Extracting prog: 3m6.345447336s Minimizing prog: 19m50.130486701s Simplifying prog options: 0s Extracting C: 36.893368472s Simplifying C: 2m51.507188422s extracting reproducer from 37 programs testing a last program of every proc single: executing 7 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-capset-socket$inet_udp-ioctl$sock_inet_SIOCADDRT-socket$nl_generic-syz_genetlink_get_family_id$nl80211-socket$inet_udp-setsockopt$IPT_SO_SET_REPLACE-socket$nl_route-syz_emit_ethernet-sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL-ioctl$KVM_CREATE_VCPU-ioctl$KVM_RUN-ioctl$KVM_CREATE_VCPU-ioctl$KVM_GET_TSC_KHZ_cpu detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) capset(&(0x7f0000000000)={0x20071026}, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(r2, 0x89a0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r3) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f00000019c0)=@raw={'raw\x00', 0x9, 0x3, 0x1e8, 0x0, 0xffffffff, 0xffffffff, 0xb8, 0xffffffff, 0xb8, 0xffffffff, 0xffffffff, 0x150, 0xffffffff, 0x3, 0x0, {[{{@ip={@loopback, @loopback, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x6}, 0x0, 0x70, 0xb8}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'pptp\x00'}}}, {{@ip={@empty, @empty}, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x248) socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000140)={@local, @broadcast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x8, 0x5a54}}}}}}, 0x0) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)={0x14, r4, 0x9c3fa077fa966179, 0x1f, 0x0, {{0x7e}, {@void, @void}}}, 0x14}}, 0x4000054) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_GET_TSC_KHZ_cpu(r7, 0xaea3) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): recvmmsg-signalfd4-prlimit64-syz_mount_image$ext4-sched_setscheduler-getpid-sched_setaffinity-sched_setscheduler-rt_sigprocmask-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sendmsg$nl_route-bpf$PROG_LOAD detailed listing: executing program 0: recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x80800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000000)='./file1\x00', 0xc248, &(0x7f0000000080)={[{@nodelalloc}, {@init_itable_val={'init_itable', 0x3d, 0x2cd}}, {@init_itable}]}, 0x81, 0x60a, &(0x7f0000000a80)="$eJzs3c9rXNUeAPDvvZPJjzavaR+Px2t5YsBFC9I0qcWqq7Yu7KJgQRciLhqapIZOf9CkYGvBFFwoKIi4FenGP0O6dyeCuvMfqCIVFyoZuTN32ulkZjqkmZk09/OBmTnn3Ns555ubM+fcOzm9ARTWdPaURuyPiHNJxFTTtsmob5zO97v/263z2SOJavWNX5NI8rLG/uv56+7sKYkYj4jvTkX8u7Sx3pUbNy/OV6p1H0QcWb109cjKjZuHly/NX1i8sHh57uhLx47Pvjx3bG5L4mzEdfrM6///9MN3X1z6vnI4iRPxZvn9hWiJY6tMx3Ss5yFm+WpSLx+JiONZos3P5WmzA0IotFL++1iOiP/GVJRqubqpWP5kqI0D+qpaiqgCBZXo/1BQjXlA49y+9Tx4bCizksG5d7J+ArQx/pH6tZEYr50b7bqfNJ0Z1a9t7N2C+rM6/r514MvsER2uQ4xsQT2drN2ux7Ix/qTWtr21rVn86SPn+mlEzEbEaNa+PRGvPkEbmq+R9OM6TDdZ/PG/3uJvPg5Z/Cfy16z81Cbrn27JDzp+AIrp7sl8IF/Lcg/Hv2w0bsx/os38Z7LN2LUZwx7/7p088aDeR8f/xng/Xpv3pC3zsCQizrZ/y3Jrwc8fn/68U/3N87/skdXfmAsOwr3bEQda5r8fZcHm858s/qTN8c92OddjHa/98MvpTtuGHX/1TsTBDvPfhizV5fvJI0vLlcXZ+nPbOr759p2vO9XfGn95CMd/V5f5f6fjn5Vd7bWSs3cuddo02f34P9KXRvPX9+ZXV6/NRYwmZ+oFaVP50e5NaezTeI8s/kPPte//3eKfaHxk9uDqWxfvd9r2hL//69Ued+wki39hk8f/s/zn8Dh/vH39mU7busXfy3sDAAAAAAAAD6W172CTdOZBOk1nZupreP8Tu9LKlZXV55euXL+8EHGo9veQ5bTxTfdUPZ9k+bn872Eb+aMt+RciYl9EfFGaqOVnzl+pLAw7eAAAAAAAAAAAAAAAAAAAANgmdufr/9er1fGIqP5eqq//BwqinzeYA7Y3/R+Kq9b/02G3AhgG4z8UV5v+XxpGO4DBM/5Dcen/UFz6PxTXSId0jbvww45m/Ifi0v8BAAAAYEfa9+zdn5KIWHtlovbIjObbykNtGdBv+jgUl3U+UFwPvvrvbfm/jwvYQXqa//9ZHYuIajXG+t8gYOCSdoW1yUE11+Ef3m37LwEAAAAAAAAAAACAPji43/p/KCp3/YXieoIFvdYCw1POf/0PxeUcH3jcKv7xThus/wcAAAAAAAAAAACAgZmsPZJ0Jl8LPBlpOjMT8a+I2BvlZGm5sjgbEXsi4sdSeSzLzw270QAAAAAAAAAAAAAAAAAAALDDrNy4eXG+Ulm81pz4a0PJzk407oK6XdrTnIhk8JVORMR2iH2TibT7PiNNJUnEWnbkh97meiIev89kRPSj9rHWkiF/MAEAAAAAAAAAAAAAAAAAQAE1rT1u78BXA24RAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAzew/v/9y8x7BgBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgKfTPwEAAP//T2g41A==") sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) rt_sigprocmask(0x6, &(0x7f00000002c0)={[0x6]}, 0x0, 0x8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x20, 0x10, 0x403, 0xfffffffc}, 0x20}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000940)=ANY=[@ANYBLOB="b4050000200080066110000000000000c6000000000000009500d800000018009f33ef60916e55893f1eeb0b2ae13d922e6235592ce847e2566c43d72918a897323fd0723043c47c896ce0bce66a245ad9d6817fd98cd824498949714ffaac8a6f77ef0000ca5d82054d54d53cd2b6db714e75d9bdae214fa68a0557eb2c5ca683a4b6fcfcff0bffffffffffd47042eaebfa6fa26fa7a347c7faa8e700458c60897d4a6148a1c11428427c40de60beacf871ab5c2ff88a02084e5b5271e45f00003826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174ebd9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632f7a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffabe90ac5d08dd9d4e0359c41cf3626e1230bc1cd4c02c460ceb44276e9bd94d1c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd00000000000fbf940e6652d357474ed5f816f66ac3027460ae66317f83cdd7a7eb2a7003d1a6cf5478533584961c329fcf5a43e05c92bfef0dcd28000000003f2915a3039c9a78f63b8ec7e60a0000fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc5117c024185a062acb6b8eec31c21b3af8b9eedb4660ed2deb7acf2a33a376a5cb7d4266d5b0be14488d14b473502486ad8dd600000000000000000000c7766ea7c581782c0d90f42a85303835fc291c25d29e6bead5d7360f2e1929d7736ebc8558c4506407d3046022bdf25485bd5442169e9b4c1278343581b7a06f65e8ea6b042c4fd08381e5000000000000006398d6480000001a723b91030000006480304c66b217aea0156ce9eef911fe5b7370f79987303ecb3aabc53c60014a0101ab766754f596b41da9534d12b8306a1b36cf3b03f0d790879f523eabfbee83d8bd472ef69660cf6ec897106c51e54a17497f384c4956b41f3843e7c878b1e11316d8ddae1c6c3b85aaf7a9fcaf8f5d6186c42542d68ba72682c938d3c0a2e6e10eed71b1d31c9f300b41745329bf34495c63e43fb896e4903fb0fae54a8f0fe3b48a5b29d279070647e65097c8ecf32a15080000000000000001007ba4a70a084bd994ac5e00000000000000000000000000351a30cd97f83d72631d0fe92efa974a53f4dc1eb9a86df632a6d463688123f64d42a919bcfc44a90ffd680200000091f842a91c977f6075d07e39e669b0713af0498a99bf5261cb3269d499a5202d7a08b33ade7b38829b9bd39619688d5e9af22170ef83e5b92cbb32b655c45de1c154aad81bf64351668a3f76d5afa958aff76249e0ffdf8e45155536a1a44bfcbfbfd232af000052f9002a"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_emit_ethernet-socket$inet6_udp-sendmmsg$inet6-mount$bind-syz_mount_image$ext4-openat-mmap-syz_open_dev$tty20-ioctl$TIOCSTI-syz_open_procfs-syz_open_procfs-mount$9p_fd-ioctl$TCSETSW2-syz_open_procfs-madvise-lseek-ioctl$FS_IOC_SETFLAGS-bind$vsock_stream-socket-socket$unix-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-syz_genetlink_get_family_id$SEG6-ioctl$BLKTRACESETUP-getpgid-openat$tun-write$tun detailed listing: executing program 0: syz_emit_ethernet(0x82, &(0x7f0000000080)={@local, @local, @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, '\x00', 0x4c, 0x2f, 0x0, @remote, @ipv4={'\x00', '\xff\xff', @private=0xffffffff}, {[], {{0x0, 0x0, 0x1, 0x0, 0x2, 0x1, 0x0, 0x1, 0x880b, 0x0, 0x0, [0xfffe, 0x1]}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, [0x4, 0xc53]}, {}, {0x8, 0x88be, 0xffffffff, {{}, 0x1, {0x400}}}, {0x8, 0x22eb, 0x0, {{}, 0x2, {0x1}}}, {0x8, 0x6558, 0xfffffffd}}}}}}}, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet6(r0, &(0x7f0000003500)=[{{&(0x7f0000000040)={0xa, 0x4e24, 0xd6, @loopback}, 0x1c, 0x0}}, {{&(0x7f0000000340)={0xa, 0x4e24, 0x0, @local}, 0x1c, 0x0, 0x0, &(0x7f00000004c0)=ANY=[], 0x18}}, {{&(0x7f00000000c0)={0xa, 0x4e23, 0x1, @private2, 0x5}, 0x1c, &(0x7f0000001600)=[{&(0x7f00000005c0)="db6e0713e15dbcf79d7d673fbb05c2c06f59d36799025026f5d0e6ac390b831e485cf3ba5b4239356852778d7c0913688ae5b817a6773c920d9fa10d1c1b2f3f91dc81991a977f0bdd3facc8709ea75161fad3c8516b40345379e84a1af89c62104dec3398e75fc8aefa766cea3ac8bdf31e93e566660c9f38c48b691109ae591dc2fe664f5284a567a26171f7209d58b9b6b0375c35285ef276690003a2b5193091eb437f5cdd912957a588d621c951bded52b3273e792b40bf0c5bacc50fa35a14fc6b9d9f49854c66390afd8da3325604d72ab0d54c63da1eaf531d83466f6e79663258e0cb6077562b55cd80a839f88970777ae45ca55b08301a0778349e8e45aa19e055b82f61cae6cb601a3b3c5c5dabee9a00694ebd5bb11da7cc1e216dc151cbb83fc975de3731ac67f2b8f14f3a63443bf942a92c9090ffb3f81eee13d6bcda4effa5c1b9650e4453c45b023891dccba352e5121a8b3984d6e4d1f8bec3e340376a81df9040f56381a595178ed4fceb426259870784eea9d9a3e7b6dee717e8f924a77032acdeaa10a5ced6ecc7d2c4072d580b256646e834fad7db2072ea076a774a3fa569a5020d10597ac667dfe28532ba814f636e9e1fdb162c38c2d0c11e25b6274c97c3a237e37c9fd5d08b6c13dafe034c51f0f77e77ef564553c739a9c16b5c09f929179c8286e4b4f831ef9f739558ec98549335449db558ec8635cb179f571c23d015d2cc0d425572228de7511ae5a0e31a7666c176fe5eb16d84682b6bbb3b39dc36e266f0b391d015dd40c0c0675f023f1329fc9d1ced2d70af7a04ba6c6cd1b558ec5497d4857270d59672d83c61bb7908dae87f37703fa4bd28604a828f82cbf58999a44051912a7d43889177af77ed2e6e05c3de74818e582e7b97c2d97e126ab3ed0c729c97febd5f36b6b50fd3bafbc540e560b26e60ed5c8739354ad12fb687dc4b38d6f43b3c72aaac9eb98db3bffaa9726ac8b39a77cae4fa687cc5d059d9e898094bcba837272bc4eeebd801d5ace53d9a62d336dabf978066a6adc3e8181ccfa80df68b236fd21f5dd273fa2db9519bb7769f3bb04c7d05bfb091212bb5fe965ba3ab9fad744442e017287f7cdae170675652ddbf2c31d6664bd9ed17030af4cc0236db1d59b48f45d9ea8cf9ba29d55f2cf7036dbd0c2037bd8b570c94d23596a65da4ea94d6a916759cecbdd021f3251a308b502b4fa139064786d9221525db941c2e3ebe92ae07de419f72c1a7ba1102a35de2bc0dfd70aee123542127f61318d7c6ca527125c3526a7ec662d1dc204859714dbc05f76f1b1e170ebf21421df18e390440419953c18456059a58d40afbba3572a7f48a3ddfaef1346590c1013ec49fdcd9236b01ed6a6faafdc09f77f162b3a25bcf9bf69bca83117a7abc296134983e0818a2a5ccec96f8e2eff7f01bf7fef69ab911c5c67875073d13cc621e5682c1e306fe54231f304106cb2bce1d746dbed32a6c8f78dbcbb66056814538e2bff09a2b3422b83cd16c8ff2603a20c96f85dfc511993f0201287c410d8a575de7a3e153650dd0111e8d5132888e822c937002332ec53a45b1be89dd6349983cbd73a14535411d20bded9b9813838c02a1966a294de941ba7881d8b15a4ce218819ea27d745d72eef54d50be44e341888740cf0cdd919408c26a1bf9a66292b82e08bf9542582a9527f2f73f58b35d954c62658ac329d68c79e09f3e99269c263778fb386b3ab4ccdd6039296e3583cd1dcd5870e64580ffd4229809323c0ef01f13d81185aaca55c548515fda6e97c221f4c5414eed77fca21dd42e27cee5573471a14758cb537a3870b1b07d9415b9cd4ca5de6e7b1af379092a9ed57799c6ab94e99719586779b0779c9ef1e3196fbd7e881a92dad07c25e9885e9b6e31aceddf57ff23e40c3930ba7a17f8842a930e3320e612169ef23cd48be78d2b3a22da07b5451446eeb9c28b9ff945b99b76fceaa578ac801a0b38c1f7906516b9681ffa4bf96f27d4ceb332aaae118744e6863faac3b431e8cafa8a1f8654eb40e6731b177823522e81c5938b0e1fc0921e09595860cf48a0b16e49071c1aedd08bd40bf51492a16a75fe3a8759509ccaf909f486f8a91a1bd721fe88303c870d49976f3f7d3438affec637f474297b95803ddc19d081a1c9e164856a947dccfdd1c762365f950f71cd023c76a93823881acadb652b84377944af9d0172b2bb59b495a77011df5be58a9e76c9c916c6d94d680664858eb422ea8b2bf258c75318b2adc6962ac05fc7667407d87f4fb7662fa2889869c4ea5d82416ecd477a17daac54f1391f3b3535cf33429fb7b6ab9fa7e1ad3221d48d21ba7022e2203f7d9c5a679716da9b64bdeb77c7b458cb86e029edffc05c92ae29d5f72f74b83968e42b8967920fd1844307574cbca715d717d456754f463e5d98df3f4e71ef57b8fc4f92ab9f8da2ed695e9e0ae21b9fa7f071213e3542fed35ce2f6d7ece2a632b44b97ac71fa561c08112572bdcd147e0f9489667c1d0fc9407169e1319ad6bc34c489fd725b29ab36f0d35bc4c347da614a332decf9886b9beaada17b0fcfd549c093c514d165380357a5e9c670a835897682ed185656605bbaad3680fc0524b6f9604018ea30580ae833dd8acdc75f1639a67308e418375b69844936004e340e9aa043cff134176495f3f31f4bdb8fd0a8f9facfa89a5529afd85ee1742f4f714a3ccb454b793c07d1320dc1d30459ec59d9efb2a8b56be0e2d500264fc6fc33cd0844fee3409fe85a9071476c3c63fcf25fa94ea425707680dbe33449d34ff9f1db0bba638c2d175a6bde48b6a9f32ef93a37244b0dbcf8a11f969b4832590f0f6c6c38a469d2a11015a186fd6aea193a8a426f252c3ee6039b45f812b8546483afa1df9f703d4a0605f5ef505a68da3e1ee15d41a3c95ca53adb77deb01765365628417e9bf2e19a2535faccac9acf53b419bdbdec811025562d1903f7b57f20e5c26b4c8f065e21f1a1abaa789ba5f3d67910998bf93a6e6d9e720899c530dd9cdcd39ef489055da5faf26f23d64ed875066f5328ae5c1333f466d1063444654f6a0baf0380e0c825a227f83b089cda51a150d3ff9c2692fc256589261c0b9a1f701a72077cd155eaad8076072c2cd556a1adc2cd9d212ac85eb8c183171051e498c989da5b3faac27b9beaf573f6da9f0e2d8ff1ade8877d4dff8833454d96905011bfb0cba87069d4ef66ce1283fc0f2cc9cb5393a799408959bf664e15a2a21c5241aa6f463d5057ed0de9d028baf9ffe71efd081c895576e4470957b76ce9bd6eff2e0c28fbb01cf71785a08987748b6b3f52f7d5d7721218a0ff60e567ff261413daf593359713fb2d82074a098762df7a15d077c702223c8166ac5f2ef148d53a44c2ea0ec93161b9e2fb0f640a88d65b0a9074b3fe210ac2446d97e19d8ad8d58c2c0502fcfa640e078fabc65367c1620f5f3a8dffa69f2d1cf102fd1a698b802c0a845a7087f22de83c56b20e285432aa63e5569e21adceaa15c7cd192592e1da3133141de7a9945153bf0a4bb44163df040a1708a4f0ca3a66be32a5e45aa7cbf87f1b953e2103e1209f278542f8c72a91ae7d709023b56301e08b400d0f096a3cee370b87f596236341744cf0c177b121ef212184a1c05de2c104c6b363734c156387689d2c8d3b3851f1a30d087cbc27ae48924b64297194b0f5f4ad30d511f407ea79f80f828b189b6fa96f4c4052c0f82e7a8f25b382e68afaaa670250b75fd67cbdf27297ea41ea7d104e8a7903a16725ea411012d14831658c4b07724eeb2a99e8f9edb65c14c04cfb5b48c4569d515c2f16fd5bc486b09188bfb451686e802b2faa5017c9c1e5d8772b02177a6778f1f8e2908cf2191af28fe1c649bcafc08b509090d1a5f9ed3cd38979bb903745660884b9b0c995b90f74576445e3bfcc30ba309c2bd3d6400fd4f6b85a43f28b7c40fac7481fedbabe97a0b40043fce6992bf0062be28fd7362dedd0dda78b66b795c44979ad34b4260d157a9cd3f0ccb29dbc6f963353bd6113f4435421349de1d5672660d289cee142b5ccb9486597181c81b1333cf491bf21bd788469b98d4774d2b876d1a0ba3d8cfbb0f6b098fe4886679d0f83aba083f99185ff59d4e92cf3a13a7cefa2add43a7e4eb9862c9d1741e15996b35ad0a6f1f78b5a6a24c29dab019aec16427bbf720f6f22b9ead2e8702a437f630f9038f36839ca21e036824d6b2cb7c428f0d6214c6547d9647542235a9c7387027d257a653cd0d93062bfad5b52d53e3cda8bc7ac5e05e8953941606d93c040745c0d7736b974a41d4dcbd7595eb91cd5d35b795f76e564c84cfb043228b08576a0c8e7ecd25f63295284bad9beb040a95cf15bbfcfaa0fdaa0849e3f589bcd6d3fffda4e795aa0de08d5578d86a9fdf18663456d9b0e4ca04f321ff66b088071b053243b7cf74af6e308a8403714341c80d1cd31c7e2c057f198cf6a69dcd91215062e4e736118a0ba1fcd2828faf145b067375c05d114bc5b51ca1f2e75b4409451e243fb0be034742f62a60bca2b644fc45321cd9c4e720f3c96bb832504b2b1242ebe4fc1e2b2184d7896dec566ed093a9ff5b8f129f85df375c00316f8afa50025abc569e940895f83346c6dbcb9680a7182d88bbb04ca4bb99a11afe9fe88d5e60f70b5a239f269585ec95747f006e5cc2b8722e224497c762871277b02ae4a877b76f04cdcba45de94be1bca9f682faaad358e0e24b5a3144baa63a92ee6307ad57b5fe25441a90858ef2131867cb4573e935d196d0ec205f4b859803e015a59fec7df00d71c8f2ce73f8bf53b3047f4d93bc0f3308f0ef8ae6b1aa40c53adbf9d0f6e6e260e865c19e417118d39231ca8ea4651e45357db3dbf5c4eafa6c35b7ab02606b19d31b9f08000fe8222d607affd4370784c90b014d947bebc247182cba63656dcb9830e4f3254c6bff03e20dfb5005ae1fa9fb516a56171067102cc24f511c513245094af3cf2b8a683e07f74644b958658cb40dcca1fc88c5f5a02fcdc42af7ea1764c548728f164befbe555312a9f752262949bde2c67d729f94d06f5a80219a696e8a2df354f6cd9cf97edc35055c11edd9f7a07461e48c5e395e67e0fbf71e462fe6720e8a084b9addcd9db63f51c96a1169b182f968d94f3ea10b2387b6738e61c63aed52f549a7abacfe32ba74dd320c25598c40195041733c6389fe946b44ae7b75fabc301fdaf6d8f481e490eabadc6b5b4b184518d137195038b2459baabe462e6bd4dd512ec31f689fdc655e4bd2725f80072aed6461183a6473a5380f5d0e8290e643e8ef1a34aae668d477589ed782c0c67dcc61e8c9340cea01400c8c7de1197a7216ea85fd1f60ace2165ee6fc324f1334cf766247b7f458009b5bb724ca7f6831851b27ccf992bb4bfba3732cf7a8cdaa389edb9341714dcb8c39bf87361441a7011c8ef06f71fa15f0d1b56ecb9d8e4f56dfe7a5c56ac91de21a2110be7c3ff865236656d7239138abc9efd0f170ae7285aa0bc4d8e7e9de785eeffdff360209c72601f7133955cc4e4af0e8e8b2ad7dd9e21f631c02f086292b1b58170626469c4aec5695547c49ee9c995911b09d9aa317784e8ee2a728ab7b305b5d7e5380105e45205f21cf8331cbfa09dbb67fb4f306beaf9d68ad5e3e510a566b0ed3ca3f6ca1f4d449a78c96179a33b02ce1ab7eb4d8eb2b81c8d9cced1a3d18f3d9aa0ffe2c777da92b3f46cdc05873a5f464d", 0x1000}, {&(0x7f00000015c0)="10f7fcbc6b521edef0c422745523fe1521beefbecd9966d04c9465b2a78ad37d2205ef", 0x23}], 0x2, &(0x7f0000001880)=ANY=[@ANYBLOB="b80000000000000029000000040000001113000000000000000100000100c2040000000604010d05020005040102037e68d6ed72dfa7ec33e9aa627fdc2bb0505ee1543241af26b8b50008f28438086fa5233ff6ee772ef4c04a1a8ade0c5a374996c066141a35ae035acc52eec3db96b1ac350eba8115f12740312bbcc88eaa294c5a95437815b8a801e831b67abb8e93580e505f4ce447092cce4f1ee46d73ccf4eff5053d6d84301939234e7200001400000000000000290000003e0000000400000000000000200000000000000029000000360000005c000000000000000502fff900000000200100000000000029000000370000000c2000000000000005020088c204000000042a27b47178ca02feec6d9f513eec448835583916c0ad0dbd51a0297a43d7f036d14a9b3582bc69f843c910ff010000000000000000000000000001c910ff0200000e00000000000000000000010093367cf83041b2718c1d11e96e3c0c3dd586f5a02057c3357cf4b934d3aee3efe5de98b42065ef8411bf76cefb68f22528f5e9a41cae26d2aec8a1105d24cc6c64e173ed33d86d1112acf892dd740d0254e7b75c438deb2226ca491185c65e34bb95bb1fb0b80bc6a8d103af2792656712f412ca523d1380c715fd60b2c7077d8c9f7447fef848c061e4e933155cdfdeeacbcdf80502fff7c910fc0100000000000000000000000000010401040000000ee818df2541"], 0x210}}, {{&(0x7f0000000100)={0xa, 0x4e22, 0xc7, @mcast2, 0x3}, 0x1c, &(0x7f0000000400)=[{&(0x7f0000000140)="8f", 0x1}, {&(0x7f00000001c0)="02448de2ec4f495e3dbb15940c06776be7fa32092c3feefa5340d765c4240f9637e2a137b1cee1f4c42dd9c715bb82c656e1c2a5b766a550c775af8f8e28e0d648162f044e9b02d1f00b2c1cf3b0e6169ff0c9f2d2a6a792237bcad98358e3a6dfab5131b693102912f866e275e41c26e1e3f58f4f7568428b855652758e7f2abb74d2233d7398fdae5cdd8ea25e4ca97ff72b3f310ee162be6eb23e26ff6ade1b6781455dea44977d4511a7f022073a519afc9e74492e68c3d026f75293f3772a3541a07d3a8330503006", 0xcb}, {&(0x7f0000001640)="03d30ed2aa16e7820aba9db64ea0a693297b5e499d8c3532168b8a0ffb748fc77a9d11ee55209c857623776aad21298730d2063bcf01218f9558aaea9c13955a619756ced8cd27311f8ea613b44de7d891576b730798815a728f4e2c717b573f480312ec63", 0x65}, {&(0x7f0000000380)="b968a284c30bfc5759ceb1275f55079b54c80fe04a8daf494db9b13c6e2eccb1880984010bb5d96b2b4c42508e60e40ed6a15000f234140e8ba5df170b0da6486e94f1a7136ff4360dd6", 0x4a}], 0x4, &(0x7f0000002240)=ANY=[], 0x12b0}}], 0x4, 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000000)='.\x00', 0x0, 0x321491, 0x0) syz_mount_image$ext4(&(0x7f0000000580)='ext4\x00', &(0x7f0000000040)='./file1\x00', 0x21081e, &(0x7f0000000480)={[{@grpquota}, {@bsdgroups}, {@quota}]}, 0x1, 0x506, &(0x7f0000001d00)="$eJzs3c9vI1cdAPCvnThxsmmTlh4AQbu0hQWt1km8bVT1AOWEEKqE6BGkbUi8URQ7jmKnNGEP6ZkrEpU4wZE/gHNP3LkguHFZDkj8iEAbJA5TzXiS9WbtTbRJ7Cj+fKTRzJvnne97a817mW9ivwBG1s2I2I+IiYj4MCJm8/OFfIv3Olv6ukcHD1YODx6sFCJJPvhXIatPz0XXv0ndyK9ZjogffS/ip4Wn47Z29zaW6/Xadl6ebze25lu7e3fWG8trtbXaZrW6tLi08M7dt6sX1tfXGhP50Vcf/nH/Wz9PmzWTn+nux0XqdL10HCc1HhE/uIxgQzCW92di2A3huRQj4uWIeD27/2djLHs3AYDrLElmI5ntLgMA110xy4EVipU8FzATxWKl0snhvRLTxXqz1b59v7mzudrJlc1FqXh/vV5byHOFc1EqpOXF7PhxuXqifDciXoqIX05OZeXKSrO+OswffABghN04Mf//d7Iz/wMA11x52A0AAAbO/A8Ao8f8DwCjx/wPAKOnM/9PDbsZAMAAef4HgNFj/geAkfLD999Pt+Qw//7r1Y92dzaaH91ZrbU2Ko2dlcpKc3urstZsrmXf2dM47Xr1ZnNr8a3Y+Xju21ut9nxrd+9eo7mz2b6Xfa/3vVope9X+AHoGAPTz0muf/aWQzsjvTmVbdK3lUBpqy4DLVhx2A4ChGRt2A4ChsdoXjK5zPONLD8A10WOJ3ieUe31AKEmS5PKaBFyyW1+S/4dR1ZX/91fAMGLk/2F0yf/D6EqSwlnX/I+zvhAAuNrk+IE+v/9/Od//Lv/lwE9WT77i09Ov7TMGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXFdH6/9W8nU6ZqJYrFQiXoiIuSgV7q/XawsR8WJE/HmyNJmWF4fcZgDgvIp/L+Trf92afXPmiapXbxwfTkTEz379wa8+Xm63t/8UMVH49+TR+fan+fnq4FsPAJzuaJ7O9l0P8o8OHqwcbYNszz++GxHlTvzDg4k4PI4/HuPZvhyliJj+TyEvdxS6chfnsf9JRHyxV/8LMZPlQDorn56Mn8Z+YaDxi0/EL2Z1nX36f/GFC2gLjJrP0vHnvV73XzFuZvve9385G6HOLx//0kutHGZj4OP4R+PfWJ/x7+ZZY7z1h+93jqaervsk4svjEUexD7vGn6P4hT7x3zxj/L9+5dXX+9Ulv4m4Fb3jd8eabze25lu7e3fWG8trtbXaZrW6tLi08M7dt6vzWY56vjMbJD0mhX++e/vFfvHT/k/3iV8+pf9fP2P/f/v/D3/8tWfE/+YbveIX45VnxE+fzL9xxvjL078v96tL46/26f9p7//tM8RO56eHf9t7atlwAGB4Wrt7G8v1em37Gh+kP6tcgWY4OP9BXOG38juDijURvat+8Ubnnj5RlSTPFavfiHERWTfgKji+6SPif8NuDAAAAAAAAAAAAAAA0NMgPrE07D4CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwfX0eAAD//yjlzow=") r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x181242, 0x148) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000000)=0x13) r3 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000180), 0x2000090, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r3}}) ioctl$TCSETSW2(r2, 0x402c542c, &(0x7f0000000040)={0xd, 0x6, 0xfffc0000, 0x8, 0x3, "0c41920887e8d2b791f805000000000000006b", 0x4, 0x5}) r5 = syz_open_procfs(0x0, &(0x7f0000000580)='smaps_rollup\x00') madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) lseek(r5, 0x2004, 0x0) ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000080)=0x5848d0) bind$vsock_stream(r0, &(0x7f0000000000)={0x28, 0x0, 0x0, @hyper}, 0x10) r6 = socket(0x10, 0x803, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=@newtfilter={0x7c, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r8, {0xf}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x50, 0x2, [@TCA_U32_SEL={0x44, 0x5, {0x5, 0xd, 0x3, 0x4, 0x13, 0x2, 0x6, 0x7ffffffa, [{0x200, 0x500, 0x3, 0x6}, {0x2, 0x2, 0x8001, 0x10}, {0xffffffff, 0x53, 0xa9, 0x1}]}}, @TCA_U32_LINK={0x8, 0x3, 0x80000000}]}}]}, 0x7c}}, 0x24000084) syz_genetlink_get_family_id$SEG6(&(0x7f0000000300), r6) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000000)={'\x00', 0x1, 0x7ca6, 0xffffff7f, 0x7, 0x8000000000000001, 0xffffffffffffffff}) getpgid(r9) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40000, 0x0) write$tun(r10, &(0x7f00000004c0)={@void, @void, @eth={@remote, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @val={@void, {0x8100, 0x7, 0x1, 0x2}}, {@generic={0x9a73, "36348afb313a90d4f20f762eab12c62e53463e7e563e91ea65022b60490861ec16c35508c70d2209951f812acdc0a9ab7feb96a848fe5049111241cf65e04e9a444c77df62138dafd0ca1213fb424a058053ce0cb94392d74189f994de96e21e6b29e49950c676a958a7b22c79bcd8ce9cb8b5929a50ddee6c48cbf44bb60ceecc8a551378045c94b36f3cbfee9a571857c9ab7b46ec02c63c0437f5599173c1753ea20dd3f4b20ef2e9d3b929"}}}}, 0xbf) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-pipe-pipe-openat-ioctl$ifreq_SIOCGIFINDEX_wireguard-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-getpgrp-ioctl$ifreq_SIOCGIFINDEX_vcan-syz_usb_connect$hid-syz_usb_connect$hid-ioctl$EXT4_IOC_ALLOC_DA_BLKS-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-getrandom-getrandom-syz_clone3-ioctl$EXT4_IOC_GETFSUUID-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) pipe(&(0x7f0000000000)) (async) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat(r3, 0x0, 0x4028c0, 0xc) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) getpgrp(0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000018105e04da1000000004000109022400010000000009040000090300000009210000000122220009058103"], 0x0) (async) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000018105e04da1000000004000109022400010000000009040000090300000009210000000122220009058103"], 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io$hid(r4, &(0x7f00000004c0)={0x24, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="002222000000960100060100b31c0800002a00c08538a2c83e2503882bb09ea549b3"], 0x0}, 0x0) (async) syz_usb_control_io$hid(r4, &(0x7f00000004c0)={0x24, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="002222000000960100060100b31c0800002a00c08538a2c83e2503882bb09ea549b3"], 0x0}, 0x0) getrandom(&(0x7f00000000c0)=""/119, 0x77, 0x3) (async) getrandom(&(0x7f00000000c0)=""/119, 0x77, 0x3) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r5, 0x80047453, 0x0) (async) ioctl$EXT4_IOC_GETFSUUID(r5, 0x80047453, 0x0) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session single: successfully extracted reproducer found reproducer with 22 syscalls minimizing guilty program testing program (duration=33.959075286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-pipe-pipe-openat-ioctl$ifreq_SIOCGIFINDEX_wireguard-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-getpgrp-ioctl$ifreq_SIOCGIFINDEX_vcan-syz_usb_connect$hid-syz_usb_connect$hid-ioctl$EXT4_IOC_ALLOC_DA_BLKS-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-getrandom-getrandom-syz_clone3-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) pipe(&(0x7f0000000000)) (async) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat(r3, 0x0, 0x4028c0, 0xc) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) getpgrp(0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000018105e04da1000000004000109022400010000000009040000090300000009210000000122220009058103"], 0x0) (async) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000018105e04da1000000004000109022400010000000009040000090300000009210000000122220009058103"], 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io$hid(r4, &(0x7f00000004c0)={0x24, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="002222000000960100060100b31c0800002a00c08538a2c83e2503882bb09ea549b3"], 0x0}, 0x0) (async) syz_usb_control_io$hid(r4, &(0x7f00000004c0)={0x24, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="002222000000960100060100b31c0800002a00c08538a2c83e2503882bb09ea549b3"], 0x0}, 0x0) getrandom(&(0x7f00000000c0)=""/119, 0x77, 0x3) (async) getrandom(&(0x7f00000000c0)=""/119, 0x77, 0x3) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r5, 0x80047453, 0x0) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=33.959075286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-pipe-pipe-openat-ioctl$ifreq_SIOCGIFINDEX_wireguard-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-getpgrp-ioctl$ifreq_SIOCGIFINDEX_vcan-syz_usb_connect$hid-syz_usb_connect$hid-ioctl$EXT4_IOC_ALLOC_DA_BLKS-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-getrandom-getrandom-syz_clone3 detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) pipe(&(0x7f0000000000)) (async) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat(r3, 0x0, 0x4028c0, 0xc) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) getpgrp(0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000018105e04da1000000004000109022400010000000009040000090300000009210000000122220009058103"], 0x0) (async) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000018105e04da1000000004000109022400010000000009040000090300000009210000000122220009058103"], 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io$hid(r4, &(0x7f00000004c0)={0x24, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="002222000000960100060100b31c0800002a00c08538a2c83e2503882bb09ea549b3"], 0x0}, 0x0) (async) syz_usb_control_io$hid(r4, &(0x7f00000004c0)={0x24, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="002222000000960100060100b31c0800002a00c08538a2c83e2503882bb09ea549b3"], 0x0}, 0x0) getrandom(&(0x7f00000000c0)=""/119, 0x77, 0x3) (async) getrandom(&(0x7f00000000c0)=""/119, 0x77, 0x3) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040), 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) program did not crash testing program (duration=33.959075286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-pipe-pipe-openat-ioctl$ifreq_SIOCGIFINDEX_wireguard-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-getpgrp-ioctl$ifreq_SIOCGIFINDEX_vcan-syz_usb_connect$hid-syz_usb_connect$hid-ioctl$EXT4_IOC_ALLOC_DA_BLKS-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-getrandom-getrandom-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) pipe(&(0x7f0000000000)) (async) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat(r3, 0x0, 0x4028c0, 0xc) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) getpgrp(0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000018105e04da1000000004000109022400010000000009040000090300000009210000000122220009058103"], 0x0) (async) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000018105e04da1000000004000109022400010000000009040000090300000009210000000122220009058103"], 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io$hid(r4, &(0x7f00000004c0)={0x24, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="002222000000960100060100b31c0800002a00c08538a2c83e2503882bb09ea549b3"], 0x0}, 0x0) (async) syz_usb_control_io$hid(r4, &(0x7f00000004c0)={0x24, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="002222000000960100060100b31c0800002a00c08538a2c83e2503882bb09ea549b3"], 0x0}, 0x0) getrandom(&(0x7f00000000c0)=""/119, 0x77, 0x3) (async) getrandom(&(0x7f00000000c0)=""/119, 0x77, 0x3) ioctl$EXT4_IOC_GETFSUUID(0xffffffffffffffff, 0x80047453, 0x0) (async) program did not crash testing program (duration=33.959075286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-pipe-pipe-openat-ioctl$ifreq_SIOCGIFINDEX_wireguard-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-getpgrp-ioctl$ifreq_SIOCGIFINDEX_vcan-syz_usb_connect$hid-syz_usb_connect$hid-ioctl$EXT4_IOC_ALLOC_DA_BLKS-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-getrandom-syz_clone3-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) pipe(&(0x7f0000000000)) (async) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat(r3, 0x0, 0x4028c0, 0xc) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) getpgrp(0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000018105e04da1000000004000109022400010000000009040000090300000009210000000122220009058103"], 0x0) (async) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000018105e04da1000000004000109022400010000000009040000090300000009210000000122220009058103"], 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io$hid(r4, &(0x7f00000004c0)={0x24, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="002222000000960100060100b31c0800002a00c08538a2c83e2503882bb09ea549b3"], 0x0}, 0x0) (async) syz_usb_control_io$hid(r4, &(0x7f00000004c0)={0x24, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="002222000000960100060100b31c0800002a00c08538a2c83e2503882bb09ea549b3"], 0x0}, 0x0) getrandom(&(0x7f00000000c0)=""/119, 0x77, 0x3) (async) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r5, 0x80047453, 0x0) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=33.959075286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-pipe-pipe-openat-ioctl$ifreq_SIOCGIFINDEX_wireguard-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-getpgrp-ioctl$ifreq_SIOCGIFINDEX_vcan-syz_usb_connect$hid-syz_usb_connect$hid-ioctl$EXT4_IOC_ALLOC_DA_BLKS-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_clone3-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) pipe(&(0x7f0000000000)) (async) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat(r3, 0x0, 0x4028c0, 0xc) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) getpgrp(0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000018105e04da1000000004000109022400010000000009040000090300000009210000000122220009058103"], 0x0) (async) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000018105e04da1000000004000109022400010000000009040000090300000009210000000122220009058103"], 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io$hid(r4, &(0x7f00000004c0)={0x24, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="002222000000960100060100b31c0800002a00c08538a2c83e2503882bb09ea549b3"], 0x0}, 0x0) (async) syz_usb_control_io$hid(r4, &(0x7f00000004c0)={0x24, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="002222000000960100060100b31c0800002a00c08538a2c83e2503882bb09ea549b3"], 0x0}, 0x0) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r5, 0x80047453, 0x0) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=33.959075286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-pipe-pipe-openat-ioctl$ifreq_SIOCGIFINDEX_wireguard-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-getpgrp-ioctl$ifreq_SIOCGIFINDEX_vcan-syz_usb_connect$hid-syz_usb_connect$hid-ioctl$EXT4_IOC_ALLOC_DA_BLKS-syz_usb_control_io$hid-syz_usb_control_io$hid-syz_clone3-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) pipe(&(0x7f0000000000)) (async) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat(r3, 0x0, 0x4028c0, 0xc) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) getpgrp(0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000018105e04da1000000004000109022400010000000009040000090300000009210000000122220009058103"], 0x0) (async) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000018105e04da1000000004000109022400010000000009040000090300000009210000000122220009058103"], 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io$hid(r4, &(0x7f00000004c0)={0x24, 0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="002222000000960100060100b31c0800002a00c08538a2c83e2503882bb09ea549b3"], 0x0}, 0x0) (async) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r5, 0x80047453, 0x0) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=33.959075286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-pipe-pipe-openat-ioctl$ifreq_SIOCGIFINDEX_wireguard-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-getpgrp-ioctl$ifreq_SIOCGIFINDEX_vcan-syz_usb_connect$hid-syz_usb_connect$hid-ioctl$EXT4_IOC_ALLOC_DA_BLKS-syz_usb_control_io$hid-syz_clone3-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) pipe(&(0x7f0000000000)) (async) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat(r3, 0x0, 0x4028c0, 0xc) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) getpgrp(0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000018105e04da1000000004000109022400010000000009040000090300000009210000000122220009058103"], 0x0) (async) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000018105e04da1000000004000109022400010000000009040000090300000009210000000122220009058103"], 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r5, 0x80047453, 0x0) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=33.959075286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-pipe-pipe-openat-ioctl$ifreq_SIOCGIFINDEX_wireguard-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-getpgrp-ioctl$ifreq_SIOCGIFINDEX_vcan-syz_usb_connect$hid-syz_usb_connect$hid-ioctl$EXT4_IOC_ALLOC_DA_BLKS-syz_clone3-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) pipe(&(0x7f0000000000)) (async) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat(r3, 0x0, 0x4028c0, 0xc) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) getpgrp(0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000018105e04da1000000004000109022400010000000009040000090300000009210000000122220009058103"], 0x0) (async) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000018105e04da1000000004000109022400010000000009040000090300000009210000000122220009058103"], 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r4, 0x80047453, 0x0) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=33.959075286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-pipe-pipe-openat-ioctl$ifreq_SIOCGIFINDEX_wireguard-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-getpgrp-ioctl$ifreq_SIOCGIFINDEX_vcan-syz_usb_connect$hid-syz_usb_connect$hid-syz_clone3-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) pipe(&(0x7f0000000000)) (async) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat(r2, 0x0, 0x4028c0, 0xc) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) getpgrp(0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000018105e04da1000000004000109022400010000000009040000090300000009210000000122220009058103"], 0x0) (async) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000018105e04da1000000004000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r3, 0x80047453, 0x0) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=33.959075286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-pipe-pipe-openat-ioctl$ifreq_SIOCGIFINDEX_wireguard-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-getpgrp-ioctl$ifreq_SIOCGIFINDEX_vcan-syz_usb_connect$hid-syz_clone3-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) pipe(&(0x7f0000000000)) (async) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat(r2, 0x0, 0x4028c0, 0xc) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) getpgrp(0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000018105e04da1000000004000109022400010000000009040000090300000009210000000122220009058103"], 0x0) (async) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r3, 0x80047453, 0x0) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=33.959075286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-pipe-pipe-openat-ioctl$ifreq_SIOCGIFINDEX_wireguard-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-getpgrp-ioctl$ifreq_SIOCGIFINDEX_vcan-syz_clone3-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) pipe(&(0x7f0000000000)) (async) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat(r2, 0x0, 0x4028c0, 0xc) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) getpgrp(0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, 0x0) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r3, 0x80047453, 0x0) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=33.959075286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-pipe-pipe-openat-ioctl$ifreq_SIOCGIFINDEX_wireguard-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-getpgrp-syz_clone3-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) pipe(&(0x7f0000000000)) (async) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat(r2, 0x0, 0x4028c0, 0xc) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) getpgrp(0xffffffffffffffff) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r3, 0x80047453, 0x0) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=33.959075286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-pipe-pipe-openat-ioctl$ifreq_SIOCGIFINDEX_wireguard-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-syz_clone3-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) pipe(&(0x7f0000000000)) (async) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat(r2, 0x0, 0x4028c0, 0xc) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r3, 0x80047453, 0x0) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=33.959075286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-pipe-pipe-openat-ioctl$ifreq_SIOCGIFINDEX_wireguard-syz_clone3-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) pipe(&(0x7f0000000000)) (async) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat(r2, 0x0, 0x4028c0, 0xc) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r3, 0x80047453, 0x0) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=33.959075286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-pipe-pipe-openat-syz_clone3-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) pipe(&(0x7f0000000000)) (async) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat(r2, 0x0, 0x4028c0, 0xc) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r3, 0x80047453, 0x0) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=33.959075286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-pipe-pipe-syz_clone3-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) pipe(&(0x7f0000000000)) (async) pipe(&(0x7f0000000000)) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x80047453, 0x0) (async) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=33.959075286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-pipe-syz_clone3-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) pipe(&(0x7f0000000000)) (async) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x80047453, 0x0) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=33.959075286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x80047453, 0x0) (async) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=33.959075286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-syz_clone3-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x80047453, 0x0) (async) program did not crash testing program (duration=33.959075286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r0, 0x80047453, 0x0) (async) program did not crash testing program (duration=33.959075286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r1, 0x80047453, 0x0) (async) program did not crash testing program (duration=33.959075286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r1, 0x80047453, 0x0) (async) program did not crash testing program (duration=33.959075286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x80047453, 0x0) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=33.959075286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r1, 0x80047453, 0x0) program did not crash testing program (duration=33.959075286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x80047453, 0x0) program did not crash testing program (duration=33.959075286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(0x0, 0x0) ioctl$EXT4_IOC_GETFSUUID(0xffffffffffffffff, 0x80047453, 0x0) program did not crash testing program (duration=33.959075286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(0xffffffffffffffff, 0x80047453, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=33.959075286s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session simplifying C reproducer testing compiled C program (duration=33.959075286s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=33.959075286s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=33.959075286s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=33.959075286s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=33.959075286s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=33.959075286s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=33.959075286s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x80047453, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release validation run: crashed=true testing program (duration=33.959075286s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x80047453, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release validation run: crashed=true testing program (duration=33.959075286s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-sendfile-syz_clone3-ioctl$EXT4_IOC_GETFSUUID detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x80047453, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release validation run: crashed=true reproducing took 28m33.224066432s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: use-after-free in atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:1667 [inline] BUG: KASAN: use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:169 [inline] BUG: KASAN: use-after-free in mutex_lock+0x8e/0x1c0 kernel/locking/mutex.c:288 Write of size 8 at addr ffff88812e2dfd50 by task syz.2.17/373 CPU: 1 PID: 373 Comm: syz.2.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:88 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:427 [inline] kasan_report+0x10f/0x150 mm/kasan/report.c:444 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:1667 [inline] __mutex_trylock_fast kernel/locking/mutex.c:169 [inline] mutex_lock+0x8e/0x1c0 kernel/locking/mutex.c:288 pppol2tp_release+0x178/0x2b0 net/l2tp/l2tp_ppp.c:442 __sock_release net/socket.c:649 [inline] sock_close+0xb8/0x200 net/socket.c:1336 __fput+0x22b/0x900 fs/file_table.c:311 ____fput+0x15/0x20 fs/file_table.c:339 task_work_run+0x127/0x190 kernel/task_work.c:188 exit_task_work include/linux/task_work.h:33 [inline] do_exit+0xb70/0x29a0 kernel/exit.c:890 do_group_exit+0x149/0x310 kernel/exit.c:1004 get_signal+0x64f/0x1430 kernel/signal.c:2908 arch_do_signal_or_restart+0xe2/0x1100 arch/x86/kernel/signal.c:867 handle_signal_work kernel/entry/common.c:154 [inline] exit_to_user_mode_loop+0xa7/0xe0 kernel/entry/common.c:178 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:307 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fc26a4f8197 Code: Unable to access opcode bytes at RIP 0x7fc26a4f816d. RSP: 002b:00007ffda70aa9c0 EFLAGS: 00000202 ORIG_RAX: 00000000000000e6 RAX: fffffffffffffdfc RBX: 0000555584b5e500 RCX: 00007fc26a4f8197 RDX: 00007ffda70aaa00 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007fc26a5d400c R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 R13: 00007fc26a7c4fac R14: 00007fc26a7c4fa0 R15: 00007fc26a7c4fa0 Allocated by task 372: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:433 [inline] ____kasan_kmalloc mm/kasan/common.c:512 [inline] __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:521 kasan_kmalloc include/linux/kasan.h:227 [inline] __kmalloc+0x13d/0x2c0 mm/slub.c:4436 kmalloc include/linux/slab.h:624 [inline] kzalloc include/linux/slab.h:750 [inline] l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772 __sys_connect_file net/socket.c:1923 [inline] __sys_connect+0x3cb/0x450 net/socket.c:1940 __do_sys_connect net/socket.c:1950 [inline] __se_sys_connect net/socket.c:1947 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:1947 x64_sys_call+0x7c/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:43 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 Freed by task 373: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4a/0x70 mm/kasan/common.c:45 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:365 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:373 kasan_slab_free include/linux/kasan.h:193 [inline] slab_free_hook mm/slub.c:1728 [inline] slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1754 slab_free mm/slub.c:3526 [inline] kfree+0xc4/0x270 mm/slub.c:4588 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline] l2tp_session_put+0xaf/0x1a0 net/l2tp/l2tp_core.c:193 l2tp_session_delete+0x3a9/0x4a0 net/l2tp/l2tp_core.c:1589 pppol2tp_release+0x169/0x2b0 net/l2tp/l2tp_ppp.c:439 __sock_release net/socket.c:649 [inline] sock_close+0xb8/0x200 net/socket.c:1336 __fput+0x22b/0x900 fs/file_table.c:311 ____fput+0x15/0x20 fs/file_table.c:339 task_work_run+0x127/0x190 kernel/task_work.c:188 exit_task_work include/linux/task_work.h:33 [inline] do_exit+0xb70/0x29a0 kernel/exit.c:890 do_group_exit+0x149/0x310 kernel/exit.c:1004 get_signal+0x64f/0x1430 kernel/signal.c:2908 arch_do_signal_or_restart+0xe2/0x1100 arch/x86/kernel/signal.c:867 handle_signal_work kernel/entry/common.c:154 [inline] exit_to_user_mode_loop+0xa7/0xe0 kernel/entry/common.c:178 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:307 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 The buggy address belongs to the object at ffff88812e2dfc00 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 336 bytes inside of 512-byte region [ffff88812e2dfc00, ffff88812e2dfe00) The buggy address belongs to the page: page:ffffea0004b8b700 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12e2dc head:ffffea0004b8b700 order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head|zone=1) raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 366, ts 30484744428, free_ts 0 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x192/0x1b0 mm/page_alloc.c:2607 prep_new_page+0x1c/0x110 mm/page_alloc.c:2613 get_page_from_freelist+0x2c3a/0x2cd0 mm/page_alloc.c:4487 __alloc_pages+0x1a2/0x460 mm/page_alloc.c:5824 alloc_slab_page mm/slub.c:-1 [inline] allocate_slab mm/slub.c:1937 [inline] new_slab+0xa0/0x4d0 mm/slub.c:2000 ___slab_alloc+0x3ac/0x840 mm/slub.c:3033 __slab_alloc+0x49/0x90 mm/slub.c:3120 slab_alloc_node mm/slub.c:3211 [inline] slab_alloc mm/slub.c:3255 [inline] kmem_cache_alloc_trace+0x146/0x270 mm/slub.c:3272 kmalloc include/linux/slab.h:619 [inline] kzalloc include/linux/slab.h:750 [inline] find_css_set+0x91d/0x1560 kernel/cgroup/cgroup.c:1251 cgroup_migrate_prepare_dst+0xc4/0xa00 kernel/cgroup/cgroup.c:2820 cgroup_attach_task+0x298/0x520 kernel/cgroup/cgroup.c:2926 __cgroup1_procs_write+0x314/0x520 kernel/cgroup/cgroup-v1.c:529 cgroup1_procs_write+0x2a/0x40 kernel/cgroup/cgroup-v1.c:543 cgroup_file_write+0x294/0x560 kernel/cgroup/cgroup.c:4011 kernfs_fop_write_iter+0x2bd/0x400 fs/kernfs/file.c:296 call_write_iter include/linux/fs.h:2212 [inline] new_sync_write fs/read_write.c:507 [inline] vfs_write+0x831/0xfd0 fs/read_write.c:594 page_owner free stack trace missing Memory state around the buggy address: ffff88812e2dfc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88812e2dfc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88812e2dfd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88812e2dfd80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88812e2dfe00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: use-after-free in atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:1667 [inline] BUG: KASAN: use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:169 [inline] BUG: KASAN: use-after-free in mutex_lock+0x8e/0x1c0 kernel/locking/mutex.c:288 Write of size 8 at addr ffff88812e2dfd50 by task syz.2.17/373 CPU: 1 PID: 373 Comm: syz.2.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: __dump_stack+0x21/0x30 lib/dump_stack.c:88 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:427 [inline] kasan_report+0x10f/0x150 mm/kasan/report.c:444 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:1667 [inline] __mutex_trylock_fast kernel/locking/mutex.c:169 [inline] mutex_lock+0x8e/0x1c0 kernel/locking/mutex.c:288 pppol2tp_release+0x178/0x2b0 net/l2tp/l2tp_ppp.c:442 __sock_release net/socket.c:649 [inline] sock_close+0xb8/0x200 net/socket.c:1336 __fput+0x22b/0x900 fs/file_table.c:311 ____fput+0x15/0x20 fs/file_table.c:339 task_work_run+0x127/0x190 kernel/task_work.c:188 exit_task_work include/linux/task_work.h:33 [inline] do_exit+0xb70/0x29a0 kernel/exit.c:890 do_group_exit+0x149/0x310 kernel/exit.c:1004 get_signal+0x64f/0x1430 kernel/signal.c:2908 arch_do_signal_or_restart+0xe2/0x1100 arch/x86/kernel/signal.c:867 handle_signal_work kernel/entry/common.c:154 [inline] exit_to_user_mode_loop+0xa7/0xe0 kernel/entry/common.c:178 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:307 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fc26a4f8197 Code: Unable to access opcode bytes at RIP 0x7fc26a4f816d. RSP: 002b:00007ffda70aa9c0 EFLAGS: 00000202 ORIG_RAX: 00000000000000e6 RAX: fffffffffffffdfc RBX: 0000555584b5e500 RCX: 00007fc26a4f8197 RDX: 00007ffda70aaa00 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007fc26a5d400c R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 R13: 00007fc26a7c4fac R14: 00007fc26a7c4fa0 R15: 00007fc26a7c4fa0 Allocated by task 372: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:433 [inline] ____kasan_kmalloc mm/kasan/common.c:512 [inline] __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:521 kasan_kmalloc include/linux/kasan.h:227 [inline] __kmalloc+0x13d/0x2c0 mm/slub.c:4436 kmalloc include/linux/slab.h:624 [inline] kzalloc include/linux/slab.h:750 [inline] l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772 __sys_connect_file net/socket.c:1923 [inline] __sys_connect+0x3cb/0x450 net/socket.c:1940 __do_sys_connect net/socket.c:1950 [inline] __se_sys_connect net/socket.c:1947 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:1947 x64_sys_call+0x7c/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:43 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 Freed by task 373: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4a/0x70 mm/kasan/common.c:45 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:365 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:373 kasan_slab_free include/linux/kasan.h:193 [inline] slab_free_hook mm/slub.c:1728 [inline] slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1754 slab_free mm/slub.c:3526 [inline] kfree+0xc4/0x270 mm/slub.c:4588 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline] l2tp_session_put+0xaf/0x1a0 net/l2tp/l2tp_core.c:193 l2tp_session_delete+0x3a9/0x4a0 net/l2tp/l2tp_core.c:1589 pppol2tp_release+0x169/0x2b0 net/l2tp/l2tp_ppp.c:439 __sock_release net/socket.c:649 [inline] sock_close+0xb8/0x200 net/socket.c:1336 __fput+0x22b/0x900 fs/file_table.c:311 ____fput+0x15/0x20 fs/file_table.c:339 task_work_run+0x127/0x190 kernel/task_work.c:188 exit_task_work include/linux/task_work.h:33 [inline] do_exit+0xb70/0x29a0 kernel/exit.c:890 do_group_exit+0x149/0x310 kernel/exit.c:1004 get_signal+0x64f/0x1430 kernel/signal.c:2908 arch_do_signal_or_restart+0xe2/0x1100 arch/x86/kernel/signal.c:867 handle_signal_work kernel/entry/common.c:154 [inline] exit_to_user_mode_loop+0xa7/0xe0 kernel/entry/common.c:178 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:307 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 The buggy address belongs to the object at ffff88812e2dfc00 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 336 bytes inside of 512-byte region [ffff88812e2dfc00, ffff88812e2dfe00) The buggy address belongs to the page: page:ffffea0004b8b700 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12e2dc head:ffffea0004b8b700 order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head|zone=1) raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 366, ts 30484744428, free_ts 0 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x192/0x1b0 mm/page_alloc.c:2607 prep_new_page+0x1c/0x110 mm/page_alloc.c:2613 get_page_from_freelist+0x2c3a/0x2cd0 mm/page_alloc.c:4487 __alloc_pages+0x1a2/0x460 mm/page_alloc.c:5824 alloc_slab_page mm/slub.c:-1 [inline] allocate_slab mm/slub.c:1937 [inline] new_slab+0xa0/0x4d0 mm/slub.c:2000 ___slab_alloc+0x3ac/0x840 mm/slub.c:3033 __slab_alloc+0x49/0x90 mm/slub.c:3120 slab_alloc_node mm/slub.c:3211 [inline] slab_alloc mm/slub.c:3255 [inline] kmem_cache_alloc_trace+0x146/0x270 mm/slub.c:3272 kmalloc include/linux/slab.h:619 [inline] kzalloc include/linux/slab.h:750 [inline] find_css_set+0x91d/0x1560 kernel/cgroup/cgroup.c:1251 cgroup_migrate_prepare_dst+0xc4/0xa00 kernel/cgroup/cgroup.c:2820 cgroup_attach_task+0x298/0x520 kernel/cgroup/cgroup.c:2926 __cgroup1_procs_write+0x314/0x520 kernel/cgroup/cgroup-v1.c:529 cgroup1_procs_write+0x2a/0x40 kernel/cgroup/cgroup-v1.c:543 cgroup_file_write+0x294/0x560 kernel/cgroup/cgroup.c:4011 kernfs_fop_write_iter+0x2bd/0x400 fs/kernfs/file.c:296 call_write_iter include/linux/fs.h:2212 [inline] new_sync_write fs/read_write.c:507 [inline] vfs_write+0x831/0xfd0 fs/read_write.c:594 page_owner free stack trace missing Memory state around the buggy address: ffff88812e2dfc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88812e2dfc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88812e2dfd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88812e2dfd80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88812e2dfe00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================