Extracting prog: 25.564246808s
Minimizing prog: 10m48.019512413s
Simplifying prog options: 0s
Extracting C: 40.228140447s
Simplifying C: 2m49.619271705s


extracting reproducer from 26 programs
testing a last program of every proc
single: executing 7 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): userfaultfd-mmap-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-getsockopt$sock_buf-syz_init_net_socket$bt_rfcomm-ioctl$BTRFS_IOC_GET_SUBVOL_INFO-ioctl$BTRFS_IOC_TREE_SEARCH-ioctl$BTRFS_IOC_INO_LOOKUP_USER-ioctl$UFFDIO_COPY
detailed listing:
executing program 0:
r0 = userfaultfd(0x801)
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0xf132, 0xffffffffffffffff, 0x7fb2a000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x3})
r1 = socket$pppl2tp(0x18, 0x1, 0x1)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r1, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32)
getsockopt$sock_buf(r1, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32)
r3 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000000380)={0x0, ""/256, 0x0, <r4=>0x0})
ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000000580)={{<r5=>0x0, 0x9, 0xd, 0x800, 0x2, 0x2, 0xd, 0x9, 0x80000001, 0x3, 0x1ff, 0x1, 0x3, 0x401, 0x9}})
ioctl$BTRFS_IOC_INO_LOOKUP_USER(r3, 0xd000943e, &(0x7f0000001580)={r4, r5, "334d570c0695cba6f5621d4c29baf5a0816f413a9376260ef59fd6c9c0d7b78a6fb8e83fa5e3d4812c921eaa0d02cfc0a6ef7c74a1fdc9a585f4a62fb15d79967d28ca47d6d9354c428a152c480c617ccc2ccb344592d2465b4491cf9bc4cdf265b69c89b29f3ce728ecbf9aac6a508a560f2f0d06aa620755ebb47a39240a956fce6f52b0393e1a5047b95b714a978b9956e6d95c81a0017fb82a48d8a98501e3ad3ba36f9e8c00241347e76ab0b36b3ac69be27d9baf17ad0abe85d06898c0ca6bb382fd6b9bd4a7103cf265132f1e5907e16e1478ffd811bc7d40980a7a35c0cba0552e135d7d69181ba5d3a611e0a12efdbde25f9cb620df5b4cea7f3cac", "7812eec25770cccd952a007877f7ad4954d0ee110528ae8bea308fa7f856199fe48a668cecb6f995ecf1abddff5e001cf6a8aa7a87049445dfee2bdb8526521fc8704618844ba66423f1654776e730c8a3465e76531a34253738ed0c69bb3258faec873b0971b5a95731d29dff749d5f40c714daf2cd354b1c69122dd3a33a82a63e2545883b23ebcd923d064323a63e60a02eef18675e01ce25164a49f37e4e2d8848482ec67d0bf7ffc30f2ff574b9bf54ddd2a70d45112413d0acebdf9ccfcf39cf51344c30171608962157cc37e0d25fc2e0392ca1fa90461cf5627fabc606fbda936339bf361ed88cf10175cd53a4bd0ae9d5146ecdc3e6d6b1dfb140eb10f484a7a17bf9bfc64f7c599bc7da5242404d70d712e55fb4c7f175bd4baf05f1dec23c49753c4cf8c5099cf5b403b6e40b3dc3c6adbc33b1c7adaf259f7dd962dc2e2601f0c0546d1e29b22c4c62a2b4a8b2511f5b7e965d6490477bc43f3cce3811056bb537814ef22e8d8ed9fc6deb70139531a9477f6a2ee85d0cb75cdc05239b950684ece0581e38d3d4c320af23a407cbcb7de2529c2b0bd3836ceeed1539d67b32a27c8a4ada86931676beb393bf5b8ea373574ca6bcccb675e692fd6b5f91c4fb93cce0bd8f635b02fa0ea9d6799cd7a62000aa503b122b90253b89900c9ddc3081e6fd6bdbdda78eb9668423889bdb121b64070fc75e8dd4afb071c3424a0a0de95b5537739a42eba54d2268aba49c55ab3a7f8f2fe73c23067a5d50addc2117e74fd8c4c7f610cec52d1d1a6add9a4d06f27ce5023f3e5dc15558e5f768ba2cdec9620757d98e50549d3bbcc278e446e14c0c3fed5ad6b113f0dab4a36b0ac2ec2914c05ddd083e280e940dbd4a162d1a4121b2de9a26e4a778e1f851fdff4b2b3e3371150ce8bb0dd45385af9d23999ac9cbce84fabefa27e3e9206abd8b1772e20544027382bab434913373af299567c7b4c337e7f04f49ceb89f1afb64ff591caf7e7959cc2a1246d2c57f39839131dfe84acfbc37ff3d7cb5e7fbbf2512ca0bce3c8d41564f37649b2abffbb5448e82b4228225269b0d07930c6cd0caa190275b07d3d78d8349686fc5a015f11753fa8068081f852188741c5c38fdd9e885c3518726503f095be64dbd128d164eb9e1df1ee1bd598f798c3318f4fd40d40c3c115471f441b42a14f916efe13ece9aac8c49de08b840913fad30406a196040a0125cbb47f59d8c66331b0214421ca74cdedbb2d39b53ed2e0072d0fa938c696739e6bb7a8fdbe75e5dec3514c3ad085eeffb1fc4318839e7372fb3d59f1359ef37e9f836260b5cc99892d3bbdce795083f6ad549ee47faf103ca45781bdfcce916a7f1c575c94bb7b929b2b02c0d47d987dd67d6668387ef4bf6601540087e11380782a391fb1fec9f59eec78ba2f41da8f94861c5c23d2579d5003a2e58c119cc8fa8153c9c59c09b5268fa743df9ddcd17d4894c741547d3cf57641085e334b80fcc63227f2f314a96f90fa3f9e930148c9951e16544e477595aefbe9734b64dbafb894b12f5fdafbbb4d0105c38144cd9b2fec9f0649bd73b60f9ee282af0e4ffe420f45e8db4a859d4ddbfc59bbf304144f86bfc18eab6e0f8242b2a6b7f11a5d1c2a160810b486a506b47997fe64c3c26fad7513040445554ef41a2766a6647d5ae15862574a3f9a8981c805f662e2544cee83afb377e3bfddd7ec911a9c99d47dd8716568efec0145ca53521ee9bf54118a91c422caf0a27b2fb584c7a4b9ce94f927357da74fb9483aedad249dfbc02419db8de090d09167adefe84f961aa6ccb1c7af6ce58ec852acf952076dc04769964856a1260b64eccface5aa85b4770a0b45fbae80c5309dbf64165cc7e88cc03625ffce41946561e226e04b76ca2ceefa018cae00e365510334c1ae9d9cfe02224581a880a1b8c7e72a083931c1fb040811258d361775052114223aa59ec1e69417cd2aa11e056adc54588ec4656918301c6e365a7c96e0e72e50c4b9ef2622a511becb4243d67913f54d6903bbd3068ae02652957333693bedc4f03b444508eeea7c5d3a4e463c2f85c2072c2ea6c3a6c75a02e52814f40f92615ef857c70e33175455600cfbaa8e80f9d5ad5566fd1f3917b9f18e41feb6004b73c766a611bd8cc5b8e0a28d1349708ca0a33d8f3284cfa82779be0c5f3617407c46336f35a12166bf9999e65a00a9c7e371dcecaec63b03d243c13667bda41a7e186c31ed6243b4f06df6d6849e374539dd4012b5dfe824c9c3e080ee2c0168bacb1b50393b2de3d43b60e718369f565e77982e51cbf7e19b5db721600bc6c7d51abf1a8fdb4975a2ca3b8dc61d8f576dbba255041e971ae1d410af0faa7af759c78e0a872e946aa5abf02b82da6a79c5a069a7bae3d47199c70d80e77ed78692269eebcf958129d3c65b72d24bbe9cc3302986444ec7b5b6d2c79c12387931b51b306e3d736855f560f4ba57b6b64a52695563e1243b2818dc1503a024167f5e997fc50472224d1bff46dd4618dd66f1d834b1877a1fd40ff88b3c0edb4f76ef92f78a7db62473101b298bd44bc731ed061ab137b7168a46abaadfa0ad62b8b1a2c5ee77308a5ddec2f63c562d327bcf27e7013b14a7c16c30173f11624b6be3359d642c916dd8b5aa55482ece04510ed571d801f0da8ad96303b3941188a6b42ebf01b4aa22a90796b2a3f10ce1715d9991b915c5d6e7f6780ad94d3a33dc1f4638729b2a1e655c76497291268ac67e23e46d0488bb327b9911412ec79c0907529e6bca00757d024b8fd578018700c86411a2e3e0cb1e6ffb4b60a3e67de9425202102a6c1be266d4e82278768108061a7448ae49d1aea061f7e5a176177b04419f881902d3067a5cb28e17a5618f831a7c864fe49874d28f32a01933ddcd92361d3da071e67d1e5e3ec75b949d56931e49bb213510376848202d9b76ad262a34dd28e45f1b6bfa5397555e219738661709c2fda048445f6d14f4e25668a63325ce08beb7da50b21ecd3a7891feec0f20b4cfe8fc49954263a6b48e461e70973244a78933679a2463495dc43de97c18911b5dc7efadf4ecc8cd2a51a5176f89b9cb7f2b698ac745ed5e8f77848f6da95f68fe42835ee8294d07279ea28f458189742da8227c9f7ddc702977ce1dfa80af80f027b1e200cac97cefe14ec95c2b777ea18e3d567de89b89117e234deba4e4b7062ec1770dc67773e7cce36ddadf9424fb7742b4874aa08d8ab00befed1b6de95a6bed746cdd87ed9a0cff2c03b621f64c1bc10e7c4b2e0214fbd7c0a10dcbcc618c6837ad4fd5ea50ffd4d65261d38c773e998b05985d0277e441c0ff9f7f98be4d2f7724480f67477974a0f5d1d5dc1e352fed6443963a5b0dbfcd5a7e77e75572de9bda593d4adc05c818ee8ef6ab22861d7f59a07bff8af05577fb86b1f38c6eafbdbe35df32ea0b26e69b1eee7f829e524d7cc7d2f523478410d68770caf683c32ae7076d2c6ff1c2e0629346c3859fb06c04828e9535f592f39e1b0361862e82bd45f28190143b0064d2294fa1359a5a5af9a78d6d6decd2b026f5bd20947765155ce5e364c64ba1ff5d21ed5742304d26d3840fea051e57a9ebfeb4012984328520106be1bc424c14f74fb9c9a35ae16a86b85d5d659b840fe467d7c4da2ce6ef6e67969ea60b69b103030fdbf6dda85a9e7237f852d780dcdc6ce62c3ac100383b779032a3fdfbccc5412ef7b1c12035f1810a9d8eeceb0424004e5c1bf2cd94cff38646539eeb8d6f909bb587c7694baa3887f4a660a31eabfcc8b1cc679654d7a1d0a98af19d8ba22053dad7db7a1bb801dd24911ba26f4cb228b17d32e6969cd9dcd7e779b03a540c557979ae6e23dd05c497a4f1e0beef934816bc81d945ae683933137c04139ac05faaeab9861ce1a94bdf5442148c8d63449d7925485f47c274a7bf13043249e0b12c5bfe022c6b4a3462ec4acb0fa8bc9adba9c58f2550108b2788b7ad9d3b6572e1a94bf0c2030c9085598a604695a6c0a9f1654cf22540254d3ea464e02b5bd67953078354c809f0a80cd9495565e7ba160ab844a61105f62fc536455bac7081d1a37d759782dbf51ae2bfedd8d8232a8963af458d03797e94aa7e08eeba46069a77ed0139effdf59b322b5f8c9b2b6d0d41ffff169b7022e8f47b46f5808f893fe065f2abed34a4488ddcb29d1b21c912280742ae63c77914ae15bca831128e36e69d205aea231437d597471ab8cbf3baec583a487d0a40a0ad6d1acf3de63e7a9cd9f132f62a67b43378f3ff9a4cb3dc199a773452b0ec35ea8b38bf9b7be2c73bcb62c5172ac797ff4333eac9baabb7b02f18e933d866a454af3b3da2ef80106b5a2183a7dea5b11d2bab3ba83ec6f9003bf936c4849ca4c069ff427fd557f6445bb04699b2bd933a01549be5d88c6af0c82cd04abb7eb6e3aed8a677434f0c4647ef283a10f00b3e1ce0215a6071bb65d602a5a7eecdb16d3ed4e51881fcdde44509cc4560d6e4303e8dfd56821ad0b75edc7fa1768cab96abec528f9b0753daea4a9d98c37875b07548236266abb400f09e3e138d675836899987de4a298ad3483d343f6e54f8018919d0a88f7eaa39b431e04e606967c6c124a6bb54718b725593e471050ee701507bc6cbf6980ae2332ed8d4c6c3e2b5c0f4a62ffe279ba783a62f463fd57d418cfa7561c42d500a2261ff9ee3f2af11af8d87e71f3425661e52e5ff08600ba6455e2ac0eaf63ca244afdffbd111c93d113f360c07e9b1a29658ead00063f0e6d4e67ca5b472c12b9caaf8090e5a6ca63e43ae7ca704d868f2e4981a8f1e5b01bebe7163122ee8d1c57d3f48b53878b2dbba1b86dd421af7569805a23874274bdd857a8bd93bee3331372f1c6aae0588a51ea9593d0b6de83ab3a489922e8984eff1424a49a1120c2f905b938ef34dbbf5d0f493f4484f318688111a18a85a08245261ab08c38d2a18c540bdbe02ff760a77c416bf19e6974aee11de340bab93164dbfc21851c37b716c3f5493fdf36258460c4645368860d4df1c0d891f41cf786e0fc7f9004f92fa3209e6cf5483830e252b97effb03fd2a7d5c22b32bd84658ca3653eaca207da066dff03fa91d68b1048c00ff6593069377960a539545323110c982bfe3f34c29daab9bcc364e8c1f9481f8887bbe9c8e51b212d09659bfda190d69285ec50771ec28608123730a3cec5160e3229a430359150dfe6655946e17524a5dc65246f09d5c8a3eed34813b1ff55fe3df8049e377d0e1c9fdd816ed410481d5a7fc36151b0e50085902385d8678859945f769fb57ca6c939a215aac173b5505afae15342c200fd7da1598ed097af397d6a7d223e51aa18492432e0407ce46319fc14563ca9f986aefa"})
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000100)={&(0x7f0000922000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x3000, 0x2, 0x2})

program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work
single: successfully extracted reproducer
found reproducer with 13 syscalls
minimizing guilty program
testing program (duration=33.19653684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): userfaultfd-mmap-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-getsockopt$sock_buf-syz_init_net_socket$bt_rfcomm-ioctl$BTRFS_IOC_GET_SUBVOL_INFO-ioctl$BTRFS_IOC_TREE_SEARCH-ioctl$BTRFS_IOC_INO_LOOKUP_USER
detailed listing:
executing program 0:
r0 = userfaultfd(0x801)
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0xf132, 0xffffffffffffffff, 0x7fb2a000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x3})
r1 = socket$pppl2tp(0x18, 0x1, 0x1)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r1, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32)
getsockopt$sock_buf(r1, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32)
r3 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000000380)={0x0, ""/256, 0x0, <r4=>0x0})
ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000000580)={{<r5=>0x0, 0x9, 0xd, 0x800, 0x2, 0x2, 0xd, 0x9, 0x80000001, 0x3, 0x1ff, 0x1, 0x3, 0x401, 0x9}})
ioctl$BTRFS_IOC_INO_LOOKUP_USER(r3, 0xd000943e, &(0x7f0000001580)={r4, r5, "334d570c0695cba6f5621d4c29baf5a0816f413a9376260ef59fd6c9c0d7b78a6fb8e83fa5e3d4812c921eaa0d02cfc0a6ef7c74a1fdc9a585f4a62fb15d79967d28ca47d6d9354c428a152c480c617ccc2ccb344592d2465b4491cf9bc4cdf265b69c89b29f3ce728ecbf9aac6a508a560f2f0d06aa620755ebb47a39240a956fce6f52b0393e1a5047b95b714a978b9956e6d95c81a0017fb82a48d8a98501e3ad3ba36f9e8c00241347e76ab0b36b3ac69be27d9baf17ad0abe85d06898c0ca6bb382fd6b9bd4a7103cf265132f1e5907e16e1478ffd811bc7d40980a7a35c0cba0552e135d7d69181ba5d3a611e0a12efdbde25f9cb620df5b4cea7f3cac", "7812eec25770cccd952a007877f7ad4954d0ee110528ae8bea308fa7f856199fe48a668cecb6f995ecf1abddff5e001cf6a8aa7a87049445dfee2bdb8526521fc8704618844ba66423f1654776e730c8a3465e76531a34253738ed0c69bb3258faec873b0971b5a95731d29dff749d5f40c714daf2cd354b1c69122dd3a33a82a63e2545883b23ebcd923d064323a63e60a02eef18675e01ce25164a49f37e4e2d8848482ec67d0bf7ffc30f2ff574b9bf54ddd2a70d45112413d0acebdf9ccfcf39cf51344c30171608962157cc37e0d25fc2e0392ca1fa90461cf5627fabc606fbda936339bf361ed88cf10175cd53a4bd0ae9d5146ecdc3e6d6b1dfb140eb10f484a7a17bf9bfc64f7c599bc7da5242404d70d712e55fb4c7f175bd4baf05f1dec23c49753c4cf8c5099cf5b403b6e40b3dc3c6adbc33b1c7adaf259f7dd962dc2e2601f0c0546d1e29b22c4c62a2b4a8b2511f5b7e965d6490477bc43f3cce3811056bb537814ef22e8d8ed9fc6deb70139531a9477f6a2ee85d0cb75cdc05239b950684ece0581e38d3d4c320af23a407cbcb7de2529c2b0bd3836ceeed1539d67b32a27c8a4ada86931676beb393bf5b8ea373574ca6bcccb675e692fd6b5f91c4fb93cce0bd8f635b02fa0ea9d6799cd7a62000aa503b122b90253b89900c9ddc3081e6fd6bdbdda78eb9668423889bdb121b64070fc75e8dd4afb071c3424a0a0de95b5537739a42eba54d2268aba49c55ab3a7f8f2fe73c23067a5d50addc2117e74fd8c4c7f610cec52d1d1a6add9a4d06f27ce5023f3e5dc15558e5f768ba2cdec9620757d98e50549d3bbcc278e446e14c0c3fed5ad6b113f0dab4a36b0ac2ec2914c05ddd083e280e940dbd4a162d1a4121b2de9a26e4a778e1f851fdff4b2b3e3371150ce8bb0dd45385af9d23999ac9cbce84fabefa27e3e9206abd8b1772e20544027382bab434913373af299567c7b4c337e7f04f49ceb89f1afb64ff591caf7e7959cc2a1246d2c57f39839131dfe84acfbc37ff3d7cb5e7fbbf2512ca0bce3c8d41564f37649b2abffbb5448e82b4228225269b0d07930c6cd0caa190275b07d3d78d8349686fc5a015f11753fa8068081f852188741c5c38fdd9e885c3518726503f095be64dbd128d164eb9e1df1ee1bd598f798c3318f4fd40d40c3c115471f441b42a14f916efe13ece9aac8c49de08b840913fad30406a196040a0125cbb47f59d8c66331b0214421ca74cdedbb2d39b53ed2e0072d0fa938c696739e6bb7a8fdbe75e5dec3514c3ad085eeffb1fc4318839e7372fb3d59f1359ef37e9f836260b5cc99892d3bbdce795083f6ad549ee47faf103ca45781bdfcce916a7f1c575c94bb7b929b2b02c0d47d987dd67d6668387ef4bf6601540087e11380782a391fb1fec9f59eec78ba2f41da8f94861c5c23d2579d5003a2e58c119cc8fa8153c9c59c09b5268fa743df9ddcd17d4894c741547d3cf57641085e334b80fcc63227f2f314a96f90fa3f9e930148c9951e16544e477595aefbe9734b64dbafb894b12f5fdafbbb4d0105c38144cd9b2fec9f0649bd73b60f9ee282af0e4ffe420f45e8db4a859d4ddbfc59bbf304144f86bfc18eab6e0f8242b2a6b7f11a5d1c2a160810b486a506b47997fe64c3c26fad7513040445554ef41a2766a6647d5ae15862574a3f9a8981c805f662e2544cee83afb377e3bfddd7ec911a9c99d47dd8716568efec0145ca53521ee9bf54118a91c422caf0a27b2fb584c7a4b9ce94f927357da74fb9483aedad249dfbc02419db8de090d09167adefe84f961aa6ccb1c7af6ce58ec852acf952076dc04769964856a1260b64eccface5aa85b4770a0b45fbae80c5309dbf64165cc7e88cc03625ffce41946561e226e04b76ca2ceefa018cae00e365510334c1ae9d9cfe02224581a880a1b8c7e72a083931c1fb040811258d361775052114223aa59ec1e69417cd2aa11e056adc54588ec4656918301c6e365a7c96e0e72e50c4b9ef2622a511becb4243d67913f54d6903bbd3068ae02652957333693bedc4f03b444508eeea7c5d3a4e463c2f85c2072c2ea6c3a6c75a02e52814f40f92615ef857c70e33175455600cfbaa8e80f9d5ad5566fd1f3917b9f18e41feb6004b73c766a611bd8cc5b8e0a28d1349708ca0a33d8f3284cfa82779be0c5f3617407c46336f35a12166bf9999e65a00a9c7e371dcecaec63b03d243c13667bda41a7e186c31ed6243b4f06df6d6849e374539dd4012b5dfe824c9c3e080ee2c0168bacb1b50393b2de3d43b60e718369f565e77982e51cbf7e19b5db721600bc6c7d51abf1a8fdb4975a2ca3b8dc61d8f576dbba255041e971ae1d410af0faa7af759c78e0a872e946aa5abf02b82da6a79c5a069a7bae3d47199c70d80e77ed78692269eebcf958129d3c65b72d24bbe9cc3302986444ec7b5b6d2c79c12387931b51b306e3d736855f560f4ba57b6b64a52695563e1243b2818dc1503a024167f5e997fc50472224d1bff46dd4618dd66f1d834b1877a1fd40ff88b3c0edb4f76ef92f78a7db62473101b298bd44bc731ed061ab137b7168a46abaadfa0ad62b8b1a2c5ee77308a5ddec2f63c562d327bcf27e7013b14a7c16c30173f11624b6be3359d642c916dd8b5aa55482ece04510ed571d801f0da8ad96303b3941188a6b42ebf01b4aa22a90796b2a3f10ce1715d9991b915c5d6e7f6780ad94d3a33dc1f4638729b2a1e655c76497291268ac67e23e46d0488bb327b9911412ec79c0907529e6bca00757d024b8fd578018700c86411a2e3e0cb1e6ffb4b60a3e67de9425202102a6c1be266d4e82278768108061a7448ae49d1aea061f7e5a176177b04419f881902d3067a5cb28e17a5618f831a7c864fe49874d28f32a01933ddcd92361d3da071e67d1e5e3ec75b949d56931e49bb213510376848202d9b76ad262a34dd28e45f1b6bfa5397555e219738661709c2fda048445f6d14f4e25668a63325ce08beb7da50b21ecd3a7891feec0f20b4cfe8fc49954263a6b48e461e70973244a78933679a2463495dc43de97c18911b5dc7efadf4ecc8cd2a51a5176f89b9cb7f2b698ac745ed5e8f77848f6da95f68fe42835ee8294d07279ea28f458189742da8227c9f7ddc702977ce1dfa80af80f027b1e200cac97cefe14ec95c2b777ea18e3d567de89b89117e234deba4e4b7062ec1770dc67773e7cce36ddadf9424fb7742b4874aa08d8ab00befed1b6de95a6bed746cdd87ed9a0cff2c03b621f64c1bc10e7c4b2e0214fbd7c0a10dcbcc618c6837ad4fd5ea50ffd4d65261d38c773e998b05985d0277e441c0ff9f7f98be4d2f7724480f67477974a0f5d1d5dc1e352fed6443963a5b0dbfcd5a7e77e75572de9bda593d4adc05c818ee8ef6ab22861d7f59a07bff8af05577fb86b1f38c6eafbdbe35df32ea0b26e69b1eee7f829e524d7cc7d2f523478410d68770caf683c32ae7076d2c6ff1c2e0629346c3859fb06c04828e9535f592f39e1b0361862e82bd45f28190143b0064d2294fa1359a5a5af9a78d6d6decd2b026f5bd20947765155ce5e364c64ba1ff5d21ed5742304d26d3840fea051e57a9ebfeb4012984328520106be1bc424c14f74fb9c9a35ae16a86b85d5d659b840fe467d7c4da2ce6ef6e67969ea60b69b103030fdbf6dda85a9e7237f852d780dcdc6ce62c3ac100383b779032a3fdfbccc5412ef7b1c12035f1810a9d8eeceb0424004e5c1bf2cd94cff38646539eeb8d6f909bb587c7694baa3887f4a660a31eabfcc8b1cc679654d7a1d0a98af19d8ba22053dad7db7a1bb801dd24911ba26f4cb228b17d32e6969cd9dcd7e779b03a540c557979ae6e23dd05c497a4f1e0beef934816bc81d945ae683933137c04139ac05faaeab9861ce1a94bdf5442148c8d63449d7925485f47c274a7bf13043249e0b12c5bfe022c6b4a3462ec4acb0fa8bc9adba9c58f2550108b2788b7ad9d3b6572e1a94bf0c2030c9085598a604695a6c0a9f1654cf22540254d3ea464e02b5bd67953078354c809f0a80cd9495565e7ba160ab844a61105f62fc536455bac7081d1a37d759782dbf51ae2bfedd8d8232a8963af458d03797e94aa7e08eeba46069a77ed0139effdf59b322b5f8c9b2b6d0d41ffff169b7022e8f47b46f5808f893fe065f2abed34a4488ddcb29d1b21c912280742ae63c77914ae15bca831128e36e69d205aea231437d597471ab8cbf3baec583a487d0a40a0ad6d1acf3de63e7a9cd9f132f62a67b43378f3ff9a4cb3dc199a773452b0ec35ea8b38bf9b7be2c73bcb62c5172ac797ff4333eac9baabb7b02f18e933d866a454af3b3da2ef80106b5a2183a7dea5b11d2bab3ba83ec6f9003bf936c4849ca4c069ff427fd557f6445bb04699b2bd933a01549be5d88c6af0c82cd04abb7eb6e3aed8a677434f0c4647ef283a10f00b3e1ce0215a6071bb65d602a5a7eecdb16d3ed4e51881fcdde44509cc4560d6e4303e8dfd56821ad0b75edc7fa1768cab96abec528f9b0753daea4a9d98c37875b07548236266abb400f09e3e138d675836899987de4a298ad3483d343f6e54f8018919d0a88f7eaa39b431e04e606967c6c124a6bb54718b725593e471050ee701507bc6cbf6980ae2332ed8d4c6c3e2b5c0f4a62ffe279ba783a62f463fd57d418cfa7561c42d500a2261ff9ee3f2af11af8d87e71f3425661e52e5ff08600ba6455e2ac0eaf63ca244afdffbd111c93d113f360c07e9b1a29658ead00063f0e6d4e67ca5b472c12b9caaf8090e5a6ca63e43ae7ca704d868f2e4981a8f1e5b01bebe7163122ee8d1c57d3f48b53878b2dbba1b86dd421af7569805a23874274bdd857a8bd93bee3331372f1c6aae0588a51ea9593d0b6de83ab3a489922e8984eff1424a49a1120c2f905b938ef34dbbf5d0f493f4484f318688111a18a85a08245261ab08c38d2a18c540bdbe02ff760a77c416bf19e6974aee11de340bab93164dbfc21851c37b716c3f5493fdf36258460c4645368860d4df1c0d891f41cf786e0fc7f9004f92fa3209e6cf5483830e252b97effb03fd2a7d5c22b32bd84658ca3653eaca207da066dff03fa91d68b1048c00ff6593069377960a539545323110c982bfe3f34c29daab9bcc364e8c1f9481f8887bbe9c8e51b212d09659bfda190d69285ec50771ec28608123730a3cec5160e3229a430359150dfe6655946e17524a5dc65246f09d5c8a3eed34813b1ff55fe3df8049e377d0e1c9fdd816ed410481d5a7fc36151b0e50085902385d8678859945f769fb57ca6c939a215aac173b5505afae15342c200fd7da1598ed097af397d6a7d223e51aa18492432e0407ce46319fc14563ca9f986aefa"})

program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work
testing program (duration=33.19653684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): userfaultfd-mmap-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-getsockopt$sock_buf-syz_init_net_socket$bt_rfcomm-ioctl$BTRFS_IOC_GET_SUBVOL_INFO-ioctl$BTRFS_IOC_TREE_SEARCH
detailed listing:
executing program 0:
r0 = userfaultfd(0x801)
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0xf132, 0xffffffffffffffff, 0x7fb2a000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x3})
r1 = socket$pppl2tp(0x18, 0x1, 0x1)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r1, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32)
getsockopt$sock_buf(r1, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32)
syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000000380))
ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000000580)={{0x0, 0x9, 0xd, 0x800, 0x2, 0x2, 0xd, 0x9, 0x80000001, 0x3, 0x1ff, 0x1, 0x3, 0x401, 0x9}})

program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work
testing program (duration=33.19653684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): userfaultfd-mmap-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-getsockopt$sock_buf-syz_init_net_socket$bt_rfcomm-ioctl$BTRFS_IOC_GET_SUBVOL_INFO
detailed listing:
executing program 0:
r0 = userfaultfd(0x801)
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0xf132, 0xffffffffffffffff, 0x7fb2a000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x3})
r1 = socket$pppl2tp(0x18, 0x1, 0x1)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r1, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32)
getsockopt$sock_buf(r1, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32)
syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000000380))

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=33.19653684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): userfaultfd-mmap-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-getsockopt$sock_buf-syz_init_net_socket$bt_rfcomm
detailed listing:
executing program 0:
r0 = userfaultfd(0x801)
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0xf132, 0xffffffffffffffff, 0x7fb2a000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x3})
r1 = socket$pppl2tp(0x18, 0x1, 0x1)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r1, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32)
getsockopt$sock_buf(r1, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32)
syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3)

program did not crash
testing program (duration=33.19653684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): userfaultfd-mmap-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-getsockopt$sock_buf-ioctl$BTRFS_IOC_GET_SUBVOL_INFO
detailed listing:
executing program 0:
r0 = userfaultfd(0x801)
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0xf132, 0xffffffffffffffff, 0x7fb2a000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x3})
r1 = socket$pppl2tp(0x18, 0x1, 0x1)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r1, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32)
getsockopt$sock_buf(r1, 0x1, 0x1c, 0x0, &(0x7f0000000340)=0x32)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000000380))

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=33.19653684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): userfaultfd-mmap-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_SUBVOL_INFO
detailed listing:
executing program 0:
r0 = userfaultfd(0x801)
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0xf132, 0xffffffffffffffff, 0x7fb2a000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x3})
r1 = socket$pppl2tp(0x18, 0x1, 0x1)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r1, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000000380))

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=33.19653684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): userfaultfd-mmap-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-socket$pppl2tp-socket$inet6_udp-ioctl$BTRFS_IOC_GET_SUBVOL_INFO
detailed listing:
executing program 0:
r0 = userfaultfd(0x801)
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0xf132, 0xffffffffffffffff, 0x7fb2a000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x3})
r1 = socket$pppl2tp(0x18, 0x1, 0x1)
socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000000380))

program did not crash
testing program (duration=33.19653684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): userfaultfd-mmap-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-socket$pppl2tp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_SUBVOL_INFO
detailed listing:
executing program 0:
r0 = userfaultfd(0x801)
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0xf132, 0xffffffffffffffff, 0x7fb2a000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x3})
r1 = socket$pppl2tp(0x18, 0x1, 0x1)
connect$pppl2tp(r1, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000000380))

program did not crash
testing program (duration=33.19653684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): userfaultfd-mmap-ioctl$UFFDIO_API-ioctl$UFFDIO_REGISTER-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_SUBVOL_INFO
detailed listing:
executing program 0:
r0 = userfaultfd(0x801)
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0xf132, 0xffffffffffffffff, 0x7fb2a000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0))
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x3})
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000380))

program did not crash
testing program (duration=33.19653684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): userfaultfd-mmap-ioctl$UFFDIO_API-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_SUBVOL_INFO
detailed listing:
executing program 0:
r0 = userfaultfd(0x801)
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0xf132, 0xffffffffffffffff, 0x7fb2a000)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000001c0))
r1 = socket$pppl2tp(0x18, 0x1, 0x1)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r1, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000000380))

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=33.19653684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): userfaultfd-mmap-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_SUBVOL_INFO
detailed listing:
executing program 0:
userfaultfd(0x801)
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0xf132, 0xffffffffffffffff, 0x7fb2a000)
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000380))

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=33.19653684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): userfaultfd-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_SUBVOL_INFO
detailed listing:
executing program 0:
userfaultfd(0x801)
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000380))

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=33.19653684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_SUBVOL_INFO
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000380))

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=33.19653684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_SUBVOL_INFO
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, 0x0, 0x0)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000380))

program did not crash
testing program (duration=33.19653684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_SUBVOL_INFO
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, 0x0)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
extracting C reproducer
testing compiled C program (duration=33.19653684s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_SUBVOL_INFO
program crashed: KASAN: use-after-free Write in pppol2tp_release
simplifying C reproducer
testing compiled C program (duration=33.19653684s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_SUBVOL_INFO
program crashed: KASAN: use-after-free Write in pppol2tp_release
testing compiled C program (duration=33.19653684s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_SUBVOL_INFO
program crashed: KASAN: use-after-free Write in pppol2tp_release
testing compiled C program (duration=33.19653684s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_SUBVOL_INFO
program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing compiled C program (duration=33.19653684s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_SUBVOL_INFO
program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing compiled C program (duration=33.19653684s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_SUBVOL_INFO
program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing compiled C program (duration=33.19653684s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_SUBVOL_INFO
program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=33.19653684s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_SUBVOL_INFO
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, 0x0)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
validation run: crashed=true
testing program (duration=33.19653684s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_SUBVOL_INFO
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, 0x0)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
validation run: crashed=true
testing program (duration=33.19653684s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_GET_SUBVOL_INFO
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, 0x0)

program crashed: KASAN: use-after-free Write in pppol2tp_release
validation run: crashed=true
reproducing took 16m13.436821833s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
BUG: KASAN: use-after-free in atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline]
BUG: KASAN: use-after-free in atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline]
BUG: KASAN: use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:173 [inline]
BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298
Write of size 8 at addr ffff888111424550 by task syz.2.17/407

CPU: 1 PID: 407 Comm: syz.2.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
 __dump_stack+0x21/0x24 lib/dump_stack.c:77
 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:435 [inline]
 kasan_report+0x100/0x140 mm/kasan/report.c:452
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189
 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37
 instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
 atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline]
 atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline]
 __mutex_trylock_fast kernel/locking/mutex.c:173 [inline]
 mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298
 pppol2tp_release+0x178/0x2b0 net/l2tp/l2tp_ppp.c:442
 __sock_release net/socket.c:597 [inline]
 sock_close+0xb8/0x200 net/socket.c:1287
 __fput+0x2dc/0x730 fs/file_table.c:281
 ____fput+0x15/0x20 fs/file_table.c:314
 task_work_run+0x127/0x190 kernel/task_work.c:189
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172
 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199
 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274
 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f4c11d0b019
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffceaff4908 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007ffceaff49f0 RCX: 00007f4c11d0b019
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00000000000069bb R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b32b20000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4c11f92fac R14: 00007f4c11f92fa8 R15: 00007f4c11f92fa0

Allocated by task 407:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:430 [inline]
 ____kasan_kmalloc mm/kasan/common.c:509 [inline]
 __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:518
 kasan_kmalloc include/linux/kasan.h:254 [inline]
 __kmalloc+0x19f/0x330 mm/slub.c:4038
 kmalloc include/linux/slab.h:560 [inline]
 kzalloc include/linux/slab.h:667 [inline]
 l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616
 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772
 __sys_connect_file net/socket.c:1867 [inline]
 __sys_connect+0x3ce/0x450 net/socket.c:1884
 __do_sys_connect net/socket.c:1894 [inline]
 __se_sys_connect net/socket.c:1891 [inline]
 __x64_sys_connect+0x7a/0x90 net/socket.c:1891
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

Freed by task 407:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4a/0x70 mm/kasan/common.c:45
 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:362
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370
 kasan_slab_free include/linux/kasan.h:220 [inline]
 slab_free_hook mm/slub.c:1600 [inline]
 slab_free_freelist_hook+0xc5/0x190 mm/slub.c:1626
 slab_free mm/slub.c:3208 [inline]
 kfree+0xc0/0x270 mm/slub.c:4196
 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline]
 l2tp_session_put+0xb2/0x1a0 net/l2tp/l2tp_core.c:193
 l2tp_session_delete+0x3a9/0x4a0 net/l2tp/l2tp_core.c:1589
 pppol2tp_release+0x169/0x2b0 net/l2tp/l2tp_ppp.c:439
 __sock_release net/socket.c:597 [inline]
 sock_close+0xb8/0x200 net/socket.c:1287
 __fput+0x2dc/0x730 fs/file_table.c:281
 ____fput+0x15/0x20 fs/file_table.c:314
 task_work_run+0x127/0x190 kernel/task_work.c:189
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172
 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199
 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274
 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

The buggy address belongs to the object at ffff888111424400
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 336 bytes inside of
 512-byte region [ffff888111424400, ffff888111424600)
The buggy address belongs to the page:
page:ffffea0004450900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x111424
head:ffffea0004450900 order:2 compound_mapcount:0 compound_pincount:0
flags: 0x4000000000010200(slab|head)
raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 364, ts 27080037867, free_ts 26983406282
 set_page_owner include/linux/page_owner.h:35 [inline]
 post_alloc_hook mm/page_alloc.c:2456 [inline]
 prep_new_page+0x176/0x190 mm/page_alloc.c:2462
 get_page_from_freelist+0x225f/0x23f0 mm/page_alloc.c:4254
 __alloc_pages_nodemask+0x29a/0x640 mm/page_alloc.c:5384
 alloc_slab_page mm/slub.c:-1 [inline]
 allocate_slab mm/slub.c:1813 [inline]
 new_slab+0x84/0x3f0 mm/slub.c:1874
 new_slab_objects mm/slub.c:2632 [inline]
 ___slab_alloc+0x2f8/0x4c0 mm/slub.c:2796
 __slab_alloc+0x63/0xa0 mm/slub.c:2836
 slab_alloc_node mm/slub.c:2918 [inline]
 slab_alloc mm/slub.c:2960 [inline]
 kmem_cache_alloc_trace+0x1a8/0x2e0 mm/slub.c:2977
 kmalloc include/linux/slab.h:555 [inline]
 kmalloc_array include/linux/slab.h:594 [inline]
 rtnl_newlink+0x14b/0x1830 net/core/rtnetlink.c:3530
 rtnetlink_rcv_msg+0x9e9/0xca0 net/core/rtnetlink.c:5614
 netlink_rcv_skb+0x1e9/0x430 net/netlink/af_netlink.c:2508
 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:5632
 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
 netlink_unicast+0x86c/0xa30 net/netlink/af_netlink.c:1340
 netlink_sendmsg+0x949/0xb70 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:652 [inline]
 __sock_sendmsg net/socket.c:664 [inline]
 __sys_sendto+0x467/0x620 net/socket.c:2007
 __do_sys_sendto net/socket.c:2019 [inline]
 __se_sys_sendto net/socket.c:2015 [inline]
 __x64_sys_sendto+0xe5/0x100 net/socket.c:2015
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:28 [inline]
 free_pages_prepare mm/page_alloc.c:1349 [inline]
 __free_pages_ok+0x80b/0x830 mm/page_alloc.c:1629
 free_the_page mm/page_alloc.c:5445 [inline]
 __free_pages+0xd8/0x390 mm/page_alloc.c:5454
 __free_slab+0xcf/0x190 mm/slub.c:1899
 free_slab mm/slub.c:1914 [inline]
 discard_slab mm/slub.c:1920 [inline]
 unfreeze_partials+0x150/0x180 mm/slub.c:2415
 put_cpu_partial+0xc1/0x180 mm/slub.c:2451
 __slab_free+0x2c9/0x3a0 mm/slub.c:3100
 do_slab_free mm/slub.c:3196 [inline]
 ___cache_free+0x10e/0x130 mm/slub.c:3215
 qlink_free+0x50/0x90 mm/kasan/quarantine.c:157
 qlist_free_all+0x5f/0xb0 mm/kasan/quarantine.c:176
 kasan_quarantine_reduce+0x14a/0x160 mm/kasan/quarantine.c:283
 __kasan_slab_alloc+0x2f/0xe0 mm/kasan/common.c:440
 kasan_slab_alloc include/linux/kasan.h:244 [inline]
 slab_post_alloc_hook+0x5d/0x2f0 mm/slab.h:580
 slab_alloc_node mm/slub.c:2952 [inline]
 slab_alloc mm/slub.c:2960 [inline]
 kmem_cache_alloc_trace+0x155/0x2e0 mm/slub.c:2977
 kmalloc include/linux/slab.h:555 [inline]
 syslog_print+0x127/0x720 kernel/printk/printk.c:1487
 do_syslog+0x94c/0x9a0 kernel/printk/printk.c:1644
 __do_sys_syslog kernel/printk/printk.c:1736 [inline]
 __se_sys_syslog kernel/printk/printk.c:1734 [inline]
 __x64_sys_syslog+0x7c/0x90 kernel/printk/printk.c:1734

Memory state around the buggy address:
 ffff888111424400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888111424480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888111424500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                 ^
 ffff888111424580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888111424600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
BUG: KASAN: use-after-free in atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline]
BUG: KASAN: use-after-free in atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline]
BUG: KASAN: use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:173 [inline]
BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298
Write of size 8 at addr ffff888111424550 by task syz.2.17/407

CPU: 1 PID: 407 Comm: syz.2.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
 __dump_stack+0x21/0x24 lib/dump_stack.c:77
 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:435 [inline]
 kasan_report+0x100/0x140 mm/kasan/report.c:452
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189
 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37
 instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
 atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline]
 atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline]
 __mutex_trylock_fast kernel/locking/mutex.c:173 [inline]
 mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298
 pppol2tp_release+0x178/0x2b0 net/l2tp/l2tp_ppp.c:442
 __sock_release net/socket.c:597 [inline]
 sock_close+0xb8/0x200 net/socket.c:1287
 __fput+0x2dc/0x730 fs/file_table.c:281
 ____fput+0x15/0x20 fs/file_table.c:314
 task_work_run+0x127/0x190 kernel/task_work.c:189
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172
 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199
 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274
 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f4c11d0b019
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffceaff4908 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007ffceaff49f0 RCX: 00007f4c11d0b019
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00000000000069bb R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b32b20000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4c11f92fac R14: 00007f4c11f92fa8 R15: 00007f4c11f92fa0

Allocated by task 407:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:430 [inline]
 ____kasan_kmalloc mm/kasan/common.c:509 [inline]
 __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:518
 kasan_kmalloc include/linux/kasan.h:254 [inline]
 __kmalloc+0x19f/0x330 mm/slub.c:4038
 kmalloc include/linux/slab.h:560 [inline]
 kzalloc include/linux/slab.h:667 [inline]
 l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616
 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772
 __sys_connect_file net/socket.c:1867 [inline]
 __sys_connect+0x3ce/0x450 net/socket.c:1884
 __do_sys_connect net/socket.c:1894 [inline]
 __se_sys_connect net/socket.c:1891 [inline]
 __x64_sys_connect+0x7a/0x90 net/socket.c:1891
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

Freed by task 407:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4a/0x70 mm/kasan/common.c:45
 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:362
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370
 kasan_slab_free include/linux/kasan.h:220 [inline]
 slab_free_hook mm/slub.c:1600 [inline]
 slab_free_freelist_hook+0xc5/0x190 mm/slub.c:1626
 slab_free mm/slub.c:3208 [inline]
 kfree+0xc0/0x270 mm/slub.c:4196
 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline]
 l2tp_session_put+0xb2/0x1a0 net/l2tp/l2tp_core.c:193
 l2tp_session_delete+0x3a9/0x4a0 net/l2tp/l2tp_core.c:1589
 pppol2tp_release+0x169/0x2b0 net/l2tp/l2tp_ppp.c:439
 __sock_release net/socket.c:597 [inline]
 sock_close+0xb8/0x200 net/socket.c:1287
 __fput+0x2dc/0x730 fs/file_table.c:281
 ____fput+0x15/0x20 fs/file_table.c:314
 task_work_run+0x127/0x190 kernel/task_work.c:189
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172
 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199
 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274
 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

The buggy address belongs to the object at ffff888111424400
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 336 bytes inside of
 512-byte region [ffff888111424400, ffff888111424600)
The buggy address belongs to the page:
page:ffffea0004450900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x111424
head:ffffea0004450900 order:2 compound_mapcount:0 compound_pincount:0
flags: 0x4000000000010200(slab|head)
raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 364, ts 27080037867, free_ts 26983406282
 set_page_owner include/linux/page_owner.h:35 [inline]
 post_alloc_hook mm/page_alloc.c:2456 [inline]
 prep_new_page+0x176/0x190 mm/page_alloc.c:2462
 get_page_from_freelist+0x225f/0x23f0 mm/page_alloc.c:4254
 __alloc_pages_nodemask+0x29a/0x640 mm/page_alloc.c:5384
 alloc_slab_page mm/slub.c:-1 [inline]
 allocate_slab mm/slub.c:1813 [inline]
 new_slab+0x84/0x3f0 mm/slub.c:1874
 new_slab_objects mm/slub.c:2632 [inline]
 ___slab_alloc+0x2f8/0x4c0 mm/slub.c:2796
 __slab_alloc+0x63/0xa0 mm/slub.c:2836
 slab_alloc_node mm/slub.c:2918 [inline]
 slab_alloc mm/slub.c:2960 [inline]
 kmem_cache_alloc_trace+0x1a8/0x2e0 mm/slub.c:2977
 kmalloc include/linux/slab.h:555 [inline]
 kmalloc_array include/linux/slab.h:594 [inline]
 rtnl_newlink+0x14b/0x1830 net/core/rtnetlink.c:3530
 rtnetlink_rcv_msg+0x9e9/0xca0 net/core/rtnetlink.c:5614
 netlink_rcv_skb+0x1e9/0x430 net/netlink/af_netlink.c:2508
 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:5632
 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
 netlink_unicast+0x86c/0xa30 net/netlink/af_netlink.c:1340
 netlink_sendmsg+0x949/0xb70 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:652 [inline]
 __sock_sendmsg net/socket.c:664 [inline]
 __sys_sendto+0x467/0x620 net/socket.c:2007
 __do_sys_sendto net/socket.c:2019 [inline]
 __se_sys_sendto net/socket.c:2015 [inline]
 __x64_sys_sendto+0xe5/0x100 net/socket.c:2015
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:28 [inline]
 free_pages_prepare mm/page_alloc.c:1349 [inline]
 __free_pages_ok+0x80b/0x830 mm/page_alloc.c:1629
 free_the_page mm/page_alloc.c:5445 [inline]
 __free_pages+0xd8/0x390 mm/page_alloc.c:5454
 __free_slab+0xcf/0x190 mm/slub.c:1899
 free_slab mm/slub.c:1914 [inline]
 discard_slab mm/slub.c:1920 [inline]
 unfreeze_partials+0x150/0x180 mm/slub.c:2415
 put_cpu_partial+0xc1/0x180 mm/slub.c:2451
 __slab_free+0x2c9/0x3a0 mm/slub.c:3100
 do_slab_free mm/slub.c:3196 [inline]
 ___cache_free+0x10e/0x130 mm/slub.c:3215
 qlink_free+0x50/0x90 mm/kasan/quarantine.c:157
 qlist_free_all+0x5f/0xb0 mm/kasan/quarantine.c:176
 kasan_quarantine_reduce+0x14a/0x160 mm/kasan/quarantine.c:283
 __kasan_slab_alloc+0x2f/0xe0 mm/kasan/common.c:440
 kasan_slab_alloc include/linux/kasan.h:244 [inline]
 slab_post_alloc_hook+0x5d/0x2f0 mm/slab.h:580
 slab_alloc_node mm/slub.c:2952 [inline]
 slab_alloc mm/slub.c:2960 [inline]
 kmem_cache_alloc_trace+0x155/0x2e0 mm/slub.c:2977
 kmalloc include/linux/slab.h:555 [inline]
 syslog_print+0x127/0x720 kernel/printk/printk.c:1487
 do_syslog+0x94c/0x9a0 kernel/printk/printk.c:1644
 __do_sys_syslog kernel/printk/printk.c:1736 [inline]
 __se_sys_syslog kernel/printk/printk.c:1734 [inline]
 __x64_sys_syslog+0x7c/0x90 kernel/printk/printk.c:1734

Memory state around the buggy address:
 ffff888111424400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888111424480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888111424500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                 ^
 ffff888111424580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888111424600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================