Extracting prog: 25.73312026s Minimizing prog: 20m10.443915552s Simplifying prog options: 0s Extracting C: 45.893022886s Simplifying C: 2m41.788997556s extracting reproducer from 69 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-setsockopt$netlink_NETLINK_NO_ENOBUFS-syz_emit_ethernet-sendmsg$nl_route-ioctl$TUNSETIFF-syz_mount_image$ext4-sendmsg$nl_route-openat-mprotect-ioctl$EXT4_IOC_MOVE_EXT-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$sock_SIOCGIFINDEX-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$inet-socket$pppl2tp-connect$pppl2tp-syz_usb_connect$uac1 detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000080)=0x7f, 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000140)=ANY=[@ANYBLOB="cebbbbbbbbbb0000fc00000008004500001c0000000000029078ac1e0001e0000001177c9078ac141430"], 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000001a0001002dbd7000010000000a808000", @ANYRES32=0x0, @ANYBLOB="00000000080002000600000f14005729f98c33cbe1616399b444985bea7f8d643eec86b4d39a8af6203f"], 0x38}, 0x1, 0x0, 0x0, 0x2404c051}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000240)='./file1\x00', 0x0, &(0x7f0000000280), 0x1, 0x4bc, &(0x7f00000002c0)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") sendmsg$nl_route(r0, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)=@ipv4_newrule={0x30, 0x20, 0x100, 0x70bd29, 0x25dfdbfd, {0x2, 0x80, 0x10, 0x1, 0x1, 0x0, 0x0, 0x4, 0x10}, [@FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x2}, @FRA_SRC={0x8, 0x2, @rand_addr=0x64010101}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000004}, 0x44000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./file1\x00', 0x2002, 0xa) mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x9) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f00000007c0)={0xc, 0xffffffffffffffff, 0x9, 0x1, 0x400, 0xfffffffffdffffff}) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000000c00)={'wg1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000c40)={'macsec0\x00', 0x0}) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000c80)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000d00)={&(0x7f0000000d40)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r8, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4c840) sendmsg$nl_route_sched(r7, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000dc0)={&(0x7f0000000e00)=@newtfilter={0x50, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0xb, 0xa}, {0x0, 0xfff3}, {0xb, 0xd}}, [@filter_kind_options=@f_u32={{0x8}, {0x24, 0x2, [@TCA_U32_CLASSID={0x8, 0x1, {0x10, 0xb}}, @TCA_U32_SEL={0x14, 0x5, {0x10, 0x4, 0x0, 0x9, 0x3, 0xfffa, 0x6, 0x7}}, @TCA_U32_POLICE={0x4}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000e80)={&(0x7f0000000ec0), 0xc, &(0x7f0000000f00)={&(0x7f0000000f40)=@delqdisc={0x24, 0x25, 0x10, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0xe}, {0xfff3, 0x1}, {0xe, 0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x24054040}, 0x10) sendmsg$inet(r2, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f00000009c0)='r', 0x1}, {&(0x7f0000000a00)="9d6165a2dff95deb78769f3a6eba32fbb69e561b3302a18f546940921404c6e81c37cca15627e0688fd8986b905486f1122a6e9104c19e5fb3d06396942ed4786375ccf59baf73168402603ff4cba590c035f42f42f7ee90af78acf08f168c7df629a19059b343fc165c4cbc18e2570ae619917a578c8596d723d25e33eeff4870e3a3118d8dc97905da7d7e96f1d6e32cca61e043", 0x95}, {&(0x7f0000000ac0)="80151cf2e7d19f86e18441b54677a3d989dbbd20927385255d644b324736e5a7b9a796d0296e3dddd1a4e539f046a63c528f", 0x32}, {&(0x7f0000000b00)="488121e3b84672bf4ad497c77411ef5b5f14443b97543cb085c6a9ce73eb694ae446dedca9750d37bc6962ee0cc24aa1238c0dc7cd6951f2a408eda6e45cfc91a28c908081e9b98a1af5ccbb2a7eff8a6ffdbe7469ac5fbc7792e0fe773ae5330ada20f49c041f923a2f6bb25424c2dcd5a429b070296abec40000a0fb736d6a8ab916644f18", 0x86}], 0x4, &(0x7f0000000f80)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r5, @multicast1, @dev={0xac, 0x14, 0x14, 0x2a}}}}, @ip_retopts={{0x50, 0x0, 0x7, {[@ssrr={0x89, 0x13, 0x6b, [@local, @empty, @empty, @multicast1]}, @ssrr={0x89, 0xb, 0xcd, [@broadcast, @broadcast]}, @ra={0x94, 0x4}, @ra={0x94, 0x4, 0x1}, @end, @cipso={0x86, 0x16, 0x1, [{0x0, 0xd, "2cea2070c76a1a122ed0aa"}, {0x0, 0x3, "95"}]}, @noop]}}}, @ip_retopts={{0x80, 0x0, 0x7, {[@noop, @timestamp_prespec={0x44, 0xc, 0x73, 0x3, 0xf, [{@multicast2, 0x82a3}]}, @cipso={0x86, 0x2a, 0x2, [{0x5, 0xa, "aa21c9cf61a3945f"}, {0x5, 0xe, "206aa4d6705d88be0aef2ac0"}, {0x6, 0x8, "8ee237720c2a"}, {0x6, 0x4, "e34c"}]}, @ssrr={0x89, 0x17, 0xd4, [@private=0xa010100, @loopback, @empty, @rand_addr=0x64010101, @empty]}, @lsrr={0x83, 0x7, 0x7f, [@loopback]}, @timestamp={0x44, 0x18, 0xdc, 0x0, 0x2, [0x9, 0x8001, 0xb4, 0x8, 0x10]}]}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @remote, @empty}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x7}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r8, @broadcast, @dev={0xac, 0x14, 0x14, 0x36}}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x9}}, @ip_tos_int={{0x14}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x1}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x8}}], 0x1a8}, 0x480c0) r9 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r9, &(0x7f0000000880)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @dev}, 0x2}}, 0x2e) syz_usb_connect$uac1(0x0, 0xb1, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000106b1d0101890f0000030109029f0003010000000904000000010100000a24010000000201020d24060000030800000031ce21c798329740594c137d0000000c24020201010608000010000c24020000000300000000000924060006010000000924030000000005000b240605", @ANYRES64], 0x0) program crashed: KASAN: use-after-free Read in l2tp_tunnel_get_session single: successfully extracted reproducer found reproducer with 26 syscalls minimizing guilty program testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-setsockopt$netlink_NETLINK_NO_ENOBUFS-syz_emit_ethernet-sendmsg$nl_route-ioctl$TUNSETIFF-syz_mount_image$ext4-sendmsg$nl_route-openat-mprotect-ioctl$EXT4_IOC_MOVE_EXT-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$sock_SIOCGIFINDEX-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$inet-socket$pppl2tp-connect$pppl2tp detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000080)=0x7f, 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000140)=ANY=[@ANYBLOB="cebbbbbbbbbb0000fc00000008004500001c0000000000029078ac1e0001e0000001177c9078ac141430"], 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000001a0001002dbd7000010000000a808000", @ANYRES32=0x0, @ANYBLOB="00000000080002000600000f14005729f98c33cbe1616399b444985bea7f8d643eec86b4d39a8af6203f"], 0x38}, 0x1, 0x0, 0x0, 0x2404c051}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000240)='./file1\x00', 0x0, &(0x7f0000000280), 0x1, 0x4bc, &(0x7f00000002c0)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") sendmsg$nl_route(r0, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)=@ipv4_newrule={0x30, 0x20, 0x100, 0x70bd29, 0x25dfdbfd, {0x2, 0x80, 0x10, 0x1, 0x1, 0x0, 0x0, 0x4, 0x10}, [@FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x2}, @FRA_SRC={0x8, 0x2, @rand_addr=0x64010101}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000004}, 0x44000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./file1\x00', 0x2002, 0xa) mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x9) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f00000007c0)={0xc, 0xffffffffffffffff, 0x9, 0x1, 0x400, 0xfffffffffdffffff}) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000000c00)={'wg1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000c40)={'macsec0\x00', 0x0}) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000c80)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000d00)={&(0x7f0000000d40)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r8, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4c840) sendmsg$nl_route_sched(r7, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000dc0)={&(0x7f0000000e00)=@newtfilter={0x50, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0xb, 0xa}, {0x0, 0xfff3}, {0xb, 0xd}}, [@filter_kind_options=@f_u32={{0x8}, {0x24, 0x2, [@TCA_U32_CLASSID={0x8, 0x1, {0x10, 0xb}}, @TCA_U32_SEL={0x14, 0x5, {0x10, 0x4, 0x0, 0x9, 0x3, 0xfffa, 0x6, 0x7}}, @TCA_U32_POLICE={0x4}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000e80)={&(0x7f0000000ec0), 0xc, &(0x7f0000000f00)={&(0x7f0000000f40)=@delqdisc={0x24, 0x25, 0x10, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0xe}, {0xfff3, 0x1}, {0xe, 0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x24054040}, 0x10) sendmsg$inet(r2, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f00000009c0)='r', 0x1}, {&(0x7f0000000a00)="9d6165a2dff95deb78769f3a6eba32fbb69e561b3302a18f546940921404c6e81c37cca15627e0688fd8986b905486f1122a6e9104c19e5fb3d06396942ed4786375ccf59baf73168402603ff4cba590c035f42f42f7ee90af78acf08f168c7df629a19059b343fc165c4cbc18e2570ae619917a578c8596d723d25e33eeff4870e3a3118d8dc97905da7d7e96f1d6e32cca61e043", 0x95}, {&(0x7f0000000ac0)="80151cf2e7d19f86e18441b54677a3d989dbbd20927385255d644b324736e5a7b9a796d0296e3dddd1a4e539f046a63c528f", 0x32}, {&(0x7f0000000b00)="488121e3b84672bf4ad497c77411ef5b5f14443b97543cb085c6a9ce73eb694ae446dedca9750d37bc6962ee0cc24aa1238c0dc7cd6951f2a408eda6e45cfc91a28c908081e9b98a1af5ccbb2a7eff8a6ffdbe7469ac5fbc7792e0fe773ae5330ada20f49c041f923a2f6bb25424c2dcd5a429b070296abec40000a0fb736d6a8ab916644f18", 0x86}], 0x4, &(0x7f0000000f80)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r5, @multicast1, @dev={0xac, 0x14, 0x14, 0x2a}}}}, @ip_retopts={{0x50, 0x0, 0x7, {[@ssrr={0x89, 0x13, 0x6b, [@local, @empty, @empty, @multicast1]}, @ssrr={0x89, 0xb, 0xcd, [@broadcast, @broadcast]}, @ra={0x94, 0x4}, @ra={0x94, 0x4, 0x1}, @end, @cipso={0x86, 0x16, 0x1, [{0x0, 0xd, "2cea2070c76a1a122ed0aa"}, {0x0, 0x3, "95"}]}, @noop]}}}, @ip_retopts={{0x80, 0x0, 0x7, {[@noop, @timestamp_prespec={0x44, 0xc, 0x73, 0x3, 0xf, [{@multicast2, 0x82a3}]}, @cipso={0x86, 0x2a, 0x2, [{0x5, 0xa, "aa21c9cf61a3945f"}, {0x5, 0xe, "206aa4d6705d88be0aef2ac0"}, {0x6, 0x8, "8ee237720c2a"}, {0x6, 0x4, "e34c"}]}, @ssrr={0x89, 0x17, 0xd4, [@private=0xa010100, @loopback, @empty, @rand_addr=0x64010101, @empty]}, @lsrr={0x83, 0x7, 0x7f, [@loopback]}, @timestamp={0x44, 0x18, 0xdc, 0x0, 0x2, [0x9, 0x8001, 0xb4, 0x8, 0x10]}]}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @remote, @empty}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x7}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r8, @broadcast, @dev={0xac, 0x14, 0x14, 0x36}}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x9}}, @ip_tos_int={{0x14}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x1}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x8}}], 0x1a8}, 0x480c0) r9 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r9, &(0x7f0000000880)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @dev}, 0x2}}, 0x2e) program crashed: KASAN: use-after-free Read in l2tp_tunnel_get_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-setsockopt$netlink_NETLINK_NO_ENOBUFS-syz_emit_ethernet-sendmsg$nl_route-ioctl$TUNSETIFF-syz_mount_image$ext4-sendmsg$nl_route-openat-mprotect-ioctl$EXT4_IOC_MOVE_EXT-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$sock_SIOCGIFINDEX-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$inet-socket$pppl2tp detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000080)=0x7f, 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000140)=ANY=[@ANYBLOB="cebbbbbbbbbb0000fc00000008004500001c0000000000029078ac1e0001e0000001177c9078ac141430"], 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000001a0001002dbd7000010000000a808000", @ANYRES32=0x0, @ANYBLOB="00000000080002000600000f14005729f98c33cbe1616399b444985bea7f8d643eec86b4d39a8af6203f"], 0x38}, 0x1, 0x0, 0x0, 0x2404c051}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000240)='./file1\x00', 0x0, &(0x7f0000000280), 0x1, 0x4bc, &(0x7f00000002c0)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") sendmsg$nl_route(r0, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)=@ipv4_newrule={0x30, 0x20, 0x100, 0x70bd29, 0x25dfdbfd, {0x2, 0x80, 0x10, 0x1, 0x1, 0x0, 0x0, 0x4, 0x10}, [@FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x2}, @FRA_SRC={0x8, 0x2, @rand_addr=0x64010101}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000004}, 0x44000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./file1\x00', 0x2002, 0xa) mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x9) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f00000007c0)={0xc, 0xffffffffffffffff, 0x9, 0x1, 0x400, 0xfffffffffdffffff}) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000000c00)={'wg1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000c40)={'macsec0\x00', 0x0}) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000c80)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000d00)={&(0x7f0000000d40)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r8, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4c840) sendmsg$nl_route_sched(r7, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000dc0)={&(0x7f0000000e00)=@newtfilter={0x50, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0xb, 0xa}, {0x0, 0xfff3}, {0xb, 0xd}}, [@filter_kind_options=@f_u32={{0x8}, {0x24, 0x2, [@TCA_U32_CLASSID={0x8, 0x1, {0x10, 0xb}}, @TCA_U32_SEL={0x14, 0x5, {0x10, 0x4, 0x0, 0x9, 0x3, 0xfffa, 0x6, 0x7}}, @TCA_U32_POLICE={0x4}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000e80)={&(0x7f0000000ec0), 0xc, &(0x7f0000000f00)={&(0x7f0000000f40)=@delqdisc={0x24, 0x25, 0x10, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0xe}, {0xfff3, 0x1}, {0xe, 0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x24054040}, 0x10) sendmsg$inet(r2, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f00000009c0)='r', 0x1}, {&(0x7f0000000a00)="9d6165a2dff95deb78769f3a6eba32fbb69e561b3302a18f546940921404c6e81c37cca15627e0688fd8986b905486f1122a6e9104c19e5fb3d06396942ed4786375ccf59baf73168402603ff4cba590c035f42f42f7ee90af78acf08f168c7df629a19059b343fc165c4cbc18e2570ae619917a578c8596d723d25e33eeff4870e3a3118d8dc97905da7d7e96f1d6e32cca61e043", 0x95}, {&(0x7f0000000ac0)="80151cf2e7d19f86e18441b54677a3d989dbbd20927385255d644b324736e5a7b9a796d0296e3dddd1a4e539f046a63c528f", 0x32}, {&(0x7f0000000b00)="488121e3b84672bf4ad497c77411ef5b5f14443b97543cb085c6a9ce73eb694ae446dedca9750d37bc6962ee0cc24aa1238c0dc7cd6951f2a408eda6e45cfc91a28c908081e9b98a1af5ccbb2a7eff8a6ffdbe7469ac5fbc7792e0fe773ae5330ada20f49c041f923a2f6bb25424c2dcd5a429b070296abec40000a0fb736d6a8ab916644f18", 0x86}], 0x4, &(0x7f0000000f80)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r5, @multicast1, @dev={0xac, 0x14, 0x14, 0x2a}}}}, @ip_retopts={{0x50, 0x0, 0x7, {[@ssrr={0x89, 0x13, 0x6b, [@local, @empty, @empty, @multicast1]}, @ssrr={0x89, 0xb, 0xcd, [@broadcast, @broadcast]}, @ra={0x94, 0x4}, @ra={0x94, 0x4, 0x1}, @end, @cipso={0x86, 0x16, 0x1, [{0x0, 0xd, "2cea2070c76a1a122ed0aa"}, {0x0, 0x3, "95"}]}, @noop]}}}, @ip_retopts={{0x80, 0x0, 0x7, {[@noop, @timestamp_prespec={0x44, 0xc, 0x73, 0x3, 0xf, [{@multicast2, 0x82a3}]}, @cipso={0x86, 0x2a, 0x2, [{0x5, 0xa, "aa21c9cf61a3945f"}, {0x5, 0xe, "206aa4d6705d88be0aef2ac0"}, {0x6, 0x8, "8ee237720c2a"}, {0x6, 0x4, "e34c"}]}, @ssrr={0x89, 0x17, 0xd4, [@private=0xa010100, @loopback, @empty, @rand_addr=0x64010101, @empty]}, @lsrr={0x83, 0x7, 0x7f, [@loopback]}, @timestamp={0x44, 0x18, 0xdc, 0x0, 0x2, [0x9, 0x8001, 0xb4, 0x8, 0x10]}]}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @remote, @empty}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x7}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r8, @broadcast, @dev={0xac, 0x14, 0x14, 0x36}}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x9}}, @ip_tos_int={{0x14}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x1}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x8}}], 0x1a8}, 0x480c0) socket$pppl2tp(0x18, 0x1, 0x1) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-setsockopt$netlink_NETLINK_NO_ENOBUFS-syz_emit_ethernet-sendmsg$nl_route-ioctl$TUNSETIFF-syz_mount_image$ext4-sendmsg$nl_route-openat-mprotect-ioctl$EXT4_IOC_MOVE_EXT-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$sock_SIOCGIFINDEX-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$inet detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000080)=0x7f, 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000140)=ANY=[@ANYBLOB="cebbbbbbbbbb0000fc00000008004500001c0000000000029078ac1e0001e0000001177c9078ac141430"], 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000001a0001002dbd7000010000000a808000", @ANYRES32=0x0, @ANYBLOB="00000000080002000600000f14005729f98c33cbe1616399b444985bea7f8d643eec86b4d39a8af6203f"], 0x38}, 0x1, 0x0, 0x0, 0x2404c051}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000240)='./file1\x00', 0x0, &(0x7f0000000280), 0x1, 0x4bc, &(0x7f00000002c0)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") sendmsg$nl_route(r0, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)=@ipv4_newrule={0x30, 0x20, 0x100, 0x70bd29, 0x25dfdbfd, {0x2, 0x80, 0x10, 0x1, 0x1, 0x0, 0x0, 0x4, 0x10}, [@FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x2}, @FRA_SRC={0x8, 0x2, @rand_addr=0x64010101}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000004}, 0x44000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./file1\x00', 0x2002, 0xa) mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x9) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f00000007c0)={0xc, 0xffffffffffffffff, 0x9, 0x1, 0x400, 0xfffffffffdffffff}) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000000c00)={'wg1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000c40)={'macsec0\x00', 0x0}) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000c80)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000d00)={&(0x7f0000000d40)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r8, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4c840) sendmsg$nl_route_sched(r7, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000dc0)={&(0x7f0000000e00)=@newtfilter={0x50, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0xb, 0xa}, {0x0, 0xfff3}, {0xb, 0xd}}, [@filter_kind_options=@f_u32={{0x8}, {0x24, 0x2, [@TCA_U32_CLASSID={0x8, 0x1, {0x10, 0xb}}, @TCA_U32_SEL={0x14, 0x5, {0x10, 0x4, 0x0, 0x9, 0x3, 0xfffa, 0x6, 0x7}}, @TCA_U32_POLICE={0x4}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000e80)={&(0x7f0000000ec0), 0xc, &(0x7f0000000f00)={&(0x7f0000000f40)=@delqdisc={0x24, 0x25, 0x10, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0xe}, {0xfff3, 0x1}, {0xe, 0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x24054040}, 0x10) sendmsg$inet(r2, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f00000009c0)='r', 0x1}, {&(0x7f0000000a00)="9d6165a2dff95deb78769f3a6eba32fbb69e561b3302a18f546940921404c6e81c37cca15627e0688fd8986b905486f1122a6e9104c19e5fb3d06396942ed4786375ccf59baf73168402603ff4cba590c035f42f42f7ee90af78acf08f168c7df629a19059b343fc165c4cbc18e2570ae619917a578c8596d723d25e33eeff4870e3a3118d8dc97905da7d7e96f1d6e32cca61e043", 0x95}, {&(0x7f0000000ac0)="80151cf2e7d19f86e18441b54677a3d989dbbd20927385255d644b324736e5a7b9a796d0296e3dddd1a4e539f046a63c528f", 0x32}, {&(0x7f0000000b00)="488121e3b84672bf4ad497c77411ef5b5f14443b97543cb085c6a9ce73eb694ae446dedca9750d37bc6962ee0cc24aa1238c0dc7cd6951f2a408eda6e45cfc91a28c908081e9b98a1af5ccbb2a7eff8a6ffdbe7469ac5fbc7792e0fe773ae5330ada20f49c041f923a2f6bb25424c2dcd5a429b070296abec40000a0fb736d6a8ab916644f18", 0x86}], 0x4, &(0x7f0000000f80)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r5, @multicast1, @dev={0xac, 0x14, 0x14, 0x2a}}}}, @ip_retopts={{0x50, 0x0, 0x7, {[@ssrr={0x89, 0x13, 0x6b, [@local, @empty, @empty, @multicast1]}, @ssrr={0x89, 0xb, 0xcd, [@broadcast, @broadcast]}, @ra={0x94, 0x4}, @ra={0x94, 0x4, 0x1}, @end, @cipso={0x86, 0x16, 0x1, [{0x0, 0xd, "2cea2070c76a1a122ed0aa"}, {0x0, 0x3, "95"}]}, @noop]}}}, @ip_retopts={{0x80, 0x0, 0x7, {[@noop, @timestamp_prespec={0x44, 0xc, 0x73, 0x3, 0xf, [{@multicast2, 0x82a3}]}, @cipso={0x86, 0x2a, 0x2, [{0x5, 0xa, "aa21c9cf61a3945f"}, {0x5, 0xe, "206aa4d6705d88be0aef2ac0"}, {0x6, 0x8, "8ee237720c2a"}, {0x6, 0x4, "e34c"}]}, @ssrr={0x89, 0x17, 0xd4, [@private=0xa010100, @loopback, @empty, @rand_addr=0x64010101, @empty]}, @lsrr={0x83, 0x7, 0x7f, [@loopback]}, @timestamp={0x44, 0x18, 0xdc, 0x0, 0x2, [0x9, 0x8001, 0xb4, 0x8, 0x10]}]}}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @remote, @empty}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x7}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r8, @broadcast, @dev={0xac, 0x14, 0x14, 0x36}}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x9}}, @ip_tos_int={{0x14}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x1}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x8}}], 0x1a8}, 0x480c0) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-setsockopt$netlink_NETLINK_NO_ENOBUFS-syz_emit_ethernet-sendmsg$nl_route-ioctl$TUNSETIFF-syz_mount_image$ext4-sendmsg$nl_route-openat-mprotect-ioctl$EXT4_IOC_MOVE_EXT-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$sock_SIOCGIFINDEX-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000080)=0x7f, 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000140)=ANY=[@ANYBLOB="cebbbbbbbbbb0000fc00000008004500001c0000000000029078ac1e0001e0000001177c9078ac141430"], 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000001a0001002dbd7000010000000a808000", @ANYRES32=0x0, @ANYBLOB="00000000080002000600000f14005729f98c33cbe1616399b444985bea7f8d643eec86b4d39a8af6203f"], 0x38}, 0x1, 0x0, 0x0, 0x2404c051}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000240)='./file1\x00', 0x0, &(0x7f0000000280), 0x1, 0x4bc, &(0x7f00000002c0)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") sendmsg$nl_route(r0, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)=@ipv4_newrule={0x30, 0x20, 0x100, 0x70bd29, 0x25dfdbfd, {0x2, 0x80, 0x10, 0x1, 0x1, 0x0, 0x0, 0x4, 0x10}, [@FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x2}, @FRA_SRC={0x8, 0x2, @rand_addr=0x64010101}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000004}, 0x44000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./file1\x00', 0x2002, 0xa) mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x9) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f00000007c0)={0xc, 0xffffffffffffffff, 0x9, 0x1, 0x400, 0xfffffffffdffffff}) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000000c00)={'wg1\x00'}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000c40)={'macsec0\x00'}) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000c80)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000d00)={&(0x7f0000000d40)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r6, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4c840) sendmsg$nl_route_sched(r5, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000dc0)={&(0x7f0000000e00)=@newtfilter={0x50, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0xb, 0xa}, {0x0, 0xfff3}, {0xb, 0xd}}, [@filter_kind_options=@f_u32={{0x8}, {0x24, 0x2, [@TCA_U32_CLASSID={0x8, 0x1, {0x10, 0xb}}, @TCA_U32_SEL={0x14, 0x5, {0x10, 0x4, 0x0, 0x9, 0x3, 0xfffa, 0x6, 0x7}}, @TCA_U32_POLICE={0x4}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000e80)={&(0x7f0000000ec0), 0xc, &(0x7f0000000f00)={&(0x7f0000000f40)=@delqdisc={0x24, 0x25, 0x10, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0xe}, {0xfff3, 0x1}, {0xe, 0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x24054040}, 0x10) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-setsockopt$netlink_NETLINK_NO_ENOBUFS-syz_emit_ethernet-sendmsg$nl_route-ioctl$TUNSETIFF-syz_mount_image$ext4-sendmsg$nl_route-openat-mprotect-ioctl$EXT4_IOC_MOVE_EXT-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$sock_SIOCGIFINDEX-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000080)=0x7f, 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000140)=ANY=[@ANYBLOB="cebbbbbbbbbb0000fc00000008004500001c0000000000029078ac1e0001e0000001177c9078ac141430"], 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000001a0001002dbd7000010000000a808000", @ANYRES32=0x0, @ANYBLOB="00000000080002000600000f14005729f98c33cbe1616399b444985bea7f8d643eec86b4d39a8af6203f"], 0x38}, 0x1, 0x0, 0x0, 0x2404c051}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000240)='./file1\x00', 0x0, &(0x7f0000000280), 0x1, 0x4bc, &(0x7f00000002c0)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") sendmsg$nl_route(r0, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)=@ipv4_newrule={0x30, 0x20, 0x100, 0x70bd29, 0x25dfdbfd, {0x2, 0x80, 0x10, 0x1, 0x1, 0x0, 0x0, 0x4, 0x10}, [@FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x2}, @FRA_SRC={0x8, 0x2, @rand_addr=0x64010101}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000004}, 0x44000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./file1\x00', 0x2002, 0xa) mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x9) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f00000007c0)={0xc, 0xffffffffffffffff, 0x9, 0x1, 0x400, 0xfffffffffdffffff}) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000000c00)={'wg1\x00'}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000c40)={'macsec0\x00'}) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000c80)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000d00)={&(0x7f0000000d40)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r6, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4c840) sendmsg$nl_route_sched(r5, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000dc0)={&(0x7f0000000e00)=@newtfilter={0x50, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0xb, 0xa}, {0x0, 0xfff3}, {0xb, 0xd}}, [@filter_kind_options=@f_u32={{0x8}, {0x24, 0x2, [@TCA_U32_CLASSID={0x8, 0x1, {0x10, 0xb}}, @TCA_U32_SEL={0x14, 0x5, {0x10, 0x4, 0x0, 0x9, 0x3, 0xfffa, 0x6, 0x7}}, @TCA_U32_POLICE={0x4}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-setsockopt$netlink_NETLINK_NO_ENOBUFS-syz_emit_ethernet-sendmsg$nl_route-ioctl$TUNSETIFF-syz_mount_image$ext4-sendmsg$nl_route-openat-mprotect-ioctl$EXT4_IOC_MOVE_EXT-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$sock_SIOCGIFINDEX-socket-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000080)=0x7f, 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000140)=ANY=[@ANYBLOB="cebbbbbbbbbb0000fc00000008004500001c0000000000029078ac1e0001e0000001177c9078ac141430"], 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000001a0001002dbd7000010000000a808000", @ANYRES32=0x0, @ANYBLOB="00000000080002000600000f14005729f98c33cbe1616399b444985bea7f8d643eec86b4d39a8af6203f"], 0x38}, 0x1, 0x0, 0x0, 0x2404c051}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000240)='./file1\x00', 0x0, &(0x7f0000000280), 0x1, 0x4bc, &(0x7f00000002c0)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") sendmsg$nl_route(r0, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)=@ipv4_newrule={0x30, 0x20, 0x100, 0x70bd29, 0x25dfdbfd, {0x2, 0x80, 0x10, 0x1, 0x1, 0x0, 0x0, 0x4, 0x10}, [@FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x2}, @FRA_SRC={0x8, 0x2, @rand_addr=0x64010101}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000004}, 0x44000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./file1\x00', 0x2002, 0xa) mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x9) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f00000007c0)={0xc, 0xffffffffffffffff, 0x9, 0x1, 0x400, 0xfffffffffdffffff}) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000000c00)={'wg1\x00'}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000c40)={'macsec0\x00'}) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000c80)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000d00)={&(0x7f0000000d40)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r6, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4c840) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-setsockopt$netlink_NETLINK_NO_ENOBUFS-syz_emit_ethernet-sendmsg$nl_route-ioctl$TUNSETIFF-syz_mount_image$ext4-sendmsg$nl_route-openat-mprotect-ioctl$EXT4_IOC_MOVE_EXT-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$sock_SIOCGIFINDEX-socket-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000080)=0x7f, 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000140)=ANY=[@ANYBLOB="cebbbbbbbbbb0000fc00000008004500001c0000000000029078ac1e0001e0000001177c9078ac141430"], 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000001a0001002dbd7000010000000a808000", @ANYRES32=0x0, @ANYBLOB="00000000080002000600000f14005729f98c33cbe1616399b444985bea7f8d643eec86b4d39a8af6203f"], 0x38}, 0x1, 0x0, 0x0, 0x2404c051}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000240)='./file1\x00', 0x0, &(0x7f0000000280), 0x1, 0x4bc, &(0x7f00000002c0)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") sendmsg$nl_route(r0, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)=@ipv4_newrule={0x30, 0x20, 0x100, 0x70bd29, 0x25dfdbfd, {0x2, 0x80, 0x10, 0x1, 0x1, 0x0, 0x0, 0x4, 0x10}, [@FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x2}, @FRA_SRC={0x8, 0x2, @rand_addr=0x64010101}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000004}, 0x44000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./file1\x00', 0x2002, 0xa) mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x9) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f00000007c0)={0xc, 0xffffffffffffffff, 0x9, 0x1, 0x400, 0xfffffffffdffffff}) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000000c00)={'wg1\x00'}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000c40)={'macsec0\x00'}) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000c80)={'batadv_slave_0\x00'}) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-setsockopt$netlink_NETLINK_NO_ENOBUFS-syz_emit_ethernet-sendmsg$nl_route-ioctl$TUNSETIFF-syz_mount_image$ext4-sendmsg$nl_route-openat-mprotect-ioctl$EXT4_IOC_MOVE_EXT-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$sock_SIOCGIFINDEX-socket detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000080)=0x7f, 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000140)=ANY=[@ANYBLOB="cebbbbbbbbbb0000fc00000008004500001c0000000000029078ac1e0001e0000001177c9078ac141430"], 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000001a0001002dbd7000010000000a808000", @ANYRES32=0x0, @ANYBLOB="00000000080002000600000f14005729f98c33cbe1616399b444985bea7f8d643eec86b4d39a8af6203f"], 0x38}, 0x1, 0x0, 0x0, 0x2404c051}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000240)='./file1\x00', 0x0, &(0x7f0000000280), 0x1, 0x4bc, &(0x7f00000002c0)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") sendmsg$nl_route(r0, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)=@ipv4_newrule={0x30, 0x20, 0x100, 0x70bd29, 0x25dfdbfd, {0x2, 0x80, 0x10, 0x1, 0x1, 0x0, 0x0, 0x4, 0x10}, [@FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x2}, @FRA_SRC={0x8, 0x2, @rand_addr=0x64010101}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000004}, 0x44000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./file1\x00', 0x2002, 0xa) mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x9) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f00000007c0)={0xc, 0xffffffffffffffff, 0x9, 0x1, 0x400, 0xfffffffffdffffff}) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000000c00)={'wg1\x00'}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000c40)={'macsec0\x00'}) socket(0x400000000010, 0x3, 0x0) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-setsockopt$netlink_NETLINK_NO_ENOBUFS-syz_emit_ethernet-sendmsg$nl_route-ioctl$TUNSETIFF-syz_mount_image$ext4-sendmsg$nl_route-openat-mprotect-ioctl$EXT4_IOC_MOVE_EXT-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000080)=0x7f, 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000140)=ANY=[@ANYBLOB="cebbbbbbbbbb0000fc00000008004500001c0000000000029078ac1e0001e0000001177c9078ac141430"], 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000001a0001002dbd7000010000000a808000", @ANYRES32=0x0, @ANYBLOB="00000000080002000600000f14005729f98c33cbe1616399b444985bea7f8d643eec86b4d39a8af6203f"], 0x38}, 0x1, 0x0, 0x0, 0x2404c051}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000240)='./file1\x00', 0x0, &(0x7f0000000280), 0x1, 0x4bc, &(0x7f00000002c0)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") sendmsg$nl_route(r0, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)=@ipv4_newrule={0x30, 0x20, 0x100, 0x70bd29, 0x25dfdbfd, {0x2, 0x80, 0x10, 0x1, 0x1, 0x0, 0x0, 0x4, 0x10}, [@FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x2}, @FRA_SRC={0x8, 0x2, @rand_addr=0x64010101}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000004}, 0x44000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./file1\x00', 0x2002, 0xa) mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x9) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f00000007c0)={0xc, 0xffffffffffffffff, 0x9, 0x1, 0x400, 0xfffffffffdffffff}) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000000c00)={'wg1\x00'}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000c40)={'macsec0\x00'}) program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-setsockopt$netlink_NETLINK_NO_ENOBUFS-syz_emit_ethernet-sendmsg$nl_route-ioctl$TUNSETIFF-syz_mount_image$ext4-sendmsg$nl_route-openat-mprotect-ioctl$EXT4_IOC_MOVE_EXT-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000080)=0x7f, 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000140)=ANY=[@ANYBLOB="cebbbbbbbbbb0000fc00000008004500001c0000000000029078ac1e0001e0000001177c9078ac141430"], 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000001a0001002dbd7000010000000a808000", @ANYRES32=0x0, @ANYBLOB="00000000080002000600000f14005729f98c33cbe1616399b444985bea7f8d643eec86b4d39a8af6203f"], 0x38}, 0x1, 0x0, 0x0, 0x2404c051}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000240)='./file1\x00', 0x0, &(0x7f0000000280), 0x1, 0x4bc, &(0x7f00000002c0)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") sendmsg$nl_route(r0, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)=@ipv4_newrule={0x30, 0x20, 0x100, 0x70bd29, 0x25dfdbfd, {0x2, 0x80, 0x10, 0x1, 0x1, 0x0, 0x0, 0x4, 0x10}, [@FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x2}, @FRA_SRC={0x8, 0x2, @rand_addr=0x64010101}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000004}, 0x44000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./file1\x00', 0x2002, 0xa) mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x9) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f00000007c0)={0xc, 0xffffffffffffffff, 0x9, 0x1, 0x400, 0xfffffffffdffffff}) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000000c00)={'wg1\x00'}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-setsockopt$netlink_NETLINK_NO_ENOBUFS-syz_emit_ethernet-sendmsg$nl_route-ioctl$TUNSETIFF-syz_mount_image$ext4-sendmsg$nl_route-openat-mprotect-ioctl$EXT4_IOC_MOVE_EXT-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000080)=0x7f, 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000140)=ANY=[@ANYBLOB="cebbbbbbbbbb0000fc00000008004500001c0000000000029078ac1e0001e0000001177c9078ac141430"], 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000001a0001002dbd7000010000000a808000", @ANYRES32=0x0, @ANYBLOB="00000000080002000600000f14005729f98c33cbe1616399b444985bea7f8d643eec86b4d39a8af6203f"], 0x38}, 0x1, 0x0, 0x0, 0x2404c051}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000240)='./file1\x00', 0x0, &(0x7f0000000280), 0x1, 0x4bc, &(0x7f00000002c0)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") sendmsg$nl_route(r0, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)=@ipv4_newrule={0x30, 0x20, 0x100, 0x70bd29, 0x25dfdbfd, {0x2, 0x80, 0x10, 0x1, 0x1, 0x0, 0x0, 0x4, 0x10}, [@FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x2}, @FRA_SRC={0x8, 0x2, @rand_addr=0x64010101}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000004}, 0x44000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./file1\x00', 0x2002, 0xa) mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x9) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f00000007c0)={0xc, 0xffffffffffffffff, 0x9, 0x1, 0x400, 0xfffffffffdffffff}) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-setsockopt$netlink_NETLINK_NO_ENOBUFS-syz_emit_ethernet-sendmsg$nl_route-ioctl$TUNSETIFF-syz_mount_image$ext4-sendmsg$nl_route-openat-mprotect-ioctl$EXT4_IOC_MOVE_EXT-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000080)=0x7f, 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000140)=ANY=[@ANYBLOB="cebbbbbbbbbb0000fc00000008004500001c0000000000029078ac1e0001e0000001177c9078ac141430"], 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000001a0001002dbd7000010000000a808000", @ANYRES32=0x0, @ANYBLOB="00000000080002000600000f14005729f98c33cbe1616399b444985bea7f8d643eec86b4d39a8af6203f"], 0x38}, 0x1, 0x0, 0x0, 0x2404c051}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000240)='./file1\x00', 0x0, &(0x7f0000000280), 0x1, 0x4bc, &(0x7f00000002c0)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") sendmsg$nl_route(r0, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)=@ipv4_newrule={0x30, 0x20, 0x100, 0x70bd29, 0x25dfdbfd, {0x2, 0x80, 0x10, 0x1, 0x1, 0x0, 0x0, 0x4, 0x10}, [@FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x2}, @FRA_SRC={0x8, 0x2, @rand_addr=0x64010101}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000004}, 0x44000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./file1\x00', 0x2002, 0xa) mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x9) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f00000007c0)={0xc, 0xffffffffffffffff, 0x9, 0x1, 0x400, 0xfffffffffdffffff}) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r4 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000000c00)={'wg1\x00'}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-setsockopt$netlink_NETLINK_NO_ENOBUFS-syz_emit_ethernet-sendmsg$nl_route-ioctl$TUNSETIFF-syz_mount_image$ext4-sendmsg$nl_route-openat-mprotect-ioctl$EXT4_IOC_MOVE_EXT-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000080)=0x7f, 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000140)=ANY=[@ANYBLOB="cebbbbbbbbbb0000fc00000008004500001c0000000000029078ac1e0001e0000001177c9078ac141430"], 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000001a0001002dbd7000010000000a808000", @ANYRES32=0x0, @ANYBLOB="00000000080002000600000f14005729f98c33cbe1616399b444985bea7f8d643eec86b4d39a8af6203f"], 0x38}, 0x1, 0x0, 0x0, 0x2404c051}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000240)='./file1\x00', 0x0, &(0x7f0000000280), 0x1, 0x4bc, &(0x7f00000002c0)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") sendmsg$nl_route(r0, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)=@ipv4_newrule={0x30, 0x20, 0x100, 0x70bd29, 0x25dfdbfd, {0x2, 0x80, 0x10, 0x1, 0x1, 0x0, 0x0, 0x4, 0x10}, [@FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x2}, @FRA_SRC={0x8, 0x2, @rand_addr=0x64010101}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000004}, 0x44000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./file1\x00', 0x2002, 0xa) mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x9) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f00000007c0)={0xc, 0xffffffffffffffff, 0x9, 0x1, 0x400, 0xfffffffffdffffff}) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000c00)={'wg1\x00'}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-setsockopt$netlink_NETLINK_NO_ENOBUFS-syz_emit_ethernet-sendmsg$nl_route-ioctl$TUNSETIFF-syz_mount_image$ext4-sendmsg$nl_route-openat-mprotect-ioctl$EXT4_IOC_MOVE_EXT-socket$pppl2tp-socket$inet6_udp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000080)=0x7f, 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000140)=ANY=[@ANYBLOB="cebbbbbbbbbb0000fc00000008004500001c0000000000029078ac1e0001e0000001177c9078ac141430"], 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000001a0001002dbd7000010000000a808000", @ANYRES32=0x0, @ANYBLOB="00000000080002000600000f14005729f98c33cbe1616399b444985bea7f8d643eec86b4d39a8af6203f"], 0x38}, 0x1, 0x0, 0x0, 0x2404c051}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000240)='./file1\x00', 0x0, &(0x7f0000000280), 0x1, 0x4bc, &(0x7f00000002c0)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") sendmsg$nl_route(r0, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)=@ipv4_newrule={0x30, 0x20, 0x100, 0x70bd29, 0x25dfdbfd, {0x2, 0x80, 0x10, 0x1, 0x1, 0x0, 0x0, 0x4, 0x10}, [@FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x2}, @FRA_SRC={0x8, 0x2, @rand_addr=0x64010101}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000004}, 0x44000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./file1\x00', 0x2002, 0xa) mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x9) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f00000007c0)={0xc, 0xffffffffffffffff, 0x9, 0x1, 0x400, 0xfffffffffdffffff}) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f0000000c00)={'wg1\x00'}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-setsockopt$netlink_NETLINK_NO_ENOBUFS-syz_emit_ethernet-sendmsg$nl_route-ioctl$TUNSETIFF-syz_mount_image$ext4-sendmsg$nl_route-openat-mprotect-ioctl$EXT4_IOC_MOVE_EXT-socket$pppl2tp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000080)=0x7f, 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000140)=ANY=[@ANYBLOB="cebbbbbbbbbb0000fc00000008004500001c0000000000029078ac1e0001e0000001177c9078ac141430"], 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000001a0001002dbd7000010000000a808000", @ANYRES32=0x0, @ANYBLOB="00000000080002000600000f14005729f98c33cbe1616399b444985bea7f8d643eec86b4d39a8af6203f"], 0x38}, 0x1, 0x0, 0x0, 0x2404c051}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000240)='./file1\x00', 0x0, &(0x7f0000000280), 0x1, 0x4bc, &(0x7f00000002c0)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") sendmsg$nl_route(r0, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)=@ipv4_newrule={0x30, 0x20, 0x100, 0x70bd29, 0x25dfdbfd, {0x2, 0x80, 0x10, 0x1, 0x1, 0x0, 0x0, 0x4, 0x10}, [@FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x2}, @FRA_SRC={0x8, 0x2, @rand_addr=0x64010101}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000004}, 0x44000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./file1\x00', 0x2002, 0xa) mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x9) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f00000007c0)={0xc, 0xffffffffffffffff, 0x9, 0x1, 0x400, 0xfffffffffdffffff}) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000c00)={'wg1\x00'}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-setsockopt$netlink_NETLINK_NO_ENOBUFS-syz_emit_ethernet-sendmsg$nl_route-ioctl$TUNSETIFF-syz_mount_image$ext4-sendmsg$nl_route-openat-mprotect-ioctl$EXT4_IOC_MOVE_EXT-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000080)=0x7f, 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000140)=ANY=[@ANYBLOB="cebbbbbbbbbb0000fc00000008004500001c0000000000029078ac1e0001e0000001177c9078ac141430"], 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000001a0001002dbd7000010000000a808000", @ANYRES32=0x0, @ANYBLOB="00000000080002000600000f14005729f98c33cbe1616399b444985bea7f8d643eec86b4d39a8af6203f"], 0x38}, 0x1, 0x0, 0x0, 0x2404c051}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000240)='./file1\x00', 0x0, &(0x7f0000000280), 0x1, 0x4bc, &(0x7f00000002c0)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") sendmsg$nl_route(r0, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)=@ipv4_newrule={0x30, 0x20, 0x100, 0x70bd29, 0x25dfdbfd, {0x2, 0x80, 0x10, 0x1, 0x1, 0x0, 0x0, 0x4, 0x10}, [@FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x2}, @FRA_SRC={0x8, 0x2, @rand_addr=0x64010101}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000004}, 0x44000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000780)='./file1\x00', 0x2002, 0xa) mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x9) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f00000007c0)={0xc, 0xffffffffffffffff, 0x9, 0x1, 0x400, 0xfffffffffdffffff}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000c00)={'wg1\x00'}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-setsockopt$netlink_NETLINK_NO_ENOBUFS-syz_emit_ethernet-sendmsg$nl_route-ioctl$TUNSETIFF-syz_mount_image$ext4-sendmsg$nl_route-openat-mprotect-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000080)=0x7f, 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000140)=ANY=[@ANYBLOB="cebbbbbbbbbb0000fc00000008004500001c0000000000029078ac1e0001e0000001177c9078ac141430"], 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000001a0001002dbd7000010000000a808000", @ANYRES32=0x0, @ANYBLOB="00000000080002000600000f14005729f98c33cbe1616399b444985bea7f8d643eec86b4d39a8af6203f"], 0x38}, 0x1, 0x0, 0x0, 0x2404c051}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000240)='./file1\x00', 0x0, &(0x7f0000000280), 0x1, 0x4bc, &(0x7f00000002c0)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") sendmsg$nl_route(r0, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)=@ipv4_newrule={0x30, 0x20, 0x100, 0x70bd29, 0x25dfdbfd, {0x2, 0x80, 0x10, 0x1, 0x1, 0x0, 0x0, 0x4, 0x10}, [@FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x2}, @FRA_SRC={0x8, 0x2, @rand_addr=0x64010101}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000004}, 0x44000) openat(0xffffffffffffff9c, &(0x7f0000000780)='./file1\x00', 0x2002, 0xa) mprotect(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x9) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000c00)={'wg1\x00'}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-setsockopt$netlink_NETLINK_NO_ENOBUFS-syz_emit_ethernet-sendmsg$nl_route-ioctl$TUNSETIFF-syz_mount_image$ext4-sendmsg$nl_route-openat-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000080)=0x7f, 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000140)=ANY=[@ANYBLOB="cebbbbbbbbbb0000fc00000008004500001c0000000000029078ac1e0001e0000001177c9078ac141430"], 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000001a0001002dbd7000010000000a808000", @ANYRES32=0x0, @ANYBLOB="00000000080002000600000f14005729f98c33cbe1616399b444985bea7f8d643eec86b4d39a8af6203f"], 0x38}, 0x1, 0x0, 0x0, 0x2404c051}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000240)='./file1\x00', 0x0, &(0x7f0000000280), 0x1, 0x4bc, &(0x7f00000002c0)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") sendmsg$nl_route(r0, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)=@ipv4_newrule={0x30, 0x20, 0x100, 0x70bd29, 0x25dfdbfd, {0x2, 0x80, 0x10, 0x1, 0x1, 0x0, 0x0, 0x4, 0x10}, [@FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x2}, @FRA_SRC={0x8, 0x2, @rand_addr=0x64010101}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000004}, 0x44000) openat(0xffffffffffffff9c, &(0x7f0000000780)='./file1\x00', 0x2002, 0xa) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000c00)={'wg1\x00'}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-setsockopt$netlink_NETLINK_NO_ENOBUFS-syz_emit_ethernet-sendmsg$nl_route-ioctl$TUNSETIFF-syz_mount_image$ext4-sendmsg$nl_route-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000080)=0x7f, 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000140)=ANY=[@ANYBLOB="cebbbbbbbbbb0000fc00000008004500001c0000000000029078ac1e0001e0000001177c9078ac141430"], 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000001a0001002dbd7000010000000a808000", @ANYRES32=0x0, @ANYBLOB="00000000080002000600000f14005729f98c33cbe1616399b444985bea7f8d643eec86b4d39a8af6203f"], 0x38}, 0x1, 0x0, 0x0, 0x2404c051}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000240)='./file1\x00', 0x0, &(0x7f0000000280), 0x1, 0x4bc, &(0x7f00000002c0)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") sendmsg$nl_route(r0, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)=@ipv4_newrule={0x30, 0x20, 0x100, 0x70bd29, 0x25dfdbfd, {0x2, 0x80, 0x10, 0x1, 0x1, 0x0, 0x0, 0x4, 0x10}, [@FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x2}, @FRA_SRC={0x8, 0x2, @rand_addr=0x64010101}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000004}, 0x44000) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000c00)={'wg1\x00'}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-setsockopt$netlink_NETLINK_NO_ENOBUFS-syz_emit_ethernet-sendmsg$nl_route-ioctl$TUNSETIFF-syz_mount_image$ext4-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000080)=0x7f, 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000140)=ANY=[@ANYBLOB="cebbbbbbbbbb0000fc00000008004500001c0000000000029078ac1e0001e0000001177c9078ac141430"], 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000001a0001002dbd7000010000000a808000", @ANYRES32=0x0, @ANYBLOB="00000000080002000600000f14005729f98c33cbe1616399b444985bea7f8d643eec86b4d39a8af6203f"], 0x38}, 0x1, 0x0, 0x0, 0x2404c051}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) syz_mount_image$ext4(&(0x7f0000000200)='ext4\x00', &(0x7f0000000240)='./file1\x00', 0x0, &(0x7f0000000280), 0x1, 0x4bc, &(0x7f00000002c0)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ") r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000c00)={'wg1\x00'}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-setsockopt$netlink_NETLINK_NO_ENOBUFS-syz_emit_ethernet-sendmsg$nl_route-ioctl$TUNSETIFF-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000080)=0x7f, 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000140)=ANY=[@ANYBLOB="cebbbbbbbbbb0000fc00000008004500001c0000000000029078ac1e0001e0000001177c9078ac141430"], 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000001a0001002dbd7000010000000a808000", @ANYRES32=0x0, @ANYBLOB="00000000080002000600000f14005729f98c33cbe1616399b444985bea7f8d643eec86b4d39a8af6203f"], 0x38}, 0x1, 0x0, 0x0, 0x2404c051}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000c00)={'wg1\x00'}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-setsockopt$netlink_NETLINK_NO_ENOBUFS-syz_emit_ethernet-sendmsg$nl_route-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000080)=0x7f, 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000140)=ANY=[@ANYBLOB="cebbbbbbbbbb0000fc00000008004500001c0000000000029078ac1e0001e0000001177c9078ac141430"], 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000001a0001002dbd7000010000000a808000", @ANYRES32=0x0, @ANYBLOB="00000000080002000600000f14005729f98c33cbe1616399b444985bea7f8d643eec86b4d39a8af6203f"], 0x38}, 0x1, 0x0, 0x0, 0x2404c051}, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000c00)={'wg1\x00'}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-setsockopt$netlink_NETLINK_NO_ENOBUFS-syz_emit_ethernet-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000080)=0x7f, 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000140)=ANY=[@ANYBLOB="cebbbbbbbbbb0000fc00000008004500001c0000000000029078ac1e0001e0000001177c9078ac141430"], 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000c00)={'wg1\x00'}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-setsockopt$netlink_NETLINK_NO_ENOBUFS-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0xc, &(0x7f0000000080)=0x7f, 0x4) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r3 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000c00)={'wg1\x00'}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f0000000c00)={'wg1\x00'}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f0000000c00)={'wg1\x00'}) program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, 0x0, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r1, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000c00)={'wg1\x00'}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f0000000c00)={'wg1\x00'}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release extracting C reproducer testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session simplifying C reproducer testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard program crashed: KASAN: use-after-free Read in pppol2tp_sock_to_session testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard program crashed: KASAN: use-after-free Write in pppol2tp_release testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard program crashed: KASAN: use-after-free Write in pppol2tp_release testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release validation run: crashed=true testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release validation run: crashed=true testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-socket$pppl2tp-connect$pppl2tp-ioctl$ifreq_SIOCGIFINDEX_wireguard detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000800)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r2 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000840)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x40}}, 0x2, 0x9800, 0x0, 0x4}}, 0x2e) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, 0x0) program crashed: KASAN: use-after-free Write in pppol2tp_release validation run: crashed=true reproducing took 25m48.414257911s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:102 [inline] BUG: KASAN: use-after-free in atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:1779 [inline] BUG: KASAN: use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:176 [inline] BUG: KASAN: use-after-free in mutex_lock+0x86/0x1b0 kernel/locking/mutex.c:295 Write of size 8 at addr ffff88811278a950 by task syz.2.17/373 CPU: 1 PID: 373 Comm: syz.2.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:88 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106 print_address_description+0x71/0x200 mm/kasan/report.c:316 print_report+0x4a/0x60 mm/kasan/report.c:420 kasan_report+0x122/0x150 mm/kasan/report.c:524 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:102 [inline] atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:1779 [inline] __mutex_trylock_fast kernel/locking/mutex.c:176 [inline] mutex_lock+0x86/0x1b0 kernel/locking/mutex.c:295 pppol2tp_release+0x178/0x2b0 net/l2tp/l2tp_ppp.c:441 __sock_release net/socket.c:652 [inline] sock_close+0xc9/0x220 net/socket.c:1390 __fput+0x1fd/0x8f0 fs/file_table.c:320 ____fput+0x15/0x20 fs/file_table.c:348 task_work_run+0x1e1/0x250 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0x9b/0xb0 kernel/entry/common.c:177 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7feea2ba94d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffdf52fe938 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffdf52fea20 RCX: 00007feea2ba94d9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00000000000071ab R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b33020000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007feea2e25fac R14: 00007feea2e25fa8 R15: 00007feea2e25fa0 Allocated by task 373: kasan_save_stack mm/kasan/common.c:46 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:53 kasan_save_alloc_info+0x1f/0x30 mm/kasan/generic.c:505 ____kasan_kmalloc mm/kasan/common.c:380 [inline] __kasan_kmalloc+0x95/0xb0 mm/kasan/common.c:389 kasan_kmalloc include/linux/kasan.h:212 [inline] __do_kmalloc_node mm/slab_common.c:938 [inline] __kmalloc+0xb4/0x1e0 mm/slab_common.c:951 kmalloc include/linux/slab.h:568 [inline] kzalloc include/linux/slab.h:699 [inline] l2tp_session_create+0x38/0xbd0 net/l2tp/l2tp_core.c:1614 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:771 __sys_connect_file net/socket.c:2001 [inline] __sys_connect+0x3da/0x460 net/socket.c:2018 __do_sys_connect net/socket.c:2028 [inline] __se_sys_connect net/socket.c:2025 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:2025 x64_sys_call+0x88d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:43 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Freed by task 373: kasan_save_stack mm/kasan/common.c:46 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:53 kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:516 ____kasan_slab_free+0x132/0x180 mm/kasan/common.c:242 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:250 kasan_slab_free include/linux/kasan.h:178 [inline] slab_free_hook mm/slub.c:1750 [inline] slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1776 slab_free mm/slub.c:3712 [inline] __kmem_cache_free+0xb7/0x1b0 mm/slub.c:3728 kfree+0x6f/0xf0 mm/slab_common.c:990 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline] l2tp_session_put+0xaf/0x1a0 net/l2tp/l2tp_core.c:193 l2tp_session_delete+0x3df/0x4d0 net/l2tp/l2tp_core.c:1587 pppol2tp_release+0x169/0x2b0 net/l2tp/l2tp_ppp.c:438 __sock_release net/socket.c:652 [inline] sock_close+0xc9/0x220 net/socket.c:1390 __fput+0x1fd/0x8f0 fs/file_table.c:320 ____fput+0x15/0x20 fs/file_table.c:348 task_work_run+0x1e1/0x250 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0x9b/0xb0 kernel/entry/common.c:177 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 The buggy address belongs to the object at ffff88811278a800 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 336 bytes inside of 512-byte region [ffff88811278a800, ffff88811278aa00) The buggy address belongs to the physical page: page:ffffea000449e200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112788 head:ffffea000449e200 order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head|zone=1) raw: 4000000000010200 0000000000000000 dead000000000001 ffff888100042f00 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 113, tgid 113 (udevd), ts 5943923331, free_ts 0 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1f5/0x210 mm/page_alloc.c:2673 prep_new_page+0x1c/0x110 mm/page_alloc.c:2680 get_page_from_freelist+0x2ca9/0x2d20 mm/page_alloc.c:4587 __alloc_pages+0x1fa/0x610 mm/page_alloc.c:5931 alloc_slab_page+0x6e/0xf0 include/linux/gfp.h:-1 allocate_slab mm/slub.c:1967 [inline] new_slab+0x98/0x3e0 mm/slub.c:2020 ___slab_alloc+0x70f/0xb70 mm/slub.c:3177 __slab_alloc+0x5e/0xa0 mm/slub.c:3263 slab_alloc_node mm/slub.c:3348 [inline] __kmem_cache_alloc_node+0x204/0x2d0 mm/slub.c:3423 __do_kmalloc_node mm/slab_common.c:937 [inline] __kmalloc_node_track_caller+0xa1/0x1e0 mm/slab_common.c:958 kmalloc_reserve net/core/skbuff.c:449 [inline] __alloc_skb+0x226/0x4a0 net/core/skbuff.c:518 alloc_skb include/linux/skbuff.h:1322 [inline] alloc_skb_with_frags+0xa8/0x620 net/core/skbuff.c:6189 sock_alloc_send_pskb+0x87f/0x9a0 net/core/sock.c:2770 unix_dgram_sendmsg+0x5c1/0x1710 net/unix/af_unix.c:1959 sock_sendmsg_nosec net/socket.c:716 [inline] __sock_sendmsg net/socket.c:728 [inline] sock_write_iter+0x2ea/0x3f0 net/socket.c:1134 call_write_iter include/linux/fs.h:2282 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x5ef/0xd00 fs/read_write.c:584 page_owner free stack trace missing Memory state around the buggy address: ffff88811278a800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88811278a880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88811278a900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88811278a980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88811278aa00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:102 [inline] BUG: KASAN: use-after-free in atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:1779 [inline] BUG: KASAN: use-after-free in __mutex_trylock_fast kernel/locking/mutex.c:176 [inline] BUG: KASAN: use-after-free in mutex_lock+0x86/0x1b0 kernel/locking/mutex.c:295 Write of size 8 at addr ffff88811278a950 by task syz.2.17/373 CPU: 1 PID: 373 Comm: syz.2.17 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:88 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106 print_address_description+0x71/0x200 mm/kasan/report.c:316 print_report+0x4a/0x60 mm/kasan/report.c:420 kasan_report+0x122/0x150 mm/kasan/report.c:524 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189 __kasan_check_write+0x14/0x20 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:102 [inline] atomic_long_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:1779 [inline] __mutex_trylock_fast kernel/locking/mutex.c:176 [inline] mutex_lock+0x86/0x1b0 kernel/locking/mutex.c:295 pppol2tp_release+0x178/0x2b0 net/l2tp/l2tp_ppp.c:441 __sock_release net/socket.c:652 [inline] sock_close+0xc9/0x220 net/socket.c:1390 __fput+0x1fd/0x8f0 fs/file_table.c:320 ____fput+0x15/0x20 fs/file_table.c:348 task_work_run+0x1e1/0x250 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0x9b/0xb0 kernel/entry/common.c:177 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7feea2ba94d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffdf52fe938 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffdf52fea20 RCX: 00007feea2ba94d9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00000000000071ab R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b33020000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007feea2e25fac R14: 00007feea2e25fa8 R15: 00007feea2e25fa0 Allocated by task 373: kasan_save_stack mm/kasan/common.c:46 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:53 kasan_save_alloc_info+0x1f/0x30 mm/kasan/generic.c:505 ____kasan_kmalloc mm/kasan/common.c:380 [inline] __kasan_kmalloc+0x95/0xb0 mm/kasan/common.c:389 kasan_kmalloc include/linux/kasan.h:212 [inline] __do_kmalloc_node mm/slab_common.c:938 [inline] __kmalloc+0xb4/0x1e0 mm/slab_common.c:951 kmalloc include/linux/slab.h:568 [inline] kzalloc include/linux/slab.h:699 [inline] l2tp_session_create+0x38/0xbd0 net/l2tp/l2tp_core.c:1614 pppol2tp_connect+0xbf5/0x1640 net/l2tp/l2tp_ppp.c:771 __sys_connect_file net/socket.c:2001 [inline] __sys_connect+0x3da/0x460 net/socket.c:2018 __do_sys_connect net/socket.c:2028 [inline] __se_sys_connect net/socket.c:2025 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:2025 x64_sys_call+0x88d/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:43 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Freed by task 373: kasan_save_stack mm/kasan/common.c:46 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:53 kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:516 ____kasan_slab_free+0x132/0x180 mm/kasan/common.c:242 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:250 kasan_slab_free include/linux/kasan.h:178 [inline] slab_free_hook mm/slub.c:1750 [inline] slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1776 slab_free mm/slub.c:3712 [inline] __kmem_cache_free+0xb7/0x1b0 mm/slub.c:3728 kfree+0x6f/0xf0 mm/slab_common.c:990 l2tp_session_free net/l2tp/l2tp_core.c:168 [inline] l2tp_session_put+0xaf/0x1a0 net/l2tp/l2tp_core.c:193 l2tp_session_delete+0x3df/0x4d0 net/l2tp/l2tp_core.c:1587 pppol2tp_release+0x169/0x2b0 net/l2tp/l2tp_ppp.c:438 __sock_release net/socket.c:652 [inline] sock_close+0xc9/0x220 net/socket.c:1390 __fput+0x1fd/0x8f0 fs/file_table.c:320 ____fput+0x15/0x20 fs/file_table.c:348 task_work_run+0x1e1/0x250 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0x9b/0xb0 kernel/entry/common.c:177 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 The buggy address belongs to the object at ffff88811278a800 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 336 bytes inside of 512-byte region [ffff88811278a800, ffff88811278aa00) The buggy address belongs to the physical page: page:ffffea000449e200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112788 head:ffffea000449e200 order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head|zone=1) raw: 4000000000010200 0000000000000000 dead000000000001 ffff888100042f00 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 113, tgid 113 (udevd), ts 5943923331, free_ts 0 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1f5/0x210 mm/page_alloc.c:2673 prep_new_page+0x1c/0x110 mm/page_alloc.c:2680 get_page_from_freelist+0x2ca9/0x2d20 mm/page_alloc.c:4587 __alloc_pages+0x1fa/0x610 mm/page_alloc.c:5931 alloc_slab_page+0x6e/0xf0 include/linux/gfp.h:-1 allocate_slab mm/slub.c:1967 [inline] new_slab+0x98/0x3e0 mm/slub.c:2020 ___slab_alloc+0x70f/0xb70 mm/slub.c:3177 __slab_alloc+0x5e/0xa0 mm/slub.c:3263 slab_alloc_node mm/slub.c:3348 [inline] __kmem_cache_alloc_node+0x204/0x2d0 mm/slub.c:3423 __do_kmalloc_node mm/slab_common.c:937 [inline] __kmalloc_node_track_caller+0xa1/0x1e0 mm/slab_common.c:958 kmalloc_reserve net/core/skbuff.c:449 [inline] __alloc_skb+0x226/0x4a0 net/core/skbuff.c:518 alloc_skb include/linux/skbuff.h:1322 [inline] alloc_skb_with_frags+0xa8/0x620 net/core/skbuff.c:6189 sock_alloc_send_pskb+0x87f/0x9a0 net/core/sock.c:2770 unix_dgram_sendmsg+0x5c1/0x1710 net/unix/af_unix.c:1959 sock_sendmsg_nosec net/socket.c:716 [inline] __sock_sendmsg net/socket.c:728 [inline] sock_write_iter+0x2ea/0x3f0 net/socket.c:1134 call_write_iter include/linux/fs.h:2282 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x5ef/0xd00 fs/read_write.c:584 page_owner free stack trace missing Memory state around the buggy address: ffff88811278a800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88811278a880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88811278a900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88811278a980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88811278aa00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================