last executing test programs: 15.046074732s ago: executing program 2 (id=833): openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000001980)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="14000000000000000100000001", @ANYRES32], 0x18}}], 0x1, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = dup(r2) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x9, 0x8, 0x7fe2, 0x1, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) pipe2$9p(&(0x7f0000000240), 0x0) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f00000001c0)=ANY=[]) 14.899940721s ago: executing program 2 (id=834): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000008000000001500000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002a00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x100002, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b7040000000000008500000043"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000500)='mm_lru_activate\x00', r2}, 0x10) write$cgroup_int(r0, &(0x7f0000000200), 0x43451) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x100002, 0x0) write$cgroup_int(r3, &(0x7f0000000200), 0x43451) 14.839326136s ago: executing program 2 (id=835): syz_mount_image$tmpfs(&(0x7f00000000c0), &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0xff, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r1}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000058"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r2}, 0x10) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x0) faccessat(r3, &(0x7f0000000000)='./file0\x00', 0x0) 14.838990276s ago: executing program 2 (id=836): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x100002, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000500)='mm_lru_activate\x00', r2}, 0x10) write$cgroup_int(r0, &(0x7f0000000200), 0x43451) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x100002, 0x0) write$cgroup_int(r3, &(0x7f0000000200), 0x43451) 14.838619786s ago: executing program 2 (id=837): socket$inet6_tcp(0xa, 0x1, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000100)=0x14) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x63}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket(0x1e, 0x4, 0x0) socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1, 0x4, 0x7fe4, 0x1, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r8}, 0x10) close(0x4) r9 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r9, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r9, 0x400455c8, 0x0) ioctl$sock_bt_hci(r2, 0x400448ca, 0x0) 11.351385829s ago: executing program 3 (id=855): pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) splice(r1, 0x0, r0, 0x0, 0x1, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0xb, 0x5, 0x2, 0x4, 0x5, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r2}, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r3}, 0x10) fcntl$setpipe(r0, 0x407, 0x100000) close_range(r0, 0xffffffffffffffff, 0x0) 11.252192206s ago: executing program 3 (id=856): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000000000406c256d0000000000000109022400010000000009040000010300000009210000000122050009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000540)={0x2c, &(0x7f0000000500)=ANY=[@ANYBLOB="000005"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0xff, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000008000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000280)={0x24, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="0003"], 0x0, 0x0}, 0x0) 9.070245608s ago: executing program 3 (id=857): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x17ef, 0x6085, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x400, 0x9, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) syz_usb_control_io(r0, &(0x7f0000000500)={0x2c, &(0x7f0000000080)={0x0, 0xd, 0x6, {0x6, 0x2, "91226466"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 9.069832538s ago: executing program 4 (id=858): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1, 0x4, 0x7fe2, 0x1, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000011c0), &(0x7f0000001200), 0x5, r0}, 0x38) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) capset(&(0x7f00000020c0)={0x19980330}, &(0x7f0000002100)) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) setrlimit(0x40000000000008, &(0x7f0000000000)) setsockopt$sock_linger(r2, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) sendto$inet6(r2, 0x0, 0x0, 0x404c080, &(0x7f00000001c0)={0xa, 0x4e20, 0x0, @empty}, 0x1c) 9.015301682s ago: executing program 4 (id=859): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r1 = memfd_create(&(0x7f0000000080)='\b\x9dF\xd8\b\xb3~u\xa5\"\xdc\xfdq\xf6c\r;\xfcO\x8c=\x81\xb1\x8aSpA\xd4\x98\x85D\x89>N\x8ar\x17O\x0fKR\xe2{mn\xcc\xbf2\xc0\xa7\x14\xd0\xd4\xfe/\x9e\xee\xe7\xd7E\xe9\t\x83\xdeNX\xec\xe66\x1b\x97\xe7\xe6\x97\xf9\xb3\xf6\xb9\v\xb5$\xee\x84\x1cn,B\xd5?\xe5E:+Pm\x1d\xb4\xb8', 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) splice(r2, 0x0, r1, &(0x7f0000000140), 0x4, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f00000000c0)='./bus\x00', 0x20081e, &(0x7f0000000040)={[{@nodelalloc}, {@grpid}, {@auto_da_alloc}]}, 0x1, 0x4ef, &(0x7f00000003c0)="$eJzs3U1vW1kZAODXzpeTyUwywywAAVOGgYKqOonbRlUXUFYIoUqILkFqQ+JGUew4ip3ShC7S/4BEJVaw5Aew7oo9GwQ7NmWBxEcEaiqxMLrXN6mb2k1oEjuKn0e6uvfcY/s9J849x36d+AQwsC5FxE5EjEbE/YiYys7nsi1ut7bkdi92Hy/u7T5ezEWzefefubQ+ORdt90m8lz1mISJ+9L2In+bejFvf2l5dqFTKG63i+Eyjuj5T39q+ulJdWC4vl9dKpfm5+dmb126UTq2vn1RHs6MvP//Dzrd+njRrMjvT3o/T1Or6yEGcxHBE/OAsgvXBUNaf0X43hHeSj4iPIuLT9PqfiqH02QQALrJmcyqaU+1lAOCiy6c5sFy+mOUCJiOfLxZbObyPYyJfqdUbVx7UNteWWrmy6RjJP1iplGezXOF0jOSS8lx6/KpcOlS+FhEfRsQvxsbTcnGxVlnq5wsfABhg7x2a//8z1pr/AYALrtDvBgAAPWf+B4DBY/4HgMFj/geAwWP+B4DBY/4HgMFj/geAgfLDO3eSrbmXff/10sOtzdXaw6tL5fpqsbq5WFysbawXl2u15fQ7e6pHPV6lVlufux6bj6a/vV5vzNS3tu9Va5trjXvp93rfK4/0pFcAwNt8+MmzP+ciYufWeLpF21oO5mq42PL9bgDQN0P9bgDQN1b7gsF1gvf40gNwQXRYovc1hYgYP3yy2Ww2z65JwBm7/AX5fxhUbfl/fwUMA0b+HwaX/D8MrmYzd9w1/+O4NwQAzjc5fqDL5/8fZfvfZh8O/GTp8C2enmWrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4HzbX/+3mK0FPhn5fLEY8X5ETMdI7sFKpTwbER9ExJ/GRsaS8lyf2wwAnFT+b7ls/a/LU59NHq4dzb0cS/cR8bNf3f3lo4VGY+OPyfl/HZxvPM3Ol/rRfgDgKPvzdLpveyP/Yvfx4v7Wy/b8/bsRUWjF39sdjb2D+MMxnO4LMRIRE//OZeWWXFvu4iR2nkTE5zv1PxeTaQ6ktfLp4fhJ7Pd7Gj//Wvx8WtfaJz+Lz51CW2DQPEvGn9udrr98XEr3na//QjpCnVw2/iUPtbiXjoGv4u+Pf0Ndxr9Lx41x/fffbx2Nv1n3JOKLwxH7sffaxp/9+Lku8T87Zvy/fOkrn3ara/464nJ0jt8ea6ZRXZ+pb21fXakuLJeXy2ul0vzc/OzNazdKM2mOeqb7bPCPW1c+6FaX9H+iS/zCEf3/+jH7/5v/3v/xV98S/5tf6xQ/Hx+/JX4yJ37jmPEXJn5X6FaXxF/q0v+jnv8rx4z//K/bbywbDgD0T31re3WhUilv9PJg/4VET4M6uAAHyW/NOWhGx4Pv9CrWaPxf92o23ylWtxHjNLJuwHlwcNFHxMt+NwYAAAAAAAAAAAAAAOioF/+x1O8+AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcHH9LwAA//89fM7W") r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000180)={'#! ', './bus'}, 0x9) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) dup3(r0, r3, 0x0) 8.860838052s ago: executing program 4 (id=861): syz_mount_image$ext4(&(0x7f0000000740)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x1810714, &(0x7f0000000240)={[{@norecovery}, {@nogrpid}, {@grpjquota_path}, {@bh}, {@prjquota}, {@usrjquota}, {@usrjquota}, {@inlinecrypt}, {@nolazytime}]}, 0xff, 0x468, &(0x7f0000000780)="$eJzs289vFFUcAPDvzG4BQdmKiIIgVTRp/NHSgsrBxGg08aCJiR7wWNtCkIUaWhMhjVZj8GhIvBuPJv4FnjwZ9WTiFY8mhoQoMQG9uGZ2Z0q77JbWbtlN9/NJBt6befve+3bmzb6dtxtA3xrK/kki7o6IyxFRaWSXFxhq/Hfj2vzk39fmJ5Oo1d78I6mXu35tfrKWK163I69zOI1IP03yRmJgabWz5y+cnqhWp8/l+dG5M++Nzp6/8PSpMxMnp09Onx0/duzokbHnnh1/pkWvf7u01jiz+K7v+3Bm/95X3770+uTxS+/8+E3W3z0HGsezONZa5+0MZYH/2fjbNB97vNONddm/tZtxJuVu94bVKkVEOR+cl6MSpbh58irxyidd7RywobJ79tb2hxdqwCaWRLd7AHRH8Uafff4ttjs09egJV19sfADK4r6Rb40j5UjzMgMb2P5QRBxf+OfLbIum5xC1Fs8NAADW67ts/vNUq/lfGnuWlNuZrw0NRsS9EbErIu6LiN0RcX9EvewDEfHgGtsfasrfOv9Mr/yvwFYpm/89n69tLZ//FbO/GCzluXvq8Q8kJ05Vpw/nf5PhGNia5cdaVV5U8fIvn7drf+n8L9uy9ou5YF7JlXLjAd22Ys/UxNxEpyalVz+O2FduFX+yuBKQRMTeiNi3tqp3FolTT3y9v12h28e/gg6sM9W+KiqZX4im+AvJyuuTo9uiOn14tLgqbvXTzxffaNf+uuLvgOz8b19+/TeVqPyVLF2vnV088MJq27j462dtP1OWV3/9L8qu/y3JW/U13S35vg8m5ubOjUVsSV6r55ftH7/52iJflM/iHz7Uevzvyl+Txf9QRGQX8YGIeDgiDubn7pGIeDQiDq0Q/w8vPfZuu2O9cP6nWt7/Fq//weXnf+2J0unvv23X/uruf0frqeF8T/3+dxvtu1PcRpuuZgAAANjE0vp345N0ZDGdpiMjje/w747taXVmdu7JEzPvn51qfId+MAbS4klXZcnz0LFkIa+xkR/PnxUXx4/kz42/KN1Vz49MzlSnuhw79LsdbcZ/5vdSt3sHbDi/14L+1Tz+0y71A7jzvP9D/zL+oX8Z/9C/Wo3/j5ry1gJgM6pVut0DoHvM/6F/Gf/Qv4x/6Evr+V3/RiXKK/x6X6JXEpH2RDd6JnGwh0ZTuQOju8s3JgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgA75LwAA///foPki") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800"/13, @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000008200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r4}, 0x10) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x13) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000680)={'bridge0\x00'}) r6 = socket$pppl2tp(0x18, 0x1, 0x1) r7 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r6, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r7, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r6) r8 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r6, &(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x2, 0x4}}, 0x2e) ioctl$PPPIOCGL2TPSTATS(r8, 0x80487436, &(0x7f0000005280)) getpeername$packet(0xffffffffffffffff, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x0) sendmsg$ETHTOOL_MSG_WOL_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x840}, 0xd4) 7.379333926s ago: executing program 4 (id=864): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000600)='./bus\x00', 0x1c14744, &(0x7f0000000100), 0xff, 0x490, &(0x7f0000000f40)="$eJzs3M9vFFUcAPDvTLf8VFoRf4AkVtHY+KOlBZSDHjSaeNBEowc81rYQZKGG1kQI0WIMHg2Jd+PRxL/Akyejnky8eNC7ISFKTAAvrpndmba77lT6cxf380kW3tt5M+99++btvr632wB61lD2TxJxR0T8EhEDjWxzgaHGfzeuXZi8ee3CZBK12hu/J/Vy169dmCyKFuftzDPDaUT6cZJX0mz23PlTE9Xq9Nk8Pzp3+t3R2XPnnzp5euLE9InpM+NHjx4+NPbM0+NHms47sso4s/iu7/tgZv/el9+6/Orksctvf/9V1t40P740jvUylAX+R62u9dij611Zh/1dW4wzqXS6NdyqvojIuqu/Pv4Hoi8WO28gXvqoo40DNlT2mr21/PB8DfgfS6LTLQA6o3ijz37/zR/9mzT16ApXn2/8ApTFfiN/NI5UFtYGNvIHMhQRx+b/+jx7RMs6RK3NugEAwFp9k81/nmya/+XzjzTuXVJuV743NBgRd0XE7oi4OyL2RMQ9EfWy90XE/Susv3Vr6N/7MOmVVQV2i7L537P53lbz/K+Y/cVgX567sx5/f3L8ZHX6YP4zGY7+rVl+rN3Fi0u8+NOnZfUvnf9lj6z+Yi6YX+RKpWWBbmpibmK9JqVXL0bsq7SLP1nYCUgiYm9E7FvZpXcViZOPf7m/rNB/x7+Mddhnqn0R8Vij/+ejJf5Csvz+5Oi2qE4fHG3cFX1t6vjhx0uvldW/pvjXQdb/O5rv/5YSA38mS/drZ1dex6VfPyndW62s8v7fkrxZ39Pdkj/3/sTc3NmxiC3JK/V80/Pji+cW+aJ8Fv/wgfbjf3d+Thb/AxGxP+LnYtg9mPfdQxHxcEQcWCb+71545J2yY93Q/1NtX/8W7v/B5v5feaLv1Ldfl9XfGn+S5xdLZP1/uJ4azp+pv/7ltpdct7w52/ISq72bAQAA4PaT1j8bn6QjC+k0HRlpfIZ/T+xIqzOzc08cn3nvzFTjM/SD0Z8W658DS9ZDx5L5/IqN/Hi+VlwcP5SvG3/Wtz1Jojo9MjlTnepw7NDrdpaM/8xv7RazI+K5TW0hsKF8Xwt6V+v4TzvUDmDzef+H3mX8Q+8y/qF3FeP/9SXPfdhSpmQvALjNef+H3mX8Q+9aGP8XO9sOYPN5/4ee1O5L8sXfOFjDV/7XlKgs8+39Lk0Uq6Pd0p5TSURsbBWRdkekpYnI/4hFt7Rn5YmbtVWeXllmdN9qojOvRwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOvtnwAAAP//aP7lHQ==") socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xa6856000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x80000000001, 0x4) connect$inet6(r3, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r3, &(0x7f0000000300)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee059853", 0xa9, 0x840, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1c, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x4c, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) r4 = socket$inet(0x2, 0x3, 0x2) getsockopt$inet_opts(r4, 0x0, 0xc, 0x0, &(0x7f0000000180)) getegid() r5 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000040)={'sit0\x00', &(0x7f0000000000)=@ethtool_rxfh_indir={0x39}}) mkdirat(0xffffffffffffff9c, 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000004280)={0x2020}, 0x2020) r6 = syz_open_procfs(0x0, &(0x7f00000009c0)='net/tcp6\x00') read$FUSE(r6, &(0x7f00000082c0)={0x2020}, 0x2020) 6.703285593s ago: executing program 3 (id=868): syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0) r0 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000900)={0x41, 0x4}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000040)={0x41}, 0x10) r3 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000280)={0x41}, 0x10) sendmsg$tipc(r3, &(0x7f0000000240)={&(0x7f0000000080), 0x10, 0x0}, 0x0) sendmsg$tipc(r3, &(0x7f0000000240)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x0, 0x4}}}, 0x10, 0x0}, 0x0) 6.639482908s ago: executing program 3 (id=869): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0xff, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES8=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005700000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x58, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r1, &(0x7f0000000440), 0x10) listen(r1, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000000)={0x28, 0x0, 0x0, @local}, 0x10) r3 = creat(&(0x7f0000000040)='./bus\x00', 0x0) ftruncate(r3, 0x800) r4 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(r2, r4, 0x0, 0x3) 6.638969978s ago: executing program 3 (id=870): socket$inet6_tcp(0xa, 0x1, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000100)=0x14) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x63}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket(0x1e, 0x4, 0x0) socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1, 0x4, 0x7fe4, 0x1, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r7}, 0x10) close(0x4) r8 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r8, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r8, 0x400455c8, 0x0) ioctl$sock_bt_hci(r2, 0x400448ca, 0x0) 6.503719947s ago: executing program 4 (id=873): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$SMC_PNETID_GET(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0xff, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r4}, 0x10) getsockname$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000840)=ANY=[@ANYBLOB="3c00000010003704feff00"/20, @ANYRES32=r5, @ANYBLOB="0b120500000000001c0012800b00010069703667726500000c00028008000100", @ANYRES32=r5], 0x3c}}, 0x0) sendmmsg$inet(r0, &(0x7f00000017c0)=[{{&(0x7f0000000040)={0x2, 0x4e1c, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0, 0x0, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r5, @empty, @multicast1}}}], 0x20}}], 0x1, 0x0) 6.161735221s ago: executing program 4 (id=875): socket$inet6_tcp(0xa, 0x1, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000100)=0x14) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x63}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket(0x1e, 0x4, 0x0) socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1, 0x4, 0x7fe4, 0x1, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r8}, 0x10) close(0x4) r9 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r9, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r9, 0x400455c8, 0x0) ioctl$sock_bt_hci(r2, 0x400448ca, 0x0) 3.239488355s ago: executing program 0 (id=884): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000080"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) close(r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r1, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000080)=r0}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) creat(&(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='9p_protocol_dump\x00', r5}, 0x10) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f0000000180)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r4}}) 3.207065747s ago: executing program 0 (id=885): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0xc9d7, 0x9, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000000)={{r0, 0xffffffffffffffff}, &(0x7f0000000580), &(0x7f00000005c0)}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x18, 0xd, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000650000000800000095"], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x3a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1341, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) writev(r3, &(0x7f0000000800)=[{&(0x7f0000000000)="8900002cba180000000000000000", 0xe}], 0x1) 3.089654535s ago: executing program 0 (id=886): socket$nl_route(0x10, 0x3, 0x0) syz_mount_image$f2fs(&(0x7f0000000000), &(0x7f0000000080)='./bus\x00', 0x0, &(0x7f00000069c0)=ANY=[@ANYBLOB="6c617a7974696d652c6e6f696e6c696e655f78617474722c6c617a7974696d652c6e6f626172726965722c6163746976655f6c6f67733d342c757365725f78617474722c6d6f64653d6c66732c616c6c6f635f6d6f64653d64656661756c742c00be9ee044c45511e65887f6fac9eba6d787c3684a836f23dbf8ad3dd5931c08b4d8bde7e8acbbf3bf3326f2faa5952a332ad2ced40c98a2affa2dad4d623f9ff3ffa81e45095548ab6200f069d0f63d20fd71d3043b0dd5c4cf9785f3f531abc19bc1678f5e0b33006bd1049ca45fd8500d67a5aa6e1c23d900000000007867738729e703bb122283fb2fae9813a0cfefcdf3dc968af1cf80e96649d943198a96d9b1af9c91506b30922be8537f54e65cf60c6b6a5798955796aea325770d6ccc93a95fad93b2c7bad114fcbc55036a301c23b07073c71555791db8919235022bb0ee4294211ab9b43f3fbedecd223722d937aa22b31e2e9c97e5ea94e4ab83d4e5811c7556813c334aec856af0a0c12b3c93ba5aa906c6e2268a0c6cbbb13f496d87c608604eb02b2c031d5ae40c75"], 0x1, 0x551b, &(0x7f0000000400)="$eJzs3E1rY9UfB/CTPs7Tf/5FXLibC4PQwiQ0fRh0V3UGH7BD8WHhStMkDZlJckuTprUrFy7Fhe9EFFy59DW4cO1OXCjuhJHccypTH0Bp2tjp5wO333tPTn73nEtpOfeGBODSWsh++akUboarIYTpEMKNEIr9UtoKGzGeCyHcCiFMPbGVUvvvDXMhhGshhJuj4rFmKb302Z3h7fUf3/j562/nZ65//tV3k5s1MGnPhxC6u3H/oBszb8V8mNprw3aR3bVhyvhC91E6zmMeNLeLCge14361IldbsX++u98f5U6nVh9lq71TtO/24gn7w9ZxneIND2t7xXGjuV1ku58X2TqK4zo8in/bjvqDWKeR6n1YlA+DwXHG9uZhM85n91GR9d4gtce6eaN5OMphynS6UM87jWIc26e50v9tb7Z7+4fZsLnXb+e9bL1SfaFSvVuu7uWN5qC5Vq51G3fXssVWZ9StPGjWuhutPG91mpV63l3KFlv1erlazRbvNbfbtV5WrVZWK8vl9aW0dyd79cG7WaeRLY7y5XZvf9Du9LOdfC+L71jKViqrLy5lt6vZ25tb2dZb9+9vbr3z/r33Hry0+forqdOfhpUtriyvrJSry+WV6tLFnf/of/2/mv/HadBjnD+cSmnSAwC4eKz/gUm46Ov/YP0/Ftb/l3b+j5PTXUAuN+t/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIBL6/vZL14rdhbi8fXU/r/U9Ew6LoUQpkIIj//CdJg7UXM61Zn9m/6zfxjDN6VQVBidYz5t10IIG2n79f9nfRUAAADg6fXlR7c+jav1+GNh0gPiPMWbNlM3PhhTvVIIYXbhhzFUCelmU3j29KOKRr/fM+FwTNWKG1hXxlQs3nKbGVe1f2T6RFx5Ikoxpo57zp3ruAAAgLN0ciVwvqsQAAAAztMnkx4Ak1E8aU2fxU+P+eZjpAeCV08cAQAAABdQadIDAAAAAM5csf73/X8AAADwdIvf/wcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPAbO3eTkzoUBQD4tND3eD9GYpy7FWewDJfg0KFhKywBt+AGWAPOXIIBQ3tRMRhM+hfJ9yXt5TbN4ZTQwTm3KQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAG16KhbTh/urUd046009zVwNAAAAcMiqWEzLD+Nq/i8dP0uHLtI8i4g8Ig7V7oP4tRdzkOIUX5xffMrhMaKMsP2O32n7GxHXaXs5b/tXAAAAgNO1nM0nVbVe7cZ9J0SXqqZN/v+moXhZRBTj54ai5dvd5bdO3RzvD23/38O4q59WqWxg1X5kZqdsuQ2binbcIN3ub8Pow5BVQ95dOgAAQFf2K4EOqxAAAAA6dtt3AvQji91S5m4tuHzy/n1B8M/eDAAAAPiBsr4TAAAAAFpX1v/e/wcAAACnrXr/HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAG1aFYvpcjaf1I2z3tTTzNUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvLI/7ygMw2AQBjeJ8uqELuD739Is2K1bNzMg+Pi3EgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAlcfx8jzj1ZjJNnqdSd49rySfTo1vp8avc+OfZKy7fwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwsz8vKRACQRAFc8b/Tvr+h5UEPYMIEdDwqKIWDQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfNHvfvk/MTXOJHOnjaXjkWTtqrF11dh70Dh6MN7+DQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwsXPvvHFUUQCAz74mD0AYg1wYISJRQEOcTUhISwGyKPgJSJazCYYNj8QFiSIkN3TIdRoEJUJIINPlP6ROJDehS+EiSFQUoHnZN4slNok8s4m/T7pzz4zGc88dW5bPzPUCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUNt5by/u5Zu5Mu5Wx+48uLGa93cn+tytze3FvOVxZ9+rDw4u8dn3WrrTWWgvEQAAAA6PXl3fR2Qx2FrOg+5cUf/vFul5zf/DC2Vc1/OTdX/d17V/3n7/7f4ruwPNlePkF724Nh6d+m8q/QOc5kx78X/P6Bd3vnj20iu+Id0PN17eGRT3s/Pd7dvvZ0V4pIlsAYDHcbLuq6D+eyjvh20mBsCh0U8K73tV/d+bazcnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgCZkG/FcHXciYrG/F+fuPrixWvQT+7c2txfrdu7mzc30mvklBhFxcW08OtXURJ4CV69d/2xlPB5daT54PSLaG70KPp7inIg2MxQ8adCtftan+6oTEdF+zu0HLf9iAgDgmZAl8aBqeV1/b7C1nB/rzEf88+PD9f+bSRxp/T/Rp/X//U/O3UnHTev/4YHP8umxtH75y6Wr166/vXZ55dLo0ujzd04P3x2eOX/27Pml4lnJkicmAAAAPJmsamn9352P2Jl4/388iWOa+v/o9uJX3w+/Scfqqf/3tffSr+1MAAAADreXTvz1Z2ef450si69X1tevDMvt7v7pcttCqo/sSNXS+r8333ZWAAAAQBN2NjoPvf+/EOUC/kdZ///8T6/+kl6zFxHHqvf/J1e/GF9odEZt+Huqs5r4d+IDnyoAAAAz7VjV0vf/g2L9f3d3yUM3It56o4yrjwGcqv7vffDtz+lY6fr/M81NcSZ1F8r7UfQLEf2FtjMCAADgWXa0anmx/8dga/nTX49/lFn/DwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANC0fwMAAP//tMZEJA==") inotify_init() mkdir(&(0x7f0000000000)='./file0\x00', 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000040)='./file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) syz_mount_image$ext4(&(0x7f0000000500)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x80, &(0x7f0000000240), 0x1, 0x50d, &(0x7f0000000980)="$eJzs3WFrI2kdAPD/TJJed7dncypynnh3eCfdQzdpr95dEbk7QfTVgXq+79U2LaVpU5p03ZZFu/gBBBEVfOUr3wh+AEH2I4iwoO9FRRHd1Ze6I0mmum2TNrttmrX9/WCa58kzM///MzSTmczDTACX1ssR8W5EFCLitYiYzN9P82m+Xdnrzvfg/u3F9pRElr3/tySS/L39dbXrxYi41l0kxiPi61+J+GZyNG5zZ3dtoV6vbeX1amt9s9rc2b2xur6wUlupbczOzrw599bcG3PTWe5U/SxHxNtf+tMPv/ezL7/9q89+6/fzf7n+7XZaX/hY8ok8vcVTBeiju+5SZ1vsa2+jrWEEG4FC3p9SYdSZAAAwiPYx/ocj4lOd4//JKHSO5gAAAICLJHtnIv6VRGQAAADAhZVGxEQkaSUfCzARaVqpdMfwfjSupvVGs/WZ5cb2xlK7LaIcpXR5tV6bzscKl6OUtOsz+Rjb/frrh+qzEfFcRPxg8kqnXlls1JdG/eMHAAAAXBLXXjp4/v/PybRTBgAAAC6Yct8KAAAAcFE45QcAAICL786oEwAAAACG6avvvdeesv3neC/d3Nlea9y8sVRrrlXWtxcri42tzcpKo7HSuWff+knrqzcam5+Lje1b1Vat2ao2d3bn1xvbG6351QOPwAYAAADO0XMv3f1dEhF7n7/SmSK/DyDAAX8cdQLAWSqMOgFgZIrtPx+MOgtgFEonzlE8lzyA0UlOaO87eOfXZ58LAAAwHFMfP3r9fyxvO/m3AeD/mbE+AHD5uLoHl1cpCk7z4ZL7UPflmX7tj3/9//CRRZY9UWIAAMCZmehMSVrJrwVORJpWKhHPdh4LWEqWV+u16fz84LeTpWfa9ZnOksmJY4YBAAAAAAAAAAAAAAAAAAAAAAAAgK4sSyIDAAAALrSI9M9J527+EVOTr04c/HXg0FO/fvL+j24ttFpbMxFjyd8n22+NRUTrx/n7r2ceCQAAAABPge55ev46M+psAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALhoHty/vbg/HWgYH27cv34xIsq94hfz0ONRioir/0ii+MhySUQUziD+3p2IeL5X/CQeZllWzrPoFf/KkOOXO5umd/w0Iq6dQXy4zO629z/v9vr8pfFy57X356+YT6fVf/+X/nf/V+iz/3l2wBgv3PtFtW/8OxEvFHvvf/bjJ934SRyK/8qA8T/4xu5uv7bspxFTPb9/kgOxqq31zWpzZ/fG6vrCSm2ltjE7O/Pm3Ftzb8xNV5dX67X8b88Y3//kLx8e1/+rfeKXD/b/yPZ/dcD+//verfsf6RZLveJff6X39+/zfeKn+Xffp/Nyu31qv7zXLT/qxZ//5sXj+r/Up//jJ/T/+oD9f+1r3/3DgLMCAOegubO7tlCv17aOKYwPMM85F955OtIYUuEp3ODDLmTf6f4/nm49p1z8SCE7zeLFOIM0xh7jc3q2hVHulQAAgGH430F/u5Ylo84HAAAAAAAAAAAAAAAAAAAALqMnvEPYeEQMPPPhmHuj6SoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwLH+EwAA//+uy9et") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000003680)='sched_switch\x00', r2}, 0x10) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x1000f4) creat(&(0x7f0000000340)='./file0/file0\x00', 0x0) chdir(&(0x7f0000000140)='./bus\x00') openat$dir(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000005940)=ANY=[@ANYBLOB="2c0000002000010000000000000000000a00000000"], 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x40000) timerfd_create(0x0, 0x80800) 3.065613437s ago: executing program 2 (id=877): socket$inet6_tcp(0xa, 0x1, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000100)=0x14) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x63}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket(0x1e, 0x4, 0x0) socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1, 0x4, 0x7fe4, 0x1, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000181100", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r8}, 0x10) close(0x4) r9 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r9, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r9, 0x400455c8, 0x0) ioctl$sock_bt_hci(r2, 0x400448ca, 0x0) 1.885043709s ago: executing program 0 (id=888): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000600)='./bus\x00', 0x1c14744, &(0x7f0000000100), 0xff, 0x490, &(0x7f0000000f40)="$eJzs3M9vFFUcAPDvTLf8VFoRf4AkVtHY+KOlBZSDHjSaeNBEowc81rYQZKGG1kQI0WIMHg2Jd+PRxL/Akyejnky8eNC7ISFKTAAvrpndmba77lT6cxf380kW3tt5M+99++btvr632wB61lD2TxJxR0T8EhEDjWxzgaHGfzeuXZi8ee3CZBK12hu/J/Vy169dmCyKFuftzDPDaUT6cZJX0mz23PlTE9Xq9Nk8Pzp3+t3R2XPnnzp5euLE9InpM+NHjx4+NPbM0+NHms47sso4s/iu7/tgZv/el9+6/Orksctvf/9V1t40P740jvUylAX+R62u9dij611Zh/1dW4wzqXS6NdyqvojIuqu/Pv4Hoi8WO28gXvqoo40DNlT2mr21/PB8DfgfS6LTLQA6o3ijz37/zR/9mzT16ApXn2/8ApTFfiN/NI5UFtYGNvIHMhQRx+b/+jx7RMs6RK3NugEAwFp9k81/nmya/+XzjzTuXVJuV743NBgRd0XE7oi4OyL2RMQ9EfWy90XE/Susv3Vr6N/7MOmVVQV2i7L537P53lbz/K+Y/cVgX567sx5/f3L8ZHX6YP4zGY7+rVl+rN3Fi0u8+NOnZfUvnf9lj6z+Yi6YX+RKpWWBbmpibmK9JqVXL0bsq7SLP1nYCUgiYm9E7FvZpXcViZOPf7m/rNB/x7+Mddhnqn0R8Vij/+ejJf5Csvz+5Oi2qE4fHG3cFX1t6vjhx0uvldW/pvjXQdb/O5rv/5YSA38mS/drZ1dex6VfPyndW62s8v7fkrxZ39Pdkj/3/sTc3NmxiC3JK/V80/Pji+cW+aJ8Fv/wgfbjf3d+Thb/AxGxP+LnYtg9mPfdQxHxcEQcWCb+71545J2yY93Q/1NtX/8W7v/B5v5feaLv1Ldfl9XfGn+S5xdLZP1/uJ4azp+pv/7ltpdct7w52/ISq72bAQAA4PaT1j8bn6QjC+k0HRlpfIZ/T+xIqzOzc08cn3nvzFTjM/SD0Z8W658DS9ZDx5L5/IqN/Hi+VlwcP5SvG3/Wtz1Jojo9MjlTnepw7NDrdpaM/8xv7RazI+K5TW0hsKF8Xwt6V+v4TzvUDmDzef+H3mX8Q+8y/qF3FeP/9SXPfdhSpmQvALjNef+H3mX8Q+9aGP8XO9sOYPN5/4ee1O5L8sXfOFjDV/7XlKgs8+39Lk0Uq6Pd0p5TSURsbBWRdkekpYnI/4hFt7Rn5YmbtVWeXllmdN9qojOvRwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOvtnwAAAP//aP7lHQ==") socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xa6856000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x80000000001, 0x4) connect$inet6(r3, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r3, &(0x7f0000000300)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee059853", 0xa9, 0x840, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1c, 0x0, 0x0, &(0x7f0000000200)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x4c, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) r4 = socket$inet(0x2, 0x3, 0x2) getsockopt$inet_opts(r4, 0x0, 0xc, 0x0, &(0x7f0000000180)) getegid() r5 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000040)={'sit0\x00', &(0x7f0000000000)=@ethtool_rxfh_indir={0x39}}) mkdirat(0xffffffffffffff9c, 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000004280)={0x2020}, 0x2020) r6 = syz_open_procfs(0x0, &(0x7f00000009c0)='net/tcp6\x00') read$FUSE(r6, &(0x7f00000082c0)={0x2020}, 0x2020) 1.705309432s ago: executing program 0 (id=889): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f00000003c0)='sched_switch\x00', r3}, 0x10) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x12, 0x2, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r5}, &(0x7f0000000040), &(0x7f0000000140)=r4}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r7, &(0x7f0000003280)={0x0, 0x0, 0x0}, 0x0) sendmsg$tipc(r7, &(0x7f0000000e40)={0x0, 0x0, 0x0}, 0x0) sendmsg$inet(r7, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)=[{0x0}], 0x1}, 0x0) sendmsg$tipc(r7, &(0x7f0000002700)={0x0, 0x0, 0x0}, 0x0) setsockopt$sock_attach_bpf(r6, 0x1, 0x21, &(0x7f0000000040), 0x4) sendmsg$tipc(r7, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) close(r7) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x4, [@struct={0x2, 0x1, 0x0, 0xf, 0x0, 0x7fffff, [{0x6}]}]}, {0x0, [0x0, 0x2e]}}, 0x0, 0x34, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) 1.351586576s ago: executing program 1 (id=894): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000004c0)={{{@in6=@private0, @in, 0x0, 0x0, 0x0, 0x0, 0x2}}, {{@in=@multicast1, 0x0, 0x2b}, 0x0, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x3}}, 0xe8) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x400, 0x9, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000004c0)={r1, &(0x7f0000000340), &(0x7f00000005c0)=""/155}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r2}, 0x10) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000680)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) 1.255301043s ago: executing program 1 (id=895): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0x6, 0xffffffff, 0x1, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r0}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1, 0x4, 0x7fe2, 0x1, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000300)='fib_table_lookup\x00', r3}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000300)='fib_table_lookup\x00', r1}, 0x10) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000280)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) 1.254828443s ago: executing program 1 (id=896): openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0x8, 0xc, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0xe) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0xb, 0x10, &(0x7f0000000740)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000020000006b8a00fe00000000c7080000010000007b8af0ff00000000bda100000000000007000000f8ffffffbfa400000000000007040000f0ffffffb7020000080000fa18230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b704000008000000850000001a00000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000000000000000000000000000850000001900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r1, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) 1.106632193s ago: executing program 1 (id=897): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000002140), 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000925e850000000700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$TOKEN_CREATE(0x24, &(0x7f0000000200)={0x0, r1}, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x9, 0x7, 0x9, 0x1, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r2, 0xffffffffffffffff}, &(0x7f00000002c0), &(0x7f0000000280)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000d0039000000000000b4a518110000", @ANYRES32=r3], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000180)='tlb_flush\x00', r4}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc004ae0a, &(0x7f0000002180)=""/226) 1.071801696s ago: executing program 1 (id=898): socket$nl_route(0x10, 0x3, 0x0) syz_mount_image$f2fs(&(0x7f0000000000), &(0x7f0000000080)='./bus\x00', 0x0, &(0x7f00000069c0)=ANY=[@ANYBLOB="6c617a7974696d652c6e6f696e6c696e655f78617474722c6c617a7974696d652c6e6f626172726965722c6163746976655f6c6f67733d342c757365725f78617474722c6d6f64653d6c66732c616c6c6f635f6d6f64653d64656661756c742c00be9ee044c45511e65887f6fac9eba6d787c3684a836f23dbf8ad3dd5931c08b4d8bde7e8acbbf3bf3326f2faa5952a332ad2ced40c98a2affa2dad4d623f9ff3ffa81e45095548ab6200f069d0f63d20fd71d3043b0dd5c4cf9785f3f531abc19bc1678f5e0b33006bd1049ca45fd8500d67a5aa6e1c23d900000000007867738729e703bb122283fb2fae9813a0cfefcdf3dc968af1cf80e96649d943198a96d9b1af9c91506b30922be8537f54e65cf60c6b6a5798955796aea325770d6ccc93a95fad93b2c7bad114fcbc55036a301c23b07073c71555791db8919235022bb0ee4294211ab9b43f3fbedecd223722d937aa22b31e2e9c97e5ea94e4ab83d4e5811c7556813c334aec856af0a0c12b3c93ba5aa906c6e2268a0c6cbbb13f496d87c608604eb02b2c031d5ae40c75"], 0x1, 0x551b, &(0x7f0000000400)="$eJzs3E1rY9UfB/CTPs7Tf/5FXLibC4PQwiQ0fRh0V3UGH7BD8WHhStMkDZlJckuTprUrFy7Fhe9EFFy59DW4cO1OXCjuhJHccypTH0Bp2tjp5wO333tPTn73nEtpOfeGBODSWsh++akUboarIYTpEMKNEIr9UtoKGzGeCyHcCiFMPbGVUvvvDXMhhGshhJuj4rFmKb302Z3h7fUf3/j562/nZ65//tV3k5s1MGnPhxC6u3H/oBszb8V8mNprw3aR3bVhyvhC91E6zmMeNLeLCge14361IldbsX++u98f5U6nVh9lq71TtO/24gn7w9ZxneIND2t7xXGjuV1ku58X2TqK4zo8in/bjvqDWKeR6n1YlA+DwXHG9uZhM85n91GR9d4gtce6eaN5OMphynS6UM87jWIc26e50v9tb7Z7+4fZsLnXb+e9bL1SfaFSvVuu7uWN5qC5Vq51G3fXssVWZ9StPGjWuhutPG91mpV63l3KFlv1erlazRbvNbfbtV5WrVZWK8vl9aW0dyd79cG7WaeRLY7y5XZvf9Du9LOdfC+L71jKViqrLy5lt6vZ25tb2dZb9+9vbr3z/r33Hry0+forqdOfhpUtriyvrJSry+WV6tLFnf/of/2/mv/HadBjnD+cSmnSAwC4eKz/gUm46Ov/YP0/Ftb/l3b+j5PTXUAuN+t/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIBL6/vZL14rdhbi8fXU/r/U9Ew6LoUQpkIIj//CdJg7UXM61Zn9m/6zfxjDN6VQVBidYz5t10IIG2n79f9nfRUAAADg6fXlR7c+jav1+GNh0gPiPMWbNlM3PhhTvVIIYXbhhzFUCelmU3j29KOKRr/fM+FwTNWKG1hXxlQs3nKbGVe1f2T6RFx5Ikoxpo57zp3ruAAAgLN0ciVwvqsQAAAAztMnkx4Ak1E8aU2fxU+P+eZjpAeCV08cAQAAABdQadIDAAAAAM5csf73/X8AAADwdIvf/wcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPAbO3eTkzoUBQD4tND3eD9GYpy7FWewDJfg0KFhKywBt+AGWAPOXIIBQ3tRMRhM+hfJ9yXt5TbN4ZTQwTm3KQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAG16KhbTh/urUd046009zVwNAAAAcMiqWEzLD+Nq/i8dP0uHLtI8i4g8Ig7V7oP4tRdzkOIUX5xffMrhMaKMsP2O32n7GxHXaXs5b/tXAAAAgNO1nM0nVbVe7cZ9J0SXqqZN/v+moXhZRBTj54ai5dvd5bdO3RzvD23/38O4q59WqWxg1X5kZqdsuQ2binbcIN3ub8Pow5BVQ95dOgAAQFf2K4EOqxAAAAA6dtt3AvQji91S5m4tuHzy/n1B8M/eDAAAAPiBsr4TAAAAAFpX1v/e/wcAAACnrXr/HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAG1aFYvpcjaf1I2z3tTTzNUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvLI/7ygMw2AQBjeJ8uqELuD739Is2K1bNzMg+Pi3EgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAlcfx8jzj1ZjJNnqdSd49rySfTo1vp8avc+OfZKy7fwMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwsz8vKRACQRAFc8b/Tvr+h5UEPYMIEdDwqKIWDQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfNHvfvk/MTXOJHOnjaXjkWTtqrF11dh70Dh6MN7+DQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwsXPvvHFUUQCAz74mD0AYg1wYISJRQEOcTUhISwGyKPgJSJazCYYNj8QFiSIkN3TIdRoEJUJIINPlP6ROJDehS+EiSFQUoHnZN4slNok8s4m/T7pzz4zGc88dW5bPzPUCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUNt5by/u5Zu5Mu5Wx+48uLGa93cn+tytze3FvOVxZ9+rDw4u8dn3WrrTWWgvEQAAAA6PXl3fR2Qx2FrOg+5cUf/vFul5zf/DC2Vc1/OTdX/d17V/3n7/7f4ruwPNlePkF724Nh6d+m8q/QOc5kx78X/P6Bd3vnj20iu+Id0PN17eGRT3s/Pd7dvvZ0V4pIlsAYDHcbLuq6D+eyjvh20mBsCh0U8K73tV/d+bazcnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgCZkG/FcHXciYrG/F+fuPrixWvQT+7c2txfrdu7mzc30mvklBhFxcW08OtXURJ4CV69d/2xlPB5daT54PSLaG70KPp7inIg2MxQ8adCtftan+6oTEdF+zu0HLf9iAgDgmZAl8aBqeV1/b7C1nB/rzEf88+PD9f+bSRxp/T/Rp/X//U/O3UnHTev/4YHP8umxtH75y6Wr166/vXZ55dLo0ujzd04P3x2eOX/27Pml4lnJkicmAAAAPJmsamn9352P2Jl4/388iWOa+v/o9uJX3w+/Scfqqf/3tffSr+1MAAAADreXTvz1Z2ef450si69X1tevDMvt7v7pcttCqo/sSNXS+r8333ZWAAAAQBN2NjoPvf+/EOUC/kdZ///8T6/+kl6zFxHHqvf/J1e/GF9odEZt+Huqs5r4d+IDnyoAAAAz7VjV0vf/g2L9f3d3yUM3It56o4yrjwGcqv7vffDtz+lY6fr/M81NcSZ1F8r7UfQLEf2FtjMCAADgWXa0anmx/8dga/nTX49/lFn/DwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANC0fwMAAP//tMZEJA==") inotify_init() mkdir(&(0x7f0000000000)='./file0\x00', 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000040)='./file1\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) syz_mount_image$ext4(&(0x7f0000000500)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x80, &(0x7f0000000240), 0x1, 0x50d, &(0x7f0000000980)="$eJzs3WFrI2kdAPD/TJJed7dncypynnh3eCfdQzdpr95dEbk7QfTVgXq+79U2LaVpU5p03ZZFu/gBBBEVfOUr3wh+AEH2I4iwoO9FRRHd1Ze6I0mmum2TNrttmrX9/WCa58kzM///MzSTmczDTACX1ssR8W5EFCLitYiYzN9P82m+Xdnrzvfg/u3F9pRElr3/tySS/L39dbXrxYi41l0kxiPi61+J+GZyNG5zZ3dtoV6vbeX1amt9s9rc2b2xur6wUlupbczOzrw599bcG3PTWe5U/SxHxNtf+tMPv/ezL7/9q89+6/fzf7n+7XZaX/hY8ok8vcVTBeiju+5SZ1vsa2+jrWEEG4FC3p9SYdSZAAAwiPYx/ocj4lOd4//JKHSO5gAAAICLJHtnIv6VRGQAAADAhZVGxEQkaSUfCzARaVqpdMfwfjSupvVGs/WZ5cb2xlK7LaIcpXR5tV6bzscKl6OUtOsz+Rjb/frrh+qzEfFcRPxg8kqnXlls1JdG/eMHAAAAXBLXXjp4/v/PybRTBgAAAC6Yct8KAAAAcFE45QcAAICL786oEwAAAACG6avvvdeesv3neC/d3Nlea9y8sVRrrlXWtxcri42tzcpKo7HSuWff+knrqzcam5+Lje1b1Vat2ao2d3bn1xvbG6351QOPwAYAAADO0XMv3f1dEhF7n7/SmSK/DyDAAX8cdQLAWSqMOgFgZIrtPx+MOgtgFEonzlE8lzyA0UlOaO87eOfXZ58LAAAwHFMfP3r9fyxvO/m3AeD/mbE+AHD5uLoHl1cpCk7z4ZL7UPflmX7tj3/9//CRRZY9UWIAAMCZmehMSVrJrwVORJpWKhHPdh4LWEqWV+u16fz84LeTpWfa9ZnOksmJY4YBAAAAAAAAAAAAAAAAAAAAAAAAgK4sSyIDAAAALrSI9M9J527+EVOTr04c/HXg0FO/fvL+j24ttFpbMxFjyd8n22+NRUTrx/n7r2ceCQAAAABPge55ev46M+psAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALhoHty/vbg/HWgYH27cv34xIsq94hfz0ONRioir/0ii+MhySUQUziD+3p2IeL5X/CQeZllWzrPoFf/KkOOXO5umd/w0Iq6dQXy4zO629z/v9vr8pfFy57X356+YT6fVf/+X/nf/V+iz/3l2wBgv3PtFtW/8OxEvFHvvf/bjJ934SRyK/8qA8T/4xu5uv7bspxFTPb9/kgOxqq31zWpzZ/fG6vrCSm2ltjE7O/Pm3Ftzb8xNV5dX67X8b88Y3//kLx8e1/+rfeKXD/b/yPZ/dcD+//verfsf6RZLveJff6X39+/zfeKn+Xffp/Nyu31qv7zXLT/qxZ//5sXj+r/Up//jJ/T/+oD9f+1r3/3DgLMCAOegubO7tlCv17aOKYwPMM85F955OtIYUuEp3ODDLmTf6f4/nm49p1z8SCE7zeLFOIM0xh7jc3q2hVHulQAAgGH430F/u5Ylo84HAAAAAAAAAAAAAAAAAAAALqMnvEPYeEQMPPPhmHuj6SoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwLH+EwAA//+uy9et") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000003680)='sched_switch\x00', r2}, 0x10) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x1000f4) creat(&(0x7f0000000340)='./file0/file0\x00', 0x0) chdir(&(0x7f0000000140)='./bus\x00') openat$dir(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000005940)=ANY=[@ANYBLOB="2c0000002000010000000000000000000a00000000"], 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x40000) timerfd_create(0x0, 0x80800) 941.859875ms ago: executing program 0 (id=899): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000600)='./bus\x00', 0x1c14744, &(0x7f0000000100), 0xff, 0x490, &(0x7f0000000f40)="$eJzs3M9vFFUcAPDvTLf8VFoRf4AkVtHY+KOlBZSDHjSaeNBEowc81rYQZKGG1kQI0WIMHg2Jd+PRxL/Akyejnky8eNC7ISFKTAAvrpndmba77lT6cxf380kW3tt5M+99++btvr632wB61lD2TxJxR0T8EhEDjWxzgaHGfzeuXZi8ee3CZBK12hu/J/Vy169dmCyKFuftzDPDaUT6cZJX0mz23PlTE9Xq9Nk8Pzp3+t3R2XPnnzp5euLE9InpM+NHjx4+NPbM0+NHms47sso4s/iu7/tgZv/el9+6/Orksctvf/9V1t40P740jvUylAX+R62u9dij611Zh/1dW4wzqXS6NdyqvojIuqu/Pv4Hoi8WO28gXvqoo40DNlT2mr21/PB8DfgfS6LTLQA6o3ijz37/zR/9mzT16ApXn2/8ApTFfiN/NI5UFtYGNvIHMhQRx+b/+jx7RMs6RK3NugEAwFp9k81/nmya/+XzjzTuXVJuV743NBgRd0XE7oi4OyL2RMQ9EfWy90XE/Susv3Vr6N/7MOmVVQV2i7L537P53lbz/K+Y/cVgX567sx5/f3L8ZHX6YP4zGY7+rVl+rN3Fi0u8+NOnZfUvnf9lj6z+Yi6YX+RKpWWBbmpibmK9JqVXL0bsq7SLP1nYCUgiYm9E7FvZpXcViZOPf7m/rNB/x7+Mddhnqn0R8Vij/+ejJf5Csvz+5Oi2qE4fHG3cFX1t6vjhx0uvldW/pvjXQdb/O5rv/5YSA38mS/drZ1dex6VfPyndW62s8v7fkrxZ39Pdkj/3/sTc3NmxiC3JK/V80/Pji+cW+aJ8Fv/wgfbjf3d+Thb/AxGxP+LnYtg9mPfdQxHxcEQcWCb+71545J2yY93Q/1NtX/8W7v/B5v5feaLv1Ldfl9XfGn+S5xdLZP1/uJ4azp+pv/7ltpdct7w52/ISq72bAQAA4PaT1j8bn6QjC+k0HRlpfIZ/T+xIqzOzc08cn3nvzFTjM/SD0Z8W658DS9ZDx5L5/IqN/Hi+VlwcP5SvG3/Wtz1Jojo9MjlTnepw7NDrdpaM/8xv7RazI+K5TW0hsKF8Xwt6V+v4TzvUDmDzef+H3mX8Q+8y/qF3FeP/9SXPfdhSpmQvALjNef+H3mX8Q+9aGP8XO9sOYPN5/4ee1O5L8sXfOFjDV/7XlKgs8+39Lk0Uq6Pd0p5TSURsbBWRdkekpYnI/4hFt7Rn5YmbtVWeXllmdN9qojOvRwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOvtnwAAAP//aP7lHQ==") socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xa6856000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x80000000001, 0x4) connect$inet6(r3, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendto$inet6(r3, &(0x7f0000000300)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee059853", 0xa9, 0x840, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1c, 0x0, 0x0, &(0x7f0000000200)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x4c, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) r4 = socket$inet(0x2, 0x3, 0x2) getsockopt$inet_opts(r4, 0x0, 0xc, 0x0, &(0x7f0000000180)) getegid() r5 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000040)={'sit0\x00', &(0x7f0000000000)=@ethtool_rxfh_indir={0x39}}) mkdirat(0xffffffffffffff9c, 0x0, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000004280)={0x2020}, 0x2020) r6 = syz_open_procfs(0x0, &(0x7f00000009c0)='net/tcp6\x00') read$FUSE(r6, &(0x7f00000082c0)={0x2020}, 0x2020) 0s ago: executing program 1 (id=900): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18010000f1ffffff0000000000100000850000007b00000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='kmem_cache_free\x00', r0}, 0x10) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, 0x25, 0x0, @val=@kprobe_multi=@syms={0x0, 0x0, 0x0}}, 0x40) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000100)=0xc6, 0x4) setsockopt$inet6_udp_encap(r1, 0x11, 0x64, &(0x7f0000000780)=0x2, 0x4) bind$inet6(r1, &(0x7f0000000200)={0xa, 0xe22, 0x0, @empty}, 0x1c) syz_emit_ethernet(0xd2, &(0x7f0000000080)=ANY=[@ANYBLOB="ffffffffbfff00000000000086dd600489f1009c1100fc010000000000000025030000000000ff02000000000000000000000000000100000e22"], 0x0) kernel console output (not intermixed with test programs): audit(1726513922.490:507): avc: denied { execute } for pid=1668 comm="syz.0.474" path="/dev/bus/usb/006/001" dev="devtmpfs" ino=155 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 74.694075][ T1675] process 'syz.3.476' launched './file0' with NULL argv: empty string added [ 74.705486][ T30] audit: type=1400 audit(1726513922.550:508): avc: denied { mount } for pid=1674 comm="syz.3.476" name="/" dev="ramfs" ino=21217 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 74.736184][ T30] audit: type=1400 audit(1726513922.600:509): avc: denied { execute } for pid=1674 comm="syz.3.476" name="file0" dev="ramfs" ino=21218 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=file permissive=1 [ 74.765131][ T1663] EXT4-fs (loop1): mounted filesystem without journal. Opts: norecovery,nogrpid,grpjquota=,bh,prjquota,usrjquota=,usrjquota=,inlinecrypt,nolazytime,,errors=continue. Quota mode: writeback. [ 74.796275][ T30] audit: type=1400 audit(1726513922.600:510): avc: denied { execute_no_trans } for pid=1674 comm="syz.3.476" path="/12/file0/file0" dev="ramfs" ino=21218 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=file permissive=1 [ 74.820457][ T30] audit: type=1400 audit(1726513922.690:511): avc: denied { unmount } for pid=1457 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 74.948409][ T45] Bluetooth: hci0: Frame reassembly failed (-84) [ 75.376265][ T1688] syz.3.479[1688] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 75.376350][ T1688] syz.3.479[1688] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 75.427002][ T702] attempt to access beyond end of device [ 75.427002][ T702] loop4: rw=524288, want=45072, limit=40427 [ 75.472841][ T702] attempt to access beyond end of device [ 75.472841][ T702] loop4: rw=0, want=45072, limit=40427 [ 75.593696][ T8] attempt to access beyond end of device [ 75.593696][ T8] loop4: rw=2049, want=45120, limit=40427 [ 75.639714][ T1692] loop2: detected capacity change from 0 to 40427 [ 75.743546][ T1692] F2FS-fs (loop2): Invalid SB checksum offset: 0 [ 75.843531][ T1692] F2FS-fs (loop2): Can't find valid F2FS filesystem in 2th superblock [ 75.895126][ T1707] loop1: detected capacity change from 0 to 1024 [ 75.909909][ T380] device bridge_slave_1 left promiscuous mode [ 75.918549][ T380] bridge0: port 2(bridge_slave_1) entered disabled state [ 75.932919][ T380] device bridge_slave_0 left promiscuous mode [ 75.934555][ T1692] F2FS-fs (loop2): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 75.944403][ T380] bridge0: port 1(bridge_slave_0) entered disabled state [ 75.959878][ T380] device veth1_macvtap left promiscuous mode [ 75.965915][ T380] device veth0_vlan left promiscuous mode [ 75.967895][ T1707] EXT4-fs (loop1): Ignoring removed bh option [ 75.977900][ T1707] EXT4-fs (loop1): Ignoring removed oldalloc option [ 75.986012][ T1692] F2FS-fs (loop2): Try to recover 2th superblock, ret: 0 [ 75.993888][ T1692] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 76.006929][ T1692] overlayfs: missing 'lowerdir' [ 76.028889][ T1707] EXT4-fs (loop1): mounted filesystem without journal. Opts: stripe=0x0000000000000003,noauto_da_alloc,jqfmt=vfsold,bh,noauto_da_alloc,delalloc,resuid=0x0000000000000000,oldalloc,jqfmt=vfsv1,,errors=continue. Quota mode: none. [ 76.171862][ T1714] netlink: 16 bytes leftover after parsing attributes in process `syz.2.482'. [ 76.221540][ T1720] loop1: detected capacity change from 0 to 512 [ 76.236889][ T1716] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.244295][ T1716] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.252007][ T1716] device bridge_slave_0 entered promiscuous mode [ 76.258431][ T1720] EXT4-fs (loop1): Ignoring removed bh option [ 76.259679][ T1716] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.271378][ T1716] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.272568][ T1720] EXT4-fs error (device loop1): ext4_find_inline_data_nolock:164: inode #12: comm syz.1.491: inline data xattr refers to an external xattr inode [ 76.279105][ T1716] device bridge_slave_1 entered promiscuous mode [ 76.293047][ T1720] EXT4-fs error (device loop1): ext4_orphan_get:1402: comm syz.1.491: couldn't read orphan inode 12 (err -117) [ 76.311111][ T1720] EXT4-fs (loop1): mounted filesystem without journal. Opts: norecovery,nogrpid,grpjquota=,bh,prjquota,usrjquota=,usrjquota=,inlinecrypt,nolazytime,,errors=continue. Quota mode: writeback. [ 76.464756][ T1608] attempt to access beyond end of device [ 76.464756][ T1608] loop2: rw=2049, want=45120, limit=40427 [ 76.498648][ T1716] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.505522][ T1716] bridge0: port 2(bridge_slave_1) entered forwarding state [ 76.512680][ T1716] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.519550][ T1716] bridge0: port 1(bridge_slave_0) entered forwarding state [ 76.698230][ T26] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.714868][ T26] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.825057][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 76.843697][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 76.852044][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 76.860794][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 76.880320][ T1734] ------------[ cut here ]------------ [ 76.882870][ T26] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.893139][ T26] bridge0: port 1(bridge_slave_0) entered forwarding state [ 76.894364][ T1734] WARNING: CPU: 0 PID: 1734 at mm/page_alloc.c:5754 __alloc_pages+0x770/0x8f0 [ 76.900832][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 76.917576][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 76.918488][ T1734] Modules linked in: [ 76.925706][ T26] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.929158][ T1734] CPU: 0 PID: 1734 Comm: syz.2.493 Not tainted 5.15.161-syzkaller-00425-gb92c0d35d015 #0 [ 76.935956][ T26] bridge0: port 2(bridge_slave_1) entered forwarding state [ 76.953047][ T1734] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 [ 76.963267][ T1734] RIP: 0010:__alloc_pages+0x770/0x8f0 [ 76.968843][ T1734] Code: df e9 aa fb ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c ba fb ff ff e8 0f 13 05 00 48 ba 00 00 00 00 00 fc ff df e9 a6 fb ff ff <0f> 0b 45 31 e4 e9 73 fc ff ff 48 8d 4c 24 40 80 e1 07 80 c1 03 38 [ 76.975482][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 76.988499][ T1734] RSP: 0018:ffffc90000a57a20 EFLAGS: 00010246 [ 77.002480][ T1734] RAX: 0000000000000004 RBX: 0000000000040dc0 RCX: ffffc90000a57a03 [ 77.002535][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 77.018230][ T1734] RDX: dffffc0000000000 RSI: 0000000000000000 RDI: ffffc90000a57ab8 [ 77.018324][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 77.026027][ T1734] RBP: ffffc90000a57b30 R08: dffffc0000000000 R09: ffffc90000a57a90 [ 77.026043][ T1734] R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000000 [ 77.026057][ T1734] R13: 1ffff9200014af4c R14: 1ffff9200014af4e R15: 1ffff9200014af48 [ 77.026074][ T1734] FS: 00007fed0800b6c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 77.034189][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 77.054428][ T1734] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 77.067457][ T26] Bluetooth: hci0: command 0x1003 tx timeout [ 77.079373][ T1734] CR2: 00007f3e623daf98 CR3: 0000000122c53000 CR4: 00000000003506b0 [ 77.088042][ T442] Bluetooth: hci0: sending frame failed (-49) [ 77.095289][ T1734] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 77.117900][ T1734] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 77.125817][ T1734] Call Trace: [ 77.129335][ T1734] [ 77.132104][ T1734] ? show_regs+0x58/0x60 [ 77.136180][ T1734] ? __warn+0x160/0x2f0 [ 77.140559][ T1734] ? __alloc_pages+0x770/0x8f0 [ 77.145152][ T1734] ? report_bug+0x3d9/0x5b0 [ 77.150210][ T1734] ? __alloc_pages+0x770/0x8f0 [ 77.155048][ T1734] ? handle_bug+0x41/0x70 [ 77.160143][ T1734] ? exc_invalid_op+0x1b/0x50 [ 77.162520][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 77.164932][ T1734] ? asm_exc_invalid_op+0x1b/0x20 [ 77.178037][ T1734] ? __alloc_pages+0x770/0x8f0 [ 77.182687][ T1734] ? prep_new_page+0x110/0x110 [ 77.183441][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 77.187277][ T1734] ? do_vfs_ioctl+0xbc1/0x2a80 [ 77.187310][ T1734] kmalloc_order+0x4a/0x160 [ 77.187333][ T1734] kmalloc_order_trace+0x1a/0xb0 [ 77.187366][ T1734] __kmalloc+0x19c/0x270 [ 77.195864][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 77.199956][ T1734] input_mt_init_slots+0xcf/0xa50 [ 77.213493][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 77.221935][ T1734] ? mutex_lock_interruptible+0xb6/0x1e0 [ 77.226317][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 77.245506][ T1734] uinput_create_device+0x522/0x630 [ 77.250693][ T1734] uinput_ioctl_handler+0xa63/0x16a0 [ 77.251122][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 77.267266][ T1734] ? selinux_file_ioctl+0x3cc/0x540 [ 77.278766][ T1734] ? uinput_release+0x50/0x50 [ 77.283367][ T1716] device veth0_vlan entered promiscuous mode [ 77.285680][ T1734] ? __fget_files+0x31e/0x380 [ 77.293662][ T1734] uinput_ioctl+0x28/0x30 [ 77.298088][ T1734] ? uinput_poll+0x120/0x120 [ 77.302883][ T1734] __se_sys_ioctl+0x114/0x190 [ 77.307689][ T1734] __x64_sys_ioctl+0x7b/0x90 [ 77.312997][ T1734] x64_sys_call+0x98/0x9a0 [ 77.317508][ T1734] do_syscall_64+0x3b/0xb0 [ 77.321806][ T63] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 77.321827][ T1734] ? clear_bhb_loop+0x35/0x90 [ 77.332498][ T63] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 77.348104][ T1734] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 77.353909][ T1734] RIP: 0033:0x7fed09391ef9 [ 77.358368][ T1734] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 77.379838][ T1716] device veth1_macvtap entered promiscuous mode [ 77.394638][ T1734] RSP: 002b:00007fed0800b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 77.403237][ T1734] RAX: ffffffffffffffda RBX: 00007fed09549f80 RCX: 00007fed09391ef9 [ 77.411732][ T1734] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000006 [ 77.419675][ T1734] RBP: 00007fed09404b76 R08: 0000000000000000 R09: 0000000000000000 [ 77.427532][ T1734] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 77.435394][ T1734] R13: 0000000000000000 R14: 00007fed09549f80 R15: 00007ffcfa3512f8 [ 77.443563][ T1734] [ 77.446524][ T1734] ---[ end trace 5690dcfefe379482 ]--- [ 77.470259][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 77.477931][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 77.486055][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 77.504745][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 77.851475][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 77.979925][ T380] device bridge_slave_1 left promiscuous mode [ 77.985909][ T380] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.009509][ T380] device bridge_slave_0 left promiscuous mode [ 78.012143][ T1770] loop1: detected capacity change from 0 to 512 [ 78.015609][ T380] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.030575][ T380] device veth1_macvtap left promiscuous mode [ 78.036716][ T380] device veth0_vlan left promiscuous mode [ 78.045946][ T1753] loop2: detected capacity change from 0 to 40427 [ 78.087983][ T1753] F2FS-fs (loop2): Invalid SB checksum offset: 0 [ 78.095027][ T1770] EXT4-fs (loop1): Ignoring removed bh option [ 78.100967][ T1753] F2FS-fs (loop2): Can't find valid F2FS filesystem in 2th superblock [ 78.113713][ T1770] EXT4-fs error (device loop1): ext4_find_inline_data_nolock:164: inode #12: comm syz.1.508: inline data xattr refers to an external xattr inode [ 78.117001][ T1753] F2FS-fs (loop2): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 78.142604][ T1770] EXT4-fs error (device loop1): ext4_orphan_get:1402: comm syz.1.508: couldn't read orphan inode 12 (err -117) [ 78.154515][ T1770] EXT4-fs (loop1): mounted filesystem without journal. Opts: norecovery,nogrpid,grpjquota=,bh,prjquota,usrjquota=,usrjquota=,inlinecrypt,nolazytime,,errors=continue. Quota mode: writeback. [ 78.192070][ T1753] F2FS-fs (loop2): Try to recover 2th superblock, ret: 0 [ 78.199121][ T1753] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 78.236151][ T1753] overlayfs: missing 'lowerdir' [ 78.329583][ T30] audit: type=1400 audit(1726513926.170:512): avc: denied { read } for pid=1779 comm="syz.3.509" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 78.556159][ T1784] netlink: 16 bytes leftover after parsing attributes in process `syz.2.502'. [ 78.727483][ T1608] attempt to access beyond end of device [ 78.727483][ T1608] loop2: rw=2049, want=45120, limit=40427 [ 78.767270][ T6] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 78.963258][ T1797] Illegal XDP return value 4294967283, expect packet loss! [ 79.167723][ T6] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 79.167923][ T26] Bluetooth: hci0: command 0x1001 tx timeout [ 79.178611][ T649] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 79.184497][ T442] Bluetooth: hci0: sending frame failed (-49) [ 79.191731][ T6] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 79.207273][ T6] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 79.216142][ T6] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 79.224879][ T6] usb 4-1: config 0 descriptor?? [ 79.297242][ T63] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 79.567566][ T649] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 248, changing to 11 [ 79.578796][ T649] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 79.588522][ T649] usb 3-1: New USB device found, idVendor=046d, idProduct=c081, bcdDevice= 0.00 [ 79.597446][ T649] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 79.609171][ T649] usb 3-1: config 0 descriptor?? [ 79.667368][ T63] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 79.678096][ T63] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 79.687767][ T63] usb 2-1: New USB device found, idVendor=1fd2, idProduct=6007, bcdDevice= 0.00 [ 79.696611][ T63] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 79.705504][ T63] usb 2-1: config 0 descriptor?? [ 79.710570][ T6] hid (null): bogus close delimiter [ 79.897269][ T26] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 80.079346][ T649] logitech-hidpp-device 0003:046D:C081.001E: hidraw0: USB HID v0.03 Device [HID 046d:c081] on usb-dummy_hcd.2-1/input0 [ 80.137320][ T26] usb 5-1: Using ep0 maxpacket: 8 [ 80.189164][ T63] hid-multitouch 0003:1FD2:6007.001F: hidraw1: USB HID v0.00 Device [HID 1fd2:6007] on usb-dummy_hcd.1-1/input0 [ 80.257348][ T26] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 80.269122][ T26] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 80.278827][ T26] usb 5-1: New USB device found, idVendor=054c, idProduct=0ce6, bcdDevice= 0.00 [ 80.287765][ T26] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 80.296056][ T26] usb 5-1: config 0 descriptor?? [ 80.307550][ T63] usb 3-1: USB disconnect, device number 7 [ 80.388749][ T39] usb 2-1: USB disconnect, device number 10 [ 80.397361][ T6] uclogic 0003:256C:006D.001D: failed retrieving string descriptor #200: -71 [ 80.406039][ T6] uclogic 0003:256C:006D.001D: failed retrieving pen parameters: -71 [ 80.414026][ T6] uclogic 0003:256C:006D.001D: failed probing pen v2 parameters: -71 [ 80.421985][ T6] uclogic 0003:256C:006D.001D: failed probing parameters: -71 [ 80.429675][ T6] uclogic: probe of 0003:256C:006D.001D failed with error -71 [ 80.438041][ T6] usb 4-1: USB disconnect, device number 12 [ 80.778376][ T26] playstation 0003:054C:0CE6.0020: unknown main item tag 0x0 [ 80.785753][ T26] playstation 0003:054C:0CE6.0020: unknown main item tag 0x0 [ 80.792980][ T26] playstation 0003:054C:0CE6.0020: unknown main item tag 0x0 [ 80.800245][ T26] playstation 0003:054C:0CE6.0020: unknown main item tag 0x0 [ 80.807458][ T26] playstation 0003:054C:0CE6.0020: unknown main item tag 0x0 [ 80.814660][ T26] playstation 0003:054C:0CE6.0020: unknown main item tag 0x0 [ 80.821871][ T26] playstation 0003:054C:0CE6.0020: unknown main item tag 0x0 [ 80.833494][ T26] playstation 0003:054C:0CE6.0020: hidraw0: USB HID v0.00 Device [HID 054c:0ce6] on usb-dummy_hcd.4-1/input0 [ 81.017351][ T26] playstation 0003:054C:0CE6.0020: Invalid byte count transferred, expected 20 got 0 [ 81.026916][ T26] playstation 0003:054C:0CE6.0020: Failed to retrieve DualSense pairing info: -22 [ 81.036214][ T26] playstation 0003:054C:0CE6.0020: Failed to get MAC address from DualSense [ 81.043801][ T1812] loop2: detected capacity change from 0 to 40427 [ 81.045156][ T26] playstation 0003:054C:0CE6.0020: Failed to create dualsense. [ 81.059869][ T1812] F2FS-fs (loop2): Invalid SB checksum offset: 0 [ 81.066073][ T1812] F2FS-fs (loop2): Can't find valid F2FS filesystem in 2th superblock [ 81.081477][ T26] playstation: probe of 0003:054C:0CE6.0020 failed with error -22 [ 81.170804][ T1812] F2FS-fs (loop2): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 81.247282][ T26] Bluetooth: hci0: command 0x1009 tx timeout [ 81.366465][ T26] usb 5-1: USB disconnect, device number 10 [ 81.367357][ T1812] F2FS-fs (loop2): Try to recover 2th superblock, ret: 0 [ 81.379176][ T1812] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 81.392219][ T1812] overlayfs: missing 'lowerdir' [ 81.427235][ T6] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 81.507264][ T1828] netlink: 16 bytes leftover after parsing attributes in process `syz.2.522'. [ 81.726575][ T1608] attempt to access beyond end of device [ 81.726575][ T1608] loop2: rw=2049, want=45120, limit=40427 [ 81.848390][ T6] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 81.866392][ T6] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 81.876598][ T6] usb 4-1: New USB device found, idVendor=054c, idProduct=0268, bcdDevice= 0.00 [ 81.899208][ T6] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 81.899505][ T1837] loop2: detected capacity change from 0 to 512 [ 81.916534][ T6] usb 4-1: config 0 descriptor?? [ 81.957534][ T1837] EXT4-fs (loop2): 1 truncate cleaned up [ 81.963946][ T1837] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 82.208683][ T1854] loop1: detected capacity change from 0 to 40427 [ 82.240316][ T1856] loop4: detected capacity change from 0 to 40427 [ 82.248125][ T1854] F2FS-fs (loop1): Invalid SB checksum offset: 0 [ 82.254278][ T1854] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock [ 82.265995][ T1854] F2FS-fs (loop1): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 82.291818][ T1854] F2FS-fs (loop1): Try to recover 2th superblock, ret: 0 [ 82.298751][ T1854] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 82.306696][ T1856] F2FS-fs (loop4): Invalid SB checksum offset: 0 [ 82.313050][ T1856] F2FS-fs (loop4): Can't find valid F2FS filesystem in 2th superblock [ 82.381249][ T1856] F2FS-fs (loop4): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 82.394271][ T1854] netlink: 16 bytes leftover after parsing attributes in process `syz.1.537'. [ 82.400705][ T6] sony 0003:054C:0268.0021: unknown main item tag 0x0 [ 82.410552][ T6] sony 0003:054C:0268.0021: unknown main item tag 0x0 [ 82.424547][ T1856] F2FS-fs (loop4): Try to recover 2th superblock, ret: 0 [ 82.431056][ T6] sony 0003:054C:0268.0021: unknown main item tag 0x0 [ 82.431684][ T1856] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 82.445551][ T6] sony 0003:054C:0268.0021: unknown main item tag 0x0 [ 82.451792][ T1856] overlayfs: missing 'lowerdir' [ 82.464823][ T6] sony 0003:054C:0268.0021: unknown main item tag 0x0 [ 82.492914][ T1640] attempt to access beyond end of device [ 82.492914][ T1640] loop1: rw=524288, want=45072, limit=40427 [ 82.504914][ T1640] attempt to access beyond end of device [ 82.504914][ T1640] loop1: rw=0, want=45072, limit=40427 [ 82.523491][ T8] attempt to access beyond end of device [ 82.523491][ T8] loop1: rw=2049, want=45120, limit=40427 [ 82.537063][ T6] sony 0003:054C:0268.0021: hiddev96,hidraw0: USB HID v80.00 Device [HID 054c:0268] on usb-dummy_hcd.3-1/input0 [ 82.551508][ T6] sony 0003:054C:0268.0021: failed to claim input [ 82.593916][ T1867] netlink: 16 bytes leftover after parsing attributes in process `syz.4.538'. [ 82.616322][ T6] usb 4-1: USB disconnect, device number 13 [ 82.739597][ T1869] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.746561][ T1869] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.754089][ T1869] device bridge_slave_0 entered promiscuous mode [ 82.761597][ T1869] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.768671][ T1869] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.776560][ T1869] device bridge_slave_1 entered promiscuous mode [ 82.854921][ T1869] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.861819][ T1869] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.868944][ T1869] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.875791][ T1869] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.884250][ T1716] attempt to access beyond end of device [ 82.884250][ T1716] loop4: rw=2049, want=45120, limit=40427 [ 82.908714][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 82.916483][ T6] bridge0: port 1(bridge_slave_0) entered disabled state [ 82.925562][ T6] bridge0: port 2(bridge_slave_1) entered disabled state [ 82.941638][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 82.955133][ T6] bridge0: port 1(bridge_slave_0) entered blocking state [ 82.962008][ T6] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.969992][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 82.978379][ T6] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.985210][ T6] bridge0: port 2(bridge_slave_1) entered forwarding state [ 83.010621][ T292] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 83.016646][ T1877] loop4: detected capacity change from 0 to 512 [ 83.018761][ T292] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 83.037754][ T380] device bridge_slave_1 left promiscuous mode [ 83.043716][ T1877] EXT4-fs (loop4): Ignoring removed bh option [ 83.044930][ T380] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.057321][ T380] device bridge_slave_0 left promiscuous mode [ 83.058791][ T1877] EXT4-fs error (device loop4): ext4_find_inline_data_nolock:164: inode #12: comm syz.4.543: inline data xattr refers to an external xattr inode [ 83.063288][ T380] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.078385][ T1877] EXT4-fs error (device loop4): ext4_orphan_get:1402: comm syz.4.543: couldn't read orphan inode 12 (err -117) [ 83.096435][ T1877] EXT4-fs (loop4): mounted filesystem without journal. Opts: norecovery,nogrpid,grpjquota=,bh,prjquota,usrjquota=,usrjquota=,inlinecrypt,nolazytime,,errors=continue. Quota mode: writeback. [ 83.115269][ T380] device veth1_macvtap left promiscuous mode [ 83.121468][ T380] device veth0_vlan left promiscuous mode [ 83.211700][ T30] audit: type=1400 audit(1726513931.080:513): avc: denied { remount } for pid=1879 comm="syz.3.544" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 83.237394][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 83.249757][ T1869] device veth0_vlan entered promiscuous mode [ 83.257659][ T292] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 83.265947][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 83.273842][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 83.288866][ T1869] device veth1_macvtap entered promiscuous mode [ 83.299931][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 83.312290][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 83.334806][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 83.487519][ T1894] bridge: RTM_NEWNEIGH with invalid ether address [ 84.068667][ T1903] loop3: detected capacity change from 0 to 40427 [ 84.151424][ T1903] F2FS-fs (loop3): Invalid SB checksum offset: 0 [ 84.167274][ T1903] F2FS-fs (loop3): Can't find valid F2FS filesystem in 2th superblock [ 84.208630][ T1903] F2FS-fs (loop3): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 84.245336][ T1903] F2FS-fs (loop3): Try to recover 2th superblock, ret: 0 [ 84.252463][ T1903] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 84.262841][ T1910] loop2: detected capacity change from 0 to 40427 [ 84.288776][ T1903] overlayfs: missing 'lowerdir' [ 84.369086][ T1910] F2FS-fs (loop2): Invalid SB checksum offset: 0 [ 84.377264][ T1910] F2FS-fs (loop2): Can't find valid F2FS filesystem in 2th superblock [ 84.427612][ T1910] F2FS-fs (loop2): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 84.440973][ T1936] netlink: 16 bytes leftover after parsing attributes in process `syz.3.552'. [ 84.472916][ T1910] F2FS-fs (loop2): Try to recover 2th superblock, ret: 0 [ 84.480118][ T1910] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 84.621163][ T1457] attempt to access beyond end of device [ 84.621163][ T1457] loop3: rw=2049, want=45120, limit=40427 [ 84.635133][ T1910] netlink: 16 bytes leftover after parsing attributes in process `syz.2.556'. [ 84.710349][ T1608] attempt to access beyond end of device [ 84.710349][ T1608] loop2: rw=524288, want=45072, limit=40427 [ 84.722910][ T1608] attempt to access beyond end of device [ 84.722910][ T1608] loop2: rw=0, want=45072, limit=40427 [ 84.757806][ T317] attempt to access beyond end of device [ 84.757806][ T317] loop2: rw=2049, want=45120, limit=40427 [ 84.767280][ T708] usb 5-1: new full-speed USB device number 11 using dummy_hcd [ 84.908679][ T1950] bridge0: port 1(bridge_slave_0) entered blocking state [ 84.915611][ T1950] bridge0: port 1(bridge_slave_0) entered disabled state [ 84.923129][ T1950] device bridge_slave_0 entered promiscuous mode [ 84.933428][ T1950] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.940955][ T1950] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.948428][ T1950] device bridge_slave_1 entered promiscuous mode [ 85.047103][ T1966] loop3: detected capacity change from 0 to 4096 [ 85.085907][ T1950] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.092828][ T1950] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.100009][ T1950] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.106865][ T1950] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.107395][ T30] audit: type=1400 audit(1726513932.950:514): avc: denied { mounton } for pid=1965 comm="syz.3.575" path="/38/file0" dev="tmpfs" ino=220 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 85.136683][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 85.144651][ T26] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.151844][ T708] usb 5-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 85.162191][ T26] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.171170][ T708] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 4 [ 85.183382][ T1966] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 85.187605][ T708] usb 5-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 4 [ 85.211250][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 85.219458][ T39] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.226547][ T39] bridge0: port 1(bridge_slave_0) entered forwarding state [ 85.234522][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 85.243002][ T39] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.249899][ T39] bridge0: port 2(bridge_slave_1) entered forwarding state [ 85.278731][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 85.286777][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 85.305052][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 85.318927][ T1950] device veth0_vlan entered promiscuous mode [ 85.331116][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 85.339290][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 85.346659][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 85.353529][ T1973] loop1: detected capacity change from 0 to 512 [ 85.366405][ T1950] device veth1_macvtap entered promiscuous mode [ 85.377360][ T708] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 85.381876][ T1973] EXT4-fs (loop1): 1 truncate cleaned up [ 85.392498][ T1973] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 85.469839][ T708] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 85.477957][ T708] usb 5-1: Product: syz [ 85.482183][ T708] usb 5-1: Manufacturer: syz [ 85.486832][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 85.494618][ T708] usb 5-1: SerialNumber: syz [ 85.517773][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 85.526560][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 85.545352][ T1971] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.553113][ T1971] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.561007][ T1971] device bridge_slave_0 entered promiscuous mode [ 85.580591][ T1971] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.596657][ T1971] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.611616][ T1971] device bridge_slave_1 entered promiscuous mode [ 85.624351][ T317] device bridge_slave_1 left promiscuous mode [ 85.632454][ T317] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.647009][ T317] device bridge_slave_0 left promiscuous mode [ 85.659323][ T317] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.672404][ T1978] loop3: detected capacity change from 0 to 40427 [ 85.680301][ T317] device veth1_macvtap left promiscuous mode [ 85.686264][ T317] device veth0_vlan left promiscuous mode [ 85.842590][ T708] usb 5-1: 2:1 : unknown format tag 0x0 is detected. processed as MPEG. [ 85.901555][ T708] usb 5-1: found format II with max.bitrate = 0, frame size=0 [ 85.944060][ T1978] F2FS-fs (loop3): Invalid SB checksum offset: 0 [ 85.995787][ T1978] F2FS-fs (loop3): Can't find valid F2FS filesystem in 2th superblock [ 86.016353][ T708] usb 5-1: 2:1 : unknown format tag 0x0 is detected. processed as MPEG. [ 86.055439][ T708] usb 5-1: found format II with max.bitrate = 0, frame size=0 [ 86.058043][ T1978] F2FS-fs (loop3): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 86.063966][ T380] Bluetooth: hci0: Frame reassembly failed (-84) [ 86.105127][ T1978] F2FS-fs (loop3): Try to recover 2th superblock, ret: 0 [ 86.112301][ T1978] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5 [ 86.128659][ T1978] overlayfs: missing 'lowerdir' [ 86.132259][ T708] usb 5-1: USB disconnect, device number 11 [ 86.244643][ T330] udevd[330]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 86.276839][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 86.284141][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 86.302926][ T1992] netlink: 16 bytes leftover after parsing attributes in process `syz.3.579'. [ 86.317414][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 86.326267][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 86.348093][ T39] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.355060][ T39] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.367619][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 86.376075][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 86.384736][ T39] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.391722][ T39] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.399166][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 86.420795][ T63] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 86.431298][ T63] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 86.511288][ T1457] attempt to access beyond end of device [ 86.511288][ T1457] loop3: rw=2049, want=45120, limit=40427 [ 86.514814][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 86.538427][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 86.547540][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 86.555343][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 86.563886][ T1971] device veth0_vlan entered promiscuous mode [ 86.577108][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 86.589166][ T1971] device veth1_macvtap entered promiscuous mode [ 86.601482][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 86.610651][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 86.640177][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 86.661359][ T1994] loop1: detected capacity change from 0 to 40427 [ 86.661713][ T30] audit: type=1400 audit(1726513934.530:515): avc: denied { bind } for pid=2002 comm="syz.2.577" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 86.732345][ T30] audit: type=1326 audit(1726513934.590:516): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2000 comm="syz.4.585" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7774ca7ef9 code=0x7ffc0000 [ 86.758120][ T1994] F2FS-fs (loop1): Invalid SB checksum offset: 0 [ 86.778670][ T30] audit: type=1326 audit(1726513934.590:517): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2000 comm="syz.4.585" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7774ca7ef9 code=0x7ffc0000 [ 86.788005][ T1994] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock [ 86.821374][ T30] audit: type=1326 audit(1726513934.590:518): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2000 comm="syz.4.585" exe="/root/syz-executor" sig=0 arch=c000003e syscall=435 compat=0 ip=0x7f7774ca7ef9 code=0x7ffc0000 [ 86.853096][ T30] audit: type=1326 audit(1726513934.600:519): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2000 comm="syz.4.585" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7774ca7ef9 code=0x7ffc0000 [ 86.877810][ T30] audit: type=1326 audit(1726513934.600:520): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2000 comm="syz.4.585" exe="/root/syz-executor" sig=0 arch=c000003e syscall=434 compat=0 ip=0x7f7774ca7ef9 code=0x7ffc0000 [ 86.904411][ T1994] F2FS-fs (loop1): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 86.904476][ T30] audit: type=1326 audit(1726513934.600:521): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2000 comm="syz.4.585" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7774ca7ef9 code=0x7ffc0000 [ 86.940943][ T2017] syz.2.587[2017] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 86.941031][ T2017] syz.2.587[2017] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 86.953443][ T30] audit: type=1326 audit(1726513934.600:522): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2000 comm="syz.4.585" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7774ca7ef9 code=0x7ffc0000 [ 87.016621][ T1994] F2FS-fs (loop1): Try to recover 2th superblock, ret: 0 [ 87.024023][ T1994] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 87.058758][ T1994] overlayfs: failed to resolve './file0': -2 [ 87.310534][ T317] device bridge_slave_1 left promiscuous mode [ 87.320883][ T317] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.337499][ T317] device bridge_slave_0 left promiscuous mode [ 87.343487][ T317] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.352352][ T317] device veth1_macvtap left promiscuous mode [ 87.358329][ T317] device veth0_vlan left promiscuous mode [ 87.501050][ T2025] netlink: 16 bytes leftover after parsing attributes in process `syz.1.581'. [ 87.619372][ T1869] attempt to access beyond end of device [ 87.619372][ T1869] loop1: rw=2049, want=45112, limit=40427 [ 87.698969][ T2031] loop4: detected capacity change from 0 to 128 [ 87.887220][ T39] Bluetooth: hci0: command 0x1003 tx timeout [ 87.893104][ T442] Bluetooth: hci0: sending frame failed (-49) [ 87.918985][ T2045] loop3: detected capacity change from 0 to 2048 [ 87.976553][ T2037] loop1: detected capacity change from 0 to 40427 [ 88.009760][ T2047] loop4: detected capacity change from 0 to 8192 [ 88.035359][ T2045] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 88.052633][ T2037] F2FS-fs (loop1): Invalid SB checksum offset: 0 [ 88.061508][ T2037] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock [ 88.061880][ T2045] xt_hashlimit: size too large, truncated to 1048576 [ 88.096569][ T2037] F2FS-fs (loop1): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 88.156447][ T2037] F2FS-fs (loop1): Try to recover 2th superblock, ret: 0 [ 88.177312][ T2037] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 88.195219][ T2037] overlayfs: missing 'lowerdir' [ 88.388196][ T2060] netlink: 16 bytes leftover after parsing attributes in process `syz.1.593'. [ 88.538551][ T2064] loop3: detected capacity change from 0 to 128 [ 88.627703][ T2064] attempt to access beyond end of device [ 88.627703][ T2064] loop3: rw=0, want=240, limit=128 [ 88.737682][ T1869] attempt to access beyond end of device [ 88.737682][ T1869] loop1: rw=2049, want=45120, limit=40427 [ 88.834188][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 88.834202][ T30] audit: type=1326 audit(1726513936.700:528): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2071 comm="syz.3.605" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3e63782ef9 code=0x7ffc0000 [ 88.967209][ T30] audit: type=1326 audit(1726513936.750:529): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2071 comm="syz.3.605" exe="/root/syz-executor" sig=0 arch=c000003e syscall=13 compat=0 ip=0x7f3e63782ef9 code=0x7ffc0000 [ 89.067307][ T30] audit: type=1326 audit(1726513936.750:530): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2071 comm="syz.3.605" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3e63782ef9 code=0x7ffc0000 [ 89.815722][ T2066] loop2: detected capacity change from 0 to 40427 [ 89.881317][ T2081] syz.1.603[2081] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 89.881404][ T2081] syz.1.603[2081] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 89.917887][ T2066] F2FS-fs (loop2): Invalid SB checksum offset: 0 [ 89.951686][ T2081] loop1: detected capacity change from 0 to 1024 [ 89.967345][ T2066] F2FS-fs (loop2): Can't find valid F2FS filesystem in 2th superblock [ 89.979288][ T39] Bluetooth: hci0: command 0x1001 tx timeout [ 89.985166][ T442] Bluetooth: hci0: sending frame failed (-49) [ 89.994895][ T2085] loop4: detected capacity change from 0 to 256 [ 90.006750][ T2066] F2FS-fs (loop2): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 90.037180][ C1] sched: RT throttling activated [ 90.042397][ T30] audit: type=1400 audit(1726513937.910:531): avc: denied { append } for pid=2084 comm="syz.4.609" path=2F32362FE91F7189591E9233614B2F6367726F75702E73746174 dev="loop4" ino=1048659 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 90.076419][ T2081] EXT4-fs (loop1): Ignoring removed orlov option [ 90.095967][ T30] audit: type=1400 audit(1726513937.910:532): avc: denied { setattr } for pid=2084 comm="syz.4.609" name="cgroup.stat" dev="loop4" ino=1048659 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 90.100902][ T2081] EXT4-fs (loop1): Ignoring removed nomblk_io_submit option [ 90.127332][ T2066] F2FS-fs (loop2): Try to recover 2th superblock, ret: 0 [ 90.134211][ T2066] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 90.152417][ T2066] overlayfs: failed to resolve './file0': -2 [ 90.161275][ T30] audit: type=1400 audit(1726513938.030:533): avc: denied { create } for pid=2093 comm="syz.4.611" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 90.166921][ T2081] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=a802e018, mo2=0002] [ 90.209584][ T2081] System zones: 0-1, 3-12 [ 90.284795][ T30] audit: type=1400 audit(1726513938.050:534): avc: denied { connect } for pid=2093 comm="syz.4.611" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 90.391968][ T2081] EXT4-fs (loop1): mounted filesystem without journal. Opts: jqfmt=vfsv1,min_batch_time=0x00000000000000c0,grpid,orlov,debug_want_extra_isize=0x0000000000000080,nouid32,sysvgroups,nomblk_io_submit,debug,,errors=continue. Quota mode: none. [ 90.423655][ T30] audit: type=1326 audit(1726513938.290:535): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2097 comm="syz.4.612" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7774ca7ef9 code=0x7ffc0000 [ 90.451521][ T30] audit: type=1326 audit(1726513938.290:536): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2097 comm="syz.4.612" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7774ca7ef9 code=0x7ffc0000 [ 90.514298][ T30] audit: type=1326 audit(1726513938.290:537): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2097 comm="syz.4.612" exe="/root/syz-executor" sig=0 arch=c000003e syscall=97 compat=0 ip=0x7f7774ca7ef9 code=0x7ffc0000 [ 90.544025][ T2108] netlink: 16 bytes leftover after parsing attributes in process `syz.2.601'. [ 90.627377][ T2114] loop4: detected capacity change from 0 to 512 [ 90.661651][ T2117] loop1: detected capacity change from 0 to 512 [ 90.689117][ T2114] EXT4-fs (loop4): Ignoring removed bh option [ 90.689457][ T2117] EXT4-fs (loop1): Ignoring removed bh option [ 90.718604][ T2114] EXT4-fs error (device loop4): ext4_find_inline_data_nolock:164: inode #12: comm syz.4.617: inline data xattr refers to an external xattr inode [ 90.726693][ T2117] EXT4-fs error (device loop1): ext4_find_inline_data_nolock:164: inode #12: comm syz.1.618: inline data xattr refers to an external xattr inode [ 90.734382][ T2114] EXT4-fs error (device loop4): ext4_orphan_get:1402: comm syz.4.617: couldn't read orphan inode 12 (err -117) [ 90.748541][ T2117] EXT4-fs error (device loop1): ext4_orphan_get:1402: comm syz.1.618: couldn't read orphan inode 12 (err -117) [ 90.760401][ T1971] attempt to access beyond end of device [ 90.760401][ T1971] loop2: rw=2049, want=45112, limit=40427 [ 90.772251][ T2117] EXT4-fs (loop1): mounted filesystem without journal. Opts: norecovery,nogrpid,grpjquota=,bh,prjquota,usrjquota=,usrjquota=,inlinecrypt,nolazytime,,errors=continue. Quota mode: writeback. [ 90.782831][ T2114] EXT4-fs (loop4): mounted filesystem without journal. Opts: norecovery,nogrpid,grpjquota=,bh,prjquota,usrjquota=,usrjquota=,inlinecrypt,nolazytime,,errors=continue. Quota mode: writeback. [ 93.605546][ T427] Bluetooth: hci0: command 0x1009 tx timeout [ 93.824683][ T8] Bluetooth: hci1: Frame reassembly failed (-84) [ 95.683083][ T39] Bluetooth: hci1: command 0x1003 tx timeout [ 95.689138][ T676] Bluetooth: hci1: sending frame failed (-49) [ 95.699219][ T2175] loop1: detected capacity change from 0 to 512 [ 95.730102][ T30] kauditd_printk_skb: 23 callbacks suppressed [ 95.730118][ T30] audit: type=1326 audit(1726513943.600:561): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2176 comm="syz.3.635" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3e63782ef9 code=0x7ffc0000 [ 95.767247][ T2175] EXT4-fs (loop1): Ignoring removed bh option [ 95.780874][ T30] audit: type=1326 audit(1726513943.640:562): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2176 comm="syz.3.635" exe="/root/syz-executor" sig=0 arch=c000003e syscall=36 compat=0 ip=0x7f3e63782ef9 code=0x7ffc0000 [ 95.826147][ T2175] EXT4-fs error (device loop1): ext4_find_inline_data_nolock:164: inode #12: comm syz.1.636: inline data xattr refers to an external xattr inode [ 95.829562][ T30] audit: type=1326 audit(1726513943.640:563): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2176 comm="syz.3.635" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3e63782ef9 code=0x7ffc0000 [ 95.868825][ T2175] EXT4-fs error (device loop1): ext4_orphan_get:1402: comm syz.1.636: couldn't read orphan inode 12 (err -117) [ 95.880738][ T2188] netlink: 4 bytes leftover after parsing attributes in process `syz.4.640'. [ 95.890795][ T2175] EXT4-fs (loop1): mounted filesystem without journal. Opts: norecovery,nogrpid,grpjquota=,bh,prjquota,usrjquota=,usrjquota=,inlinecrypt,nolazytime,,errors=continue. Quota mode: writeback. [ 95.910475][ T2188] netlink: 12 bytes leftover after parsing attributes in process `syz.4.640'. [ 97.979240][ T2186] bridge0: port 1(bridge_slave_0) entered blocking state [ 97.986311][ T2186] bridge0: port 1(bridge_slave_0) entered disabled state [ 97.994026][ T2186] device bridge_slave_0 entered promiscuous mode [ 98.001415][ T26] Bluetooth: hci1: command 0x1001 tx timeout [ 98.007295][ T676] Bluetooth: hci0: sending frame failed (-49) [ 98.017282][ T676] Bluetooth: hci1: sending frame failed (-49) [ 98.023911][ T2186] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.031346][ T2186] bridge0: port 2(bridge_slave_1) entered disabled state [ 98.040863][ T2186] device bridge_slave_1 entered promiscuous mode [ 98.057909][ T2212] loop1: detected capacity change from 0 to 512 [ 98.067803][ T317] Bluetooth: hci2: Frame reassembly failed (-84) [ 98.075567][ T2212] EXT4-fs (loop1): 1 truncate cleaned up [ 98.081178][ T2212] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 98.171835][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 98.179165][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 98.188276][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 98.196924][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 98.205307][ T26] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.212208][ T26] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.220640][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 98.232822][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 98.241214][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 98.249292][ T427] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.256144][ T427] bridge0: port 2(bridge_slave_1) entered forwarding state [ 98.275073][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 98.282860][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 98.293048][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 98.306005][ T2186] device veth0_vlan entered promiscuous mode [ 98.312361][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 98.320799][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 98.328216][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 98.342263][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 98.351357][ T2186] device veth1_macvtap entered promiscuous mode [ 98.361265][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 98.374262][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 98.521418][ T2228] loop0: detected capacity change from 0 to 512 [ 98.618025][ T2228] EXT4-fs (loop0): Ignoring removed bh option [ 98.625206][ T2228] EXT4-fs error (device loop0): ext4_find_inline_data_nolock:164: inode #12: comm syz.0.651: inline data xattr refers to an external xattr inode [ 98.640070][ T2228] EXT4-fs error (device loop0): ext4_orphan_get:1402: comm syz.0.651: couldn't read orphan inode 12 (err -117) [ 98.651881][ T2228] EXT4-fs (loop0): mounted filesystem without journal. Opts: norecovery,nogrpid,grpjquota=,bh,prjquota,usrjquota=,usrjquota=,inlinecrypt,nolazytime,,errors=continue. Quota mode: writeback. [ 99.166177][ T2241] loop1: detected capacity change from 0 to 512 [ 99.237987][ T2241] EXT4-fs (loop1): Ignoring removed bh option [ 99.245433][ T2241] EXT4-fs error (device loop1): ext4_find_inline_data_nolock:164: inode #12: comm syz.1.655: inline data xattr refers to an external xattr inode [ 99.260398][ T2241] EXT4-fs error (device loop1): ext4_orphan_get:1402: comm syz.1.655: couldn't read orphan inode 12 (err -117) [ 99.272325][ T2241] EXT4-fs (loop1): mounted filesystem without journal. Opts: norecovery,nogrpid,grpjquota=,bh,prjquota,usrjquota=,usrjquota=,inlinecrypt,nolazytime,,errors=continue. Quota mode: writeback. [ 99.291203][ T380] device bridge_slave_1 left promiscuous mode [ 99.297295][ T380] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.305049][ T380] device bridge_slave_0 left promiscuous mode [ 99.311209][ T380] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.319373][ T380] device veth1_macvtap left promiscuous mode [ 99.325379][ T380] device veth0_vlan left promiscuous mode [ 100.047763][ T426] Bluetooth: hci1: command 0x1009 tx timeout [ 100.053704][ T426] Bluetooth: hci0: command 0x1003 tx timeout [ 100.059923][ T441] Bluetooth: hci0: sending frame failed (-49) [ 100.127536][ T426] Bluetooth: hci2: command 0x1003 tx timeout [ 100.133541][ T441] Bluetooth: hci2: sending frame failed (-49) [ 100.665208][ T2257] device pim6reg1 entered promiscuous mode [ 100.970116][ T2269] loop0: detected capacity change from 0 to 512 [ 100.988932][ T30] audit: type=1400 audit(1726513948.860:564): avc: denied { relabelfrom } for pid=2270 comm="syz.1.664" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 101.008667][ T30] audit: type=1400 audit(1726513948.860:565): avc: denied { relabelto } for pid=2270 comm="syz.1.664" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 101.032906][ T2269] EXT4-fs (loop0): 1 truncate cleaned up [ 101.038664][ T2269] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 101.212414][ T30] audit: type=1400 audit(1726513949.080:566): avc: denied { setattr } for pid=2283 comm="syz.1.668" name="/" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 101.269534][ T2286] syz.1.669[2286] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 101.269604][ T2286] syz.1.669[2286] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 101.908081][ T30] audit: type=1400 audit(1726513949.780:567): avc: denied { bind } for pid=2297 comm="syz.0.676" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 101.939612][ T30] audit: type=1400 audit(1726513949.780:568): avc: denied { setopt } for pid=2297 comm="syz.0.676" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 102.060102][ T30] audit: type=1400 audit(1726513949.930:569): avc: denied { write } for pid=2301 comm="syz.0.678" name="file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 102.127245][ T427] Bluetooth: hci0: command 0x1001 tx timeout [ 102.133173][ T441] Bluetooth: hci0: sending frame failed (-49) [ 102.195560][ T30] audit: type=1400 audit(1726513950.060:570): avc: denied { ioctl } for pid=2307 comm="syz.0.680" path="socket:[25830]" dev="sockfs" ino=25830 ioctlcmd=0x8946 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 102.223108][ T427] Bluetooth: hci2: command 0x1001 tx timeout [ 102.231368][ T441] Bluetooth: hci2: sending frame failed (-49) [ 102.354786][ T2320] loop1: detected capacity change from 0 to 2048 [ 102.408731][ T2320] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 102.503723][ T317] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1152: group 0, block bitmap and bg descriptor inconsistent: 25 vs 150994969 free clusters [ 102.518539][ T317] EXT4-fs (loop1): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 2048 with error 28 [ 102.531120][ T317] EXT4-fs (loop1): This should not happen!! Data will be lost [ 102.531120][ T317] [ 102.540780][ T317] EXT4-fs (loop1): Total free blocks count 0 [ 102.546565][ T317] EXT4-fs (loop1): Free/Dirty block details [ 102.552514][ T317] EXT4-fs (loop1): free_blocks=2415919104 [ 102.558114][ T317] EXT4-fs (loop1): dirty_blocks=3520 [ 102.563323][ T317] EXT4-fs (loop1): Block reservation details [ 102.567243][ T39] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 102.569157][ T317] EXT4-fs (loop1): i_reserved_data_blocks=220 [ 102.591101][ T317] EXT4-fs (loop1): Delayed block allocation failed for inode 18 at logical offset 2050 with max blocks 1460 with error 28 [ 102.603628][ T317] EXT4-fs (loop1): This should not happen!! Data will be lost [ 102.603628][ T317] [ 102.809725][ T30] audit: type=1400 audit(1726513950.680:571): avc: denied { listen } for pid=2328 comm="syz.1.689" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 102.828938][ T30] audit: type=1400 audit(1726513950.680:572): avc: denied { accept } for pid=2328 comm="syz.1.689" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 102.871944][ T30] audit: type=1400 audit(1726513950.740:573): avc: denied { name_bind } for pid=2331 comm="syz.1.690" src=20000 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=rawip_socket permissive=1 [ 103.001663][ T39] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 103.012558][ T39] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 103.023389][ T39] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 103.033146][ T39] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 103.046014][ T39] usb 1-1: New USB device found, idVendor=057e, idProduct=2009, bcdDevice= 0.00 [ 103.054887][ T39] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 103.063265][ T39] usb 1-1: config 0 descriptor?? [ 103.608772][ T39] nintendo 0003:057E:2009.0022: unknown main item tag 0x0 [ 103.617434][ T39] nintendo 0003:057E:2009.0022: unknown main item tag 0x0 [ 103.624449][ T39] nintendo 0003:057E:2009.0022: unknown main item tag 0x0 [ 103.632103][ T39] nintendo 0003:057E:2009.0022: unknown main item tag 0x0 [ 103.639376][ T39] nintendo 0003:057E:2009.0022: unknown main item tag 0x0 [ 103.647080][ T39] nintendo 0003:057E:2009.0022: hidraw0: USB HID v0.00 Device [HID 057e:2009] on usb-dummy_hcd.0-1/input0 [ 103.660952][ T2341] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.667883][ T2341] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.675197][ T2341] device bridge_slave_0 entered promiscuous mode [ 103.682173][ T2341] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.689296][ T2341] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.696649][ T2341] device bridge_slave_1 entered promiscuous mode [ 103.727272][ T39] nintendo 0003:057E:2009.0022: Failed to read stick cal, using defaults; ret=-38 [ 103.740675][ T39] nintendo 0003:057E:2009.0022: Analog stick positions may be inaccurate [ 103.749317][ T39] nintendo 0003:057E:2009.0022: Failed to set report mode; ret=-38 [ 103.758260][ T39] nintendo 0003:057E:2009.0022: probe - fail = -38 [ 103.764674][ T39] nintendo: probe of 0003:057E:2009.0022 failed with error -38 [ 103.803919][ T2341] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.810903][ T2341] bridge0: port 2(bridge_slave_1) entered forwarding state [ 103.818033][ T2341] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.824877][ T2341] bridge0: port 1(bridge_slave_0) entered forwarding state [ 103.850949][ T63] usb 1-1: USB disconnect, device number 12 [ 103.854513][ T2346] loop1: detected capacity change from 0 to 512 [ 103.869031][ T292] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 103.876466][ T292] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 103.886469][ T292] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.894405][ T2346] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 103.906056][ T2346] EXT4-fs (loop1): 1 truncate cleaned up [ 103.913366][ T2346] EXT4-fs (loop1): mounted filesystem without journal. Opts: init_itable,resuid=0x0000000000000000,stripe=0x0000000000000000,,errors=continue. Quota mode: none. [ 103.929907][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 103.938349][ T6] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.945204][ T6] bridge0: port 2(bridge_slave_1) entered forwarding state [ 103.968243][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 103.976086][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 103.985075][ T426] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 103.997991][ T2341] device veth0_vlan entered promiscuous mode [ 104.009381][ T426] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 104.017418][ T426] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 104.024713][ T426] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 104.032092][ T426] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 104.041279][ T2341] device veth1_macvtap entered promiscuous mode [ 104.051284][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 104.064096][ T292] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 104.109114][ T2352] device pim6reg1 entered promiscuous mode [ 104.176447][ T2353] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.185577][ T2353] bridge0: port 1(bridge_slave_0) entered disabled state [ 104.193551][ T2353] device bridge_slave_0 entered promiscuous mode [ 104.203274][ T2353] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.210413][ T63] Bluetooth: hci0: command 0x1009 tx timeout [ 104.216717][ T2353] bridge0: port 2(bridge_slave_1) entered disabled state [ 104.224763][ T2353] device bridge_slave_1 entered promiscuous mode [ 104.287216][ T63] Bluetooth: hci2: command 0x1009 tx timeout [ 104.345613][ T292] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 104.353417][ T292] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 104.366462][ T317] device bridge_slave_1 left promiscuous mode [ 104.372602][ T317] bridge0: port 2(bridge_slave_1) entered disabled state [ 104.380713][ T317] device bridge_slave_0 left promiscuous mode [ 104.389493][ T317] bridge0: port 1(bridge_slave_0) entered disabled state [ 104.398485][ T317] device veth1_macvtap left promiscuous mode [ 104.404390][ T317] device veth0_vlan left promiscuous mode [ 104.701500][ T63] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 104.709811][ T63] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 104.717954][ T63] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.724908][ T63] bridge0: port 1(bridge_slave_0) entered forwarding state [ 104.732320][ T63] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 104.740858][ T63] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 104.748937][ T63] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.755765][ T63] bridge0: port 2(bridge_slave_1) entered forwarding state [ 104.763190][ T2371] bridge: RTM_NEWNEIGH with invalid ether address [ 104.772197][ T292] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 104.787770][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 104.795801][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 104.798636][ T2374] loop0: detected capacity change from 0 to 256 [ 104.804072][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 104.818181][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 104.836162][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 104.844594][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 104.858181][ T2353] device veth0_vlan entered promiscuous mode [ 104.873426][ T63] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 104.881577][ T63] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 104.891060][ T63] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 104.902302][ T63] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 104.910351][ T63] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 104.919471][ T2353] device veth1_macvtap entered promiscuous mode [ 104.937509][ T63] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 104.946017][ T63] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 104.963427][ T63] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 104.986073][ T63] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 105.436374][ T2380] loop1: detected capacity change from 0 to 40427 [ 105.510885][ T2380] F2FS-fs (loop1): Invalid SB checksum offset: 0 [ 105.517640][ T2380] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock [ 105.530405][ T2380] F2FS-fs (loop1): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 105.569892][ T2380] F2FS-fs (loop1): Try to recover 2th superblock, ret: 0 [ 105.576809][ T2380] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 105.590080][ T2380] overlayfs: missing 'lowerdir' [ 105.809712][ T2402] netlink: 16 bytes leftover after parsing attributes in process `syz.1.697'. [ 105.975795][ T317] device bridge_slave_1 left promiscuous mode [ 105.986552][ T317] bridge0: port 2(bridge_slave_1) entered disabled state [ 106.010300][ T317] device bridge_slave_0 left promiscuous mode [ 106.027275][ T317] bridge0: port 1(bridge_slave_0) entered disabled state [ 106.045748][ T317] device veth1_macvtap left promiscuous mode [ 106.067243][ T317] device veth0_vlan left promiscuous mode [ 106.144627][ T2353] attempt to access beyond end of device [ 106.144627][ T2353] loop1: rw=2049, want=45120, limit=40427 [ 106.201637][ T2412] ªªªªªª: renamed from vlan0 [ 106.263473][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 106.263489][ T30] audit: type=1326 audit(1726513954.130:580): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2424 comm="syz.2.724" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fab75c7aef9 code=0x7ffc0000 [ 106.310433][ T30] audit: type=1326 audit(1726513954.170:581): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2424 comm="syz.2.724" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fab75c7aef9 code=0x7ffc0000 [ 106.336219][ T30] audit: type=1326 audit(1726513954.170:582): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2424 comm="syz.2.724" exe="/root/syz-executor" sig=0 arch=c000003e syscall=101 compat=0 ip=0x7fab75c7aef9 code=0x7ffc0000 [ 106.365738][ T30] audit: type=1326 audit(1726513954.170:583): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2424 comm="syz.2.724" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fab75c7aef9 code=0x7ffc0000 [ 106.390440][ T30] audit: type=1326 audit(1726513954.170:584): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2424 comm="syz.2.724" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fab75c7aef9 code=0x7ffc0000 [ 106.414262][ T30] audit: type=1326 audit(1726513954.170:585): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2424 comm="syz.2.724" exe="/root/syz-executor" sig=0 arch=c000003e syscall=332 compat=0 ip=0x7fab75c7aef9 code=0x7ffc0000 [ 106.438830][ T30] audit: type=1326 audit(1726513954.170:586): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2424 comm="syz.2.724" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fab75c7aef9 code=0x7ffc0000 [ 106.468090][ T30] audit: type=1326 audit(1726513954.170:587): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2424 comm="syz.2.724" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fab75c7aef9 code=0x7ffc0000 [ 106.866229][ T2421] bridge0: port 1(bridge_slave_0) entered blocking state [ 106.877665][ T2421] bridge0: port 1(bridge_slave_0) entered disabled state [ 106.891565][ T2421] device bridge_slave_0 entered promiscuous mode [ 106.908990][ T2421] bridge0: port 2(bridge_slave_1) entered blocking state [ 106.937665][ T2421] bridge0: port 2(bridge_slave_1) entered disabled state [ 106.948700][ T2421] device bridge_slave_1 entered promiscuous mode [ 107.040376][ T2420] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.047345][ T2420] bridge0: port 1(bridge_slave_0) entered disabled state [ 107.054762][ T2420] device bridge_slave_0 entered promiscuous mode [ 107.061809][ T2420] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.068699][ T2420] bridge0: port 2(bridge_slave_1) entered disabled state [ 107.075962][ T2420] device bridge_slave_1 entered promiscuous mode [ 107.394788][ T45] Bluetooth: hci1: Frame reassembly failed (-84) [ 107.412751][ T2454] loop2: detected capacity change from 0 to 512 [ 107.454154][ T2454] EXT4-fs (loop2): Ignoring removed bh option [ 107.473632][ T2454] EXT4-fs error (device loop2): ext4_find_inline_data_nolock:164: inode #12: comm syz.2.731: inline data xattr refers to an external xattr inode [ 107.492892][ T2454] EXT4-fs error (device loop2): ext4_orphan_get:1402: comm syz.2.731: couldn't read orphan inode 12 (err -117) [ 107.505285][ T2454] EXT4-fs (loop2): mounted filesystem without journal. Opts: norecovery,nogrpid,grpjquota=,bh,prjquota,usrjquota=,usrjquota=,inlinecrypt,nolazytime,,errors=continue. Quota mode: writeback. [ 107.546164][ T2462] netlink: 'syz.1.734': attribute type 4 has an invalid length. [ 107.565877][ T2421] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.572799][ T2421] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.579954][ T2421] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.586803][ T2421] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.595315][ T292] bridge0: port 1(bridge_slave_0) entered disabled state [ 107.605682][ T292] bridge0: port 2(bridge_slave_1) entered disabled state [ 107.614123][ T2462] netlink: 'syz.1.734': attribute type 4 has an invalid length. [ 107.688283][ T426] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 107.702128][ T426] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 107.820157][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 107.832449][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 107.843052][ T39] bridge0: port 1(bridge_slave_0) entered blocking state [ 107.849941][ T39] bridge0: port 1(bridge_slave_0) entered forwarding state [ 107.859460][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 107.869658][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 107.878023][ T39] bridge0: port 2(bridge_slave_1) entered blocking state [ 107.884862][ T39] bridge0: port 2(bridge_slave_1) entered forwarding state [ 107.908154][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 107.916373][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 107.924234][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 107.932466][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 107.956020][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 107.964526][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 107.982148][ T63] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 107.989948][ T63] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 107.998235][ T63] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 108.005518][ T63] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 108.013478][ T2421] device veth0_vlan entered promiscuous mode [ 108.029899][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 108.037393][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 108.046357][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 108.054952][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 108.065072][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 108.073340][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 108.081452][ T26] bridge0: port 1(bridge_slave_0) entered blocking state [ 108.088297][ T26] bridge0: port 1(bridge_slave_0) entered forwarding state [ 108.095860][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 108.104230][ T2421] device veth1_macvtap entered promiscuous mode [ 108.112234][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 108.120010][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 108.160133][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 108.168329][ T6] bridge0: port 2(bridge_slave_1) entered blocking state [ 108.175184][ T6] bridge0: port 2(bridge_slave_1) entered forwarding state [ 108.187237][ T292] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 108.205818][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 108.213763][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 108.229326][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 108.238115][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 108.257880][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 108.266173][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 108.285684][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 108.333872][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 108.348303][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 108.355683][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 108.376948][ T2420] device veth0_vlan entered promiscuous mode [ 108.394021][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 108.403994][ T2420] device veth1_macvtap entered promiscuous mode [ 108.415683][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 108.424238][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 108.443797][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 108.467872][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 108.477601][ T2482] loop3: detected capacity change from 0 to 512 [ 108.519203][ T2482] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpquota,nouid32,minixdf,,errors=continue. Quota mode: writeback. [ 108.532526][ T2482] ext4 filesystem being mounted at /0/file0 supports timestamps until 2038 (0x7fffffff) [ 108.637505][ T26] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 108.826809][ T292] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 108.837983][ T292] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 108.848032][ T292] usb 2-1: New USB device found, idVendor=04e7, idProduct=0830, bcdDevice= 0.00 [ 108.857497][ T292] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 108.867049][ T292] usb 2-1: config 0 descriptor?? [ 108.978070][ T317] device bridge_slave_1 left promiscuous mode [ 108.984132][ T317] bridge0: port 2(bridge_slave_1) entered disabled state [ 108.991718][ T317] device bridge_slave_0 left promiscuous mode [ 108.998054][ T317] bridge0: port 1(bridge_slave_0) entered disabled state [ 109.006031][ T317] device veth1_macvtap left promiscuous mode [ 109.012415][ T317] device veth0_vlan left promiscuous mode [ 109.067323][ T26] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 18 [ 109.177228][ T426] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 109.267318][ T26] usb 5-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=48.99 [ 109.276388][ T26] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 109.284782][ T26] usb 5-1: Product: syz [ 109.289485][ T26] usb 5-1: Manufacturer: syz [ 109.293931][ T26] usb 5-1: SerialNumber: syz [ 109.303083][ T26] usb 5-1: config 0 descriptor?? [ 109.327394][ T2475] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 109.349320][ T292] hid-generic 0003:04E7:0830.0023: item fetching failed at offset 5/7 [ 109.357891][ T292] hid-generic: probe of 0003:04E7:0830.0023 failed with error -22 [ 109.407498][ T649] Bluetooth: hci1: command 0x1003 tx timeout [ 109.413387][ T676] Bluetooth: hci1: sending frame failed (-49) [ 109.547448][ T426] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 109.559797][ T426] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 109.569939][ T292] usb 2-1: USB disconnect, device number 11 [ 109.570285][ T426] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 109.584865][ T426] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 109.598442][ T26] usb 5-1: USB disconnect, device number 12 [ 109.608761][ T330] udevd[330]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 109.624973][ T426] usb 4-1: config 0 descriptor?? [ 109.737284][ T427] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 110.178076][ T427] usb 3-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 110.189006][ T427] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 110.200019][ T427] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 110.210006][ T427] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 110.222983][ T427] usb 3-1: New USB device found, idVendor=057e, idProduct=2009, bcdDevice= 0.00 [ 110.274785][ T2498] loop1: detected capacity change from 0 to 40427 [ 110.300074][ T2498] F2FS-fs (loop1): Invalid SB checksum offset: 0 [ 110.310661][ T2498] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock [ 110.321621][ T2498] F2FS-fs (loop1): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 110.353502][ T2498] F2FS-fs (loop1): Try to recover 2th superblock, ret: 0 [ 110.360815][ T2498] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 110.393155][ T2498] overlayfs: missing 'lowerdir' [ 110.580280][ T2509] netlink: 16 bytes leftover after parsing attributes in process `syz.1.746'. [ 110.968159][ T2353] attempt to access beyond end of device [ 110.968159][ T2353] loop1: rw=2049, want=45120, limit=40427 [ 111.177063][ T427] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.189570][ T427] usb 3-1: config 0 descriptor?? [ 111.319058][ T2518] input: syz1 as /devices/virtual/input/input10 [ 111.447277][ T649] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 111.487435][ T426] uclogic 0003:256C:006D.0024: failed retrieving string descriptor #100: -71 [ 111.487510][ T6] Bluetooth: hci1: command 0x1001 tx timeout [ 111.503309][ T676] Bluetooth: hci1: sending frame failed (-49) [ 111.697207][ T649] usb 2-1: Using ep0 maxpacket: 16 [ 111.817272][ T649] usb 2-1: config 3 has an invalid interface number: 216 but max is 0 [ 111.825369][ T649] usb 2-1: config 3 has 2 interfaces, different from the descriptor's value: 1 [ 111.834417][ T649] usb 2-1: config 3 has no interface number 1 [ 111.840520][ T649] usb 2-1: config 3 interface 216 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 111.853570][ T649] usb 2-1: too many endpoints for config 3 interface 0 altsetting 0: 198, using maximum allowed: 30 [ 111.865951][ T649] usb 2-1: config 3 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 198 [ 112.005278][ T2526] netlink: 32 bytes leftover after parsing attributes in process `syz.3.753'. [ 112.037364][ T649] usb 2-1: New USB device found, idVendor=07af, idProduct=0004, bcdDevice= 1.01 [ 112.051491][ T649] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 112.053126][ T427] nintendo 0003:057E:2009.0025: unknown main item tag 0x0 [ 112.066352][ T427] nintendo 0003:057E:2009.0025: unknown main item tag 0x0 [ 112.067271][ T649] usb 2-1: Product: syz [ 112.073314][ T426] uclogic 0003:256C:006D.0024: failed retrieving pen parameters: -71 [ 112.077650][ T649] usb 2-1: Manufacturer: syz [ 112.085164][ T426] uclogic 0003:256C:006D.0024: failed probing pen v1 parameters: -71 [ 112.090026][ T649] usb 2-1: SerialNumber: syz [ 112.097529][ T427] nintendo 0003:057E:2009.0025: unknown main item tag 0x0 [ 112.108898][ T426] uclogic 0003:256C:006D.0024: failed probing parameters: -71 [ 112.116223][ T427] nintendo 0003:057E:2009.0025: unknown main item tag 0x0 [ 112.123291][ T426] uclogic: probe of 0003:256C:006D.0024 failed with error -71 [ 112.130739][ T427] nintendo 0003:057E:2009.0025: unknown main item tag 0x0 [ 112.139185][ T649] usb-storage 2-1:3.216: USB Mass Storage device detected [ 112.141780][ T426] usb 4-1: USB disconnect, device number 14 [ 112.150056][ T649] usb-storage 2-1:3.216: Quirks match for vid 07af pid 0004: 4 [ 112.152400][ T427] nintendo 0003:057E:2009.0025: hidraw0: USB HID v0.00 Device [HID 057e:2009] on usb-dummy_hcd.2-1/input0 [ 112.211103][ T2534] loop3: detected capacity change from 0 to 512 [ 112.254425][ T427] nintendo 0003:057E:2009.0025: Failed to read stick cal, using defaults; ret=-38 [ 112.270952][ T2536] loop4: detected capacity change from 0 to 128 [ 112.277435][ T427] nintendo 0003:057E:2009.0025: Analog stick positions may be inaccurate [ 112.285749][ T427] nintendo 0003:057E:2009.0025: Failed to set report mode; ret=-38 [ 112.294690][ T427] nintendo 0003:057E:2009.0025: probe - fail = -38 [ 112.301091][ T427] nintendo: probe of 0003:057E:2009.0025 failed with error -38 [ 112.308743][ T2534] EXT4-fs (loop3): Ignoring removed bh option [ 112.310312][ T427] usb 3-1: USB disconnect, device number 8 [ 112.322438][ T2534] EXT4-fs error (device loop3): ext4_find_inline_data_nolock:164: inode #12: comm syz.3.756: inline data xattr refers to an external xattr inode [ 112.337497][ T2534] EXT4-fs error (device loop3): ext4_orphan_get:1402: comm syz.3.756: couldn't read orphan inode 12 (err -117) [ 112.354554][ T2534] EXT4-fs (loop3): mounted filesystem without journal. Opts: norecovery,nogrpid,grpjquota=,bh,prjquota,usrjquota=,usrjquota=,inlinecrypt,nolazytime,,errors=continue. Quota mode: writeback. [ 112.377571][ T649] usb-storage 2-1:3.0: USB Mass Storage device detected [ 112.388406][ T649] usb-storage 2-1:3.0: Quirks match for vid 07af pid 0004: 4 [ 112.419864][ T649] usb 2-1: USB disconnect, device number 12 [ 112.966584][ T2542] loop2: detected capacity change from 0 to 40427 [ 112.988111][ T2542] F2FS-fs (loop2): Invalid SB checksum offset: 0 [ 112.994293][ T2542] F2FS-fs (loop2): Can't find valid F2FS filesystem in 2th superblock [ 113.009367][ T2542] F2FS-fs (loop2): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 113.048038][ T2542] F2FS-fs (loop2): Try to recover 2th superblock, ret: 0 [ 113.054996][ T2542] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 113.082724][ T2542] overlayfs: missing 'lowerdir' [ 113.296930][ T2566] netlink: 16 bytes leftover after parsing attributes in process `syz.2.759'. [ 113.522946][ T2341] attempt to access beyond end of device [ 113.522946][ T2341] loop2: rw=2049, want=45120, limit=40427 [ 113.567243][ T292] Bluetooth: hci1: command 0x1009 tx timeout [ 113.739133][ T2571] input: syz0 as /devices/virtual/input/input11 [ 114.140271][ T2580] loop4: detected capacity change from 0 to 512 [ 114.312344][ T2580] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 114.398767][ T30] audit: type=1326 audit(1726513962.260:588): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2583 comm="syz.3.769" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6412750ef9 code=0x7ffc0000 [ 114.432906][ T2580] ext4 filesystem being mounted at /9/file0 supports timestamps until 2038 (0x7fffffff) [ 114.475531][ T2580] EXT4-fs error (device loop4): ext4_do_update_inode:5191: inode #2: comm syz.4.770: corrupted inode contents [ 114.488156][ T2580] EXT4-fs error (device loop4): ext4_dirty_inode:6024: inode #2: comm syz.4.770: mark_inode_dirty error [ 114.492665][ T30] audit: type=1326 audit(1726513962.290:589): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2583 comm="syz.3.769" exe="/root/syz-executor" sig=0 arch=c000003e syscall=127 compat=0 ip=0x7f6412750ef9 code=0x7ffc0000 [ 114.500016][ T2580] EXT4-fs error (device loop4): ext4_do_update_inode:5191: inode #2: comm syz.4.770: corrupted inode contents [ 114.535069][ T2580] EXT4-fs error (device loop4): __ext4_ext_dirty:183: inode #2: comm syz.4.770: mark_inode_dirty error [ 114.561215][ T2421] EXT4-fs error (device loop4): ext4_readdir:260: inode #2: block 3: comm syz-executor: path /9/file0: bad entry in directory: rec_len is smaller than minimal - offset=12, inode=514, rec_len=0, size=2048 fake=0 [ 114.579024][ T30] audit: type=1326 audit(1726513962.300:590): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2583 comm="syz.3.769" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6412750ef9 code=0x7ffc0000 [ 114.605033][ T2421] EXT4-fs error (device loop4): ext4_readdir:260: inode #2: block 12: comm syz-executor: path /9/file0: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=5066064, rec_len=1, size=2048 fake=0 [ 114.631511][ T30] audit: type=1326 audit(1726513962.300:591): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2583 comm="syz.3.769" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6412750ef9 code=0x7ffc0000 [ 114.654714][ T2421] EXT4-fs error (device loop4): ext4_readdir:260: inode #2: block 13: comm syz-executor: path /9/file0: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=3653246737, rec_len=1, size=2048 fake=0 [ 114.677228][ T2421] EXT4-fs error (device loop4): ext4_readdir:260: inode #2: block 14: comm syz-executor: path /9/file0: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=3, rec_len=0, size=2048 fake=0 [ 114.697602][ T2421] EXT4-fs error (device loop4): ext4_readdir:260: inode #2: block 15: comm syz-executor: path /9/file0: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=5, rec_len=0, size=2048 fake=0 [ 114.719053][ T2421] EXT4-fs error (device loop4): ext4_readdir:260: inode #2: block 16: comm syz-executor: path /9/file0: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=3653245223, rec_len=1, size=2048 fake=0 [ 114.813961][ T2569] loop2: detected capacity change from 0 to 131072 [ 114.903305][ T2569] F2FS-fs (loop2): invalid crc value [ 114.964618][ T2569] F2FS-fs (loop2): Disable nat_bits due to incorrect cp_ver (15359802341028777995, 275811881701387) [ 115.027266][ T2569] F2FS-fs (loop2): Mounted with checkpoint version = 753bd00b [ 115.118838][ T2569] fscrypt (loop2, inode 4): Unsupported encryption modes (contents 0, filenames 0) [ 115.301951][ T2596] loop1: detected capacity change from 0 to 40427 [ 115.431584][ T2596] F2FS-fs (loop1): Invalid SB checksum offset: 0 [ 115.446132][ T2596] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock [ 115.493200][ T2596] F2FS-fs (loop1): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 115.584152][ T2606] loop2: detected capacity change from 0 to 256 [ 115.590659][ T2596] F2FS-fs (loop1): Try to recover 2th superblock, ret: 0 [ 115.598093][ T2596] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 115.631157][ T2596] overlayfs: missing 'lowerdir' [ 115.808749][ T2614] netlink: 16 bytes leftover after parsing attributes in process `syz.1.775'. [ 116.078599][ T30] audit: type=1400 audit(1726513963.950:592): avc: denied { append } for pid=2620 comm="syz.3.782" name="001" dev="devtmpfs" ino=161 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 116.136641][ T2353] attempt to access beyond end of device [ 116.136641][ T2353] loop1: rw=2049, want=45120, limit=40427 [ 116.200791][ T2627] device syzkaller0 entered promiscuous mode [ 116.666187][ T2635] loop1: detected capacity change from 0 to 512 [ 116.704024][ T2635] EXT4-fs (loop1): 1 truncate cleaned up [ 116.717296][ T2635] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 117.359360][ T2639] loop3: detected capacity change from 0 to 131072 [ 117.386936][ T2639] F2FS-fs (loop3): invalid crc value [ 117.403248][ T2639] F2FS-fs (loop3): Disable nat_bits due to incorrect cp_ver (15359802341028777995, 275811881701387) [ 117.439065][ T2639] F2FS-fs (loop3): Mounted with checkpoint version = 753bd00b [ 117.465844][ T2639] fscrypt (loop3, inode 4): Unsupported encryption modes (contents 0, filenames 0) [ 117.484683][ T2647] bridge0: port 1(bridge_slave_0) entered blocking state [ 117.492102][ T2647] bridge0: port 1(bridge_slave_0) entered disabled state [ 117.500089][ T2647] device bridge_slave_0 entered promiscuous mode [ 117.516529][ T2647] bridge0: port 2(bridge_slave_1) entered blocking state [ 117.523861][ T2647] bridge0: port 2(bridge_slave_1) entered disabled state [ 117.531503][ T2647] device bridge_slave_1 entered promiscuous mode [ 117.596677][ T2659] syz.2.794[2659] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 117.596756][ T2659] syz.2.794[2659] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 117.681421][ T2652] bridge0: port 1(bridge_slave_0) entered blocking state [ 117.699660][ T2652] bridge0: port 1(bridge_slave_0) entered disabled state [ 117.707020][ T2652] device bridge_slave_0 entered promiscuous mode [ 117.771662][ T2652] bridge0: port 2(bridge_slave_1) entered blocking state [ 117.782122][ T2652] bridge0: port 2(bridge_slave_1) entered disabled state [ 117.798004][ T2652] device bridge_slave_1 entered promiscuous mode [ 117.807658][ T2671] netlink: 48 bytes leftover after parsing attributes in process `syz.2.796'. [ 117.902328][ T2647] bridge0: port 2(bridge_slave_1) entered blocking state [ 117.909234][ T2647] bridge0: port 2(bridge_slave_1) entered forwarding state [ 117.916316][ T2647] bridge0: port 1(bridge_slave_0) entered blocking state [ 117.923136][ T2647] bridge0: port 1(bridge_slave_0) entered forwarding state [ 118.617626][ T427] bridge0: port 1(bridge_slave_0) entered disabled state [ 118.660273][ T427] bridge0: port 2(bridge_slave_1) entered disabled state [ 118.850863][ T426] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 118.907051][ T2691] loop3: detected capacity change from 0 to 512 [ 118.920763][ T426] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 118.928456][ T426] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 118.936566][ T426] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 118.944949][ T426] bridge0: port 1(bridge_slave_0) entered blocking state [ 118.951850][ T426] bridge0: port 1(bridge_slave_0) entered forwarding state [ 118.954617][ T2691] EXT4-fs (loop3): 1 truncate cleaned up [ 118.959092][ T426] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 118.964409][ T2691] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 118.972991][ T426] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 118.992740][ T426] bridge0: port 2(bridge_slave_1) entered blocking state [ 119.000052][ T426] bridge0: port 2(bridge_slave_1) entered forwarding state [ 119.193981][ T317] device bridge_slave_1 left promiscuous mode [ 119.199975][ T317] bridge0: port 2(bridge_slave_1) entered disabled state [ 119.208169][ T317] device bridge_slave_0 left promiscuous mode [ 119.214151][ T317] bridge0: port 1(bridge_slave_0) entered disabled state [ 119.221850][ T317] device veth1_macvtap left promiscuous mode [ 119.227815][ T317] device veth0_vlan left promiscuous mode [ 119.309989][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 119.318049][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 119.331497][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 119.339775][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 119.362175][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 119.370343][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 119.385276][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 119.393530][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 119.403711][ T2647] device veth0_vlan entered promiscuous mode [ 119.410175][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 119.417495][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 119.424836][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 119.432285][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 119.443493][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 119.451793][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 119.460062][ T427] bridge0: port 1(bridge_slave_0) entered blocking state [ 119.466922][ T427] bridge0: port 1(bridge_slave_0) entered forwarding state [ 119.474561][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 119.484503][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 119.492793][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 119.500793][ T427] bridge0: port 2(bridge_slave_1) entered blocking state [ 119.507651][ T427] bridge0: port 2(bridge_slave_1) entered forwarding state [ 119.519372][ T63] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 119.527508][ T63] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 119.537388][ T2647] device veth1_macvtap entered promiscuous mode [ 119.548716][ T63] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 119.556260][ T63] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 119.564282][ T63] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 119.576773][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 119.584976][ T427] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 119.601513][ T292] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 119.609796][ T292] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 119.619198][ T292] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 119.627748][ T292] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 119.652111][ T2652] device veth0_vlan entered promiscuous mode [ 119.665871][ T2652] device veth1_macvtap entered promiscuous mode [ 119.732181][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 119.752799][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 119.765848][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 119.774124][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 119.968488][ T1685] Bluetooth: hci1: Frame reassembly failed (-84) [ 120.089641][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 120.097783][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 120.105864][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 120.113453][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 120.123050][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 120.131607][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 120.139893][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 120.166560][ T292] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 120.174001][ T292] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 120.305069][ T2730] loop4: detected capacity change from 0 to 512 [ 120.359183][ T2730] EXT4-fs (loop4): Quota format mount options ignored when QUOTA feature is enabled [ 120.402385][ T2730] EXT4-fs (loop4): mounted filesystem without journal. Opts: bsdgroups,jqfmt=vfsold,noquota,min_batch_time=0x0000000000000010,journal_dev=0x000000000000000d,,errors=continue. Quota mode: writeback. [ 120.422963][ T2730] ext4 filesystem being mounted at /2/file0 supports timestamps until 2038 (0x7fffffff) [ 120.697399][ T39] Bluetooth: hci0: command 0x1003 tx timeout [ 120.727432][ T47] Bluetooth: hci0: sending frame failed (-49) [ 120.840012][ T317] device bridge_slave_1 left promiscuous mode [ 120.848600][ T317] bridge0: port 2(bridge_slave_1) entered disabled state [ 120.856145][ T317] device bridge_slave_0 left promiscuous mode [ 120.862814][ T317] bridge0: port 1(bridge_slave_0) entered disabled state [ 120.887923][ T317] device veth1_macvtap left promiscuous mode [ 120.894374][ T317] device veth0_vlan left promiscuous mode [ 121.170555][ T2766] bridge0: port 1(bridge_slave_0) entered blocking state [ 121.177550][ T2766] bridge0: port 1(bridge_slave_0) entered disabled state [ 121.184863][ T2766] device bridge_slave_0 entered promiscuous mode [ 121.191938][ T2766] bridge0: port 2(bridge_slave_1) entered blocking state [ 121.199300][ T2766] bridge0: port 2(bridge_slave_1) entered disabled state [ 121.206572][ T2766] device bridge_slave_1 entered promiscuous mode [ 121.264187][ T2766] bridge0: port 2(bridge_slave_1) entered blocking state [ 121.271237][ T2766] bridge0: port 2(bridge_slave_1) entered forwarding state [ 121.278389][ T2766] bridge0: port 1(bridge_slave_0) entered blocking state [ 121.285349][ T2766] bridge0: port 1(bridge_slave_0) entered forwarding state [ 121.312976][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 121.321396][ T39] bridge0: port 1(bridge_slave_0) entered disabled state [ 121.329398][ T39] bridge0: port 2(bridge_slave_1) entered disabled state [ 121.351244][ T30] audit: type=1326 audit(1726513969.220:593): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2774 comm="syz.3.830" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6412750ef9 code=0x7ffc0000 [ 121.375442][ T30] audit: type=1326 audit(1726513969.240:594): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2774 comm="syz.3.830" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f6412750ef9 code=0x7ffc0000 [ 121.398726][ T30] audit: type=1326 audit(1726513969.240:595): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2774 comm="syz.3.830" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6412750ef9 code=0x7ffc0000 [ 121.421872][ T30] audit: type=1326 audit(1726513969.240:596): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2774 comm="syz.3.830" exe="/root/syz-executor" sig=0 arch=c000003e syscall=270 compat=0 ip=0x7f6412750ef9 code=0x7ffc0000 [ 121.437234][ T427] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 121.453366][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 121.461512][ T26] bridge0: port 1(bridge_slave_0) entered blocking state [ 121.468403][ T26] bridge0: port 1(bridge_slave_0) entered forwarding state [ 121.475863][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 121.484046][ T26] bridge0: port 2(bridge_slave_1) entered blocking state [ 121.490904][ T26] bridge0: port 2(bridge_slave_1) entered forwarding state [ 121.498290][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 121.518703][ T292] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 121.527904][ T292] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 121.537929][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 121.546256][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 121.553957][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 121.564540][ T2766] device veth0_vlan entered promiscuous mode [ 121.577125][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 121.586316][ T2766] device veth1_macvtap entered promiscuous mode [ 121.596657][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 121.613254][ T26] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 121.723125][ T30] audit: type=1326 audit(1726513969.590:597): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2780 comm="syz.2.832" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e5b2aef9 code=0x7ffc0000 [ 121.746789][ T30] audit: type=1326 audit(1726513969.590:598): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2780 comm="syz.2.832" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e5b2aef9 code=0x7ffc0000 [ 121.770238][ T30] audit: type=1326 audit(1726513969.590:599): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2780 comm="syz.2.832" exe="/root/syz-executor" sig=0 arch=c000003e syscall=141 compat=0 ip=0x7f20e5b2aef9 code=0x7ffc0000 [ 121.794210][ T30] audit: type=1326 audit(1726513969.590:600): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2780 comm="syz.2.832" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e5b2aef9 code=0x7ffc0000 [ 121.818800][ T30] audit: type=1326 audit(1726513969.590:601): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2780 comm="syz.2.832" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20e5b2aef9 code=0x7ffc0000 [ 121.827357][ T427] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 121.852763][ T427] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 121.862744][ T427] usb 5-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 121.871667][ T427] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 121.881223][ T427] usb 5-1: config 0 descriptor?? [ 121.887271][ T26] Bluetooth: hci1: command 0x1003 tx timeout [ 121.893666][ T47] Bluetooth: hci1: sending frame failed (-49) [ 122.057627][ T317] device bridge_slave_1 left promiscuous mode [ 122.178721][ T317] bridge0: port 2(bridge_slave_1) entered disabled state [ 122.191220][ T317] device bridge_slave_0 left promiscuous mode [ 122.197836][ T317] bridge0: port 1(bridge_slave_0) entered disabled state [ 122.208893][ T45] Bluetooth: hci2: Frame reassembly failed (-84) [ 122.259863][ T317] device veth1_macvtap left promiscuous mode [ 122.377663][ T427] hid (null): bogus close delimiter [ 122.767509][ T26] Bluetooth: hci0: command 0x1001 tx timeout [ 122.773532][ T441] Bluetooth: hci0: sending frame failed (-49) [ 123.038553][ T427] input: HID 256c:006d Pen as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:256C:006D.0026/input/input12 [ 123.053881][ T427] input: HID 256c:006d Pad as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:256C:006D.0026/input/input13 [ 123.069823][ T427] uclogic 0003:256C:006D.0026: input,hidraw0: USB HID v0.00 Keypad [HID 256c:006d] on usb-dummy_hcd.4-1/input0 [ 123.208009][ T2806] loop3: detected capacity change from 0 to 16 [ 123.241092][ T427] usb 5-1: USB disconnect, device number 13 [ 123.277921][ T2806] erofs: (device loop3): mounted with root inode @ nid 36. [ 123.286008][ T2806] attempt to access beyond end of device [ 123.286008][ T2806] loop3: rw=0, want=14552337264, limit=16 [ 123.467406][ T30] audit: type=1400 audit(1726513971.340:602): avc: denied { mount } for pid=2815 comm="syz.3.845" name="/" dev="configfs" ino=162 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 123.548325][ T2823] loop3: detected capacity change from 0 to 512 [ 123.637686][ T2823] EXT4-fs (loop3): Ignoring removed bh option [ 123.645082][ T2823] EXT4-fs error (device loop3): ext4_find_inline_data_nolock:164: inode #12: comm syz.3.848: inline data xattr refers to an external xattr inode [ 123.660038][ T2823] EXT4-fs error (device loop3): ext4_orphan_get:1402: comm syz.3.848: couldn't read orphan inode 12 (err -117) [ 123.672016][ T2823] EXT4-fs (loop3): mounted filesystem without journal. Opts: norecovery,nogrpid,grpjquota=,bh,prjquota,usrjquota=,usrjquota=,inlinecrypt,nolazytime,,errors=continue. Quota mode: writeback. [ 123.967248][ T427] Bluetooth: hci1: command 0x1001 tx timeout [ 123.974296][ T441] Bluetooth: hci1: sending frame failed (-49) [ 124.165984][ T2831] loop4: detected capacity change from 0 to 40427 [ 124.207307][ T26] Bluetooth: hci2: command 0x1003 tx timeout [ 124.213184][ T441] Bluetooth: hci2: sending frame failed (-49) [ 124.249593][ T2831] F2FS-fs (loop4): Invalid SB checksum offset: 0 [ 124.255857][ T2831] F2FS-fs (loop4): Can't find valid F2FS filesystem in 2th superblock [ 124.266443][ T2831] F2FS-fs (loop4): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 124.291818][ T2831] F2FS-fs (loop4): Try to recover 2th superblock, ret: 0 [ 124.298862][ T2831] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 124.311578][ T2831] overlayfs: missing 'lowerdir' [ 124.533001][ T2840] netlink: 16 bytes leftover after parsing attributes in process `syz.4.850'. [ 124.847599][ T26] Bluetooth: hci0: command 0x1009 tx timeout [ 124.983341][ T2652] attempt to access beyond end of device [ 124.983341][ T2652] loop4: rw=2049, want=45120, limit=40427 [ 125.837232][ T6] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 126.047313][ T426] Bluetooth: hci1: command 0x1009 tx timeout [ 126.207448][ T6] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 126.218183][ T6] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 126.227764][ T6] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 126.236546][ T6] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 126.245400][ T6] usb 4-1: config 0 descriptor?? [ 126.287564][ T426] Bluetooth: hci2: command 0x1001 tx timeout [ 126.293455][ T441] Bluetooth: hci2: sending frame failed (-49) [ 127.247544][ T6] usb 4-1: string descriptor 0 read error: -71 [ 127.267545][ T6] uclogic 0003:256C:006D.0027: failed retrieving string descriptor #200: -71 [ 127.276151][ T6] uclogic 0003:256C:006D.0027: failed retrieving pen parameters: -71 [ 127.284308][ T6] uclogic 0003:256C:006D.0027: failed probing pen v2 parameters: -71 [ 127.292438][ T6] uclogic 0003:256C:006D.0027: failed probing parameters: -71 [ 127.299704][ T6] uclogic: probe of 0003:256C:006D.0027 failed with error -71 [ 127.307960][ T6] usb 4-1: USB disconnect, device number 15 [ 127.804530][ T2867] loop4: detected capacity change from 0 to 512 [ 127.898911][ T2867] EXT4-fs (loop4): mounted filesystem without journal. Opts: nodelalloc,grpid,auto_da_alloc,,errors=continue. Quota mode: writeback. [ 127.912538][ T2867] ext4 filesystem being mounted at /15/bus supports timestamps until 2038 (0x7fffffff) [ 127.966416][ T30] kauditd_printk_skb: 14 callbacks suppressed [ 127.966435][ T30] audit: type=1400 audit(1726513975.830:617): avc: denied { mounton } for pid=2871 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 128.007100][ T2874] loop4: detected capacity change from 0 to 512 [ 128.007227][ T6] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 128.024625][ T2871] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.031796][ T2871] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.039154][ T2871] device bridge_slave_0 entered promiscuous mode [ 128.045943][ T2871] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.053091][ T2871] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.060677][ T2871] device bridge_slave_1 entered promiscuous mode [ 128.068278][ T2874] EXT4-fs (loop4): Ignoring removed bh option [ 128.077935][ T2874] EXT4-fs error (device loop4): ext4_find_inline_data_nolock:164: inode #12: comm syz.4.861: inline data xattr refers to an external xattr inode [ 128.092889][ T2874] EXT4-fs error (device loop4): ext4_orphan_get:1402: comm syz.4.861: couldn't read orphan inode 12 (err -117) [ 128.104667][ T2874] EXT4-fs (loop4): mounted filesystem without journal. Opts: norecovery,nogrpid,grpjquota=,bh,prjquota,usrjquota=,usrjquota=,inlinecrypt,nolazytime,,errors=continue. Quota mode: writeback. [ 128.176743][ T2871] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.183645][ T2871] bridge0: port 2(bridge_slave_1) entered forwarding state [ 128.190785][ T2871] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.197643][ T2871] bridge0: port 1(bridge_slave_0) entered forwarding state [ 128.218741][ T426] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.225905][ T426] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.233960][ T426] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 128.241291][ T426] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 128.251018][ T292] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 128.258899][ T6] usb 4-1: Using ep0 maxpacket: 16 [ 128.264334][ T292] bridge0: port 1(bridge_slave_0) entered blocking state [ 128.271225][ T292] bridge0: port 1(bridge_slave_0) entered forwarding state [ 128.288961][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 128.296994][ T649] bridge0: port 2(bridge_slave_1) entered blocking state [ 128.303872][ T649] bridge0: port 2(bridge_slave_1) entered forwarding state [ 128.311922][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 128.319952][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 128.338434][ T292] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 128.351666][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 128.359935][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 128.367634][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 128.375977][ T2871] device veth0_vlan entered promiscuous mode [ 128.387283][ T6] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 128.402676][ T2871] device veth1_macvtap entered promiscuous mode [ 128.408872][ T6] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 128.426818][ T6] usb 4-1: New USB device found, idVendor=17ef, idProduct=6085, bcdDevice= 0.00 [ 128.444139][ T6] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 128.465866][ T6] usb 4-1: config 0 descriptor?? [ 128.471180][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 128.479910][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 128.488539][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 128.506585][ T30] audit: type=1400 audit(1726513976.370:618): avc: denied { read } for pid=2882 comm="syz.1.860" path="anon_inode:[userfaultfd]" dev="anon_inodefs" ino=29909 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 129.137427][ T427] Bluetooth: hci2: command 0x1009 tx timeout [ 129.368316][ T6] hid-rmi 0003:17EF:6085.0028: item fetching failed at offset 3/5 [ 129.378377][ T6] hid-rmi 0003:17EF:6085.0028: parse failed [ 129.384240][ T6] hid-rmi: probe of 0003:17EF:6085.0028 failed with error -22 [ 129.418158][ T2897] loop4: detected capacity change from 0 to 512 [ 129.509794][ T2897] EXT4-fs (loop4): 1 truncate cleaned up [ 129.515289][ T2897] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 129.583024][ T426] usb 4-1: USB disconnect, device number 16 [ 129.776986][ T2905] bridge0: port 1(bridge_slave_0) entered blocking state [ 129.783968][ T2905] bridge0: port 1(bridge_slave_0) entered disabled state [ 129.791853][ T2905] device bridge_slave_0 entered promiscuous mode [ 129.798776][ T2905] bridge0: port 2(bridge_slave_1) entered blocking state [ 129.805670][ T2905] bridge0: port 2(bridge_slave_1) entered disabled state [ 129.812964][ T2905] device bridge_slave_1 entered promiscuous mode [ 129.864379][ T2905] bridge0: port 2(bridge_slave_1) entered blocking state [ 129.871285][ T2905] bridge0: port 2(bridge_slave_1) entered forwarding state [ 129.878387][ T2905] bridge0: port 1(bridge_slave_0) entered blocking state [ 129.885247][ T2905] bridge0: port 1(bridge_slave_0) entered forwarding state [ 129.917056][ T426] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 129.925577][ T426] bridge0: port 1(bridge_slave_0) entered disabled state [ 129.933143][ T426] bridge0: port 2(bridge_slave_1) entered disabled state [ 129.951834][ T2893] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 129.959860][ T2893] bridge0: port 1(bridge_slave_0) entered blocking state [ 129.966701][ T2893] bridge0: port 1(bridge_slave_0) entered forwarding state [ 129.974010][ T2893] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 129.982058][ T2893] bridge0: port 2(bridge_slave_1) entered blocking state [ 129.988920][ T2893] bridge0: port 2(bridge_slave_1) entered forwarding state [ 129.998143][ T297] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 130.008108][ T2893] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 130.021005][ T2893] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 130.036731][ T2893] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 130.053808][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 130.061793][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 130.069386][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 130.077333][ T2905] device veth0_vlan entered promiscuous mode [ 130.090692][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 130.104478][ T2905] device veth1_macvtap entered promiscuous mode [ 130.116830][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 130.138687][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 130.204821][ T2918] loop0: detected capacity change from 0 to 2048 [ 130.229164][ T2918] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 130.287469][ T297] usb 2-1: Using ep0 maxpacket: 16 [ 130.413734][ T45] Bluetooth: hci0: Frame reassembly failed (-84) [ 130.587316][ T297] usb 2-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 9.00 [ 130.597016][ T2929] loop0: detected capacity change from 0 to 512 [ 130.600486][ T297] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 130.617509][ T2929] EXT4-fs (loop0): Ignoring removed bh option [ 130.625386][ T2929] EXT4-fs error (device loop0): ext4_find_inline_data_nolock:164: inode #12: comm syz.0.874: inline data xattr refers to an external xattr inode [ 130.632611][ T297] usb 2-1: Product: syz [ 130.645213][ T2929] EXT4-fs error (device loop0): ext4_orphan_get:1402: comm syz.0.874: couldn't read orphan inode 12 (err -117) [ 130.661154][ T2929] EXT4-fs (loop0): mounted filesystem without journal. Opts: norecovery,nogrpid,grpjquota=,bh,prjquota,usrjquota=,usrjquota=,inlinecrypt,nolazytime,,errors=continue. Quota mode: writeback. [ 130.759568][ T297] usb 2-1: Manufacturer: syz [ 130.764209][ T297] usb 2-1: SerialNumber: syz [ 130.769766][ T297] usb 2-1: config 0 descriptor?? [ 130.808039][ T317] device bridge_slave_1 left promiscuous mode [ 130.808380][ T297] ftdi_sio 2-1:0.0: FTDI USB Serial Device converter detected [ 131.742881][ T317] bridge0: port 2(bridge_slave_1) entered disabled state [ 131.750996][ T317] device bridge_slave_0 left promiscuous mode [ 131.757013][ T317] bridge0: port 1(bridge_slave_0) entered disabled state [ 131.765919][ T317] device veth1_macvtap left promiscuous mode [ 131.772180][ T317] device veth0_vlan left promiscuous mode [ 132.250146][ T297] usb 2-1: Detected FT232H [ 132.251224][ T45] Bluetooth: hci1: Frame reassembly failed (-84) [ 132.261748][ T45] Bluetooth: hci1: Frame reassembly failed (-84) [ 132.287391][ T297] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 132.367292][ T2893] Bluetooth: hci0: command 0x1003 tx timeout [ 132.373178][ T441] Bluetooth: hci0: sending frame failed (-49) [ 133.210208][ T297] usb 2-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 133.280342][ T2945] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.287436][ T2945] bridge0: port 1(bridge_slave_0) entered disabled state [ 133.294801][ T2945] device bridge_slave_0 entered promiscuous mode [ 133.306665][ T2945] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.313605][ T2945] bridge0: port 2(bridge_slave_1) entered disabled state [ 133.321634][ T2945] device bridge_slave_1 entered promiscuous mode [ 133.401966][ T2945] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.408961][ T2945] bridge0: port 2(bridge_slave_1) entered forwarding state [ 133.416055][ T2945] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.422863][ T2945] bridge0: port 1(bridge_slave_0) entered forwarding state [ 133.423712][ T371] usb 2-1: USB disconnect, device number 13 [ 133.446555][ T371] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 133.460658][ T371] ftdi_sio 2-1:0.0: device disconnected [ 133.477494][ T63] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 133.485235][ T63] bridge0: port 1(bridge_slave_0) entered disabled state [ 133.492805][ T63] bridge0: port 2(bridge_slave_1) entered disabled state [ 133.507515][ T297] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 133.521438][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 133.528348][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 133.535891][ T297] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 133.544147][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 133.551036][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 133.566810][ T63] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 133.579844][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 133.596992][ T426] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 133.610558][ T2945] device veth0_vlan entered promiscuous mode [ 133.618914][ T297] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 133.626763][ T297] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 133.634787][ T297] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 133.671334][ T2945] device veth1_macvtap entered promiscuous mode [ 133.678713][ T297] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 133.693364][ T426] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 133.704505][ T649] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 133.749971][ T45] device bridge_slave_1 left promiscuous mode [ 133.756103][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 133.769274][ T45] device bridge_slave_0 left promiscuous mode [ 133.775260][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 133.793746][ T45] device veth1_macvtap left promiscuous mode [ 133.799652][ T45] device veth0_vlan left promiscuous mode [ 133.967999][ T317] Bluetooth: hci2: Frame reassembly failed (-84) [ 133.986681][ T317] Bluetooth: hci2: Frame reassembly failed (-84) [ 134.258442][ T2966] loop0: detected capacity change from 0 to 40427 [ 134.287502][ T649] Bluetooth: hci1: command 0x1003 tx timeout [ 134.293371][ T441] Bluetooth: hci1: sending frame failed (-49) [ 134.307989][ T2966] F2FS-fs (loop0): Invalid SB checksum offset: 0 [ 134.314203][ T2966] F2FS-fs (loop0): Can't find valid F2FS filesystem in 2th superblock [ 134.324582][ T2966] F2FS-fs (loop0): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 134.620259][ T2966] F2FS-fs (loop0): Try to recover 2th superblock, ret: 0 [ 134.627619][ T2966] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e5 [ 134.643982][ T63] Bluetooth: hci0: command 0x1001 tx timeout [ 134.650263][ T441] Bluetooth: hci0: sending frame failed (-49) [ 134.765892][ T2980] netlink: 16 bytes leftover after parsing attributes in process `syz.0.886'. [ 134.906051][ T2905] attempt to access beyond end of device [ 134.906051][ T2905] loop0: rw=524288, want=45072, limit=40427 [ 134.917427][ T2905] attempt to access beyond end of device [ 134.917427][ T2905] loop0: rw=0, want=45072, limit=40427 [ 134.932588][ T45] attempt to access beyond end of device [ 134.932588][ T45] loop0: rw=2049, want=45120, limit=40427 [ 135.178186][ T2984] bridge0: port 1(bridge_slave_0) entered blocking state [ 135.185039][ T2984] bridge0: port 1(bridge_slave_0) entered disabled state [ 135.193022][ T2984] device bridge_slave_0 entered promiscuous mode [ 135.205321][ T2984] bridge0: port 2(bridge_slave_1) entered blocking state [ 135.209895][ T30] audit: type=1400 audit(1726513983.070:619): avc: denied { write } for pid=2990 comm="syz.1.892" name="task" dev="proc" ino=29312 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 135.213165][ T2984] bridge0: port 2(bridge_slave_1) entered disabled state [ 135.241146][ T2984] device bridge_slave_1 entered promiscuous mode [ 135.254400][ T30] audit: type=1400 audit(1726513983.100:620): avc: denied { add_name } for pid=2990 comm="syz.1.892" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=dir permissive=1 [ 135.278554][ T30] audit: type=1400 audit(1726513983.100:621): avc: denied { create } for pid=2990 comm="syz.1.892" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=file permissive=1 [ 135.279039][ T2992] loop1: detected capacity change from 0 to 1024 [ 135.298617][ T30] audit: type=1400 audit(1726513983.100:622): avc: denied { associate } for pid=2990 comm="syz.1.892" name="file0" scontext=root:object_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 135.425048][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 135.432403][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 135.442286][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 135.451111][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 135.459447][ T310] bridge0: port 1(bridge_slave_0) entered blocking state [ 135.466301][ T310] bridge0: port 1(bridge_slave_0) entered forwarding state [ 135.474087][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 135.485936][ T297] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 135.494665][ T297] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 135.505843][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 135.512817][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 135.535265][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 135.546196][ T45] device bridge_slave_1 left promiscuous mode [ 135.552337][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 135.559932][ T45] device bridge_slave_0 left promiscuous mode [ 135.565879][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 135.573907][ T45] device veth1_macvtap left promiscuous mode [ 135.579749][ T45] device veth0_vlan left promiscuous mode [ 135.697399][ T297] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 135.712615][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 135.724007][ T2984] device veth0_vlan entered promiscuous mode [ 135.732198][ T297] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 135.740988][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 135.748645][ T310] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 135.764874][ T2984] device veth1_macvtap entered promiscuous mode [ 135.771920][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 135.787240][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 135.795722][ T6] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 135.921480][ T3004] loop1: detected capacity change from 0 to 40427 [ 136.007795][ T3004] F2FS-fs (loop1): Invalid SB checksum offset: 0 [ 136.014035][ T3004] F2FS-fs (loop1): Can't find valid F2FS filesystem in 2th superblock [ 136.024503][ T3004] F2FS-fs (loop1): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 136.047217][ T297] Bluetooth: hci2: command 0x1003 tx timeout [ 136.053097][ T441] Bluetooth: hci2: sending frame failed (-49) [ 136.059014][ T3004] F2FS-fs (loop1): Try to recover 2th superblock, ret: 0 [ 136.059040][ T3004] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 136.183140][ T3012] netlink: 16 bytes leftover after parsing attributes in process `syz.1.898'. [ 136.367408][ T310] Bluetooth: hci1: command 0x1001 tx timeout [ 136.373281][ T441] Bluetooth: hci1: sending frame failed (-49) [ 136.497770][ T45] device bridge_slave_1 left promiscuous mode [ 136.503743][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 136.511110][ T45] device bridge_slave_0 left promiscuous mode [ 136.517074][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 136.524902][ T45] device veth1_macvtap left promiscuous mode [ 136.530807][ T45] device veth0_vlan left promiscuous mode [ 136.617387][ T2871] attempt to access beyond end of device [ 136.617387][ T2871] loop1: rw=524288, want=45072, limit=40427 [ 136.628721][ T2871] attempt to access beyond end of device [ 136.628721][ T2871] loop1: rw=0, want=45072, limit=40427 [ 136.643098][ T317] attempt to access beyond end of device [ 136.643098][ T317] loop1: rw=2049, want=45120, limit=40427 [ 136.687675][ T310] Bluetooth: hci0: command 0x1009 tx timeout SYZFAIL: mkdir(syz-tmp) failed (errno 28: No space left on device) loop exited with status 67 SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: failed to mkdtemp (errno 28: No space left on device) SYZFAIL: repeatedly failed to execute the program proc=0 req=899 state=1 status=67 (errno 9: Bad file descriptor) [ 137.288461][ T45] device bridge_slave_1 left promiscuous mode [ 137.294403][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 137.301855][ T45] device bridge_slave_0 left promiscuous mode [ 137.307885][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 137.315709][ T45] device veth1_macvtap left promiscuous mode [ 137.321587][ T45] device veth0_vlan left promiscuous mode [ 138.127310][ T63] Bluetooth: hci2: command 0x1001 tx timeout [ 138.133194][ T441] Bluetooth: hci2: sending frame failed (-49) [ 138.447307][ T649] Bluetooth: hci1: command 0x1009 tx timeout [ 140.207296][ T63] Bluetooth: hci2: command 0x1009 tx timeout [ 141.727920][ T45] device bridge_slave_1 left promiscuous mode [ 141.733872][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 141.741269][ T45] device bridge_slave_0 left promiscuous mode [ 141.747310][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 141.755060][ T45] device veth1_macvtap left promiscuous mode [ 141.760921][ T45] device veth0_vlan left promiscuous mode [ 143.687982][ T10] device bridge_slave_1 left promiscuous mode [ 143.693910][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 143.701339][ T10] device bridge_slave_0 left promiscuous mode [ 143.707348][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 143.715087][ T10] device veth1_macvtap left promiscuous mode [ 143.720938][ T10] device veth0_vlan left promiscuous mode [ 145.087982][ T10] device bridge_slave_1 left promiscuous mode [ 145.093922][ T10] bridge0: port 2(bridge_slave_1) entered disabled state [ 145.101280][ T10] device bridge_slave_0 left promiscuous mode [ 145.107323][ T10] bridge0: port 1(bridge_slave_0) entered disabled state [ 145.115275][ T10] device veth1_macvtap left promiscuous mode [ 145.121150][ T10] device veth0_vlan left promiscuous mode