13, 0x2, [@ptm_cap={0x3}, @wireless={0x56, 0x10, 0x1, 0x2, 0x4, 0xba, 0xfc, 0x8f27, 0xa}]}}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r1, &(0x7f00000007c0)={0x24, &(0x7f0000000a40)=ANY=[@ANYBLOB="400896000000960b982bfe2a6d1b263d410328f57412cb124220f559516c52350fd968e09833b2263d0818a18b94957d5fcbca5b8fe5eaff8a4bb40dae272060c6b2f08eb64476d712d0b1fe86851707cc9d7f81565938ff8dd0a22e7c2ad9f7b63bca1030a9b4d5558513d875ec0900584631da522f1a9c01f0c4147b86d5ff2cf1a8cb6266455bfaf212f26d750500d35428005ed83d48e595350675b579c5a911f2f13039"], 0x0, &(0x7f0000000740)={0x0, 0x22, 0x1, {[@main=@item_012={0x0, 0x0, 0x8}]}}, 0x0}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x0, 0xfffc, 0x0, {0xa, 0x4e22, 0xffff, @mcast2}}}, 0x32) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000001f40)={0x0, "1500489adfb95b45420de2438b8d0239"}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$midi-bpf$PROG_LOAD-syz_usb_connect$uac3-socket$pppl2tp-syz_usb_connect$hid-syz_usb_control_io$hid-syz_usb_control_io-connect$pppl2tp-ioctl$BTRFS_IOC_DEV_INFO detailed listing: executing program 0: syz_usb_connect$midi(0x2, 0x52, &(0x7f0000000040)=ANY=[@ANYBLOB="120110010000002082054501400001020301090240000101181004090400000301030006090509022000000405072501033c375309050602ff030600050525080b01072501"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x12, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000ff0f00000000000000000000850000005600000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect$uac3(0x3, 0xf0, &(0x7f0000000800)=ANY=[@ANYBLOB="120100020000002099040750400001020301000000000000000408080b0102012630060904000000010130000a2401032e000700000019240702050800000005000000050000000d0000000a0000000b240c09060eb69bf82b770904010000010230000904010101010230000a2402024000ffff00040a24020200000800000409050109000005028b0a252505007c85f1764f7a1296453abb00000400000904020000010230000904020101010230000924020100080003ff0c24020104020106c645783006240201020609db0002f95d9b635691cf2402017f030305090b24020109030709c532840924020101f0a108b3c82989d6db1b522848"], &(0x7f00000005c0)={0xa, &(0x7f0000000540)={0xa, 0x6, 0x201, 0x45, 0x1, 0x2f, 0x20, 0x4}, 0x13, &(0x7f0000000580)={0x5, 0xf, 0x13, 0x2, [@ptm_cap={0x3}, @wireless={0x56, 0x10, 0x1, 0x2, 0x4, 0xba, 0xfc, 0x8f27, 0xa}]}}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r1, &(0x7f00000007c0)={0x24, &(0x7f0000000a40)=ANY=[@ANYBLOB="400896000000960b982bfe2a6d1b263d410328f57412cb124220f559516c52350fd968e09833b2263d0818a18b94957d5fcbca5b8fe5eaff8a4bb40dae272060c6b2f08eb64476d712d0b1fe86851707cc9d7f81565938ff8dd0a22e7c2ad9f7b63bca1030a9b4d5558513d875ec0900584631da522f1a9c01f0c4147b86d5ff2cf1a8cb6266455bfaf212f26d750500d35428005ed83d48e595350675b579c5a911f2f13039"], 0x0, &(0x7f0000000740)={0x0, 0x22, 0x1, {[@main=@item_012={0x0, 0x0, 0x8}]}}, 0x0}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x4, 0x0, 0xfffc, 0x0, {0xa, 0x4e22, 0xffff, @mcast2}}}, 0x32) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000001f40)={0x0, "1500489adfb95b45420de2438b8d0239"}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$midi-bpf$PROG_LOAD-syz_usb_connect$uac3-socket$pppl2tp-syz_usb_connect$hid-syz_usb_control_io$hid-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_DEV_INFO detailed listing: executing program 0: syz_usb_connect$midi(0x2, 0x52, &(0x7f0000000040)=ANY=[@ANYBLOB="120110010000002082054501400001020301090240000101181004090400000301030006090509022000000405072501033c375309050602ff030600050525080b01072501"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x12, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000ff0f00000000000000000000850000005600000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect$uac3(0x3, 0xf0, &(0x7f0000000800)=ANY=[@ANYBLOB="120100020000002099040750400001020301000000000000000408080b0102012630060904000000010130000a2401032e000700000019240702050800000005000000050000000d0000000a0000000b240c09060eb69bf82b770904010000010230000904010101010230000a2402024000ffff00040a24020200000800000409050109000005028b0a252505007c85f1764f7a1296453abb00000400000904020000010230000904020101010230000924020100080003ff0c24020104020106c645783006240201020609db0002f95d9b635691cf2402017f030305090b24020109030709c532840924020101f0a108b3c82989d6db1b522848"], &(0x7f00000005c0)={0xa, &(0x7f0000000540)={0xa, 0x6, 0x201, 0x45, 0x1, 0x2f, 0x20, 0x4}, 0x13, &(0x7f0000000580)={0x5, 0xf, 0x13, 0x2, [@ptm_cap={0x3}, @wireless={0x56, 0x10, 0x1, 0x2, 0x4, 0xba, 0xfc, 0x8f27, 0xa}]}}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r1, &(0x7f00000007c0)={0x24, &(0x7f0000000a40)=ANY=[@ANYBLOB="400896000000960b982bfe2a6d1b263d410328f57412cb124220f559516c52350fd968e09833b2263d0818a18b94957d5fcbca5b8fe5eaff8a4bb40dae272060c6b2f08eb64476d712d0b1fe86851707cc9d7f81565938ff8dd0a22e7c2ad9f7b63bca1030a9b4d5558513d875ec0900584631da522f1a9c01f0c4147b86d5ff2cf1a8cb6266455bfaf212f26d750500d35428005ed83d48e595350675b579c5a911f2f13039"], 0x0, &(0x7f0000000740)={0x0, 0x22, 0x1, {[@main=@item_012={0x0, 0x0, 0x8}]}}, 0x0}, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x4, 0x0, 0xfffc, 0x0, {0xa, 0x4e22, 0xffff, @mcast2}}}, 0x32) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000001f40)={0x0, "1500489adfb95b45420de2438b8d0239"}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$midi-bpf$PROG_LOAD-syz_usb_connect$uac3-socket$pppl2tp-syz_usb_connect$hid-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_DEV_INFO detailed listing: executing program 0: syz_usb_connect$midi(0x2, 0x52, &(0x7f0000000040)=ANY=[@ANYBLOB="120110010000002082054501400001020301090240000101181004090400000301030006090509022000000405072501033c375309050602ff030600050525080b01072501"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x12, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000ff0f00000000000000000000850000005600000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect$uac3(0x3, 0xf0, &(0x7f0000000800)=ANY=[@ANYBLOB="120100020000002099040750400001020301000000000000000408080b0102012630060904000000010130000a2401032e000700000019240702050800000005000000050000000d0000000a0000000b240c09060eb69bf82b770904010000010230000904010101010230000a2402024000ffff00040a24020200000800000409050109000005028b0a252505007c85f1764f7a1296453abb00000400000904020000010230000904020101010230000924020100080003ff0c24020104020106c645783006240201020609db0002f95d9b635691cf2402017f030305090b24020109030709c532840924020101f0a108b3c82989d6db1b522848"], &(0x7f00000005c0)={0xa, &(0x7f0000000540)={0xa, 0x6, 0x201, 0x45, 0x1, 0x2f, 0x20, 0x4}, 0x13, &(0x7f0000000580)={0x5, 0xf, 0x13, 0x2, [@ptm_cap={0x3}, @wireless={0x56, 0x10, 0x1, 0x2, 0x4, 0xba, 0xfc, 0x8f27, 0xa}]}}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x4, 0x0, 0xfffc, 0x0, {0xa, 0x4e22, 0xffff, @mcast2}}}, 0x32) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000001f40)={0x0, "1500489adfb95b45420de2438b8d0239"}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$midi-bpf$PROG_LOAD-syz_usb_connect$uac3-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_DEV_INFO detailed listing: executing program 0: syz_usb_connect$midi(0x2, 0x52, &(0x7f0000000040)=ANY=[@ANYBLOB="120110010000002082054501400001020301090240000101181004090400000301030006090509022000000405072501033c375309050602ff030600050525080b01072501"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x12, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000ff0f00000000000000000000850000005600000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect$uac3(0x3, 0xf0, &(0x7f0000000800)=ANY=[@ANYBLOB="120100020000002099040750400001020301000000000000000408080b0102012630060904000000010130000a2401032e000700000019240702050800000005000000050000000d0000000a0000000b240c09060eb69bf82b770904010000010230000904010101010230000a2402024000ffff00040a24020200000800000409050109000005028b0a252505007c85f1764f7a1296453abb00000400000904020000010230000904020101010230000924020100080003ff0c24020104020106c645783006240201020609db0002f95d9b635691cf2402017f030305090b24020109030709c532840924020101f0a108b3c82989d6db1b522848"], &(0x7f00000005c0)={0xa, &(0x7f0000000540)={0xa, 0x6, 0x201, 0x45, 0x1, 0x2f, 0x20, 0x4}, 0x13, &(0x7f0000000580)={0x5, 0xf, 0x13, 0x2, [@ptm_cap={0x3}, @wireless={0x56, 0x10, 0x1, 0x2, 0x4, 0xba, 0xfc, 0x8f27, 0xa}]}}) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x4, 0x0, 0xfffc, 0x0, {0xa, 0x4e22, 0xffff, @mcast2}}}, 0x32) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000001f40)={0x0, "1500489adfb95b45420de2438b8d0239"}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$midi-bpf$PROG_LOAD-syz_usb_connect$uac3-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_DEV_INFO detailed listing: executing program 0: syz_usb_connect$midi(0x2, 0x52, &(0x7f0000000040)=ANY=[@ANYBLOB="120110010000002082054501400001020301090240000101181004090400000301030006090509022000000405072501033c375309050602ff030600050525080b01072501"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x12, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000ff0f00000000000000000000850000005600000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect$uac3(0x3, 0xf0, &(0x7f0000000800)=ANY=[@ANYBLOB="120100020000002099040750400001020301000000000000000408080b0102012630060904000000010130000a2401032e000700000019240702050800000005000000050000000d0000000a0000000b240c09060eb69bf82b770904010000010230000904010101010230000a2402024000ffff00040a24020200000800000409050109000005028b0a252505007c85f1764f7a1296453abb00000400000904020000010230000904020101010230000924020100080003ff0c24020104020106c645783006240201020609db0002f95d9b635691cf2402017f030305090b24020109030709c532840924020101f0a108b3c82989d6db1b522848"], &(0x7f00000005c0)={0xa, &(0x7f0000000540)={0xa, 0x6, 0x201, 0x45, 0x1, 0x2f, 0x20, 0x4}, 0x13, &(0x7f0000000580)={0x5, 0xf, 0x13, 0x2, [@ptm_cap={0x3}, @wireless={0x56, 0x10, 0x1, 0x2, 0x4, 0xba, 0xfc, 0x8f27, 0xa}]}}) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x4, 0x0, 0xfffc, 0x0, {0xa, 0x4e22, 0xffff, @mcast2}}}, 0x32) ioctl$BTRFS_IOC_DEV_INFO(0xffffffffffffffff, 0xd000941e, &(0x7f0000001f40)={0x0, "1500489adfb95b45420de2438b8d0239"}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$midi-bpf$PROG_LOAD-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_DEV_INFO detailed listing: executing program 0: syz_usb_connect$midi(0x2, 0x52, &(0x7f0000000040)=ANY=[@ANYBLOB="120110010000002082054501400001020301090240000101181004090400000301030006090509022000000405072501033c375309050602ff030600050525080b01072501"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x12, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000ff0f00000000000000000000850000005600000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @cgroup_sock_addr=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x4, 0x0, 0xfffc, 0x0, {0xa, 0x4e22, 0xffff, @mcast2}}}, 0x32) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000001f40)={0x0, "1500489adfb95b45420de2438b8d0239"}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$midi-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_DEV_INFO detailed listing: executing program 0: syz_usb_connect$midi(0x2, 0x52, &(0x7f0000000040)=ANY=[@ANYBLOB="120110010000002082054501400001020301090240000101181004090400000301030006090509022000000405072501033c375309050602ff030600050525080b01072501"], 0x0) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x4, 0x0, 0xfffc, 0x0, {0xa, 0x4e22, 0xffff, @mcast2}}}, 0x32) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000001f40)={0x0, "1500489adfb95b45420de2438b8d0239"}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_DEV_INFO detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x4, 0x0, 0xfffc, 0x0, {0xa, 0x4e22, 0xffff, @mcast2}}}, 0x32) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000001f40)={0x0, "1500489adfb95b45420de2438b8d0239"}) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_DEV_INFO detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, 0x0, 0x0) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000001f40)={0x0, "1500489adfb95b45420de2438b8d0239"}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_DEV_INFO detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x4, 0x0, 0xfffc, 0x0, {0xa, 0x4e22, 0xffff, @mcast2}}}, 0x32) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release extracting C reproducer testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_DEV_INFO program crashed: KASAN: use-after-free Write in pppol2tp_release simplifying C reproducer testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_DEV_INFO program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_DEV_INFO program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_DEV_INFO program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_DEV_INFO program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_DEV_INFO program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_DEV_INFO program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_DEV_INFO detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x4, 0x0, 0xfffc, 0x0, {0xa, 0x4e22, 0xffff, @mcast2}}}, 0x32) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release validation run: crashed=true testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_DEV_INFO detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x4, 0x0, 0xfffc, 0x0, {0xa, 0x4e22, 0xffff, @mcast2}}}, 0x32) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release validation run: crashed=true testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_DEV_INFO detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x4, 0x0, 0xfffc, 0x0, {0xa, 0x4e22, 0xffff, @mcast2}}}, 0x32) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release validation run: crashed=true reproducing took 21m53.307795214s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: use-after-free in atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline] BUG: KASAN: use-after-free in atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline] BUG: KASAN: use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:173 [inline] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298 Write of size 8 at addr ffff888111087550 by task syz.2.17/394 CPU: 0 PID: 394 Comm: syz.2.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:77 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:435 [inline] kasan_report+0x100/0x140 mm/kasan/report.c:452 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline] atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline] __mutex_trylock_fast kernel/locking/mutex.c:173 [inline] mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298 pppol2tp_release+0x178/0x2b0 net/l2tp/l2tp_ppp.c:442 __sock_release net/socket.c:597 [inline] sock_close+0xb8/0x200 net/socket.c:1287 __fput+0x2dc/0x730 fs/file_table.c:281 ____fput+0x15/0x20 fs/file_table.c:314 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f8e724da159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff2e658228 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007fff2e658310 RCX: 00007f8e724da159 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00000000000074ee R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b32b20000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f8e72761fac R14: 00007f8e72761fa8 R15: 00007f8e72761fa0 Allocated by task 394: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:430 [inline] ____kasan_kmalloc mm/kasan/common.c:509 [inline] __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:518 kasan_kmalloc include/linux/kasan.h:254 [inline] __kmalloc+0x19f/0x330 mm/slub.c:4038 kmalloc include/linux/slab.h:560 [inline] kzalloc include/linux/slab.h:667 [inline] l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772 __sys_connect_file net/socket.c:1867 [inline] __sys_connect+0x3ce/0x450 net/socket.c:1884 __do_sys_connect net/socket.c:1894 [inline] __se_sys_connect net/socket.c:1891 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:1891 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xcb Freed by task 394: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4a/0x70 mm/kasan/common.c:45 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:362 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370 kasan_slab_free include/linux/kasan.h:220 [inline] slab_free_hook mm/slub.c:1600 [inline] slab_free_freelist_hook+0xc5/0x190 mm/slub.c:1626 slab_free mm/slub.c:3208 [inline] kfree+0xc0/0x270 mm/slub.c:4196 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline] l2tp_session_put+0xb2/0x1a0 net/l2tp/l2tp_core.c:193 l2tp_session_delete+0x3a9/0x4a0 net/l2tp/l2tp_core.c:1589 pppol2tp_release+0x169/0x2b0 net/l2tp/l2tp_ppp.c:439 __sock_release net/socket.c:597 [inline] sock_close+0xb8/0x200 net/socket.c:1287 __fput+0x2dc/0x730 fs/file_table.c:281 ____fput+0x15/0x20 fs/file_table.c:314 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb The buggy address belongs to the object at ffff888111087400 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 336 bytes inside of 512-byte region [ffff888111087400, ffff888111087600) The buggy address belongs to the page: page:ffffea0004442100 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x111084 head:ffffea0004442100 order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head) raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 364, ts 29953429934, free_ts 29915013046 set_page_owner include/linux/page_owner.h:35 [inline] post_alloc_hook mm/page_alloc.c:2456 [inline] prep_new_page+0x176/0x190 mm/page_alloc.c:2462 get_page_from_freelist+0x225f/0x23f0 mm/page_alloc.c:4254 __alloc_pages_nodemask+0x29a/0x640 mm/page_alloc.c:5384 alloc_slab_page mm/slub.c:-1 [inline] allocate_slab mm/slub.c:1813 [inline] new_slab+0x84/0x3f0 mm/slub.c:1874 new_slab_objects mm/slub.c:2632 [inline] ___slab_alloc+0x2f8/0x4c0 mm/slub.c:2796 __slab_alloc+0x63/0xa0 mm/slub.c:2836 slab_alloc_node mm/slub.c:2918 [inline] slab_alloc mm/slub.c:2960 [inline] __kmalloc_track_caller+0x1e4/0x310 mm/slub.c:4541 __kmalloc_reserve net/core/skbuff.c:144 [inline] __alloc_skb+0xdc/0x520 net/core/skbuff.c:212 alloc_skb include/linux/skbuff.h:1126 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1178 [inline] netlink_sendmsg+0x693/0xb70 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:652 [inline] __sock_sendmsg net/socket.c:664 [inline] __sys_sendto+0x467/0x620 net/socket.c:2007 __do_sys_sendto net/socket.c:2019 [inline] __se_sys_sendto net/socket.c:2015 [inline] __x64_sys_sendto+0xe5/0x100 net/socket.c:2015 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xcb page last free stack trace: reset_page_owner include/linux/page_owner.h:28 [inline] free_pages_prepare mm/page_alloc.c:1349 [inline] __free_pages_ok+0x80b/0x830 mm/page_alloc.c:1629 free_the_page mm/page_alloc.c:5445 [inline] __free_pages+0xd8/0x390 mm/page_alloc.c:5454 __free_slab+0xcf/0x190 mm/slub.c:1899 free_slab mm/slub.c:1914 [inline] discard_slab mm/slub.c:1920 [inline] unfreeze_partials+0x150/0x180 mm/slub.c:2415 put_cpu_partial+0xc1/0x180 mm/slub.c:2451 __slab_free+0x2c9/0x3a0 mm/slub.c:3100 do_slab_free mm/slub.c:3196 [inline] ___cache_free+0x10e/0x130 mm/slub.c:3215 qlink_free+0x50/0x90 mm/kasan/quarantine.c:157 qlist_free_all+0x5f/0xb0 mm/kasan/quarantine.c:176 kasan_quarantine_reduce+0x14a/0x160 mm/kasan/quarantine.c:283 __kasan_slab_alloc+0x2f/0xe0 mm/kasan/common.c:440 kasan_slab_alloc include/linux/kasan.h:244 [inline] slab_post_alloc_hook+0x5d/0x2f0 mm/slab.h:580 slab_alloc_node mm/slub.c:2952 [inline] slab_alloc mm/slub.c:2960 [inline] __kmalloc+0x17b/0x330 mm/slub.c:4034 __kmalloc_node include/linux/slab.h:421 [inline] kmalloc_node include/linux/slab.h:578 [inline] kzalloc_node include/linux/slab.h:678 [inline] qdisc_alloc+0x79/0x720 net/sched/sch_generic.c:864 qdisc_create_dflt+0x6b/0x390 net/sched/sch_generic.c:927 attach_one_default_qdisc net/sched/sch_generic.c:1090 [inline] netdev_for_each_tx_queue include/linux/netdevice.h:2323 [inline] attach_default_qdiscs net/sched/sch_generic.c:1108 [inline] dev_activate+0x292/0x11c0 net/sched/sch_generic.c:1167 Memory state around the buggy address: ffff888111087400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888111087480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888111087500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888111087580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888111087600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: use-after-free in atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline] BUG: KASAN: use-after-free in atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline] BUG: KASAN: use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:173 [inline] BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298 Write of size 8 at addr ffff888111087550 by task syz.2.17/394 CPU: 0 PID: 394 Comm: syz.2.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:77 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:435 [inline] kasan_report+0x100/0x140 mm/kasan/report.c:452 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline] atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline] __mutex_trylock_fast kernel/locking/mutex.c:173 [inline] mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298 pppol2tp_release+0x178/0x2b0 net/l2tp/l2tp_ppp.c:442 __sock_release net/socket.c:597 [inline] sock_close+0xb8/0x200 net/socket.c:1287 __fput+0x2dc/0x730 fs/file_table.c:281 ____fput+0x15/0x20 fs/file_table.c:314 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7f8e724da159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff2e658228 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007fff2e658310 RCX: 00007f8e724da159 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00000000000074ee R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b32b20000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f8e72761fac R14: 00007f8e72761fa8 R15: 00007f8e72761fa0 Allocated by task 394: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:430 [inline] ____kasan_kmalloc mm/kasan/common.c:509 [inline] __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:518 kasan_kmalloc include/linux/kasan.h:254 [inline] __kmalloc+0x19f/0x330 mm/slub.c:4038 kmalloc include/linux/slab.h:560 [inline] kzalloc include/linux/slab.h:667 [inline] l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772 __sys_connect_file net/socket.c:1867 [inline] __sys_connect+0x3ce/0x450 net/socket.c:1884 __do_sys_connect net/socket.c:1894 [inline] __se_sys_connect net/socket.c:1891 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:1891 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xcb Freed by task 394: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4a/0x70 mm/kasan/common.c:45 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:362 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370 kasan_slab_free include/linux/kasan.h:220 [inline] slab_free_hook mm/slub.c:1600 [inline] slab_free_freelist_hook+0xc5/0x190 mm/slub.c:1626 slab_free mm/slub.c:3208 [inline] kfree+0xc0/0x270 mm/slub.c:4196 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline] l2tp_session_put+0xb2/0x1a0 net/l2tp/l2tp_core.c:193 l2tp_session_delete+0x3a9/0x4a0 net/l2tp/l2tp_core.c:1589 pppol2tp_release+0x169/0x2b0 net/l2tp/l2tp_ppp.c:439 __sock_release net/socket.c:597 [inline] sock_close+0xb8/0x200 net/socket.c:1287 __fput+0x2dc/0x730 fs/file_table.c:281 ____fput+0x15/0x20 fs/file_table.c:314 task_work_run+0x127/0x190 kernel/task_work.c:189 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x61/0xcb The buggy address belongs to the object at ffff888111087400 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 336 bytes inside of 512-byte region [ffff888111087400, ffff888111087600) The buggy address belongs to the page: page:ffffea0004442100 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x111084 head:ffffea0004442100 order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head) raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 364, ts 29953429934, free_ts 29915013046 set_page_owner include/linux/page_owner.h:35 [inline] post_alloc_hook mm/page_alloc.c:2456 [inline] prep_new_page+0x176/0x190 mm/page_alloc.c:2462 get_page_from_freelist+0x225f/0x23f0 mm/page_alloc.c:4254 __alloc_pages_nodemask+0x29a/0x640 mm/page_alloc.c:5384 alloc_slab_page mm/slub.c:-1 [inline] allocate_slab mm/slub.c:1813 [inline] new_slab+0x84/0x3f0 mm/slub.c:1874 new_slab_objects mm/slub.c:2632 [inline] ___slab_alloc+0x2f8/0x4c0 mm/slub.c:2796 __slab_alloc+0x63/0xa0 mm/slub.c:2836 slab_alloc_node mm/slub.c:2918 [inline] slab_alloc mm/slub.c:2960 [inline] __kmalloc_track_caller+0x1e4/0x310 mm/slub.c:4541 __kmalloc_reserve net/core/skbuff.c:144 [inline] __alloc_skb+0xdc/0x520 net/core/skbuff.c:212 alloc_skb include/linux/skbuff.h:1126 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1178 [inline] netlink_sendmsg+0x693/0xb70 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:652 [inline] __sock_sendmsg net/socket.c:664 [inline] __sys_sendto+0x467/0x620 net/socket.c:2007 __do_sys_sendto net/socket.c:2019 [inline] __se_sys_sendto net/socket.c:2015 [inline] __x64_sys_sendto+0xe5/0x100 net/socket.c:2015 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xcb page last free stack trace: reset_page_owner include/linux/page_owner.h:28 [inline] free_pages_prepare mm/page_alloc.c:1349 [inline] __free_pages_ok+0x80b/0x830 mm/page_alloc.c:1629 free_the_page mm/page_alloc.c:5445 [inline] __free_pages+0xd8/0x390 mm/page_alloc.c:5454 __free_slab+0xcf/0x190 mm/slub.c:1899 free_slab mm/slub.c:1914 [inline] discard_slab mm/slub.c:1920 [inline] unfreeze_partials+0x150/0x180 mm/slub.c:2415 put_cpu_partial+0xc1/0x180 mm/slub.c:2451 __slab_free+0x2c9/0x3a0 mm/slub.c:3100 do_slab_free mm/slub.c:3196 [inline] ___cache_free+0x10e/0x130 mm/slub.c:3215 qlink_free+0x50/0x90 mm/kasan/quarantine.c:157 qlist_free_all+0x5f/0xb0 mm/kasan/quarantine.c:176 kasan_quarantine_reduce+0x14a/0x160 mm/kasan/quarantine.c:283 __kasan_slab_alloc+0x2f/0xe0 mm/kasan/common.c:440 kasan_slab_alloc include/linux/kasan.h:244 [inline] slab_post_alloc_hook+0x5d/0x2f0 mm/slab.h:580 slab_alloc_node mm/slub.c:2952 [inline] slab_alloc mm/slub.c:2960 [inline] __kmalloc+0x17b/0x330 mm/slub.c:4034 __kmalloc_node include/linux/slab.h:421 [inline] kmalloc_node include/linux/slab.h:578 [inline] kzalloc_node include/linux/slab.h:678 [inline] qdisc_alloc+0x79/0x720 net/sched/sch_generic.c:864 qdisc_create_dflt+0x6b/0x390 net/sched/sch_generic.c:927 attach_one_default_qdisc net/sched/sch_generic.c:1090 [inline] netdev_for_each_tx_queue include/linux/netdevice.h:2323 [inline] attach_default_qdiscs net/sched/sch_generic.c:1108 [inline] dev_activate+0x292/0x11c0 net/sched/sch_generic.c:1167 Memory state around the buggy address: ffff888111087400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888111087480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888111087500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888111087580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888111087600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================