Extracting prog: 2m33.792914028s
Minimizing prog: 19m42.848882056s
Simplifying prog options: 0s
Extracting C: 26.740206136s
Simplifying C: 6m10.440912065s


extracting reproducer from 59 programs
testing a last program of every proc
single: executing 14 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-openat$hwrng-syz_mount_image$vfat-openat$dir-getdents64-openat$kvm-sendmsg$nl_route-ioctl$KVM_CREATE_VM-openat$cgroup_ro-bpf$PROG_LOAD-write$binfmt_script-mmap-preadv-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_CREATE_VCPU-openat$dir-openat$selinux_commit_pending_bools-socket$nl_xfrm-sendmsg$nl_xfrm-writev-getdents64-syz_kvm_setup_cpu$x86-socket$nl_route-socket$inet6_udp-ioctl$sock_SIOCGIFINDEX-socket$nl_route-setsockopt$IPT_SO_SET_REPLACE-socket$inet-setsockopt$inet_msfilter-bpf$BPF_GET_PROG_INFO
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x80c00, 0x0)
syz_mount_image$vfat(&(0x7f00000000c0), &(0x7f0000000040)='./file0\x00', 0x8000, &(0x7f00000004c0)=ANY=[@ANYBLOB="73686f72746e616d653d6c6f7765722c756e695f786c6174653d302c756e695f786c6174653d312c636f6465706167653d3933362c73686f72746e616d653d6c6f7765722c726f6469722c696f636861727365743d6b6f69382d752c73686f72746e746d653d6c6f7765722c756e695f786c6174653d312c696f636861727365743d6370313235312c756e695f786c6174653d302c726f6469722c757466383d302c0000e3b256c8cf"], 0x2a, 0x356, &(0x7f0000000780)="$eJzs3U1oHOUbAPBnO5tsGug/Ofyh6Gn1JkhpIh7US0KpUMxBK4tfFxeb+pFdC1lcSA7Z5qJ4VLwIigdvPejBQ8/iQcSbB69WkKp4sbdAiyO7M9nZr9ho2dTi73cID8/7PvO+M/OSnYTdd19eiY0LM3Hxxo3rMTdXivLKmZXYK8ViHIskMpdjgvKkJABwL9hL0/g9zdy+9/vz+9HslOcFAExP7/X/1RNFonI3ZwMAHIVD/v3/9MTspalNCwCYor0Yef1/cKh55N/85f57AgCAe9ezL7z41OpaxPlqdS6i+U671q7F40X76sV4PRqxHqdjIW5FZA8K2dNC9+eT59bOnq52/bwYtW5FuxbR7LRr2ZPCatKrr8RSLMRiXp/265Nu/VKvvhoRlzu98aNZatdmYj4f/4f5WI/lWIj/j9VHnFs7u1zND1Br7td3InZjbv8kuvM/FQvx3StxKRpxIbq1xfx3lqrVM+naUH37SqXX7yCfeP8jAAAAAAAAAAAAAAAAAAAAAAB34FS1b7G//03a7LTfPj/aYXFof5xa1pzvD7Sb7Q+UVvZ353k3Gd0faHh/nnatHMfu6pkDAAAAAAAAAAAAAAAAAADAv0drazbqjcb6Zmtre2Mw6Axk3vzms6+Ox2ifN5IiE+XscEN98lwMVCXRL0/75Wky1CcPkoii85Wr/RkP9qn0z2J7fzOBweNUsqaBTCmfU73ROPHATx+NDbq1vfFHkUli7LIMB6XxQZv/y1J/UXVwsHybPtfSND2ofOfD8aooRZTHbtydBLN58PX11+57pHXy0V7Tl/mmDw89vPDctQ8+/XWj3oj80jQas5utW+k/GSuyW1CsjVJ+nUsTVsLkYLfI7G62turJ9789f/973450TmJSeXfxFJm3Dh7r89HMbBZ0p3mYM52ZsPgnBE98UX/pZn/1/v07ePLjlfrVnR9/OWzVwC8JG3UAAAAAAAAAAAAAAAAAAMCRGPi49aFkn71+7JnpzgoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAjlbx/f8Dwe5Y5jDBzU6MN1XWN1sHDn78SE8VAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID/sD8DAAD//9npcg0=")
r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x101000, 0x108)
getdents64(r0, &(0x7f0000000f80)=""/4096, 0x1000)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x40800}, 0x40)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94)
write$binfmt_script(r3, &(0x7f0000000000), 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r3, 0x0)
preadv(r3, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r5 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0)
r6 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0)
r7 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r7, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000b00)=ANY=[@ANYBLOB="7c01000019000100000000000000000000000000560000000000ffff0a010101ac1414420000000000000000000000004e230000000080000a00000000000000a3ce122cde86dbd4715cac69209d2d5501eee1a6bd2f8e229cceff0269f407003898b064b2353ba4da33c048ecad73146b0e3b3de8f2150fc2250e73d5e7c9baa87d8132b569a2809ef10e32839323150de7f51b2b345d9df1ff5cf7ca42ddc8eed0d4a885a859efff0845e9e9f79f9578d0b0165f3436b2e1eae1817ab8785aa1e90f394106870e8893b711531845fca7fbeff469e8822ac31c0b9de978", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000000000000000000000000000000000000000000000000000000000000000000000000000c4000500ff010000000000000000000000000001000004d2330000000a000000000000000000000000000000000000000135000001003b00830000000500000005000000e0000001000000000000000000000000000004d56c00000002000000000000000000000000000000000000000000000001030300040000000200000003000000fe880000000000000000000000000001000004d32b000000000000000a010103000000000000000000000000023500000500d1000e0000007b04000003000000"], 0x17c}}, 0x4894)
writev(r6, &(0x7f0000000480)=[{&(0x7f0000000240)='4', 0x1}], 0x1)
getdents64(r5, &(0x7f0000000280)=""/213, 0xd5)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r8 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r8, 0x8933, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x188, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x7fffffe, 0x0, {[{{@uncond, 0x6, 0xa8, 0xf0, 0x0, {}, [@common=@unspec=@time={{0x38}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}, {{@ip={@local, @local, 0x0, 0x0, 'veth0_to_team\x00', 'veth1_virt_wifi\x00'}, 0x0, 0x70, 0x98}, @common=@unspec=@NFQUEUE0={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x280)
r9 = socket$inet(0x2, 0x1, 0x0)
setsockopt$inet_msfilter(r9, 0x0, 0x29, &(0x7f0000000140)=ANY=[@ANYBLOB="e0000001ac1414aa0000000003"], 0x1c)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={0xffffffffffffffff, 0xe0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x4, 0x7, &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x38, &(0x7f00000001c0)=[{}, {}, {}, {}, {}], 0x28, 0x10, &(0x7f0000000200), &(0x7f0000000240), 0x8, 0x1b, 0x8, 0x8, &(0x7f0000000280)}}, 0x10)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-openat$hwrng-syz_mount_image$vfat-openat$dir-getdents64-openat$kvm-sendmsg$nl_route-ioctl$KVM_CREATE_VM-openat$cgroup_ro-bpf$PROG_LOAD-write$binfmt_script-mmap-preadv-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_CREATE_VCPU-openat$dir-openat$selinux_commit_pending_bools-socket$nl_xfrm-sendmsg$nl_xfrm-writev-getdents64-syz_kvm_setup_cpu$x86-socket$nl_route-socket$inet6_udp-ioctl$sock_SIOCGIFINDEX-socket$nl_route-setsockopt$IPT_SO_SET_REPLACE-socket$inet-setsockopt$inet_msfilter-bpf$BPF_GET_PROG_INFO
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x80c00, 0x0)
syz_mount_image$vfat(&(0x7f00000000c0), &(0x7f0000000040)='./file0\x00', 0x8000, &(0x7f00000004c0)=ANY=[@ANYBLOB="73686f72746e616d653d6c6f7765722c756e695f786c6174653d302c756e695f786c6174653d312c636f6465706167653d3933362c73686f72746e616d653d6c6f7765722c726f6469722c696f636861727365743d6b6f69382d752c73686f72746e746d653d6c6f7765722c756e695f786c6174653d312c696f636861727365743d6370313235312c756e695f786c6174653d302c726f6469722c757466383d302c0000e3b256c8cf"], 0x2a, 0x356, &(0x7f0000000780)="$eJzs3U1oHOUbAPBnO5tsGug/Ofyh6Gn1JkhpIh7US0KpUMxBK4tfFxeb+pFdC1lcSA7Z5qJ4VLwIigdvPejBQ8/iQcSbB69WkKp4sbdAiyO7M9nZr9ho2dTi73cID8/7PvO+M/OSnYTdd19eiY0LM3Hxxo3rMTdXivLKmZXYK8ViHIskMpdjgvKkJABwL9hL0/g9zdy+9/vz+9HslOcFAExP7/X/1RNFonI3ZwMAHIVD/v3/9MTspalNCwCYor0Yef1/cKh55N/85f57AgCAe9ezL7z41OpaxPlqdS6i+U671q7F40X76sV4PRqxHqdjIW5FZA8K2dNC9+eT59bOnq52/bwYtW5FuxbR7LRr2ZPCatKrr8RSLMRiXp/265Nu/VKvvhoRlzu98aNZatdmYj4f/4f5WI/lWIj/j9VHnFs7u1zND1Br7td3InZjbv8kuvM/FQvx3StxKRpxIbq1xfx3lqrVM+naUH37SqXX7yCfeP8jAAAAAAAAAAAAAAAAAAAAAAB34FS1b7G//03a7LTfPj/aYXFof5xa1pzvD7Sb7Q+UVvZ353k3Gd0faHh/nnatHMfu6pkDAAAAAAAAAAAAAAAAAADAv0drazbqjcb6Zmtre2Mw6Axk3vzms6+Ox2ifN5IiE+XscEN98lwMVCXRL0/75Wky1CcPkoii85Wr/RkP9qn0z2J7fzOBweNUsqaBTCmfU73ROPHATx+NDbq1vfFHkUli7LIMB6XxQZv/y1J/UXVwsHybPtfSND2ofOfD8aooRZTHbtydBLN58PX11+57pHXy0V7Tl/mmDw89vPDctQ8+/XWj3oj80jQas5utW+k/GSuyW1CsjVJ+nUsTVsLkYLfI7G62turJ9789f/973450TmJSeXfxFJm3Dh7r89HMbBZ0p3mYM52ZsPgnBE98UX/pZn/1/v07ePLjlfrVnR9/OWzVwC8JG3UAAAAAAAAAAAAAAAAAAMCRGPi49aFkn71+7JnpzgoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAjlbx/f8Dwe5Y5jDBzU6MN1XWN1sHDn78SE8VAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID/sD8DAAD//9npcg0=")
r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x101000, 0x108)
getdents64(r0, &(0x7f0000000f80)=""/4096, 0x1000)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1e9100, 0x0)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x40800}, 0x40)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94)
write$binfmt_script(r3, &(0x7f0000000000), 0x208e24b)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r3, 0x0)
preadv(r3, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r5 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0)
r6 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0)
r7 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r7, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000b00)=ANY=[@ANYBLOB="7c01000019000100000000000000000000000000560000000000ffff0a010101ac1414420000000000000000000000004e230000000080000a00000000000000a3ce122cde86dbd4715cac69209d2d5501eee1a6bd2f8e229cceff0269f407003898b064b2353ba4da33c048ecad73146b0e3b3de8f2150fc2250e73d5e7c9baa87d8132b569a2809ef10e32839323150de7f51b2b345d9df1ff5cf7ca42ddc8eed0d4a885a859efff0845e9e9f79f9578d0b0165f3436b2e1eae1817ab8785aa1e90f394106870e8893b711531845fca7fbeff469e8822ac31c0b9de978", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000000000000000000000000000000000000000000000000000000000000000000000000000c4000500ff010000000000000000000000000001000004d2330000000a000000000000000000000000000000000000000135000001003b00830000000500000005000000e0000001000000000000000000000000000004d56c00000002000000000000000000000000000000000000000000000001030300040000000200000003000000fe880000000000000000000000000001000004d32b000000000000000a010103000000000000000000000000023500000500d1000e0000007b04000003000000"], 0x17c}}, 0x4894)
writev(r6, &(0x7f0000000480)=[{&(0x7f0000000240)='4', 0x1}], 0x1)
getdents64(r5, &(0x7f0000000280)=""/213, 0xd5)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x54, 0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r8 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r8, 0x8933, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x220, 0x0, 0xffffffff, 0xffffffff, 0xf0, 0xffffffff, 0x188, 0xffffffff, 0xffffffff, 0x188, 0xffffffff, 0x7fffffe, 0x0, {[{{@uncond, 0x6, 0xa8, 0xf0, 0x0, {}, [@common=@unspec=@time={{0x38}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}, {{@ip={@local, @local, 0x0, 0x0, 'veth0_to_team\x00', 'veth1_virt_wifi\x00'}, 0x0, 0x70, 0x98}, @common=@unspec=@NFQUEUE0={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x280)
r9 = socket$inet(0x2, 0x1, 0x0)
setsockopt$inet_msfilter(r9, 0x0, 0x29, &(0x7f0000000140)=ANY=[@ANYBLOB="e0000001ac1414aa0000000003"], 0x1c)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={0xffffffffffffffff, 0xe0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x4, 0x7, &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x38, &(0x7f00000001c0)=[{}, {}, {}, {}, {}], 0x28, 0x10, &(0x7f0000000200), &(0x7f0000000240), 0x8, 0x1b, 0x8, 0x8, &(0x7f0000000280)}}, 0x10)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-socket$nl_generic-syz_genetlink_get_family_id$mptcp-ioctl$TUNSETIFF-socket$inet6-setsockopt$inet6_udp_int-bpf$BPF_PROG_WITH_BTFID_LOAD-socket$nl_route-socketpair$unix-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bind$inet6-syz_emit_ethernet-sendmsg$nl_route-setsockopt$sock_linger-sendmmsg$inet6-write$tun-bpf$PROG_LOAD-syz_open_dev$tty1-keyctl$clear-syz_open_dev$evdev-ioctl$TIOCCBRK-ioctl$EVIOCGRAB-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL-ioctl$BTRFS_IOC_SNAP_CREATE_V2-ioctl$PIO_UNIMAP
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), r1)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000040)=0xd, 0x4)
r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x6, &(0x7f0000000040)=@framed={{}, [@map_val, @ldst={0x3, 0x0, 0x6, 0x0, 0x0, 0x18}]}, &(0x7f0000000180)='syzkaller\x00', 0x5, 0xd2, &(0x7f00000002c0)=""/210}, 0x22)
r4 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', <r6=>0x0})
r7 = socket$pppl2tp(0x18, 0x1, 0x1)
r8 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r7, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r8, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
bind$inet6(r8, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c)
syz_emit_ethernet(0x4c, &(0x7f0000000240)={@multicast, @multicast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x16, 0x11, 0xff, @remote, @local, {[], {0x0, 0xe22, 0x16, 0x0, @gue={{0x1, 0x0, 0x0, 0x3, 0x0, @void}, '\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}}}}, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@newlink={0x2c, 0x10, 0x1, 0x470bd27, 0x25dfd402, {0x0, 0x0, 0x0, r6, 0x6e494, 0x16ac1}, [@IFLA_BROADCAST={0xa, 0x2, @remote}]}, 0x2c}}, 0x88c2)
setsockopt$sock_linger(r2, 0x1, 0x3c, &(0x7f0000000180)={0xfffffffd}, 0x8)
sendmmsg$inet6(r2, &(0x7f0000000380)=[{{&(0x7f0000000140)={0xa, 0x4e20, 0x10, @mcast2, 0x5}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000080)="c2fb8e95213f23e208cf81fbe16df0", 0xf}], 0x1}}], 0x1, 0x4001c00)
write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="08008808070400000000de850000430200b30065000002029078ffffffffe0000002940400004434d971e0000001000000037f00000100000007ac14140b80000001ffffffff0000000600000000000037afffffffff0000000512969078ac1e0001b9b80b0bc9c1fe0efada77dc87429444f7175a31fc4adc603b5b84059d55f138eefe1c1edc75d4a29fab94a5c57767054357a44d40c0da4bdb1b99dc2e0c646d6a9b80111fc35aa1efc7107240768eb5e184049272482c46c140715bfaa0818beea0cc53f24c263ce50c6adc325b361f712af6fc78ff79941513504d3bc73fbdc82de19223bff66410692ca3d9ee5fc1dc9dc58c45b90e34d5c3cea764"], 0xc1)
bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r9 = syz_open_dev$tty1(0xc, 0x4, 0x1)
keyctl$clear(0x11, 0xfffffffffffffffd)
r10 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffc, 0x822b01)
ioctl$TIOCCBRK(r9, 0x5428)
ioctl$EVIOCGRAB(r10, 0x40044590, &(0x7f0000000540)=0x5001)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r7, 0xc0c89425, &(0x7f0000000580)={"edef8b3ff8586be14e686d36a27ae99b", <r11=>0x0, 0x0, {0x8, 0x2}, {0x9, 0x1}, 0x3, [0x398c, 0x101, 0x7, 0x5, 0x5, 0x7, 0x0, 0x400, 0x5, 0x0, 0x3, 0x9, 0xfff, 0x1, 0x1, 0x37f]})
ioctl$BTRFS_IOC_SNAP_CREATE_V2(r7, 0x50009417, &(0x7f0000000780)={{r3}, r11, 0x12, @inherit={0x50, &(0x7f0000000680)={0x1, 0x1, 0x7fffffffffffffff, 0x8, {0xc, 0x2, 0x2, 0x5f1c, 0x2}, [0x10001]}}, @subvolid=0x4})
ioctl$PIO_UNIMAP(r9, 0x4b52, &(0x7f0000000100)={0xfffffffffffffe91, 0x0})

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
single: successfully extracted reproducer
found reproducer with 28 syscalls
minimizing guilty program
testing program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-socket$nl_generic-syz_genetlink_get_family_id$mptcp-ioctl$TUNSETIFF-socket$inet6-setsockopt$inet6_udp_int-bpf$BPF_PROG_WITH_BTFID_LOAD-socket$nl_route-socketpair$unix-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bind$inet6-syz_emit_ethernet-sendmsg$nl_route-setsockopt$sock_linger-sendmmsg$inet6-write$tun-bpf$PROG_LOAD-syz_open_dev$tty1-keyctl$clear-syz_open_dev$evdev-ioctl$TIOCCBRK-ioctl$EVIOCGRAB-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL-ioctl$BTRFS_IOC_SNAP_CREATE_V2
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), r1)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000040)=0xd, 0x4)
r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x6, &(0x7f0000000040)=@framed={{}, [@map_val, @ldst={0x3, 0x0, 0x6, 0x0, 0x0, 0x18}]}, &(0x7f0000000180)='syzkaller\x00', 0x5, 0xd2, &(0x7f00000002c0)=""/210}, 0x22)
r4 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, <r5=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', <r6=>0x0})
r7 = socket$pppl2tp(0x18, 0x1, 0x1)
r8 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r7, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r8, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
bind$inet6(r8, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c)
syz_emit_ethernet(0x4c, &(0x7f0000000240)={@multicast, @multicast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x16, 0x11, 0xff, @remote, @local, {[], {0x0, 0xe22, 0x16, 0x0, @gue={{0x1, 0x0, 0x0, 0x3, 0x0, @void}, '\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}}}}, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@newlink={0x2c, 0x10, 0x1, 0x470bd27, 0x25dfd402, {0x0, 0x0, 0x0, r6, 0x6e494, 0x16ac1}, [@IFLA_BROADCAST={0xa, 0x2, @remote}]}, 0x2c}}, 0x88c2)
setsockopt$sock_linger(r2, 0x1, 0x3c, &(0x7f0000000180)={0xfffffffd}, 0x8)
sendmmsg$inet6(r2, &(0x7f0000000380)=[{{&(0x7f0000000140)={0xa, 0x4e20, 0x10, @mcast2, 0x5}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000080)="c2fb8e95213f23e208cf81fbe16df0", 0xf}], 0x1}}], 0x1, 0x4001c00)
write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="08008808070400000000de850000430200b30065000002029078ffffffffe0000002940400004434d971e0000001000000037f00000100000007ac14140b80000001ffffffff0000000600000000000037afffffffff0000000512969078ac1e0001b9b80b0bc9c1fe0efada77dc87429444f7175a31fc4adc603b5b84059d55f138eefe1c1edc75d4a29fab94a5c57767054357a44d40c0da4bdb1b99dc2e0c646d6a9b80111fc35aa1efc7107240768eb5e184049272482c46c140715bfaa0818beea0cc53f24c263ce50c6adc325b361f712af6fc78ff79941513504d3bc73fbdc82de19223bff66410692ca3d9ee5fc1dc9dc58c45b90e34d5c3cea764"], 0xc1)
bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r9 = syz_open_dev$tty1(0xc, 0x4, 0x1)
keyctl$clear(0x11, 0xfffffffffffffffd)
r10 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffc, 0x822b01)
ioctl$TIOCCBRK(r9, 0x5428)
ioctl$EVIOCGRAB(r10, 0x40044590, &(0x7f0000000540)=0x5001)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r7, 0xc0c89425, &(0x7f0000000580)={"edef8b3ff8586be14e686d36a27ae99b", <r11=>0x0, 0x0, {0x8, 0x2}, {0x9, 0x1}, 0x3, [0x398c, 0x101, 0x7, 0x5, 0x5, 0x7, 0x0, 0x400, 0x5, 0x0, 0x3, 0x9, 0xfff, 0x1, 0x1, 0x37f]})
ioctl$BTRFS_IOC_SNAP_CREATE_V2(r7, 0x50009417, &(0x7f0000000780)={{r3}, r11, 0x12, @inherit={0x50, &(0x7f0000000680)={0x1, 0x1, 0x7fffffffffffffff, 0x8, {0xc, 0x2, 0x2, 0x5f1c, 0x2}, [0x10001]}}, @subvolid=0x4})

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-socket$nl_generic-syz_genetlink_get_family_id$mptcp-ioctl$TUNSETIFF-socket$inet6-setsockopt$inet6_udp_int-bpf$BPF_PROG_WITH_BTFID_LOAD-socket$nl_route-socketpair$unix-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bind$inet6-syz_emit_ethernet-sendmsg$nl_route-setsockopt$sock_linger-sendmmsg$inet6-write$tun-bpf$PROG_LOAD-syz_open_dev$tty1-keyctl$clear-syz_open_dev$evdev-ioctl$TIOCCBRK-ioctl$EVIOCGRAB-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), r1)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000040)=0xd, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x6, &(0x7f0000000040)=@framed={{}, [@map_val, @ldst={0x3, 0x0, 0x6, 0x0, 0x0, 0x18}]}, &(0x7f0000000180)='syzkaller\x00', 0x5, 0xd2, &(0x7f00000002c0)=""/210}, 0x22)
r3 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', <r5=>0x0})
r6 = socket$pppl2tp(0x18, 0x1, 0x1)
r7 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r6, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r7, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
bind$inet6(r7, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c)
syz_emit_ethernet(0x4c, &(0x7f0000000240)={@multicast, @multicast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x16, 0x11, 0xff, @remote, @local, {[], {0x0, 0xe22, 0x16, 0x0, @gue={{0x1, 0x0, 0x0, 0x3, 0x0, @void}, '\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}}}}, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@newlink={0x2c, 0x10, 0x1, 0x470bd27, 0x25dfd402, {0x0, 0x0, 0x0, r5, 0x6e494, 0x16ac1}, [@IFLA_BROADCAST={0xa, 0x2, @remote}]}, 0x2c}}, 0x88c2)
setsockopt$sock_linger(r2, 0x1, 0x3c, &(0x7f0000000180)={0xfffffffd}, 0x8)
sendmmsg$inet6(r2, &(0x7f0000000380)=[{{&(0x7f0000000140)={0xa, 0x4e20, 0x10, @mcast2, 0x5}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000080)="c2fb8e95213f23e208cf81fbe16df0", 0xf}], 0x1}}], 0x1, 0x4001c00)
write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="08008808070400000000de850000430200b30065000002029078ffffffffe0000002940400004434d971e0000001000000037f00000100000007ac14140b80000001ffffffff0000000600000000000037afffffffff0000000512969078ac1e0001b9b80b0bc9c1fe0efada77dc87429444f7175a31fc4adc603b5b84059d55f138eefe1c1edc75d4a29fab94a5c57767054357a44d40c0da4bdb1b99dc2e0c646d6a9b80111fc35aa1efc7107240768eb5e184049272482c46c140715bfaa0818beea0cc53f24c263ce50c6adc325b361f712af6fc78ff79941513504d3bc73fbdc82de19223bff66410692ca3d9ee5fc1dc9dc58c45b90e34d5c3cea764"], 0xc1)
bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r8 = syz_open_dev$tty1(0xc, 0x4, 0x1)
keyctl$clear(0x11, 0xfffffffffffffffd)
r9 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffc, 0x822b01)
ioctl$TIOCCBRK(r8, 0x5428)
ioctl$EVIOCGRAB(r9, 0x40044590, &(0x7f0000000540)=0x5001)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r6, 0xc0c89425, &(0x7f0000000580)={"edef8b3ff8586be14e686d36a27ae99b", 0x0, 0x0, {0x8, 0x2}, {0x9, 0x1}, 0x3, [0x398c, 0x101, 0x7, 0x5, 0x5, 0x7, 0x0, 0x400, 0x5, 0x0, 0x3, 0x9, 0xfff, 0x1, 0x1, 0x37f]})

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-socket$nl_generic-syz_genetlink_get_family_id$mptcp-ioctl$TUNSETIFF-socket$inet6-setsockopt$inet6_udp_int-bpf$BPF_PROG_WITH_BTFID_LOAD-socket$nl_route-socketpair$unix-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bind$inet6-syz_emit_ethernet-sendmsg$nl_route-setsockopt$sock_linger-sendmmsg$inet6-write$tun-bpf$PROG_LOAD-syz_open_dev$tty1-keyctl$clear-syz_open_dev$evdev-ioctl$TIOCCBRK-ioctl$EVIOCGRAB
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), r1)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000040)=0xd, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x6, &(0x7f0000000040)=@framed={{}, [@map_val, @ldst={0x3, 0x0, 0x6, 0x0, 0x0, 0x18}]}, &(0x7f0000000180)='syzkaller\x00', 0x5, 0xd2, &(0x7f00000002c0)=""/210}, 0x22)
r3 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', <r5=>0x0})
r6 = socket$pppl2tp(0x18, 0x1, 0x1)
r7 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r6, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r7, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
bind$inet6(r7, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c)
syz_emit_ethernet(0x4c, &(0x7f0000000240)={@multicast, @multicast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x16, 0x11, 0xff, @remote, @local, {[], {0x0, 0xe22, 0x16, 0x0, @gue={{0x1, 0x0, 0x0, 0x3, 0x0, @void}, '\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}}}}, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@newlink={0x2c, 0x10, 0x1, 0x470bd27, 0x25dfd402, {0x0, 0x0, 0x0, r5, 0x6e494, 0x16ac1}, [@IFLA_BROADCAST={0xa, 0x2, @remote}]}, 0x2c}}, 0x88c2)
setsockopt$sock_linger(r2, 0x1, 0x3c, &(0x7f0000000180)={0xfffffffd}, 0x8)
sendmmsg$inet6(r2, &(0x7f0000000380)=[{{&(0x7f0000000140)={0xa, 0x4e20, 0x10, @mcast2, 0x5}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000080)="c2fb8e95213f23e208cf81fbe16df0", 0xf}], 0x1}}], 0x1, 0x4001c00)
write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="08008808070400000000de850000430200b30065000002029078ffffffffe0000002940400004434d971e0000001000000037f00000100000007ac14140b80000001ffffffff0000000600000000000037afffffffff0000000512969078ac1e0001b9b80b0bc9c1fe0efada77dc87429444f7175a31fc4adc603b5b84059d55f138eefe1c1edc75d4a29fab94a5c57767054357a44d40c0da4bdb1b99dc2e0c646d6a9b80111fc35aa1efc7107240768eb5e184049272482c46c140715bfaa0818beea0cc53f24c263ce50c6adc325b361f712af6fc78ff79941513504d3bc73fbdc82de19223bff66410692ca3d9ee5fc1dc9dc58c45b90e34d5c3cea764"], 0xc1)
bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r8 = syz_open_dev$tty1(0xc, 0x4, 0x1)
keyctl$clear(0x11, 0xfffffffffffffffd)
r9 = syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffc, 0x822b01)
ioctl$TIOCCBRK(r8, 0x5428)
ioctl$EVIOCGRAB(r9, 0x40044590, &(0x7f0000000540)=0x5001)

program did not crash
testing program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-socket$nl_generic-syz_genetlink_get_family_id$mptcp-ioctl$TUNSETIFF-socket$inet6-setsockopt$inet6_udp_int-bpf$BPF_PROG_WITH_BTFID_LOAD-socket$nl_route-socketpair$unix-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bind$inet6-syz_emit_ethernet-sendmsg$nl_route-setsockopt$sock_linger-sendmmsg$inet6-write$tun-bpf$PROG_LOAD-syz_open_dev$tty1-keyctl$clear-syz_open_dev$evdev-ioctl$TIOCCBRK-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), r1)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000040)=0xd, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x6, &(0x7f0000000040)=@framed={{}, [@map_val, @ldst={0x3, 0x0, 0x6, 0x0, 0x0, 0x18}]}, &(0x7f0000000180)='syzkaller\x00', 0x5, 0xd2, &(0x7f00000002c0)=""/210}, 0x22)
r3 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', <r5=>0x0})
r6 = socket$pppl2tp(0x18, 0x1, 0x1)
r7 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r6, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r7, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
bind$inet6(r7, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c)
syz_emit_ethernet(0x4c, &(0x7f0000000240)={@multicast, @multicast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x16, 0x11, 0xff, @remote, @local, {[], {0x0, 0xe22, 0x16, 0x0, @gue={{0x1, 0x0, 0x0, 0x3, 0x0, @void}, '\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}}}}, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@newlink={0x2c, 0x10, 0x1, 0x470bd27, 0x25dfd402, {0x0, 0x0, 0x0, r5, 0x6e494, 0x16ac1}, [@IFLA_BROADCAST={0xa, 0x2, @remote}]}, 0x2c}}, 0x88c2)
setsockopt$sock_linger(r2, 0x1, 0x3c, &(0x7f0000000180)={0xfffffffd}, 0x8)
sendmmsg$inet6(r2, &(0x7f0000000380)=[{{&(0x7f0000000140)={0xa, 0x4e20, 0x10, @mcast2, 0x5}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000080)="c2fb8e95213f23e208cf81fbe16df0", 0xf}], 0x1}}], 0x1, 0x4001c00)
write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="08008808070400000000de850000430200b30065000002029078ffffffffe0000002940400004434d971e0000001000000037f00000100000007ac14140b80000001ffffffff0000000600000000000037afffffffff0000000512969078ac1e0001b9b80b0bc9c1fe0efada77dc87429444f7175a31fc4adc603b5b84059d55f138eefe1c1edc75d4a29fab94a5c57767054357a44d40c0da4bdb1b99dc2e0c646d6a9b80111fc35aa1efc7107240768eb5e184049272482c46c140715bfaa0818beea0cc53f24c263ce50c6adc325b361f712af6fc78ff79941513504d3bc73fbdc82de19223bff66410692ca3d9ee5fc1dc9dc58c45b90e34d5c3cea764"], 0xc1)
bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r8 = syz_open_dev$tty1(0xc, 0x4, 0x1)
keyctl$clear(0x11, 0xfffffffffffffffd)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffc, 0x822b01)
ioctl$TIOCCBRK(r8, 0x5428)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r6, 0xc0c89425, &(0x7f0000000580)={"edef8b3ff8586be14e686d36a27ae99b", 0x0, 0x0, {0x8, 0x2}, {0x9, 0x1}, 0x3, [0x398c, 0x101, 0x7, 0x5, 0x5, 0x7, 0x0, 0x400, 0x5, 0x0, 0x3, 0x9, 0xfff, 0x1, 0x1, 0x37f]})

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-socket$nl_generic-syz_genetlink_get_family_id$mptcp-ioctl$TUNSETIFF-socket$inet6-setsockopt$inet6_udp_int-bpf$BPF_PROG_WITH_BTFID_LOAD-socket$nl_route-socketpair$unix-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bind$inet6-syz_emit_ethernet-sendmsg$nl_route-setsockopt$sock_linger-sendmmsg$inet6-write$tun-bpf$PROG_LOAD-syz_open_dev$tty1-keyctl$clear-syz_open_dev$evdev-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), r1)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000040)=0xd, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x6, &(0x7f0000000040)=@framed={{}, [@map_val, @ldst={0x3, 0x0, 0x6, 0x0, 0x0, 0x18}]}, &(0x7f0000000180)='syzkaller\x00', 0x5, 0xd2, &(0x7f00000002c0)=""/210}, 0x22)
r3 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', <r5=>0x0})
r6 = socket$pppl2tp(0x18, 0x1, 0x1)
r7 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r6, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r7, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
bind$inet6(r7, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c)
syz_emit_ethernet(0x4c, &(0x7f0000000240)={@multicast, @multicast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x16, 0x11, 0xff, @remote, @local, {[], {0x0, 0xe22, 0x16, 0x0, @gue={{0x1, 0x0, 0x0, 0x3, 0x0, @void}, '\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}}}}, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@newlink={0x2c, 0x10, 0x1, 0x470bd27, 0x25dfd402, {0x0, 0x0, 0x0, r5, 0x6e494, 0x16ac1}, [@IFLA_BROADCAST={0xa, 0x2, @remote}]}, 0x2c}}, 0x88c2)
setsockopt$sock_linger(r2, 0x1, 0x3c, &(0x7f0000000180)={0xfffffffd}, 0x8)
sendmmsg$inet6(r2, &(0x7f0000000380)=[{{&(0x7f0000000140)={0xa, 0x4e20, 0x10, @mcast2, 0x5}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000080)="c2fb8e95213f23e208cf81fbe16df0", 0xf}], 0x1}}], 0x1, 0x4001c00)
write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="08008808070400000000de850000430200b30065000002029078ffffffffe0000002940400004434d971e0000001000000037f00000100000007ac14140b80000001ffffffff0000000600000000000037afffffffff0000000512969078ac1e0001b9b80b0bc9c1fe0efada77dc87429444f7175a31fc4adc603b5b84059d55f138eefe1c1edc75d4a29fab94a5c57767054357a44d40c0da4bdb1b99dc2e0c646d6a9b80111fc35aa1efc7107240768eb5e184049272482c46c140715bfaa0818beea0cc53f24c263ce50c6adc325b361f712af6fc78ff79941513504d3bc73fbdc82de19223bff66410692ca3d9ee5fc1dc9dc58c45b90e34d5c3cea764"], 0xc1)
bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
syz_open_dev$tty1(0xc, 0x4, 0x1)
keyctl$clear(0x11, 0xfffffffffffffffd)
syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffc, 0x822b01)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r6, 0xc0c89425, &(0x7f0000000580)={"edef8b3ff8586be14e686d36a27ae99b", 0x0, 0x0, {0x8, 0x2}, {0x9, 0x1}, 0x3, [0x398c, 0x101, 0x7, 0x5, 0x5, 0x7, 0x0, 0x400, 0x5, 0x0, 0x3, 0x9, 0xfff, 0x1, 0x1, 0x37f]})

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-socket$nl_generic-syz_genetlink_get_family_id$mptcp-ioctl$TUNSETIFF-socket$inet6-setsockopt$inet6_udp_int-bpf$BPF_PROG_WITH_BTFID_LOAD-socket$nl_route-socketpair$unix-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bind$inet6-syz_emit_ethernet-sendmsg$nl_route-setsockopt$sock_linger-sendmmsg$inet6-write$tun-bpf$PROG_LOAD-syz_open_dev$tty1-keyctl$clear-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), r1)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000040)=0xd, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x6, &(0x7f0000000040)=@framed={{}, [@map_val, @ldst={0x3, 0x0, 0x6, 0x0, 0x0, 0x18}]}, &(0x7f0000000180)='syzkaller\x00', 0x5, 0xd2, &(0x7f00000002c0)=""/210}, 0x22)
r3 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', <r5=>0x0})
r6 = socket$pppl2tp(0x18, 0x1, 0x1)
r7 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r6, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r7, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
bind$inet6(r7, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c)
syz_emit_ethernet(0x4c, &(0x7f0000000240)={@multicast, @multicast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x16, 0x11, 0xff, @remote, @local, {[], {0x0, 0xe22, 0x16, 0x0, @gue={{0x1, 0x0, 0x0, 0x3, 0x0, @void}, '\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}}}}, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@newlink={0x2c, 0x10, 0x1, 0x470bd27, 0x25dfd402, {0x0, 0x0, 0x0, r5, 0x6e494, 0x16ac1}, [@IFLA_BROADCAST={0xa, 0x2, @remote}]}, 0x2c}}, 0x88c2)
setsockopt$sock_linger(r2, 0x1, 0x3c, &(0x7f0000000180)={0xfffffffd}, 0x8)
sendmmsg$inet6(r2, &(0x7f0000000380)=[{{&(0x7f0000000140)={0xa, 0x4e20, 0x10, @mcast2, 0x5}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000080)="c2fb8e95213f23e208cf81fbe16df0", 0xf}], 0x1}}], 0x1, 0x4001c00)
write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="08008808070400000000de850000430200b30065000002029078ffffffffe0000002940400004434d971e0000001000000037f00000100000007ac14140b80000001ffffffff0000000600000000000037afffffffff0000000512969078ac1e0001b9b80b0bc9c1fe0efada77dc87429444f7175a31fc4adc603b5b84059d55f138eefe1c1edc75d4a29fab94a5c57767054357a44d40c0da4bdb1b99dc2e0c646d6a9b80111fc35aa1efc7107240768eb5e184049272482c46c140715bfaa0818beea0cc53f24c263ce50c6adc325b361f712af6fc78ff79941513504d3bc73fbdc82de19223bff66410692ca3d9ee5fc1dc9dc58c45b90e34d5c3cea764"], 0xc1)
bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
syz_open_dev$tty1(0xc, 0x4, 0x1)
keyctl$clear(0x11, 0xfffffffffffffffd)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r6, 0xc0c89425, &(0x7f0000000580)={"edef8b3ff8586be14e686d36a27ae99b", 0x0, 0x0, {0x8, 0x2}, {0x9, 0x1}, 0x3, [0x398c, 0x101, 0x7, 0x5, 0x5, 0x7, 0x0, 0x400, 0x5, 0x0, 0x3, 0x9, 0xfff, 0x1, 0x1, 0x37f]})

program crashed: KASAN: use-after-free Read in rcu_cblist_dequeue
testing program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-socket$nl_generic-syz_genetlink_get_family_id$mptcp-ioctl$TUNSETIFF-socket$inet6-setsockopt$inet6_udp_int-bpf$BPF_PROG_WITH_BTFID_LOAD-socket$nl_route-socketpair$unix-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bind$inet6-syz_emit_ethernet-sendmsg$nl_route-setsockopt$sock_linger-sendmmsg$inet6-write$tun-bpf$PROG_LOAD-syz_open_dev$tty1-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), r1)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000040)=0xd, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x6, &(0x7f0000000040)=@framed={{}, [@map_val, @ldst={0x3, 0x0, 0x6, 0x0, 0x0, 0x18}]}, &(0x7f0000000180)='syzkaller\x00', 0x5, 0xd2, &(0x7f00000002c0)=""/210}, 0x22)
r3 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', <r5=>0x0})
r6 = socket$pppl2tp(0x18, 0x1, 0x1)
r7 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r6, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r7, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
bind$inet6(r7, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c)
syz_emit_ethernet(0x4c, &(0x7f0000000240)={@multicast, @multicast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x16, 0x11, 0xff, @remote, @local, {[], {0x0, 0xe22, 0x16, 0x0, @gue={{0x1, 0x0, 0x0, 0x3, 0x0, @void}, '\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}}}}, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@newlink={0x2c, 0x10, 0x1, 0x470bd27, 0x25dfd402, {0x0, 0x0, 0x0, r5, 0x6e494, 0x16ac1}, [@IFLA_BROADCAST={0xa, 0x2, @remote}]}, 0x2c}}, 0x88c2)
setsockopt$sock_linger(r2, 0x1, 0x3c, &(0x7f0000000180)={0xfffffffd}, 0x8)
sendmmsg$inet6(r2, &(0x7f0000000380)=[{{&(0x7f0000000140)={0xa, 0x4e20, 0x10, @mcast2, 0x5}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000080)="c2fb8e95213f23e208cf81fbe16df0", 0xf}], 0x1}}], 0x1, 0x4001c00)
write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="08008808070400000000de850000430200b30065000002029078ffffffffe0000002940400004434d971e0000001000000037f00000100000007ac14140b80000001ffffffff0000000600000000000037afffffffff0000000512969078ac1e0001b9b80b0bc9c1fe0efada77dc87429444f7175a31fc4adc603b5b84059d55f138eefe1c1edc75d4a29fab94a5c57767054357a44d40c0da4bdb1b99dc2e0c646d6a9b80111fc35aa1efc7107240768eb5e184049272482c46c140715bfaa0818beea0cc53f24c263ce50c6adc325b361f712af6fc78ff79941513504d3bc73fbdc82de19223bff66410692ca3d9ee5fc1dc9dc58c45b90e34d5c3cea764"], 0xc1)
bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r6, 0xc0c89425, &(0x7f0000000580)={"edef8b3ff8586be14e686d36a27ae99b", 0x0, 0x0, {0x8, 0x2}, {0x9, 0x1}, 0x3, [0x398c, 0x101, 0x7, 0x5, 0x5, 0x7, 0x0, 0x400, 0x5, 0x0, 0x3, 0x9, 0xfff, 0x1, 0x1, 0x37f]})

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-socket$nl_generic-syz_genetlink_get_family_id$mptcp-ioctl$TUNSETIFF-socket$inet6-setsockopt$inet6_udp_int-bpf$BPF_PROG_WITH_BTFID_LOAD-socket$nl_route-socketpair$unix-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bind$inet6-syz_emit_ethernet-sendmsg$nl_route-setsockopt$sock_linger-sendmmsg$inet6-write$tun-bpf$PROG_LOAD-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), r1)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000040)=0xd, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x6, &(0x7f0000000040)=@framed={{}, [@map_val, @ldst={0x3, 0x0, 0x6, 0x0, 0x0, 0x18}]}, &(0x7f0000000180)='syzkaller\x00', 0x5, 0xd2, &(0x7f00000002c0)=""/210}, 0x22)
r3 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', <r5=>0x0})
r6 = socket$pppl2tp(0x18, 0x1, 0x1)
r7 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r6, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r7, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
bind$inet6(r7, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c)
syz_emit_ethernet(0x4c, &(0x7f0000000240)={@multicast, @multicast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x16, 0x11, 0xff, @remote, @local, {[], {0x0, 0xe22, 0x16, 0x0, @gue={{0x1, 0x0, 0x0, 0x3, 0x0, @void}, '\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}}}}, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@newlink={0x2c, 0x10, 0x1, 0x470bd27, 0x25dfd402, {0x0, 0x0, 0x0, r5, 0x6e494, 0x16ac1}, [@IFLA_BROADCAST={0xa, 0x2, @remote}]}, 0x2c}}, 0x88c2)
setsockopt$sock_linger(r2, 0x1, 0x3c, &(0x7f0000000180)={0xfffffffd}, 0x8)
sendmmsg$inet6(r2, &(0x7f0000000380)=[{{&(0x7f0000000140)={0xa, 0x4e20, 0x10, @mcast2, 0x5}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000080)="c2fb8e95213f23e208cf81fbe16df0", 0xf}], 0x1}}], 0x1, 0x4001c00)
write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="08008808070400000000de850000430200b30065000002029078ffffffffe0000002940400004434d971e0000001000000037f00000100000007ac14140b80000001ffffffff0000000600000000000037afffffffff0000000512969078ac1e0001b9b80b0bc9c1fe0efada77dc87429444f7175a31fc4adc603b5b84059d55f138eefe1c1edc75d4a29fab94a5c57767054357a44d40c0da4bdb1b99dc2e0c646d6a9b80111fc35aa1efc7107240768eb5e184049272482c46c140715bfaa0818beea0cc53f24c263ce50c6adc325b361f712af6fc78ff79941513504d3bc73fbdc82de19223bff66410692ca3d9ee5fc1dc9dc58c45b90e34d5c3cea764"], 0xc1)
bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r6, 0xc0c89425, &(0x7f0000000580)={"edef8b3ff8586be14e686d36a27ae99b", 0x0, 0x0, {0x8, 0x2}, {0x9, 0x1}, 0x3, [0x398c, 0x101, 0x7, 0x5, 0x5, 0x7, 0x0, 0x400, 0x5, 0x0, 0x3, 0x9, 0xfff, 0x1, 0x1, 0x37f]})

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-socket$nl_generic-syz_genetlink_get_family_id$mptcp-ioctl$TUNSETIFF-socket$inet6-setsockopt$inet6_udp_int-bpf$BPF_PROG_WITH_BTFID_LOAD-socket$nl_route-socketpair$unix-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bind$inet6-syz_emit_ethernet-sendmsg$nl_route-setsockopt$sock_linger-sendmmsg$inet6-write$tun-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), r1)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000040)=0xd, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x6, &(0x7f0000000040)=@framed={{}, [@map_val, @ldst={0x3, 0x0, 0x6, 0x0, 0x0, 0x18}]}, &(0x7f0000000180)='syzkaller\x00', 0x5, 0xd2, &(0x7f00000002c0)=""/210}, 0x22)
r3 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', <r5=>0x0})
r6 = socket$pppl2tp(0x18, 0x1, 0x1)
r7 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r6, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r7, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
bind$inet6(r7, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c)
syz_emit_ethernet(0x4c, &(0x7f0000000240)={@multicast, @multicast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x16, 0x11, 0xff, @remote, @local, {[], {0x0, 0xe22, 0x16, 0x0, @gue={{0x1, 0x0, 0x0, 0x3, 0x0, @void}, '\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}}}}, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@newlink={0x2c, 0x10, 0x1, 0x470bd27, 0x25dfd402, {0x0, 0x0, 0x0, r5, 0x6e494, 0x16ac1}, [@IFLA_BROADCAST={0xa, 0x2, @remote}]}, 0x2c}}, 0x88c2)
setsockopt$sock_linger(r2, 0x1, 0x3c, &(0x7f0000000180)={0xfffffffd}, 0x8)
sendmmsg$inet6(r2, &(0x7f0000000380)=[{{&(0x7f0000000140)={0xa, 0x4e20, 0x10, @mcast2, 0x5}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000080)="c2fb8e95213f23e208cf81fbe16df0", 0xf}], 0x1}}], 0x1, 0x4001c00)
write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="08008808070400000000de850000430200b30065000002029078ffffffffe0000002940400004434d971e0000001000000037f00000100000007ac14140b80000001ffffffff0000000600000000000037afffffffff0000000512969078ac1e0001b9b80b0bc9c1fe0efada77dc87429444f7175a31fc4adc603b5b84059d55f138eefe1c1edc75d4a29fab94a5c57767054357a44d40c0da4bdb1b99dc2e0c646d6a9b80111fc35aa1efc7107240768eb5e184049272482c46c140715bfaa0818beea0cc53f24c263ce50c6adc325b361f712af6fc78ff79941513504d3bc73fbdc82de19223bff66410692ca3d9ee5fc1dc9dc58c45b90e34d5c3cea764"], 0xc1)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r6, 0xc0c89425, &(0x7f0000000580)={"edef8b3ff8586be14e686d36a27ae99b", 0x0, 0x0, {0x8, 0x2}, {0x9, 0x1}, 0x3, [0x398c, 0x101, 0x7, 0x5, 0x5, 0x7, 0x0, 0x400, 0x5, 0x0, 0x3, 0x9, 0xfff, 0x1, 0x1, 0x37f]})

program crashed: KASAN: use-after-free Write in rcu_segcblist_enqueue
testing program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-socket$nl_generic-syz_genetlink_get_family_id$mptcp-ioctl$TUNSETIFF-socket$inet6-setsockopt$inet6_udp_int-bpf$BPF_PROG_WITH_BTFID_LOAD-socket$nl_route-socketpair$unix-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bind$inet6-syz_emit_ethernet-sendmsg$nl_route-setsockopt$sock_linger-sendmmsg$inet6-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), r1)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000040)=0xd, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x6, &(0x7f0000000040)=@framed={{}, [@map_val, @ldst={0x3, 0x0, 0x6, 0x0, 0x0, 0x18}]}, &(0x7f0000000180)='syzkaller\x00', 0x5, 0xd2, &(0x7f00000002c0)=""/210}, 0x22)
r3 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', <r5=>0x0})
r6 = socket$pppl2tp(0x18, 0x1, 0x1)
r7 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r6, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r7, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
bind$inet6(r7, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c)
syz_emit_ethernet(0x4c, &(0x7f0000000240)={@multicast, @multicast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x16, 0x11, 0xff, @remote, @local, {[], {0x0, 0xe22, 0x16, 0x0, @gue={{0x1, 0x0, 0x0, 0x3, 0x0, @void}, '\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}}}}, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@newlink={0x2c, 0x10, 0x1, 0x470bd27, 0x25dfd402, {0x0, 0x0, 0x0, r5, 0x6e494, 0x16ac1}, [@IFLA_BROADCAST={0xa, 0x2, @remote}]}, 0x2c}}, 0x88c2)
setsockopt$sock_linger(r2, 0x1, 0x3c, &(0x7f0000000180)={0xfffffffd}, 0x8)
sendmmsg$inet6(r2, &(0x7f0000000380)=[{{&(0x7f0000000140)={0xa, 0x4e20, 0x10, @mcast2, 0x5}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000080)="c2fb8e95213f23e208cf81fbe16df0", 0xf}], 0x1}}], 0x1, 0x4001c00)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r6, 0xc0c89425, &(0x7f0000000580)={"edef8b3ff8586be14e686d36a27ae99b", 0x0, 0x0, {0x8, 0x2}, {0x9, 0x1}, 0x3, [0x398c, 0x101, 0x7, 0x5, 0x5, 0x7, 0x0, 0x400, 0x5, 0x0, 0x3, 0x9, 0xfff, 0x1, 0x1, 0x37f]})

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-socket$nl_generic-syz_genetlink_get_family_id$mptcp-ioctl$TUNSETIFF-socket$inet6-setsockopt$inet6_udp_int-bpf$BPF_PROG_WITH_BTFID_LOAD-socket$nl_route-socketpair$unix-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bind$inet6-syz_emit_ethernet-sendmsg$nl_route-setsockopt$sock_linger-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), r1)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000040)=0xd, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x6, &(0x7f0000000040)=@framed={{}, [@map_val, @ldst={0x3, 0x0, 0x6, 0x0, 0x0, 0x18}]}, &(0x7f0000000180)='syzkaller\x00', 0x5, 0xd2, &(0x7f00000002c0)=""/210}, 0x22)
r3 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', <r5=>0x0})
r6 = socket$pppl2tp(0x18, 0x1, 0x1)
r7 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r6, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r7, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
bind$inet6(r7, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c)
syz_emit_ethernet(0x4c, &(0x7f0000000240)={@multicast, @multicast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x16, 0x11, 0xff, @remote, @local, {[], {0x0, 0xe22, 0x16, 0x0, @gue={{0x1, 0x0, 0x0, 0x3, 0x0, @void}, '\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}}}}, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@newlink={0x2c, 0x10, 0x1, 0x470bd27, 0x25dfd402, {0x0, 0x0, 0x0, r5, 0x6e494, 0x16ac1}, [@IFLA_BROADCAST={0xa, 0x2, @remote}]}, 0x2c}}, 0x88c2)
setsockopt$sock_linger(r2, 0x1, 0x3c, &(0x7f0000000180)={0xfffffffd}, 0x8)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r6, 0xc0c89425, &(0x7f0000000580)={"edef8b3ff8586be14e686d36a27ae99b", 0x0, 0x0, {0x8, 0x2}, {0x9, 0x1}, 0x3, [0x398c, 0x101, 0x7, 0x5, 0x5, 0x7, 0x0, 0x400, 0x5, 0x0, 0x3, 0x9, 0xfff, 0x1, 0x1, 0x37f]})

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-socket$nl_generic-syz_genetlink_get_family_id$mptcp-ioctl$TUNSETIFF-socket$inet6-setsockopt$inet6_udp_int-bpf$BPF_PROG_WITH_BTFID_LOAD-socket$nl_route-socketpair$unix-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bind$inet6-syz_emit_ethernet-sendmsg$nl_route-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), r1)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000040)=0xd, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x6, &(0x7f0000000040)=@framed={{}, [@map_val, @ldst={0x3, 0x0, 0x6, 0x0, 0x0, 0x18}]}, &(0x7f0000000180)='syzkaller\x00', 0x5, 0xd2, &(0x7f00000002c0)=""/210}, 0x22)
r3 = socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', <r5=>0x0})
r6 = socket$pppl2tp(0x18, 0x1, 0x1)
r7 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r6, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r7, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
bind$inet6(r7, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c)
syz_emit_ethernet(0x4c, &(0x7f0000000240)={@multicast, @multicast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x16, 0x11, 0xff, @remote, @local, {[], {0x0, 0xe22, 0x16, 0x0, @gue={{0x1, 0x0, 0x0, 0x3, 0x0, @void}, '\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}}}}, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@newlink={0x2c, 0x10, 0x1, 0x470bd27, 0x25dfd402, {0x0, 0x0, 0x0, r5, 0x6e494, 0x16ac1}, [@IFLA_BROADCAST={0xa, 0x2, @remote}]}, 0x2c}}, 0x88c2)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r6, 0xc0c89425, &(0x7f0000000580)={"edef8b3ff8586be14e686d36a27ae99b", 0x0, 0x0, {0x8, 0x2}, {0x9, 0x1}, 0x3, [0x398c, 0x101, 0x7, 0x5, 0x5, 0x7, 0x0, 0x400, 0x5, 0x0, 0x3, 0x9, 0xfff, 0x1, 0x1, 0x37f]})

program crashed: KASAN: use-after-free Read in rcu_cblist_dequeue
testing program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-socket$nl_generic-syz_genetlink_get_family_id$mptcp-ioctl$TUNSETIFF-socket$inet6-setsockopt$inet6_udp_int-bpf$BPF_PROG_WITH_BTFID_LOAD-socket$nl_route-socketpair$unix-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bind$inet6-syz_emit_ethernet-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), r1)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000040)=0xd, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x6, &(0x7f0000000040)=@framed={{}, [@map_val, @ldst={0x3, 0x0, 0x6, 0x0, 0x0, 0x18}]}, &(0x7f0000000180)='syzkaller\x00', 0x5, 0xd2, &(0x7f00000002c0)=""/210}, 0x22)
socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00'})
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r4, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r5, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
bind$inet6(r5, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c)
syz_emit_ethernet(0x4c, &(0x7f0000000240)={@multicast, @multicast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "010100", 0x16, 0x11, 0xff, @remote, @local, {[], {0x0, 0xe22, 0x16, 0x0, @gue={{0x1, 0x0, 0x0, 0x3, 0x0, @void}, '\x00\x00\x00\x00\x00\x00\x00\x00`\x00'}}}}}}}, 0x0)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r4, 0xc0c89425, &(0x7f0000000580)={"edef8b3ff8586be14e686d36a27ae99b", 0x0, 0x0, {0x8, 0x2}, {0x9, 0x1}, 0x3, [0x398c, 0x101, 0x7, 0x5, 0x5, 0x7, 0x0, 0x400, 0x5, 0x0, 0x3, 0x9, 0xfff, 0x1, 0x1, 0x37f]})

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-socket$nl_generic-syz_genetlink_get_family_id$mptcp-ioctl$TUNSETIFF-socket$inet6-setsockopt$inet6_udp_int-bpf$BPF_PROG_WITH_BTFID_LOAD-socket$nl_route-socketpair$unix-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-bind$inet6-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), r1)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000040)=0xd, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x6, &(0x7f0000000040)=@framed={{}, [@map_val, @ldst={0x3, 0x0, 0x6, 0x0, 0x0, 0x18}]}, &(0x7f0000000180)='syzkaller\x00', 0x5, 0xd2, &(0x7f00000002c0)=""/210}, 0x22)
socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00'})
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r4, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r5, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
bind$inet6(r5, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r4, 0xc0c89425, &(0x7f0000000580)={"edef8b3ff8586be14e686d36a27ae99b", 0x0, 0x0, {0x8, 0x2}, {0x9, 0x1}, 0x3, [0x398c, 0x101, 0x7, 0x5, 0x5, 0x7, 0x0, 0x400, 0x5, 0x0, 0x3, 0x9, 0xfff, 0x1, 0x1, 0x37f]})

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-socket$nl_generic-syz_genetlink_get_family_id$mptcp-ioctl$TUNSETIFF-socket$inet6-setsockopt$inet6_udp_int-bpf$BPF_PROG_WITH_BTFID_LOAD-socket$nl_route-socketpair$unix-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), r1)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000040)=0xd, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x6, &(0x7f0000000040)=@framed={{}, [@map_val, @ldst={0x3, 0x0, 0x6, 0x0, 0x0, 0x18}]}, &(0x7f0000000180)='syzkaller\x00', 0x5, 0xd2, &(0x7f00000002c0)=""/210}, 0x22)
socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00'})
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r4, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r5, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r4, 0xc0c89425, &(0x7f0000000580)={"edef8b3ff8586be14e686d36a27ae99b", 0x0, 0x0, {0x8, 0x2}, {0x9, 0x1}, 0x3, [0x398c, 0x101, 0x7, 0x5, 0x5, 0x7, 0x0, 0x400, 0x5, 0x0, 0x3, 0x9, 0xfff, 0x1, 0x1, 0x37f]})

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-socket$nl_generic-syz_genetlink_get_family_id$mptcp-ioctl$TUNSETIFF-socket$inet6-setsockopt$inet6_udp_int-bpf$BPF_PROG_WITH_BTFID_LOAD-socket$nl_route-socketpair$unix-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-socket$inet6_udp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), r1)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000040)=0xd, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x6, &(0x7f0000000040)=@framed={{}, [@map_val, @ldst={0x3, 0x0, 0x6, 0x0, 0x0, 0x18}]}, &(0x7f0000000180)='syzkaller\x00', 0x5, 0xd2, &(0x7f00000002c0)=""/210}, 0x22)
socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00'})
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r4, 0xc0c89425, &(0x7f0000000580)={"edef8b3ff8586be14e686d36a27ae99b", 0x0, 0x0, {0x8, 0x2}, {0x9, 0x1}, 0x3, [0x398c, 0x101, 0x7, 0x5, 0x5, 0x7, 0x0, 0x400, 0x5, 0x0, 0x3, 0x9, 0xfff, 0x1, 0x1, 0x37f]})

program did not crash
testing program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-socket$nl_generic-syz_genetlink_get_family_id$mptcp-ioctl$TUNSETIFF-socket$inet6-setsockopt$inet6_udp_int-bpf$BPF_PROG_WITH_BTFID_LOAD-socket$nl_route-socketpair$unix-ioctl$sock_SIOCGIFINDEX-socket$pppl2tp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), r1)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000040)=0xd, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x6, &(0x7f0000000040)=@framed={{}, [@map_val, @ldst={0x3, 0x0, 0x6, 0x0, 0x0, 0x18}]}, &(0x7f0000000180)='syzkaller\x00', 0x5, 0xd2, &(0x7f00000002c0)=""/210}, 0x22)
socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00'})
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
connect$pppl2tp(r4, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r4, 0xc0c89425, &(0x7f0000000580)={"edef8b3ff8586be14e686d36a27ae99b", 0x0, 0x0, {0x8, 0x2}, {0x9, 0x1}, 0x3, [0x398c, 0x101, 0x7, 0x5, 0x5, 0x7, 0x0, 0x400, 0x5, 0x0, 0x3, 0x9, 0xfff, 0x1, 0x1, 0x37f]})

program did not crash
testing program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-socket$nl_generic-syz_genetlink_get_family_id$mptcp-ioctl$TUNSETIFF-socket$inet6-setsockopt$inet6_udp_int-bpf$BPF_PROG_WITH_BTFID_LOAD-socket$nl_route-socketpair$unix-ioctl$sock_SIOCGIFINDEX-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), r1)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000040)=0xd, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x6, &(0x7f0000000040)=@framed={{}, [@map_val, @ldst={0x3, 0x0, 0x6, 0x0, 0x0, 0x18}]}, &(0x7f0000000180)='syzkaller\x00', 0x5, 0xd2, &(0x7f00000002c0)=""/210}, 0x22)
socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00'})
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f0000000580)={"edef8b3ff8586be14e686d36a27ae99b", 0x0, 0x0, {0x8, 0x2}, {0x9, 0x1}, 0x3, [0x398c, 0x101, 0x7, 0x5, 0x5, 0x7, 0x0, 0x400, 0x5, 0x0, 0x3, 0x9, 0xfff, 0x1, 0x1, 0x37f]})

program did not crash
testing program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-socket$nl_generic-syz_genetlink_get_family_id$mptcp-ioctl$TUNSETIFF-socket$inet6-setsockopt$inet6_udp_int-bpf$BPF_PROG_WITH_BTFID_LOAD-socket$nl_route-socketpair$unix-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), r1)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000040)=0xd, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x6, &(0x7f0000000040)=@framed={{}, [@map_val, @ldst={0x3, 0x0, 0x6, 0x0, 0x0, 0x18}]}, &(0x7f0000000180)='syzkaller\x00', 0x5, 0xd2, &(0x7f00000002c0)=""/210}, 0x22)
socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0))
r3 = socket$pppl2tp(0x18, 0x1, 0x1)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r3, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r3, 0xc0c89425, &(0x7f0000000580)={"edef8b3ff8586be14e686d36a27ae99b", 0x0, 0x0, {0x8, 0x2}, {0x9, 0x1}, 0x3, [0x398c, 0x101, 0x7, 0x5, 0x5, 0x7, 0x0, 0x400, 0x5, 0x0, 0x3, 0x9, 0xfff, 0x1, 0x1, 0x37f]})

program crashed: KASAN: use-after-free Read in rcu_cblist_dequeue
testing program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-socket$nl_generic-syz_genetlink_get_family_id$mptcp-ioctl$TUNSETIFF-socket$inet6-setsockopt$inet6_udp_int-bpf$BPF_PROG_WITH_BTFID_LOAD-socket$nl_route-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), r1)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000040)=0xd, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x6, &(0x7f0000000040)=@framed={{}, [@map_val, @ldst={0x3, 0x0, 0x6, 0x0, 0x0, 0x18}]}, &(0x7f0000000180)='syzkaller\x00', 0x5, 0xd2, &(0x7f00000002c0)=""/210}, 0x22)
socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$pppl2tp(0x18, 0x1, 0x1)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r3, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r3, 0xc0c89425, &(0x7f0000000580)={"edef8b3ff8586be14e686d36a27ae99b", 0x0, 0x0, {0x8, 0x2}, {0x9, 0x1}, 0x3, [0x398c, 0x101, 0x7, 0x5, 0x5, 0x7, 0x0, 0x400, 0x5, 0x0, 0x3, 0x9, 0xfff, 0x1, 0x1, 0x37f]})

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-socket$nl_generic-syz_genetlink_get_family_id$mptcp-ioctl$TUNSETIFF-socket$inet6-setsockopt$inet6_udp_int-bpf$BPF_PROG_WITH_BTFID_LOAD-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), r1)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000040)=0xd, 0x4)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x6, &(0x7f0000000040)=@framed={{}, [@map_val, @ldst={0x3, 0x0, 0x6, 0x0, 0x0, 0x18}]}, &(0x7f0000000180)='syzkaller\x00', 0x5, 0xd2, &(0x7f00000002c0)=""/210}, 0x22)
r3 = socket$pppl2tp(0x18, 0x1, 0x1)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r3, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r3, 0xc0c89425, &(0x7f0000000580)={"edef8b3ff8586be14e686d36a27ae99b", 0x0, 0x0, {0x8, 0x2}, {0x9, 0x1}, 0x3, [0x398c, 0x101, 0x7, 0x5, 0x5, 0x7, 0x0, 0x400, 0x5, 0x0, 0x3, 0x9, 0xfff, 0x1, 0x1, 0x37f]})

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-socket$nl_generic-syz_genetlink_get_family_id$mptcp-ioctl$TUNSETIFF-socket$inet6-setsockopt$inet6_udp_int-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), r1)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$inet6(0xa, 0x80002, 0x0)
setsockopt$inet6_udp_int(r2, 0x11, 0x67, &(0x7f0000000040)=0xd, 0x4)
r3 = socket$pppl2tp(0x18, 0x1, 0x1)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r3, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r3, 0xc0c89425, &(0x7f0000000580)={"edef8b3ff8586be14e686d36a27ae99b", 0x0, 0x0, {0x8, 0x2}, {0x9, 0x1}, 0x3, [0x398c, 0x101, 0x7, 0x5, 0x5, 0x7, 0x0, 0x400, 0x5, 0x0, 0x3, 0x9, 0xfff, 0x1, 0x1, 0x37f]})

program crashed: KASAN: use-after-free Read in rcu_cblist_dequeue
testing program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-socket$nl_generic-syz_genetlink_get_family_id$mptcp-ioctl$TUNSETIFF-socket$inet6-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), r1)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
socket$inet6(0xa, 0x80002, 0x0)
r2 = socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r2, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000000580)={"edef8b3ff8586be14e686d36a27ae99b", 0x0, 0x0, {0x8, 0x2}, {0x9, 0x1}, 0x3, [0x398c, 0x101, 0x7, 0x5, 0x5, 0x7, 0x0, 0x400, 0x5, 0x0, 0x3, 0x9, 0xfff, 0x1, 0x1, 0x37f]})

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-socket$nl_generic-syz_genetlink_get_family_id$mptcp-ioctl$TUNSETIFF-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), r1)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201})
r2 = socket$pppl2tp(0x18, 0x1, 0x1)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r2, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, &(0x7f0000000580)={"edef8b3ff8586be14e686d36a27ae99b", 0x0, 0x0, {0x8, 0x2}, {0x9, 0x1}, 0x3, [0x398c, 0x101, 0x7, 0x5, 0x5, 0x7, 0x0, 0x400, 0x5, 0x0, 0x3, 0x9, 0xfff, 0x1, 0x1, 0x37f]})

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-socket$nl_generic-syz_genetlink_get_family_id$mptcp-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), r0)
r1 = socket$pppl2tp(0x18, 0x1, 0x1)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r1, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, &(0x7f0000000580)={"edef8b3ff8586be14e686d36a27ae99b", 0x0, 0x0, {0x8, 0x2}, {0x9, 0x1}, 0x3, [0x398c, 0x101, 0x7, 0x5, 0x5, 0x7, 0x0, 0x400, 0x5, 0x0, 0x3, 0x9, 0xfff, 0x1, 0x1, 0x37f]})

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-socket$nl_generic-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f0000000580)={"edef8b3ff8586be14e686d36a27ae99b", 0x0, 0x0, {0x8, 0x2}, {0x9, 0x1}, 0x3, [0x398c, 0x101, 0x7, 0x5, 0x5, 0x7, 0x0, 0x400, 0x5, 0x0, 0x3, 0x9, 0xfff, 0x1, 0x1, 0x37f]})

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f0000000580)={"edef8b3ff8586be14e686d36a27ae99b", 0x0, 0x0, {0x8, 0x2}, {0x9, 0x1}, 0x3, [0x398c, 0x101, 0x7, 0x5, 0x5, 0x7, 0x0, 0x400, 0x5, 0x0, 0x3, 0x9, 0xfff, 0x1, 0x1, 0x37f]})

program crashed: KASAN: use-after-free Read in rcu_cblist_dequeue
testing program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f0000000580)={"edef8b3ff8586be14e686d36a27ae99b", 0x0, 0x0, {0x8, 0x2}, {0x9, 0x1}, 0x3, [0x398c, 0x101, 0x7, 0x5, 0x5, 0x7, 0x0, 0x400, 0x5, 0x0, 0x3, 0x9, 0xfff, 0x1, 0x1, 0x37f]})

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, 0x0, 0x0)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, &(0x7f0000000580)={"edef8b3ff8586be14e686d36a27ae99b", 0x0, 0x0, {0x8, 0x2}, {0x9, 0x1}, 0x3, [0x398c, 0x101, 0x7, 0x5, 0x5, 0x7, 0x0, 0x400, 0x5, 0x0, 0x3, 0x9, 0xfff, 0x1, 0x1, 0x37f]})

program did not crash
testing program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, 0x0)

program crashed: KASAN: use-after-free Write in pppol2tp_release
extracting C reproducer
testing compiled C program (duration=33.710489847s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
program crashed: KASAN: use-after-free Write in pppol2tp_release
simplifying C reproducer
testing compiled C program (duration=33.710489847s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
program crashed: KASAN: use-after-free Write in pppol2tp_release
testing compiled C program (duration=33.710489847s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
program crashed: KASAN: use-after-free Write in pppol2tp_release
testing compiled C program (duration=33.710489847s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
program did not crash
testing compiled C program (duration=33.710489847s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
program crashed: KASAN: use-after-free Write in pppol2tp_release
testing compiled C program (duration=33.710489847s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
program crashed: KASAN: use-after-free Write in pppol2tp_release
testing compiled C program (duration=33.710489847s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
program crashed: KASAN: use-after-free Write in pppol2tp_release
testing compiled C program (duration=33.710489847s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing compiled C program (duration=33.710489847s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing compiled C program (duration=33.710489847s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing compiled C program (duration=33.710489847s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing compiled C program (duration=33.710489847s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing compiled C program (duration=33.710489847s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
program did not crash
testing program (duration=33.710489847s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, 0x0)

program crashed: KASAN: use-after-free Read in rcu_cblist_dequeue
validation run: crashed=true
testing program (duration=33.710489847s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, 0x0)

program crashed: KASAN: use-after-free Write in pppol2tp_release
validation run: crashed=true
testing program (duration=33.710489847s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000740)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x4e23, @broadcast}, 0x2, 0x0, 0x4}}, 0x2e)
ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, 0x0)

program crashed: KASAN: use-after-free Write in pppol2tp_release
validation run: crashed=true
reproducing took 32m5.634809402s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
BUG: KASAN: use-after-free in atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline]
BUG: KASAN: use-after-free in atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline]
BUG: KASAN: use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:173 [inline]
BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298
Write of size 8 at addr ffff888111647150 by task syz.2.17/379

CPU: 0 PID: 379 Comm: syz.2.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
 __dump_stack+0x21/0x24 lib/dump_stack.c:77
 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:435 [inline]
 kasan_report+0x100/0x140 mm/kasan/report.c:452
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189
 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37
 instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
 atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline]
 atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline]
 __mutex_trylock_fast kernel/locking/mutex.c:173 [inline]
 mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298
 pppol2tp_release+0x178/0x2b0 net/l2tp/l2tp_ppp.c:442
 __sock_release net/socket.c:597 [inline]
 sock_close+0xb8/0x200 net/socket.c:1287
 __fput+0x2dc/0x730 fs/file_table.c:281
 ____fput+0x15/0x20 fs/file_table.c:314
 task_work_run+0x127/0x190 kernel/task_work.c:189
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172
 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199
 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274
 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f6f8224de99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff84ad5c58 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007fff84ad5d40 RCX: 00007f6f8224de99
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 0000000000015d81 R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b32c20000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6f824d5fac R14: 00007f6f824d5fa8 R15: 00007f6f824d5fa0

Allocated by task 379:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:430 [inline]
 ____kasan_kmalloc mm/kasan/common.c:509 [inline]
 __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:518
 kasan_kmalloc include/linux/kasan.h:254 [inline]
 __kmalloc+0x19f/0x330 mm/slub.c:4038
 kmalloc include/linux/slab.h:560 [inline]
 kzalloc include/linux/slab.h:667 [inline]
 l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616
 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772
 __sys_connect_file net/socket.c:1867 [inline]
 __sys_connect+0x3ce/0x450 net/socket.c:1884
 __do_sys_connect net/socket.c:1894 [inline]
 __se_sys_connect net/socket.c:1891 [inline]
 __x64_sys_connect+0x7a/0x90 net/socket.c:1891
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

Freed by task 379:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4a/0x70 mm/kasan/common.c:45
 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:362
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370
 kasan_slab_free include/linux/kasan.h:220 [inline]
 slab_free_hook mm/slub.c:1600 [inline]
 slab_free_freelist_hook+0xc5/0x190 mm/slub.c:1626
 slab_free mm/slub.c:3208 [inline]
 kfree+0xc0/0x270 mm/slub.c:4196
 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline]
 l2tp_session_put+0xb2/0x1a0 net/l2tp/l2tp_core.c:193
 l2tp_session_delete+0x3a9/0x4a0 net/l2tp/l2tp_core.c:1589
 pppol2tp_release+0x169/0x2b0 net/l2tp/l2tp_ppp.c:439
 __sock_release net/socket.c:597 [inline]
 sock_close+0xb8/0x200 net/socket.c:1287
 __fput+0x2dc/0x730 fs/file_table.c:281
 ____fput+0x15/0x20 fs/file_table.c:314
 task_work_run+0x127/0x190 kernel/task_work.c:189
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172
 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199
 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274
 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

The buggy address belongs to the object at ffff888111647000
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 336 bytes inside of
 512-byte region [ffff888111647000, ffff888111647200)
The buggy address belongs to the page:
page:ffffea0004459100 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x111644
head:ffffea0004459100 order:2 compound_mapcount:0 compound_pincount:0
flags: 0x4000000000010200(slab|head)
raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 365, ts 89496351020, free_ts 89452942745
 set_page_owner include/linux/page_owner.h:35 [inline]
 post_alloc_hook mm/page_alloc.c:2456 [inline]
 prep_new_page+0x176/0x190 mm/page_alloc.c:2462
 get_page_from_freelist+0x225f/0x23f0 mm/page_alloc.c:4254
 __alloc_pages_nodemask+0x29a/0x640 mm/page_alloc.c:5384
 alloc_slab_page mm/slub.c:-1 [inline]
 allocate_slab mm/slub.c:1813 [inline]
 new_slab+0x84/0x3f0 mm/slub.c:1874
 new_slab_objects mm/slub.c:2632 [inline]
 ___slab_alloc+0x2f8/0x4c0 mm/slub.c:2796
 __slab_alloc+0x63/0xa0 mm/slub.c:2836
 slab_alloc_node mm/slub.c:2918 [inline]
 slab_alloc mm/slub.c:2960 [inline]
 __kmalloc+0x1f9/0x330 mm/slub.c:4034
 kmalloc include/linux/slab.h:560 [inline]
 kzalloc include/linux/slab.h:667 [inline]
 fib6_info_alloc+0x34/0xe0 net/ipv6/ip6_fib.c:154
 ip6_route_info_create+0x4c7/0x1450 net/ipv6/route.c:3671
 ip6_route_add+0x27/0x130 net/ipv6/route.c:3767
 addrconf_add_mroute net/ipv6/addrconf.c:2526 [inline]
 addrconf_add_dev+0x385/0x4c0 net/ipv6/addrconf.c:2544
 addrconf_dev_config+0x1c3/0x510 net/ipv6/addrconf.c:3426
 addrconf_notify+0x9d8/0xea0 net/ipv6/addrconf.c:3672
 notifier_call_chain kernel/notifier.c:83 [inline]
 raw_notifier_call_chain+0x90/0x100 kernel/notifier.c:410
 call_netdevice_notifiers_info net/core/dev.c:2052 [inline]
 call_netdevice_notifiers_extack net/core/dev.c:2064 [inline]
 call_netdevice_notifiers net/core/dev.c:2078 [inline]
 __dev_notify_flags+0x2f4/0x5b0 net/core/dev.c:8583
 dev_change_flags+0xe3/0x1a0 net/core/dev.c:8621
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:28 [inline]
 free_pages_prepare mm/page_alloc.c:1349 [inline]
 __free_pages_ok+0x80b/0x830 mm/page_alloc.c:1629
 free_the_page mm/page_alloc.c:5445 [inline]
 __free_pages+0xd8/0x390 mm/page_alloc.c:5454
 __free_slab+0xcf/0x190 mm/slub.c:1899
 free_slab mm/slub.c:1914 [inline]
 discard_slab mm/slub.c:1920 [inline]
 unfreeze_partials+0x150/0x180 mm/slub.c:2415
 put_cpu_partial+0xc1/0x180 mm/slub.c:2451
 __slab_free+0x2c9/0x3a0 mm/slub.c:3100
 do_slab_free mm/slub.c:3196 [inline]
 ___cache_free+0x10e/0x130 mm/slub.c:3215
 qlink_free+0x50/0x90 mm/kasan/quarantine.c:157
 qlist_free_all+0x5f/0xb0 mm/kasan/quarantine.c:176
 kasan_quarantine_reduce+0x14a/0x160 mm/kasan/quarantine.c:283
 __kasan_slab_alloc+0x2f/0xe0 mm/kasan/common.c:440
 kasan_slab_alloc include/linux/kasan.h:244 [inline]
 slab_post_alloc_hook+0x5d/0x2f0 mm/slab.h:580
 slab_alloc_node mm/slub.c:2952 [inline]
 slab_alloc mm/slub.c:2960 [inline]
 kmem_cache_alloc+0x15a/0x2d0 mm/slub.c:2965
 kmem_cache_alloc_node include/linux/slab.h:426 [inline]
 __alloc_skb+0x9e/0x520 net/core/skbuff.c:200
 alloc_skb include/linux/skbuff.h:1126 [inline]
 nlmsg_new include/net/netlink.h:953 [inline]
 rtmsg_ifinfo_build_skb+0x75/0x180 net/core/rtnetlink.c:3848
 rtmsg_ifinfo_event net/core/rtnetlink.c:3884 [inline]
 rtnetlink_event+0xd2/0x1a0 net/core/rtnetlink.c:5665

Memory state around the buggy address:
 ffff888111647000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888111647080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888111647100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                 ^
 ffff888111647180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888111647200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
BUG: KASAN: use-after-free in atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline]
BUG: KASAN: use-after-free in atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline]
BUG: KASAN: use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:173 [inline]
BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298
Write of size 8 at addr ffff888111647150 by task syz.2.17/379

CPU: 0 PID: 379 Comm: syz.2.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
 __dump_stack+0x21/0x24 lib/dump_stack.c:77
 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:435 [inline]
 kasan_report+0x100/0x140 mm/kasan/report.c:452
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189
 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37
 instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
 atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline]
 atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline]
 __mutex_trylock_fast kernel/locking/mutex.c:173 [inline]
 mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298
 pppol2tp_release+0x178/0x2b0 net/l2tp/l2tp_ppp.c:442
 __sock_release net/socket.c:597 [inline]
 sock_close+0xb8/0x200 net/socket.c:1287
 __fput+0x2dc/0x730 fs/file_table.c:281
 ____fput+0x15/0x20 fs/file_table.c:314
 task_work_run+0x127/0x190 kernel/task_work.c:189
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172
 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199
 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274
 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f6f8224de99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff84ad5c58 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007fff84ad5d40 RCX: 00007f6f8224de99
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 0000000000015d81 R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b32c20000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6f824d5fac R14: 00007f6f824d5fa8 R15: 00007f6f824d5fa0

Allocated by task 379:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:430 [inline]
 ____kasan_kmalloc mm/kasan/common.c:509 [inline]
 __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:518
 kasan_kmalloc include/linux/kasan.h:254 [inline]
 __kmalloc+0x19f/0x330 mm/slub.c:4038
 kmalloc include/linux/slab.h:560 [inline]
 kzalloc include/linux/slab.h:667 [inline]
 l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616
 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772
 __sys_connect_file net/socket.c:1867 [inline]
 __sys_connect+0x3ce/0x450 net/socket.c:1884
 __do_sys_connect net/socket.c:1894 [inline]
 __se_sys_connect net/socket.c:1891 [inline]
 __x64_sys_connect+0x7a/0x90 net/socket.c:1891
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

Freed by task 379:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4a/0x70 mm/kasan/common.c:45
 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:362
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370
 kasan_slab_free include/linux/kasan.h:220 [inline]
 slab_free_hook mm/slub.c:1600 [inline]
 slab_free_freelist_hook+0xc5/0x190 mm/slub.c:1626
 slab_free mm/slub.c:3208 [inline]
 kfree+0xc0/0x270 mm/slub.c:4196
 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline]
 l2tp_session_put+0xb2/0x1a0 net/l2tp/l2tp_core.c:193
 l2tp_session_delete+0x3a9/0x4a0 net/l2tp/l2tp_core.c:1589
 pppol2tp_release+0x169/0x2b0 net/l2tp/l2tp_ppp.c:439
 __sock_release net/socket.c:597 [inline]
 sock_close+0xb8/0x200 net/socket.c:1287
 __fput+0x2dc/0x730 fs/file_table.c:281
 ____fput+0x15/0x20 fs/file_table.c:314
 task_work_run+0x127/0x190 kernel/task_work.c:189
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172
 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199
 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274
 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

The buggy address belongs to the object at ffff888111647000
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 336 bytes inside of
 512-byte region [ffff888111647000, ffff888111647200)
The buggy address belongs to the page:
page:ffffea0004459100 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x111644
head:ffffea0004459100 order:2 compound_mapcount:0 compound_pincount:0
flags: 0x4000000000010200(slab|head)
raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 365, ts 89496351020, free_ts 89452942745
 set_page_owner include/linux/page_owner.h:35 [inline]
 post_alloc_hook mm/page_alloc.c:2456 [inline]
 prep_new_page+0x176/0x190 mm/page_alloc.c:2462
 get_page_from_freelist+0x225f/0x23f0 mm/page_alloc.c:4254
 __alloc_pages_nodemask+0x29a/0x640 mm/page_alloc.c:5384
 alloc_slab_page mm/slub.c:-1 [inline]
 allocate_slab mm/slub.c:1813 [inline]
 new_slab+0x84/0x3f0 mm/slub.c:1874
 new_slab_objects mm/slub.c:2632 [inline]
 ___slab_alloc+0x2f8/0x4c0 mm/slub.c:2796
 __slab_alloc+0x63/0xa0 mm/slub.c:2836
 slab_alloc_node mm/slub.c:2918 [inline]
 slab_alloc mm/slub.c:2960 [inline]
 __kmalloc+0x1f9/0x330 mm/slub.c:4034
 kmalloc include/linux/slab.h:560 [inline]
 kzalloc include/linux/slab.h:667 [inline]
 fib6_info_alloc+0x34/0xe0 net/ipv6/ip6_fib.c:154
 ip6_route_info_create+0x4c7/0x1450 net/ipv6/route.c:3671
 ip6_route_add+0x27/0x130 net/ipv6/route.c:3767
 addrconf_add_mroute net/ipv6/addrconf.c:2526 [inline]
 addrconf_add_dev+0x385/0x4c0 net/ipv6/addrconf.c:2544
 addrconf_dev_config+0x1c3/0x510 net/ipv6/addrconf.c:3426
 addrconf_notify+0x9d8/0xea0 net/ipv6/addrconf.c:3672
 notifier_call_chain kernel/notifier.c:83 [inline]
 raw_notifier_call_chain+0x90/0x100 kernel/notifier.c:410
 call_netdevice_notifiers_info net/core/dev.c:2052 [inline]
 call_netdevice_notifiers_extack net/core/dev.c:2064 [inline]
 call_netdevice_notifiers net/core/dev.c:2078 [inline]
 __dev_notify_flags+0x2f4/0x5b0 net/core/dev.c:8583
 dev_change_flags+0xe3/0x1a0 net/core/dev.c:8621
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:28 [inline]
 free_pages_prepare mm/page_alloc.c:1349 [inline]
 __free_pages_ok+0x80b/0x830 mm/page_alloc.c:1629
 free_the_page mm/page_alloc.c:5445 [inline]
 __free_pages+0xd8/0x390 mm/page_alloc.c:5454
 __free_slab+0xcf/0x190 mm/slub.c:1899
 free_slab mm/slub.c:1914 [inline]
 discard_slab mm/slub.c:1920 [inline]
 unfreeze_partials+0x150/0x180 mm/slub.c:2415
 put_cpu_partial+0xc1/0x180 mm/slub.c:2451
 __slab_free+0x2c9/0x3a0 mm/slub.c:3100
 do_slab_free mm/slub.c:3196 [inline]
 ___cache_free+0x10e/0x130 mm/slub.c:3215
 qlink_free+0x50/0x90 mm/kasan/quarantine.c:157
 qlist_free_all+0x5f/0xb0 mm/kasan/quarantine.c:176
 kasan_quarantine_reduce+0x14a/0x160 mm/kasan/quarantine.c:283
 __kasan_slab_alloc+0x2f/0xe0 mm/kasan/common.c:440
 kasan_slab_alloc include/linux/kasan.h:244 [inline]
 slab_post_alloc_hook+0x5d/0x2f0 mm/slab.h:580
 slab_alloc_node mm/slub.c:2952 [inline]
 slab_alloc mm/slub.c:2960 [inline]
 kmem_cache_alloc+0x15a/0x2d0 mm/slub.c:2965
 kmem_cache_alloc_node include/linux/slab.h:426 [inline]
 __alloc_skb+0x9e/0x520 net/core/skbuff.c:200
 alloc_skb include/linux/skbuff.h:1126 [inline]
 nlmsg_new include/net/netlink.h:953 [inline]
 rtmsg_ifinfo_build_skb+0x75/0x180 net/core/rtnetlink.c:3848
 rtmsg_ifinfo_event net/core/rtnetlink.c:3884 [inline]
 rtnetlink_event+0xd2/0x1a0 net/core/rtnetlink.c:5665

Memory state around the buggy address:
 ffff888111647000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888111647080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888111647100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                 ^
 ffff888111647180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888111647200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================