Extracting prog: 1m33.619535744s Minimizing prog: 28m24.857549549s Simplifying prog options: 0s Extracting C: 1m41.188335237s Simplifying C: 3m13.845733754s extracting reproducer from 58 programs testing a last program of every proc single: executing 13 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect$cdc_ncm-capset-unshare-syz_usb_control_io$cdc_ncm-syz_usb_control_io$cdc_ncm detailed listing: executing program 0: r0 = syz_usb_connect$cdc_ncm(0x0, 0x76, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0) capset(0x0, 0x0) unshare(0x22020600) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-setsockopt$packet_fanout_data-write$binfmt_misc-connect$pppl2tp-socket$packet-socket$nl_generic-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$ifreq_SIOCGIFINDEX_wireguard-bind$packet-bind$packet-bpf$BPF_BTF_LOAD-ioctl$F2FS_IOC_MOVE_RANGE-ioctl$F2FS_IOC_MOVE_RANGE-openat$selinux_avc_cache_threshold-openat$selinux_avc_cache_threshold-openat-ioctl$FITRIM-openat$binder_debug-syz_open_procfs-syz_open_procfs-read$FUSE-syz_open_procfs-readlinkat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_open_dev$usbfs-syz_open_dev$usbfs-fcntl$dupfd-fcntl$dupfd-ioctl$USBDEVFS_SUBMITURB-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$PROG_LOAD_XDP detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) write$binfmt_misc(r3, &(0x7f0000000100), 0x6) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00', 0x0}) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) (async) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) r8 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc4, 0xc4, 0x5, [@struct={0xa, 0x7, 0x0, 0x4, 0x1, 0x100, [{0xe, 0x5, 0x13a}, {0x10, 0x2, 0x4}, {0x6, 0x0, 0x4}, {0x8, 0x1, 0xb9}, {0xd, 0x1, 0x7}, {0x6, 0x0, 0x3}, {0xf, 0x0, 0x6}]}, @const={0x4, 0x0, 0x0, 0xa, 0x2}, @decl_tag={0x4, 0x0, 0x0, 0x11, 0x2, 0x7}, @enum={0xb, 0x1, 0x0, 0x6, 0x4, [{0xb}]}, @decl_tag={0x9, 0x0, 0x0, 0x11, 0x2, 0xffffffffffffffff}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x5, 0xf}}, @restrict={0x7}]}, {0x0, [0x30, 0x5f, 0x30]}}, &(0x7f0000000440)=""/164, 0xe1, 0xa4, 0x0, 0x22cdcbd8}, 0x28) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) (async) r10 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) r11 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x8080, 0x83) ioctl$FITRIM(r11, 0xc0185879, &(0x7f00000001c0)={0x0, 0x1ffffff, 0xfffffffffffffff6}) r12 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000640)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') (async) r13 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r13, &(0x7f0000000600)={0x2020}, 0x2020) r14 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='net/igmp6\x00') readlinkat(r14, &(0x7f0000000100)='./mnt\x00', &(0x7f0000000840)=""/66, 0x42) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000700)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000680), &(0x7f00000006c0)}, 0x20) syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) (async) r16 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) fcntl$dupfd(r16, 0x0, r16) (async) r17 = fcntl$dupfd(r16, 0x0, r16) ioctl$USBDEVFS_SUBMITURB(r17, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000080)={0x80, 0x13, 0x0, 0x0, 0x7995}, 0x10022, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000800)={0x6, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000c0020000000000000000010002250100070e20009500000000000000ae045cb7eacfefe2687aee602f897d6dc55aebeae4da04"], &(0x7f00000000c0)='syzkaller\x00', 0x80000000, 0x67, &(0x7f0000000100)=""/103, 0x41100, 0x8, '\x00', r7, 0x25, r8, 0x8, &(0x7f0000000540)={0x9, 0x3}, 0x8, 0x10, &(0x7f0000000580)={0x0, 0x7, 0x5}, 0x10, 0x0, 0x0, 0x3, &(0x7f0000000780)=[r9, r10, r2, r11, r12, r13, r14, r15, r17, r18], &(0x7f00000007c0)=[{0x0, 0x1, 0x0, 0xa}, {0x1, 0x4, 0xf, 0x2}, {0x3, 0x4, 0x4, 0x5}], 0x10, 0x5}, 0x94) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session single: successfully extracted reproducer found reproducer with 40 syscalls minimizing guilty program testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-setsockopt$packet_fanout_data-write$binfmt_misc-connect$pppl2tp-socket$packet-socket$nl_generic-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$ifreq_SIOCGIFINDEX_wireguard-bind$packet-bind$packet-bpf$BPF_BTF_LOAD-ioctl$F2FS_IOC_MOVE_RANGE-ioctl$F2FS_IOC_MOVE_RANGE-openat$selinux_avc_cache_threshold-openat$selinux_avc_cache_threshold-openat-ioctl$FITRIM-openat$binder_debug-syz_open_procfs-syz_open_procfs-read$FUSE-syz_open_procfs-readlinkat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_open_dev$usbfs-syz_open_dev$usbfs-fcntl$dupfd-fcntl$dupfd-ioctl$USBDEVFS_SUBMITURB-bpf$BPF_MAP_CONST_STR_FREEZE detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) write$binfmt_misc(r3, &(0x7f0000000100), 0x6) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00', 0x0}) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) (async) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc4, 0xc4, 0x5, [@struct={0xa, 0x7, 0x0, 0x4, 0x1, 0x100, [{0xe, 0x5, 0x13a}, {0x10, 0x2, 0x4}, {0x6, 0x0, 0x4}, {0x8, 0x1, 0xb9}, {0xd, 0x1, 0x7}, {0x6, 0x0, 0x3}, {0xf, 0x0, 0x6}]}, @const={0x4, 0x0, 0x0, 0xa, 0x2}, @decl_tag={0x4, 0x0, 0x0, 0x11, 0x2, 0x7}, @enum={0xb, 0x1, 0x0, 0x6, 0x4, [{0xb}]}, @decl_tag={0x9, 0x0, 0x0, 0x11, 0x2, 0xffffffffffffffff}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x5, 0xf}}, @restrict={0x7}]}, {0x0, [0x30, 0x5f, 0x30]}}, &(0x7f0000000440)=""/164, 0xe1, 0xa4, 0x0, 0x22cdcbd8}, 0x28) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) (async) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x8080, 0x83) ioctl$FITRIM(r8, 0xc0185879, &(0x7f00000001c0)={0x0, 0x1ffffff, 0xfffffffffffffff6}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000640)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') (async) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r9, &(0x7f0000000600)={0x2020}, 0x2020) r10 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='net/igmp6\x00') readlinkat(r10, &(0x7f0000000100)='./mnt\x00', &(0x7f0000000840)=""/66, 0x42) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000700)={{}, &(0x7f0000000680), &(0x7f00000006c0)}, 0x20) syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) (async) r11 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) fcntl$dupfd(r11, 0x0, r11) (async) r12 = fcntl$dupfd(r11, 0x0, r11) ioctl$USBDEVFS_SUBMITURB(r12, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000080)={0x80, 0x13, 0x0, 0x0, 0x7995}, 0x10022, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000740), 0x4) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-setsockopt$packet_fanout_data-write$binfmt_misc-connect$pppl2tp-socket$packet-socket$nl_generic-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$ifreq_SIOCGIFINDEX_wireguard-bind$packet-bind$packet-bpf$BPF_BTF_LOAD-ioctl$F2FS_IOC_MOVE_RANGE-ioctl$F2FS_IOC_MOVE_RANGE-openat$selinux_avc_cache_threshold-openat$selinux_avc_cache_threshold-openat-ioctl$FITRIM-openat$binder_debug-syz_open_procfs-syz_open_procfs-read$FUSE-syz_open_procfs-readlinkat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_open_dev$usbfs-syz_open_dev$usbfs-fcntl$dupfd-fcntl$dupfd-ioctl$USBDEVFS_SUBMITURB detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) write$binfmt_misc(r3, &(0x7f0000000100), 0x6) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00', 0x0}) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) (async) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc4, 0xc4, 0x5, [@struct={0xa, 0x7, 0x0, 0x4, 0x1, 0x100, [{0xe, 0x5, 0x13a}, {0x10, 0x2, 0x4}, {0x6, 0x0, 0x4}, {0x8, 0x1, 0xb9}, {0xd, 0x1, 0x7}, {0x6, 0x0, 0x3}, {0xf, 0x0, 0x6}]}, @const={0x4, 0x0, 0x0, 0xa, 0x2}, @decl_tag={0x4, 0x0, 0x0, 0x11, 0x2, 0x7}, @enum={0xb, 0x1, 0x0, 0x6, 0x4, [{0xb}]}, @decl_tag={0x9, 0x0, 0x0, 0x11, 0x2, 0xffffffffffffffff}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x5, 0xf}}, @restrict={0x7}]}, {0x0, [0x30, 0x5f, 0x30]}}, &(0x7f0000000440)=""/164, 0xe1, 0xa4, 0x0, 0x22cdcbd8}, 0x28) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) (async) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x8080, 0x83) ioctl$FITRIM(r8, 0xc0185879, &(0x7f00000001c0)={0x0, 0x1ffffff, 0xfffffffffffffff6}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000640)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') (async) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r9, &(0x7f0000000600)={0x2020}, 0x2020) r10 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='net/igmp6\x00') readlinkat(r10, &(0x7f0000000100)='./mnt\x00', &(0x7f0000000840)=""/66, 0x42) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000700)={{}, &(0x7f0000000680), &(0x7f00000006c0)}, 0x20) syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) (async) r11 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) fcntl$dupfd(r11, 0x0, r11) (async) r12 = fcntl$dupfd(r11, 0x0, r11) ioctl$USBDEVFS_SUBMITURB(r12, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000080)={0x80, 0x13, 0x0, 0x0, 0x7995}, 0x10022, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-setsockopt$packet_fanout_data-write$binfmt_misc-connect$pppl2tp-socket$packet-socket$nl_generic-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$ifreq_SIOCGIFINDEX_wireguard-bind$packet-bind$packet-bpf$BPF_BTF_LOAD-ioctl$F2FS_IOC_MOVE_RANGE-ioctl$F2FS_IOC_MOVE_RANGE-openat$selinux_avc_cache_threshold-openat$selinux_avc_cache_threshold-openat-ioctl$FITRIM-openat$binder_debug-syz_open_procfs-syz_open_procfs-read$FUSE-syz_open_procfs-readlinkat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_open_dev$usbfs-syz_open_dev$usbfs-fcntl$dupfd-fcntl$dupfd detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) write$binfmt_misc(r3, &(0x7f0000000100), 0x6) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00', 0x0}) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) (async) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc4, 0xc4, 0x5, [@struct={0xa, 0x7, 0x0, 0x4, 0x1, 0x100, [{0xe, 0x5, 0x13a}, {0x10, 0x2, 0x4}, {0x6, 0x0, 0x4}, {0x8, 0x1, 0xb9}, {0xd, 0x1, 0x7}, {0x6, 0x0, 0x3}, {0xf, 0x0, 0x6}]}, @const={0x4, 0x0, 0x0, 0xa, 0x2}, @decl_tag={0x4, 0x0, 0x0, 0x11, 0x2, 0x7}, @enum={0xb, 0x1, 0x0, 0x6, 0x4, [{0xb}]}, @decl_tag={0x9, 0x0, 0x0, 0x11, 0x2, 0xffffffffffffffff}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x5, 0xf}}, @restrict={0x7}]}, {0x0, [0x30, 0x5f, 0x30]}}, &(0x7f0000000440)=""/164, 0xe1, 0xa4, 0x0, 0x22cdcbd8}, 0x28) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) (async) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x8080, 0x83) ioctl$FITRIM(r8, 0xc0185879, &(0x7f00000001c0)={0x0, 0x1ffffff, 0xfffffffffffffff6}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000640)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') (async) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r9, &(0x7f0000000600)={0x2020}, 0x2020) r10 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='net/igmp6\x00') readlinkat(r10, &(0x7f0000000100)='./mnt\x00', &(0x7f0000000840)=""/66, 0x42) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000700)={{}, &(0x7f0000000680), &(0x7f00000006c0)}, 0x20) syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) (async) r11 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) fcntl$dupfd(r11, 0x0, r11) (async) fcntl$dupfd(r11, 0x0, r11) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-setsockopt$packet_fanout_data-write$binfmt_misc-connect$pppl2tp-socket$packet-socket$nl_generic-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$ifreq_SIOCGIFINDEX_wireguard-bind$packet-bind$packet-bpf$BPF_BTF_LOAD-ioctl$F2FS_IOC_MOVE_RANGE-ioctl$F2FS_IOC_MOVE_RANGE-openat$selinux_avc_cache_threshold-openat$selinux_avc_cache_threshold-openat-ioctl$FITRIM-openat$binder_debug-syz_open_procfs-syz_open_procfs-read$FUSE-syz_open_procfs-readlinkat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_open_dev$usbfs-syz_open_dev$usbfs-fcntl$dupfd detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) write$binfmt_misc(r3, &(0x7f0000000100), 0x6) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00', 0x0}) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) (async) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc4, 0xc4, 0x5, [@struct={0xa, 0x7, 0x0, 0x4, 0x1, 0x100, [{0xe, 0x5, 0x13a}, {0x10, 0x2, 0x4}, {0x6, 0x0, 0x4}, {0x8, 0x1, 0xb9}, {0xd, 0x1, 0x7}, {0x6, 0x0, 0x3}, {0xf, 0x0, 0x6}]}, @const={0x4, 0x0, 0x0, 0xa, 0x2}, @decl_tag={0x4, 0x0, 0x0, 0x11, 0x2, 0x7}, @enum={0xb, 0x1, 0x0, 0x6, 0x4, [{0xb}]}, @decl_tag={0x9, 0x0, 0x0, 0x11, 0x2, 0xffffffffffffffff}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x5, 0xf}}, @restrict={0x7}]}, {0x0, [0x30, 0x5f, 0x30]}}, &(0x7f0000000440)=""/164, 0xe1, 0xa4, 0x0, 0x22cdcbd8}, 0x28) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) (async) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x8080, 0x83) ioctl$FITRIM(r8, 0xc0185879, &(0x7f00000001c0)={0x0, 0x1ffffff, 0xfffffffffffffff6}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000640)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') (async) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r9, &(0x7f0000000600)={0x2020}, 0x2020) r10 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='net/igmp6\x00') readlinkat(r10, &(0x7f0000000100)='./mnt\x00', &(0x7f0000000840)=""/66, 0x42) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000700)={{}, &(0x7f0000000680), &(0x7f00000006c0)}, 0x20) syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) (async) r11 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) fcntl$dupfd(r11, 0x0, r11) (async) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-setsockopt$packet_fanout_data-write$binfmt_misc-connect$pppl2tp-socket$packet-socket$nl_generic-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$ifreq_SIOCGIFINDEX_wireguard-bind$packet-bind$packet-bpf$BPF_BTF_LOAD-ioctl$F2FS_IOC_MOVE_RANGE-ioctl$F2FS_IOC_MOVE_RANGE-openat$selinux_avc_cache_threshold-openat$selinux_avc_cache_threshold-openat-ioctl$FITRIM-openat$binder_debug-syz_open_procfs-syz_open_procfs-read$FUSE-syz_open_procfs-readlinkat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_open_dev$usbfs-syz_open_dev$usbfs detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) write$binfmt_misc(r3, &(0x7f0000000100), 0x6) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00', 0x0}) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) (async) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc4, 0xc4, 0x5, [@struct={0xa, 0x7, 0x0, 0x4, 0x1, 0x100, [{0xe, 0x5, 0x13a}, {0x10, 0x2, 0x4}, {0x6, 0x0, 0x4}, {0x8, 0x1, 0xb9}, {0xd, 0x1, 0x7}, {0x6, 0x0, 0x3}, {0xf, 0x0, 0x6}]}, @const={0x4, 0x0, 0x0, 0xa, 0x2}, @decl_tag={0x4, 0x0, 0x0, 0x11, 0x2, 0x7}, @enum={0xb, 0x1, 0x0, 0x6, 0x4, [{0xb}]}, @decl_tag={0x9, 0x0, 0x0, 0x11, 0x2, 0xffffffffffffffff}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x5, 0xf}}, @restrict={0x7}]}, {0x0, [0x30, 0x5f, 0x30]}}, &(0x7f0000000440)=""/164, 0xe1, 0xa4, 0x0, 0x22cdcbd8}, 0x28) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) (async) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x8080, 0x83) ioctl$FITRIM(r8, 0xc0185879, &(0x7f00000001c0)={0x0, 0x1ffffff, 0xfffffffffffffff6}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000640)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') (async) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r9, &(0x7f0000000600)={0x2020}, 0x2020) r10 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='net/igmp6\x00') readlinkat(r10, &(0x7f0000000100)='./mnt\x00', &(0x7f0000000840)=""/66, 0x42) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000700)={{}, &(0x7f0000000680), &(0x7f00000006c0)}, 0x20) syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) (async) syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-setsockopt$packet_fanout_data-write$binfmt_misc-connect$pppl2tp-socket$packet-socket$nl_generic-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$ifreq_SIOCGIFINDEX_wireguard-bind$packet-bind$packet-bpf$BPF_BTF_LOAD-ioctl$F2FS_IOC_MOVE_RANGE-ioctl$F2FS_IOC_MOVE_RANGE-openat$selinux_avc_cache_threshold-openat$selinux_avc_cache_threshold-openat-ioctl$FITRIM-openat$binder_debug-syz_open_procfs-syz_open_procfs-read$FUSE-syz_open_procfs-readlinkat-bpf$MAP_UPDATE_ELEM_TAIL_CALL-syz_open_dev$usbfs detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) write$binfmt_misc(r3, &(0x7f0000000100), 0x6) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00', 0x0}) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) (async) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc4, 0xc4, 0x5, [@struct={0xa, 0x7, 0x0, 0x4, 0x1, 0x100, [{0xe, 0x5, 0x13a}, {0x10, 0x2, 0x4}, {0x6, 0x0, 0x4}, {0x8, 0x1, 0xb9}, {0xd, 0x1, 0x7}, {0x6, 0x0, 0x3}, {0xf, 0x0, 0x6}]}, @const={0x4, 0x0, 0x0, 0xa, 0x2}, @decl_tag={0x4, 0x0, 0x0, 0x11, 0x2, 0x7}, @enum={0xb, 0x1, 0x0, 0x6, 0x4, [{0xb}]}, @decl_tag={0x9, 0x0, 0x0, 0x11, 0x2, 0xffffffffffffffff}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x5, 0xf}}, @restrict={0x7}]}, {0x0, [0x30, 0x5f, 0x30]}}, &(0x7f0000000440)=""/164, 0xe1, 0xa4, 0x0, 0x22cdcbd8}, 0x28) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) (async) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x8080, 0x83) ioctl$FITRIM(r8, 0xc0185879, &(0x7f00000001c0)={0x0, 0x1ffffff, 0xfffffffffffffff6}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000640)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') (async) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r9, &(0x7f0000000600)={0x2020}, 0x2020) r10 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='net/igmp6\x00') readlinkat(r10, &(0x7f0000000100)='./mnt\x00', &(0x7f0000000840)=""/66, 0x42) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000700)={{}, &(0x7f0000000680), &(0x7f00000006c0)}, 0x20) syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) (async) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-setsockopt$packet_fanout_data-write$binfmt_misc-connect$pppl2tp-socket$packet-socket$nl_generic-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$ifreq_SIOCGIFINDEX_wireguard-bind$packet-bind$packet-bpf$BPF_BTF_LOAD-ioctl$F2FS_IOC_MOVE_RANGE-ioctl$F2FS_IOC_MOVE_RANGE-openat$selinux_avc_cache_threshold-openat$selinux_avc_cache_threshold-openat-ioctl$FITRIM-openat$binder_debug-syz_open_procfs-syz_open_procfs-read$FUSE-syz_open_procfs-readlinkat-bpf$MAP_UPDATE_ELEM_TAIL_CALL detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) write$binfmt_misc(r3, &(0x7f0000000100), 0x6) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00', 0x0}) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) (async) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc4, 0xc4, 0x5, [@struct={0xa, 0x7, 0x0, 0x4, 0x1, 0x100, [{0xe, 0x5, 0x13a}, {0x10, 0x2, 0x4}, {0x6, 0x0, 0x4}, {0x8, 0x1, 0xb9}, {0xd, 0x1, 0x7}, {0x6, 0x0, 0x3}, {0xf, 0x0, 0x6}]}, @const={0x4, 0x0, 0x0, 0xa, 0x2}, @decl_tag={0x4, 0x0, 0x0, 0x11, 0x2, 0x7}, @enum={0xb, 0x1, 0x0, 0x6, 0x4, [{0xb}]}, @decl_tag={0x9, 0x0, 0x0, 0x11, 0x2, 0xffffffffffffffff}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x5, 0xf}}, @restrict={0x7}]}, {0x0, [0x30, 0x5f, 0x30]}}, &(0x7f0000000440)=""/164, 0xe1, 0xa4, 0x0, 0x22cdcbd8}, 0x28) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) (async) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x8080, 0x83) ioctl$FITRIM(r8, 0xc0185879, &(0x7f00000001c0)={0x0, 0x1ffffff, 0xfffffffffffffff6}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000640)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') (async) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r9, &(0x7f0000000600)={0x2020}, 0x2020) r10 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='net/igmp6\x00') readlinkat(r10, &(0x7f0000000100)='./mnt\x00', &(0x7f0000000840)=""/66, 0x42) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000700)={{}, &(0x7f0000000680), &(0x7f00000006c0)}, 0x20) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-setsockopt$packet_fanout_data-write$binfmt_misc-connect$pppl2tp-socket$packet-socket$nl_generic-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$ifreq_SIOCGIFINDEX_wireguard-bind$packet-bind$packet-bpf$BPF_BTF_LOAD-ioctl$F2FS_IOC_MOVE_RANGE-ioctl$F2FS_IOC_MOVE_RANGE-openat$selinux_avc_cache_threshold-openat$selinux_avc_cache_threshold-openat-ioctl$FITRIM-openat$binder_debug-syz_open_procfs-syz_open_procfs-read$FUSE-syz_open_procfs-readlinkat detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) write$binfmt_misc(r3, &(0x7f0000000100), 0x6) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00', 0x0}) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) (async) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc4, 0xc4, 0x5, [@struct={0xa, 0x7, 0x0, 0x4, 0x1, 0x100, [{0xe, 0x5, 0x13a}, {0x10, 0x2, 0x4}, {0x6, 0x0, 0x4}, {0x8, 0x1, 0xb9}, {0xd, 0x1, 0x7}, {0x6, 0x0, 0x3}, {0xf, 0x0, 0x6}]}, @const={0x4, 0x0, 0x0, 0xa, 0x2}, @decl_tag={0x4, 0x0, 0x0, 0x11, 0x2, 0x7}, @enum={0xb, 0x1, 0x0, 0x6, 0x4, [{0xb}]}, @decl_tag={0x9, 0x0, 0x0, 0x11, 0x2, 0xffffffffffffffff}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x5, 0xf}}, @restrict={0x7}]}, {0x0, [0x30, 0x5f, 0x30]}}, &(0x7f0000000440)=""/164, 0xe1, 0xa4, 0x0, 0x22cdcbd8}, 0x28) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) (async) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x8080, 0x83) ioctl$FITRIM(r8, 0xc0185879, &(0x7f00000001c0)={0x0, 0x1ffffff, 0xfffffffffffffff6}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000640)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') (async) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r9, &(0x7f0000000600)={0x2020}, 0x2020) r10 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='net/igmp6\x00') readlinkat(r10, &(0x7f0000000100)='./mnt\x00', &(0x7f0000000840)=""/66, 0x42) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-setsockopt$packet_fanout_data-write$binfmt_misc-connect$pppl2tp-socket$packet-socket$nl_generic-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$ifreq_SIOCGIFINDEX_wireguard-bind$packet-bind$packet-bpf$BPF_BTF_LOAD-ioctl$F2FS_IOC_MOVE_RANGE-ioctl$F2FS_IOC_MOVE_RANGE-openat$selinux_avc_cache_threshold-openat$selinux_avc_cache_threshold-openat-ioctl$FITRIM-openat$binder_debug-syz_open_procfs-syz_open_procfs-read$FUSE-syz_open_procfs detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) write$binfmt_misc(r3, &(0x7f0000000100), 0x6) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00', 0x0}) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) (async) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc4, 0xc4, 0x5, [@struct={0xa, 0x7, 0x0, 0x4, 0x1, 0x100, [{0xe, 0x5, 0x13a}, {0x10, 0x2, 0x4}, {0x6, 0x0, 0x4}, {0x8, 0x1, 0xb9}, {0xd, 0x1, 0x7}, {0x6, 0x0, 0x3}, {0xf, 0x0, 0x6}]}, @const={0x4, 0x0, 0x0, 0xa, 0x2}, @decl_tag={0x4, 0x0, 0x0, 0x11, 0x2, 0x7}, @enum={0xb, 0x1, 0x0, 0x6, 0x4, [{0xb}]}, @decl_tag={0x9, 0x0, 0x0, 0x11, 0x2, 0xffffffffffffffff}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x5, 0xf}}, @restrict={0x7}]}, {0x0, [0x30, 0x5f, 0x30]}}, &(0x7f0000000440)=""/164, 0xe1, 0xa4, 0x0, 0x22cdcbd8}, 0x28) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) (async) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x8080, 0x83) ioctl$FITRIM(r8, 0xc0185879, &(0x7f00000001c0)={0x0, 0x1ffffff, 0xfffffffffffffff6}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000640)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') (async) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r9, &(0x7f0000000600)={0x2020}, 0x2020) syz_open_procfs(0xffffffffffffffff, &(0x7f00000002c0)='net/igmp6\x00') program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-setsockopt$packet_fanout_data-write$binfmt_misc-connect$pppl2tp-socket$packet-socket$nl_generic-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$ifreq_SIOCGIFINDEX_wireguard-bind$packet-bind$packet-bpf$BPF_BTF_LOAD-ioctl$F2FS_IOC_MOVE_RANGE-ioctl$F2FS_IOC_MOVE_RANGE-openat$selinux_avc_cache_threshold-openat$selinux_avc_cache_threshold-openat-ioctl$FITRIM-openat$binder_debug-syz_open_procfs-syz_open_procfs-read$FUSE detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) write$binfmt_misc(r3, &(0x7f0000000100), 0x6) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00', 0x0}) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) (async) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc4, 0xc4, 0x5, [@struct={0xa, 0x7, 0x0, 0x4, 0x1, 0x100, [{0xe, 0x5, 0x13a}, {0x10, 0x2, 0x4}, {0x6, 0x0, 0x4}, {0x8, 0x1, 0xb9}, {0xd, 0x1, 0x7}, {0x6, 0x0, 0x3}, {0xf, 0x0, 0x6}]}, @const={0x4, 0x0, 0x0, 0xa, 0x2}, @decl_tag={0x4, 0x0, 0x0, 0x11, 0x2, 0x7}, @enum={0xb, 0x1, 0x0, 0x6, 0x4, [{0xb}]}, @decl_tag={0x9, 0x0, 0x0, 0x11, 0x2, 0xffffffffffffffff}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x5, 0xf}}, @restrict={0x7}]}, {0x0, [0x30, 0x5f, 0x30]}}, &(0x7f0000000440)=""/164, 0xe1, 0xa4, 0x0, 0x22cdcbd8}, 0x28) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) (async) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x8080, 0x83) ioctl$FITRIM(r8, 0xc0185879, &(0x7f00000001c0)={0x0, 0x1ffffff, 0xfffffffffffffff6}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000640)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') (async) r9 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r9, &(0x7f0000000600)={0x2020}, 0x2020) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-setsockopt$packet_fanout_data-write$binfmt_misc-connect$pppl2tp-socket$packet-socket$nl_generic-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$ifreq_SIOCGIFINDEX_wireguard-bind$packet-bind$packet-bpf$BPF_BTF_LOAD-ioctl$F2FS_IOC_MOVE_RANGE-ioctl$F2FS_IOC_MOVE_RANGE-openat$selinux_avc_cache_threshold-openat$selinux_avc_cache_threshold-openat-ioctl$FITRIM-openat$binder_debug-syz_open_procfs-syz_open_procfs detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) write$binfmt_misc(r3, &(0x7f0000000100), 0x6) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00', 0x0}) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) (async) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc4, 0xc4, 0x5, [@struct={0xa, 0x7, 0x0, 0x4, 0x1, 0x100, [{0xe, 0x5, 0x13a}, {0x10, 0x2, 0x4}, {0x6, 0x0, 0x4}, {0x8, 0x1, 0xb9}, {0xd, 0x1, 0x7}, {0x6, 0x0, 0x3}, {0xf, 0x0, 0x6}]}, @const={0x4, 0x0, 0x0, 0xa, 0x2}, @decl_tag={0x4, 0x0, 0x0, 0x11, 0x2, 0x7}, @enum={0xb, 0x1, 0x0, 0x6, 0x4, [{0xb}]}, @decl_tag={0x9, 0x0, 0x0, 0x11, 0x2, 0xffffffffffffffff}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x5, 0xf}}, @restrict={0x7}]}, {0x0, [0x30, 0x5f, 0x30]}}, &(0x7f0000000440)=""/164, 0xe1, 0xa4, 0x0, 0x22cdcbd8}, 0x28) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) (async) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x8080, 0x83) ioctl$FITRIM(r8, 0xc0185879, &(0x7f00000001c0)={0x0, 0x1ffffff, 0xfffffffffffffff6}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000640)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') (async) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-setsockopt$packet_fanout_data-write$binfmt_misc-connect$pppl2tp-socket$packet-socket$nl_generic-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$ifreq_SIOCGIFINDEX_wireguard-bind$packet-bind$packet-bpf$BPF_BTF_LOAD-ioctl$F2FS_IOC_MOVE_RANGE-ioctl$F2FS_IOC_MOVE_RANGE-openat$selinux_avc_cache_threshold-openat$selinux_avc_cache_threshold-openat-ioctl$FITRIM-openat$binder_debug-syz_open_procfs detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) write$binfmt_misc(r3, &(0x7f0000000100), 0x6) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00', 0x0}) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) (async) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc4, 0xc4, 0x5, [@struct={0xa, 0x7, 0x0, 0x4, 0x1, 0x100, [{0xe, 0x5, 0x13a}, {0x10, 0x2, 0x4}, {0x6, 0x0, 0x4}, {0x8, 0x1, 0xb9}, {0xd, 0x1, 0x7}, {0x6, 0x0, 0x3}, {0xf, 0x0, 0x6}]}, @const={0x4, 0x0, 0x0, 0xa, 0x2}, @decl_tag={0x4, 0x0, 0x0, 0x11, 0x2, 0x7}, @enum={0xb, 0x1, 0x0, 0x6, 0x4, [{0xb}]}, @decl_tag={0x9, 0x0, 0x0, 0x11, 0x2, 0xffffffffffffffff}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x5, 0xf}}, @restrict={0x7}]}, {0x0, [0x30, 0x5f, 0x30]}}, &(0x7f0000000440)=""/164, 0xe1, 0xa4, 0x0, 0x22cdcbd8}, 0x28) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) (async) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x8080, 0x83) ioctl$FITRIM(r8, 0xc0185879, &(0x7f00000001c0)={0x0, 0x1ffffff, 0xfffffffffffffff6}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000640)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') (async) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-setsockopt$packet_fanout_data-write$binfmt_misc-connect$pppl2tp-socket$packet-socket$nl_generic-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$ifreq_SIOCGIFINDEX_wireguard-bind$packet-bind$packet-bpf$BPF_BTF_LOAD-ioctl$F2FS_IOC_MOVE_RANGE-ioctl$F2FS_IOC_MOVE_RANGE-openat$selinux_avc_cache_threshold-openat$selinux_avc_cache_threshold-openat-ioctl$FITRIM-openat$binder_debug detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) write$binfmt_misc(r3, &(0x7f0000000100), 0x6) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00', 0x0}) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) (async) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc4, 0xc4, 0x5, [@struct={0xa, 0x7, 0x0, 0x4, 0x1, 0x100, [{0xe, 0x5, 0x13a}, {0x10, 0x2, 0x4}, {0x6, 0x0, 0x4}, {0x8, 0x1, 0xb9}, {0xd, 0x1, 0x7}, {0x6, 0x0, 0x3}, {0xf, 0x0, 0x6}]}, @const={0x4, 0x0, 0x0, 0xa, 0x2}, @decl_tag={0x4, 0x0, 0x0, 0x11, 0x2, 0x7}, @enum={0xb, 0x1, 0x0, 0x6, 0x4, [{0xb}]}, @decl_tag={0x9, 0x0, 0x0, 0x11, 0x2, 0xffffffffffffffff}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x5, 0xf}}, @restrict={0x7}]}, {0x0, [0x30, 0x5f, 0x30]}}, &(0x7f0000000440)=""/164, 0xe1, 0xa4, 0x0, 0x22cdcbd8}, 0x28) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) (async) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x8080, 0x83) ioctl$FITRIM(r8, 0xc0185879, &(0x7f00000001c0)={0x0, 0x1ffffff, 0xfffffffffffffff6}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000640)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-setsockopt$packet_fanout_data-write$binfmt_misc-connect$pppl2tp-socket$packet-socket$nl_generic-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$ifreq_SIOCGIFINDEX_wireguard-bind$packet-bind$packet-bpf$BPF_BTF_LOAD-ioctl$F2FS_IOC_MOVE_RANGE-ioctl$F2FS_IOC_MOVE_RANGE-openat$selinux_avc_cache_threshold-openat$selinux_avc_cache_threshold-openat-ioctl$FITRIM detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) write$binfmt_misc(r3, &(0x7f0000000100), 0x6) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00', 0x0}) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) (async) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc4, 0xc4, 0x5, [@struct={0xa, 0x7, 0x0, 0x4, 0x1, 0x100, [{0xe, 0x5, 0x13a}, {0x10, 0x2, 0x4}, {0x6, 0x0, 0x4}, {0x8, 0x1, 0xb9}, {0xd, 0x1, 0x7}, {0x6, 0x0, 0x3}, {0xf, 0x0, 0x6}]}, @const={0x4, 0x0, 0x0, 0xa, 0x2}, @decl_tag={0x4, 0x0, 0x0, 0x11, 0x2, 0x7}, @enum={0xb, 0x1, 0x0, 0x6, 0x4, [{0xb}]}, @decl_tag={0x9, 0x0, 0x0, 0x11, 0x2, 0xffffffffffffffff}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x5, 0xf}}, @restrict={0x7}]}, {0x0, [0x30, 0x5f, 0x30]}}, &(0x7f0000000440)=""/164, 0xe1, 0xa4, 0x0, 0x22cdcbd8}, 0x28) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) (async) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x8080, 0x83) ioctl$FITRIM(r8, 0xc0185879, &(0x7f00000001c0)={0x0, 0x1ffffff, 0xfffffffffffffff6}) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-setsockopt$packet_fanout_data-write$binfmt_misc-connect$pppl2tp-socket$packet-socket$nl_generic-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$ifreq_SIOCGIFINDEX_wireguard-bind$packet-bind$packet-bpf$BPF_BTF_LOAD-ioctl$F2FS_IOC_MOVE_RANGE-ioctl$F2FS_IOC_MOVE_RANGE-openat$selinux_avc_cache_threshold-openat$selinux_avc_cache_threshold-openat detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) write$binfmt_misc(r3, &(0x7f0000000100), 0x6) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00', 0x0}) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) (async) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc4, 0xc4, 0x5, [@struct={0xa, 0x7, 0x0, 0x4, 0x1, 0x100, [{0xe, 0x5, 0x13a}, {0x10, 0x2, 0x4}, {0x6, 0x0, 0x4}, {0x8, 0x1, 0xb9}, {0xd, 0x1, 0x7}, {0x6, 0x0, 0x3}, {0xf, 0x0, 0x6}]}, @const={0x4, 0x0, 0x0, 0xa, 0x2}, @decl_tag={0x4, 0x0, 0x0, 0x11, 0x2, 0x7}, @enum={0xb, 0x1, 0x0, 0x6, 0x4, [{0xb}]}, @decl_tag={0x9, 0x0, 0x0, 0x11, 0x2, 0xffffffffffffffff}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x5, 0xf}}, @restrict={0x7}]}, {0x0, [0x30, 0x5f, 0x30]}}, &(0x7f0000000440)=""/164, 0xe1, 0xa4, 0x0, 0x22cdcbd8}, 0x28) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) (async) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x8080, 0x83) program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-setsockopt$packet_fanout_data-write$binfmt_misc-connect$pppl2tp-socket$packet-socket$nl_generic-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$ifreq_SIOCGIFINDEX_wireguard-bind$packet-bind$packet-bpf$BPF_BTF_LOAD-ioctl$F2FS_IOC_MOVE_RANGE-ioctl$F2FS_IOC_MOVE_RANGE-openat$selinux_avc_cache_threshold-openat$selinux_avc_cache_threshold detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) write$binfmt_misc(r3, &(0x7f0000000100), 0x6) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00', 0x0}) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) (async) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc4, 0xc4, 0x5, [@struct={0xa, 0x7, 0x0, 0x4, 0x1, 0x100, [{0xe, 0x5, 0x13a}, {0x10, 0x2, 0x4}, {0x6, 0x0, 0x4}, {0x8, 0x1, 0xb9}, {0xd, 0x1, 0x7}, {0x6, 0x0, 0x3}, {0xf, 0x0, 0x6}]}, @const={0x4, 0x0, 0x0, 0xa, 0x2}, @decl_tag={0x4, 0x0, 0x0, 0x11, 0x2, 0x7}, @enum={0xb, 0x1, 0x0, 0x6, 0x4, [{0xb}]}, @decl_tag={0x9, 0x0, 0x0, 0x11, 0x2, 0xffffffffffffffff}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x5, 0xf}}, @restrict={0x7}]}, {0x0, [0x30, 0x5f, 0x30]}}, &(0x7f0000000440)=""/164, 0xe1, 0xa4, 0x0, 0x22cdcbd8}, 0x28) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) (async) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-setsockopt$packet_fanout_data-write$binfmt_misc-connect$pppl2tp-socket$packet-socket$nl_generic-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$ifreq_SIOCGIFINDEX_wireguard-bind$packet-bind$packet-bpf$BPF_BTF_LOAD-ioctl$F2FS_IOC_MOVE_RANGE-ioctl$F2FS_IOC_MOVE_RANGE-openat$selinux_avc_cache_threshold detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) write$binfmt_misc(r3, &(0x7f0000000100), 0x6) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00', 0x0}) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) (async) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc4, 0xc4, 0x5, [@struct={0xa, 0x7, 0x0, 0x4, 0x1, 0x100, [{0xe, 0x5, 0x13a}, {0x10, 0x2, 0x4}, {0x6, 0x0, 0x4}, {0x8, 0x1, 0xb9}, {0xd, 0x1, 0x7}, {0x6, 0x0, 0x3}, {0xf, 0x0, 0x6}]}, @const={0x4, 0x0, 0x0, 0xa, 0x2}, @decl_tag={0x4, 0x0, 0x0, 0x11, 0x2, 0x7}, @enum={0xb, 0x1, 0x0, 0x6, 0x4, [{0xb}]}, @decl_tag={0x9, 0x0, 0x0, 0x11, 0x2, 0xffffffffffffffff}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x5, 0xf}}, @restrict={0x7}]}, {0x0, [0x30, 0x5f, 0x30]}}, &(0x7f0000000440)=""/164, 0xe1, 0xa4, 0x0, 0x22cdcbd8}, 0x28) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-setsockopt$packet_fanout_data-write$binfmt_misc-connect$pppl2tp-socket$packet-socket$nl_generic-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$ifreq_SIOCGIFINDEX_wireguard-bind$packet-bind$packet-bpf$BPF_BTF_LOAD-ioctl$F2FS_IOC_MOVE_RANGE-ioctl$F2FS_IOC_MOVE_RANGE detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) write$binfmt_misc(r3, &(0x7f0000000100), 0x6) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00', 0x0}) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) (async) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc4, 0xc4, 0x5, [@struct={0xa, 0x7, 0x0, 0x4, 0x1, 0x100, [{0xe, 0x5, 0x13a}, {0x10, 0x2, 0x4}, {0x6, 0x0, 0x4}, {0x8, 0x1, 0xb9}, {0xd, 0x1, 0x7}, {0x6, 0x0, 0x3}, {0xf, 0x0, 0x6}]}, @const={0x4, 0x0, 0x0, 0xa, 0x2}, @decl_tag={0x4, 0x0, 0x0, 0x11, 0x2, 0x7}, @enum={0xb, 0x1, 0x0, 0x6, 0x4, [{0xb}]}, @decl_tag={0x9, 0x0, 0x0, 0x11, 0x2, 0xffffffffffffffff}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x5, 0xf}}, @restrict={0x7}]}, {0x0, [0x30, 0x5f, 0x30]}}, &(0x7f0000000440)=""/164, 0xe1, 0xa4, 0x0, 0x22cdcbd8}, 0x28) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-setsockopt$packet_fanout_data-write$binfmt_misc-connect$pppl2tp-socket$packet-socket$nl_generic-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$ifreq_SIOCGIFINDEX_wireguard-bind$packet-bind$packet-bpf$BPF_BTF_LOAD-ioctl$F2FS_IOC_MOVE_RANGE detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) write$binfmt_misc(r3, &(0x7f0000000100), 0x6) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00', 0x0}) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) (async) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc4, 0xc4, 0x5, [@struct={0xa, 0x7, 0x0, 0x4, 0x1, 0x100, [{0xe, 0x5, 0x13a}, {0x10, 0x2, 0x4}, {0x6, 0x0, 0x4}, {0x8, 0x1, 0xb9}, {0xd, 0x1, 0x7}, {0x6, 0x0, 0x3}, {0xf, 0x0, 0x6}]}, @const={0x4, 0x0, 0x0, 0xa, 0x2}, @decl_tag={0x4, 0x0, 0x0, 0x11, 0x2, 0x7}, @enum={0xb, 0x1, 0x0, 0x6, 0x4, [{0xb}]}, @decl_tag={0x9, 0x0, 0x0, 0x11, 0x2, 0xffffffffffffffff}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x5, 0xf}}, @restrict={0x7}]}, {0x0, [0x30, 0x5f, 0x30]}}, &(0x7f0000000440)=""/164, 0xe1, 0xa4, 0x0, 0x22cdcbd8}, 0x28) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-setsockopt$packet_fanout_data-write$binfmt_misc-connect$pppl2tp-socket$packet-socket$nl_generic-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$ifreq_SIOCGIFINDEX_wireguard-bind$packet-bind$packet-bpf$BPF_BTF_LOAD detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) write$binfmt_misc(r3, &(0x7f0000000100), 0x6) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00', 0x0}) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) (async) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc4, 0xc4, 0x5, [@struct={0xa, 0x7, 0x0, 0x4, 0x1, 0x100, [{0xe, 0x5, 0x13a}, {0x10, 0x2, 0x4}, {0x6, 0x0, 0x4}, {0x8, 0x1, 0xb9}, {0xd, 0x1, 0x7}, {0x6, 0x0, 0x3}, {0xf, 0x0, 0x6}]}, @const={0x4, 0x0, 0x0, 0xa, 0x2}, @decl_tag={0x4, 0x0, 0x0, 0x11, 0x2, 0x7}, @enum={0xb, 0x1, 0x0, 0x6, 0x4, [{0xb}]}, @decl_tag={0x9, 0x0, 0x0, 0x11, 0x2, 0xffffffffffffffff}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x5, 0xf}}, @restrict={0x7}]}, {0x0, [0x30, 0x5f, 0x30]}}, &(0x7f0000000440)=""/164, 0xe1, 0xa4, 0x0, 0x22cdcbd8}, 0x28) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-setsockopt$packet_fanout_data-write$binfmt_misc-connect$pppl2tp-socket$packet-socket$nl_generic-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$ifreq_SIOCGIFINDEX_wireguard-bind$packet-bind$packet-ioctl$F2FS_IOC_MOVE_RANGE detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) write$binfmt_misc(r3, &(0x7f0000000100), 0x6) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00', 0x0}) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) (async) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-setsockopt$packet_fanout_data-write$binfmt_misc-connect$pppl2tp-socket$packet-socket$nl_generic-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$ifreq_SIOCGIFINDEX_wireguard-bind$packet-ioctl$F2FS_IOC_MOVE_RANGE detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) write$binfmt_misc(r3, &(0x7f0000000100), 0x6) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000000200)={'wg2\x00', 0x0}) bind$packet(r5, &(0x7f0000000200)={0x11, 0x5, r7, 0x1, 0x0, 0x6, @random="001122334455"}, 0x14) (async) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-setsockopt$packet_fanout_data-write$binfmt_misc-connect$pppl2tp-socket$packet-socket$nl_generic-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$F2FS_IOC_MOVE_RANGE detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) write$binfmt_misc(r3, &(0x7f0000000100), 0x6) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) socket$packet(0x11, 0x3, 0x300) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r5, 0x8933, &(0x7f0000000200)={'wg2\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r5, 0x8933, &(0x7f0000000200)={'wg2\x00'}) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-setsockopt$packet_fanout_data-write$binfmt_misc-connect$pppl2tp-socket$packet-socket$nl_generic-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$F2FS_IOC_MOVE_RANGE detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) write$binfmt_misc(r3, &(0x7f0000000100), 0x6) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) socket$packet(0x11, 0x3, 0x300) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r5, 0x8933, &(0x7f0000000200)={'wg2\x00'}) (async) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-setsockopt$packet_fanout_data-write$binfmt_misc-connect$pppl2tp-socket$packet-socket$nl_generic-ioctl$F2FS_IOC_MOVE_RANGE detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) write$binfmt_misc(r3, &(0x7f0000000100), 0x6) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) socket$packet(0x11, 0x3, 0x300) socket$nl_generic(0x10, 0x3, 0x10) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-setsockopt$packet_fanout_data-write$binfmt_misc-connect$pppl2tp-socket$packet-ioctl$F2FS_IOC_MOVE_RANGE detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) write$binfmt_misc(r3, &(0x7f0000000100), 0x6) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) socket$packet(0x11, 0x3, 0x300) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-setsockopt$packet_fanout_data-write$binfmt_misc-connect$pppl2tp-ioctl$F2FS_IOC_MOVE_RANGE detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) write$binfmt_misc(r3, &(0x7f0000000100), 0x6) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-setsockopt$packet_fanout_data-write$binfmt_misc-ioctl$F2FS_IOC_MOVE_RANGE detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r2, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r2, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r3, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) setsockopt$packet_fanout_data(r3, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) write$binfmt_misc(r2, &(0x7f0000000100), 0x6) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-setsockopt$packet_fanout_data-connect$pppl2tp-ioctl$F2FS_IOC_MOVE_RANGE detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-setsockopt$packet_fanout_data-connect$pppl2tp-ioctl$F2FS_IOC_MOVE_RANGE detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f00000000c0)=[{0x0, 0x80}, {0x1, 0x1}, {0x0, 0x8, 0x5, 0x7f}]}, 0x10) (async) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-bind$bt_hci-connect$pppl2tp-ioctl$F2FS_IOC_MOVE_RANGE detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-bind$bt_hci-connect$pppl2tp-ioctl$F2FS_IOC_MOVE_RANGE detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) (async) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-bpf$ITER_CREATE-connect$pppl2tp-ioctl$F2FS_IOC_MOVE_RANGE detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x8) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-syz_init_net_socket$bt_hci-connect$pppl2tp-ioctl$F2FS_IOC_MOVE_RANGE detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-socket$inet6_udp-connect$pppl2tp-ioctl$F2FS_IOC_MOVE_RANGE detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$F2FS_IOC_MOVE_RANGE detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$F2FS_IOC_MOVE_RANGE detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-socket$inet6_udp-connect$pppl2tp-ioctl$F2FS_IOC_MOVE_RANGE detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$F2FS_IOC_MOVE_RANGE detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f00000005c0)={r0, 0x0, 0x2, 0x7}) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$F2FS_IOC_MOVE_RANGE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x2, 0x7}) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$F2FS_IOC_MOVE_RANGE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x2, 0x7}) program crashed: lost connection to test machine ignore low priority crash: lost connection to test machine testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$F2FS_IOC_MOVE_RANGE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, 0x0, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0x2, 0x7}) (async) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$F2FS_IOC_MOVE_RANGE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, 0x0) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$F2FS_IOC_MOVE_RANGE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, 0x0) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session extracting C reproducer testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$F2FS_IOC_MOVE_RANGE program crashed: KASAN: use-after-free Write in pppol2tp_release simplifying C reproducer testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$F2FS_IOC_MOVE_RANGE program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$F2FS_IOC_MOVE_RANGE program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$F2FS_IOC_MOVE_RANGE program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$F2FS_IOC_MOVE_RANGE program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$F2FS_IOC_MOVE_RANGE program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$F2FS_IOC_MOVE_RANGE program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$F2FS_IOC_MOVE_RANGE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, 0x0) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session validation run: crashed=true testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$F2FS_IOC_MOVE_RANGE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release validation run: crashed=true testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$F2FS_IOC_MOVE_RANGE detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x3}}, 0x26) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release validation run: crashed=true reproducing took 36m44.353668985s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: use-after-free in atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:1667 [inline] BUG: KASAN: use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:169 [inline] BUG: KASAN: use-after-free in mutex_lock+0x8e/0x1c0 kernel/locking/mutex.c:288 Write of size 8 at addr ffff88811f6e7950 by task syz.2.17/372 CPU: 1 PID: 372 Comm: syz.2.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:88 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:427 [inline] kasan_report+0x10f/0x150 mm/kasan/report.c:444 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:1667 [inline] __mutex_trylock_fast kernel/locking/mutex.c:169 [inline] mutex_lock+0x8e/0x1c0 kernel/locking/mutex.c:288 pppol2tp_release+0x178/0x2b0 net/l2tp/l2tp_ppp.c:442 __sock_release net/socket.c:649 [inline] sock_close+0xb8/0x200 net/socket.c:1336 __fput+0x22b/0x900 fs/file_table.c:311 ____fput+0x15/0x20 fs/file_table.c:339 task_work_run+0x127/0x190 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0xd0/0xe0 kernel/entry/common.c:181 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:307 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f051ee16159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc107407c8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffc107408b0 RCX: 00007f051ee16159 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 000000000000f53b R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b32f20000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f051f09dfac R14: 00007f051f09dfa8 R15: 00007f051f09dfa0 Allocated by task 372: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:433 [inline] ____kasan_kmalloc mm/kasan/common.c:512 [inline] __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:521 kasan_kmalloc include/linux/kasan.h:227 [inline] __kmalloc+0x13d/0x2c0 mm/slub.c:4436 kmalloc include/linux/slab.h:624 [inline] kzalloc include/linux/slab.h:750 [inline] l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772 __sys_connect_file net/socket.c:1923 [inline] __sys_connect+0x3cb/0x450 net/socket.c:1940 __do_sys_connect net/socket.c:1950 [inline] __se_sys_connect net/socket.c:1947 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:1947 x64_sys_call+0x7c/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:43 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 Freed by task 372: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4a/0x70 mm/kasan/common.c:45 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:365 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:373 kasan_slab_free include/linux/kasan.h:193 [inline] slab_free_hook mm/slub.c:1728 [inline] slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1754 slab_free mm/slub.c:3526 [inline] kfree+0xc4/0x270 mm/slub.c:4588 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline] l2tp_session_put+0xaf/0x1a0 net/l2tp/l2tp_core.c:193 l2tp_session_delete+0x3a9/0x4a0 net/l2tp/l2tp_core.c:1589 pppol2tp_release+0x169/0x2b0 net/l2tp/l2tp_ppp.c:439 __sock_release net/socket.c:649 [inline] sock_close+0xb8/0x200 net/socket.c:1336 __fput+0x22b/0x900 fs/file_table.c:311 ____fput+0x15/0x20 fs/file_table.c:339 task_work_run+0x127/0x190 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0xd0/0xe0 kernel/entry/common.c:181 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:307 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 The buggy address belongs to the object at ffff88811f6e7800 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 336 bytes inside of 512-byte region [ffff88811f6e7800, ffff88811f6e7a00) The buggy address belongs to the page: page:ffffea00047db900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11f6e4 head:ffffea00047db900 order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head|zone=1) raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 368, ts 62795473978, free_ts 62137355869 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x192/0x1b0 mm/page_alloc.c:2607 prep_new_page+0x1c/0x110 mm/page_alloc.c:2613 get_page_from_freelist+0x2c3a/0x2cd0 mm/page_alloc.c:4487 __alloc_pages+0x1a2/0x460 mm/page_alloc.c:5824 alloc_slab_page mm/slub.c:-1 [inline] allocate_slab mm/slub.c:1937 [inline] new_slab+0xa0/0x4d0 mm/slub.c:2000 ___slab_alloc+0x3ac/0x840 mm/slub.c:3033 __slab_alloc+0x49/0x90 mm/slub.c:3120 slab_alloc_node mm/slub.c:3211 [inline] slab_alloc mm/slub.c:3255 [inline] __kmalloc_track_caller+0x169/0x2c0 mm/slub.c:4954 kmalloc_reserve net/core/skbuff.c:357 [inline] __alloc_skb+0x210/0x730 net/core/skbuff.c:428 alloc_skb include/linux/skbuff.h:1183 [inline] nlmsg_new include/net/netlink.h:953 [inline] inet6_ifa_notify net/ipv6/addrconf.c:5543 [inline] __ipv6_ifa_notify+0x200/0xe70 net/ipv6/addrconf.c:6198 ipv6_ifa_notify net/ipv6/addrconf.c:6250 [inline] inet6_addr_add+0x631/0x9d0 net/ipv6/addrconf.c:3037 inet6_rtm_newaddr+0x6e7/0x9c0 net/ipv6/addrconf.c:4978 rtnetlink_rcv_msg+0x9fd/0xcb0 net/core/rtnetlink.c:5662 netlink_rcv_skb+0x1e9/0x430 net/netlink/af_netlink.c:2516 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:5680 netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline] netlink_unicast+0x86c/0xa30 net/netlink/af_netlink.c:1348 page last free stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] free_pages_prepare mm/page_alloc.c:1474 [inline] free_pcp_prepare mm/page_alloc.c:1546 [inline] free_unref_page_prepare+0x5fa/0x600 mm/page_alloc.c:3536 free_unref_page+0xae/0x540 mm/page_alloc.c:3618 free_the_page mm/page_alloc.c:805 [inline] __free_pages+0x6c/0x100 mm/page_alloc.c:5900 __vunmap+0x801/0x980 mm/vmalloc.c:2660 __vfree mm/vmalloc.c:2709 [inline] vfree+0x8b/0xc0 mm/vmalloc.c:2740 kcov_put kernel/kcov.c:417 [inline] kcov_close+0x2b/0x50 kernel/kcov.c:519 __fput+0x22b/0x900 fs/file_table.c:311 ____fput+0x15/0x20 fs/file_table.c:339 task_work_run+0x127/0x190 kernel/task_work.c:188 exit_task_work include/linux/task_work.h:33 [inline] do_exit+0xb70/0x29a0 kernel/exit.c:890 do_group_exit+0x149/0x310 kernel/exit.c:1004 get_signal+0x64f/0x1430 kernel/signal.c:2908 arch_do_signal_or_restart+0xe2/0x1100 arch/x86/kernel/signal.c:867 handle_signal_work kernel/entry/common.c:154 [inline] exit_to_user_mode_loop+0xa7/0xe0 kernel/entry/common.c:178 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:307 Memory state around the buggy address: ffff88811f6e7800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88811f6e7880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88811f6e7900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88811f6e7980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88811f6e7a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: use-after-free in atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:1667 [inline] BUG: KASAN: use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:169 [inline] BUG: KASAN: use-after-free in mutex_lock+0x8e/0x1c0 kernel/locking/mutex.c:288 Write of size 8 at addr ffff88811f6e7950 by task syz.2.17/372 CPU: 1 PID: 372 Comm: syz.2.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:88 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:427 [inline] kasan_report+0x10f/0x150 mm/kasan/report.c:444 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:1667 [inline] __mutex_trylock_fast kernel/locking/mutex.c:169 [inline] mutex_lock+0x8e/0x1c0 kernel/locking/mutex.c:288 pppol2tp_release+0x178/0x2b0 net/l2tp/l2tp_ppp.c:442 __sock_release net/socket.c:649 [inline] sock_close+0xb8/0x200 net/socket.c:1336 __fput+0x22b/0x900 fs/file_table.c:311 ____fput+0x15/0x20 fs/file_table.c:339 task_work_run+0x127/0x190 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0xd0/0xe0 kernel/entry/common.c:181 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:307 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f051ee16159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc107407c8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffc107408b0 RCX: 00007f051ee16159 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 000000000000f53b R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b32f20000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f051f09dfac R14: 00007f051f09dfa8 R15: 00007f051f09dfa0 Allocated by task 372: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:433 [inline] ____kasan_kmalloc mm/kasan/common.c:512 [inline] __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:521 kasan_kmalloc include/linux/kasan.h:227 [inline] __kmalloc+0x13d/0x2c0 mm/slub.c:4436 kmalloc include/linux/slab.h:624 [inline] kzalloc include/linux/slab.h:750 [inline] l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772 __sys_connect_file net/socket.c:1923 [inline] __sys_connect+0x3cb/0x450 net/socket.c:1940 __do_sys_connect net/socket.c:1950 [inline] __se_sys_connect net/socket.c:1947 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:1947 x64_sys_call+0x7c/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:43 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 Freed by task 372: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4a/0x70 mm/kasan/common.c:45 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:365 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:373 kasan_slab_free include/linux/kasan.h:193 [inline] slab_free_hook mm/slub.c:1728 [inline] slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1754 slab_free mm/slub.c:3526 [inline] kfree+0xc4/0x270 mm/slub.c:4588 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline] l2tp_session_put+0xaf/0x1a0 net/l2tp/l2tp_core.c:193 l2tp_session_delete+0x3a9/0x4a0 net/l2tp/l2tp_core.c:1589 pppol2tp_release+0x169/0x2b0 net/l2tp/l2tp_ppp.c:439 __sock_release net/socket.c:649 [inline] sock_close+0xb8/0x200 net/socket.c:1336 __fput+0x22b/0x900 fs/file_table.c:311 ____fput+0x15/0x20 fs/file_table.c:339 task_work_run+0x127/0x190 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0xd0/0xe0 kernel/entry/common.c:181 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:307 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 The buggy address belongs to the object at ffff88811f6e7800 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 336 bytes inside of 512-byte region [ffff88811f6e7800, ffff88811f6e7a00) The buggy address belongs to the page: page:ffffea00047db900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11f6e4 head:ffffea00047db900 order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head|zone=1) raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 368, ts 62795473978, free_ts 62137355869 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x192/0x1b0 mm/page_alloc.c:2607 prep_new_page+0x1c/0x110 mm/page_alloc.c:2613 get_page_from_freelist+0x2c3a/0x2cd0 mm/page_alloc.c:4487 __alloc_pages+0x1a2/0x460 mm/page_alloc.c:5824 alloc_slab_page mm/slub.c:-1 [inline] allocate_slab mm/slub.c:1937 [inline] new_slab+0xa0/0x4d0 mm/slub.c:2000 ___slab_alloc+0x3ac/0x840 mm/slub.c:3033 __slab_alloc+0x49/0x90 mm/slub.c:3120 slab_alloc_node mm/slub.c:3211 [inline] slab_alloc mm/slub.c:3255 [inline] __kmalloc_track_caller+0x169/0x2c0 mm/slub.c:4954 kmalloc_reserve net/core/skbuff.c:357 [inline] __alloc_skb+0x210/0x730 net/core/skbuff.c:428 alloc_skb include/linux/skbuff.h:1183 [inline] nlmsg_new include/net/netlink.h:953 [inline] inet6_ifa_notify net/ipv6/addrconf.c:5543 [inline] __ipv6_ifa_notify+0x200/0xe70 net/ipv6/addrconf.c:6198 ipv6_ifa_notify net/ipv6/addrconf.c:6250 [inline] inet6_addr_add+0x631/0x9d0 net/ipv6/addrconf.c:3037 inet6_rtm_newaddr+0x6e7/0x9c0 net/ipv6/addrconf.c:4978 rtnetlink_rcv_msg+0x9fd/0xcb0 net/core/rtnetlink.c:5662 netlink_rcv_skb+0x1e9/0x430 net/netlink/af_netlink.c:2516 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:5680 netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline] netlink_unicast+0x86c/0xa30 net/netlink/af_netlink.c:1348 page last free stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] free_pages_prepare mm/page_alloc.c:1474 [inline] free_pcp_prepare mm/page_alloc.c:1546 [inline] free_unref_page_prepare+0x5fa/0x600 mm/page_alloc.c:3536 free_unref_page+0xae/0x540 mm/page_alloc.c:3618 free_the_page mm/page_alloc.c:805 [inline] __free_pages+0x6c/0x100 mm/page_alloc.c:5900 __vunmap+0x801/0x980 mm/vmalloc.c:2660 __vfree mm/vmalloc.c:2709 [inline] vfree+0x8b/0xc0 mm/vmalloc.c:2740 kcov_put kernel/kcov.c:417 [inline] kcov_close+0x2b/0x50 kernel/kcov.c:519 __fput+0x22b/0x900 fs/file_table.c:311 ____fput+0x15/0x20 fs/file_table.c:339 task_work_run+0x127/0x190 kernel/task_work.c:188 exit_task_work include/linux/task_work.h:33 [inline] do_exit+0xb70/0x29a0 kernel/exit.c:890 do_group_exit+0x149/0x310 kernel/exit.c:1004 get_signal+0x64f/0x1430 kernel/signal.c:2908 arch_do_signal_or_restart+0xe2/0x1100 arch/x86/kernel/signal.c:867 handle_signal_work kernel/entry/common.c:154 [inline] exit_to_user_mode_loop+0xa7/0xe0 kernel/entry/common.c:178 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:307 Memory state around the buggy address: ffff88811f6e7800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88811f6e7880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88811f6e7900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88811f6e7980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88811f6e7a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================