Extracting prog: 1m13.571550574s
Minimizing prog: 17m6.853908726s
Simplifying prog options: 0s
Extracting C: 30.547707444s
Simplifying C: 4m9.9628298s


extracting reproducer from 68 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SET_MM_MAP-socket$pppl2tp-openat$selinux_avc_hash_stats-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE-ioctl$BTRFS_IOC_SCRUB-ioctl$BTRFS_IOC_SCRUB-socket$pppl2tp-connect$pppl2tp-write-socket$unix-bind$unix-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-close_range
detailed listing:
executing program 0:
prctl$PR_SET_MM_MAP(0x22, 0xe, 0x0, 0x0)
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
openat$selinux_avc_hash_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000600)={{<r2=>r1, &(0x7f0000000080)='\x00', 0x50800, &(0x7f00000000c0)={@_ha_fsid={[0x7, 0x1]}, {0xfff7, 0x80, 0x9c5a, 0xe664}}, 0xd9bf, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0xf3}, 0x4, &(0x7f0000000580)=[{0x2, 0x400, &(0x7f0000000180)='}\x00', &(0x7f00000001c0)="4f57480db6f1672804e0694c0a169fbd873c8e7c711039e3fd6c973dec6a18b45fbad98cea6770a3e6cbcef0a2698c7d1021ae2bc433f7b20679e267d6c8f51ae80708e57bffec199f58daed6aada89b54e3e50fa8be1bc4da57788208f4c4e842", 0x61, 0x38}, {0x1, 0xe0000000, &(0x7f0000000240)='\x00', &(0x7f0000000280)="066afcaf65bbf8a33b5bcf7fa2aaaa11e1a67ce9f6ab044e5a2b6831fd13915ec0b61c9c8e77e800c1a644ccf487fe07416810a0e86e3534dd1cd6ffdcc9e7cff5225fc1f5fe34e4d734541abcb36dfe6e8b42b6c7b09e0f31d273e2db3e389ffdb1279f09a98bc65f1e183677b1e93902c42a23b2d3fc5edb7fe9d5d20e00358832e9d8579753", 0x87, 0x20}, {0x0, 0x7ff, &(0x7f0000000340)=']\x00', &(0x7f0000000380)="62c13e92ba9a261c76fca7d27cc76e63ff8925ec38f517befc12d1d6000a5f79ac9dd0d9643fba29100a33f67c859e4b90c697c7611845ae580e48ecafd74618b47dd89568a18aec559e1b9bc3b0dadbbc0c0778ac1399a08109b98a7611c7c6607b9478e89cd6670648d4174d0fb2a3047a99d35c4ebc05c0e6fc43883eab9173a0af46be3bf7ce4a539bc015e8aea8ace8775195a5a600a43ddbeeb679c2b17422522fd55cdd4f0d177198c14ddd8871e1f5bd140c", 0xb6, 0xc}, {0x1, 0x0, &(0x7f0000000440)='-%^\x00', &(0x7f0000000480)="3615f17c9879582c8ba8ba0c261ee1080baf88c8cc956509050a9e64aa8e2629ae629941c7de467c3ab39fd7cdf08a3054509edc5f318cc2a43a46dc161cdb384528afbd69d430ca6821c2b42f157634e688d3dff6aca4f329423f57975ea24a2fbfeb17ca346addd5f5939d7c882e891d2618a5195f8c6d5f83a630efe8cf4c9ef683938a85b3781094b448f76fe84ff9646e71ab2317f322e8748b40c7709ba24f496e1f9d0d68f8baace9f698c075ee15e0ad50a9eb24928e7683486d6183164e46cc5b8f84fe2b549450abe0e4e8bbc893aa7cf8c285dca5bcd6f995f71de3e3b909c7d753b9f019e440609867", 0xef, 0x2}]})
ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000000780)={<r3=>0x0, 0x4, 0xee8, 0x1})
ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000b80)={r3, 0x8, 0x8001})
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
connect$pppl2tp(r4, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @broadcast}, 0x2, 0x9800, 0xfffffffb}}, 0x2e)
write(0xffffffffffffffff, 0x0, 0x0)
r5 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r5, 0x0, 0x0)
r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]})
close_range(r6, 0xffffffffffffffff, 0x0)

program crashed: KASAN: use-after-free Read in l2tp_tunnel_get_session
single: successfully extracted reproducer
found reproducer with 15 syscalls
minimizing guilty program
testing program (duration=31.876258612s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SET_MM_MAP-socket$pppl2tp-openat$selinux_avc_hash_stats-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE-ioctl$BTRFS_IOC_SCRUB-ioctl$BTRFS_IOC_SCRUB-socket$pppl2tp-connect$pppl2tp-write-socket$unix-bind$unix-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER
detailed listing:
executing program 0:
prctl$PR_SET_MM_MAP(0x22, 0xe, 0x0, 0x0)
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
openat$selinux_avc_hash_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000600)={{<r2=>r1, &(0x7f0000000080)='\x00', 0x50800, &(0x7f00000000c0)={@_ha_fsid={[0x7, 0x1]}, {0xfff7, 0x80, 0x9c5a, 0xe664}}, 0xd9bf, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0xf3}, 0x4, &(0x7f0000000580)=[{0x2, 0x400, &(0x7f0000000180)='}\x00', &(0x7f00000001c0)="4f57480db6f1672804e0694c0a169fbd873c8e7c711039e3fd6c973dec6a18b45fbad98cea6770a3e6cbcef0a2698c7d1021ae2bc433f7b20679e267d6c8f51ae80708e57bffec199f58daed6aada89b54e3e50fa8be1bc4da57788208f4c4e842", 0x61, 0x38}, {0x1, 0xe0000000, &(0x7f0000000240)='\x00', &(0x7f0000000280)="066afcaf65bbf8a33b5bcf7fa2aaaa11e1a67ce9f6ab044e5a2b6831fd13915ec0b61c9c8e77e800c1a644ccf487fe07416810a0e86e3534dd1cd6ffdcc9e7cff5225fc1f5fe34e4d734541abcb36dfe6e8b42b6c7b09e0f31d273e2db3e389ffdb1279f09a98bc65f1e183677b1e93902c42a23b2d3fc5edb7fe9d5d20e00358832e9d8579753", 0x87, 0x20}, {0x0, 0x7ff, &(0x7f0000000340)=']\x00', &(0x7f0000000380)="62c13e92ba9a261c76fca7d27cc76e63ff8925ec38f517befc12d1d6000a5f79ac9dd0d9643fba29100a33f67c859e4b90c697c7611845ae580e48ecafd74618b47dd89568a18aec559e1b9bc3b0dadbbc0c0778ac1399a08109b98a7611c7c6607b9478e89cd6670648d4174d0fb2a3047a99d35c4ebc05c0e6fc43883eab9173a0af46be3bf7ce4a539bc015e8aea8ace8775195a5a600a43ddbeeb679c2b17422522fd55cdd4f0d177198c14ddd8871e1f5bd140c", 0xb6, 0xc}, {0x1, 0x0, &(0x7f0000000440)='-%^\x00', &(0x7f0000000480)="3615f17c9879582c8ba8ba0c261ee1080baf88c8cc956509050a9e64aa8e2629ae629941c7de467c3ab39fd7cdf08a3054509edc5f318cc2a43a46dc161cdb384528afbd69d430ca6821c2b42f157634e688d3dff6aca4f329423f57975ea24a2fbfeb17ca346addd5f5939d7c882e891d2618a5195f8c6d5f83a630efe8cf4c9ef683938a85b3781094b448f76fe84ff9646e71ab2317f322e8748b40c7709ba24f496e1f9d0d68f8baace9f698c075ee15e0ad50a9eb24928e7683486d6183164e46cc5b8f84fe2b549450abe0e4e8bbc893aa7cf8c285dca5bcd6f995f71de3e3b909c7d753b9f019e440609867", 0xef, 0x2}]})
ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000000780)={<r3=>0x0, 0x4, 0xee8, 0x1})
ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000b80)={r3, 0x8, 0x8001})
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
connect$pppl2tp(r4, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @broadcast}, 0x2, 0x9800, 0xfffffffb}}, 0x2e)
write(0xffffffffffffffff, 0x0, 0x0)
r5 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r5, 0x0, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]})

program crashed: KASAN: use-after-free Read in l2tp_tunnel_get_session
testing program (duration=31.876258612s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SET_MM_MAP-socket$pppl2tp-openat$selinux_avc_hash_stats-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE-ioctl$BTRFS_IOC_SCRUB-ioctl$BTRFS_IOC_SCRUB-socket$pppl2tp-connect$pppl2tp-write-socket$unix-bind$unix
detailed listing:
executing program 0:
prctl$PR_SET_MM_MAP(0x22, 0xe, 0x0, 0x0)
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
openat$selinux_avc_hash_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000600)={{<r2=>r1, &(0x7f0000000080)='\x00', 0x50800, &(0x7f00000000c0)={@_ha_fsid={[0x7, 0x1]}, {0xfff7, 0x80, 0x9c5a, 0xe664}}, 0xd9bf, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0xf3}, 0x4, &(0x7f0000000580)=[{0x2, 0x400, &(0x7f0000000180)='}\x00', &(0x7f00000001c0)="4f57480db6f1672804e0694c0a169fbd873c8e7c711039e3fd6c973dec6a18b45fbad98cea6770a3e6cbcef0a2698c7d1021ae2bc433f7b20679e267d6c8f51ae80708e57bffec199f58daed6aada89b54e3e50fa8be1bc4da57788208f4c4e842", 0x61, 0x38}, {0x1, 0xe0000000, &(0x7f0000000240)='\x00', &(0x7f0000000280)="066afcaf65bbf8a33b5bcf7fa2aaaa11e1a67ce9f6ab044e5a2b6831fd13915ec0b61c9c8e77e800c1a644ccf487fe07416810a0e86e3534dd1cd6ffdcc9e7cff5225fc1f5fe34e4d734541abcb36dfe6e8b42b6c7b09e0f31d273e2db3e389ffdb1279f09a98bc65f1e183677b1e93902c42a23b2d3fc5edb7fe9d5d20e00358832e9d8579753", 0x87, 0x20}, {0x0, 0x7ff, &(0x7f0000000340)=']\x00', &(0x7f0000000380)="62c13e92ba9a261c76fca7d27cc76e63ff8925ec38f517befc12d1d6000a5f79ac9dd0d9643fba29100a33f67c859e4b90c697c7611845ae580e48ecafd74618b47dd89568a18aec559e1b9bc3b0dadbbc0c0778ac1399a08109b98a7611c7c6607b9478e89cd6670648d4174d0fb2a3047a99d35c4ebc05c0e6fc43883eab9173a0af46be3bf7ce4a539bc015e8aea8ace8775195a5a600a43ddbeeb679c2b17422522fd55cdd4f0d177198c14ddd8871e1f5bd140c", 0xb6, 0xc}, {0x1, 0x0, &(0x7f0000000440)='-%^\x00', &(0x7f0000000480)="3615f17c9879582c8ba8ba0c261ee1080baf88c8cc956509050a9e64aa8e2629ae629941c7de467c3ab39fd7cdf08a3054509edc5f318cc2a43a46dc161cdb384528afbd69d430ca6821c2b42f157634e688d3dff6aca4f329423f57975ea24a2fbfeb17ca346addd5f5939d7c882e891d2618a5195f8c6d5f83a630efe8cf4c9ef683938a85b3781094b448f76fe84ff9646e71ab2317f322e8748b40c7709ba24f496e1f9d0d68f8baace9f698c075ee15e0ad50a9eb24928e7683486d6183164e46cc5b8f84fe2b549450abe0e4e8bbc893aa7cf8c285dca5bcd6f995f71de3e3b909c7d753b9f019e440609867", 0xef, 0x2}]})
ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000000780)={<r3=>0x0, 0x4, 0xee8, 0x1})
ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000b80)={r3, 0x8, 0x8001})
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
connect$pppl2tp(r4, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @broadcast}, 0x2, 0x9800, 0xfffffffb}}, 0x2e)
write(0xffffffffffffffff, 0x0, 0x0)
r5 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r5, 0x0, 0x0)

program crashed: KASAN: use-after-free Read in l2tp_tunnel_get_session
testing program (duration=31.876258612s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SET_MM_MAP-socket$pppl2tp-openat$selinux_avc_hash_stats-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE-ioctl$BTRFS_IOC_SCRUB-ioctl$BTRFS_IOC_SCRUB-socket$pppl2tp-connect$pppl2tp-write-socket$unix
detailed listing:
executing program 0:
prctl$PR_SET_MM_MAP(0x22, 0xe, 0x0, 0x0)
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
openat$selinux_avc_hash_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000600)={{<r2=>r1, &(0x7f0000000080)='\x00', 0x50800, &(0x7f00000000c0)={@_ha_fsid={[0x7, 0x1]}, {0xfff7, 0x80, 0x9c5a, 0xe664}}, 0xd9bf, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0xf3}, 0x4, &(0x7f0000000580)=[{0x2, 0x400, &(0x7f0000000180)='}\x00', &(0x7f00000001c0)="4f57480db6f1672804e0694c0a169fbd873c8e7c711039e3fd6c973dec6a18b45fbad98cea6770a3e6cbcef0a2698c7d1021ae2bc433f7b20679e267d6c8f51ae80708e57bffec199f58daed6aada89b54e3e50fa8be1bc4da57788208f4c4e842", 0x61, 0x38}, {0x1, 0xe0000000, &(0x7f0000000240)='\x00', &(0x7f0000000280)="066afcaf65bbf8a33b5bcf7fa2aaaa11e1a67ce9f6ab044e5a2b6831fd13915ec0b61c9c8e77e800c1a644ccf487fe07416810a0e86e3534dd1cd6ffdcc9e7cff5225fc1f5fe34e4d734541abcb36dfe6e8b42b6c7b09e0f31d273e2db3e389ffdb1279f09a98bc65f1e183677b1e93902c42a23b2d3fc5edb7fe9d5d20e00358832e9d8579753", 0x87, 0x20}, {0x0, 0x7ff, &(0x7f0000000340)=']\x00', &(0x7f0000000380)="62c13e92ba9a261c76fca7d27cc76e63ff8925ec38f517befc12d1d6000a5f79ac9dd0d9643fba29100a33f67c859e4b90c697c7611845ae580e48ecafd74618b47dd89568a18aec559e1b9bc3b0dadbbc0c0778ac1399a08109b98a7611c7c6607b9478e89cd6670648d4174d0fb2a3047a99d35c4ebc05c0e6fc43883eab9173a0af46be3bf7ce4a539bc015e8aea8ace8775195a5a600a43ddbeeb679c2b17422522fd55cdd4f0d177198c14ddd8871e1f5bd140c", 0xb6, 0xc}, {0x1, 0x0, &(0x7f0000000440)='-%^\x00', &(0x7f0000000480)="3615f17c9879582c8ba8ba0c261ee1080baf88c8cc956509050a9e64aa8e2629ae629941c7de467c3ab39fd7cdf08a3054509edc5f318cc2a43a46dc161cdb384528afbd69d430ca6821c2b42f157634e688d3dff6aca4f329423f57975ea24a2fbfeb17ca346addd5f5939d7c882e891d2618a5195f8c6d5f83a630efe8cf4c9ef683938a85b3781094b448f76fe84ff9646e71ab2317f322e8748b40c7709ba24f496e1f9d0d68f8baace9f698c075ee15e0ad50a9eb24928e7683486d6183164e46cc5b8f84fe2b549450abe0e4e8bbc893aa7cf8c285dca5bcd6f995f71de3e3b909c7d753b9f019e440609867", 0xef, 0x2}]})
ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000000780)={<r3=>0x0, 0x4, 0xee8, 0x1})
ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000b80)={r3, 0x8, 0x8001})
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
connect$pppl2tp(r4, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @broadcast}, 0x2, 0x9800, 0xfffffffb}}, 0x2e)
write(0xffffffffffffffff, 0x0, 0x0)
socket$unix(0x1, 0x1, 0x0)

program crashed: KASAN: use-after-free Read in l2tp_tunnel_get_session
testing program (duration=31.876258612s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SET_MM_MAP-socket$pppl2tp-openat$selinux_avc_hash_stats-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE-ioctl$BTRFS_IOC_SCRUB-ioctl$BTRFS_IOC_SCRUB-socket$pppl2tp-connect$pppl2tp-write
detailed listing:
executing program 0:
prctl$PR_SET_MM_MAP(0x22, 0xe, 0x0, 0x0)
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
openat$selinux_avc_hash_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000600)={{<r2=>r1, &(0x7f0000000080)='\x00', 0x50800, &(0x7f00000000c0)={@_ha_fsid={[0x7, 0x1]}, {0xfff7, 0x80, 0x9c5a, 0xe664}}, 0xd9bf, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0xf3}, 0x4, &(0x7f0000000580)=[{0x2, 0x400, &(0x7f0000000180)='}\x00', &(0x7f00000001c0)="4f57480db6f1672804e0694c0a169fbd873c8e7c711039e3fd6c973dec6a18b45fbad98cea6770a3e6cbcef0a2698c7d1021ae2bc433f7b20679e267d6c8f51ae80708e57bffec199f58daed6aada89b54e3e50fa8be1bc4da57788208f4c4e842", 0x61, 0x38}, {0x1, 0xe0000000, &(0x7f0000000240)='\x00', &(0x7f0000000280)="066afcaf65bbf8a33b5bcf7fa2aaaa11e1a67ce9f6ab044e5a2b6831fd13915ec0b61c9c8e77e800c1a644ccf487fe07416810a0e86e3534dd1cd6ffdcc9e7cff5225fc1f5fe34e4d734541abcb36dfe6e8b42b6c7b09e0f31d273e2db3e389ffdb1279f09a98bc65f1e183677b1e93902c42a23b2d3fc5edb7fe9d5d20e00358832e9d8579753", 0x87, 0x20}, {0x0, 0x7ff, &(0x7f0000000340)=']\x00', &(0x7f0000000380)="62c13e92ba9a261c76fca7d27cc76e63ff8925ec38f517befc12d1d6000a5f79ac9dd0d9643fba29100a33f67c859e4b90c697c7611845ae580e48ecafd74618b47dd89568a18aec559e1b9bc3b0dadbbc0c0778ac1399a08109b98a7611c7c6607b9478e89cd6670648d4174d0fb2a3047a99d35c4ebc05c0e6fc43883eab9173a0af46be3bf7ce4a539bc015e8aea8ace8775195a5a600a43ddbeeb679c2b17422522fd55cdd4f0d177198c14ddd8871e1f5bd140c", 0xb6, 0xc}, {0x1, 0x0, &(0x7f0000000440)='-%^\x00', &(0x7f0000000480)="3615f17c9879582c8ba8ba0c261ee1080baf88c8cc956509050a9e64aa8e2629ae629941c7de467c3ab39fd7cdf08a3054509edc5f318cc2a43a46dc161cdb384528afbd69d430ca6821c2b42f157634e688d3dff6aca4f329423f57975ea24a2fbfeb17ca346addd5f5939d7c882e891d2618a5195f8c6d5f83a630efe8cf4c9ef683938a85b3781094b448f76fe84ff9646e71ab2317f322e8748b40c7709ba24f496e1f9d0d68f8baace9f698c075ee15e0ad50a9eb24928e7683486d6183164e46cc5b8f84fe2b549450abe0e4e8bbc893aa7cf8c285dca5bcd6f995f71de3e3b909c7d753b9f019e440609867", 0xef, 0x2}]})
ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000000780)={<r3=>0x0, 0x4, 0xee8, 0x1})
ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000b80)={r3, 0x8, 0x8001})
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
connect$pppl2tp(r4, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @broadcast}, 0x2, 0x9800, 0xfffffffb}}, 0x2e)
write(0xffffffffffffffff, 0x0, 0x0)

program crashed: KASAN: use-after-free Read in l2tp_tunnel_get_session
testing program (duration=31.876258612s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SET_MM_MAP-socket$pppl2tp-openat$selinux_avc_hash_stats-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE-ioctl$BTRFS_IOC_SCRUB-ioctl$BTRFS_IOC_SCRUB-socket$pppl2tp-connect$pppl2tp
detailed listing:
executing program 0:
prctl$PR_SET_MM_MAP(0x22, 0xe, 0x0, 0x0)
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
openat$selinux_avc_hash_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000600)={{<r2=>r1, &(0x7f0000000080)='\x00', 0x50800, &(0x7f00000000c0)={@_ha_fsid={[0x7, 0x1]}, {0xfff7, 0x80, 0x9c5a, 0xe664}}, 0xd9bf, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0xf3}, 0x4, &(0x7f0000000580)=[{0x2, 0x400, &(0x7f0000000180)='}\x00', &(0x7f00000001c0)="4f57480db6f1672804e0694c0a169fbd873c8e7c711039e3fd6c973dec6a18b45fbad98cea6770a3e6cbcef0a2698c7d1021ae2bc433f7b20679e267d6c8f51ae80708e57bffec199f58daed6aada89b54e3e50fa8be1bc4da57788208f4c4e842", 0x61, 0x38}, {0x1, 0xe0000000, &(0x7f0000000240)='\x00', &(0x7f0000000280)="066afcaf65bbf8a33b5bcf7fa2aaaa11e1a67ce9f6ab044e5a2b6831fd13915ec0b61c9c8e77e800c1a644ccf487fe07416810a0e86e3534dd1cd6ffdcc9e7cff5225fc1f5fe34e4d734541abcb36dfe6e8b42b6c7b09e0f31d273e2db3e389ffdb1279f09a98bc65f1e183677b1e93902c42a23b2d3fc5edb7fe9d5d20e00358832e9d8579753", 0x87, 0x20}, {0x0, 0x7ff, &(0x7f0000000340)=']\x00', &(0x7f0000000380)="62c13e92ba9a261c76fca7d27cc76e63ff8925ec38f517befc12d1d6000a5f79ac9dd0d9643fba29100a33f67c859e4b90c697c7611845ae580e48ecafd74618b47dd89568a18aec559e1b9bc3b0dadbbc0c0778ac1399a08109b98a7611c7c6607b9478e89cd6670648d4174d0fb2a3047a99d35c4ebc05c0e6fc43883eab9173a0af46be3bf7ce4a539bc015e8aea8ace8775195a5a600a43ddbeeb679c2b17422522fd55cdd4f0d177198c14ddd8871e1f5bd140c", 0xb6, 0xc}, {0x1, 0x0, &(0x7f0000000440)='-%^\x00', &(0x7f0000000480)="3615f17c9879582c8ba8ba0c261ee1080baf88c8cc956509050a9e64aa8e2629ae629941c7de467c3ab39fd7cdf08a3054509edc5f318cc2a43a46dc161cdb384528afbd69d430ca6821c2b42f157634e688d3dff6aca4f329423f57975ea24a2fbfeb17ca346addd5f5939d7c882e891d2618a5195f8c6d5f83a630efe8cf4c9ef683938a85b3781094b448f76fe84ff9646e71ab2317f322e8748b40c7709ba24f496e1f9d0d68f8baace9f698c075ee15e0ad50a9eb24928e7683486d6183164e46cc5b8f84fe2b549450abe0e4e8bbc893aa7cf8c285dca5bcd6f995f71de3e3b909c7d753b9f019e440609867", 0xef, 0x2}]})
ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000000780)={<r3=>0x0, 0x4, 0xee8, 0x1})
ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000b80)={r3, 0x8, 0x8001})
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
connect$pppl2tp(r4, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @broadcast}, 0x2, 0x9800, 0xfffffffb}}, 0x2e)

program crashed: KASAN: use-after-free Read in l2tp_tunnel_get_session
testing program (duration=31.876258612s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SET_MM_MAP-socket$pppl2tp-openat$selinux_avc_hash_stats-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE-ioctl$BTRFS_IOC_SCRUB-ioctl$BTRFS_IOC_SCRUB-socket$pppl2tp
detailed listing:
executing program 0:
prctl$PR_SET_MM_MAP(0x22, 0xe, 0x0, 0x0)
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
openat$selinux_avc_hash_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000600)={{<r2=>r1, &(0x7f0000000080)='\x00', 0x50800, &(0x7f00000000c0)={@_ha_fsid={[0x7, 0x1]}, {0xfff7, 0x80, 0x9c5a, 0xe664}}, 0xd9bf, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0xf3}, 0x4, &(0x7f0000000580)=[{0x2, 0x400, &(0x7f0000000180)='}\x00', &(0x7f00000001c0)="4f57480db6f1672804e0694c0a169fbd873c8e7c711039e3fd6c973dec6a18b45fbad98cea6770a3e6cbcef0a2698c7d1021ae2bc433f7b20679e267d6c8f51ae80708e57bffec199f58daed6aada89b54e3e50fa8be1bc4da57788208f4c4e842", 0x61, 0x38}, {0x1, 0xe0000000, &(0x7f0000000240)='\x00', &(0x7f0000000280)="066afcaf65bbf8a33b5bcf7fa2aaaa11e1a67ce9f6ab044e5a2b6831fd13915ec0b61c9c8e77e800c1a644ccf487fe07416810a0e86e3534dd1cd6ffdcc9e7cff5225fc1f5fe34e4d734541abcb36dfe6e8b42b6c7b09e0f31d273e2db3e389ffdb1279f09a98bc65f1e183677b1e93902c42a23b2d3fc5edb7fe9d5d20e00358832e9d8579753", 0x87, 0x20}, {0x0, 0x7ff, &(0x7f0000000340)=']\x00', &(0x7f0000000380)="62c13e92ba9a261c76fca7d27cc76e63ff8925ec38f517befc12d1d6000a5f79ac9dd0d9643fba29100a33f67c859e4b90c697c7611845ae580e48ecafd74618b47dd89568a18aec559e1b9bc3b0dadbbc0c0778ac1399a08109b98a7611c7c6607b9478e89cd6670648d4174d0fb2a3047a99d35c4ebc05c0e6fc43883eab9173a0af46be3bf7ce4a539bc015e8aea8ace8775195a5a600a43ddbeeb679c2b17422522fd55cdd4f0d177198c14ddd8871e1f5bd140c", 0xb6, 0xc}, {0x1, 0x0, &(0x7f0000000440)='-%^\x00', &(0x7f0000000480)="3615f17c9879582c8ba8ba0c261ee1080baf88c8cc956509050a9e64aa8e2629ae629941c7de467c3ab39fd7cdf08a3054509edc5f318cc2a43a46dc161cdb384528afbd69d430ca6821c2b42f157634e688d3dff6aca4f329423f57975ea24a2fbfeb17ca346addd5f5939d7c882e891d2618a5195f8c6d5f83a630efe8cf4c9ef683938a85b3781094b448f76fe84ff9646e71ab2317f322e8748b40c7709ba24f496e1f9d0d68f8baace9f698c075ee15e0ad50a9eb24928e7683486d6183164e46cc5b8f84fe2b549450abe0e4e8bbc893aa7cf8c285dca5bcd6f995f71de3e3b909c7d753b9f019e440609867", 0xef, 0x2}]})
ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000000780)={<r3=>0x0, 0x4, 0xee8, 0x1})
ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000b80)={r3, 0x8, 0x8001})
socket$pppl2tp(0x18, 0x1, 0x1)

program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work
testing program (duration=31.876258612s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SET_MM_MAP-socket$pppl2tp-openat$selinux_avc_hash_stats-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE-ioctl$BTRFS_IOC_SCRUB-ioctl$BTRFS_IOC_SCRUB
detailed listing:
executing program 0:
prctl$PR_SET_MM_MAP(0x22, 0xe, 0x0, 0x0)
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
openat$selinux_avc_hash_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000600)={{<r2=>r1, &(0x7f0000000080)='\x00', 0x50800, &(0x7f00000000c0)={@_ha_fsid={[0x7, 0x1]}, {0xfff7, 0x80, 0x9c5a, 0xe664}}, 0xd9bf, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0xf3}, 0x4, &(0x7f0000000580)=[{0x2, 0x400, &(0x7f0000000180)='}\x00', &(0x7f00000001c0)="4f57480db6f1672804e0694c0a169fbd873c8e7c711039e3fd6c973dec6a18b45fbad98cea6770a3e6cbcef0a2698c7d1021ae2bc433f7b20679e267d6c8f51ae80708e57bffec199f58daed6aada89b54e3e50fa8be1bc4da57788208f4c4e842", 0x61, 0x38}, {0x1, 0xe0000000, &(0x7f0000000240)='\x00', &(0x7f0000000280)="066afcaf65bbf8a33b5bcf7fa2aaaa11e1a67ce9f6ab044e5a2b6831fd13915ec0b61c9c8e77e800c1a644ccf487fe07416810a0e86e3534dd1cd6ffdcc9e7cff5225fc1f5fe34e4d734541abcb36dfe6e8b42b6c7b09e0f31d273e2db3e389ffdb1279f09a98bc65f1e183677b1e93902c42a23b2d3fc5edb7fe9d5d20e00358832e9d8579753", 0x87, 0x20}, {0x0, 0x7ff, &(0x7f0000000340)=']\x00', &(0x7f0000000380)="62c13e92ba9a261c76fca7d27cc76e63ff8925ec38f517befc12d1d6000a5f79ac9dd0d9643fba29100a33f67c859e4b90c697c7611845ae580e48ecafd74618b47dd89568a18aec559e1b9bc3b0dadbbc0c0778ac1399a08109b98a7611c7c6607b9478e89cd6670648d4174d0fb2a3047a99d35c4ebc05c0e6fc43883eab9173a0af46be3bf7ce4a539bc015e8aea8ace8775195a5a600a43ddbeeb679c2b17422522fd55cdd4f0d177198c14ddd8871e1f5bd140c", 0xb6, 0xc}, {0x1, 0x0, &(0x7f0000000440)='-%^\x00', &(0x7f0000000480)="3615f17c9879582c8ba8ba0c261ee1080baf88c8cc956509050a9e64aa8e2629ae629941c7de467c3ab39fd7cdf08a3054509edc5f318cc2a43a46dc161cdb384528afbd69d430ca6821c2b42f157634e688d3dff6aca4f329423f57975ea24a2fbfeb17ca346addd5f5939d7c882e891d2618a5195f8c6d5f83a630efe8cf4c9ef683938a85b3781094b448f76fe84ff9646e71ab2317f322e8748b40c7709ba24f496e1f9d0d68f8baace9f698c075ee15e0ad50a9eb24928e7683486d6183164e46cc5b8f84fe2b549450abe0e4e8bbc893aa7cf8c285dca5bcd6f995f71de3e3b909c7d753b9f019e440609867", 0xef, 0x2}]})
ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000000780)={<r3=>0x0, 0x4, 0xee8, 0x1})
ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000b80)={r3, 0x8, 0x8001})

program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work
testing program (duration=31.876258612s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SET_MM_MAP-socket$pppl2tp-openat$selinux_avc_hash_stats-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE-ioctl$BTRFS_IOC_SCRUB
detailed listing:
executing program 0:
prctl$PR_SET_MM_MAP(0x22, 0xe, 0x0, 0x0)
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
openat$selinux_avc_hash_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000600)={{r1, &(0x7f0000000080)='\x00', 0x50800, &(0x7f00000000c0)={@_ha_fsid={[0x7, 0x1]}, {0xfff7, 0x80, 0x9c5a, 0xe664}}, 0xd9bf, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0xf3}, 0x4, &(0x7f0000000580)=[{0x2, 0x400, &(0x7f0000000180)='}\x00', &(0x7f00000001c0)="4f57480db6f1672804e0694c0a169fbd873c8e7c711039e3fd6c973dec6a18b45fbad98cea6770a3e6cbcef0a2698c7d1021ae2bc433f7b20679e267d6c8f51ae80708e57bffec199f58daed6aada89b54e3e50fa8be1bc4da57788208f4c4e842", 0x61, 0x38}, {0x1, 0xe0000000, &(0x7f0000000240)='\x00', &(0x7f0000000280)="066afcaf65bbf8a33b5bcf7fa2aaaa11e1a67ce9f6ab044e5a2b6831fd13915ec0b61c9c8e77e800c1a644ccf487fe07416810a0e86e3534dd1cd6ffdcc9e7cff5225fc1f5fe34e4d734541abcb36dfe6e8b42b6c7b09e0f31d273e2db3e389ffdb1279f09a98bc65f1e183677b1e93902c42a23b2d3fc5edb7fe9d5d20e00358832e9d8579753", 0x87, 0x20}, {0x0, 0x7ff, &(0x7f0000000340)=']\x00', &(0x7f0000000380)="62c13e92ba9a261c76fca7d27cc76e63ff8925ec38f517befc12d1d6000a5f79ac9dd0d9643fba29100a33f67c859e4b90c697c7611845ae580e48ecafd74618b47dd89568a18aec559e1b9bc3b0dadbbc0c0778ac1399a08109b98a7611c7c6607b9478e89cd6670648d4174d0fb2a3047a99d35c4ebc05c0e6fc43883eab9173a0af46be3bf7ce4a539bc015e8aea8ace8775195a5a600a43ddbeeb679c2b17422522fd55cdd4f0d177198c14ddd8871e1f5bd140c", 0xb6, 0xc}, {0x1, 0x0, &(0x7f0000000440)='-%^\x00', &(0x7f0000000480)="3615f17c9879582c8ba8ba0c261ee1080baf88c8cc956509050a9e64aa8e2629ae629941c7de467c3ab39fd7cdf08a3054509edc5f318cc2a43a46dc161cdb384528afbd69d430ca6821c2b42f157634e688d3dff6aca4f329423f57975ea24a2fbfeb17ca346addd5f5939d7c882e891d2618a5195f8c6d5f83a630efe8cf4c9ef683938a85b3781094b448f76fe84ff9646e71ab2317f322e8748b40c7709ba24f496e1f9d0d68f8baace9f698c075ee15e0ad50a9eb24928e7683486d6183164e46cc5b8f84fe2b549450abe0e4e8bbc893aa7cf8c285dca5bcd6f995f71de3e3b909c7d753b9f019e440609867", 0xef, 0x2}]})
ioctl$BTRFS_IOC_SCRUB(r0, 0xc400941b, &(0x7f0000000780)={0x0, 0x4, 0xee8, 0x1})

program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work
testing program (duration=31.876258612s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SET_MM_MAP-socket$pppl2tp-openat$selinux_avc_hash_stats-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE
detailed listing:
executing program 0:
prctl$PR_SET_MM_MAP(0x22, 0xe, 0x0, 0x0)
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
openat$selinux_avc_hash_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000600)={{r1, &(0x7f0000000080)='\x00', 0x50800, &(0x7f00000000c0)={@_ha_fsid={[0x7, 0x1]}, {0xfff7, 0x80, 0x9c5a, 0xe664}}, 0xd9bf, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0xf3}, 0x4, &(0x7f0000000580)=[{0x2, 0x400, &(0x7f0000000180)='}\x00', &(0x7f00000001c0)="4f57480db6f1672804e0694c0a169fbd873c8e7c711039e3fd6c973dec6a18b45fbad98cea6770a3e6cbcef0a2698c7d1021ae2bc433f7b20679e267d6c8f51ae80708e57bffec199f58daed6aada89b54e3e50fa8be1bc4da57788208f4c4e842", 0x61, 0x38}, {0x1, 0xe0000000, &(0x7f0000000240)='\x00', &(0x7f0000000280)="066afcaf65bbf8a33b5bcf7fa2aaaa11e1a67ce9f6ab044e5a2b6831fd13915ec0b61c9c8e77e800c1a644ccf487fe07416810a0e86e3534dd1cd6ffdcc9e7cff5225fc1f5fe34e4d734541abcb36dfe6e8b42b6c7b09e0f31d273e2db3e389ffdb1279f09a98bc65f1e183677b1e93902c42a23b2d3fc5edb7fe9d5d20e00358832e9d8579753", 0x87, 0x20}, {0x0, 0x7ff, &(0x7f0000000340)=']\x00', &(0x7f0000000380)="62c13e92ba9a261c76fca7d27cc76e63ff8925ec38f517befc12d1d6000a5f79ac9dd0d9643fba29100a33f67c859e4b90c697c7611845ae580e48ecafd74618b47dd89568a18aec559e1b9bc3b0dadbbc0c0778ac1399a08109b98a7611c7c6607b9478e89cd6670648d4174d0fb2a3047a99d35c4ebc05c0e6fc43883eab9173a0af46be3bf7ce4a539bc015e8aea8ace8775195a5a600a43ddbeeb679c2b17422522fd55cdd4f0d177198c14ddd8871e1f5bd140c", 0xb6, 0xc}, {0x1, 0x0, &(0x7f0000000440)='-%^\x00', &(0x7f0000000480)="3615f17c9879582c8ba8ba0c261ee1080baf88c8cc956509050a9e64aa8e2629ae629941c7de467c3ab39fd7cdf08a3054509edc5f318cc2a43a46dc161cdb384528afbd69d430ca6821c2b42f157634e688d3dff6aca4f329423f57975ea24a2fbfeb17ca346addd5f5939d7c882e891d2618a5195f8c6d5f83a630efe8cf4c9ef683938a85b3781094b448f76fe84ff9646e71ab2317f322e8748b40c7709ba24f496e1f9d0d68f8baace9f698c075ee15e0ad50a9eb24928e7683486d6183164e46cc5b8f84fe2b549450abe0e4e8bbc893aa7cf8c285dca5bcd6f995f71de3e3b909c7d753b9f019e440609867", 0xef, 0x2}]})

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=31.876258612s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SET_MM_MAP-socket$pppl2tp-openat$selinux_avc_hash_stats-socket$inet6_udp-connect$pppl2tp
detailed listing:
executing program 0:
prctl$PR_SET_MM_MAP(0x22, 0xe, 0x0, 0x0)
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
openat$selinux_avc_hash_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)

program did not crash
testing program (duration=31.876258612s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SET_MM_MAP-socket$pppl2tp-openat$selinux_avc_hash_stats-socket$inet6_udp-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE
detailed listing:
executing program 0:
prctl$PR_SET_MM_MAP(0x22, 0xe, 0x0, 0x0)
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
openat$selinux_avc_hash_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000600)={{r1, &(0x7f0000000080)='\x00', 0x50800, &(0x7f00000000c0)={@_ha_fsid={[0x7, 0x1]}, {0xfff7, 0x80, 0x9c5a, 0xe664}}, 0xd9bf, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0xf3}, 0x4, &(0x7f0000000580)=[{0x2, 0x400, &(0x7f0000000180)='}\x00', &(0x7f00000001c0)="4f57480db6f1672804e0694c0a169fbd873c8e7c711039e3fd6c973dec6a18b45fbad98cea6770a3e6cbcef0a2698c7d1021ae2bc433f7b20679e267d6c8f51ae80708e57bffec199f58daed6aada89b54e3e50fa8be1bc4da57788208f4c4e842", 0x61, 0x38}, {0x1, 0xe0000000, &(0x7f0000000240)='\x00', &(0x7f0000000280)="066afcaf65bbf8a33b5bcf7fa2aaaa11e1a67ce9f6ab044e5a2b6831fd13915ec0b61c9c8e77e800c1a644ccf487fe07416810a0e86e3534dd1cd6ffdcc9e7cff5225fc1f5fe34e4d734541abcb36dfe6e8b42b6c7b09e0f31d273e2db3e389ffdb1279f09a98bc65f1e183677b1e93902c42a23b2d3fc5edb7fe9d5d20e00358832e9d8579753", 0x87, 0x20}, {0x0, 0x7ff, &(0x7f0000000340)=']\x00', &(0x7f0000000380)="62c13e92ba9a261c76fca7d27cc76e63ff8925ec38f517befc12d1d6000a5f79ac9dd0d9643fba29100a33f67c859e4b90c697c7611845ae580e48ecafd74618b47dd89568a18aec559e1b9bc3b0dadbbc0c0778ac1399a08109b98a7611c7c6607b9478e89cd6670648d4174d0fb2a3047a99d35c4ebc05c0e6fc43883eab9173a0af46be3bf7ce4a539bc015e8aea8ace8775195a5a600a43ddbeeb679c2b17422522fd55cdd4f0d177198c14ddd8871e1f5bd140c", 0xb6, 0xc}, {0x1, 0x0, &(0x7f0000000440)='-%^\x00', &(0x7f0000000480)="3615f17c9879582c8ba8ba0c261ee1080baf88c8cc956509050a9e64aa8e2629ae629941c7de467c3ab39fd7cdf08a3054509edc5f318cc2a43a46dc161cdb384528afbd69d430ca6821c2b42f157634e688d3dff6aca4f329423f57975ea24a2fbfeb17ca346addd5f5939d7c882e891d2618a5195f8c6d5f83a630efe8cf4c9ef683938a85b3781094b448f76fe84ff9646e71ab2317f322e8748b40c7709ba24f496e1f9d0d68f8baace9f698c075ee15e0ad50a9eb24928e7683486d6183164e46cc5b8f84fe2b549450abe0e4e8bbc893aa7cf8c285dca5bcd6f995f71de3e3b909c7d753b9f019e440609867", 0xef, 0x2}]})

program did not crash
testing program (duration=31.876258612s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SET_MM_MAP-socket$pppl2tp-openat$selinux_avc_hash_stats-connect$pppl2tp-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE
detailed listing:
executing program 0:
prctl$PR_SET_MM_MAP(0x22, 0xe, 0x0, 0x0)
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
openat$selinux_avc_hash_stats(0xffffffffffffff9c, 0x0, 0x0, 0x0)
connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000600)={{0xffffffffffffffff, &(0x7f0000000080)='\x00', 0x50800, &(0x7f00000000c0)={@_ha_fsid={[0x7, 0x1]}, {0xfff7, 0x80, 0x9c5a, 0xe664}}, 0xd9bf, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0xf3}, 0x4, &(0x7f0000000580)=[{0x2, 0x400, &(0x7f0000000180)='}\x00', &(0x7f00000001c0)="4f57480db6f1672804e0694c0a169fbd873c8e7c711039e3fd6c973dec6a18b45fbad98cea6770a3e6cbcef0a2698c7d1021ae2bc433f7b20679e267d6c8f51ae80708e57bffec199f58daed6aada89b54e3e50fa8be1bc4da57788208f4c4e842", 0x61, 0x38}, {0x1, 0xe0000000, &(0x7f0000000240)='\x00', &(0x7f0000000280)="066afcaf65bbf8a33b5bcf7fa2aaaa11e1a67ce9f6ab044e5a2b6831fd13915ec0b61c9c8e77e800c1a644ccf487fe07416810a0e86e3534dd1cd6ffdcc9e7cff5225fc1f5fe34e4d734541abcb36dfe6e8b42b6c7b09e0f31d273e2db3e389ffdb1279f09a98bc65f1e183677b1e93902c42a23b2d3fc5edb7fe9d5d20e00358832e9d8579753", 0x87, 0x20}, {0x0, 0x7ff, &(0x7f0000000340)=']\x00', &(0x7f0000000380)="62c13e92ba9a261c76fca7d27cc76e63ff8925ec38f517befc12d1d6000a5f79ac9dd0d9643fba29100a33f67c859e4b90c697c7611845ae580e48ecafd74618b47dd89568a18aec559e1b9bc3b0dadbbc0c0778ac1399a08109b98a7611c7c6607b9478e89cd6670648d4174d0fb2a3047a99d35c4ebc05c0e6fc43883eab9173a0af46be3bf7ce4a539bc015e8aea8ace8775195a5a600a43ddbeeb679c2b17422522fd55cdd4f0d177198c14ddd8871e1f5bd140c", 0xb6, 0xc}, {0x1, 0x0, &(0x7f0000000440)='-%^\x00', &(0x7f0000000480)="3615f17c9879582c8ba8ba0c261ee1080baf88c8cc956509050a9e64aa8e2629ae629941c7de467c3ab39fd7cdf08a3054509edc5f318cc2a43a46dc161cdb384528afbd69d430ca6821c2b42f157634e688d3dff6aca4f329423f57975ea24a2fbfeb17ca346addd5f5939d7c882e891d2618a5195f8c6d5f83a630efe8cf4c9ef683938a85b3781094b448f76fe84ff9646e71ab2317f322e8748b40c7709ba24f496e1f9d0d68f8baace9f698c075ee15e0ad50a9eb24928e7683486d6183164e46cc5b8f84fe2b549450abe0e4e8bbc893aa7cf8c285dca5bcd6f995f71de3e3b909c7d753b9f019e440609867", 0xef, 0x2}]})

program did not crash
testing program (duration=31.876258612s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SET_MM_MAP-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE
detailed listing:
executing program 0:
prctl$PR_SET_MM_MAP(0x22, 0xe, 0x0, 0x0)
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000600)={{r1, &(0x7f0000000080)='\x00', 0x50800, &(0x7f00000000c0)={@_ha_fsid={[0x7, 0x1]}, {0xfff7, 0x80, 0x9c5a, 0xe664}}, 0xd9bf, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0xf3}, 0x4, &(0x7f0000000580)=[{0x2, 0x400, &(0x7f0000000180)='}\x00', &(0x7f00000001c0)="4f57480db6f1672804e0694c0a169fbd873c8e7c711039e3fd6c973dec6a18b45fbad98cea6770a3e6cbcef0a2698c7d1021ae2bc433f7b20679e267d6c8f51ae80708e57bffec199f58daed6aada89b54e3e50fa8be1bc4da57788208f4c4e842", 0x61, 0x38}, {0x1, 0xe0000000, &(0x7f0000000240)='\x00', &(0x7f0000000280)="066afcaf65bbf8a33b5bcf7fa2aaaa11e1a67ce9f6ab044e5a2b6831fd13915ec0b61c9c8e77e800c1a644ccf487fe07416810a0e86e3534dd1cd6ffdcc9e7cff5225fc1f5fe34e4d734541abcb36dfe6e8b42b6c7b09e0f31d273e2db3e389ffdb1279f09a98bc65f1e183677b1e93902c42a23b2d3fc5edb7fe9d5d20e00358832e9d8579753", 0x87, 0x20}, {0x0, 0x7ff, &(0x7f0000000340)=']\x00', &(0x7f0000000380)="62c13e92ba9a261c76fca7d27cc76e63ff8925ec38f517befc12d1d6000a5f79ac9dd0d9643fba29100a33f67c859e4b90c697c7611845ae580e48ecafd74618b47dd89568a18aec559e1b9bc3b0dadbbc0c0778ac1399a08109b98a7611c7c6607b9478e89cd6670648d4174d0fb2a3047a99d35c4ebc05c0e6fc43883eab9173a0af46be3bf7ce4a539bc015e8aea8ace8775195a5a600a43ddbeeb679c2b17422522fd55cdd4f0d177198c14ddd8871e1f5bd140c", 0xb6, 0xc}, {0x1, 0x0, &(0x7f0000000440)='-%^\x00', &(0x7f0000000480)="3615f17c9879582c8ba8ba0c261ee1080baf88c8cc956509050a9e64aa8e2629ae629941c7de467c3ab39fd7cdf08a3054509edc5f318cc2a43a46dc161cdb384528afbd69d430ca6821c2b42f157634e688d3dff6aca4f329423f57975ea24a2fbfeb17ca346addd5f5939d7c882e891d2618a5195f8c6d5f83a630efe8cf4c9ef683938a85b3781094b448f76fe84ff9646e71ab2317f322e8748b40c7709ba24f496e1f9d0d68f8baace9f698c075ee15e0ad50a9eb24928e7683486d6183164e46cc5b8f84fe2b549450abe0e4e8bbc893aa7cf8c285dca5bcd6f995f71de3e3b909c7d753b9f019e440609867", 0xef, 0x2}]})

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=31.876258612s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prctl$PR_SET_MM_MAP-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE
detailed listing:
executing program 0:
prctl$PR_SET_MM_MAP(0x22, 0xe, 0x0, 0x0)
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r0, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(0xffffffffffffffff, 0x4048587b, &(0x7f0000000600)={{r0, &(0x7f0000000080)='\x00', 0x50800, &(0x7f00000000c0)={@_ha_fsid={[0x7, 0x1]}, {0xfff7, 0x80, 0x9c5a, 0xe664}}, 0xd9bf, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0xf3}, 0x4, &(0x7f0000000580)=[{0x2, 0x400, &(0x7f0000000180)='}\x00', &(0x7f00000001c0)="4f57480db6f1672804e0694c0a169fbd873c8e7c711039e3fd6c973dec6a18b45fbad98cea6770a3e6cbcef0a2698c7d1021ae2bc433f7b20679e267d6c8f51ae80708e57bffec199f58daed6aada89b54e3e50fa8be1bc4da57788208f4c4e842", 0x61, 0x38}, {0x1, 0xe0000000, &(0x7f0000000240)='\x00', &(0x7f0000000280)="066afcaf65bbf8a33b5bcf7fa2aaaa11e1a67ce9f6ab044e5a2b6831fd13915ec0b61c9c8e77e800c1a644ccf487fe07416810a0e86e3534dd1cd6ffdcc9e7cff5225fc1f5fe34e4d734541abcb36dfe6e8b42b6c7b09e0f31d273e2db3e389ffdb1279f09a98bc65f1e183677b1e93902c42a23b2d3fc5edb7fe9d5d20e00358832e9d8579753", 0x87, 0x20}, {0x0, 0x7ff, &(0x7f0000000340)=']\x00', &(0x7f0000000380)="62c13e92ba9a261c76fca7d27cc76e63ff8925ec38f517befc12d1d6000a5f79ac9dd0d9643fba29100a33f67c859e4b90c697c7611845ae580e48ecafd74618b47dd89568a18aec559e1b9bc3b0dadbbc0c0778ac1399a08109b98a7611c7c6607b9478e89cd6670648d4174d0fb2a3047a99d35c4ebc05c0e6fc43883eab9173a0af46be3bf7ce4a539bc015e8aea8ace8775195a5a600a43ddbeeb679c2b17422522fd55cdd4f0d177198c14ddd8871e1f5bd140c", 0xb6, 0xc}, {0x1, 0x0, &(0x7f0000000440)='-%^\x00', &(0x7f0000000480)="3615f17c9879582c8ba8ba0c261ee1080baf88c8cc956509050a9e64aa8e2629ae629941c7de467c3ab39fd7cdf08a3054509edc5f318cc2a43a46dc161cdb384528afbd69d430ca6821c2b42f157634e688d3dff6aca4f329423f57975ea24a2fbfeb17ca346addd5f5939d7c882e891d2618a5195f8c6d5f83a630efe8cf4c9ef683938a85b3781094b448f76fe84ff9646e71ab2317f322e8748b40c7709ba24f496e1f9d0d68f8baace9f698c075ee15e0ad50a9eb24928e7683486d6183164e46cc5b8f84fe2b549450abe0e4e8bbc893aa7cf8c285dca5bcd6f995f71de3e3b909c7d753b9f019e440609867", 0xef, 0x2}]})

program did not crash
testing program (duration=31.876258612s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000600)={{r1, &(0x7f0000000080)='\x00', 0x50800, &(0x7f00000000c0)={@_ha_fsid={[0x7, 0x1]}, {0xfff7, 0x80, 0x9c5a, 0xe664}}, 0xd9bf, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0xf3}, 0x4, &(0x7f0000000580)=[{0x2, 0x400, &(0x7f0000000180)='}\x00', &(0x7f00000001c0)="4f57480db6f1672804e0694c0a169fbd873c8e7c711039e3fd6c973dec6a18b45fbad98cea6770a3e6cbcef0a2698c7d1021ae2bc433f7b20679e267d6c8f51ae80708e57bffec199f58daed6aada89b54e3e50fa8be1bc4da57788208f4c4e842", 0x61, 0x38}, {0x1, 0xe0000000, &(0x7f0000000240)='\x00', &(0x7f0000000280)="066afcaf65bbf8a33b5bcf7fa2aaaa11e1a67ce9f6ab044e5a2b6831fd13915ec0b61c9c8e77e800c1a644ccf487fe07416810a0e86e3534dd1cd6ffdcc9e7cff5225fc1f5fe34e4d734541abcb36dfe6e8b42b6c7b09e0f31d273e2db3e389ffdb1279f09a98bc65f1e183677b1e93902c42a23b2d3fc5edb7fe9d5d20e00358832e9d8579753", 0x87, 0x20}, {0x0, 0x7ff, &(0x7f0000000340)=']\x00', &(0x7f0000000380)="62c13e92ba9a261c76fca7d27cc76e63ff8925ec38f517befc12d1d6000a5f79ac9dd0d9643fba29100a33f67c859e4b90c697c7611845ae580e48ecafd74618b47dd89568a18aec559e1b9bc3b0dadbbc0c0778ac1399a08109b98a7611c7c6607b9478e89cd6670648d4174d0fb2a3047a99d35c4ebc05c0e6fc43883eab9173a0af46be3bf7ce4a539bc015e8aea8ace8775195a5a600a43ddbeeb679c2b17422522fd55cdd4f0d177198c14ddd8871e1f5bd140c", 0xb6, 0xc}, {0x1, 0x0, &(0x7f0000000440)='-%^\x00', &(0x7f0000000480)="3615f17c9879582c8ba8ba0c261ee1080baf88c8cc956509050a9e64aa8e2629ae629941c7de467c3ab39fd7cdf08a3054509edc5f318cc2a43a46dc161cdb384528afbd69d430ca6821c2b42f157634e688d3dff6aca4f329423f57975ea24a2fbfeb17ca346addd5f5939d7c882e891d2618a5195f8c6d5f83a630efe8cf4c9ef683938a85b3781094b448f76fe84ff9646e71ab2317f322e8748b40c7709ba24f496e1f9d0d68f8baace9f698c075ee15e0ad50a9eb24928e7683486d6183164e46cc5b8f84fe2b549450abe0e4e8bbc893aa7cf8c285dca5bcd6f995f71de3e3b909c7d753b9f019e440609867", 0xef, 0x2}]})

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=31.876258612s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, 0x0, 0x0)
ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000000600)={{r1, &(0x7f0000000080)='\x00', 0x50800, &(0x7f00000000c0)={@_ha_fsid={[0x7, 0x1]}, {0xfff7, 0x80, 0x9c5a, 0xe664}}, 0xd9bf, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0xf3}, 0x4, &(0x7f0000000580)=[{0x2, 0x400, &(0x7f0000000180)='}\x00', &(0x7f00000001c0)="4f57480db6f1672804e0694c0a169fbd873c8e7c711039e3fd6c973dec6a18b45fbad98cea6770a3e6cbcef0a2698c7d1021ae2bc433f7b20679e267d6c8f51ae80708e57bffec199f58daed6aada89b54e3e50fa8be1bc4da57788208f4c4e842", 0x61, 0x38}, {0x1, 0xe0000000, &(0x7f0000000240)='\x00', &(0x7f0000000280)="066afcaf65bbf8a33b5bcf7fa2aaaa11e1a67ce9f6ab044e5a2b6831fd13915ec0b61c9c8e77e800c1a644ccf487fe07416810a0e86e3534dd1cd6ffdcc9e7cff5225fc1f5fe34e4d734541abcb36dfe6e8b42b6c7b09e0f31d273e2db3e389ffdb1279f09a98bc65f1e183677b1e93902c42a23b2d3fc5edb7fe9d5d20e00358832e9d8579753", 0x87, 0x20}, {0x0, 0x7ff, &(0x7f0000000340)=']\x00', &(0x7f0000000380)="62c13e92ba9a261c76fca7d27cc76e63ff8925ec38f517befc12d1d6000a5f79ac9dd0d9643fba29100a33f67c859e4b90c697c7611845ae580e48ecafd74618b47dd89568a18aec559e1b9bc3b0dadbbc0c0778ac1399a08109b98a7611c7c6607b9478e89cd6670648d4174d0fb2a3047a99d35c4ebc05c0e6fc43883eab9173a0af46be3bf7ce4a539bc015e8aea8ace8775195a5a600a43ddbeeb679c2b17422522fd55cdd4f0d177198c14ddd8871e1f5bd140c", 0xb6, 0xc}, {0x1, 0x0, &(0x7f0000000440)='-%^\x00', &(0x7f0000000480)="3615f17c9879582c8ba8ba0c261ee1080baf88c8cc956509050a9e64aa8e2629ae629941c7de467c3ab39fd7cdf08a3054509edc5f318cc2a43a46dc161cdb384528afbd69d430ca6821c2b42f157634e688d3dff6aca4f329423f57975ea24a2fbfeb17ca346addd5f5939d7c882e891d2618a5195f8c6d5f83a630efe8cf4c9ef683938a85b3781094b448f76fe84ff9646e71ab2317f322e8748b40c7709ba24f496e1f9d0d68f8baace9f698c075ee15e0ad50a9eb24928e7683486d6183164e46cc5b8f84fe2b549450abe0e4e8bbc893aa7cf8c285dca5bcd6f995f71de3e3b909c7d753b9f019e440609867", 0xef, 0x2}]})

program did not crash
testing program (duration=31.876258612s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, 0x0)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
extracting C reproducer
testing compiled C program (duration=31.876258612s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE
program crashed: KASAN: use-after-free Write in pppol2tp_release
simplifying C reproducer
testing compiled C program (duration=31.876258612s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE
program crashed: KASAN: use-after-free Write in pppol2tp_release
testing compiled C program (duration=31.876258612s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE
program crashed: KASAN: use-after-free Write in pppol2tp_release
testing compiled C program (duration=31.876258612s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE
program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing compiled C program (duration=31.876258612s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE
program did not crash
testing compiled C program (duration=31.876258612s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE
program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing compiled C program (duration=31.876258612s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE
program did not crash
testing program (duration=31.876258612s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, 0x0)

program crashed: KASAN: use-after-free Write in pppol2tp_release
validation run: crashed=true
testing program (duration=31.876258612s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, 0x0)

program crashed: KASAN: use-after-free Write in pppol2tp_release
validation run: crashed=true
testing program (duration=31.876258612s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e24, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, 0x0)

program crashed: KASAN: use-after-free Write in pppol2tp_release
validation run: crashed=true
reproducing took 25m18.184491984s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
BUG: KASAN: use-after-free in atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline]
BUG: KASAN: use-after-free in atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline]
BUG: KASAN: use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:173 [inline]
BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298
Write of size 8 at addr ffff8881119a5950 by task syz.2.17/396

CPU: 0 PID: 396 Comm: syz.2.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 __dump_stack+0x21/0x24 lib/dump_stack.c:77
 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:435 [inline]
 kasan_report+0x100/0x140 mm/kasan/report.c:452
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189
 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37
 instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
 atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline]
 atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline]
 __mutex_trylock_fast kernel/locking/mutex.c:173 [inline]
 mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298
 pppol2tp_release+0x178/0x2b0 net/l2tp/l2tp_ppp.c:442
 __sock_release net/socket.c:597 [inline]
 sock_close+0xb8/0x200 net/socket.c:1287
 __fput+0x2dc/0x730 fs/file_table.c:281
 ____fput+0x15/0x20 fs/file_table.c:314
 task_work_run+0x127/0x190 kernel/task_work.c:189
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172
 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199
 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274
 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f68b53520d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffccb5f1808 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007ffccb5f18f0 RCX: 00007f68b53520d9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 0000000000006805 R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b32b20000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f68b55d9fac R14: 00007f68b55d9fa8 R15: 00007f68b55d9fa0

Allocated by task 396:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:430 [inline]
 ____kasan_kmalloc mm/kasan/common.c:509 [inline]
 __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:518
 kasan_kmalloc include/linux/kasan.h:254 [inline]
 __kmalloc+0x19f/0x330 mm/slub.c:4038
 kmalloc include/linux/slab.h:560 [inline]
 kzalloc include/linux/slab.h:667 [inline]
 l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616
 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772
 __sys_connect_file net/socket.c:1867 [inline]
 __sys_connect+0x3ce/0x450 net/socket.c:1884
 __do_sys_connect net/socket.c:1894 [inline]
 __se_sys_connect net/socket.c:1891 [inline]
 __x64_sys_connect+0x7a/0x90 net/socket.c:1891
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

Freed by task 396:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4a/0x70 mm/kasan/common.c:45
 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:362
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370
 kasan_slab_free include/linux/kasan.h:220 [inline]
 slab_free_hook mm/slub.c:1600 [inline]
 slab_free_freelist_hook+0xc5/0x190 mm/slub.c:1626
 slab_free mm/slub.c:3208 [inline]
 kfree+0xc0/0x270 mm/slub.c:4196
 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline]
 l2tp_session_put+0xb2/0x1a0 net/l2tp/l2tp_core.c:193
 l2tp_session_delete+0x3a9/0x4a0 net/l2tp/l2tp_core.c:1589
 pppol2tp_release+0x169/0x2b0 net/l2tp/l2tp_ppp.c:439
 __sock_release net/socket.c:597 [inline]
 sock_close+0xb8/0x200 net/socket.c:1287
 __fput+0x2dc/0x730 fs/file_table.c:281
 ____fput+0x15/0x20 fs/file_table.c:314
 task_work_run+0x127/0x190 kernel/task_work.c:189
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172
 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199
 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274
 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

The buggy address belongs to the object at ffff8881119a5800
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 336 bytes inside of
 512-byte region [ffff8881119a5800, ffff8881119a5a00)
The buggy address belongs to the page:
page:ffffea0004466900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1119a4
head:ffffea0004466900 order:2 compound_mapcount:0 compound_pincount:0
flags: 0x4000000000010200(slab|head)
raw: 4000000000010200 ffffea00043f1b00 0000000500000005 ffff888100043080
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 99, ts 3724280949, free_ts 0
 set_page_owner include/linux/page_owner.h:35 [inline]
 post_alloc_hook mm/page_alloc.c:2456 [inline]
 prep_new_page+0x176/0x190 mm/page_alloc.c:2462
 get_page_from_freelist+0x225f/0x23f0 mm/page_alloc.c:4254
 __alloc_pages_nodemask+0x29a/0x640 mm/page_alloc.c:5384
 alloc_slab_page mm/slub.c:-1 [inline]
 allocate_slab mm/slub.c:1813 [inline]
 new_slab+0x84/0x3f0 mm/slub.c:1874
 new_slab_objects mm/slub.c:2632 [inline]
 ___slab_alloc+0x2f8/0x4c0 mm/slub.c:2796
 __slab_alloc+0x63/0xa0 mm/slub.c:2836
 slab_alloc_node mm/slub.c:2918 [inline]
 slab_alloc mm/slub.c:2960 [inline]
 __kmalloc_track_caller+0x1e4/0x310 mm/slub.c:4541
 __kmalloc_reserve net/core/skbuff.c:144 [inline]
 __alloc_skb+0xdc/0x520 net/core/skbuff.c:212
 alloc_skb include/linux/skbuff.h:1126 [inline]
 alloc_skb_with_frags+0xa3/0x560 net/core/skbuff.c:6019
 sock_alloc_send_pskb+0x87f/0x9a0 net/core/sock.c:2393
 unix_dgram_sendmsg+0x6f3/0x18f0 net/unix/af_unix.c:1725
 sock_sendmsg_nosec net/socket.c:652 [inline]
 __sock_sendmsg net/socket.c:664 [inline]
 sock_write_iter+0x2a6/0x3a0 net/socket.c:1019
 call_write_iter include/linux/fs.h:2066 [inline]
 new_sync_write fs/read_write.c:518 [inline]
 vfs_write+0x770/0xd70 fs/read_write.c:605
 ksys_write+0x14a/0x260 fs/read_write.c:658
 __do_sys_write fs/read_write.c:670 [inline]
 __se_sys_write fs/read_write.c:667 [inline]
 __x64_sys_write+0x7b/0x90 fs/read_write.c:667
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
page_owner free stack trace missing

Memory state around the buggy address:
 ffff8881119a5800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8881119a5880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8881119a5900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                 ^
 ffff8881119a5980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8881119a5a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
BUG: KASAN: use-after-free in atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline]
BUG: KASAN: use-after-free in atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline]
BUG: KASAN: use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:173 [inline]
BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298
Write of size 8 at addr ffff8881119a5950 by task syz.2.17/396

CPU: 0 PID: 396 Comm: syz.2.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 __dump_stack+0x21/0x24 lib/dump_stack.c:77
 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:435 [inline]
 kasan_report+0x100/0x140 mm/kasan/report.c:452
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189
 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37
 instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
 atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline]
 atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline]
 __mutex_trylock_fast kernel/locking/mutex.c:173 [inline]
 mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298
 pppol2tp_release+0x178/0x2b0 net/l2tp/l2tp_ppp.c:442
 __sock_release net/socket.c:597 [inline]
 sock_close+0xb8/0x200 net/socket.c:1287
 __fput+0x2dc/0x730 fs/file_table.c:281
 ____fput+0x15/0x20 fs/file_table.c:314
 task_work_run+0x127/0x190 kernel/task_work.c:189
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172
 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199
 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274
 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f68b53520d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffccb5f1808 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007ffccb5f18f0 RCX: 00007f68b53520d9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 0000000000006805 R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b32b20000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f68b55d9fac R14: 00007f68b55d9fa8 R15: 00007f68b55d9fa0

Allocated by task 396:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:430 [inline]
 ____kasan_kmalloc mm/kasan/common.c:509 [inline]
 __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:518
 kasan_kmalloc include/linux/kasan.h:254 [inline]
 __kmalloc+0x19f/0x330 mm/slub.c:4038
 kmalloc include/linux/slab.h:560 [inline]
 kzalloc include/linux/slab.h:667 [inline]
 l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616
 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772
 __sys_connect_file net/socket.c:1867 [inline]
 __sys_connect+0x3ce/0x450 net/socket.c:1884
 __do_sys_connect net/socket.c:1894 [inline]
 __se_sys_connect net/socket.c:1891 [inline]
 __x64_sys_connect+0x7a/0x90 net/socket.c:1891
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

Freed by task 396:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4a/0x70 mm/kasan/common.c:45
 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:362
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370
 kasan_slab_free include/linux/kasan.h:220 [inline]
 slab_free_hook mm/slub.c:1600 [inline]
 slab_free_freelist_hook+0xc5/0x190 mm/slub.c:1626
 slab_free mm/slub.c:3208 [inline]
 kfree+0xc0/0x270 mm/slub.c:4196
 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline]
 l2tp_session_put+0xb2/0x1a0 net/l2tp/l2tp_core.c:193
 l2tp_session_delete+0x3a9/0x4a0 net/l2tp/l2tp_core.c:1589
 pppol2tp_release+0x169/0x2b0 net/l2tp/l2tp_ppp.c:439
 __sock_release net/socket.c:597 [inline]
 sock_close+0xb8/0x200 net/socket.c:1287
 __fput+0x2dc/0x730 fs/file_table.c:281
 ____fput+0x15/0x20 fs/file_table.c:314
 task_work_run+0x127/0x190 kernel/task_work.c:189
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172
 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199
 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274
 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

The buggy address belongs to the object at ffff8881119a5800
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 336 bytes inside of
 512-byte region [ffff8881119a5800, ffff8881119a5a00)
The buggy address belongs to the page:
page:ffffea0004466900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1119a4
head:ffffea0004466900 order:2 compound_mapcount:0 compound_pincount:0
flags: 0x4000000000010200(slab|head)
raw: 4000000000010200 ffffea00043f1b00 0000000500000005 ffff888100043080
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 99, ts 3724280949, free_ts 0
 set_page_owner include/linux/page_owner.h:35 [inline]
 post_alloc_hook mm/page_alloc.c:2456 [inline]
 prep_new_page+0x176/0x190 mm/page_alloc.c:2462
 get_page_from_freelist+0x225f/0x23f0 mm/page_alloc.c:4254
 __alloc_pages_nodemask+0x29a/0x640 mm/page_alloc.c:5384
 alloc_slab_page mm/slub.c:-1 [inline]
 allocate_slab mm/slub.c:1813 [inline]
 new_slab+0x84/0x3f0 mm/slub.c:1874
 new_slab_objects mm/slub.c:2632 [inline]
 ___slab_alloc+0x2f8/0x4c0 mm/slub.c:2796
 __slab_alloc+0x63/0xa0 mm/slub.c:2836
 slab_alloc_node mm/slub.c:2918 [inline]
 slab_alloc mm/slub.c:2960 [inline]
 __kmalloc_track_caller+0x1e4/0x310 mm/slub.c:4541
 __kmalloc_reserve net/core/skbuff.c:144 [inline]
 __alloc_skb+0xdc/0x520 net/core/skbuff.c:212
 alloc_skb include/linux/skbuff.h:1126 [inline]
 alloc_skb_with_frags+0xa3/0x560 net/core/skbuff.c:6019
 sock_alloc_send_pskb+0x87f/0x9a0 net/core/sock.c:2393
 unix_dgram_sendmsg+0x6f3/0x18f0 net/unix/af_unix.c:1725
 sock_sendmsg_nosec net/socket.c:652 [inline]
 __sock_sendmsg net/socket.c:664 [inline]
 sock_write_iter+0x2a6/0x3a0 net/socket.c:1019
 call_write_iter include/linux/fs.h:2066 [inline]
 new_sync_write fs/read_write.c:518 [inline]
 vfs_write+0x770/0xd70 fs/read_write.c:605
 ksys_write+0x14a/0x260 fs/read_write.c:658
 __do_sys_write fs/read_write.c:670 [inline]
 __se_sys_write fs/read_write.c:667 [inline]
 __x64_sys_write+0x7b/0x90 fs/read_write.c:667
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
page_owner free stack trace missing

Memory state around the buggy address:
 ffff8881119a5800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8881119a5880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8881119a5900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                 ^
 ffff8881119a5980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8881119a5a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================