Extracting prog: 56.698691001s
Minimizing prog: 33m15.862965547s
Simplifying prog options: 0s
Extracting C: 49.168550272s
Simplifying C: 3m12.60150871s


extracting reproducer from 81 programs
testing a last program of every proc
single: executing 31 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-syz_mount_image$ext4-openat$tcp_mem-write$tcp_mem-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-socket$pppl2tp-socket$packet-socket$packet-setsockopt$packet_tx_ring-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-sendmmsg-ioctl$BTRFS_IOC_QGROUP_LIMIT-ioctl$BTRFS_IOC_QGROUP_LIMIT-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_LOOKUP_ELEM-syz_usb_connect$hid-syz_mount_image$ext4-connect$pppl2tp-connect$pppl2tp-socket$netlink-writev-syz_mount_image$exfat-bpf$PROG_LOAD_XDP-ioctl$BTRFS_IOC_QGROUP_CREATE-ioctl$BTRFS_IOC_QGROUP_CREATE-sched_setscheduler-mmap
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue")
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
write$tcp_mem(r2, 0x0, 0xfffffeff)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32)
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
socket$packet(0x11, 0x2, 0x300) (async)
r5 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r5, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) (async)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff)
sendmmsg(r5, &(0x7f0000000880)=[{{&(0x7f0000000180)=@hci={0x1f, 0xffffffffffffffff, 0x2}, 0x80, 0x0}}], 0x1, 0x45)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}})
bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="120000000a001700080000000200000000000000fd2232fdbec4f9088dfde2e8274444d7b426178cde3a981d5c0078e97367eb5484e7a23dc54df612ed2dce9abca9768676974b1e55ff3b3894d1df437715020e90f206dcc4be855105c9bf668efec2ef25381a55f29539442615eac4a856c07bd2a5d68edd3019747032767163fb6d6e5c1220b91bb2992c6de72293636f287f1469fb2e0f94bbcd418409c8c89f5ebbb67f3cfb005b1083683b998cd00a8fac5b49c74583", @ANYRES32, @ANYBLOB='\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) (async)
r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="120000000a001700080000000200000000000000fd2232fdbec4f9088dfde2e8274444d7b426178cde3a981d5c0078e97367eb5484e7a23dc54df612ed2dce9abca9768676974b1e55ff3b3894d1df437715020e90f206dcc4be855105c9bf668efec2ef25381a55f29539442615eac4a856c07bd2a5d68edd3019747032767163fb6d6e5c1220b91bb2992c6de72293636f287f1469fb2e0f94bbcd418409c8c89f5ebbb67f3cfb005b1083683b998cd00a8fac5b49c74583", @ANYRES32, @ANYBLOB='\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000002c0)={r6, &(0x7f0000000580), 0x0}, 0x20)
syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x8, 0x16c0, 0x5e1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x40, 0x40, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x1, 0x3, 0x41, {0x9, 0x21, 0xfff4, 0xd9, 0x1, {0x22, 0x998}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x5, 0x2, 0x7}}}}}]}}]}}, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x4, [{0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x444}}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})
syz_mount_image$ext4(&(0x7f0000000180)='ext2\x00', &(0x7f0000000200)='./file1\x00', 0x210000, &(0x7f0000000040)={[{@nobh}, {@debug}, {@barrier}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x2000}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x70}}, {@min_batch_time={'min_batch_time', 0x3d, 0x3d20}}, {@stripe={'stripe', 0x3d, 0x20}}, {@errors_remount}, {@max_batch_time={'max_batch_time', 0x3d, 0x3ff}}, {@inlinecrypt}, {@dioread_lock}]}, 0x3, 0x589, &(0x7f0000000d80)="$eJzs3c1rHOUfAPDvbHb7/vs1hVKsiBR6sFK7aRJfKnioR9FiQT3XkGxDyaZbspvSxILtwV68SBFELIh3vXvwULx49K8oaKFICQp6WZnNbLJpNslmszFp9/OBSZ5nZnafeeaZ78Mz++wyAfStE+mfXMTxiPgiiTjcsi0f2cYTi/stPL45ni5J1Osf/JFEkq1r7p9k/w9mmeci4ufPIk7nVpdbnZufGiuXSzNZfqg2fW2oOjd/5sr02GRpsnR1ZHT03GujI2++8XrP6vryxb++fv/+O+c+P7nw1Q8Pj9xN4nwcyra11mNT9q7I3WrNnKjXs3NSiPNPvGy4q8J2r2SnD4CuDGRxXoiI44XDhWbUA8++TyOiDvSpZJPxv1d/Ac+I5jigeW/f9X3wU+rR24s3QKvrn1/8bCT2Ne6NDiwkK+6M0vvdwR6Un5bx4+/37qZLbOVzCIBNunU7Is7m86v7vyTr/7p3toN9nixD/wf/nfvp+OeVduOf3NL4J9qMfw62id1ubBz/uYc9KGZN6fjvrbbj36VJq8GBLPe/xpivkFy+Ui6lfdv/I+JUFPam+fXmc84tPKivta11/JcuafnNsWB2HA/zK+eYYmKsNraVOrd6dDvi+bbj32Sp/ZM27Z+ej486LONY6d6La23buP7bq/5dxEtt2395RitZf35yqHE9DDWvitX+vHPs17XKb1//X37ahqq2lbb/gfXrP5i0ztdWN1/Gt/v+Ka21rdvrf0/yYSO9J1t3Y6xWmxmO2JO8t3r9yPJrm/nm/mn9T51cv/9rd/3vj4iPO6z/naPfv9B9/bdXWv+JTbX/5hMP3v3km7XK76z9X22kTmVrOun/Oj3ArZw7AAAAAAAA2G1yEXEoklwx9mXpXK5YXPx+x9E4kCtXqrXTlyuzVyei8VvZwSjkmjPdh1u+DzGcfR+2mR95Ij8aEUci4suB/Y18cbxSntjpygMAAAAAAAAAAAAAAAAAAMAucXDp9/+x4vf/qd8GdvrogG2XX3z+N9CHNnzkfy+e9ATsShvGP/DMEv/Qv8Q/9C/xD32pMcUn/qF/iX/oX+If+pf4BwAAAAAAAAAAAAAAAAAAAAAAAAAAgJ66eOFCutQXHt8cT/MT1+dmpyrXz0yUqlPF6dnx4nhl5lpxslKZLJeK45Xpjd6vXKlcGx6J2RtDtVK1NlSdm780XZm9Wrt0ZXpssnSp5DnjAAAAAAAAAAAAAAAAAAAAsFp1bn5qrFwuzfQgUSiXS7mI6GTniB4V+tQl/t7y+6Ttdivf2XnenkQSy2vyu+KsSvQ6sdM9EwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAs+zcAAP//MUwypA==")
connect$pppl2tp(r4, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, r4, {0x2, 0x4e23, @rand_addr=0x64010102}, 0x3, 0x0, 0x1}}, 0x26) (async)
connect$pppl2tp(r4, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, r4, {0x2, 0x4e23, @rand_addr=0x64010102}, 0x3, 0x0, 0x1}}, 0x26)
r7 = socket$netlink(0x10, 0x3, 0x8000000004)
writev(r7, &(0x7f00000000c0)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fbc45ff810500000000000058000b480400945f6400947e570028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010002081000418e00000004fcff", 0x58}], 0x1)
syz_mount_image$exfat(&(0x7f0000001500), &(0x7f0000001540)='./file0\x00', 0x0, &(0x7f0000001580), 0x1, 0x14d1, &(0x7f00000015c0)="$eJzs3AlwlcW2KOBe3f1DiBG3EZl79fphiwGaiIjIICIyiIiICIjMIiBiRERERISATCICIgIyRkSGEAGRIUDEMM/zPBg5iIiIyCSTQL/C47ncczy3uO+8cy+vKuur6kqv/Hut3Z1VyT9UZf/UdViNxjWrNiAi8a9Qf5vAX78kCyFihBADhRC3CSECIUTZ+LLx147nUpD8L70J+x/SMPVmr4DdTNz/7I37n71x/7M37n/2xv3P3rj/2Rv3P3vj/jOWraUVuJ1H9h38/D874/N/9sb9z964/9kb9z974/5nb9z/7I37n71x/7M37j9j2dr/B8+gedzEwRhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOM/S+44K/TQoi/zW/2uhhjjDHGGGOMMfbv43Pe7BUwxhhjjDHGGGPsfx4IKZTQIhA5RE4RI3KJWHGLiBO3itziNhERt4t4cYfII+4UeUU+kV8UEAVFIVFYGIHCChKhKCKKiqi4SxQTd4sEUVyUECWFE6VEorhHlBb3ijLiPlFW3C/KiQdEeVFBVBSVxIOisnhIVBEPi6riEVFNVBc1RE3xqKglHhO1xeOijnhC1BVPinriKVFfPC0aiIaikXhGNBbPiiaiqWgmmosWoqVo9S/lvyV6iLdFT9FLJIveoo94R/QV/UR/MUAMFO+KQeI9MVi8L4aIoWKY+EAMFx+KEeIjMVKMEqPFx2KMGCvGifFigpgoUsQnYpL4VEwWn4kpYqqYJqaLVDFDpInPxUwxS8wWX4g54ksxV8wT88UCkS4WikViscgQX4kl4muRKZaKZWK5WCFWilVitVgj1op1Yr3YIDaKTWKz2CK2im1iu9ghdopdYrfYI/aKfWK/OCC+EVni2//L/PP/kN8NBAiQIEGDhhyQA2IgBmIhFuIgDnJDbohABOIhHvJAHsgLeSE/5IeCUBAKQ2FAQCAgKAJFIApRKAbFIAESoASUAAcOEiERSsO9UAbKQFkoC+WgHJSHClABKkElqAyVoQpUgapQFapBNagBNeBReBQeg9pQG+pAHagLdaEe1IP6UB8aQANoBI2gMTSGJtAEmkEzaAEtoBW0gtbQGtpAG2gH7aA9tIcO0AGSIAk6QkfoBJ2gM3SGLtAFukJX6AZvwpvwFrwFb8Pb0Auqyd7QB/pAX+gL/WEADIB3YRC8B+/B+zAEhsIw+AA+gA9hBJyDkTAKRsNoqCzHwjgYDyQnQgqkwCSYBJNhMkyBqTAVpkMqzIA0SIOZMAtmwRcwB76EL2EezIMFkA7psAgWQwZkwBI4D5mwFJbBclgBK2EFrIY1sBrWwXpYBxthI2yGzbAVtsJ22A47YSfsht2wF/bCftgPQyALsuAgHIRDcAgOw2E4AkfgKByFY3AMjsNxOAEn4CScgtNwCs7CWTgH5+ECXIBLcAkuw2W4Clev/fLLa7TUMofMIWNkjIyVsTJOxsncMreMyIiMl/Eyj8wj88q8Mr/MLwvKgrKwLCxRoiQZyiKyiIzKqCwmi8kEmSBLyBLSSScTZaIsLUvLMrKMLCvvl+XkA7K8rCDbukqykqws27kq8mFZVVaV1WR1WUPWlDVlLVlL1pa1ZR1ZR9aVdWU9+ZSsL3tDf2gor3WmsRwKTeQwaCabyxaypfwQnpOt5QhoI9vKdvIFOQpGQgfZ2iXJl2VHOQ46yVfleHhNdpEToat8Q3aTb8ru8i3ZQ7ZxPWUvOQV6yz5yOvSV/WR/OUDOhOryWsdqyPflEDlUDpMfyAXwoRwhP5Ij5Sg5Wn4sx8ixcpwcLyfIiTJFfiInyU/lZPmZnCKnymlyukyVM2Sa/FzOlLPkbPmFnCO/lHPlPDlfLpDpcqFcJBfLDPmVXCK/lplyqVwml8sVcqVcJVfLNXKtXCfXyw1yo9wkN8stcqvcJrfLHXKn3CV3yz1yr9wn98sD8huZJb+VB+Vf5CH5nTwsv5dH5A/yqPxRHpM/yePyZ3lC/iJPylPytDwjz8pf5Tl5Xl6QF+Ul+Zu8LK/Iq9JLoUBJpZRWgcqhcqoYlUvFqltUnLpV5Va3qYi6XcWrO1QedafKq/Kp/KqAKqgKqcLKKFRWkQpVEVVURdVdqpi6WyWo4qqEKqmcKqUS1T2qtLpXlVH3qbLqflVOPaDKqwqqoqqkHlSV1UOqinpYVVWPqGqquqqhaqpHVS31mKqtHld11BOqrnpS1VNPqfrqadVANVSN1DOqsXpWNVFNVTPVXLVQLVUr9ZxqrZ5XbVRb1U69oNqrF1UH9ZJKUi+rjuoV1Um9qjqr11QX9brqqt5Q3dSbqru6oq4qr3qqXipZ9VZ91Duqr+qn+qsBaqB6Vw1S76nB6n01RA1Vw9QHarj6UI1QH6mRapQarT5WY9RYNU6NVxPURJWiPlGT1KdqsvpMTVFT1TQ1XaWqGar/H5Vm/zfyP/0n+YN/f/fNaovaqrap7WqH2ql2qd1qj9qj9ql96oA6oLJUljqoDqpD6pA6rA6rI+qIOqqOqmPqmDqujqsT6oQ6qU6pi+qMOqt+VefUeXVeXVSX1CV1+Y+fgdCgpVZa60Dn0Dl1jM6lY/UtOk7fqnPr23RE367j9R06j75T59X5dH5dQBfUhXRhbTRqq0mHuoguqqP6Ll1M360TdHFdQpfUTpfSifqe/+f8G62vlW6lW+vWuo1uo9vpdrq9bq876A46SSfpjrqj7qQ76c66s+6iu+iuuqvuprvp7rq77qF76J66p07WybqPfkf31f10fz1AD9Tv6kF6kB6sB+sheogepofp4Xq4HqFH6JF6pB6tR+sxeowep8fpCXqCTtEpepKepCfryXqKnqKn6Wk6VafqNJ2mZ+qZeraerefoOXqunqvn6/k6XafrRXqRztAZeoleojP1Ur1UL9fL9Uq9Uq/Wq/VavVav1+v1Rr1RZ+oteoveprfpHXqH3qV36T16j96n9+kD+oDO0ln6oD6oD+lD+rA+rI/oI/qoPqqP6WP6uD6uT+gT+qQ+qU/r0/qsPqvP6XP6gr6gL+lL+rK+rK/qq9cu+wIZyEAHOsgR5AhigpggNogN4oK4IHeQO4gEkSA+iA/yBHcGeYN8Qf6gQFAwKBQUDkyAgQ0oCIMiQdEgGtwVFAvuDhKC4kGJoGTgglJBYnBPUDq4NygT3BeUDe4PygUPBOWDCkHFoFLwYFA5eCioEjwcVA0eCaoF1YMaQc3g0aBW8FhQO3g8qBM8EdQNngzqBU8F9YOngwZBw6BR8EzQOHg2aBI0DZoFzYMWQcug1b+1vvfn8j3veppeJtn0Nn3MO6av6Wf6mwFmoHnXDDLvmcHmfTPEDDXDzAdmuPnQjDAfmZFmlBltPjZjzFgzzow3E8xEk2I+MZPMp2ay+cxMMVPNNDPdpJoZJs18bmaaWWa2+cLMMV+auWaemW8WmHSz0Cwyi02G+cosMV+bTLPULDPLzQqz0qwyq80as9asM+vNBrPRbDKbzRaz1Wwz280Os9PsMrvNHrPX7DP7zQHzjcky35qD5i/mkPnOHDbfmyPmB3PU/GiOmZ/McfOzOWF+MSfNKXPanDFnza/mnDlvLpiL5pL5zVw2V8xV469d3F87vaNGjTkwB8ZgDMZiLMZhHObG3BjBCMZjPObBPJgX82J+zI8FsSAWxsJ4DSFhESyCUYxiMSyGCZiAJbAEOnSYiIlYGktjGSyDZbEslsNyWB7LY0WsiA/ig/gQPoQP48P4CD6C1bE61sSaWAtrYW2sjXWwDtbFulgP62F9rI8NsAE2wkbYGBtjE2yCzbAZtsAW2ApbYWtsjW2wDbbDdtge22MH7IBJmIQdsSN2wk7YGTtjF+yCXbErdsNu2B27Yw/sgT2xJyZjMvbBPtgX+2J/7I8DcSAOwkE4GAfjEByCw3AYDsfhOAJH4EgchaPxYxyDY3EcjscJOBFTMAUn4SScjJNxCk7BaTgNUzEV0zANZ+JMnI2zcQ7Owbk4F+fjfEzHdFyEizADM3AJLsFMzMRluAxX4ApchatwDa7BdbgON+AG3ISbcAtuwW24DXfgDtyFu3AP7sF9uA8P4AHMwiw8iAfxEB7Cw3gYj+ARPIpH8Rgew+N4HE/gCTyJJ/E0nsazeBbP4Tm8gBfwEv6Gl/EKXkWPMTaXjbW32Dh7q81tb7P/GOe3BWxBW8gWtsbmtfn+LkZrbYItbkvYktbZUjbR3vOnuLytYCvaSvZBW9k+ZKv8Ka5lH7O17eO2jn3C1rSP/l1c1z5p69lnbX3b1DawzW0j29I2ts/aJrapbWab2xa2pW1vX7Qd7Es2yb5sO9pX/hQvsovtGrvWrrPr7T67316wF+0x+5O9ZH+zPW0vO9C+awfZ9+xg+74dYof+KR5tP7Zj7Fg7zo63E+zEP8XT7HSbamfYNPu5nWln/SlOtwvtHJth59p5dr5d8Ht8bU0Z9iu7xH5tM+1Su8wutyvsSrvKrv6PtS63G+0mu9nusXvtNrvd7rA77S67+/f42j4O2G9slv3WHrU/2kP2O3vYHrdH7A+/x9f2d9z+bE/YX+xJe8qetmfsWfurPWfP/77/a3s/Y6/Yq9ZbQUCSFGkKKAflpBjKRbF0C8XRrZSbbqMI3U7xdAfloTspL+Wj/FSAClIhKkyGkCwRhVSEilKU7qJidDclUHEqQSXJUSlKpHuoNN1LZeg+Kkv3Uzl6gMpTBapIlehBqkwPURV6mKrSI1SNqlMNqkmPUi16jGrT41SHnqC69CTVo6eoPj1NDaghNaJnqDE9S02oKTWj5tSCWlIreo5a0/PUhtpSO3qB2tOL1IFeoiR6mTrSK9SJXqXO9Bp1odepK71B3ehN6k5vUQ96m3pSL0qm3tSH3qG+1I/60wAaSO/SIHqPBtP7NISG0jD6gIbThzSCPqKRNIpG08c0hsbSOBpPE2gipdAnNIk+pcn0GU2hqTSNplMqzaA0+pxm0iyaTV/QHPqS5tI8mk8LKJ0W0iJaTBn0FS2hrymTltIyWk4raCWtotW0htbSOlpPG2gjbaLNtIW20jbaTjtoJ+2i3bSH9tI+2k8H6BvKom/pIP2FDtF3dJi+pyP0Ax2lH+kY/UTH6Wc6Qb/QSTpFp+kMnaVf6Rydpwt0kS7Rb3SZrtBV8iRCCGWoQh0GYY4wZxgT5gpjw1vCuPDWMHd4WxgJbw/jwzvCPOGdYd4wX5g/LBAWDAuFhUMTYmhDCsOwSFg0jIZ3hcXCu8OEsHhYIiwZurBUmBjeE5YO7w3LhPeFZcP7w3LhA2H5sEJYMawUPhhWDh8Kq4QPh1XDR8JqYfWwRlgzfDSsFT4W1g4fD+uET4RlwifDeuFTYf3w6bBB2DBsFD4TNg6fDZuETcNmYfOwRdgybBU+F7YOnw/bhG3DduELYfvwxbBD+FKYFL4cdgxfueHx5LB32Cd8J3wn9P5xNT+6IJoeXRhdFF0czYh+FV0S/TqaGV0aXRZdHl0RXRldFV0dXRNdG10XXR/dEN0Y3RTdHPW+Zk7hwEmnnHaBy+FyuhiXy8W6W1ycu9Xldre5iLvdxbs7XB53p8vr8rn8roAr6Aq5ws44dNaRC10RV9RF3V2umLvbJbjiroQr6Zwr5RJdS9fKtXKt3fOujWvr2rkX3AvuRfeie8m95F52Hd0rrpN71XV2r7ku7nX3unvDdXNvuu7uLdfDve16ul4u2SW7Pq6P6+v6uv6uvxvoBrpBbpAb7Aa7IW6IG+aGueFuuBvhRriRbqQb7Ua7MW6MG+fGuQlugktxKW6Sm+Qmu8luipviprlpLtWlujSX5ma6mW62m+3muDlurpvr5rv5Lt2lu0VukctwGW6JW+IyXaZb5pa5FW6FW+VWuTVujVvn1rkNboPb5Da5LW6L2+a2uR1uh9vldrk9bo/b5/a5A+6Ay3JZ7qA76A65Q+6w+94dcT+4o+5Hd8z95I67n90J94s76U650+6MO+t+defceXfBXXSX3G/usrvirjrvUiKfRCZFPo1MjnwWmRKZGpkWmR5JjcyIpEU+j8yMzIrMjnwRmRP5MjI3Mi8yP7Igkh5ZGFkUWRzJiHwVWRL5OpIZWRpZFlkeWRFZGfG+0LbQF/FFfdTf5Yv5u32CL+5L+JLe+VI+0d/jS/t7fRl/ny/r7/fl/AO+vK/gK/qmvplv7lv4lr6Vf8639s/7Nr6tb+df8O39i76Df8kn+Zd9R/+K7+Rf9Z39a76Lf9139W/4bv5N392/5Xv4t31P38sn+96+j3/H9/X9fH8/wA/07/pB/j0/2L/vh/ihfpj/wA/3H/oR/iM/0o/yo/3Hfowf68f58X6Cn+hT/Cd+kv/UT/af+Sl+qp/mp/tUP8On+c/9TD/Lz/Zf+Dn+Sz/Xz/Pz/QKf7hf6RX6xz/Bf+SX+a5/pl/plfrlf4Vf6VX61X+PX+nV+vd/gN/pNfrPf4rf6bX673+F3+l1+t9/j9/p9fr8/4L/xWf5bf9D/xR/y3/nD/nt/xP/gj/of/TH/kz/uf/Yn/C/+pD/lT/sz/qz/1Z/z5/0Ff9Ff8r/5y/6Kv8r/s8YYY4wx9t+ibnC89z/5nvxjXNNHCHHr9gJH/rHmhrx/nfeT+zpGhBAv9+ra8G+jYcPk5OQ/XpupRFB0nhAicj0/h7geLxXtxIsiSbQVpf/p+vrJikA3qB+9X4jY/5QTI67H1+vf+1/Ub7rwhvXnCZFQ9HpOLnE9vl6/zH9Rf3f7G9TP9V2KEG3+U06cuB5fr58onheviKS/eyVjjDHGGGOMMfZX/eSlbje6v712f15QX8/JKa7HN7o/Z4wxxhhjjDHG2M332pvdX3ouKaltZ57whCc8+Y/Jzf7LxBhjjDHGGPt3u37Rf7NXwhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMZV//Gx8ndrP3yBhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjN1s/ycAAP//fMhn/w==")
bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0xd, 0x1cd, &(0x7f0000000040)=@framed, &(0x7f0000000100)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x84}, 0x94)
ioctl$BTRFS_IOC_QGROUP_CREATE(r7, 0x4010942a, &(0x7f0000000080)={0x1, 0x2}) (async)
ioctl$BTRFS_IOC_QGROUP_CREATE(r7, 0x4010942a, &(0x7f0000000080)={0x1, 0x2})
sched_setscheduler(0x0, 0x2, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0)

program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work
single: successfully extracted reproducer
found reproducer with 40 syscalls
minimizing guilty program
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-syz_mount_image$ext4-openat$tcp_mem-write$tcp_mem-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-socket$pppl2tp-socket$packet-socket$packet-setsockopt$packet_tx_ring-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-sendmmsg-ioctl$BTRFS_IOC_QGROUP_LIMIT-ioctl$BTRFS_IOC_QGROUP_LIMIT-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_LOOKUP_ELEM-syz_usb_connect$hid-syz_mount_image$ext4-connect$pppl2tp-connect$pppl2tp-socket$netlink-writev-syz_mount_image$exfat-bpf$PROG_LOAD_XDP-ioctl$BTRFS_IOC_QGROUP_CREATE-ioctl$BTRFS_IOC_QGROUP_CREATE-sched_setscheduler
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue")
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
write$tcp_mem(r2, 0x0, 0xfffffeff)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32)
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
socket$packet(0x11, 0x2, 0x300) (async)
r5 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r5, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) (async)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff)
sendmmsg(r5, &(0x7f0000000880)=[{{&(0x7f0000000180)=@hci={0x1f, 0xffffffffffffffff, 0x2}, 0x80, 0x0}}], 0x1, 0x45)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}})
bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="120000000a001700080000000200000000000000fd2232fdbec4f9088dfde2e8274444d7b426178cde3a981d5c0078e97367eb5484e7a23dc54df612ed2dce9abca9768676974b1e55ff3b3894d1df437715020e90f206dcc4be855105c9bf668efec2ef25381a55f29539442615eac4a856c07bd2a5d68edd3019747032767163fb6d6e5c1220b91bb2992c6de72293636f287f1469fb2e0f94bbcd418409c8c89f5ebbb67f3cfb005b1083683b998cd00a8fac5b49c74583", @ANYRES32, @ANYBLOB='\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) (async)
r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="120000000a001700080000000200000000000000fd2232fdbec4f9088dfde2e8274444d7b426178cde3a981d5c0078e97367eb5484e7a23dc54df612ed2dce9abca9768676974b1e55ff3b3894d1df437715020e90f206dcc4be855105c9bf668efec2ef25381a55f29539442615eac4a856c07bd2a5d68edd3019747032767163fb6d6e5c1220b91bb2992c6de72293636f287f1469fb2e0f94bbcd418409c8c89f5ebbb67f3cfb005b1083683b998cd00a8fac5b49c74583", @ANYRES32, @ANYBLOB='\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000002c0)={r6, &(0x7f0000000580), 0x0}, 0x20)
syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x8, 0x16c0, 0x5e1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x40, 0x40, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x1, 0x3, 0x41, {0x9, 0x21, 0xfff4, 0xd9, 0x1, {0x22, 0x998}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x5, 0x2, 0x7}}}}}]}}]}}, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x4, [{0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x444}}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})
syz_mount_image$ext4(&(0x7f0000000180)='ext2\x00', &(0x7f0000000200)='./file1\x00', 0x210000, &(0x7f0000000040)={[{@nobh}, {@debug}, {@barrier}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x2000}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x70}}, {@min_batch_time={'min_batch_time', 0x3d, 0x3d20}}, {@stripe={'stripe', 0x3d, 0x20}}, {@errors_remount}, {@max_batch_time={'max_batch_time', 0x3d, 0x3ff}}, {@inlinecrypt}, {@dioread_lock}]}, 0x3, 0x589, &(0x7f0000000d80)="$eJzs3c1rHOUfAPDvbHb7/vs1hVKsiBR6sFK7aRJfKnioR9FiQT3XkGxDyaZbspvSxILtwV68SBFELIh3vXvwULx49K8oaKFICQp6WZnNbLJpNslmszFp9/OBSZ5nZnafeeaZ78Mz++wyAfStE+mfXMTxiPgiiTjcsi0f2cYTi/stPL45ni5J1Osf/JFEkq1r7p9k/w9mmeci4ufPIk7nVpdbnZufGiuXSzNZfqg2fW2oOjd/5sr02GRpsnR1ZHT03GujI2++8XrP6vryxb++fv/+O+c+P7nw1Q8Pj9xN4nwcyra11mNT9q7I3WrNnKjXs3NSiPNPvGy4q8J2r2SnD4CuDGRxXoiI44XDhWbUA8++TyOiDvSpZJPxv1d/Ac+I5jigeW/f9X3wU+rR24s3QKvrn1/8bCT2Ne6NDiwkK+6M0vvdwR6Un5bx4+/37qZLbOVzCIBNunU7Is7m86v7vyTr/7p3toN9nixD/wf/nfvp+OeVduOf3NL4J9qMfw62id1ubBz/uYc9KGZN6fjvrbbj36VJq8GBLPe/xpivkFy+Ui6lfdv/I+JUFPam+fXmc84tPKivta11/JcuafnNsWB2HA/zK+eYYmKsNraVOrd6dDvi+bbj32Sp/ZM27Z+ej486LONY6d6La23buP7bq/5dxEtt2395RitZf35yqHE9DDWvitX+vHPs17XKb1//X37ahqq2lbb/gfXrP5i0ztdWN1/Gt/v+Ka21rdvrf0/yYSO9J1t3Y6xWmxmO2JO8t3r9yPJrm/nm/mn9T51cv/9rd/3vj4iPO6z/naPfv9B9/bdXWv+JTbX/5hMP3v3km7XK76z9X22kTmVrOun/Oj3ArZw7AAAAAAAA2G1yEXEoklwx9mXpXK5YXPx+x9E4kCtXqrXTlyuzVyei8VvZwSjkmjPdh1u+DzGcfR+2mR95Ij8aEUci4suB/Y18cbxSntjpygMAAAAAAAAAAAAAAAAAAMAucXDp9/+x4vf/qd8GdvrogG2XX3z+N9CHNnzkfy+e9ATsShvGP/DMEv/Qv8Q/9C/xD32pMcUn/qF/iX/oX+If+pf4BwAAAAAAAAAAAAAAAAAAAAAAAAAAgJ66eOFCutQXHt8cT/MT1+dmpyrXz0yUqlPF6dnx4nhl5lpxslKZLJeK45Xpjd6vXKlcGx6J2RtDtVK1NlSdm780XZm9Wrt0ZXpssnSp5DnjAAAAAAAAAAAAAAAAAAAAsFp1bn5qrFwuzfQgUSiXS7mI6GTniB4V+tQl/t7y+6Ttdivf2XnenkQSy2vyu+KsSvQ6sdM9EwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAs+zcAAP//MUwypA==")
connect$pppl2tp(r4, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, r4, {0x2, 0x4e23, @rand_addr=0x64010102}, 0x3, 0x0, 0x1}}, 0x26) (async)
connect$pppl2tp(r4, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, r4, {0x2, 0x4e23, @rand_addr=0x64010102}, 0x3, 0x0, 0x1}}, 0x26)
r7 = socket$netlink(0x10, 0x3, 0x8000000004)
writev(r7, &(0x7f00000000c0)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fbc45ff810500000000000058000b480400945f6400947e570028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010002081000418e00000004fcff", 0x58}], 0x1)
syz_mount_image$exfat(&(0x7f0000001500), &(0x7f0000001540)='./file0\x00', 0x0, &(0x7f0000001580), 0x1, 0x14d1, &(0x7f00000015c0)="$eJzs3AlwlcW2KOBe3f1DiBG3EZl79fphiwGaiIjIICIyiIiICIjMIiBiRERERISATCICIgIyRkSGEAGRIUDEMM/zPBg5iIiIyCSTQL/C47ncczy3uO+8cy+vKuur6kqv/Hut3Z1VyT9UZf/UdViNxjWrNiAi8a9Qf5vAX78kCyFihBADhRC3CSECIUTZ+LLx147nUpD8L70J+x/SMPVmr4DdTNz/7I37n71x/7M37n/2xv3P3rj/2Rv3P3vj/jOWraUVuJ1H9h38/D874/N/9sb9z964/9kb9z974/5nb9z/7I37n71x/7M37j9j2dr/B8+gedzEwRhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOM/S+44K/TQoi/zW/2uhhjjDHGGGOMMfbv43Pe7BUwxhhjjDHGGGPsfx4IKZTQIhA5RE4RI3KJWHGLiBO3itziNhERt4t4cYfII+4UeUU+kV8UEAVFIVFYGIHCChKhKCKKiqi4SxQTd4sEUVyUECWFE6VEorhHlBb3ijLiPlFW3C/KiQdEeVFBVBSVxIOisnhIVBEPi6riEVFNVBc1RE3xqKglHhO1xeOijnhC1BVPinriKVFfPC0aiIaikXhGNBbPiiaiqWgmmosWoqVo9S/lvyV6iLdFT9FLJIveoo94R/QV/UR/MUAMFO+KQeI9MVi8L4aIoWKY+EAMFx+KEeIjMVKMEqPFx2KMGCvGifFigpgoUsQnYpL4VEwWn4kpYqqYJqaLVDFDpInPxUwxS8wWX4g54ksxV8wT88UCkS4WikViscgQX4kl4muRKZaKZWK5WCFWilVitVgj1op1Yr3YIDaKTWKz2CK2im1iu9ghdopdYrfYI/aKfWK/OCC+EVni2//L/PP/kN8NBAiQIEGDhhyQA2IgBmIhFuIgDnJDbohABOIhHvJAHsgLeSE/5IeCUBAKQ2FAQCAgKAJFIApRKAbFIAESoASUAAcOEiERSsO9UAbKQFkoC+WgHJSHClABKkElqAyVoQpUgapQFapBNagBNeBReBQeg9pQG+pAHagLdaEe1IP6UB8aQANoBI2gMTSGJtAEmkEzaAEtoBW0gtbQGtpAG2gH7aA9tIcO0AGSIAk6QkfoBJ2gM3SGLtAFukJX6AZvwpvwFrwFb8Pb0Auqyd7QB/pAX+gL/WEADIB3YRC8B+/B+zAEhsIw+AA+gA9hBJyDkTAKRsNoqCzHwjgYDyQnQgqkwCSYBJNhMkyBqTAVpkMqzIA0SIOZMAtmwRcwB76EL2EezIMFkA7psAgWQwZkwBI4D5mwFJbBclgBK2EFrIY1sBrWwXpYBxthI2yGzbAVtsJ22A47YSfsht2wF/bCftgPQyALsuAgHIRDcAgOw2E4AkfgKByFY3AMjsNxOAEn4CScgtNwCs7CWTgH5+ECXIBLcAkuw2W4Clev/fLLa7TUMofMIWNkjIyVsTJOxsncMreMyIiMl/Eyj8wj88q8Mr/MLwvKgrKwLCxRoiQZyiKyiIzKqCwmi8kEmSBLyBLSSScTZaIsLUvLMrKMLCvvl+XkA7K8rCDbukqykqws27kq8mFZVVaV1WR1WUPWlDVlLVlL1pa1ZR1ZR9aVdWU9+ZSsL3tDf2gor3WmsRwKTeQwaCabyxaypfwQnpOt5QhoI9vKdvIFOQpGQgfZ2iXJl2VHOQ46yVfleHhNdpEToat8Q3aTb8ru8i3ZQ7ZxPWUvOQV6yz5yOvSV/WR/OUDOhOryWsdqyPflEDlUDpMfyAXwoRwhP5Ij5Sg5Wn4sx8ixcpwcLyfIiTJFfiInyU/lZPmZnCKnymlyukyVM2Sa/FzOlLPkbPmFnCO/lHPlPDlfLpDpcqFcJBfLDPmVXCK/lplyqVwml8sVcqVcJVfLNXKtXCfXyw1yo9wkN8stcqvcJrfLHXKn3CV3yz1yr9wn98sD8huZJb+VB+Vf5CH5nTwsv5dH5A/yqPxRHpM/yePyZ3lC/iJPylPytDwjz8pf5Tl5Xl6QF+Ul+Zu8LK/Iq9JLoUBJpZRWgcqhcqoYlUvFqltUnLpV5Va3qYi6XcWrO1QedafKq/Kp/KqAKqgKqcLKKFRWkQpVEVVURdVdqpi6WyWo4qqEKqmcKqUS1T2qtLpXlVH3qbLqflVOPaDKqwqqoqqkHlSV1UOqinpYVVWPqGqquqqhaqpHVS31mKqtHld11BOqrnpS1VNPqfrqadVANVSN1DOqsXpWNVFNVTPVXLVQLVUr9ZxqrZ5XbVRb1U69oNqrF1UH9ZJKUi+rjuoV1Um9qjqr11QX9brqqt5Q3dSbqru6oq4qr3qqXipZ9VZ91Duqr+qn+qsBaqB6Vw1S76nB6n01RA1Vw9QHarj6UI1QH6mRapQarT5WY9RYNU6NVxPURJWiPlGT1KdqsvpMTVFT1TQ1XaWqGar/H5Vm/zfyP/0n+YN/f/fNaovaqrap7WqH2ql2qd1qj9qj9ql96oA6oLJUljqoDqpD6pA6rA6rI+qIOqqOqmPqmDqujqsT6oQ6qU6pi+qMOqt+VefUeXVeXVSX1CV1+Y+fgdCgpVZa60Dn0Dl1jM6lY/UtOk7fqnPr23RE367j9R06j75T59X5dH5dQBfUhXRhbTRqq0mHuoguqqP6Ll1M360TdHFdQpfUTpfSifqe/+f8G62vlW6lW+vWuo1uo9vpdrq9bq876A46SSfpjrqj7qQ76c66s+6iu+iuuqvuprvp7rq77qF76J66p07WybqPfkf31f10fz1AD9Tv6kF6kB6sB+sheogepofp4Xq4HqFH6JF6pB6tR+sxeowep8fpCXqCTtEpepKepCfryXqKnqKn6Wk6VafqNJ2mZ+qZeraerefoOXqunqvn6/k6XafrRXqRztAZeoleojP1Ur1UL9fL9Uq9Uq/Wq/VavVav1+v1Rr1RZ+oteoveprfpHXqH3qV36T16j96n9+kD+oDO0ln6oD6oD+lD+rA+rI/oI/qoPqqP6WP6uD6uT+gT+qQ+qU/r0/qsPqvP6XP6gr6gL+lL+rK+rK/qq9cu+wIZyEAHOsgR5AhigpggNogN4oK4IHeQO4gEkSA+iA/yBHcGeYN8Qf6gQFAwKBQUDkyAgQ0oCIMiQdEgGtwVFAvuDhKC4kGJoGTgglJBYnBPUDq4NygT3BeUDe4PygUPBOWDCkHFoFLwYFA5eCioEjwcVA0eCaoF1YMaQc3g0aBW8FhQO3g8qBM8EdQNngzqBU8F9YOngwZBw6BR8EzQOHg2aBI0DZoFzYMWQcug1b+1vvfn8j3veppeJtn0Nn3MO6av6Wf6mwFmoHnXDDLvmcHmfTPEDDXDzAdmuPnQjDAfmZFmlBltPjZjzFgzzow3E8xEk2I+MZPMp2ay+cxMMVPNNDPdpJoZJs18bmaaWWa2+cLMMV+auWaemW8WmHSz0Cwyi02G+cosMV+bTLPULDPLzQqz0qwyq80as9asM+vNBrPRbDKbzRaz1Wwz280Os9PsMrvNHrPX7DP7zQHzjcky35qD5i/mkPnOHDbfmyPmB3PU/GiOmZ/McfOzOWF+MSfNKXPanDFnza/mnDlvLpiL5pL5zVw2V8xV469d3F87vaNGjTkwB8ZgDMZiLMZhHObG3BjBCMZjPObBPJgX82J+zI8FsSAWxsJ4DSFhESyCUYxiMSyGCZiAJbAEOnSYiIlYGktjGSyDZbEslsNyWB7LY0WsiA/ig/gQPoQP48P4CD6C1bE61sSaWAtrYW2sjXWwDtbFulgP62F9rI8NsAE2wkbYGBtjE2yCzbAZtsAW2ApbYWtsjW2wDbbDdtge22MH7IBJmIQdsSN2wk7YGTtjF+yCXbErdsNu2B27Yw/sgT2xJyZjMvbBPtgX+2J/7I8DcSAOwkE4GAfjEByCw3AYDsfhOAJH4EgchaPxYxyDY3EcjscJOBFTMAUn4SScjJNxCk7BaTgNUzEV0zANZ+JMnI2zcQ7Owbk4F+fjfEzHdFyEizADM3AJLsFMzMRluAxX4ApchatwDa7BdbgON+AG3ISbcAtuwW24DXfgDtyFu3AP7sF9uA8P4AHMwiw8iAfxEB7Cw3gYj+ARPIpH8Rgew+N4HE/gCTyJJ/E0nsazeBbP4Tm8gBfwEv6Gl/EKXkWPMTaXjbW32Dh7q81tb7P/GOe3BWxBW8gWtsbmtfn+LkZrbYItbkvYktbZUjbR3vOnuLytYCvaSvZBW9k+ZKv8Ka5lH7O17eO2jn3C1rSP/l1c1z5p69lnbX3b1DawzW0j29I2ts/aJrapbWab2xa2pW1vX7Qd7Es2yb5sO9pX/hQvsovtGrvWrrPr7T67316wF+0x+5O9ZH+zPW0vO9C+awfZ9+xg+74dYof+KR5tP7Zj7Fg7zo63E+zEP8XT7HSbamfYNPu5nWln/SlOtwvtHJth59p5dr5d8Ht8bU0Z9iu7xH5tM+1Su8wutyvsSrvKrv6PtS63G+0mu9nusXvtNrvd7rA77S67+/f42j4O2G9slv3WHrU/2kP2O3vYHrdH7A+/x9f2d9z+bE/YX+xJe8qetmfsWfurPWfP/77/a3s/Y6/Yq9ZbQUCSFGkKKAflpBjKRbF0C8XRrZSbbqMI3U7xdAfloTspL+Wj/FSAClIhKkyGkCwRhVSEilKU7qJidDclUHEqQSXJUSlKpHuoNN1LZeg+Kkv3Uzl6gMpTBapIlehBqkwPURV6mKrSI1SNqlMNqkmPUi16jGrT41SHnqC69CTVo6eoPj1NDaghNaJnqDE9S02oKTWj5tSCWlIreo5a0/PUhtpSO3qB2tOL1IFeoiR6mTrSK9SJXqXO9Bp1odepK71B3ehN6k5vUQ96m3pSL0qm3tSH3qG+1I/60wAaSO/SIHqPBtP7NISG0jD6gIbThzSCPqKRNIpG08c0hsbSOBpPE2gipdAnNIk+pcn0GU2hqTSNplMqzaA0+pxm0iyaTV/QHPqS5tI8mk8LKJ0W0iJaTBn0FS2hrymTltIyWk4raCWtotW0htbSOlpPG2gjbaLNtIW20jbaTjtoJ+2i3bSH9tI+2k8H6BvKom/pIP2FDtF3dJi+pyP0Ax2lH+kY/UTH6Wc6Qb/QSTpFp+kMnaVf6Rydpwt0kS7Rb3SZrtBV8iRCCGWoQh0GYY4wZxgT5gpjw1vCuPDWMHd4WxgJbw/jwzvCPOGdYd4wX5g/LBAWDAuFhUMTYmhDCsOwSFg0jIZ3hcXCu8OEsHhYIiwZurBUmBjeE5YO7w3LhPeFZcP7w3LhA2H5sEJYMawUPhhWDh8Kq4QPh1XDR8JqYfWwRlgzfDSsFT4W1g4fD+uET4RlwifDeuFTYf3w6bBB2DBsFD4TNg6fDZuETcNmYfOwRdgybBU+F7YOnw/bhG3DduELYfvwxbBD+FKYFL4cdgxfueHx5LB32Cd8J3wn9P5xNT+6IJoeXRhdFF0czYh+FV0S/TqaGV0aXRZdHl0RXRldFV0dXRNdG10XXR/dEN0Y3RTdHPW+Zk7hwEmnnHaBy+FyuhiXy8W6W1ycu9Xldre5iLvdxbs7XB53p8vr8rn8roAr6Aq5ws44dNaRC10RV9RF3V2umLvbJbjiroQr6Zwr5RJdS9fKtXKt3fOujWvr2rkX3AvuRfeie8m95F52Hd0rrpN71XV2r7ku7nX3unvDdXNvuu7uLdfDve16ul4u2SW7Pq6P6+v6uv6uvxvoBrpBbpAb7Aa7IW6IG+aGueFuuBvhRriRbqQb7Ua7MW6MG+fGuQlugktxKW6Sm+Qmu8luipviprlpLtWlujSX5ma6mW62m+3muDlurpvr5rv5Lt2lu0VukctwGW6JW+IyXaZb5pa5FW6FW+VWuTVujVvn1rkNboPb5Da5LW6L2+a2uR1uh9vldrk9bo/b5/a5A+6Ay3JZ7qA76A65Q+6w+94dcT+4o+5Hd8z95I67n90J94s76U650+6MO+t+defceXfBXXSX3G/usrvirjrvUiKfRCZFPo1MjnwWmRKZGpkWmR5JjcyIpEU+j8yMzIrMjnwRmRP5MjI3Mi8yP7Igkh5ZGFkUWRzJiHwVWRL5OpIZWRpZFlkeWRFZGfG+0LbQF/FFfdTf5Yv5u32CL+5L+JLe+VI+0d/jS/t7fRl/ny/r7/fl/AO+vK/gK/qmvplv7lv4lr6Vf8639s/7Nr6tb+df8O39i76Df8kn+Zd9R/+K7+Rf9Z39a76Lf9139W/4bv5N392/5Xv4t31P38sn+96+j3/H9/X9fH8/wA/07/pB/j0/2L/vh/ihfpj/wA/3H/oR/iM/0o/yo/3Hfowf68f58X6Cn+hT/Cd+kv/UT/af+Sl+qp/mp/tUP8On+c/9TD/Lz/Zf+Dn+Sz/Xz/Pz/QKf7hf6RX6xz/Bf+SX+a5/pl/plfrlf4Vf6VX61X+PX+nV+vd/gN/pNfrPf4rf6bX673+F3+l1+t9/j9/p9fr8/4L/xWf5bf9D/xR/y3/nD/nt/xP/gj/of/TH/kz/uf/Yn/C/+pD/lT/sz/qz/1Z/z5/0Ff9Ff8r/5y/6Kv8r/s8YYY4wx9t+ibnC89z/5nvxjXNNHCHHr9gJH/rHmhrx/nfeT+zpGhBAv9+ra8G+jYcPk5OQ/XpupRFB0nhAicj0/h7geLxXtxIsiSbQVpf/p+vrJikA3qB+9X4jY/5QTI67H1+vf+1/Ub7rwhvXnCZFQ9HpOLnE9vl6/zH9Rf3f7G9TP9V2KEG3+U06cuB5fr58onheviKS/eyVjjDHGGGOMMfZX/eSlbje6v712f15QX8/JKa7HN7o/Z4wxxhhjjDHG2M332pvdX3ouKaltZ57whCc8+Y/Jzf7LxBhjjDHGGPt3u37Rf7NXwhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMZV//Gx8ndrP3yBhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjN1s/ycAAP//fMhn/w==")
bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0xd, 0x1cd, &(0x7f0000000040)=@framed, &(0x7f0000000100)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x84}, 0x94)
ioctl$BTRFS_IOC_QGROUP_CREATE(r7, 0x4010942a, &(0x7f0000000080)={0x1, 0x2}) (async)
ioctl$BTRFS_IOC_QGROUP_CREATE(r7, 0x4010942a, &(0x7f0000000080)={0x1, 0x2})
sched_setscheduler(0x0, 0x2, 0x0)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-syz_mount_image$ext4-openat$tcp_mem-write$tcp_mem-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-socket$pppl2tp-socket$packet-socket$packet-setsockopt$packet_tx_ring-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-sendmmsg-ioctl$BTRFS_IOC_QGROUP_LIMIT-ioctl$BTRFS_IOC_QGROUP_LIMIT-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_LOOKUP_ELEM-syz_usb_connect$hid-syz_mount_image$ext4-connect$pppl2tp-connect$pppl2tp-socket$netlink-writev-syz_mount_image$exfat-bpf$PROG_LOAD_XDP-ioctl$BTRFS_IOC_QGROUP_CREATE-ioctl$BTRFS_IOC_QGROUP_CREATE
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue")
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
write$tcp_mem(r2, 0x0, 0xfffffeff)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32)
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
socket$packet(0x11, 0x2, 0x300) (async)
r5 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r5, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) (async)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff)
sendmmsg(r5, &(0x7f0000000880)=[{{&(0x7f0000000180)=@hci={0x1f, 0xffffffffffffffff, 0x2}, 0x80, 0x0}}], 0x1, 0x45)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}})
bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="120000000a001700080000000200000000000000fd2232fdbec4f9088dfde2e8274444d7b426178cde3a981d5c0078e97367eb5484e7a23dc54df612ed2dce9abca9768676974b1e55ff3b3894d1df437715020e90f206dcc4be855105c9bf668efec2ef25381a55f29539442615eac4a856c07bd2a5d68edd3019747032767163fb6d6e5c1220b91bb2992c6de72293636f287f1469fb2e0f94bbcd418409c8c89f5ebbb67f3cfb005b1083683b998cd00a8fac5b49c74583", @ANYRES32, @ANYBLOB='\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) (async)
r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="120000000a001700080000000200000000000000fd2232fdbec4f9088dfde2e8274444d7b426178cde3a981d5c0078e97367eb5484e7a23dc54df612ed2dce9abca9768676974b1e55ff3b3894d1df437715020e90f206dcc4be855105c9bf668efec2ef25381a55f29539442615eac4a856c07bd2a5d68edd3019747032767163fb6d6e5c1220b91bb2992c6de72293636f287f1469fb2e0f94bbcd418409c8c89f5ebbb67f3cfb005b1083683b998cd00a8fac5b49c74583", @ANYRES32, @ANYBLOB='\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000002c0)={r6, &(0x7f0000000580), 0x0}, 0x20)
syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x8, 0x16c0, 0x5e1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x40, 0x40, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x1, 0x3, 0x41, {0x9, 0x21, 0xfff4, 0xd9, 0x1, {0x22, 0x998}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x5, 0x2, 0x7}}}}}]}}]}}, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x4, [{0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x444}}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})
syz_mount_image$ext4(&(0x7f0000000180)='ext2\x00', &(0x7f0000000200)='./file1\x00', 0x210000, &(0x7f0000000040)={[{@nobh}, {@debug}, {@barrier}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x2000}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x70}}, {@min_batch_time={'min_batch_time', 0x3d, 0x3d20}}, {@stripe={'stripe', 0x3d, 0x20}}, {@errors_remount}, {@max_batch_time={'max_batch_time', 0x3d, 0x3ff}}, {@inlinecrypt}, {@dioread_lock}]}, 0x3, 0x589, &(0x7f0000000d80)="$eJzs3c1rHOUfAPDvbHb7/vs1hVKsiBR6sFK7aRJfKnioR9FiQT3XkGxDyaZbspvSxILtwV68SBFELIh3vXvwULx49K8oaKFICQp6WZnNbLJpNslmszFp9/OBSZ5nZnafeeaZ78Mz++wyAfStE+mfXMTxiPgiiTjcsi0f2cYTi/stPL45ni5J1Osf/JFEkq1r7p9k/w9mmeci4ufPIk7nVpdbnZufGiuXSzNZfqg2fW2oOjd/5sr02GRpsnR1ZHT03GujI2++8XrP6vryxb++fv/+O+c+P7nw1Q8Pj9xN4nwcyra11mNT9q7I3WrNnKjXs3NSiPNPvGy4q8J2r2SnD4CuDGRxXoiI44XDhWbUA8++TyOiDvSpZJPxv1d/Ac+I5jigeW/f9X3wU+rR24s3QKvrn1/8bCT2Ne6NDiwkK+6M0vvdwR6Un5bx4+/37qZLbOVzCIBNunU7Is7m86v7vyTr/7p3toN9nixD/wf/nfvp+OeVduOf3NL4J9qMfw62id1ubBz/uYc9KGZN6fjvrbbj36VJq8GBLPe/xpivkFy+Ui6lfdv/I+JUFPam+fXmc84tPKivta11/JcuafnNsWB2HA/zK+eYYmKsNraVOrd6dDvi+bbj32Sp/ZM27Z+ej486LONY6d6La23buP7bq/5dxEtt2395RitZf35yqHE9DDWvitX+vHPs17XKb1//X37ahqq2lbb/gfXrP5i0ztdWN1/Gt/v+Ka21rdvrf0/yYSO9J1t3Y6xWmxmO2JO8t3r9yPJrm/nm/mn9T51cv/9rd/3vj4iPO6z/naPfv9B9/bdXWv+JTbX/5hMP3v3km7XK76z9X22kTmVrOun/Oj3ArZw7AAAAAAAA2G1yEXEoklwx9mXpXK5YXPx+x9E4kCtXqrXTlyuzVyei8VvZwSjkmjPdh1u+DzGcfR+2mR95Ij8aEUci4suB/Y18cbxSntjpygMAAAAAAAAAAAAAAAAAAMAucXDp9/+x4vf/qd8GdvrogG2XX3z+N9CHNnzkfy+e9ATsShvGP/DMEv/Qv8Q/9C/xD32pMcUn/qF/iX/oX+If+pf4BwAAAAAAAAAAAAAAAAAAAAAAAAAAgJ66eOFCutQXHt8cT/MT1+dmpyrXz0yUqlPF6dnx4nhl5lpxslKZLJeK45Xpjd6vXKlcGx6J2RtDtVK1NlSdm780XZm9Wrt0ZXpssnSp5DnjAAAAAAAAAAAAAAAAAAAAsFp1bn5qrFwuzfQgUSiXS7mI6GTniB4V+tQl/t7y+6Ttdivf2XnenkQSy2vyu+KsSvQ6sdM9EwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAs+zcAAP//MUwypA==")
connect$pppl2tp(r4, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, r4, {0x2, 0x4e23, @rand_addr=0x64010102}, 0x3, 0x0, 0x1}}, 0x26) (async)
connect$pppl2tp(r4, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, r4, {0x2, 0x4e23, @rand_addr=0x64010102}, 0x3, 0x0, 0x1}}, 0x26)
r7 = socket$netlink(0x10, 0x3, 0x8000000004)
writev(r7, &(0x7f00000000c0)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fbc45ff810500000000000058000b480400945f6400947e570028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010002081000418e00000004fcff", 0x58}], 0x1)
syz_mount_image$exfat(&(0x7f0000001500), &(0x7f0000001540)='./file0\x00', 0x0, &(0x7f0000001580), 0x1, 0x14d1, &(0x7f00000015c0)="$eJzs3AlwlcW2KOBe3f1DiBG3EZl79fphiwGaiIjIICIyiIiICIjMIiBiRERERISATCICIgIyRkSGEAGRIUDEMM/zPBg5iIiIyCSTQL/C47ncczy3uO+8cy+vKuur6kqv/Hut3Z1VyT9UZf/UdViNxjWrNiAi8a9Qf5vAX78kCyFihBADhRC3CSECIUTZ+LLx147nUpD8L70J+x/SMPVmr4DdTNz/7I37n71x/7M37n/2xv3P3rj/2Rv3P3vj/jOWraUVuJ1H9h38/D874/N/9sb9z964/9kb9z974/5nb9z/7I37n71x/7M37j9j2dr/B8+gedzEwRhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOM/S+44K/TQoi/zW/2uhhjjDHGGGOMMfbv43Pe7BUwxhhjjDHGGGPsfx4IKZTQIhA5RE4RI3KJWHGLiBO3itziNhERt4t4cYfII+4UeUU+kV8UEAVFIVFYGIHCChKhKCKKiqi4SxQTd4sEUVyUECWFE6VEorhHlBb3ijLiPlFW3C/KiQdEeVFBVBSVxIOisnhIVBEPi6riEVFNVBc1RE3xqKglHhO1xeOijnhC1BVPinriKVFfPC0aiIaikXhGNBbPiiaiqWgmmosWoqVo9S/lvyV6iLdFT9FLJIveoo94R/QV/UR/MUAMFO+KQeI9MVi8L4aIoWKY+EAMFx+KEeIjMVKMEqPFx2KMGCvGifFigpgoUsQnYpL4VEwWn4kpYqqYJqaLVDFDpInPxUwxS8wWX4g54ksxV8wT88UCkS4WikViscgQX4kl4muRKZaKZWK5WCFWilVitVgj1op1Yr3YIDaKTWKz2CK2im1iu9ghdopdYrfYI/aKfWK/OCC+EVni2//L/PP/kN8NBAiQIEGDhhyQA2IgBmIhFuIgDnJDbohABOIhHvJAHsgLeSE/5IeCUBAKQ2FAQCAgKAJFIApRKAbFIAESoASUAAcOEiERSsO9UAbKQFkoC+WgHJSHClABKkElqAyVoQpUgapQFapBNagBNeBReBQeg9pQG+pAHagLdaEe1IP6UB8aQANoBI2gMTSGJtAEmkEzaAEtoBW0gtbQGtpAG2gH7aA9tIcO0AGSIAk6QkfoBJ2gM3SGLtAFukJX6AZvwpvwFrwFb8Pb0Auqyd7QB/pAX+gL/WEADIB3YRC8B+/B+zAEhsIw+AA+gA9hBJyDkTAKRsNoqCzHwjgYDyQnQgqkwCSYBJNhMkyBqTAVpkMqzIA0SIOZMAtmwRcwB76EL2EezIMFkA7psAgWQwZkwBI4D5mwFJbBclgBK2EFrIY1sBrWwXpYBxthI2yGzbAVtsJ22A47YSfsht2wF/bCftgPQyALsuAgHIRDcAgOw2E4AkfgKByFY3AMjsNxOAEn4CScgtNwCs7CWTgH5+ECXIBLcAkuw2W4Clev/fLLa7TUMofMIWNkjIyVsTJOxsncMreMyIiMl/Eyj8wj88q8Mr/MLwvKgrKwLCxRoiQZyiKyiIzKqCwmi8kEmSBLyBLSSScTZaIsLUvLMrKMLCvvl+XkA7K8rCDbukqykqws27kq8mFZVVaV1WR1WUPWlDVlLVlL1pa1ZR1ZR9aVdWU9+ZSsL3tDf2gor3WmsRwKTeQwaCabyxaypfwQnpOt5QhoI9vKdvIFOQpGQgfZ2iXJl2VHOQ46yVfleHhNdpEToat8Q3aTb8ru8i3ZQ7ZxPWUvOQV6yz5yOvSV/WR/OUDOhOryWsdqyPflEDlUDpMfyAXwoRwhP5Ij5Sg5Wn4sx8ixcpwcLyfIiTJFfiInyU/lZPmZnCKnymlyukyVM2Sa/FzOlLPkbPmFnCO/lHPlPDlfLpDpcqFcJBfLDPmVXCK/lplyqVwml8sVcqVcJVfLNXKtXCfXyw1yo9wkN8stcqvcJrfLHXKn3CV3yz1yr9wn98sD8huZJb+VB+Vf5CH5nTwsv5dH5A/yqPxRHpM/yePyZ3lC/iJPylPytDwjz8pf5Tl5Xl6QF+Ul+Zu8LK/Iq9JLoUBJpZRWgcqhcqoYlUvFqltUnLpV5Va3qYi6XcWrO1QedafKq/Kp/KqAKqgKqcLKKFRWkQpVEVVURdVdqpi6WyWo4qqEKqmcKqUS1T2qtLpXlVH3qbLqflVOPaDKqwqqoqqkHlSV1UOqinpYVVWPqGqquqqhaqpHVS31mKqtHld11BOqrnpS1VNPqfrqadVANVSN1DOqsXpWNVFNVTPVXLVQLVUr9ZxqrZ5XbVRb1U69oNqrF1UH9ZJKUi+rjuoV1Um9qjqr11QX9brqqt5Q3dSbqru6oq4qr3qqXipZ9VZ91Duqr+qn+qsBaqB6Vw1S76nB6n01RA1Vw9QHarj6UI1QH6mRapQarT5WY9RYNU6NVxPURJWiPlGT1KdqsvpMTVFT1TQ1XaWqGar/H5Vm/zfyP/0n+YN/f/fNaovaqrap7WqH2ql2qd1qj9qj9ql96oA6oLJUljqoDqpD6pA6rA6rI+qIOqqOqmPqmDqujqsT6oQ6qU6pi+qMOqt+VefUeXVeXVSX1CV1+Y+fgdCgpVZa60Dn0Dl1jM6lY/UtOk7fqnPr23RE367j9R06j75T59X5dH5dQBfUhXRhbTRqq0mHuoguqqP6Ll1M360TdHFdQpfUTpfSifqe/+f8G62vlW6lW+vWuo1uo9vpdrq9bq876A46SSfpjrqj7qQ76c66s+6iu+iuuqvuprvp7rq77qF76J66p07WybqPfkf31f10fz1AD9Tv6kF6kB6sB+sheogepofp4Xq4HqFH6JF6pB6tR+sxeowep8fpCXqCTtEpepKepCfryXqKnqKn6Wk6VafqNJ2mZ+qZeraerefoOXqunqvn6/k6XafrRXqRztAZeoleojP1Ur1UL9fL9Uq9Uq/Wq/VavVav1+v1Rr1RZ+oteoveprfpHXqH3qV36T16j96n9+kD+oDO0ln6oD6oD+lD+rA+rI/oI/qoPqqP6WP6uD6uT+gT+qQ+qU/r0/qsPqvP6XP6gr6gL+lL+rK+rK/qq9cu+wIZyEAHOsgR5AhigpggNogN4oK4IHeQO4gEkSA+iA/yBHcGeYN8Qf6gQFAwKBQUDkyAgQ0oCIMiQdEgGtwVFAvuDhKC4kGJoGTgglJBYnBPUDq4NygT3BeUDe4PygUPBOWDCkHFoFLwYFA5eCioEjwcVA0eCaoF1YMaQc3g0aBW8FhQO3g8qBM8EdQNngzqBU8F9YOngwZBw6BR8EzQOHg2aBI0DZoFzYMWQcug1b+1vvfn8j3veppeJtn0Nn3MO6av6Wf6mwFmoHnXDDLvmcHmfTPEDDXDzAdmuPnQjDAfmZFmlBltPjZjzFgzzow3E8xEk2I+MZPMp2ay+cxMMVPNNDPdpJoZJs18bmaaWWa2+cLMMV+auWaemW8WmHSz0Cwyi02G+cosMV+bTLPULDPLzQqz0qwyq80as9asM+vNBrPRbDKbzRaz1Wwz280Os9PsMrvNHrPX7DP7zQHzjcky35qD5i/mkPnOHDbfmyPmB3PU/GiOmZ/McfOzOWF+MSfNKXPanDFnza/mnDlvLpiL5pL5zVw2V8xV469d3F87vaNGjTkwB8ZgDMZiLMZhHObG3BjBCMZjPObBPJgX82J+zI8FsSAWxsJ4DSFhESyCUYxiMSyGCZiAJbAEOnSYiIlYGktjGSyDZbEslsNyWB7LY0WsiA/ig/gQPoQP48P4CD6C1bE61sSaWAtrYW2sjXWwDtbFulgP62F9rI8NsAE2wkbYGBtjE2yCzbAZtsAW2ApbYWtsjW2wDbbDdtge22MH7IBJmIQdsSN2wk7YGTtjF+yCXbErdsNu2B27Yw/sgT2xJyZjMvbBPtgX+2J/7I8DcSAOwkE4GAfjEByCw3AYDsfhOAJH4EgchaPxYxyDY3EcjscJOBFTMAUn4SScjJNxCk7BaTgNUzEV0zANZ+JMnI2zcQ7Owbk4F+fjfEzHdFyEizADM3AJLsFMzMRluAxX4ApchatwDa7BdbgON+AG3ISbcAtuwW24DXfgDtyFu3AP7sF9uA8P4AHMwiw8iAfxEB7Cw3gYj+ARPIpH8Rgew+N4HE/gCTyJJ/E0nsazeBbP4Tm8gBfwEv6Gl/EKXkWPMTaXjbW32Dh7q81tb7P/GOe3BWxBW8gWtsbmtfn+LkZrbYItbkvYktbZUjbR3vOnuLytYCvaSvZBW9k+ZKv8Ka5lH7O17eO2jn3C1rSP/l1c1z5p69lnbX3b1DawzW0j29I2ts/aJrapbWab2xa2pW1vX7Qd7Es2yb5sO9pX/hQvsovtGrvWrrPr7T67316wF+0x+5O9ZH+zPW0vO9C+awfZ9+xg+74dYof+KR5tP7Zj7Fg7zo63E+zEP8XT7HSbamfYNPu5nWln/SlOtwvtHJth59p5dr5d8Ht8bU0Z9iu7xH5tM+1Su8wutyvsSrvKrv6PtS63G+0mu9nusXvtNrvd7rA77S67+/f42j4O2G9slv3WHrU/2kP2O3vYHrdH7A+/x9f2d9z+bE/YX+xJe8qetmfsWfurPWfP/77/a3s/Y6/Yq9ZbQUCSFGkKKAflpBjKRbF0C8XRrZSbbqMI3U7xdAfloTspL+Wj/FSAClIhKkyGkCwRhVSEilKU7qJidDclUHEqQSXJUSlKpHuoNN1LZeg+Kkv3Uzl6gMpTBapIlehBqkwPURV6mKrSI1SNqlMNqkmPUi16jGrT41SHnqC69CTVo6eoPj1NDaghNaJnqDE9S02oKTWj5tSCWlIreo5a0/PUhtpSO3qB2tOL1IFeoiR6mTrSK9SJXqXO9Bp1odepK71B3ehN6k5vUQ96m3pSL0qm3tSH3qG+1I/60wAaSO/SIHqPBtP7NISG0jD6gIbThzSCPqKRNIpG08c0hsbSOBpPE2gipdAnNIk+pcn0GU2hqTSNplMqzaA0+pxm0iyaTV/QHPqS5tI8mk8LKJ0W0iJaTBn0FS2hrymTltIyWk4raCWtotW0htbSOlpPG2gjbaLNtIW20jbaTjtoJ+2i3bSH9tI+2k8H6BvKom/pIP2FDtF3dJi+pyP0Ax2lH+kY/UTH6Wc6Qb/QSTpFp+kMnaVf6Rydpwt0kS7Rb3SZrtBV8iRCCGWoQh0GYY4wZxgT5gpjw1vCuPDWMHd4WxgJbw/jwzvCPOGdYd4wX5g/LBAWDAuFhUMTYmhDCsOwSFg0jIZ3hcXCu8OEsHhYIiwZurBUmBjeE5YO7w3LhPeFZcP7w3LhA2H5sEJYMawUPhhWDh8Kq4QPh1XDR8JqYfWwRlgzfDSsFT4W1g4fD+uET4RlwifDeuFTYf3w6bBB2DBsFD4TNg6fDZuETcNmYfOwRdgybBU+F7YOnw/bhG3DduELYfvwxbBD+FKYFL4cdgxfueHx5LB32Cd8J3wn9P5xNT+6IJoeXRhdFF0czYh+FV0S/TqaGV0aXRZdHl0RXRldFV0dXRNdG10XXR/dEN0Y3RTdHPW+Zk7hwEmnnHaBy+FyuhiXy8W6W1ycu9Xldre5iLvdxbs7XB53p8vr8rn8roAr6Aq5ws44dNaRC10RV9RF3V2umLvbJbjiroQr6Zwr5RJdS9fKtXKt3fOujWvr2rkX3AvuRfeie8m95F52Hd0rrpN71XV2r7ku7nX3unvDdXNvuu7uLdfDve16ul4u2SW7Pq6P6+v6uv6uvxvoBrpBbpAb7Aa7IW6IG+aGueFuuBvhRriRbqQb7Ua7MW6MG+fGuQlugktxKW6Sm+Qmu8luipviprlpLtWlujSX5ma6mW62m+3muDlurpvr5rv5Lt2lu0VukctwGW6JW+IyXaZb5pa5FW6FW+VWuTVujVvn1rkNboPb5Da5LW6L2+a2uR1uh9vldrk9bo/b5/a5A+6Ay3JZ7qA76A65Q+6w+94dcT+4o+5Hd8z95I67n90J94s76U650+6MO+t+defceXfBXXSX3G/usrvirjrvUiKfRCZFPo1MjnwWmRKZGpkWmR5JjcyIpEU+j8yMzIrMjnwRmRP5MjI3Mi8yP7Igkh5ZGFkUWRzJiHwVWRL5OpIZWRpZFlkeWRFZGfG+0LbQF/FFfdTf5Yv5u32CL+5L+JLe+VI+0d/jS/t7fRl/ny/r7/fl/AO+vK/gK/qmvplv7lv4lr6Vf8639s/7Nr6tb+df8O39i76Df8kn+Zd9R/+K7+Rf9Z39a76Lf9139W/4bv5N392/5Xv4t31P38sn+96+j3/H9/X9fH8/wA/07/pB/j0/2L/vh/ihfpj/wA/3H/oR/iM/0o/yo/3Hfowf68f58X6Cn+hT/Cd+kv/UT/af+Sl+qp/mp/tUP8On+c/9TD/Lz/Zf+Dn+Sz/Xz/Pz/QKf7hf6RX6xz/Bf+SX+a5/pl/plfrlf4Vf6VX61X+PX+nV+vd/gN/pNfrPf4rf6bX673+F3+l1+t9/j9/p9fr8/4L/xWf5bf9D/xR/y3/nD/nt/xP/gj/of/TH/kz/uf/Yn/C/+pD/lT/sz/qz/1Z/z5/0Ff9Ff8r/5y/6Kv8r/s8YYY4wx9t+ibnC89z/5nvxjXNNHCHHr9gJH/rHmhrx/nfeT+zpGhBAv9+ra8G+jYcPk5OQ/XpupRFB0nhAicj0/h7geLxXtxIsiSbQVpf/p+vrJikA3qB+9X4jY/5QTI67H1+vf+1/Ub7rwhvXnCZFQ9HpOLnE9vl6/zH9Rf3f7G9TP9V2KEG3+U06cuB5fr58onheviKS/eyVjjDHGGGOMMfZX/eSlbje6v712f15QX8/JKa7HN7o/Z4wxxhhjjDHG2M332pvdX3ouKaltZ57whCc8+Y/Jzf7LxBhjjDHGGPt3u37Rf7NXwhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMZV//Gx8ndrP3yBhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjN1s/ycAAP//fMhn/w==")
bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0xd, 0x1cd, &(0x7f0000000040)=@framed, &(0x7f0000000100)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x84}, 0x94)
ioctl$BTRFS_IOC_QGROUP_CREATE(r7, 0x4010942a, &(0x7f0000000080)={0x1, 0x2}) (async)
ioctl$BTRFS_IOC_QGROUP_CREATE(r7, 0x4010942a, &(0x7f0000000080)={0x1, 0x2})

program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-syz_mount_image$ext4-openat$tcp_mem-write$tcp_mem-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-socket$pppl2tp-socket$packet-socket$packet-setsockopt$packet_tx_ring-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-sendmmsg-ioctl$BTRFS_IOC_QGROUP_LIMIT-ioctl$BTRFS_IOC_QGROUP_LIMIT-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_LOOKUP_ELEM-syz_usb_connect$hid-syz_mount_image$ext4-connect$pppl2tp-connect$pppl2tp-socket$netlink-writev-syz_mount_image$exfat-bpf$PROG_LOAD_XDP-ioctl$BTRFS_IOC_QGROUP_CREATE
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue")
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
write$tcp_mem(r2, 0x0, 0xfffffeff)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32)
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
socket$packet(0x11, 0x2, 0x300) (async)
r5 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r5, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) (async)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff)
sendmmsg(r5, &(0x7f0000000880)=[{{&(0x7f0000000180)=@hci={0x1f, 0xffffffffffffffff, 0x2}, 0x80, 0x0}}], 0x1, 0x45)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}})
bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="120000000a001700080000000200000000000000fd2232fdbec4f9088dfde2e8274444d7b426178cde3a981d5c0078e97367eb5484e7a23dc54df612ed2dce9abca9768676974b1e55ff3b3894d1df437715020e90f206dcc4be855105c9bf668efec2ef25381a55f29539442615eac4a856c07bd2a5d68edd3019747032767163fb6d6e5c1220b91bb2992c6de72293636f287f1469fb2e0f94bbcd418409c8c89f5ebbb67f3cfb005b1083683b998cd00a8fac5b49c74583", @ANYRES32, @ANYBLOB='\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) (async)
r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="120000000a001700080000000200000000000000fd2232fdbec4f9088dfde2e8274444d7b426178cde3a981d5c0078e97367eb5484e7a23dc54df612ed2dce9abca9768676974b1e55ff3b3894d1df437715020e90f206dcc4be855105c9bf668efec2ef25381a55f29539442615eac4a856c07bd2a5d68edd3019747032767163fb6d6e5c1220b91bb2992c6de72293636f287f1469fb2e0f94bbcd418409c8c89f5ebbb67f3cfb005b1083683b998cd00a8fac5b49c74583", @ANYRES32, @ANYBLOB='\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000002c0)={r6, &(0x7f0000000580), 0x0}, 0x20)
syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x8, 0x16c0, 0x5e1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x40, 0x40, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x1, 0x3, 0x41, {0x9, 0x21, 0xfff4, 0xd9, 0x1, {0x22, 0x998}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x5, 0x2, 0x7}}}}}]}}]}}, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x4, [{0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x444}}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})
syz_mount_image$ext4(&(0x7f0000000180)='ext2\x00', &(0x7f0000000200)='./file1\x00', 0x210000, &(0x7f0000000040)={[{@nobh}, {@debug}, {@barrier}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x2000}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x70}}, {@min_batch_time={'min_batch_time', 0x3d, 0x3d20}}, {@stripe={'stripe', 0x3d, 0x20}}, {@errors_remount}, {@max_batch_time={'max_batch_time', 0x3d, 0x3ff}}, {@inlinecrypt}, {@dioread_lock}]}, 0x3, 0x589, &(0x7f0000000d80)="$eJzs3c1rHOUfAPDvbHb7/vs1hVKsiBR6sFK7aRJfKnioR9FiQT3XkGxDyaZbspvSxILtwV68SBFELIh3vXvwULx49K8oaKFICQp6WZnNbLJpNslmszFp9/OBSZ5nZnafeeaZ78Mz++wyAfStE+mfXMTxiPgiiTjcsi0f2cYTi/stPL45ni5J1Osf/JFEkq1r7p9k/w9mmeci4ufPIk7nVpdbnZufGiuXSzNZfqg2fW2oOjd/5sr02GRpsnR1ZHT03GujI2++8XrP6vryxb++fv/+O+c+P7nw1Q8Pj9xN4nwcyra11mNT9q7I3WrNnKjXs3NSiPNPvGy4q8J2r2SnD4CuDGRxXoiI44XDhWbUA8++TyOiDvSpZJPxv1d/Ac+I5jigeW/f9X3wU+rR24s3QKvrn1/8bCT2Ne6NDiwkK+6M0vvdwR6Un5bx4+/37qZLbOVzCIBNunU7Is7m86v7vyTr/7p3toN9nixD/wf/nfvp+OeVduOf3NL4J9qMfw62id1ubBz/uYc9KGZN6fjvrbbj36VJq8GBLPe/xpivkFy+Ui6lfdv/I+JUFPam+fXmc84tPKivta11/JcuafnNsWB2HA/zK+eYYmKsNraVOrd6dDvi+bbj32Sp/ZM27Z+ej486LONY6d6La23buP7bq/5dxEtt2395RitZf35yqHE9DDWvitX+vHPs17XKb1//X37ahqq2lbb/gfXrP5i0ztdWN1/Gt/v+Ka21rdvrf0/yYSO9J1t3Y6xWmxmO2JO8t3r9yPJrm/nm/mn9T51cv/9rd/3vj4iPO6z/naPfv9B9/bdXWv+JTbX/5hMP3v3km7XK76z9X22kTmVrOun/Oj3ArZw7AAAAAAAA2G1yEXEoklwx9mXpXK5YXPx+x9E4kCtXqrXTlyuzVyei8VvZwSjkmjPdh1u+DzGcfR+2mR95Ij8aEUci4suB/Y18cbxSntjpygMAAAAAAAAAAAAAAAAAAMAucXDp9/+x4vf/qd8GdvrogG2XX3z+N9CHNnzkfy+e9ATsShvGP/DMEv/Qv8Q/9C/xD32pMcUn/qF/iX/oX+If+pf4BwAAAAAAAAAAAAAAAAAAAAAAAAAAgJ66eOFCutQXHt8cT/MT1+dmpyrXz0yUqlPF6dnx4nhl5lpxslKZLJeK45Xpjd6vXKlcGx6J2RtDtVK1NlSdm780XZm9Wrt0ZXpssnSp5DnjAAAAAAAAAAAAAAAAAAAAsFp1bn5qrFwuzfQgUSiXS7mI6GTniB4V+tQl/t7y+6Ttdivf2XnenkQSy2vyu+KsSvQ6sdM9EwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAs+zcAAP//MUwypA==")
connect$pppl2tp(r4, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, r4, {0x2, 0x4e23, @rand_addr=0x64010102}, 0x3, 0x0, 0x1}}, 0x26) (async)
connect$pppl2tp(r4, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, r4, {0x2, 0x4e23, @rand_addr=0x64010102}, 0x3, 0x0, 0x1}}, 0x26)
r7 = socket$netlink(0x10, 0x3, 0x8000000004)
writev(r7, &(0x7f00000000c0)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fbc45ff810500000000000058000b480400945f6400947e570028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010002081000418e00000004fcff", 0x58}], 0x1)
syz_mount_image$exfat(&(0x7f0000001500), &(0x7f0000001540)='./file0\x00', 0x0, &(0x7f0000001580), 0x1, 0x14d1, &(0x7f00000015c0)="$eJzs3AlwlcW2KOBe3f1DiBG3EZl79fphiwGaiIjIICIyiIiICIjMIiBiRERERISATCICIgIyRkSGEAGRIUDEMM/zPBg5iIiIyCSTQL/C47ncczy3uO+8cy+vKuur6kqv/Hut3Z1VyT9UZf/UdViNxjWrNiAi8a9Qf5vAX78kCyFihBADhRC3CSECIUTZ+LLx147nUpD8L70J+x/SMPVmr4DdTNz/7I37n71x/7M37n/2xv3P3rj/2Rv3P3vj/jOWraUVuJ1H9h38/D874/N/9sb9z964/9kb9z974/5nb9z/7I37n71x/7M37j9j2dr/B8+gedzEwRhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOM/S+44K/TQoi/zW/2uhhjjDHGGGOMMfbv43Pe7BUwxhhjjDHGGGPsfx4IKZTQIhA5RE4RI3KJWHGLiBO3itziNhERt4t4cYfII+4UeUU+kV8UEAVFIVFYGIHCChKhKCKKiqi4SxQTd4sEUVyUECWFE6VEorhHlBb3ijLiPlFW3C/KiQdEeVFBVBSVxIOisnhIVBEPi6riEVFNVBc1RE3xqKglHhO1xeOijnhC1BVPinriKVFfPC0aiIaikXhGNBbPiiaiqWgmmosWoqVo9S/lvyV6iLdFT9FLJIveoo94R/QV/UR/MUAMFO+KQeI9MVi8L4aIoWKY+EAMFx+KEeIjMVKMEqPFx2KMGCvGifFigpgoUsQnYpL4VEwWn4kpYqqYJqaLVDFDpInPxUwxS8wWX4g54ksxV8wT88UCkS4WikViscgQX4kl4muRKZaKZWK5WCFWilVitVgj1op1Yr3YIDaKTWKz2CK2im1iu9ghdopdYrfYI/aKfWK/OCC+EVni2//L/PP/kN8NBAiQIEGDhhyQA2IgBmIhFuIgDnJDbohABOIhHvJAHsgLeSE/5IeCUBAKQ2FAQCAgKAJFIApRKAbFIAESoASUAAcOEiERSsO9UAbKQFkoC+WgHJSHClABKkElqAyVoQpUgapQFapBNagBNeBReBQeg9pQG+pAHagLdaEe1IP6UB8aQANoBI2gMTSGJtAEmkEzaAEtoBW0gtbQGtpAG2gH7aA9tIcO0AGSIAk6QkfoBJ2gM3SGLtAFukJX6AZvwpvwFrwFb8Pb0Auqyd7QB/pAX+gL/WEADIB3YRC8B+/B+zAEhsIw+AA+gA9hBJyDkTAKRsNoqCzHwjgYDyQnQgqkwCSYBJNhMkyBqTAVpkMqzIA0SIOZMAtmwRcwB76EL2EezIMFkA7psAgWQwZkwBI4D5mwFJbBclgBK2EFrIY1sBrWwXpYBxthI2yGzbAVtsJ22A47YSfsht2wF/bCftgPQyALsuAgHIRDcAgOw2E4AkfgKByFY3AMjsNxOAEn4CScgtNwCs7CWTgH5+ECXIBLcAkuw2W4Clev/fLLa7TUMofMIWNkjIyVsTJOxsncMreMyIiMl/Eyj8wj88q8Mr/MLwvKgrKwLCxRoiQZyiKyiIzKqCwmi8kEmSBLyBLSSScTZaIsLUvLMrKMLCvvl+XkA7K8rCDbukqykqws27kq8mFZVVaV1WR1WUPWlDVlLVlL1pa1ZR1ZR9aVdWU9+ZSsL3tDf2gor3WmsRwKTeQwaCabyxaypfwQnpOt5QhoI9vKdvIFOQpGQgfZ2iXJl2VHOQ46yVfleHhNdpEToat8Q3aTb8ru8i3ZQ7ZxPWUvOQV6yz5yOvSV/WR/OUDOhOryWsdqyPflEDlUDpMfyAXwoRwhP5Ij5Sg5Wn4sx8ixcpwcLyfIiTJFfiInyU/lZPmZnCKnymlyukyVM2Sa/FzOlLPkbPmFnCO/lHPlPDlfLpDpcqFcJBfLDPmVXCK/lplyqVwml8sVcqVcJVfLNXKtXCfXyw1yo9wkN8stcqvcJrfLHXKn3CV3yz1yr9wn98sD8huZJb+VB+Vf5CH5nTwsv5dH5A/yqPxRHpM/yePyZ3lC/iJPylPytDwjz8pf5Tl5Xl6QF+Ul+Zu8LK/Iq9JLoUBJpZRWgcqhcqoYlUvFqltUnLpV5Va3qYi6XcWrO1QedafKq/Kp/KqAKqgKqcLKKFRWkQpVEVVURdVdqpi6WyWo4qqEKqmcKqUS1T2qtLpXlVH3qbLqflVOPaDKqwqqoqqkHlSV1UOqinpYVVWPqGqquqqhaqpHVS31mKqtHld11BOqrnpS1VNPqfrqadVANVSN1DOqsXpWNVFNVTPVXLVQLVUr9ZxqrZ5XbVRb1U69oNqrF1UH9ZJKUi+rjuoV1Um9qjqr11QX9brqqt5Q3dSbqru6oq4qr3qqXipZ9VZ91Duqr+qn+qsBaqB6Vw1S76nB6n01RA1Vw9QHarj6UI1QH6mRapQarT5WY9RYNU6NVxPURJWiPlGT1KdqsvpMTVFT1TQ1XaWqGar/H5Vm/zfyP/0n+YN/f/fNaovaqrap7WqH2ql2qd1qj9qj9ql96oA6oLJUljqoDqpD6pA6rA6rI+qIOqqOqmPqmDqujqsT6oQ6qU6pi+qMOqt+VefUeXVeXVSX1CV1+Y+fgdCgpVZa60Dn0Dl1jM6lY/UtOk7fqnPr23RE367j9R06j75T59X5dH5dQBfUhXRhbTRqq0mHuoguqqP6Ll1M360TdHFdQpfUTpfSifqe/+f8G62vlW6lW+vWuo1uo9vpdrq9bq876A46SSfpjrqj7qQ76c66s+6iu+iuuqvuprvp7rq77qF76J66p07WybqPfkf31f10fz1AD9Tv6kF6kB6sB+sheogepofp4Xq4HqFH6JF6pB6tR+sxeowep8fpCXqCTtEpepKepCfryXqKnqKn6Wk6VafqNJ2mZ+qZeraerefoOXqunqvn6/k6XafrRXqRztAZeoleojP1Ur1UL9fL9Uq9Uq/Wq/VavVav1+v1Rr1RZ+oteoveprfpHXqH3qV36T16j96n9+kD+oDO0ln6oD6oD+lD+rA+rI/oI/qoPqqP6WP6uD6uT+gT+qQ+qU/r0/qsPqvP6XP6gr6gL+lL+rK+rK/qq9cu+wIZyEAHOsgR5AhigpggNogN4oK4IHeQO4gEkSA+iA/yBHcGeYN8Qf6gQFAwKBQUDkyAgQ0oCIMiQdEgGtwVFAvuDhKC4kGJoGTgglJBYnBPUDq4NygT3BeUDe4PygUPBOWDCkHFoFLwYFA5eCioEjwcVA0eCaoF1YMaQc3g0aBW8FhQO3g8qBM8EdQNngzqBU8F9YOngwZBw6BR8EzQOHg2aBI0DZoFzYMWQcug1b+1vvfn8j3veppeJtn0Nn3MO6av6Wf6mwFmoHnXDDLvmcHmfTPEDDXDzAdmuPnQjDAfmZFmlBltPjZjzFgzzow3E8xEk2I+MZPMp2ay+cxMMVPNNDPdpJoZJs18bmaaWWa2+cLMMV+auWaemW8WmHSz0Cwyi02G+cosMV+bTLPULDPLzQqz0qwyq80as9asM+vNBrPRbDKbzRaz1Wwz280Os9PsMrvNHrPX7DP7zQHzjcky35qD5i/mkPnOHDbfmyPmB3PU/GiOmZ/McfOzOWF+MSfNKXPanDFnza/mnDlvLpiL5pL5zVw2V8xV469d3F87vaNGjTkwB8ZgDMZiLMZhHObG3BjBCMZjPObBPJgX82J+zI8FsSAWxsJ4DSFhESyCUYxiMSyGCZiAJbAEOnSYiIlYGktjGSyDZbEslsNyWB7LY0WsiA/ig/gQPoQP48P4CD6C1bE61sSaWAtrYW2sjXWwDtbFulgP62F9rI8NsAE2wkbYGBtjE2yCzbAZtsAW2ApbYWtsjW2wDbbDdtge22MH7IBJmIQdsSN2wk7YGTtjF+yCXbErdsNu2B27Yw/sgT2xJyZjMvbBPtgX+2J/7I8DcSAOwkE4GAfjEByCw3AYDsfhOAJH4EgchaPxYxyDY3EcjscJOBFTMAUn4SScjJNxCk7BaTgNUzEV0zANZ+JMnI2zcQ7Owbk4F+fjfEzHdFyEizADM3AJLsFMzMRluAxX4ApchatwDa7BdbgON+AG3ISbcAtuwW24DXfgDtyFu3AP7sF9uA8P4AHMwiw8iAfxEB7Cw3gYj+ARPIpH8Rgew+N4HE/gCTyJJ/E0nsazeBbP4Tm8gBfwEv6Gl/EKXkWPMTaXjbW32Dh7q81tb7P/GOe3BWxBW8gWtsbmtfn+LkZrbYItbkvYktbZUjbR3vOnuLytYCvaSvZBW9k+ZKv8Ka5lH7O17eO2jn3C1rSP/l1c1z5p69lnbX3b1DawzW0j29I2ts/aJrapbWab2xa2pW1vX7Qd7Es2yb5sO9pX/hQvsovtGrvWrrPr7T67316wF+0x+5O9ZH+zPW0vO9C+awfZ9+xg+74dYof+KR5tP7Zj7Fg7zo63E+zEP8XT7HSbamfYNPu5nWln/SlOtwvtHJth59p5dr5d8Ht8bU0Z9iu7xH5tM+1Su8wutyvsSrvKrv6PtS63G+0mu9nusXvtNrvd7rA77S67+/f42j4O2G9slv3WHrU/2kP2O3vYHrdH7A+/x9f2d9z+bE/YX+xJe8qetmfsWfurPWfP/77/a3s/Y6/Yq9ZbQUCSFGkKKAflpBjKRbF0C8XRrZSbbqMI3U7xdAfloTspL+Wj/FSAClIhKkyGkCwRhVSEilKU7qJidDclUHEqQSXJUSlKpHuoNN1LZeg+Kkv3Uzl6gMpTBapIlehBqkwPURV6mKrSI1SNqlMNqkmPUi16jGrT41SHnqC69CTVo6eoPj1NDaghNaJnqDE9S02oKTWj5tSCWlIreo5a0/PUhtpSO3qB2tOL1IFeoiR6mTrSK9SJXqXO9Bp1odepK71B3ehN6k5vUQ96m3pSL0qm3tSH3qG+1I/60wAaSO/SIHqPBtP7NISG0jD6gIbThzSCPqKRNIpG08c0hsbSOBpPE2gipdAnNIk+pcn0GU2hqTSNplMqzaA0+pxm0iyaTV/QHPqS5tI8mk8LKJ0W0iJaTBn0FS2hrymTltIyWk4raCWtotW0htbSOlpPG2gjbaLNtIW20jbaTjtoJ+2i3bSH9tI+2k8H6BvKom/pIP2FDtF3dJi+pyP0Ax2lH+kY/UTH6Wc6Qb/QSTpFp+kMnaVf6Rydpwt0kS7Rb3SZrtBV8iRCCGWoQh0GYY4wZxgT5gpjw1vCuPDWMHd4WxgJbw/jwzvCPOGdYd4wX5g/LBAWDAuFhUMTYmhDCsOwSFg0jIZ3hcXCu8OEsHhYIiwZurBUmBjeE5YO7w3LhPeFZcP7w3LhA2H5sEJYMawUPhhWDh8Kq4QPh1XDR8JqYfWwRlgzfDSsFT4W1g4fD+uET4RlwifDeuFTYf3w6bBB2DBsFD4TNg6fDZuETcNmYfOwRdgybBU+F7YOnw/bhG3DduELYfvwxbBD+FKYFL4cdgxfueHx5LB32Cd8J3wn9P5xNT+6IJoeXRhdFF0czYh+FV0S/TqaGV0aXRZdHl0RXRldFV0dXRNdG10XXR/dEN0Y3RTdHPW+Zk7hwEmnnHaBy+FyuhiXy8W6W1ycu9Xldre5iLvdxbs7XB53p8vr8rn8roAr6Aq5ws44dNaRC10RV9RF3V2umLvbJbjiroQr6Zwr5RJdS9fKtXKt3fOujWvr2rkX3AvuRfeie8m95F52Hd0rrpN71XV2r7ku7nX3unvDdXNvuu7uLdfDve16ul4u2SW7Pq6P6+v6uv6uvxvoBrpBbpAb7Aa7IW6IG+aGueFuuBvhRriRbqQb7Ua7MW6MG+fGuQlugktxKW6Sm+Qmu8luipviprlpLtWlujSX5ma6mW62m+3muDlurpvr5rv5Lt2lu0VukctwGW6JW+IyXaZb5pa5FW6FW+VWuTVujVvn1rkNboPb5Da5LW6L2+a2uR1uh9vldrk9bo/b5/a5A+6Ay3JZ7qA76A65Q+6w+94dcT+4o+5Hd8z95I67n90J94s76U650+6MO+t+defceXfBXXSX3G/usrvirjrvUiKfRCZFPo1MjnwWmRKZGpkWmR5JjcyIpEU+j8yMzIrMjnwRmRP5MjI3Mi8yP7Igkh5ZGFkUWRzJiHwVWRL5OpIZWRpZFlkeWRFZGfG+0LbQF/FFfdTf5Yv5u32CL+5L+JLe+VI+0d/jS/t7fRl/ny/r7/fl/AO+vK/gK/qmvplv7lv4lr6Vf8639s/7Nr6tb+df8O39i76Df8kn+Zd9R/+K7+Rf9Z39a76Lf9139W/4bv5N392/5Xv4t31P38sn+96+j3/H9/X9fH8/wA/07/pB/j0/2L/vh/ihfpj/wA/3H/oR/iM/0o/yo/3Hfowf68f58X6Cn+hT/Cd+kv/UT/af+Sl+qp/mp/tUP8On+c/9TD/Lz/Zf+Dn+Sz/Xz/Pz/QKf7hf6RX6xz/Bf+SX+a5/pl/plfrlf4Vf6VX61X+PX+nV+vd/gN/pNfrPf4rf6bX673+F3+l1+t9/j9/p9fr8/4L/xWf5bf9D/xR/y3/nD/nt/xP/gj/of/TH/kz/uf/Yn/C/+pD/lT/sz/qz/1Z/z5/0Ff9Ff8r/5y/6Kv8r/s8YYY4wx9t+ibnC89z/5nvxjXNNHCHHr9gJH/rHmhrx/nfeT+zpGhBAv9+ra8G+jYcPk5OQ/XpupRFB0nhAicj0/h7geLxXtxIsiSbQVpf/p+vrJikA3qB+9X4jY/5QTI67H1+vf+1/Ub7rwhvXnCZFQ9HpOLnE9vl6/zH9Rf3f7G9TP9V2KEG3+U06cuB5fr58onheviKS/eyVjjDHGGGOMMfZX/eSlbje6v712f15QX8/JKa7HN7o/Z4wxxhhjjDHG2M332pvdX3ouKaltZ57whCc8+Y/Jzf7LxBhjjDHGGPt3u37Rf7NXwhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMZV//Gx8ndrP3yBhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjN1s/ycAAP//fMhn/w==")
bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0xd, 0x1cd, &(0x7f0000000040)=@framed, &(0x7f0000000100)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x84}, 0x94)
ioctl$BTRFS_IOC_QGROUP_CREATE(r7, 0x4010942a, &(0x7f0000000080)={0x1, 0x2}) (async)

program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-syz_mount_image$ext4-openat$tcp_mem-write$tcp_mem-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-socket$pppl2tp-socket$packet-socket$packet-setsockopt$packet_tx_ring-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-sendmmsg-ioctl$BTRFS_IOC_QGROUP_LIMIT-ioctl$BTRFS_IOC_QGROUP_LIMIT-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_LOOKUP_ELEM-syz_usb_connect$hid-syz_mount_image$ext4-connect$pppl2tp-connect$pppl2tp-socket$netlink-writev-syz_mount_image$exfat-bpf$PROG_LOAD_XDP
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue")
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
write$tcp_mem(r2, 0x0, 0xfffffeff)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32)
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
socket$packet(0x11, 0x2, 0x300) (async)
r5 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r5, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) (async)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff)
sendmmsg(r5, &(0x7f0000000880)=[{{&(0x7f0000000180)=@hci={0x1f, 0xffffffffffffffff, 0x2}, 0x80, 0x0}}], 0x1, 0x45)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}})
bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="120000000a001700080000000200000000000000fd2232fdbec4f9088dfde2e8274444d7b426178cde3a981d5c0078e97367eb5484e7a23dc54df612ed2dce9abca9768676974b1e55ff3b3894d1df437715020e90f206dcc4be855105c9bf668efec2ef25381a55f29539442615eac4a856c07bd2a5d68edd3019747032767163fb6d6e5c1220b91bb2992c6de72293636f287f1469fb2e0f94bbcd418409c8c89f5ebbb67f3cfb005b1083683b998cd00a8fac5b49c74583", @ANYRES32, @ANYBLOB='\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) (async)
r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="120000000a001700080000000200000000000000fd2232fdbec4f9088dfde2e8274444d7b426178cde3a981d5c0078e97367eb5484e7a23dc54df612ed2dce9abca9768676974b1e55ff3b3894d1df437715020e90f206dcc4be855105c9bf668efec2ef25381a55f29539442615eac4a856c07bd2a5d68edd3019747032767163fb6d6e5c1220b91bb2992c6de72293636f287f1469fb2e0f94bbcd418409c8c89f5ebbb67f3cfb005b1083683b998cd00a8fac5b49c74583", @ANYRES32, @ANYBLOB='\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000002c0)={r6, &(0x7f0000000580), 0x0}, 0x20)
syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x8, 0x16c0, 0x5e1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x40, 0x40, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x1, 0x3, 0x41, {0x9, 0x21, 0xfff4, 0xd9, 0x1, {0x22, 0x998}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x5, 0x2, 0x7}}}}}]}}]}}, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x4, [{0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x444}}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})
syz_mount_image$ext4(&(0x7f0000000180)='ext2\x00', &(0x7f0000000200)='./file1\x00', 0x210000, &(0x7f0000000040)={[{@nobh}, {@debug}, {@barrier}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x2000}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x70}}, {@min_batch_time={'min_batch_time', 0x3d, 0x3d20}}, {@stripe={'stripe', 0x3d, 0x20}}, {@errors_remount}, {@max_batch_time={'max_batch_time', 0x3d, 0x3ff}}, {@inlinecrypt}, {@dioread_lock}]}, 0x3, 0x589, &(0x7f0000000d80)="$eJzs3c1rHOUfAPDvbHb7/vs1hVKsiBR6sFK7aRJfKnioR9FiQT3XkGxDyaZbspvSxILtwV68SBFELIh3vXvwULx49K8oaKFICQp6WZnNbLJpNslmszFp9/OBSZ5nZnafeeaZ78Mz++wyAfStE+mfXMTxiPgiiTjcsi0f2cYTi/stPL45ni5J1Osf/JFEkq1r7p9k/w9mmeci4ufPIk7nVpdbnZufGiuXSzNZfqg2fW2oOjd/5sr02GRpsnR1ZHT03GujI2++8XrP6vryxb++fv/+O+c+P7nw1Q8Pj9xN4nwcyra11mNT9q7I3WrNnKjXs3NSiPNPvGy4q8J2r2SnD4CuDGRxXoiI44XDhWbUA8++TyOiDvSpZJPxv1d/Ac+I5jigeW/f9X3wU+rR24s3QKvrn1/8bCT2Ne6NDiwkK+6M0vvdwR6Un5bx4+/37qZLbOVzCIBNunU7Is7m86v7vyTr/7p3toN9nixD/wf/nfvp+OeVduOf3NL4J9qMfw62id1ubBz/uYc9KGZN6fjvrbbj36VJq8GBLPe/xpivkFy+Ui6lfdv/I+JUFPam+fXmc84tPKivta11/JcuafnNsWB2HA/zK+eYYmKsNraVOrd6dDvi+bbj32Sp/ZM27Z+ej486LONY6d6La23buP7bq/5dxEtt2395RitZf35yqHE9DDWvitX+vHPs17XKb1//X37ahqq2lbb/gfXrP5i0ztdWN1/Gt/v+Ka21rdvrf0/yYSO9J1t3Y6xWmxmO2JO8t3r9yPJrm/nm/mn9T51cv/9rd/3vj4iPO6z/naPfv9B9/bdXWv+JTbX/5hMP3v3km7XK76z9X22kTmVrOun/Oj3ArZw7AAAAAAAA2G1yEXEoklwx9mXpXK5YXPx+x9E4kCtXqrXTlyuzVyei8VvZwSjkmjPdh1u+DzGcfR+2mR95Ij8aEUci4suB/Y18cbxSntjpygMAAAAAAAAAAAAAAAAAAMAucXDp9/+x4vf/qd8GdvrogG2XX3z+N9CHNnzkfy+e9ATsShvGP/DMEv/Qv8Q/9C/xD32pMcUn/qF/iX/oX+If+pf4BwAAAAAAAAAAAAAAAAAAAAAAAAAAgJ66eOFCutQXHt8cT/MT1+dmpyrXz0yUqlPF6dnx4nhl5lpxslKZLJeK45Xpjd6vXKlcGx6J2RtDtVK1NlSdm780XZm9Wrt0ZXpssnSp5DnjAAAAAAAAAAAAAAAAAAAAsFp1bn5qrFwuzfQgUSiXS7mI6GTniB4V+tQl/t7y+6Ttdivf2XnenkQSy2vyu+KsSvQ6sdM9EwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAs+zcAAP//MUwypA==")
connect$pppl2tp(r4, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, r4, {0x2, 0x4e23, @rand_addr=0x64010102}, 0x3, 0x0, 0x1}}, 0x26) (async)
connect$pppl2tp(r4, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, r4, {0x2, 0x4e23, @rand_addr=0x64010102}, 0x3, 0x0, 0x1}}, 0x26)
r7 = socket$netlink(0x10, 0x3, 0x8000000004)
writev(r7, &(0x7f00000000c0)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fbc45ff810500000000000058000b480400945f6400947e570028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010002081000418e00000004fcff", 0x58}], 0x1)
syz_mount_image$exfat(&(0x7f0000001500), &(0x7f0000001540)='./file0\x00', 0x0, &(0x7f0000001580), 0x1, 0x14d1, &(0x7f00000015c0)="$eJzs3AlwlcW2KOBe3f1DiBG3EZl79fphiwGaiIjIICIyiIiICIjMIiBiRERERISATCICIgIyRkSGEAGRIUDEMM/zPBg5iIiIyCSTQL/C47ncczy3uO+8cy+vKuur6kqv/Hut3Z1VyT9UZf/UdViNxjWrNiAi8a9Qf5vAX78kCyFihBADhRC3CSECIUTZ+LLx147nUpD8L70J+x/SMPVmr4DdTNz/7I37n71x/7M37n/2xv3P3rj/2Rv3P3vj/jOWraUVuJ1H9h38/D874/N/9sb9z964/9kb9z974/5nb9z/7I37n71x/7M37j9j2dr/B8+gedzEwRhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOM/S+44K/TQoi/zW/2uhhjjDHGGGOMMfbv43Pe7BUwxhhjjDHGGGPsfx4IKZTQIhA5RE4RI3KJWHGLiBO3itziNhERt4t4cYfII+4UeUU+kV8UEAVFIVFYGIHCChKhKCKKiqi4SxQTd4sEUVyUECWFE6VEorhHlBb3ijLiPlFW3C/KiQdEeVFBVBSVxIOisnhIVBEPi6riEVFNVBc1RE3xqKglHhO1xeOijnhC1BVPinriKVFfPC0aiIaikXhGNBbPiiaiqWgmmosWoqVo9S/lvyV6iLdFT9FLJIveoo94R/QV/UR/MUAMFO+KQeI9MVi8L4aIoWKY+EAMFx+KEeIjMVKMEqPFx2KMGCvGifFigpgoUsQnYpL4VEwWn4kpYqqYJqaLVDFDpInPxUwxS8wWX4g54ksxV8wT88UCkS4WikViscgQX4kl4muRKZaKZWK5WCFWilVitVgj1op1Yr3YIDaKTWKz2CK2im1iu9ghdopdYrfYI/aKfWK/OCC+EVni2//L/PP/kN8NBAiQIEGDhhyQA2IgBmIhFuIgDnJDbohABOIhHvJAHsgLeSE/5IeCUBAKQ2FAQCAgKAJFIApRKAbFIAESoASUAAcOEiERSsO9UAbKQFkoC+WgHJSHClABKkElqAyVoQpUgapQFapBNagBNeBReBQeg9pQG+pAHagLdaEe1IP6UB8aQANoBI2gMTSGJtAEmkEzaAEtoBW0gtbQGtpAG2gH7aA9tIcO0AGSIAk6QkfoBJ2gM3SGLtAFukJX6AZvwpvwFrwFb8Pb0Auqyd7QB/pAX+gL/WEADIB3YRC8B+/B+zAEhsIw+AA+gA9hBJyDkTAKRsNoqCzHwjgYDyQnQgqkwCSYBJNhMkyBqTAVpkMqzIA0SIOZMAtmwRcwB76EL2EezIMFkA7psAgWQwZkwBI4D5mwFJbBclgBK2EFrIY1sBrWwXpYBxthI2yGzbAVtsJ22A47YSfsht2wF/bCftgPQyALsuAgHIRDcAgOw2E4AkfgKByFY3AMjsNxOAEn4CScgtNwCs7CWTgH5+ECXIBLcAkuw2W4Clev/fLLa7TUMofMIWNkjIyVsTJOxsncMreMyIiMl/Eyj8wj88q8Mr/MLwvKgrKwLCxRoiQZyiKyiIzKqCwmi8kEmSBLyBLSSScTZaIsLUvLMrKMLCvvl+XkA7K8rCDbukqykqws27kq8mFZVVaV1WR1WUPWlDVlLVlL1pa1ZR1ZR9aVdWU9+ZSsL3tDf2gor3WmsRwKTeQwaCabyxaypfwQnpOt5QhoI9vKdvIFOQpGQgfZ2iXJl2VHOQ46yVfleHhNdpEToat8Q3aTb8ru8i3ZQ7ZxPWUvOQV6yz5yOvSV/WR/OUDOhOryWsdqyPflEDlUDpMfyAXwoRwhP5Ij5Sg5Wn4sx8ixcpwcLyfIiTJFfiInyU/lZPmZnCKnymlyukyVM2Sa/FzOlLPkbPmFnCO/lHPlPDlfLpDpcqFcJBfLDPmVXCK/lplyqVwml8sVcqVcJVfLNXKtXCfXyw1yo9wkN8stcqvcJrfLHXKn3CV3yz1yr9wn98sD8huZJb+VB+Vf5CH5nTwsv5dH5A/yqPxRHpM/yePyZ3lC/iJPylPytDwjz8pf5Tl5Xl6QF+Ul+Zu8LK/Iq9JLoUBJpZRWgcqhcqoYlUvFqltUnLpV5Va3qYi6XcWrO1QedafKq/Kp/KqAKqgKqcLKKFRWkQpVEVVURdVdqpi6WyWo4qqEKqmcKqUS1T2qtLpXlVH3qbLqflVOPaDKqwqqoqqkHlSV1UOqinpYVVWPqGqquqqhaqpHVS31mKqtHld11BOqrnpS1VNPqfrqadVANVSN1DOqsXpWNVFNVTPVXLVQLVUr9ZxqrZ5XbVRb1U69oNqrF1UH9ZJKUi+rjuoV1Um9qjqr11QX9brqqt5Q3dSbqru6oq4qr3qqXipZ9VZ91Duqr+qn+qsBaqB6Vw1S76nB6n01RA1Vw9QHarj6UI1QH6mRapQarT5WY9RYNU6NVxPURJWiPlGT1KdqsvpMTVFT1TQ1XaWqGar/H5Vm/zfyP/0n+YN/f/fNaovaqrap7WqH2ql2qd1qj9qj9ql96oA6oLJUljqoDqpD6pA6rA6rI+qIOqqOqmPqmDqujqsT6oQ6qU6pi+qMOqt+VefUeXVeXVSX1CV1+Y+fgdCgpVZa60Dn0Dl1jM6lY/UtOk7fqnPr23RE367j9R06j75T59X5dH5dQBfUhXRhbTRqq0mHuoguqqP6Ll1M360TdHFdQpfUTpfSifqe/+f8G62vlW6lW+vWuo1uo9vpdrq9bq876A46SSfpjrqj7qQ76c66s+6iu+iuuqvuprvp7rq77qF76J66p07WybqPfkf31f10fz1AD9Tv6kF6kB6sB+sheogepofp4Xq4HqFH6JF6pB6tR+sxeowep8fpCXqCTtEpepKepCfryXqKnqKn6Wk6VafqNJ2mZ+qZeraerefoOXqunqvn6/k6XafrRXqRztAZeoleojP1Ur1UL9fL9Uq9Uq/Wq/VavVav1+v1Rr1RZ+oteoveprfpHXqH3qV36T16j96n9+kD+oDO0ln6oD6oD+lD+rA+rI/oI/qoPqqP6WP6uD6uT+gT+qQ+qU/r0/qsPqvP6XP6gr6gL+lL+rK+rK/qq9cu+wIZyEAHOsgR5AhigpggNogN4oK4IHeQO4gEkSA+iA/yBHcGeYN8Qf6gQFAwKBQUDkyAgQ0oCIMiQdEgGtwVFAvuDhKC4kGJoGTgglJBYnBPUDq4NygT3BeUDe4PygUPBOWDCkHFoFLwYFA5eCioEjwcVA0eCaoF1YMaQc3g0aBW8FhQO3g8qBM8EdQNngzqBU8F9YOngwZBw6BR8EzQOHg2aBI0DZoFzYMWQcug1b+1vvfn8j3veppeJtn0Nn3MO6av6Wf6mwFmoHnXDDLvmcHmfTPEDDXDzAdmuPnQjDAfmZFmlBltPjZjzFgzzow3E8xEk2I+MZPMp2ay+cxMMVPNNDPdpJoZJs18bmaaWWa2+cLMMV+auWaemW8WmHSz0Cwyi02G+cosMV+bTLPULDPLzQqz0qwyq80as9asM+vNBrPRbDKbzRaz1Wwz280Os9PsMrvNHrPX7DP7zQHzjcky35qD5i/mkPnOHDbfmyPmB3PU/GiOmZ/McfOzOWF+MSfNKXPanDFnza/mnDlvLpiL5pL5zVw2V8xV469d3F87vaNGjTkwB8ZgDMZiLMZhHObG3BjBCMZjPObBPJgX82J+zI8FsSAWxsJ4DSFhESyCUYxiMSyGCZiAJbAEOnSYiIlYGktjGSyDZbEslsNyWB7LY0WsiA/ig/gQPoQP48P4CD6C1bE61sSaWAtrYW2sjXWwDtbFulgP62F9rI8NsAE2wkbYGBtjE2yCzbAZtsAW2ApbYWtsjW2wDbbDdtge22MH7IBJmIQdsSN2wk7YGTtjF+yCXbErdsNu2B27Yw/sgT2xJyZjMvbBPtgX+2J/7I8DcSAOwkE4GAfjEByCw3AYDsfhOAJH4EgchaPxYxyDY3EcjscJOBFTMAUn4SScjJNxCk7BaTgNUzEV0zANZ+JMnI2zcQ7Owbk4F+fjfEzHdFyEizADM3AJLsFMzMRluAxX4ApchatwDa7BdbgON+AG3ISbcAtuwW24DXfgDtyFu3AP7sF9uA8P4AHMwiw8iAfxEB7Cw3gYj+ARPIpH8Rgew+N4HE/gCTyJJ/E0nsazeBbP4Tm8gBfwEv6Gl/EKXkWPMTaXjbW32Dh7q81tb7P/GOe3BWxBW8gWtsbmtfn+LkZrbYItbkvYktbZUjbR3vOnuLytYCvaSvZBW9k+ZKv8Ka5lH7O17eO2jn3C1rSP/l1c1z5p69lnbX3b1DawzW0j29I2ts/aJrapbWab2xa2pW1vX7Qd7Es2yb5sO9pX/hQvsovtGrvWrrPr7T67316wF+0x+5O9ZH+zPW0vO9C+awfZ9+xg+74dYof+KR5tP7Zj7Fg7zo63E+zEP8XT7HSbamfYNPu5nWln/SlOtwvtHJth59p5dr5d8Ht8bU0Z9iu7xH5tM+1Su8wutyvsSrvKrv6PtS63G+0mu9nusXvtNrvd7rA77S67+/f42j4O2G9slv3WHrU/2kP2O3vYHrdH7A+/x9f2d9z+bE/YX+xJe8qetmfsWfurPWfP/77/a3s/Y6/Yq9ZbQUCSFGkKKAflpBjKRbF0C8XRrZSbbqMI3U7xdAfloTspL+Wj/FSAClIhKkyGkCwRhVSEilKU7qJidDclUHEqQSXJUSlKpHuoNN1LZeg+Kkv3Uzl6gMpTBapIlehBqkwPURV6mKrSI1SNqlMNqkmPUi16jGrT41SHnqC69CTVo6eoPj1NDaghNaJnqDE9S02oKTWj5tSCWlIreo5a0/PUhtpSO3qB2tOL1IFeoiR6mTrSK9SJXqXO9Bp1odepK71B3ehN6k5vUQ96m3pSL0qm3tSH3qG+1I/60wAaSO/SIHqPBtP7NISG0jD6gIbThzSCPqKRNIpG08c0hsbSOBpPE2gipdAnNIk+pcn0GU2hqTSNplMqzaA0+pxm0iyaTV/QHPqS5tI8mk8LKJ0W0iJaTBn0FS2hrymTltIyWk4raCWtotW0htbSOlpPG2gjbaLNtIW20jbaTjtoJ+2i3bSH9tI+2k8H6BvKom/pIP2FDtF3dJi+pyP0Ax2lH+kY/UTH6Wc6Qb/QSTpFp+kMnaVf6Rydpwt0kS7Rb3SZrtBV8iRCCGWoQh0GYY4wZxgT5gpjw1vCuPDWMHd4WxgJbw/jwzvCPOGdYd4wX5g/LBAWDAuFhUMTYmhDCsOwSFg0jIZ3hcXCu8OEsHhYIiwZurBUmBjeE5YO7w3LhPeFZcP7w3LhA2H5sEJYMawUPhhWDh8Kq4QPh1XDR8JqYfWwRlgzfDSsFT4W1g4fD+uET4RlwifDeuFTYf3w6bBB2DBsFD4TNg6fDZuETcNmYfOwRdgybBU+F7YOnw/bhG3DduELYfvwxbBD+FKYFL4cdgxfueHx5LB32Cd8J3wn9P5xNT+6IJoeXRhdFF0czYh+FV0S/TqaGV0aXRZdHl0RXRldFV0dXRNdG10XXR/dEN0Y3RTdHPW+Zk7hwEmnnHaBy+FyuhiXy8W6W1ycu9Xldre5iLvdxbs7XB53p8vr8rn8roAr6Aq5ws44dNaRC10RV9RF3V2umLvbJbjiroQr6Zwr5RJdS9fKtXKt3fOujWvr2rkX3AvuRfeie8m95F52Hd0rrpN71XV2r7ku7nX3unvDdXNvuu7uLdfDve16ul4u2SW7Pq6P6+v6uv6uvxvoBrpBbpAb7Aa7IW6IG+aGueFuuBvhRriRbqQb7Ua7MW6MG+fGuQlugktxKW6Sm+Qmu8luipviprlpLtWlujSX5ma6mW62m+3muDlurpvr5rv5Lt2lu0VukctwGW6JW+IyXaZb5pa5FW6FW+VWuTVujVvn1rkNboPb5Da5LW6L2+a2uR1uh9vldrk9bo/b5/a5A+6Ay3JZ7qA76A65Q+6w+94dcT+4o+5Hd8z95I67n90J94s76U650+6MO+t+defceXfBXXSX3G/usrvirjrvUiKfRCZFPo1MjnwWmRKZGpkWmR5JjcyIpEU+j8yMzIrMjnwRmRP5MjI3Mi8yP7Igkh5ZGFkUWRzJiHwVWRL5OpIZWRpZFlkeWRFZGfG+0LbQF/FFfdTf5Yv5u32CL+5L+JLe+VI+0d/jS/t7fRl/ny/r7/fl/AO+vK/gK/qmvplv7lv4lr6Vf8639s/7Nr6tb+df8O39i76Df8kn+Zd9R/+K7+Rf9Z39a76Lf9139W/4bv5N392/5Xv4t31P38sn+96+j3/H9/X9fH8/wA/07/pB/j0/2L/vh/ihfpj/wA/3H/oR/iM/0o/yo/3Hfowf68f58X6Cn+hT/Cd+kv/UT/af+Sl+qp/mp/tUP8On+c/9TD/Lz/Zf+Dn+Sz/Xz/Pz/QKf7hf6RX6xz/Bf+SX+a5/pl/plfrlf4Vf6VX61X+PX+nV+vd/gN/pNfrPf4rf6bX673+F3+l1+t9/j9/p9fr8/4L/xWf5bf9D/xR/y3/nD/nt/xP/gj/of/TH/kz/uf/Yn/C/+pD/lT/sz/qz/1Z/z5/0Ff9Ff8r/5y/6Kv8r/s8YYY4wx9t+ibnC89z/5nvxjXNNHCHHr9gJH/rHmhrx/nfeT+zpGhBAv9+ra8G+jYcPk5OQ/XpupRFB0nhAicj0/h7geLxXtxIsiSbQVpf/p+vrJikA3qB+9X4jY/5QTI67H1+vf+1/Ub7rwhvXnCZFQ9HpOLnE9vl6/zH9Rf3f7G9TP9V2KEG3+U06cuB5fr58onheviKS/eyVjjDHGGGOMMfZX/eSlbje6v712f15QX8/JKa7HN7o/Z4wxxhhjjDHG2M332pvdX3ouKaltZ57whCc8+Y/Jzf7LxBhjjDHGGPt3u37Rf7NXwhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMZV//Gx8ndrP3yBhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjN1s/ycAAP//fMhn/w==")
bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0xd, 0x1cd, &(0x7f0000000040)=@framed, &(0x7f0000000100)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x84}, 0x94)

program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-syz_mount_image$ext4-openat$tcp_mem-write$tcp_mem-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-socket$pppl2tp-socket$packet-socket$packet-setsockopt$packet_tx_ring-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-sendmmsg-ioctl$BTRFS_IOC_QGROUP_LIMIT-ioctl$BTRFS_IOC_QGROUP_LIMIT-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_LOOKUP_ELEM-syz_usb_connect$hid-syz_mount_image$ext4-connect$pppl2tp-connect$pppl2tp-socket$netlink-writev-syz_mount_image$exfat
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue")
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
write$tcp_mem(r2, 0x0, 0xfffffeff)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32)
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
socket$packet(0x11, 0x2, 0x300) (async)
r5 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r5, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) (async)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff)
sendmmsg(r5, &(0x7f0000000880)=[{{&(0x7f0000000180)=@hci={0x1f, 0xffffffffffffffff, 0x2}, 0x80, 0x0}}], 0x1, 0x45)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}})
bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="120000000a001700080000000200000000000000fd2232fdbec4f9088dfde2e8274444d7b426178cde3a981d5c0078e97367eb5484e7a23dc54df612ed2dce9abca9768676974b1e55ff3b3894d1df437715020e90f206dcc4be855105c9bf668efec2ef25381a55f29539442615eac4a856c07bd2a5d68edd3019747032767163fb6d6e5c1220b91bb2992c6de72293636f287f1469fb2e0f94bbcd418409c8c89f5ebbb67f3cfb005b1083683b998cd00a8fac5b49c74583", @ANYRES32, @ANYBLOB='\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) (async)
r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="120000000a001700080000000200000000000000fd2232fdbec4f9088dfde2e8274444d7b426178cde3a981d5c0078e97367eb5484e7a23dc54df612ed2dce9abca9768676974b1e55ff3b3894d1df437715020e90f206dcc4be855105c9bf668efec2ef25381a55f29539442615eac4a856c07bd2a5d68edd3019747032767163fb6d6e5c1220b91bb2992c6de72293636f287f1469fb2e0f94bbcd418409c8c89f5ebbb67f3cfb005b1083683b998cd00a8fac5b49c74583", @ANYRES32, @ANYBLOB='\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000002c0)={r6, &(0x7f0000000580), 0x0}, 0x20)
syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x8, 0x16c0, 0x5e1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x40, 0x40, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x1, 0x3, 0x41, {0x9, 0x21, 0xfff4, 0xd9, 0x1, {0x22, 0x998}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x5, 0x2, 0x7}}}}}]}}]}}, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x4, [{0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x444}}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})
syz_mount_image$ext4(&(0x7f0000000180)='ext2\x00', &(0x7f0000000200)='./file1\x00', 0x210000, &(0x7f0000000040)={[{@nobh}, {@debug}, {@barrier}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x2000}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x70}}, {@min_batch_time={'min_batch_time', 0x3d, 0x3d20}}, {@stripe={'stripe', 0x3d, 0x20}}, {@errors_remount}, {@max_batch_time={'max_batch_time', 0x3d, 0x3ff}}, {@inlinecrypt}, {@dioread_lock}]}, 0x3, 0x589, &(0x7f0000000d80)="$eJzs3c1rHOUfAPDvbHb7/vs1hVKsiBR6sFK7aRJfKnioR9FiQT3XkGxDyaZbspvSxILtwV68SBFELIh3vXvwULx49K8oaKFICQp6WZnNbLJpNslmszFp9/OBSZ5nZnafeeaZ78Mz++wyAfStE+mfXMTxiPgiiTjcsi0f2cYTi/stPL45ni5J1Osf/JFEkq1r7p9k/w9mmeci4ufPIk7nVpdbnZufGiuXSzNZfqg2fW2oOjd/5sr02GRpsnR1ZHT03GujI2++8XrP6vryxb++fv/+O+c+P7nw1Q8Pj9xN4nwcyra11mNT9q7I3WrNnKjXs3NSiPNPvGy4q8J2r2SnD4CuDGRxXoiI44XDhWbUA8++TyOiDvSpZJPxv1d/Ac+I5jigeW/f9X3wU+rR24s3QKvrn1/8bCT2Ne6NDiwkK+6M0vvdwR6Un5bx4+/37qZLbOVzCIBNunU7Is7m86v7vyTr/7p3toN9nixD/wf/nfvp+OeVduOf3NL4J9qMfw62id1ubBz/uYc9KGZN6fjvrbbj36VJq8GBLPe/xpivkFy+Ui6lfdv/I+JUFPam+fXmc84tPKivta11/JcuafnNsWB2HA/zK+eYYmKsNraVOrd6dDvi+bbj32Sp/ZM27Z+ej486LONY6d6La23buP7bq/5dxEtt2395RitZf35yqHE9DDWvitX+vHPs17XKb1//X37ahqq2lbb/gfXrP5i0ztdWN1/Gt/v+Ka21rdvrf0/yYSO9J1t3Y6xWmxmO2JO8t3r9yPJrm/nm/mn9T51cv/9rd/3vj4iPO6z/naPfv9B9/bdXWv+JTbX/5hMP3v3km7XK76z9X22kTmVrOun/Oj3ArZw7AAAAAAAA2G1yEXEoklwx9mXpXK5YXPx+x9E4kCtXqrXTlyuzVyei8VvZwSjkmjPdh1u+DzGcfR+2mR95Ij8aEUci4suB/Y18cbxSntjpygMAAAAAAAAAAAAAAAAAAMAucXDp9/+x4vf/qd8GdvrogG2XX3z+N9CHNnzkfy+e9ATsShvGP/DMEv/Qv8Q/9C/xD32pMcUn/qF/iX/oX+If+pf4BwAAAAAAAAAAAAAAAAAAAAAAAAAAgJ66eOFCutQXHt8cT/MT1+dmpyrXz0yUqlPF6dnx4nhl5lpxslKZLJeK45Xpjd6vXKlcGx6J2RtDtVK1NlSdm780XZm9Wrt0ZXpssnSp5DnjAAAAAAAAAAAAAAAAAAAAsFp1bn5qrFwuzfQgUSiXS7mI6GTniB4V+tQl/t7y+6Ttdivf2XnenkQSy2vyu+KsSvQ6sdM9EwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAs+zcAAP//MUwypA==")
connect$pppl2tp(r4, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, r4, {0x2, 0x4e23, @rand_addr=0x64010102}, 0x3, 0x0, 0x1}}, 0x26) (async)
connect$pppl2tp(r4, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, r4, {0x2, 0x4e23, @rand_addr=0x64010102}, 0x3, 0x0, 0x1}}, 0x26)
r7 = socket$netlink(0x10, 0x3, 0x8000000004)
writev(r7, &(0x7f00000000c0)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fbc45ff810500000000000058000b480400945f6400947e570028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010002081000418e00000004fcff", 0x58}], 0x1)
syz_mount_image$exfat(&(0x7f0000001500), &(0x7f0000001540)='./file0\x00', 0x0, &(0x7f0000001580), 0x1, 0x14d1, &(0x7f00000015c0)="$eJzs3AlwlcW2KOBe3f1DiBG3EZl79fphiwGaiIjIICIyiIiICIjMIiBiRERERISATCICIgIyRkSGEAGRIUDEMM/zPBg5iIiIyCSTQL/C47ncczy3uO+8cy+vKuur6kqv/Hut3Z1VyT9UZf/UdViNxjWrNiAi8a9Qf5vAX78kCyFihBADhRC3CSECIUTZ+LLx147nUpD8L70J+x/SMPVmr4DdTNz/7I37n71x/7M37n/2xv3P3rj/2Rv3P3vj/jOWraUVuJ1H9h38/D874/N/9sb9z964/9kb9z974/5nb9z/7I37n71x/7M37j9j2dr/B8+gedzEwRhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOM/S+44K/TQoi/zW/2uhhjjDHGGGOMMfbv43Pe7BUwxhhjjDHGGGPsfx4IKZTQIhA5RE4RI3KJWHGLiBO3itziNhERt4t4cYfII+4UeUU+kV8UEAVFIVFYGIHCChKhKCKKiqi4SxQTd4sEUVyUECWFE6VEorhHlBb3ijLiPlFW3C/KiQdEeVFBVBSVxIOisnhIVBEPi6riEVFNVBc1RE3xqKglHhO1xeOijnhC1BVPinriKVFfPC0aiIaikXhGNBbPiiaiqWgmmosWoqVo9S/lvyV6iLdFT9FLJIveoo94R/QV/UR/MUAMFO+KQeI9MVi8L4aIoWKY+EAMFx+KEeIjMVKMEqPFx2KMGCvGifFigpgoUsQnYpL4VEwWn4kpYqqYJqaLVDFDpInPxUwxS8wWX4g54ksxV8wT88UCkS4WikViscgQX4kl4muRKZaKZWK5WCFWilVitVgj1op1Yr3YIDaKTWKz2CK2im1iu9ghdopdYrfYI/aKfWK/OCC+EVni2//L/PP/kN8NBAiQIEGDhhyQA2IgBmIhFuIgDnJDbohABOIhHvJAHsgLeSE/5IeCUBAKQ2FAQCAgKAJFIApRKAbFIAESoASUAAcOEiERSsO9UAbKQFkoC+WgHJSHClABKkElqAyVoQpUgapQFapBNagBNeBReBQeg9pQG+pAHagLdaEe1IP6UB8aQANoBI2gMTSGJtAEmkEzaAEtoBW0gtbQGtpAG2gH7aA9tIcO0AGSIAk6QkfoBJ2gM3SGLtAFukJX6AZvwpvwFrwFb8Pb0Auqyd7QB/pAX+gL/WEADIB3YRC8B+/B+zAEhsIw+AA+gA9hBJyDkTAKRsNoqCzHwjgYDyQnQgqkwCSYBJNhMkyBqTAVpkMqzIA0SIOZMAtmwRcwB76EL2EezIMFkA7psAgWQwZkwBI4D5mwFJbBclgBK2EFrIY1sBrWwXpYBxthI2yGzbAVtsJ22A47YSfsht2wF/bCftgPQyALsuAgHIRDcAgOw2E4AkfgKByFY3AMjsNxOAEn4CScgtNwCs7CWTgH5+ECXIBLcAkuw2W4Clev/fLLa7TUMofMIWNkjIyVsTJOxsncMreMyIiMl/Eyj8wj88q8Mr/MLwvKgrKwLCxRoiQZyiKyiIzKqCwmi8kEmSBLyBLSSScTZaIsLUvLMrKMLCvvl+XkA7K8rCDbukqykqws27kq8mFZVVaV1WR1WUPWlDVlLVlL1pa1ZR1ZR9aVdWU9+ZSsL3tDf2gor3WmsRwKTeQwaCabyxaypfwQnpOt5QhoI9vKdvIFOQpGQgfZ2iXJl2VHOQ46yVfleHhNdpEToat8Q3aTb8ru8i3ZQ7ZxPWUvOQV6yz5yOvSV/WR/OUDOhOryWsdqyPflEDlUDpMfyAXwoRwhP5Ij5Sg5Wn4sx8ixcpwcLyfIiTJFfiInyU/lZPmZnCKnymlyukyVM2Sa/FzOlLPkbPmFnCO/lHPlPDlfLpDpcqFcJBfLDPmVXCK/lplyqVwml8sVcqVcJVfLNXKtXCfXyw1yo9wkN8stcqvcJrfLHXKn3CV3yz1yr9wn98sD8huZJb+VB+Vf5CH5nTwsv5dH5A/yqPxRHpM/yePyZ3lC/iJPylPytDwjz8pf5Tl5Xl6QF+Ul+Zu8LK/Iq9JLoUBJpZRWgcqhcqoYlUvFqltUnLpV5Va3qYi6XcWrO1QedafKq/Kp/KqAKqgKqcLKKFRWkQpVEVVURdVdqpi6WyWo4qqEKqmcKqUS1T2qtLpXlVH3qbLqflVOPaDKqwqqoqqkHlSV1UOqinpYVVWPqGqquqqhaqpHVS31mKqtHld11BOqrnpS1VNPqfrqadVANVSN1DOqsXpWNVFNVTPVXLVQLVUr9ZxqrZ5XbVRb1U69oNqrF1UH9ZJKUi+rjuoV1Um9qjqr11QX9brqqt5Q3dSbqru6oq4qr3qqXipZ9VZ91Duqr+qn+qsBaqB6Vw1S76nB6n01RA1Vw9QHarj6UI1QH6mRapQarT5WY9RYNU6NVxPURJWiPlGT1KdqsvpMTVFT1TQ1XaWqGar/H5Vm/zfyP/0n+YN/f/fNaovaqrap7WqH2ql2qd1qj9qj9ql96oA6oLJUljqoDqpD6pA6rA6rI+qIOqqOqmPqmDqujqsT6oQ6qU6pi+qMOqt+VefUeXVeXVSX1CV1+Y+fgdCgpVZa60Dn0Dl1jM6lY/UtOk7fqnPr23RE367j9R06j75T59X5dH5dQBfUhXRhbTRqq0mHuoguqqP6Ll1M360TdHFdQpfUTpfSifqe/+f8G62vlW6lW+vWuo1uo9vpdrq9bq876A46SSfpjrqj7qQ76c66s+6iu+iuuqvuprvp7rq77qF76J66p07WybqPfkf31f10fz1AD9Tv6kF6kB6sB+sheogepofp4Xq4HqFH6JF6pB6tR+sxeowep8fpCXqCTtEpepKepCfryXqKnqKn6Wk6VafqNJ2mZ+qZeraerefoOXqunqvn6/k6XafrRXqRztAZeoleojP1Ur1UL9fL9Uq9Uq/Wq/VavVav1+v1Rr1RZ+oteoveprfpHXqH3qV36T16j96n9+kD+oDO0ln6oD6oD+lD+rA+rI/oI/qoPqqP6WP6uD6uT+gT+qQ+qU/r0/qsPqvP6XP6gr6gL+lL+rK+rK/qq9cu+wIZyEAHOsgR5AhigpggNogN4oK4IHeQO4gEkSA+iA/yBHcGeYN8Qf6gQFAwKBQUDkyAgQ0oCIMiQdEgGtwVFAvuDhKC4kGJoGTgglJBYnBPUDq4NygT3BeUDe4PygUPBOWDCkHFoFLwYFA5eCioEjwcVA0eCaoF1YMaQc3g0aBW8FhQO3g8qBM8EdQNngzqBU8F9YOngwZBw6BR8EzQOHg2aBI0DZoFzYMWQcug1b+1vvfn8j3veppeJtn0Nn3MO6av6Wf6mwFmoHnXDDLvmcHmfTPEDDXDzAdmuPnQjDAfmZFmlBltPjZjzFgzzow3E8xEk2I+MZPMp2ay+cxMMVPNNDPdpJoZJs18bmaaWWa2+cLMMV+auWaemW8WmHSz0Cwyi02G+cosMV+bTLPULDPLzQqz0qwyq80as9asM+vNBrPRbDKbzRaz1Wwz280Os9PsMrvNHrPX7DP7zQHzjcky35qD5i/mkPnOHDbfmyPmB3PU/GiOmZ/McfOzOWF+MSfNKXPanDFnza/mnDlvLpiL5pL5zVw2V8xV469d3F87vaNGjTkwB8ZgDMZiLMZhHObG3BjBCMZjPObBPJgX82J+zI8FsSAWxsJ4DSFhESyCUYxiMSyGCZiAJbAEOnSYiIlYGktjGSyDZbEslsNyWB7LY0WsiA/ig/gQPoQP48P4CD6C1bE61sSaWAtrYW2sjXWwDtbFulgP62F9rI8NsAE2wkbYGBtjE2yCzbAZtsAW2ApbYWtsjW2wDbbDdtge22MH7IBJmIQdsSN2wk7YGTtjF+yCXbErdsNu2B27Yw/sgT2xJyZjMvbBPtgX+2J/7I8DcSAOwkE4GAfjEByCw3AYDsfhOAJH4EgchaPxYxyDY3EcjscJOBFTMAUn4SScjJNxCk7BaTgNUzEV0zANZ+JMnI2zcQ7Owbk4F+fjfEzHdFyEizADM3AJLsFMzMRluAxX4ApchatwDa7BdbgON+AG3ISbcAtuwW24DXfgDtyFu3AP7sF9uA8P4AHMwiw8iAfxEB7Cw3gYj+ARPIpH8Rgew+N4HE/gCTyJJ/E0nsazeBbP4Tm8gBfwEv6Gl/EKXkWPMTaXjbW32Dh7q81tb7P/GOe3BWxBW8gWtsbmtfn+LkZrbYItbkvYktbZUjbR3vOnuLytYCvaSvZBW9k+ZKv8Ka5lH7O17eO2jn3C1rSP/l1c1z5p69lnbX3b1DawzW0j29I2ts/aJrapbWab2xa2pW1vX7Qd7Es2yb5sO9pX/hQvsovtGrvWrrPr7T67316wF+0x+5O9ZH+zPW0vO9C+awfZ9+xg+74dYof+KR5tP7Zj7Fg7zo63E+zEP8XT7HSbamfYNPu5nWln/SlOtwvtHJth59p5dr5d8Ht8bU0Z9iu7xH5tM+1Su8wutyvsSrvKrv6PtS63G+0mu9nusXvtNrvd7rA77S67+/f42j4O2G9slv3WHrU/2kP2O3vYHrdH7A+/x9f2d9z+bE/YX+xJe8qetmfsWfurPWfP/77/a3s/Y6/Yq9ZbQUCSFGkKKAflpBjKRbF0C8XRrZSbbqMI3U7xdAfloTspL+Wj/FSAClIhKkyGkCwRhVSEilKU7qJidDclUHEqQSXJUSlKpHuoNN1LZeg+Kkv3Uzl6gMpTBapIlehBqkwPURV6mKrSI1SNqlMNqkmPUi16jGrT41SHnqC69CTVo6eoPj1NDaghNaJnqDE9S02oKTWj5tSCWlIreo5a0/PUhtpSO3qB2tOL1IFeoiR6mTrSK9SJXqXO9Bp1odepK71B3ehN6k5vUQ96m3pSL0qm3tSH3qG+1I/60wAaSO/SIHqPBtP7NISG0jD6gIbThzSCPqKRNIpG08c0hsbSOBpPE2gipdAnNIk+pcn0GU2hqTSNplMqzaA0+pxm0iyaTV/QHPqS5tI8mk8LKJ0W0iJaTBn0FS2hrymTltIyWk4raCWtotW0htbSOlpPG2gjbaLNtIW20jbaTjtoJ+2i3bSH9tI+2k8H6BvKom/pIP2FDtF3dJi+pyP0Ax2lH+kY/UTH6Wc6Qb/QSTpFp+kMnaVf6Rydpwt0kS7Rb3SZrtBV8iRCCGWoQh0GYY4wZxgT5gpjw1vCuPDWMHd4WxgJbw/jwzvCPOGdYd4wX5g/LBAWDAuFhUMTYmhDCsOwSFg0jIZ3hcXCu8OEsHhYIiwZurBUmBjeE5YO7w3LhPeFZcP7w3LhA2H5sEJYMawUPhhWDh8Kq4QPh1XDR8JqYfWwRlgzfDSsFT4W1g4fD+uET4RlwifDeuFTYf3w6bBB2DBsFD4TNg6fDZuETcNmYfOwRdgybBU+F7YOnw/bhG3DduELYfvwxbBD+FKYFL4cdgxfueHx5LB32Cd8J3wn9P5xNT+6IJoeXRhdFF0czYh+FV0S/TqaGV0aXRZdHl0RXRldFV0dXRNdG10XXR/dEN0Y3RTdHPW+Zk7hwEmnnHaBy+FyuhiXy8W6W1ycu9Xldre5iLvdxbs7XB53p8vr8rn8roAr6Aq5ws44dNaRC10RV9RF3V2umLvbJbjiroQr6Zwr5RJdS9fKtXKt3fOujWvr2rkX3AvuRfeie8m95F52Hd0rrpN71XV2r7ku7nX3unvDdXNvuu7uLdfDve16ul4u2SW7Pq6P6+v6uv6uvxvoBrpBbpAb7Aa7IW6IG+aGueFuuBvhRriRbqQb7Ua7MW6MG+fGuQlugktxKW6Sm+Qmu8luipviprlpLtWlujSX5ma6mW62m+3muDlurpvr5rv5Lt2lu0VukctwGW6JW+IyXaZb5pa5FW6FW+VWuTVujVvn1rkNboPb5Da5LW6L2+a2uR1uh9vldrk9bo/b5/a5A+6Ay3JZ7qA76A65Q+6w+94dcT+4o+5Hd8z95I67n90J94s76U650+6MO+t+defceXfBXXSX3G/usrvirjrvUiKfRCZFPo1MjnwWmRKZGpkWmR5JjcyIpEU+j8yMzIrMjnwRmRP5MjI3Mi8yP7Igkh5ZGFkUWRzJiHwVWRL5OpIZWRpZFlkeWRFZGfG+0LbQF/FFfdTf5Yv5u32CL+5L+JLe+VI+0d/jS/t7fRl/ny/r7/fl/AO+vK/gK/qmvplv7lv4lr6Vf8639s/7Nr6tb+df8O39i76Df8kn+Zd9R/+K7+Rf9Z39a76Lf9139W/4bv5N392/5Xv4t31P38sn+96+j3/H9/X9fH8/wA/07/pB/j0/2L/vh/ihfpj/wA/3H/oR/iM/0o/yo/3Hfowf68f58X6Cn+hT/Cd+kv/UT/af+Sl+qp/mp/tUP8On+c/9TD/Lz/Zf+Dn+Sz/Xz/Pz/QKf7hf6RX6xz/Bf+SX+a5/pl/plfrlf4Vf6VX61X+PX+nV+vd/gN/pNfrPf4rf6bX673+F3+l1+t9/j9/p9fr8/4L/xWf5bf9D/xR/y3/nD/nt/xP/gj/of/TH/kz/uf/Yn/C/+pD/lT/sz/qz/1Z/z5/0Ff9Ff8r/5y/6Kv8r/s8YYY4wx9t+ibnC89z/5nvxjXNNHCHHr9gJH/rHmhrx/nfeT+zpGhBAv9+ra8G+jYcPk5OQ/XpupRFB0nhAicj0/h7geLxXtxIsiSbQVpf/p+vrJikA3qB+9X4jY/5QTI67H1+vf+1/Ub7rwhvXnCZFQ9HpOLnE9vl6/zH9Rf3f7G9TP9V2KEG3+U06cuB5fr58onheviKS/eyVjjDHGGGOMMfZX/eSlbje6v712f15QX8/JKa7HN7o/Z4wxxhhjjDHG2M332pvdX3ouKaltZ57whCc8+Y/Jzf7LxBhjjDHGGPt3u37Rf7NXwhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMZV//Gx8ndrP3yBhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjN1s/ycAAP//fMhn/w==")

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-syz_mount_image$ext4-openat$tcp_mem-write$tcp_mem-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-socket$pppl2tp-socket$packet-socket$packet-setsockopt$packet_tx_ring-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-sendmmsg-ioctl$BTRFS_IOC_QGROUP_LIMIT-ioctl$BTRFS_IOC_QGROUP_LIMIT-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_LOOKUP_ELEM-syz_usb_connect$hid-syz_mount_image$ext4-connect$pppl2tp-connect$pppl2tp-socket$netlink-writev
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue")
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
write$tcp_mem(r2, 0x0, 0xfffffeff)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32)
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
socket$packet(0x11, 0x2, 0x300) (async)
r5 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r5, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) (async)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff)
sendmmsg(r5, &(0x7f0000000880)=[{{&(0x7f0000000180)=@hci={0x1f, 0xffffffffffffffff, 0x2}, 0x80, 0x0}}], 0x1, 0x45)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}})
bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="120000000a001700080000000200000000000000fd2232fdbec4f9088dfde2e8274444d7b426178cde3a981d5c0078e97367eb5484e7a23dc54df612ed2dce9abca9768676974b1e55ff3b3894d1df437715020e90f206dcc4be855105c9bf668efec2ef25381a55f29539442615eac4a856c07bd2a5d68edd3019747032767163fb6d6e5c1220b91bb2992c6de72293636f287f1469fb2e0f94bbcd418409c8c89f5ebbb67f3cfb005b1083683b998cd00a8fac5b49c74583", @ANYRES32, @ANYBLOB='\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) (async)
r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="120000000a001700080000000200000000000000fd2232fdbec4f9088dfde2e8274444d7b426178cde3a981d5c0078e97367eb5484e7a23dc54df612ed2dce9abca9768676974b1e55ff3b3894d1df437715020e90f206dcc4be855105c9bf668efec2ef25381a55f29539442615eac4a856c07bd2a5d68edd3019747032767163fb6d6e5c1220b91bb2992c6de72293636f287f1469fb2e0f94bbcd418409c8c89f5ebbb67f3cfb005b1083683b998cd00a8fac5b49c74583", @ANYRES32, @ANYBLOB='\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000002c0)={r6, &(0x7f0000000580), 0x0}, 0x20)
syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x8, 0x16c0, 0x5e1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x40, 0x40, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x1, 0x3, 0x41, {0x9, 0x21, 0xfff4, 0xd9, 0x1, {0x22, 0x998}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x5, 0x2, 0x7}}}}}]}}]}}, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x4, [{0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x444}}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})
syz_mount_image$ext4(&(0x7f0000000180)='ext2\x00', &(0x7f0000000200)='./file1\x00', 0x210000, &(0x7f0000000040)={[{@nobh}, {@debug}, {@barrier}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x2000}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x70}}, {@min_batch_time={'min_batch_time', 0x3d, 0x3d20}}, {@stripe={'stripe', 0x3d, 0x20}}, {@errors_remount}, {@max_batch_time={'max_batch_time', 0x3d, 0x3ff}}, {@inlinecrypt}, {@dioread_lock}]}, 0x3, 0x589, &(0x7f0000000d80)="$eJzs3c1rHOUfAPDvbHb7/vs1hVKsiBR6sFK7aRJfKnioR9FiQT3XkGxDyaZbspvSxILtwV68SBFELIh3vXvwULx49K8oaKFICQp6WZnNbLJpNslmszFp9/OBSZ5nZnafeeaZ78Mz++wyAfStE+mfXMTxiPgiiTjcsi0f2cYTi/stPL45ni5J1Osf/JFEkq1r7p9k/w9mmeci4ufPIk7nVpdbnZufGiuXSzNZfqg2fW2oOjd/5sr02GRpsnR1ZHT03GujI2++8XrP6vryxb++fv/+O+c+P7nw1Q8Pj9xN4nwcyra11mNT9q7I3WrNnKjXs3NSiPNPvGy4q8J2r2SnD4CuDGRxXoiI44XDhWbUA8++TyOiDvSpZJPxv1d/Ac+I5jigeW/f9X3wU+rR24s3QKvrn1/8bCT2Ne6NDiwkK+6M0vvdwR6Un5bx4+/37qZLbOVzCIBNunU7Is7m86v7vyTr/7p3toN9nixD/wf/nfvp+OeVduOf3NL4J9qMfw62id1ubBz/uYc9KGZN6fjvrbbj36VJq8GBLPe/xpivkFy+Ui6lfdv/I+JUFPam+fXmc84tPKivta11/JcuafnNsWB2HA/zK+eYYmKsNraVOrd6dDvi+bbj32Sp/ZM27Z+ej486LONY6d6La23buP7bq/5dxEtt2395RitZf35yqHE9DDWvitX+vHPs17XKb1//X37ahqq2lbb/gfXrP5i0ztdWN1/Gt/v+Ka21rdvrf0/yYSO9J1t3Y6xWmxmO2JO8t3r9yPJrm/nm/mn9T51cv/9rd/3vj4iPO6z/naPfv9B9/bdXWv+JTbX/5hMP3v3km7XK76z9X22kTmVrOun/Oj3ArZw7AAAAAAAA2G1yEXEoklwx9mXpXK5YXPx+x9E4kCtXqrXTlyuzVyei8VvZwSjkmjPdh1u+DzGcfR+2mR95Ij8aEUci4suB/Y18cbxSntjpygMAAAAAAAAAAAAAAAAAAMAucXDp9/+x4vf/qd8GdvrogG2XX3z+N9CHNnzkfy+e9ATsShvGP/DMEv/Qv8Q/9C/xD32pMcUn/qF/iX/oX+If+pf4BwAAAAAAAAAAAAAAAAAAAAAAAAAAgJ66eOFCutQXHt8cT/MT1+dmpyrXz0yUqlPF6dnx4nhl5lpxslKZLJeK45Xpjd6vXKlcGx6J2RtDtVK1NlSdm780XZm9Wrt0ZXpssnSp5DnjAAAAAAAAAAAAAAAAAAAAsFp1bn5qrFwuzfQgUSiXS7mI6GTniB4V+tQl/t7y+6Ttdivf2XnenkQSy2vyu+KsSvQ6sdM9EwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAs+zcAAP//MUwypA==")
connect$pppl2tp(r4, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, r4, {0x2, 0x4e23, @rand_addr=0x64010102}, 0x3, 0x0, 0x1}}, 0x26) (async)
connect$pppl2tp(r4, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, r4, {0x2, 0x4e23, @rand_addr=0x64010102}, 0x3, 0x0, 0x1}}, 0x26)
r7 = socket$netlink(0x10, 0x3, 0x8000000004)
writev(r7, &(0x7f00000000c0)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067fbc45ff810500000000000058000b480400945f6400947e570028925a01000000000000008000f0fffeffe809000000fff5dd0000001000010002081000418e00000004fcff", 0x58}], 0x1)

program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-syz_mount_image$ext4-openat$tcp_mem-write$tcp_mem-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-socket$pppl2tp-socket$packet-socket$packet-setsockopt$packet_tx_ring-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-sendmmsg-ioctl$BTRFS_IOC_QGROUP_LIMIT-ioctl$BTRFS_IOC_QGROUP_LIMIT-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_LOOKUP_ELEM-syz_usb_connect$hid-syz_mount_image$ext4-connect$pppl2tp-connect$pppl2tp-socket$netlink
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue")
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
write$tcp_mem(r2, 0x0, 0xfffffeff)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32)
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
socket$packet(0x11, 0x2, 0x300) (async)
r5 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r5, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) (async)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff)
sendmmsg(r5, &(0x7f0000000880)=[{{&(0x7f0000000180)=@hci={0x1f, 0xffffffffffffffff, 0x2}, 0x80, 0x0}}], 0x1, 0x45)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}})
bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="120000000a001700080000000200000000000000fd2232fdbec4f9088dfde2e8274444d7b426178cde3a981d5c0078e97367eb5484e7a23dc54df612ed2dce9abca9768676974b1e55ff3b3894d1df437715020e90f206dcc4be855105c9bf668efec2ef25381a55f29539442615eac4a856c07bd2a5d68edd3019747032767163fb6d6e5c1220b91bb2992c6de72293636f287f1469fb2e0f94bbcd418409c8c89f5ebbb67f3cfb005b1083683b998cd00a8fac5b49c74583", @ANYRES32, @ANYBLOB='\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) (async)
r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="120000000a001700080000000200000000000000fd2232fdbec4f9088dfde2e8274444d7b426178cde3a981d5c0078e97367eb5484e7a23dc54df612ed2dce9abca9768676974b1e55ff3b3894d1df437715020e90f206dcc4be855105c9bf668efec2ef25381a55f29539442615eac4a856c07bd2a5d68edd3019747032767163fb6d6e5c1220b91bb2992c6de72293636f287f1469fb2e0f94bbcd418409c8c89f5ebbb67f3cfb005b1083683b998cd00a8fac5b49c74583", @ANYRES32, @ANYBLOB='\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000002c0)={r6, &(0x7f0000000580), 0x0}, 0x20)
syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x8, 0x16c0, 0x5e1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x40, 0x40, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x1, 0x3, 0x41, {0x9, 0x21, 0xfff4, 0xd9, 0x1, {0x22, 0x998}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x5, 0x2, 0x7}}}}}]}}]}}, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x4, [{0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x444}}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})
syz_mount_image$ext4(&(0x7f0000000180)='ext2\x00', &(0x7f0000000200)='./file1\x00', 0x210000, &(0x7f0000000040)={[{@nobh}, {@debug}, {@barrier}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x2000}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x70}}, {@min_batch_time={'min_batch_time', 0x3d, 0x3d20}}, {@stripe={'stripe', 0x3d, 0x20}}, {@errors_remount}, {@max_batch_time={'max_batch_time', 0x3d, 0x3ff}}, {@inlinecrypt}, {@dioread_lock}]}, 0x3, 0x589, &(0x7f0000000d80)="$eJzs3c1rHOUfAPDvbHb7/vs1hVKsiBR6sFK7aRJfKnioR9FiQT3XkGxDyaZbspvSxILtwV68SBFELIh3vXvwULx49K8oaKFICQp6WZnNbLJpNslmszFp9/OBSZ5nZnafeeaZ78Mz++wyAfStE+mfXMTxiPgiiTjcsi0f2cYTi/stPL45ni5J1Osf/JFEkq1r7p9k/w9mmeci4ufPIk7nVpdbnZufGiuXSzNZfqg2fW2oOjd/5sr02GRpsnR1ZHT03GujI2++8XrP6vryxb++fv/+O+c+P7nw1Q8Pj9xN4nwcyra11mNT9q7I3WrNnKjXs3NSiPNPvGy4q8J2r2SnD4CuDGRxXoiI44XDhWbUA8++TyOiDvSpZJPxv1d/Ac+I5jigeW/f9X3wU+rR24s3QKvrn1/8bCT2Ne6NDiwkK+6M0vvdwR6Un5bx4+/37qZLbOVzCIBNunU7Is7m86v7vyTr/7p3toN9nixD/wf/nfvp+OeVduOf3NL4J9qMfw62id1ubBz/uYc9KGZN6fjvrbbj36VJq8GBLPe/xpivkFy+Ui6lfdv/I+JUFPam+fXmc84tPKivta11/JcuafnNsWB2HA/zK+eYYmKsNraVOrd6dDvi+bbj32Sp/ZM27Z+ej486LONY6d6La23buP7bq/5dxEtt2395RitZf35yqHE9DDWvitX+vHPs17XKb1//X37ahqq2lbb/gfXrP5i0ztdWN1/Gt/v+Ka21rdvrf0/yYSO9J1t3Y6xWmxmO2JO8t3r9yPJrm/nm/mn9T51cv/9rd/3vj4iPO6z/naPfv9B9/bdXWv+JTbX/5hMP3v3km7XK76z9X22kTmVrOun/Oj3ArZw7AAAAAAAA2G1yEXEoklwx9mXpXK5YXPx+x9E4kCtXqrXTlyuzVyei8VvZwSjkmjPdh1u+DzGcfR+2mR95Ij8aEUci4suB/Y18cbxSntjpygMAAAAAAAAAAAAAAAAAAMAucXDp9/+x4vf/qd8GdvrogG2XX3z+N9CHNnzkfy+e9ATsShvGP/DMEv/Qv8Q/9C/xD32pMcUn/qF/iX/oX+If+pf4BwAAAAAAAAAAAAAAAAAAAAAAAAAAgJ66eOFCutQXHt8cT/MT1+dmpyrXz0yUqlPF6dnx4nhl5lpxslKZLJeK45Xpjd6vXKlcGx6J2RtDtVK1NlSdm780XZm9Wrt0ZXpssnSp5DnjAAAAAAAAAAAAAAAAAAAAsFp1bn5qrFwuzfQgUSiXS7mI6GTniB4V+tQl/t7y+6Ttdivf2XnenkQSy2vyu+KsSvQ6sdM9EwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAs+zcAAP//MUwypA==")
connect$pppl2tp(r4, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, r4, {0x2, 0x4e23, @rand_addr=0x64010102}, 0x3, 0x0, 0x1}}, 0x26) (async)
connect$pppl2tp(r4, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, r4, {0x2, 0x4e23, @rand_addr=0x64010102}, 0x3, 0x0, 0x1}}, 0x26)
socket$netlink(0x10, 0x3, 0x8000000004)

program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-syz_mount_image$ext4-openat$tcp_mem-write$tcp_mem-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-socket$pppl2tp-socket$packet-socket$packet-setsockopt$packet_tx_ring-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-sendmmsg-ioctl$BTRFS_IOC_QGROUP_LIMIT-ioctl$BTRFS_IOC_QGROUP_LIMIT-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_LOOKUP_ELEM-syz_usb_connect$hid-syz_mount_image$ext4-connect$pppl2tp-connect$pppl2tp
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue")
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
write$tcp_mem(r2, 0x0, 0xfffffeff)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32)
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
socket$packet(0x11, 0x2, 0x300) (async)
r5 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r5, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) (async)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff)
sendmmsg(r5, &(0x7f0000000880)=[{{&(0x7f0000000180)=@hci={0x1f, 0xffffffffffffffff, 0x2}, 0x80, 0x0}}], 0x1, 0x45)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}})
bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="120000000a001700080000000200000000000000fd2232fdbec4f9088dfde2e8274444d7b426178cde3a981d5c0078e97367eb5484e7a23dc54df612ed2dce9abca9768676974b1e55ff3b3894d1df437715020e90f206dcc4be855105c9bf668efec2ef25381a55f29539442615eac4a856c07bd2a5d68edd3019747032767163fb6d6e5c1220b91bb2992c6de72293636f287f1469fb2e0f94bbcd418409c8c89f5ebbb67f3cfb005b1083683b998cd00a8fac5b49c74583", @ANYRES32, @ANYBLOB='\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) (async)
r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="120000000a001700080000000200000000000000fd2232fdbec4f9088dfde2e8274444d7b426178cde3a981d5c0078e97367eb5484e7a23dc54df612ed2dce9abca9768676974b1e55ff3b3894d1df437715020e90f206dcc4be855105c9bf668efec2ef25381a55f29539442615eac4a856c07bd2a5d68edd3019747032767163fb6d6e5c1220b91bb2992c6de72293636f287f1469fb2e0f94bbcd418409c8c89f5ebbb67f3cfb005b1083683b998cd00a8fac5b49c74583", @ANYRES32, @ANYBLOB='\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000002c0)={r6, &(0x7f0000000580), 0x0}, 0x20)
syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x8, 0x16c0, 0x5e1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x40, 0x40, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x1, 0x3, 0x41, {0x9, 0x21, 0xfff4, 0xd9, 0x1, {0x22, 0x998}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x5, 0x2, 0x7}}}}}]}}]}}, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x4, [{0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x444}}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})
syz_mount_image$ext4(&(0x7f0000000180)='ext2\x00', &(0x7f0000000200)='./file1\x00', 0x210000, &(0x7f0000000040)={[{@nobh}, {@debug}, {@barrier}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x2000}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x70}}, {@min_batch_time={'min_batch_time', 0x3d, 0x3d20}}, {@stripe={'stripe', 0x3d, 0x20}}, {@errors_remount}, {@max_batch_time={'max_batch_time', 0x3d, 0x3ff}}, {@inlinecrypt}, {@dioread_lock}]}, 0x3, 0x589, &(0x7f0000000d80)="$eJzs3c1rHOUfAPDvbHb7/vs1hVKsiBR6sFK7aRJfKnioR9FiQT3XkGxDyaZbspvSxILtwV68SBFELIh3vXvwULx49K8oaKFICQp6WZnNbLJpNslmszFp9/OBSZ5nZnafeeaZ78Mz++wyAfStE+mfXMTxiPgiiTjcsi0f2cYTi/stPL45ni5J1Osf/JFEkq1r7p9k/w9mmeci4ufPIk7nVpdbnZufGiuXSzNZfqg2fW2oOjd/5sr02GRpsnR1ZHT03GujI2++8XrP6vryxb++fv/+O+c+P7nw1Q8Pj9xN4nwcyra11mNT9q7I3WrNnKjXs3NSiPNPvGy4q8J2r2SnD4CuDGRxXoiI44XDhWbUA8++TyOiDvSpZJPxv1d/Ac+I5jigeW/f9X3wU+rR24s3QKvrn1/8bCT2Ne6NDiwkK+6M0vvdwR6Un5bx4+/37qZLbOVzCIBNunU7Is7m86v7vyTr/7p3toN9nixD/wf/nfvp+OeVduOf3NL4J9qMfw62id1ubBz/uYc9KGZN6fjvrbbj36VJq8GBLPe/xpivkFy+Ui6lfdv/I+JUFPam+fXmc84tPKivta11/JcuafnNsWB2HA/zK+eYYmKsNraVOrd6dDvi+bbj32Sp/ZM27Z+ej486LONY6d6La23buP7bq/5dxEtt2395RitZf35yqHE9DDWvitX+vHPs17XKb1//X37ahqq2lbb/gfXrP5i0ztdWN1/Gt/v+Ka21rdvrf0/yYSO9J1t3Y6xWmxmO2JO8t3r9yPJrm/nm/mn9T51cv/9rd/3vj4iPO6z/naPfv9B9/bdXWv+JTbX/5hMP3v3km7XK76z9X22kTmVrOun/Oj3ArZw7AAAAAAAA2G1yEXEoklwx9mXpXK5YXPx+x9E4kCtXqrXTlyuzVyei8VvZwSjkmjPdh1u+DzGcfR+2mR95Ij8aEUci4suB/Y18cbxSntjpygMAAAAAAAAAAAAAAAAAAMAucXDp9/+x4vf/qd8GdvrogG2XX3z+N9CHNnzkfy+e9ATsShvGP/DMEv/Qv8Q/9C/xD32pMcUn/qF/iX/oX+If+pf4BwAAAAAAAAAAAAAAAAAAAAAAAAAAgJ66eOFCutQXHt8cT/MT1+dmpyrXz0yUqlPF6dnx4nhl5lpxslKZLJeK45Xpjd6vXKlcGx6J2RtDtVK1NlSdm780XZm9Wrt0ZXpssnSp5DnjAAAAAAAAAAAAAAAAAAAAsFp1bn5qrFwuzfQgUSiXS7mI6GTniB4V+tQl/t7y+6Ttdivf2XnenkQSy2vyu+KsSvQ6sdM9EwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAs+zcAAP//MUwypA==")
connect$pppl2tp(r4, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, r4, {0x2, 0x4e23, @rand_addr=0x64010102}, 0x3, 0x0, 0x1}}, 0x26) (async)
connect$pppl2tp(r4, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, r4, {0x2, 0x4e23, @rand_addr=0x64010102}, 0x3, 0x0, 0x1}}, 0x26)

VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying
program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-syz_mount_image$ext4-openat$tcp_mem-write$tcp_mem-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-socket$pppl2tp-socket$packet-socket$packet-setsockopt$packet_tx_ring-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-sendmmsg-ioctl$BTRFS_IOC_QGROUP_LIMIT-ioctl$BTRFS_IOC_QGROUP_LIMIT-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_LOOKUP_ELEM-syz_usb_connect$hid-syz_mount_image$ext4-connect$pppl2tp
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue")
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
write$tcp_mem(r2, 0x0, 0xfffffeff)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32)
r4 = socket$pppl2tp(0x18, 0x1, 0x1)
socket$packet(0x11, 0x2, 0x300) (async)
r5 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r5, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) (async)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff)
sendmmsg(r5, &(0x7f0000000880)=[{{&(0x7f0000000180)=@hci={0x1f, 0xffffffffffffffff, 0x2}, 0x80, 0x0}}], 0x1, 0x45)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}})
bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="120000000a001700080000000200000000000000fd2232fdbec4f9088dfde2e8274444d7b426178cde3a981d5c0078e97367eb5484e7a23dc54df612ed2dce9abca9768676974b1e55ff3b3894d1df437715020e90f206dcc4be855105c9bf668efec2ef25381a55f29539442615eac4a856c07bd2a5d68edd3019747032767163fb6d6e5c1220b91bb2992c6de72293636f287f1469fb2e0f94bbcd418409c8c89f5ebbb67f3cfb005b1083683b998cd00a8fac5b49c74583", @ANYRES32, @ANYBLOB='\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) (async)
r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="120000000a001700080000000200000000000000fd2232fdbec4f9088dfde2e8274444d7b426178cde3a981d5c0078e97367eb5484e7a23dc54df612ed2dce9abca9768676974b1e55ff3b3894d1df437715020e90f206dcc4be855105c9bf668efec2ef25381a55f29539442615eac4a856c07bd2a5d68edd3019747032767163fb6d6e5c1220b91bb2992c6de72293636f287f1469fb2e0f94bbcd418409c8c89f5ebbb67f3cfb005b1083683b998cd00a8fac5b49c74583", @ANYRES32, @ANYBLOB='\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000002c0)={r6, &(0x7f0000000580), 0x0}, 0x20)
syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x8, 0x16c0, 0x5e1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x40, 0x40, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x1, 0x3, 0x41, {0x9, 0x21, 0xfff4, 0xd9, 0x1, {0x22, 0x998}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x5, 0x2, 0x7}}}}}]}}]}}, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x4, [{0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x444}}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})
syz_mount_image$ext4(&(0x7f0000000180)='ext2\x00', &(0x7f0000000200)='./file1\x00', 0x210000, &(0x7f0000000040)={[{@nobh}, {@debug}, {@barrier}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x2000}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x70}}, {@min_batch_time={'min_batch_time', 0x3d, 0x3d20}}, {@stripe={'stripe', 0x3d, 0x20}}, {@errors_remount}, {@max_batch_time={'max_batch_time', 0x3d, 0x3ff}}, {@inlinecrypt}, {@dioread_lock}]}, 0x3, 0x589, &(0x7f0000000d80)="$eJzs3c1rHOUfAPDvbHb7/vs1hVKsiBR6sFK7aRJfKnioR9FiQT3XkGxDyaZbspvSxILtwV68SBFELIh3vXvwULx49K8oaKFICQp6WZnNbLJpNslmszFp9/OBSZ5nZnafeeaZ78Mz++wyAfStE+mfXMTxiPgiiTjcsi0f2cYTi/stPL45ni5J1Osf/JFEkq1r7p9k/w9mmeci4ufPIk7nVpdbnZufGiuXSzNZfqg2fW2oOjd/5sr02GRpsnR1ZHT03GujI2++8XrP6vryxb++fv/+O+c+P7nw1Q8Pj9xN4nwcyra11mNT9q7I3WrNnKjXs3NSiPNPvGy4q8J2r2SnD4CuDGRxXoiI44XDhWbUA8++TyOiDvSpZJPxv1d/Ac+I5jigeW/f9X3wU+rR24s3QKvrn1/8bCT2Ne6NDiwkK+6M0vvdwR6Un5bx4+/37qZLbOVzCIBNunU7Is7m86v7vyTr/7p3toN9nixD/wf/nfvp+OeVduOf3NL4J9qMfw62id1ubBz/uYc9KGZN6fjvrbbj36VJq8GBLPe/xpivkFy+Ui6lfdv/I+JUFPam+fXmc84tPKivta11/JcuafnNsWB2HA/zK+eYYmKsNraVOrd6dDvi+bbj32Sp/ZM27Z+ej486LONY6d6La23buP7bq/5dxEtt2395RitZf35yqHE9DDWvitX+vHPs17XKb1//X37ahqq2lbb/gfXrP5i0ztdWN1/Gt/v+Ka21rdvrf0/yYSO9J1t3Y6xWmxmO2JO8t3r9yPJrm/nm/mn9T51cv/9rd/3vj4iPO6z/naPfv9B9/bdXWv+JTbX/5hMP3v3km7XK76z9X22kTmVrOun/Oj3ArZw7AAAAAAAA2G1yEXEoklwx9mXpXK5YXPx+x9E4kCtXqrXTlyuzVyei8VvZwSjkmjPdh1u+DzGcfR+2mR95Ij8aEUci4suB/Y18cbxSntjpygMAAAAAAAAAAAAAAAAAAMAucXDp9/+x4vf/qd8GdvrogG2XX3z+N9CHNnzkfy+e9ATsShvGP/DMEv/Qv8Q/9C/xD32pMcUn/qF/iX/oX+If+pf4BwAAAAAAAAAAAAAAAAAAAAAAAAAAgJ66eOFCutQXHt8cT/MT1+dmpyrXz0yUqlPF6dnx4nhl5lpxslKZLJeK45Xpjd6vXKlcGx6J2RtDtVK1NlSdm780XZm9Wrt0ZXpssnSp5DnjAAAAAAAAAAAAAAAAAAAAsFp1bn5qrFwuzfQgUSiXS7mI6GTniB4V+tQl/t7y+6Ttdivf2XnenkQSy2vyu+KsSvQ6sdM9EwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAs+zcAAP//MUwypA==")
connect$pppl2tp(r4, &(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, r4, {0x2, 0x4e23, @rand_addr=0x64010102}, 0x3, 0x0, 0x1}}, 0x26) (async)

program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-syz_mount_image$ext4-openat$tcp_mem-write$tcp_mem-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-socket$pppl2tp-socket$packet-socket$packet-setsockopt$packet_tx_ring-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-sendmmsg-ioctl$BTRFS_IOC_QGROUP_LIMIT-ioctl$BTRFS_IOC_QGROUP_LIMIT-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_LOOKUP_ELEM-syz_usb_connect$hid-syz_mount_image$ext4
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue")
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
write$tcp_mem(r2, 0x0, 0xfffffeff)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32)
socket$pppl2tp(0x18, 0x1, 0x1)
socket$packet(0x11, 0x2, 0x300) (async)
r4 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r4, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) (async)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff)
sendmmsg(r4, &(0x7f0000000880)=[{{&(0x7f0000000180)=@hci={0x1f, 0xffffffffffffffff, 0x2}, 0x80, 0x0}}], 0x1, 0x45)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}})
bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="120000000a001700080000000200000000000000fd2232fdbec4f9088dfde2e8274444d7b426178cde3a981d5c0078e97367eb5484e7a23dc54df612ed2dce9abca9768676974b1e55ff3b3894d1df437715020e90f206dcc4be855105c9bf668efec2ef25381a55f29539442615eac4a856c07bd2a5d68edd3019747032767163fb6d6e5c1220b91bb2992c6de72293636f287f1469fb2e0f94bbcd418409c8c89f5ebbb67f3cfb005b1083683b998cd00a8fac5b49c74583", @ANYRES32, @ANYBLOB='\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) (async)
r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="120000000a001700080000000200000000000000fd2232fdbec4f9088dfde2e8274444d7b426178cde3a981d5c0078e97367eb5484e7a23dc54df612ed2dce9abca9768676974b1e55ff3b3894d1df437715020e90f206dcc4be855105c9bf668efec2ef25381a55f29539442615eac4a856c07bd2a5d68edd3019747032767163fb6d6e5c1220b91bb2992c6de72293636f287f1469fb2e0f94bbcd418409c8c89f5ebbb67f3cfb005b1083683b998cd00a8fac5b49c74583", @ANYRES32, @ANYBLOB='\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000002c0)={r5, &(0x7f0000000580), 0x0}, 0x20)
syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x8, 0x16c0, 0x5e1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x40, 0x40, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x1, 0x3, 0x41, {0x9, 0x21, 0xfff4, 0xd9, 0x1, {0x22, 0x998}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x5, 0x2, 0x7}}}}}]}}]}}, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x4, [{0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x444}}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})
syz_mount_image$ext4(&(0x7f0000000180)='ext2\x00', &(0x7f0000000200)='./file1\x00', 0x210000, &(0x7f0000000040)={[{@nobh}, {@debug}, {@barrier}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x2000}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x70}}, {@min_batch_time={'min_batch_time', 0x3d, 0x3d20}}, {@stripe={'stripe', 0x3d, 0x20}}, {@errors_remount}, {@max_batch_time={'max_batch_time', 0x3d, 0x3ff}}, {@inlinecrypt}, {@dioread_lock}]}, 0x3, 0x589, &(0x7f0000000d80)="$eJzs3c1rHOUfAPDvbHb7/vs1hVKsiBR6sFK7aRJfKnioR9FiQT3XkGxDyaZbspvSxILtwV68SBFELIh3vXvwULx49K8oaKFICQp6WZnNbLJpNslmszFp9/OBSZ5nZnafeeaZ78Mz++wyAfStE+mfXMTxiPgiiTjcsi0f2cYTi/stPL45ni5J1Osf/JFEkq1r7p9k/w9mmeci4ufPIk7nVpdbnZufGiuXSzNZfqg2fW2oOjd/5sr02GRpsnR1ZHT03GujI2++8XrP6vryxb++fv/+O+c+P7nw1Q8Pj9xN4nwcyra11mNT9q7I3WrNnKjXs3NSiPNPvGy4q8J2r2SnD4CuDGRxXoiI44XDhWbUA8++TyOiDvSpZJPxv1d/Ac+I5jigeW/f9X3wU+rR24s3QKvrn1/8bCT2Ne6NDiwkK+6M0vvdwR6Un5bx4+/37qZLbOVzCIBNunU7Is7m86v7vyTr/7p3toN9nixD/wf/nfvp+OeVduOf3NL4J9qMfw62id1ubBz/uYc9KGZN6fjvrbbj36VJq8GBLPe/xpivkFy+Ui6lfdv/I+JUFPam+fXmc84tPKivta11/JcuafnNsWB2HA/zK+eYYmKsNraVOrd6dDvi+bbj32Sp/ZM27Z+ej486LONY6d6La23buP7bq/5dxEtt2395RitZf35yqHE9DDWvitX+vHPs17XKb1//X37ahqq2lbb/gfXrP5i0ztdWN1/Gt/v+Ka21rdvrf0/yYSO9J1t3Y6xWmxmO2JO8t3r9yPJrm/nm/mn9T51cv/9rd/3vj4iPO6z/naPfv9B9/bdXWv+JTbX/5hMP3v3km7XK76z9X22kTmVrOun/Oj3ArZw7AAAAAAAA2G1yEXEoklwx9mXpXK5YXPx+x9E4kCtXqrXTlyuzVyei8VvZwSjkmjPdh1u+DzGcfR+2mR95Ij8aEUci4suB/Y18cbxSntjpygMAAAAAAAAAAAAAAAAAAMAucXDp9/+x4vf/qd8GdvrogG2XX3z+N9CHNnzkfy+e9ATsShvGP/DMEv/Qv8Q/9C/xD32pMcUn/qF/iX/oX+If+pf4BwAAAAAAAAAAAAAAAAAAAAAAAAAAgJ66eOFCutQXHt8cT/MT1+dmpyrXz0yUqlPF6dnx4nhl5lpxslKZLJeK45Xpjd6vXKlcGx6J2RtDtVK1NlSdm780XZm9Wrt0ZXpssnSp5DnjAAAAAAAAAAAAAAAAAAAAsFp1bn5qrFwuzfQgUSiXS7mI6GTniB4V+tQl/t7y+6Ttdivf2XnenkQSy2vyu+KsSvQ6sdM9EwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAs+zcAAP//MUwypA==")

program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-syz_mount_image$ext4-openat$tcp_mem-write$tcp_mem-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-socket$pppl2tp-socket$packet-socket$packet-setsockopt$packet_tx_ring-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-sendmmsg-ioctl$BTRFS_IOC_QGROUP_LIMIT-ioctl$BTRFS_IOC_QGROUP_LIMIT-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_LOOKUP_ELEM-syz_usb_connect$hid
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue")
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
write$tcp_mem(r2, 0x0, 0xfffffeff)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32)
socket$pppl2tp(0x18, 0x1, 0x1)
socket$packet(0x11, 0x2, 0x300) (async)
r4 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r4, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) (async)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff)
sendmmsg(r4, &(0x7f0000000880)=[{{&(0x7f0000000180)=@hci={0x1f, 0xffffffffffffffff, 0x2}, 0x80, 0x0}}], 0x1, 0x45)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}})
bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="120000000a001700080000000200000000000000fd2232fdbec4f9088dfde2e8274444d7b426178cde3a981d5c0078e97367eb5484e7a23dc54df612ed2dce9abca9768676974b1e55ff3b3894d1df437715020e90f206dcc4be855105c9bf668efec2ef25381a55f29539442615eac4a856c07bd2a5d68edd3019747032767163fb6d6e5c1220b91bb2992c6de72293636f287f1469fb2e0f94bbcd418409c8c89f5ebbb67f3cfb005b1083683b998cd00a8fac5b49c74583", @ANYRES32, @ANYBLOB='\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) (async)
r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="120000000a001700080000000200000000000000fd2232fdbec4f9088dfde2e8274444d7b426178cde3a981d5c0078e97367eb5484e7a23dc54df612ed2dce9abca9768676974b1e55ff3b3894d1df437715020e90f206dcc4be855105c9bf668efec2ef25381a55f29539442615eac4a856c07bd2a5d68edd3019747032767163fb6d6e5c1220b91bb2992c6de72293636f287f1469fb2e0f94bbcd418409c8c89f5ebbb67f3cfb005b1083683b998cd00a8fac5b49c74583", @ANYRES32, @ANYBLOB='\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000002c0)={r5, &(0x7f0000000580), 0x0}, 0x20)
syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x8, 0x16c0, 0x5e1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x40, 0x40, 0x0, "", [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x1, 0x3, 0x41, {0x9, 0x21, 0xfff4, 0xd9, 0x1, {0x22, 0x998}}, {{{0x9, 0x5, 0x81, 0x3, 0x8, 0x5, 0x2, 0x7}}}}}]}}]}}, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x4, [{0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x444}}, {0x0, 0x0}, {0x0, 0x0}, {0x0, 0x0}]})

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-syz_mount_image$ext4-openat$tcp_mem-write$tcp_mem-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-socket$pppl2tp-socket$packet-socket$packet-setsockopt$packet_tx_ring-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-sendmmsg-ioctl$BTRFS_IOC_QGROUP_LIMIT-ioctl$BTRFS_IOC_QGROUP_LIMIT-bpf$MAP_CREATE-bpf$MAP_CREATE-bpf$MAP_LOOKUP_ELEM
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue")
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
write$tcp_mem(r2, 0x0, 0xfffffeff)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32)
socket$pppl2tp(0x18, 0x1, 0x1)
socket$packet(0x11, 0x2, 0x300) (async)
r4 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r4, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) (async)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff)
sendmmsg(r4, &(0x7f0000000880)=[{{&(0x7f0000000180)=@hci={0x1f, 0xffffffffffffffff, 0x2}, 0x80, 0x0}}], 0x1, 0x45)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}})
bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="120000000a001700080000000200000000000000fd2232fdbec4f9088dfde2e8274444d7b426178cde3a981d5c0078e97367eb5484e7a23dc54df612ed2dce9abca9768676974b1e55ff3b3894d1df437715020e90f206dcc4be855105c9bf668efec2ef25381a55f29539442615eac4a856c07bd2a5d68edd3019747032767163fb6d6e5c1220b91bb2992c6de72293636f287f1469fb2e0f94bbcd418409c8c89f5ebbb67f3cfb005b1083683b998cd00a8fac5b49c74583", @ANYRES32, @ANYBLOB='\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) (async)
r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="120000000a001700080000000200000000000000fd2232fdbec4f9088dfde2e8274444d7b426178cde3a981d5c0078e97367eb5484e7a23dc54df612ed2dce9abca9768676974b1e55ff3b3894d1df437715020e90f206dcc4be855105c9bf668efec2ef25381a55f29539442615eac4a856c07bd2a5d68edd3019747032767163fb6d6e5c1220b91bb2992c6de72293636f287f1469fb2e0f94bbcd418409c8c89f5ebbb67f3cfb005b1083683b998cd00a8fac5b49c74583", @ANYRES32, @ANYBLOB='\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000002c0)={r5, &(0x7f0000000580), 0x0}, 0x20)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-syz_mount_image$ext4-openat$tcp_mem-write$tcp_mem-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-socket$pppl2tp-socket$packet-socket$packet-setsockopt$packet_tx_ring-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-sendmmsg-ioctl$BTRFS_IOC_QGROUP_LIMIT-ioctl$BTRFS_IOC_QGROUP_LIMIT-bpf$MAP_CREATE-bpf$MAP_CREATE
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue")
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
write$tcp_mem(r2, 0x0, 0xfffffeff)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32)
socket$pppl2tp(0x18, 0x1, 0x1)
socket$packet(0x11, 0x2, 0x300) (async)
r4 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r4, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) (async)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff)
sendmmsg(r4, &(0x7f0000000880)=[{{&(0x7f0000000180)=@hci={0x1f, 0xffffffffffffffff, 0x2}, 0x80, 0x0}}], 0x1, 0x45)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}})
bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="120000000a001700080000000200000000000000fd2232fdbec4f9088dfde2e8274444d7b426178cde3a981d5c0078e97367eb5484e7a23dc54df612ed2dce9abca9768676974b1e55ff3b3894d1df437715020e90f206dcc4be855105c9bf668efec2ef25381a55f29539442615eac4a856c07bd2a5d68edd3019747032767163fb6d6e5c1220b91bb2992c6de72293636f287f1469fb2e0f94bbcd418409c8c89f5ebbb67f3cfb005b1083683b998cd00a8fac5b49c74583", @ANYRES32, @ANYBLOB='\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) (async)
bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="120000000a001700080000000200000000000000fd2232fdbec4f9088dfde2e8274444d7b426178cde3a981d5c0078e97367eb5484e7a23dc54df612ed2dce9abca9768676974b1e55ff3b3894d1df437715020e90f206dcc4be855105c9bf668efec2ef25381a55f29539442615eac4a856c07bd2a5d68edd3019747032767163fb6d6e5c1220b91bb2992c6de72293636f287f1469fb2e0f94bbcd418409c8c89f5ebbb67f3cfb005b1083683b998cd00a8fac5b49c74583", @ANYRES32, @ANYBLOB='\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-syz_mount_image$ext4-openat$tcp_mem-write$tcp_mem-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-socket$pppl2tp-socket$packet-socket$packet-setsockopt$packet_tx_ring-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-sendmmsg-ioctl$BTRFS_IOC_QGROUP_LIMIT-ioctl$BTRFS_IOC_QGROUP_LIMIT-bpf$MAP_CREATE
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue")
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
write$tcp_mem(r2, 0x0, 0xfffffeff)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32)
socket$pppl2tp(0x18, 0x1, 0x1)
socket$packet(0x11, 0x2, 0x300) (async)
r4 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r4, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) (async)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff)
sendmmsg(r4, &(0x7f0000000880)=[{{&(0x7f0000000180)=@hci={0x1f, 0xffffffffffffffff, 0x2}, 0x80, 0x0}}], 0x1, 0x45)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}})
bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="120000000a001700080000000200000000000000fd2232fdbec4f9088dfde2e8274444d7b426178cde3a981d5c0078e97367eb5484e7a23dc54df612ed2dce9abca9768676974b1e55ff3b3894d1df437715020e90f206dcc4be855105c9bf668efec2ef25381a55f29539442615eac4a856c07bd2a5d68edd3019747032767163fb6d6e5c1220b91bb2992c6de72293636f287f1469fb2e0f94bbcd418409c8c89f5ebbb67f3cfb005b1083683b998cd00a8fac5b49c74583", @ANYRES32, @ANYBLOB='\x00@\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) (async)

program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-syz_mount_image$ext4-openat$tcp_mem-write$tcp_mem-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-socket$pppl2tp-socket$packet-socket$packet-setsockopt$packet_tx_ring-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-sendmmsg-ioctl$BTRFS_IOC_QGROUP_LIMIT-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue")
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
write$tcp_mem(r2, 0x0, 0xfffffeff)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32)
socket$pppl2tp(0x18, 0x1, 0x1)
socket$packet(0x11, 0x2, 0x300) (async)
r4 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r4, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) (async)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff)
sendmmsg(r4, &(0x7f0000000880)=[{{&(0x7f0000000180)=@hci={0x1f, 0xffffffffffffffff, 0x2}, 0x80, 0x0}}], 0x1, 0x45)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}})

program crashed: KASAN: use-after-free Read in l2tp_tunnel_del_work
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-syz_mount_image$ext4-openat$tcp_mem-write$tcp_mem-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-socket$pppl2tp-socket$packet-socket$packet-setsockopt$packet_tx_ring-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-sendmmsg-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue")
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
write$tcp_mem(r2, 0x0, 0xfffffeff)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32)
socket$pppl2tp(0x18, 0x1, 0x1)
socket$packet(0x11, 0x2, 0x300) (async)
r4 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r4, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) (async)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff)
sendmmsg(r4, &(0x7f0000000880)=[{{&(0x7f0000000180)=@hci={0x1f, 0xffffffffffffffff, 0x2}, 0x80, 0x0}}], 0x1, 0x45)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-syz_mount_image$ext4-openat$tcp_mem-write$tcp_mem-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-socket$pppl2tp-socket$packet-socket$packet-setsockopt$packet_tx_ring-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-sendmmsg
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue")
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
write$tcp_mem(r2, 0x0, 0xfffffeff)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32)
socket$pppl2tp(0x18, 0x1, 0x1)
socket$packet(0x11, 0x2, 0x300) (async)
r4 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r4, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) (async)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff)
sendmmsg(r4, &(0x7f0000000880)=[{{&(0x7f0000000180)=@hci={0x1f, 0xffffffffffffffff, 0x2}, 0x80, 0x0}}], 0x1, 0x45)

program did not crash
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-syz_mount_image$ext4-openat$tcp_mem-write$tcp_mem-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-socket$pppl2tp-socket$packet-socket$packet-setsockopt$packet_tx_ring-syz_genetlink_get_family_id$ethtool-syz_genetlink_get_family_id$ethtool-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue")
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
write$tcp_mem(r2, 0x0, 0xfffffeff)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32)
socket$pppl2tp(0x18, 0x1, 0x1)
socket$packet(0x11, 0x2, 0x300) (async)
r4 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r4, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) (async)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-syz_mount_image$ext4-openat$tcp_mem-write$tcp_mem-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-socket$pppl2tp-socket$packet-socket$packet-setsockopt$packet_tx_ring-syz_genetlink_get_family_id$ethtool-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue")
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
write$tcp_mem(r2, 0x0, 0xfffffeff)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32)
socket$pppl2tp(0x18, 0x1, 0x1)
socket$packet(0x11, 0x2, 0x300) (async)
r4 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r4, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), 0xffffffffffffffff) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-syz_mount_image$ext4-openat$tcp_mem-write$tcp_mem-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-socket$pppl2tp-socket$packet-socket$packet-setsockopt$packet_tx_ring-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue")
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
write$tcp_mem(r2, 0x0, 0xfffffeff)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32)
socket$pppl2tp(0x18, 0x1, 0x1)
socket$packet(0x11, 0x2, 0x300) (async)
r4 = socket$packet(0x11, 0x2, 0x300)
setsockopt$packet_tx_ring(r4, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe, 0x0, 0x3}, 0x1c)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-syz_mount_image$ext4-openat$tcp_mem-write$tcp_mem-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-socket$pppl2tp-socket$packet-socket$packet-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue")
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
write$tcp_mem(r2, 0x0, 0xfffffeff)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32)
socket$pppl2tp(0x18, 0x1, 0x1)
socket$packet(0x11, 0x2, 0x300) (async)
socket$packet(0x11, 0x2, 0x300)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-syz_mount_image$ext4-openat$tcp_mem-write$tcp_mem-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-socket$pppl2tp-socket$packet-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue")
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
write$tcp_mem(r2, 0x0, 0xfffffeff)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32)
socket$pppl2tp(0x18, 0x1, 0x1)
socket$packet(0x11, 0x2, 0x300) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-syz_mount_image$ext4-openat$tcp_mem-write$tcp_mem-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-socket$pppl2tp-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue")
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
write$tcp_mem(r2, 0x0, 0xfffffeff)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32)
socket$pppl2tp(0x18, 0x1, 0x1)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-syz_mount_image$ext4-openat$tcp_mem-write$tcp_mem-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue")
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
write$tcp_mem(r2, 0x0, 0xfffffeff)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-syz_mount_image$ext4-openat$tcp_mem-write$tcp_mem-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue")
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
write$tcp_mem(r2, 0x0, 0xfffffeff)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-syz_mount_image$ext4-openat$tcp_mem-write$tcp_mem-socket$inet6_udp-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue")
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
write$tcp_mem(r2, 0x0, 0xfffffeff)
socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)

program did not crash
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-syz_mount_image$ext4-openat$tcp_mem-write$tcp_mem-connect$pppl2tp-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue")
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
write$tcp_mem(r2, 0x0, 0xfffffeff)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)

program did not crash
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-syz_mount_image$ext4-openat$tcp_mem-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue")
openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-syz_mount_image$ext4-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue")
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-syz_mount_image$ext4-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000380)='./bus\x00', 0xe, &(0x7f0000000300)={[{@errors_remount}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x8000000}}, {@noacl}], [{@context={'context', 0x3d, 'staff_u'}}]}, 0x5, 0x46e, &(0x7f0000000c80)="$eJzs27tvHMUfAPDvrl/xL/lhE8IjD8AQEBYPO054pKCACCSKICFBQWvZThTixCg2EokiSBAKFaKhR5T8AxRU0CBEhUQLPYoUoTRJqA7t3a59b+PL+S7JfT7S+mZ2Zz3zvd25m925DWBgTWV/kohdEfFHRExUsrUFpiovN69fXLh1/eJCEqXSu38n5XI3rl9cKIoW++3MM9NpRPp5Evub1Lt6/sLp+eXlpXN5fnbtzIezq+cvvHDqzPzJpZNLZw8fPfrikblXXj78UlfizNp0Y98nKwf2vpUMv338y2xdWsRfF0eXTLXb+HSp1OXq+uv/VelkuI8NYUuGIiI7XCPl/j8RQ7Fx8Cbizc/62jhgW5VKpdLO1psvlYB7WBK1eV0eBkXxRZ9d/xZL/SDgte0bfvTdtdcrF0BZ3DfzpbJlONIYL6dG6q5vu2kqIt6/9M832RLbcx8CAKDGj9n45/lm4780Hqoqd18+NzQZEfdHxO6IeCAi9kTEgxHlsg9HxCN5+crIafORY/0kSeP4J716WwFuIhv/vZrPbdWO/9KiyORQOTdWHgNOxkhy4tTy0qH8PZmOkbEsP9emjp/e+P2rVtuqx3/ZktVfjAXzdlwdHqvdZ3F+bf52Yq527XLEvuFm8SfrMwFJROyNiH0d1nHq2e8OtNq2efxtdGGeqfRtxDOV438p6uIvJO3nJ2d3xPLSodnirGj0629X3mlV/23F3wXZ8f9f0/N/Pf7JpHq+dnXrdVz584uW1zSdnv+jyXvl9Gi+7uP5tbVzcxGjyfFKo6vXH97Yt8gX5bP4pw827/+7Y+Od2B8R2Un8aEQ8FhGP521/IiKejIiDbeL/5dhTH3Qe//bK4l/c0vHfSIxG/ZrmiaHTP/9QU+lkQ/y32hz/9dR0/tr4+TfUENd/aVdnZzMAAADcfbKr612RpDPr6TSdman8Xn5PRLq8srr23ImVj84uVp4RmIxIiztdE1X3Q+fyy/pK/nJEVH5aUGw/kt83/npovJyfWVhZXux38DDgdrbo/5m/Gm+rAfcaz2vB4NL/YXBt1v8/7VE7gN7r/Pv/2HhXGwL0XJP+r1/DQBhr+v1vzA+Doa7/m/aDAVLX/3f0qx1A73V+/2+0q+0Aes/8Pwyk1fHY/CH5toniP3W4+z2biJE7ohnbloj0jmhGbxLD30dsca+Ru7xf9O8zCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoJv+DQAA//8+WNue") (async)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-setuid-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
setuid(0xee01)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-setuid-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
setuid(0xee01) (async)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-setgroups-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
setgroups(0x1, &(0x7f0000000080)=[0xee00])
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-fstat-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
fstat(r1, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-fstat-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = open_tree(0xffffffffffffff9c, 0x0, 0x0)
fstat(r1, 0x0) (async)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-open_tree-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
open_tree(0xffffffffffffff9c, 0x0, 0x0)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-prctl$PR_SET_SECUREBITS-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
prctl$PR_SET_SECUREBITS(0x1c, 0x1d)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-setresgid-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
setresgid(0x0, 0xee01, 0x0)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)

program crashed: KASAN: use-after-free Write in pppol2tp_release
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32) (async)
ioctl$BTRFS_IOC_QGROUP_LIMIT(0xffffffffffffffff, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}}) (async)

program did not crash
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}})

program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, 0x0, 0x0)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, &(0x7f0000000140)={0x7, {0x3e, 0x10, 0x4, 0x80, 0x101}})

program did not crash
testing program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, 0x0)

program crashed: KASAN: use-after-free Write in pppol2tp_release
extracting C reproducer
testing compiled C program (duration=31.481648379s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_QGROUP_LIMIT
program crashed: KASAN: use-after-free Write in pppol2tp_release
simplifying C reproducer
testing compiled C program (duration=31.481648379s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_QGROUP_LIMIT
program crashed: KASAN: use-after-free Write in pppol2tp_release
testing compiled C program (duration=31.481648379s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_QGROUP_LIMIT
program crashed: KASAN: use-after-free Write in pppol2tp_release
testing compiled C program (duration=31.481648379s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_QGROUP_LIMIT
program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing compiled C program (duration=31.481648379s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_QGROUP_LIMIT
program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing compiled C program (duration=31.481648379s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_QGROUP_LIMIT
program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing compiled C program (duration=31.481648379s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_QGROUP_LIMIT
program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session
testing program (duration=31.481648379s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, 0x0)

program crashed: KASAN: use-after-free Write in pppol2tp_release
validation run: crashed=true
testing program (duration=31.481648379s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, 0x0)

program crashed: KASAN: use-after-free Write in pppol2tp_release
validation run: crashed=true
testing program (duration=31.481648379s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-ioctl$BTRFS_IOC_QGROUP_LIMIT
detailed listing:
executing program 0:
r0 = socket$pppl2tp(0x18, 0x1, 0x1)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x208, 0x0, 0x0, 0x0, {0xa, 0x4e22, 0x0, @rand_addr=' \x01\x00', 0x2000000}}}, 0x32)
ioctl$BTRFS_IOC_QGROUP_LIMIT(r0, 0x8030942b, 0x0)

program crashed: KASAN: use-after-free Write in pppol2tp_release
validation run: crashed=true
reproducing took 39m42.446211685s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
BUG: KASAN: use-after-free in atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline]
BUG: KASAN: use-after-free in atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline]
BUG: KASAN: use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:173 [inline]
BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298
Write of size 8 at addr ffff8881117fd550 by task syz.2.17/369

CPU: 1 PID: 369 Comm: syz.2.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026
Call Trace:
 __dump_stack+0x21/0x24 lib/dump_stack.c:77
 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:435 [inline]
 kasan_report+0x100/0x140 mm/kasan/report.c:452
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189
 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37
 instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
 atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline]
 atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline]
 __mutex_trylock_fast kernel/locking/mutex.c:173 [inline]
 mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298
 pppol2tp_release+0x178/0x2b0 net/l2tp/l2tp_ppp.c:442
 __sock_release net/socket.c:597 [inline]
 sock_close+0xb8/0x200 net/socket.c:1287
 __fput+0x2dc/0x730 fs/file_table.c:281
 ____fput+0x15/0x20 fs/file_table.c:314
 task_work_run+0x127/0x190 kernel/task_work.c:189
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172
 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199
 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274
 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f579d3a3e99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcc9079048 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007ffcc9079130 RCX: 00007f579d3a3e99
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00000000000092a0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b32c20000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f579d62bfac R14: 00007f579d62bfa8 R15: 00007f579d62bfa0

Allocated by task 369:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:430 [inline]
 ____kasan_kmalloc mm/kasan/common.c:509 [inline]
 __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:518
 kasan_kmalloc include/linux/kasan.h:254 [inline]
 __kmalloc+0x19f/0x330 mm/slub.c:4038
 kmalloc include/linux/slab.h:560 [inline]
 kzalloc include/linux/slab.h:667 [inline]
 l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616
 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772
 __sys_connect_file net/socket.c:1867 [inline]
 __sys_connect+0x3ce/0x450 net/socket.c:1884
 __do_sys_connect net/socket.c:1894 [inline]
 __se_sys_connect net/socket.c:1891 [inline]
 __x64_sys_connect+0x7a/0x90 net/socket.c:1891
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

Freed by task 369:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4a/0x70 mm/kasan/common.c:45
 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:362
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370
 kasan_slab_free include/linux/kasan.h:220 [inline]
 slab_free_hook mm/slub.c:1600 [inline]
 slab_free_freelist_hook+0xc5/0x190 mm/slub.c:1626
 slab_free mm/slub.c:3208 [inline]
 kfree+0xc0/0x270 mm/slub.c:4196
 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline]
 l2tp_session_put+0xb2/0x1a0 net/l2tp/l2tp_core.c:193
 l2tp_session_delete+0x3a9/0x4a0 net/l2tp/l2tp_core.c:1589
 pppol2tp_release+0x169/0x2b0 net/l2tp/l2tp_ppp.c:439
 __sock_release net/socket.c:597 [inline]
 sock_close+0xb8/0x200 net/socket.c:1287
 __fput+0x2dc/0x730 fs/file_table.c:281
 ____fput+0x15/0x20 fs/file_table.c:314
 task_work_run+0x127/0x190 kernel/task_work.c:189
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172
 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199
 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274
 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

The buggy address belongs to the object at ffff8881117fd400
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 336 bytes inside of
 512-byte region [ffff8881117fd400, ffff8881117fd600)
The buggy address belongs to the page:
page:ffffea000445ff00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1117fc
head:ffffea000445ff00 order:2 compound_mapcount:0 compound_pincount:0
flags: 0x4000000000010200(slab|head)
raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 369, ts 37562112927, free_ts 37560698478
 set_page_owner include/linux/page_owner.h:35 [inline]
 post_alloc_hook mm/page_alloc.c:2456 [inline]
 prep_new_page+0x176/0x190 mm/page_alloc.c:2462
 get_page_from_freelist+0x225f/0x23f0 mm/page_alloc.c:4254
 __alloc_pages_nodemask+0x29a/0x640 mm/page_alloc.c:5384
 alloc_slab_page mm/slub.c:-1 [inline]
 allocate_slab mm/slub.c:1813 [inline]
 new_slab+0x84/0x3f0 mm/slub.c:1874
 new_slab_objects mm/slub.c:2632 [inline]
 ___slab_alloc+0x2f8/0x4c0 mm/slub.c:2796
 __slab_alloc+0x63/0xa0 mm/slub.c:2836
 slab_alloc_node mm/slub.c:2918 [inline]
 slab_alloc mm/slub.c:2960 [inline]
 __kmalloc+0x1f9/0x330 mm/slub.c:4034
 kmalloc include/linux/slab.h:560 [inline]
 kzalloc include/linux/slab.h:667 [inline]
 l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616
 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772
 __sys_connect_file net/socket.c:1867 [inline]
 __sys_connect+0x3ce/0x450 net/socket.c:1884
 __do_sys_connect net/socket.c:1894 [inline]
 __se_sys_connect net/socket.c:1891 [inline]
 __x64_sys_connect+0x7a/0x90 net/socket.c:1891
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:28 [inline]
 free_pages_prepare mm/page_alloc.c:1349 [inline]
 __free_pages_ok+0x80b/0x830 mm/page_alloc.c:1629
 free_the_page mm/page_alloc.c:5445 [inline]
 __free_pages+0xd8/0x390 mm/page_alloc.c:5454
 __free_slab+0xcf/0x190 mm/slub.c:1899
 free_slab mm/slub.c:1914 [inline]
 discard_slab mm/slub.c:1920 [inline]
 unfreeze_partials+0x150/0x180 mm/slub.c:2415
 put_cpu_partial+0xc1/0x180 mm/slub.c:2451
 __slab_free+0x2c9/0x3a0 mm/slub.c:3100
 do_slab_free mm/slub.c:3196 [inline]
 ___cache_free+0x10e/0x130 mm/slub.c:3215
 qlink_free+0x50/0x90 mm/kasan/quarantine.c:157
 qlist_free_all+0x5f/0xb0 mm/kasan/quarantine.c:176
 kasan_quarantine_reduce+0x14a/0x160 mm/kasan/quarantine.c:283
 __kasan_slab_alloc+0x2f/0xe0 mm/kasan/common.c:440
 kasan_slab_alloc include/linux/kasan.h:244 [inline]
 slab_post_alloc_hook+0x5d/0x2f0 mm/slab.h:580
 slab_alloc_node mm/slub.c:2952 [inline]
 slab_alloc mm/slub.c:2960 [inline]
 kmem_cache_alloc+0x15a/0x2d0 mm/slub.c:2965
 getname_flags+0xba/0x510 fs/namei.c:141
 user_path_at_empty+0x2f/0x50 fs/namei.c:2748
 user_path_at include/linux/namei.h:60 [inline]
 do_utimes_path fs/utimes.c:93 [inline]
 do_utimes+0x12e/0x2a0 fs/utimes.c:143

Memory state around the buggy address:
 ffff8881117fd400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8881117fd480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8881117fd500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                 ^
 ffff8881117fd580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8881117fd600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
BUG: KASAN: use-after-free in atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline]
BUG: KASAN: use-after-free in atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline]
BUG: KASAN: use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:173 [inline]
BUG: KASAN: use-after-free in mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298
Write of size 8 at addr ffff8881117fd550 by task syz.2.17/369

CPU: 1 PID: 369 Comm: syz.2.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026
Call Trace:
 __dump_stack+0x21/0x24 lib/dump_stack.c:77
 dump_stack_lvl+0x1a7/0x208 lib/dump_stack.c:118
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:435 [inline]
 kasan_report+0x100/0x140 mm/kasan/report.c:452
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189
 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37
 instrument_atomic_read_write include/linux/instrumented.h:101 [inline]
 atomic64_try_cmpxchg_acquire include/asm-generic/atomic-instrumented.h:1515 [inline]
 atomic_long_try_cmpxchg_acquire include/asm-generic/atomic-long.h:443 [inline]
 __mutex_trylock_fast kernel/locking/mutex.c:173 [inline]
 mutex_lock+0x85/0xf0 kernel/locking/mutex.c:298
 pppol2tp_release+0x178/0x2b0 net/l2tp/l2tp_ppp.c:442
 __sock_release net/socket.c:597 [inline]
 sock_close+0xb8/0x200 net/socket.c:1287
 __fput+0x2dc/0x730 fs/file_table.c:281
 ____fput+0x15/0x20 fs/file_table.c:314
 task_work_run+0x127/0x190 kernel/task_work.c:189
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172
 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199
 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274
 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f579d3a3e99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcc9079048 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007ffcc9079130 RCX: 00007f579d3a3e99
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00000000000092a0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b32c20000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f579d62bfac R14: 00007f579d62bfa8 R15: 00007f579d62bfa0

Allocated by task 369:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:430 [inline]
 ____kasan_kmalloc mm/kasan/common.c:509 [inline]
 __kasan_kmalloc+0xd4/0x100 mm/kasan/common.c:518
 kasan_kmalloc include/linux/kasan.h:254 [inline]
 __kmalloc+0x19f/0x330 mm/slub.c:4038
 kmalloc include/linux/slab.h:560 [inline]
 kzalloc include/linux/slab.h:667 [inline]
 l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616
 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772
 __sys_connect_file net/socket.c:1867 [inline]
 __sys_connect+0x3ce/0x450 net/socket.c:1884
 __do_sys_connect net/socket.c:1894 [inline]
 __se_sys_connect net/socket.c:1891 [inline]
 __x64_sys_connect+0x7a/0x90 net/socket.c:1891
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

Freed by task 369:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4a/0x70 mm/kasan/common.c:45
 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:362
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370
 kasan_slab_free include/linux/kasan.h:220 [inline]
 slab_free_hook mm/slub.c:1600 [inline]
 slab_free_freelist_hook+0xc5/0x190 mm/slub.c:1626
 slab_free mm/slub.c:3208 [inline]
 kfree+0xc0/0x270 mm/slub.c:4196
 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline]
 l2tp_session_put+0xb2/0x1a0 net/l2tp/l2tp_core.c:193
 l2tp_session_delete+0x3a9/0x4a0 net/l2tp/l2tp_core.c:1589
 pppol2tp_release+0x169/0x2b0 net/l2tp/l2tp_ppp.c:439
 __sock_release net/socket.c:597 [inline]
 sock_close+0xb8/0x200 net/socket.c:1287
 __fput+0x2dc/0x730 fs/file_table.c:281
 ____fput+0x15/0x20 fs/file_table.c:314
 task_work_run+0x127/0x190 kernel/task_work.c:189
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop+0xcb/0xe0 kernel/entry/common.c:172
 exit_to_user_mode_prepare+0x76/0xa0 kernel/entry/common.c:199
 syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:274
 do_syscall_64+0x3d/0x40 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x61/0xcb

The buggy address belongs to the object at ffff8881117fd400
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 336 bytes inside of
 512-byte region [ffff8881117fd400, ffff8881117fd600)
The buggy address belongs to the page:
page:ffffea000445ff00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1117fc
head:ffffea000445ff00 order:2 compound_mapcount:0 compound_pincount:0
flags: 0x4000000000010200(slab|head)
raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043080
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 369, ts 37562112927, free_ts 37560698478
 set_page_owner include/linux/page_owner.h:35 [inline]
 post_alloc_hook mm/page_alloc.c:2456 [inline]
 prep_new_page+0x176/0x190 mm/page_alloc.c:2462
 get_page_from_freelist+0x225f/0x23f0 mm/page_alloc.c:4254
 __alloc_pages_nodemask+0x29a/0x640 mm/page_alloc.c:5384
 alloc_slab_page mm/slub.c:-1 [inline]
 allocate_slab mm/slub.c:1813 [inline]
 new_slab+0x84/0x3f0 mm/slub.c:1874
 new_slab_objects mm/slub.c:2632 [inline]
 ___slab_alloc+0x2f8/0x4c0 mm/slub.c:2796
 __slab_alloc+0x63/0xa0 mm/slub.c:2836
 slab_alloc_node mm/slub.c:2918 [inline]
 slab_alloc mm/slub.c:2960 [inline]
 __kmalloc+0x1f9/0x330 mm/slub.c:4034
 kmalloc include/linux/slab.h:560 [inline]
 kzalloc include/linux/slab.h:667 [inline]
 l2tp_session_create+0x39/0xb60 net/l2tp/l2tp_core.c:1616
 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:772
 __sys_connect_file net/socket.c:1867 [inline]
 __sys_connect+0x3ce/0x450 net/socket.c:1884
 __do_sys_connect net/socket.c:1894 [inline]
 __se_sys_connect net/socket.c:1891 [inline]
 __x64_sys_connect+0x7a/0x90 net/socket.c:1891
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:28 [inline]
 free_pages_prepare mm/page_alloc.c:1349 [inline]
 __free_pages_ok+0x80b/0x830 mm/page_alloc.c:1629
 free_the_page mm/page_alloc.c:5445 [inline]
 __free_pages+0xd8/0x390 mm/page_alloc.c:5454
 __free_slab+0xcf/0x190 mm/slub.c:1899
 free_slab mm/slub.c:1914 [inline]
 discard_slab mm/slub.c:1920 [inline]
 unfreeze_partials+0x150/0x180 mm/slub.c:2415
 put_cpu_partial+0xc1/0x180 mm/slub.c:2451
 __slab_free+0x2c9/0x3a0 mm/slub.c:3100
 do_slab_free mm/slub.c:3196 [inline]
 ___cache_free+0x10e/0x130 mm/slub.c:3215
 qlink_free+0x50/0x90 mm/kasan/quarantine.c:157
 qlist_free_all+0x5f/0xb0 mm/kasan/quarantine.c:176
 kasan_quarantine_reduce+0x14a/0x160 mm/kasan/quarantine.c:283
 __kasan_slab_alloc+0x2f/0xe0 mm/kasan/common.c:440
 kasan_slab_alloc include/linux/kasan.h:244 [inline]
 slab_post_alloc_hook+0x5d/0x2f0 mm/slab.h:580
 slab_alloc_node mm/slub.c:2952 [inline]
 slab_alloc mm/slub.c:2960 [inline]
 kmem_cache_alloc+0x15a/0x2d0 mm/slub.c:2965
 getname_flags+0xba/0x510 fs/namei.c:141
 user_path_at_empty+0x2f/0x50 fs/namei.c:2748
 user_path_at include/linux/namei.h:60 [inline]
 do_utimes_path fs/utimes.c:93 [inline]
 do_utimes+0x12e/0x2a0 fs/utimes.c:143

Memory state around the buggy address:
 ffff8881117fd400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8881117fd480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8881117fd500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                 ^
 ffff8881117fd580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8881117fd600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================