last executing test programs: 9.100827811s ago: executing program 4 (id=1054): openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) gettid() r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000700), 0x0) read(r0, &(0x7f0000000200)=""/202, 0xca) r1 = socket(0x10, 0x80003, 0x0) recvmsg$unix(r1, &(0x7f0000000940)={0x0, 0x0, 0x0}, 0x0) write(r1, &(0x7f0000000000)="240000001a005f0214f9f407000904000a000000fe0000000000000008000f00fd000000", 0x85) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, 0x0) recvfrom$inet6(r1, 0x0, 0x0, 0x2042, 0x0, 0x0) 9.083444113s ago: executing program 2 (id=1056): madvise(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x16) syz_clone(0x8a000000, 0x0, 0x0, 0x0, 0x0, 0x0) 8.148467667s ago: executing program 4 (id=1059): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) recvmmsg(r0, 0x0, 0x0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={{0x14}, [@NFT_MSG_NEWRULE={0x14, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}}], {0x14}}, 0x3c}, 0x1, 0x0, 0x0, 0x24004094}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) gettid() r4 = socket$tipc(0x1e, 0x5, 0x0) listen(r4, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000f80)={&(0x7f0000000e80)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x20, 0x20, 0xa, [@func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{0x8, 0x2}]}, @func={0x2, 0x0, 0x0, 0xc, 0x1}]}, {0x0, [0x30, 0x61, 0x2e, 0x0, 0x0, 0x0, 0x2e, 0x61]}}, &(0x7f0000000f40)=""/9, 0x42, 0x9, 0x1, 0xffff7772}, 0x28) bpf$ENABLE_STATS(0x20, 0x0, 0x0) ioctl$PPPIOCGDEBUG(0xffffffffffffffff, 0x80047441, &(0x7f0000000180)) 7.58874545s ago: executing program 0 (id=1060): r0 = socket$unix(0x1, 0x1, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r2, 0x8914, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0x8, 0x10}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=@newqdisc={0x50, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r8, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x24, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x6, 0xfffff65e}}, @TCA_HTB_DIRECT_QLEN={0x8}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r6, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0xdd86, r9, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000840)='\'', 0x30}], 0x1}, 0x4) 7.468992577s ago: executing program 2 (id=1061): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) unshare(0x22020600) r2 = syz_open_dev$sndpcmp(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_LINK(r2, 0x40044160, 0x0) 7.463928327s ago: executing program 1 (id=1062): socket$netlink(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x800, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000240), 0x2, 0x40102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2f) socket(0x28, 0x5, 0x0) socket(0x28, 0x5, 0x0) socket$xdp(0x2c, 0x3, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0xc, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) 6.38087815s ago: executing program 4 (id=1063): r0 = socket$kcm(0x11, 0x3, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xa, 0x7f61, 0xfffffffd, 0xc5, 0xe23, 0x1, 0x1, 0x7fff, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008001}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000600)=@newqdisc={0x68, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0x25dfdc01, {0x0, 0x0, 0x0, r8, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xfff3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x3c, 0x2, [@TCA_TBF_BURST={0x8, 0x6, 0x9}, @TCA_TBF_PBURST={0x8, 0x7, 0x15ca}, @TCA_TBF_PARMS={0x28, 0x1, {{0x3, 0x1, 0x401, 0x2, 0x6281, 0x1aa}, {0x91, 0x2, 0x4, 0x9, 0x1, 0xe2d}, 0x5, 0x7, 0xb2a}}]}}]}, 0x68}, 0x1, 0x0, 0x0, 0x440e0}, 0x4890) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r9, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214000600002fb96d", 0xe}], 0x1}, 0x0) 6.345260081s ago: executing program 2 (id=1064): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, 0x0, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=@newtfilter={0x58, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xb, 0x4}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x28, 0x2, [@TCA_BASIC_EMATCHES={0x24, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x18, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0xceb, 0x7, 0xfff1}, {{0x0, 0x0, 0x1, 0x1}, {0x0, 0x0, 0x1}}}}]}]}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r7, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000500)='\'', 0x1}], 0x1}, 0x4) 6.148526713s ago: executing program 3 (id=1065): setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f0000000040), 0x10000, &(0x7f00000005c0)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x8000}}) unlink(&(0x7f0000000000)='./file0\x00') 5.991527212s ago: executing program 0 (id=1066): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000004c0)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x6, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_NAT={0x8, 0xb, 0x1}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000240)="800000800000210ee7decd7a0000", 0xe, 0x40, 0x0, 0x0) 5.968021354s ago: executing program 1 (id=1067): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000001600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0x80000, {0x0, 0x0, 0x0, r6, {0x0, 0x9}, {0xffe6, 0xb}, {0xffe0, 0xb}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x7fffffff, 0xb, 0x4}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x2000c031}, 0x4008000) r7 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r7, &(0x7f0000000180)="bad330fbc9b55400ffff000007", 0xd, 0x0, &(0x7f00000001c0)={0x11, 0x11, r3, 0x1, 0xd8, 0x6, @multicast}, 0x14) 5.723974618s ago: executing program 3 (id=1068): socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r2 = socket$inet(0x2, 0x801, 0x0) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socket$inet6(0xa, 0x1, 0x0) splice(r2, 0x0, r3, 0x0, 0x7ffff000, 0x0) 5.616739524s ago: executing program 4 (id=1069): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, &(0x7f0000000100), 0xff, 0x4a1, &(0x7f00000004c0)="$eJzs3MtvVFUYAPDvTh+8aUVEQdAqGomPlhZUFi7UaOJCExNd4LK2BZGBGloTIY0WY3BpSNwblyb+Be7cGHVhTNxq4tKQEG1MKK5q7gum02mZlpYpnd8vmc45c1/nu+eemXPv6b0BtK2+9E8SsT0ifo+Injw7f4a+/G12Zmrk+szUSBJzc2/9nWTzXZuZGilnLZfbVmQOVSIqnyXxYrJwuxPnL5werlbHzhX5gckzHwxMnL/wzKkzwyfHTo6dHTp27OiRweefG3p2VeJM47q27+Px/Xtfe+fyGyPHL7/707dpsfYcyKfXxnFL1xsE1EBfutf+mcvUT3t8GWW/G+yoSSedLSwIy9IREWl1dWXtvyc64mbl9cSrn7a0cMCaSn+bNi0+eXoO2MCSaHUJgNYof+jT89/ydYe6HuvC1Zciuov07MzUyOyN+DujUnzetYbb74uI49P/fZW+YrnXIQAAViDr2zzdqP9XiT3Zez7WsbMYQ+mNiHsiYldE3BsRuyPivohs3vujOx7IF57raXL7fXX5hf2fypWGZV4laf/vhZq+32xN/MVbb0eR25HF35WcOFUdO1zsk0PRtSnNDy6xje9f+e2LxabV9v/SV7r9si9YFOBKZ90FutHhyeHV2glXL0bs62wUf3JjJCA9AvZGxL7lrXpnmTj15Df7F5vp1vEvYRXGmea+jngir//pqIu/lCw9PjmwOapjhwfKo2Khn3+99GaR7K6fdlvxr4K0/rfOP/6LKReL955/k3y8tiuq1bFzE8vfxqU/Pl/0nGalx3938nY2Zv3Le/lnHw1PTp4bjOhOXs/y5Y7OPh+6uWyZL+dP4z90sHH731Usk8b/YESkB/GBiHgoIh4uyv5IRDwaEQeXiP/Hlx97f4n4k0iipfU/2vD7L4nYnCV6k9rx+hUkOk7/8N1iI+bN1f/RmM6+a3PZ998tNFvA29+DAAAAsP5VImJ7JJX+PN23PSqV/v78f/h3x9ZKdXxi8qkT4x+eHc3vEeiNrkp5paun5nroYDJdrDHPDxXXisvpR4rrxl92bMny/SPj1dEWxw7tbtv89h9l+0/91dHq0gFrzv1a0L7q23+lReUA7rxmfv+dC8DG1KD9b2lFOYA7z/k/tK9G7f+Turz+P2xMC9v/nw0eWQdsRPr/0L60f2hf2j+0pWbv4i+fp7DihwDMS5Q3C6x8PZubvsN//SX61mTNZQ2tZeG3xM1PorJqa55eB5WyzhNpi1nJ4rGz+WdhzE80eFgNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAXej/AAAA//+q8eIl") prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x200000087}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f0000000580)='./file1\x00', 0x80242, 0x1df2a23c5997fa5f) write$FUSE_CREATE_OPEN(r3, &(0x7f0000000180)={0xa0, 0x0, 0x0, {{0x6, 0x100000000000001, 0x8000000004007, 0xac, 0x800, 0x4, {0x0, 0x4, 0x6218, 0x40000000005, 0x4000000000085, 0xd614, 0x9, 0x7fffffff, 0xfffffffa, 0xc000, 0x0, 0xee00, 0x0, 0x3ff, 0x401}}, {0x0, 0x8}}}, 0xa0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001940)=@newtaction={0xe98, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0xe84, 0x1, [@m_pedit={0xe80, 0x1, 0x0, 0x0, {{0xa}, {0xe54, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe50, 0x2, {{{}, 0x97, 0x0, [{}, {}]}, [{}, {}, {}, {0x0, 0x101}, {}, {0x448eade7}, {0x0, 0x0, 0x80000000}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x20000000}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, {}, {}, {}, {}, {0xfffffffc}, {}, {}, {}, {0x0, 0x4}, {}, {}, {}, {0x0, 0x10}, {}, {0x0, 0x0, 0x0, 0x0, 0xfffffffd}, {}, {}, {}, {}, {}, {0xfffffffe}, {}, {0xd5}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x10}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0xfffffffe}, {}, {0x0, 0x0, 0x0, 0x0, 0x800}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}, {0x0, 0x0, 0x0, 0x4}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0xfffffffd}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0xfffffffd}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xb}], [{}, {}, {}, {}, {}, {0x5}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe98}}, 0x0) 5.304406892s ago: executing program 2 (id=1070): openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) gettid() r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000700), 0x0) read(r0, &(0x7f0000000200)=""/202, 0xca) r1 = socket(0x10, 0x80003, 0x0) recvmsg$unix(r1, &(0x7f0000000940)={0x0, 0x0, 0x0}, 0x0) write(r1, &(0x7f0000000000)="240000001a005f0214f9f407000904000a000000fe0000000000000008000f00fd000000", 0x85) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, 0x0) recvfrom$inet6(r1, 0x0, 0x0, 0x2042, 0x0, 0x0) 5.184321869s ago: executing program 1 (id=1071): io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x2, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, 0x0) memfd_create(0x0, 0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() prlimit64(r0, 0xe, &(0x7f0000000380)={0xd62e, 0xffffffff}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) getpid() syz_mount_image$ext4(&(0x7f0000000280)='ext4\x00', &(0x7f0000000bc0)='./file0\x00', 0x0, &(0x7f00000001c0)={[{@init_itable_val={'init_itable', 0x3d, 0x6}}, {@jqfmt_vfsv1}]}, 0x1, 0xba5, &(0x7f0000000c00)="$eJzs3M1rXFUUAPDzXj6aNmmTiqgtggGpFcVp2hSFrlp3glRBF102JpMSMv0wScGELtK6VxciLgrSv0AE99aFbgQXdSH1LyhikaCbVjDy5iMdOjNJbCe9sf5+cPPunZvOOWdeZ969MC8B/G+NFj/yiH0RcTqLGK4/nkdEf7U3ELFc+727K5cmi5bF6uo7v2eRRcSdlUuTjefK6sfB+mAgIm68nsUTH7bGnV9cmp2oVMpz9fGhhbMXDs0vLr0yc3biTPlM+dzR8deOjr86Pt7FWm9deO/zZ386+cKVax+NvfXZnh+yOB5D9bnmOrplNEbXXpNmvREx0e1gifTU62muM+tNmBAAAOvKm9ZwT8Vw9MS9xdtwfPdz0uQAAACArljtiVgFAAAAHnOZ/T8AAAA85hrfA7izcmmy0dJ+I+HRun0iIkZq9Tfub67N9MZy9TgQfRGx648smm9rzWr/7KGNFpG+/rFctNii+5DXs3w5Ip5pd/6zav0j1bu4W+vPI2KsC/FH7xu3r7/dXdTdsfz9qQeu/3gX4m+ufgDorusnahey1utfvrb+iTbXv942164Hkfr611j/3W1Z/92rv6fD+u/tTcbY/9dLNzrNNa//Tn38y1QRvzg+VFH/wu3LEft729WfrdWfdaj/9CZjDE7eulrrrbYs5Ir6i3obraX+L08+THkbWr0WcSDa19+Qrff3iQ5Nz1TKY7WfHWIc+PbUwU7xm89/0Yr4jb3Ao1Cc/10d6m86/2ffWPm75fxf2GSMkad/29dpbuP681/7s3ervf76Ix9MLCzMHY7oz95sffzI+rk0fqfxHEX9Lz6//vu/3f//4jNhuf46FHuBy/VjMb5yX8zBA0e+evD6t1ZR/9TG57/t+/+TTcb44pur73eaS10/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP8NeUQMRZaX1vp5XipFDEbEk7Err5yfX3h5+vzFc1PFXMRI9OXTM5XyWEQM18ZZMT5c7d8bH7lvPB4ReyPi0+Gd1XFp8nxlKnXxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAArBmMiKHI8lJE5BHx53Cel0qpswIAAAC6biR1AgAAAMCWs/8HAACAx5/9PwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFts73PXb2YRsXxsZ7UV+utzfUkzA7ZanjoBIJme1AkAyfSmTgBIxh4fyDaYH+g4s6PruQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwfR3cd/1mFhHLx3ZWW6G/PteXNDNgq+WpEwCS6UmdAJBMb+oEgGTs8YFsg/mBjjM7up4LAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANvXULVleSki8mo/z0uliN0RMRJ92fRMpTwWEXsi4uLuiGJ8OHXSAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdN384tLsRKVSntsGnXx7pKGjo1NJ/ckEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAK84tLsxOVSnluPnUmAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQGrzi0uzE5VKeW4LO6lrBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgnX8CAAD//+wLCYA=") 5.076621815s ago: executing program 0 (id=1072): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000480)=0x7) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffff000}, 0x94) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, 0x0) preadv(r4, 0x0, 0x0, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a78000000060a0b040000000000000000020000004c000480240001800b000100736f636b657400001400028008000240000000030800014000000002240001800b0001007470726f7879000014000280080001400000000208000340000000100900010073797a30000000000900020073797a3200000000140000001100"], 0xa0}}, 0x40880) 4.048596025s ago: executing program 3 (id=1073): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) recvmmsg(r0, 0x0, 0x0, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={{0x14}, [@NFT_MSG_NEWRULE={0x14, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}}], {0x14}}, 0x3c}, 0x1, 0x0, 0x0, 0x24004094}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) timer_create(0x8, &(0x7f00000000c0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) r4 = socket$tipc(0x1e, 0x5, 0x0) listen(r4, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000f80)={&(0x7f0000000e80)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x20, 0x20, 0xa, [@func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{0x8, 0x2}]}, @func={0x2, 0x0, 0x0, 0xc, 0x1}]}, {0x0, [0x30, 0x61, 0x2e, 0x0, 0x0, 0x0, 0x2e, 0x61]}}, &(0x7f0000000f40)=""/9, 0x42, 0x9, 0x1, 0xffff7772}, 0x28) bpf$ENABLE_STATS(0x20, 0x0, 0x0) ioctl$PPPIOCGDEBUG(0xffffffffffffffff, 0x80047441, &(0x7f0000000180)) 3.909240763s ago: executing program 4 (id=1074): prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000002780)={0x0, 0x0, 0x0}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x0, 0x0) syz_mount_image$f2fs(&(0x7f0000000780), &(0x7f0000000000)='./file2\x00', 0x18000, &(0x7f0000000080)=ANY=[], 0x1, 0x556e, &(0x7f0000004000)="$eJzs3M2LG/UbAPBnst2+//pbxIO3DpTCLjSh2b6gt6otvmBLqXrwpNkkDWmTzLJJ03VB8OBRPPifiIInj/4NHjx7Ew+KN6GSmYl21YIvedm2nw9Mnplvvnnm+YZl4JlZEsBTay39+cckTsWxiFiJiJMRk/0HSUQk00lXivBcRJyOiMpDW1KO/zZwOCKOR8SpSfIiZ1K+9em58ZlLP7z+01ffHDl04rMvv13eqoFlOzu5QJTu94uYdYp4Z7uIjXE3j/2L4zIWb/TvlsdZEe+3t/IM9xvTeY08XugU87Pte8NJvN1rNCex072dj28PihMOx51pnvwDdxo7+XGrvZXH7jDLY2evqGt3r7i27Q1HRZ5Wme/9PH2MRtNYjLd328V6tu/msTkYleNF3qzV3p3EcRmn195m1mvldWz922/54HujO7i3m47bO8NuNkgv1erP1+qXq/WdrNUetS9WG/3W5Yvpeqc3mVYdtRv9K50s6/TatWbW30jXO81mtV5P16+2t7qNQVqv1y7UzlcvbZR759JXbryd9lrp+iS+1B3cG3V7w/R2tpMWn9hIN2sXXthIz9TTN6/fTG/eunbt+s233r36zo0Xr7/2cjnpT2Wl65vnNzer9fPVzfrGU7T+j8qiZ7h++E+SZRcA8Ph5RP8f+n9gns5O+vSyz59t/79zK2L+/X/Msf8vT6f/P2j97wz7/86Jha+/Egdo/TAT/7T//2BOdQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsHDfrX7+ar6zVhyfKMf/Vw49Ux4nEVGJiAd/YSUO78u5UuZZfcT81T/U8HUSeYbJOY6U2/GIuFJuv/x/3t8CAAAAPLm++PD0J0W3XrysLbsgFqm4aVM5+d6M8iURsbr2/YyyVSYvz84oWf73fSh2Z5Qtv4F1dEbJiltuh2aV7W9Z2ReOPhSSIlQWWg4AALAQ+zuBxXYhAAAALNLHyy6A5Uhi+ihz+iw4/8/73x8IHtt3BAAAADyGkmUXAAAAAMxd3v/7/T8AAAB4shW//wcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPArO/eTq0QMxwH8N/Ne3+P5JxLj3qu4g1MYj+DSpeEAXoKV6/EKXoAzYNx4Aw1jmCkEjKCGDgTz+SRD6TB8aQkL2kIBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY0pfUTD+9f/nh1JxV295FRPsHD4euKdMbAAAA4HeWqZl2d8Z9/XE+/zSfep7rVUTUBwbvN3G3kzja5qQD16eb/TZ8jugS1q9xn49HEfEqHz+eDf42AAAAwH9rMZtPIrrBeHczvnSDOKd+0qZ+8qZQXhURafytUFq9zntRKKz7fN/Gu0JpKbbzXAV0U263pdL+Sj8Bt5m1G+0UVV/Ux59frO8AAMAZ5aX4/H3/H0ch3/1sHwAA4Hq8vXQDGMjr4w9XsVnK3C4F3vdFXt572KsBAAAAV6i6dAMAAACAwXXj/2VqPn6NUcH9//r/FBzd/++Xhtj/DwAAAIbT7/8HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAkJapmS5m88mpOav2NGV6AwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/2Z9XHIBBIAyD23frCPc/bPM3QVZjZsTmCwsCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPh3fHPJWEdsiVZVe07buNWr6swqcWWVuLNOPHnQ5/4GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgZX9eUiAEgiAK5oz/nfT9DysJegYRIqDhUUUtGgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPim3/3yf2JqnEnmThtLxyPJ2lVj66qx96Bx9GC8/RsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgYuf+feMmwwAAv2ffXWkBEQLKEAaQGGCh6bW0dAMGUMTAn4AUpdcSeuVHm4FWFSgLG2TugsqIEBIobJ1ZO7dSl7B1yFAkJLZD9tmJQxPlQlP7aJ5H+u57bfk+v5+vavL68wUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgNLGu1txmr1MjeKk2HfnwfXFrL/7rz5za/XebNayeFhn0v8PR6sbrZnmEgEAAOBwaBW1fVpsr3fW5rM+mcrr/055XFbz33x26z2xQ91f9mXtn7Xffr3/4ubJpkbnyQY9vzTon3g4nfbjm+lke27PI9r5lc/vvaT5B5J8sPLCRie/nq1vb99+r5uHR+rIFgDY1XD3H8bHR936zSIofx/K+l5N6QFwuLUrhXdZ/6dTzeYEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUIeNlXi6jFsRMdveijN3H1xf3Km/tXpvtmxnbtxYrY6ZDdGJiPNLg/6JGucy6a5cvXZxYTDoX94r6Mbex+wveDkiDnTAfQRvF9O/+NEYB0eMN/Lfw+EwjTjwCyV4tCApPuxJyWcU/P7f3z4s//U+pgzfiYhBQ/8hAQDwxOoULavr1ztr89m+1nTE8Ift9f9rlTjGrP/vf3zmTn7wd8m282X1f6++KU68ueVLn89duXrtjaVLCxf6F/qfvnmy91bv1NnTp8/O5fdK5twxAQAA4NF0i1at/5Pph9f/j1XiGLP+/+L73lfVc6Xq/x1tLfo1nQkAAMDh9vwrf/3Z2mF/q9uNLxeWly/3Rq+b2ydHrw2kum9Hilat/9PpprMCAAAA6rCx0tq2/n+uEseY6//P/PjSz9Ux04g4Wqz/H1/8bHCuvulMtIP88vDXu3xPvuk5AgAA0KyjRauu/3fy5/+TzUcekoh4/dVRXPwZwLHq//T9b36qnqv6/P+p+qY4kZKZ0fXI+5mI9kzTGQEAAPAke6poWbH/R2dt/pNfjn3Y9fw/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQN3+CQAA//+K6TmR") prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f0000002840)='./file0\x00', &(0x7f0000002880), 0x700, &(0x7f0000000200)=ANY=[@ANYBLOB='dy']) 3.688848066s ago: executing program 2 (id=1075): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) unshare(0x22020600) r2 = syz_open_dev$sndpcmp(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_LINK(r2, 0x40044160, 0x0) 3.402181133s ago: executing program 0 (id=1076): r0 = socket$unix(0x1, 0x1, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r2, 0x8914, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0x8, 0x10}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=@newqdisc={0x50, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r8, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x24, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x6, 0xfffff65e}}, @TCA_HTB_DIRECT_QLEN={0x8}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r6, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0xdd86, r9, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000840)='\'', 0x30}], 0x1}, 0x4) 2.377671882s ago: executing program 3 (id=1077): socket$netlink(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x800, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000240), 0x2, 0x40102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2f) socket(0x28, 0x5, 0x0) socket(0x28, 0x5, 0x0) socket$xdp(0x2c, 0x3, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0xc, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) 2.330975565s ago: executing program 2 (id=1078): socketpair$nbd(0x1, 0x1, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x61, 0x8e}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) prlimit64(r0, 0xb, 0x0, &(0x7f0000000100)) add_key(&(0x7f00000000c0)='pkcs7_test\x00', 0x0, &(0x7f0000000000)="100c0608262329ba8b0ad775b31b", 0xe, 0xfffffffffffffffc) recvmmsg(r3, &(0x7f0000000d00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2100, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) r4 = socket(0x10, 0x2, 0x0) recvmmsg(r4, &(0x7f0000002ec0), 0x0, 0x2, 0x0) 1.981731215s ago: executing program 1 (id=1079): r0 = socket$kcm(0x11, 0x3, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xb}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0xa, 0x7f61, 0xfffffffd, 0xc5, 0xe23, 0x1, 0x1, 0x7fff, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20008001}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000600)=@newqdisc={0x68, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0x25dfdc01, {0x0, 0x0, 0x0, r8, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xfff3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x3c, 0x2, [@TCA_TBF_BURST={0x8, 0x6, 0x9}, @TCA_TBF_PBURST={0x8, 0x7, 0x15ca}, @TCA_TBF_PARMS={0x28, 0x1, {{0x3, 0x1, 0x401, 0x2, 0x6281, 0x1aa}, {0x91, 0x2, 0x4, 0x9, 0x1, 0xe2d}, 0x5, 0x7, 0xb2a}}]}}]}, 0x68}, 0x1, 0x0, 0x0, 0x440e0}, 0x4890) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r9, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214000600002fb96d", 0xe}], 0x1}, 0x0) 1.89516345s ago: executing program 0 (id=1080): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=@newtfilter={0x58, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xb, 0x4}, {}, {0x7, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x28, 0x2, [@TCA_BASIC_EMATCHES={0x24, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x18, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x1, 0x0, 0x0, {{0xceb, 0x7, 0xfff1}, {{0x0, 0x0, 0x1, 0x1}, {0x0, 0x0, 0x1}}}}]}]}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r7, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000500)='\'', 0x1}], 0x1}, 0x4) 926.889717ms ago: executing program 3 (id=1081): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000001600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000540)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0x80000, {0x0, 0x0, 0x0, r6, {0x0, 0x9}, {0xffe6, 0xb}, {0xffe0, 0xb}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x7fffffff, 0xb, 0x4}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x2000c031}, 0x4008000) r7 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r7, &(0x7f0000000180)="bad330fbc9b55400ffff000007", 0xd, 0x0, &(0x7f00000001c0)={0x11, 0x11, r3, 0x1, 0xd8, 0x6, @multicast}, 0x14) 859.55024ms ago: executing program 4 (id=1082): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000004c0)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000140)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x6, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_NAT={0x8, 0xb, 0x1}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f0000000240)="800000800000210ee7decd7a0000", 0xe, 0x40, 0x0, 0x0) 773.857215ms ago: executing program 1 (id=1083): setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f0000000040), 0x10000, &(0x7f00000005c0)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x8000}}) unlink(&(0x7f0000000000)='./file0\x00') 218.653267ms ago: executing program 1 (id=1084): socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = getpid() prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r3 = socket$inet(0x2, 0x801, 0x0) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) socket$inet6(0xa, 0x1, 0x0) splice(r3, 0x0, r4, 0x0, 0x7ffff000, 0x0) 36.629558ms ago: executing program 3 (id=1085): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000000c0)='./file1\x00', 0x0, &(0x7f0000000100), 0xff, 0x4a1, &(0x7f00000004c0)="$eJzs3MtvVFUYAPDvTh+8aUVEQdAqGomPlhZUFi7UaOJCExNd4LK2BZGBGloTIY0WY3BpSNwblyb+Be7cGHVhTNxq4tKQEG1MKK5q7gum02mZlpYpnd8vmc45c1/nu+eemXPv6b0BtK2+9E8SsT0ifo+Injw7f4a+/G12Zmrk+szUSBJzc2/9nWTzXZuZGilnLZfbVmQOVSIqnyXxYrJwuxPnL5werlbHzhX5gckzHwxMnL/wzKkzwyfHTo6dHTp27OiRweefG3p2VeJM47q27+Px/Xtfe+fyGyPHL7/707dpsfYcyKfXxnFL1xsE1EBfutf+mcvUT3t8GWW/G+yoSSedLSwIy9IREWl1dWXtvyc64mbl9cSrn7a0cMCaSn+bNi0+eXoO2MCSaHUJgNYof+jT89/ydYe6HuvC1Zciuov07MzUyOyN+DujUnzetYbb74uI49P/fZW+YrnXIQAAViDr2zzdqP9XiT3Zez7WsbMYQ+mNiHsiYldE3BsRuyPivohs3vujOx7IF57raXL7fXX5hf2fypWGZV4laf/vhZq+32xN/MVbb0eR25HF35WcOFUdO1zsk0PRtSnNDy6xje9f+e2LxabV9v/SV7r9si9YFOBKZ90FutHhyeHV2glXL0bs62wUf3JjJCA9AvZGxL7lrXpnmTj15Df7F5vp1vEvYRXGmea+jngir//pqIu/lCw9PjmwOapjhwfKo2Khn3+99GaR7K6fdlvxr4K0/rfOP/6LKReL955/k3y8tiuq1bFzE8vfxqU/Pl/0nGalx3938nY2Zv3Le/lnHw1PTp4bjOhOXs/y5Y7OPh+6uWyZL+dP4z90sHH731Usk8b/YESkB/GBiHgoIh4uyv5IRDwaEQeXiP/Hlx97f4n4k0iipfU/2vD7L4nYnCV6k9rx+hUkOk7/8N1iI+bN1f/RmM6+a3PZ998tNFvA29+DAAAAsP5VImJ7JJX+PN23PSqV/v78f/h3x9ZKdXxi8qkT4x+eHc3vEeiNrkp5paun5nroYDJdrDHPDxXXisvpR4rrxl92bMny/SPj1dEWxw7tbtv89h9l+0/91dHq0gFrzv1a0L7q23+lReUA7rxmfv+dC8DG1KD9b2lFOYA7z/k/tK9G7f+Turz+P2xMC9v/nw0eWQdsRPr/0L60f2hf2j+0pWbv4i+fp7DihwDMS5Q3C6x8PZubvsN//SX61mTNZQ2tZeG3xM1PorJqa55eB5WyzhNpi1nJ4rGz+WdhzE80eFgNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAXej/AAAA//+q8eIl") prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x200000087}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = open(&(0x7f0000000580)='./file1\x00', 0x80242, 0x1df2a23c5997fa5f) sendfile(r3, r3, &(0x7f0000000080), 0x7f03) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001940)=@newtaction={0xe98, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0xe84, 0x1, [@m_pedit={0xe80, 0x1, 0x0, 0x0, {{0xa}, {0xe54, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe50, 0x2, {{{}, 0x97, 0x0, [{}, {}]}, [{}, {}, {}, {0x0, 0x101}, {}, {0x448eade7}, {0x0, 0x0, 0x80000000}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x20000000}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, {}, {}, {}, {}, {0xfffffffc}, {}, {}, {}, {0x0, 0x4}, {}, {}, {}, {0x0, 0x10}, {}, {0x0, 0x0, 0x0, 0x0, 0xfffffffd}, {}, {}, {}, {}, {}, {0xfffffffe}, {}, {0xd5}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x10}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0xfffffffe}, {}, {0x0, 0x0, 0x0, 0x0, 0x800}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}, {0x0, 0x0, 0x0, 0x4}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0xfffffffd}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0xfffffffd}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xb}], [{}, {}, {}, {}, {}, {0x5}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe98}}, 0x0) 0s ago: executing program 0 (id=1086): r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x8000000004) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, 0x0, 0x0) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) r5 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r5, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) setsockopt$ax25_SO_BINDTODEVICE(r5, 0x101, 0x19, 0x0, 0x0) kernel console output (not intermixed with test programs): ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 72.613175][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 72.625522][ T154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.635289][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.643728][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.656861][ T4192] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.677036][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 72.686325][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 72.695457][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 72.704054][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 72.713782][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 72.743285][ T1646] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.756214][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 72.764851][ T1646] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.776204][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 72.785768][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 72.796975][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.808426][ T4192] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 72.832212][ T4185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 72.844376][ T4185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.855853][ T4185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 72.866662][ T4185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 72.879969][ T4185] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 72.889355][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 72.897956][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 72.906153][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 72.914427][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 72.923971][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 72.933474][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 72.941975][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 72.950541][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 72.959244][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 72.970896][ T4192] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.979632][ T4192] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.990914][ T4192] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 72.999661][ T4192] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.011927][ T4186] device veth0_vlan entered promiscuous mode [ 73.019829][ T4198] device veth0_vlan entered promiscuous mode [ 73.030815][ T4233] Bluetooth: hci4: command 0x040f tx timeout [ 73.031252][ T4185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.037638][ T4233] Bluetooth: hci2: command 0x040f tx timeout [ 73.047631][ T4247] Bluetooth: hci0: command 0x040f tx timeout [ 73.059841][ T4247] Bluetooth: hci1: command 0x040f tx timeout [ 73.067268][ T4185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.077777][ T4185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 73.089169][ T4233] Bluetooth: hci3: command 0x040f tx timeout [ 73.094570][ T4185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.109180][ T4185] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 73.122718][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 73.134751][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 73.145343][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 73.158027][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 73.187353][ T4198] device veth1_vlan entered promiscuous mode [ 73.206452][ T4185] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.217877][ T4185] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.227319][ T4185] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.236412][ T4185] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.255902][ T4186] device veth1_vlan entered promiscuous mode [ 73.410311][ T4186] device veth0_macvtap entered promiscuous mode [ 73.431340][ T4225] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.448364][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 73.463541][ T4225] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.476895][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 73.495475][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 73.504924][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 73.514055][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 73.522768][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 73.536398][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 73.545337][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 73.561612][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 73.576029][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 73.618571][ T4186] device veth1_macvtap entered promiscuous mode [ 73.669710][ T4198] device veth0_macvtap entered promiscuous mode [ 73.695208][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.720696][ T1646] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.730725][ T1646] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.740235][ T4198] device veth1_macvtap entered promiscuous mode [ 73.756119][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.782351][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.800901][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.820424][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.832331][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.858705][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 73.873141][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 73.887142][ T4186] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 73.897293][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 73.909825][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 73.929459][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 73.941495][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 73.955151][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 73.989662][ T4198] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 74.010920][ T4198] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.022607][ T4198] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 74.033513][ T4198] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.045341][ T4198] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 74.056190][ T4198] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.067459][ T4198] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 74.078348][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 74.087871][ T4198] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.112633][ T4198] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.130303][ T4225] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 74.166943][ T4225] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 74.186654][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 74.198264][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.210927][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 74.258911][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.271355][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 74.291993][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.320174][ T4186] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.350009][ T1646] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 74.358730][ T4198] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 74.379477][ T1646] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.391059][ T4198] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.416455][ T4198] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 74.437016][ T4198] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.490585][ T4198] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 74.531862][ T4198] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.576041][ T4198] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 74.613972][ T4198] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 74.676842][ T4198] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.700071][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 74.848916][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 74.880853][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 74.901274][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 74.911550][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 74.939178][ T4186] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.959011][ T4186] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.009416][ T4186] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.019573][ T4186] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.057027][ T4198] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.068000][ T4198] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.087336][ T4198] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.107697][ T4198] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 75.117442][ T4296] Bluetooth: hci3: command 0x0419 tx timeout [ 75.123704][ T4296] Bluetooth: hci2: command 0x0419 tx timeout [ 75.141125][ T4296] Bluetooth: hci1: command 0x0419 tx timeout [ 75.187153][ T4296] Bluetooth: hci0: command 0x0419 tx timeout [ 75.207561][ T4296] Bluetooth: hci4: command 0x0419 tx timeout [ 75.260610][ T4174] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 75.366536][ T4314] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 75.374089][ T4314] IPv6: NLM_F_CREATE should be set when creating new route [ 75.620700][ T4174] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 75.800853][ T4174] usb 1-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ec.7e [ 75.814473][ T4174] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 75.826287][ T4174] usb 1-1: Product: syz [ 75.831731][ T4174] usb 1-1: Manufacturer: syz [ 75.837427][ T4174] usb 1-1: SerialNumber: syz [ 75.847762][ T4174] usb 1-1: config 0 descriptor?? [ 75.892650][ T4174] hub 1-1:0.0: bad descriptor, ignoring hub [ 75.898810][ T4174] hub: probe of 1-1:0.0 failed with error -5 [ 75.918174][ T4174] input: syz syz as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input5 [ 75.969185][ T4317] syz.2.10 uses obsolete (PF_INET,SOCK_PACKET) [ 76.139073][ T4314] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.147408][ T4314] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.684677][ T4314] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 76.739865][ T4314] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 76.961402][ T4325] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 77.051909][ T4325] kvm: emulating exchange as write [ 77.342547][ T4314] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 77.352082][ T4314] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 77.361273][ T4314] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 77.370193][ T4314] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 77.584254][ T4328] netlink: 'syz.0.12': attribute type 39 has an invalid length. [ 77.637054][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.648544][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.660712][ T4335] device bridge_slave_0 left promiscuous mode [ 77.685457][ T4335] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.719132][ T4335] device bridge_slave_1 left promiscuous mode [ 77.733155][ T4335] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.745993][ T4335] bond0: (slave bond_slave_0): Releasing backup interface [ 77.759057][ T4335] bond0: (slave bond_slave_1): Releasing backup interface [ 77.771441][ T4335] team0: Port device team_slave_0 removed [ 77.779524][ T4335] team0: Port device team_slave_1 removed [ 77.786887][ T4338] binder: 4336:4338 unknown command 1074553619 [ 77.796075][ T4335] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 77.803744][ T4338] binder: 4336:4338 ioctl c0306201 200000000040 returned -22 [ 77.813261][ T4335] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 77.835484][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 77.896729][ T155] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.917316][ T155] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.973473][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 77.981294][ T155] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.998241][ T155] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.017979][ T1646] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 78.064281][ T155] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.073393][ T155] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.082237][ T4341] input: syz1 as /devices/virtual/input/input6 [ 78.133059][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 78.160615][ T4277] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 78.500089][ T4179] usb 1-1: reset full-speed USB device number 2 using dummy_hcd [ 78.553620][ T4179] usb 1-1: device reset changed ep0 maxpacket size! [ 78.861014][ T4277] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 79.047773][ T4277] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 79.291098][ T4238] usb 1-1: USB disconnect, device number 2 [ 79.430190][ T4341] input: failed to attach handler mousedev to device input6, error: -4 [ 79.500775][ T4277] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 79.526159][ T4277] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 79.536531][ T4277] usb 3-1: SerialNumber: syz [ 79.614476][ T4372] device bond_slave_0 entered promiscuous mode [ 79.620987][ T4372] device bond_slave_1 entered promiscuous mode [ 79.628435][ T4372] device vlan2 entered promiscuous mode [ 79.634654][ T4372] device bond0 entered promiscuous mode [ 79.670701][ T4238] usb 1-1: new full-speed USB device number 3 using dummy_hcd [ 79.976587][ T26] audit: type=1326 audit(1769957698.753:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4373 comm="syz.3.21" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fed2f355eb9 code=0x0 [ 80.051960][ T4238] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 80.060274][ T4238] usb 1-1: config 0 has no interface number 0 [ 80.069551][ T4277] usb 3-1: 0:2 : does not exist [ 80.075782][ T4238] usb 1-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8c.1e [ 80.087064][ T4277] usb 3-1: usbmixer: too many channels (61) in unit 5 [ 80.097179][ T4238] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 80.124611][ T4238] usb 1-1: config 0 descriptor?? [ 80.145924][ T4277] usb 3-1: USB disconnect, device number 2 [ 80.175896][ T4238] usb 1-1: selecting invalid altsetting 1 [ 80.185321][ T4247] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 80.194954][ T4238] dvb_ttusb_budget: ttusb_init_controller: error [ 80.202359][ T4238] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 80.266489][ T4238] DVB: Unable to find symbol cx22700_attach() [ 80.325388][ T4238] DVB: Unable to find symbol tda10046_attach() [ 80.342046][ T4238] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 80.402012][ T4175] udevd[4175]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 80.430604][ T4247] usb 2-1: Using ep0 maxpacket: 8 [ 80.457170][ T4233] usb 1-1: USB disconnect, device number 3 [ 80.590564][ T4247] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 80.615734][ T4247] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 80.627678][ T4247] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 80.638954][ T4247] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 80.652664][ T4247] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 80.661252][ T4277] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 80.672696][ T4247] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 80.937729][ T4277] usb 5-1: Using ep0 maxpacket: 32 [ 80.941206][ T4247] usb 2-1: GET_CAPABILITIES returned 0 [ 80.948568][ T4247] usbtmc 2-1:16.0: can't read capabilities [ 80.954922][ T13] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 81.201667][ T13] usb 4-1: Using ep0 maxpacket: 8 [ 81.215493][ T4233] usb 2-1: USB disconnect, device number 2 [ 81.240924][ T4277] usb 5-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 81.265730][ T4277] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 81.283075][ T4277] usb 5-1: Product: syz [ 81.287459][ T4277] usb 5-1: Manufacturer: syz [ 81.294796][ T4277] usb 5-1: SerialNumber: syz [ 81.302022][ T4393] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 81.320645][ T4277] usb 5-1: config 0 descriptor?? [ 81.320667][ T13] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 81.353467][ T13] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 81.384188][ T13] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 81.405621][ T13] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 81.427851][ T4393] Zero length message leads to an empty skb [ 81.438185][ T13] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 81.481694][ T13] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 81.588360][ T4277] RobotFuzz Open Source InterFace, OSIF 5-1:0.0: version d4.15 found at bus 005 address 002 [ 81.723238][ T4395] uffd: Set unprivileged_userfaultfd sysctl knob to 1 if kernel faults must be handled without obtaining CAP_SYS_PTRACE capability [ 81.760584][ T13] usb 4-1: GET_CAPABILITIES returned 0 [ 81.766337][ T13] usbtmc 4-1:16.0: can't read capabilities [ 81.986455][ T13] usb 4-1: USB disconnect, device number 2 [ 82.225958][ T4247] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 82.313287][ T4399] mmap: syz.4.23 (4399) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. [ 82.340610][ T4384] i2c i2c-1: failure reading status [ 82.349652][ T13] usb 5-1: USB disconnect, device number 2 [ 82.591170][ T4403] device team_slave_0 entered promiscuous mode [ 82.597736][ T4403] device team_slave_1 entered promiscuous mode [ 82.601417][ T4247] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 82.635185][ T4247] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 82.641635][ T4403] device vlan2 entered promiscuous mode [ 82.680525][ T4403] device team0 entered promiscuous mode [ 82.686616][ T4247] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 12592, setting to 64 [ 82.728583][ T4247] usb 2-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 82.767198][ T4247] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 82.830794][ T4401] raw-gadget.2 gadget: fail, usb_ep_enable returned -22 [ 82.851651][ T4247] hub 2-1:1.0: bad descriptor, ignoring hub [ 82.857674][ T4247] hub: probe of 2-1:1.0 failed with error -5 [ 82.906548][ T4247] cdc_wdm 2-1:1.0: skipping garbage [ 82.966793][ T4247] cdc_wdm 2-1:1.0: skipping garbage [ 82.989112][ T4247] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 83.021025][ T4247] cdc_wdm 2-1:1.0: Unknown control protocol [ 83.036764][ T4408] netlink: 12 bytes leftover after parsing attributes in process `syz.4.33'. [ 83.447760][ T4247] usb 2-1: USB disconnect, device number 3 [ 83.673528][ T13] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 83.930590][ T13] usb 5-1: Using ep0 maxpacket: 16 [ 83.947714][ T4423] netlink: 92 bytes leftover after parsing attributes in process `syz.2.37'. [ 84.050691][ T13] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 84.076680][ T13] usb 5-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 84.101760][ T13] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 84.125235][ T4429] netlink: 12 bytes leftover after parsing attributes in process `syz.1.38'. [ 84.143047][ T13] usb 5-1: config 0 descriptor?? [ 84.156450][ T4429] device vlan2 entered promiscuous mode [ 84.195123][ T4429] device veth0 entered promiscuous mode [ 84.329234][ T4432] device syzkaller0 entered promiscuous mode [ 84.400741][ T4277] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 84.854137][ T4277] usb 1-1: config index 0 descriptor too short (expected 23569, got 27) [ 84.863701][ T4441] netlink: 4 bytes leftover after parsing attributes in process `syz.1.41'. [ 84.887833][ T4277] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 84.994644][ T4277] usb 1-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 85.034770][ T4277] usb 1-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 85.060590][ T13] usbhid 5-1:0.0: can't add hid device: -71 [ 85.077491][ T13] usbhid: probe of 5-1:0.0 failed with error -71 [ 85.093362][ T4277] usb 1-1: Manufacturer: syz [ 85.109447][ T13] usb 5-1: USB disconnect, device number 3 [ 85.162390][ T4277] usb 1-1: config 0 descriptor?? [ 85.330457][ T4277] rc_core: IR keymap rc-hauppauge not found [ 85.340507][ T4277] Registered IR keymap rc-empty [ 85.353936][ T4277] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 85.425098][ T4277] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input7 [ 85.790464][ T4277] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 86.060629][ T4277] usb 3-1: Using ep0 maxpacket: 32 [ 86.191014][ T4277] usb 3-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 86.221645][ T4277] usb 3-1: config 155 interface 0 altsetting 0 has an invalid endpoint with address 0xE2, skipping [ 86.267534][ T4277] usb 3-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 86.540707][ T4277] usb 3-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 86.560565][ T4277] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 86.568796][ T4277] usb 3-1: Product: syz [ 86.590427][ T4277] usb 3-1: Manufacturer: syz [ 86.596024][ T4277] usb 3-1: SerialNumber: syz [ 86.672667][ T4277] imon:imon_find_endpoints: no valid input (IR) endpoint found [ 86.731269][ T4277] imon 3-1:155.0: unable to initialize intf0, err -19 [ 86.749083][ T4277] imon:imon_probe: failed to initialize context! [ 86.768427][ T4277] imon 3-1:155.0: unable to register, err -19 [ 86.796621][ T1335] cfg80211: failed to load regulatory.db [ 87.252529][ T4467] ======================================================= [ 87.252529][ T4467] WARNING: The mand mount option has been deprecated and [ 87.252529][ T4467] and is ignored by this kernel. Remove the mand [ 87.252529][ T4467] option from the mount to silence this warning. [ 87.252529][ T4467] ======================================================= [ 87.366124][ T4470] process 'syz.4.49' launched './file0' with NULL argv: empty string added [ 87.681398][ T4473] netlink: 24 bytes leftover after parsing attributes in process `syz.1.50'. [ 87.848021][ T1335] usb 1-1: USB disconnect, device number 4 [ 87.917566][ T4479] device syzkaller0 entered promiscuous mode [ 87.963011][ T4479] sch_tbf: burst 9 is lower than device syzkaller0 mtu (1514) ! [ 88.357449][ T26] audit: type=1326 audit(1769957707.133:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4485 comm="syz.1.55" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1e9fe18eb9 code=0x7ffc0000 [ 88.428359][ T26] audit: type=1326 audit(1769957707.173:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4485 comm="syz.1.55" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1e9fe18eb9 code=0x7ffc0000 [ 88.494819][ T26] audit: type=1326 audit(1769957707.173:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4485 comm="syz.1.55" exe="/root/syz-executor" sig=0 arch=c000003e syscall=246 compat=0 ip=0x7f1e9fe18eb9 code=0x7ffc0000 [ 88.547354][ T26] audit: type=1326 audit(1769957707.173:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4485 comm="syz.1.55" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1e9fe18eb9 code=0x7ffc0000 [ 88.613945][ T26] audit: type=1326 audit(1769957707.183:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4485 comm="syz.1.55" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1e9fe18eb9 code=0x7ffc0000 [ 88.669601][ T26] audit: type=1326 audit(1769957707.233:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4485 comm="syz.1.55" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f1e9fe18eb9 code=0x7ffc0000 [ 88.697287][ T26] audit: type=1326 audit(1769957707.233:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4485 comm="syz.1.55" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1e9fe18eb9 code=0x7ffc0000 [ 88.721008][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #28a!!! [ 88.744639][ T26] audit: type=1326 audit(1769957707.233:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4485 comm="syz.1.55" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1e9fe18eb9 code=0x7ffc0000 [ 88.769860][ T26] audit: type=1326 audit(1769957707.293:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4485 comm="syz.1.55" exe="/root/syz-executor" sig=0 arch=c000003e syscall=10 compat=0 ip=0x7f1e9fe18eb9 code=0x7ffc0000 [ 88.850226][ T1335] usb 3-1: USB disconnect, device number 3 [ 88.870648][ T26] audit: type=1326 audit(1769957707.293:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4485 comm="syz.1.55" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1e9fe18eb9 code=0x7ffc0000 [ 88.964783][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #208!!! [ 89.802108][ T1107] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 90.170700][ T1107] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 90.178767][ T1107] usb 2-1: config 0 has no interface number 0 [ 90.235718][ T1107] usb 2-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8c.1e [ 90.285909][ T1107] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 90.328565][ T1107] usb 2-1: config 0 descriptor?? [ 90.382580][ T1107] usb 2-1: selecting invalid altsetting 1 [ 90.403013][ T1107] dvb_ttusb_budget: ttusb_init_controller: error [ 90.435098][ T1107] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 90.644496][ T1107] DVB: Unable to find symbol cx22700_attach() [ 90.812518][ T1107] DVB: Unable to find symbol tda10046_attach() [ 90.818742][ T1107] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 90.856811][ T1107] usb 2-1: USB disconnect, device number 4 [ 91.062715][ T7] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 91.310636][ T7] usb 1-1: Using ep0 maxpacket: 32 [ 91.430656][ T7] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 91.448719][ T7] usb 1-1: config 0 has no interface number 0 [ 91.630603][ T7] usb 1-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 91.647423][ T7] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 91.699493][ T7] usb 1-1: Product: syz [ 91.718064][ T7] usb 1-1: Manufacturer: syz [ 91.761561][ T7] usb 1-1: SerialNumber: syz [ 91.812742][ T7] usb 1-1: config 0 descriptor?? [ 91.902583][ T7] usb 1-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 91.939985][ T7] usb 1-1: selecting invalid altsetting 1 [ 91.966525][ T7] usb 1-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 92.057639][ T7] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 92.086129][ T4549] loop1: detected capacity change from 0 to 32768 [ 92.121942][ T7] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 92.135476][ T4549] XFS: noikeep mount option is deprecated. [ 92.170558][ T7] usb 1-1: media controller created [ 92.319610][ T7] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 92.324304][ T4549] XFS (loop1): Mounting V5 Filesystem [ 92.420599][ T7] usb 1-1: dvb_usb_ce6230: usb_control_msg() failed=-71 [ 92.438418][ T7] zl10353_read_register: readreg error (reg=127, ret==-71) [ 92.499185][ T4549] XFS (loop1): Torn write (CRC failure) detected at log block 0x30. Truncating head block from 0x51. [ 92.511241][ T7] usb 1-1: dvb_usb_ce6230: usb_set_interface() failed=-71 [ 92.581153][ T4549] XFS (loop1): Starting recovery (logdev: internal) [ 92.619331][ T7] usb 1-1: USB disconnect, device number 5 [ 92.689571][ T4549] XFS (loop1): Ending recovery (logdev: internal) [ 92.950513][ T4549] syz.1.75 (4549) used greatest stack depth: 19536 bytes left [ 92.963687][ T4186] XFS (loop1): Unmounting Filesystem [ 93.220577][ T7] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 93.470490][ T7] usb 1-1: Using ep0 maxpacket: 8 [ 93.610660][ T7] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 93.666756][ T4581] loop2: detected capacity change from 0 to 256 [ 93.685173][ T7] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 93.738832][ T7] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 93.789349][ T7] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 93.844586][ T7] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 93.906114][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #140!!! [ 93.964148][ T4581] exfat: Deprecated parameter 'utf8' [ 93.970044][ T4581] exfat: Deprecated parameter 'namecase' [ 94.276250][ T4581] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0xbe675ead, utbl_chksum : 0xe619d30d) [ 94.380667][ T7] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 94.389914][ T7] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 94.470939][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 94.479987][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 94.488945][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 94.497951][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 94.506868][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 94.515894][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #08!!! [ 94.760634][ T7] usb 1-1: GET_CAPABILITIES returned 0 [ 94.766186][ T7] usbtmc 1-1:16.0: can't read capabilities [ 95.005856][ T1335] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 95.260598][ T1335] usb 3-1: Using ep0 maxpacket: 32 [ 95.380686][ T1335] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 95.407712][ T1335] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 95.445614][ T1335] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 95.490664][ T1335] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 95.516271][ T1335] usb 3-1: config 0 descriptor?? [ 96.089331][ T1335] savu 0003:1E7D:2D5A.0001: hiddev1,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.2-1/input0 [ 96.219336][ T1335] usb 3-1: USB disconnect, device number 4 [ 96.379919][ T4615] fido_id[4615]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 97.081069][ T4233] usb 5-1: new full-speed USB device number 4 using dummy_hcd [ 97.540621][ T4233] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 97.613375][ T4233] usb 5-1: config 0 has no interface number 0 [ 97.620066][ T4233] usb 5-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8c.1e [ 97.670465][ T4233] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 97.711225][ T4233] usb 5-1: config 0 descriptor?? [ 97.751992][ T4233] usb 5-1: selecting invalid altsetting 1 [ 97.766159][ T4233] dvb_ttusb_budget: ttusb_init_controller: error [ 97.776209][ T4233] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 98.025135][ T4233] DVB: Unable to find symbol cx22700_attach() [ 98.142069][ T4233] DVB: Unable to find symbol tda10046_attach() [ 98.150304][ T4233] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 98.212164][ T4233] usb 5-1: USB disconnect, device number 4 [ 99.398046][ T26] kauditd_printk_skb: 21 callbacks suppressed [ 99.398060][ T26] audit: type=1326 audit(1769957718.173:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4666 comm="syz.3.101" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fed2f355eb9 code=0x7ffc0000 [ 99.460823][ T26] audit: type=1326 audit(1769957718.213:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4666 comm="syz.3.101" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fed2f355eb9 code=0x7ffc0000 [ 99.488648][ T26] audit: type=1326 audit(1769957718.233:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4666 comm="syz.3.101" exe="/root/syz-executor" sig=0 arch=c000003e syscall=246 compat=0 ip=0x7fed2f355eb9 code=0x7ffc0000 [ 99.546602][ T26] audit: type=1326 audit(1769957718.233:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4666 comm="syz.3.101" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fed2f355eb9 code=0x7ffc0000 [ 99.570495][ T4261] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 99.581847][ T26] audit: type=1326 audit(1769957718.233:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4666 comm="syz.3.101" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fed2f355eb9 code=0x7ffc0000 [ 99.626277][ T26] audit: type=1326 audit(1769957718.233:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4666 comm="syz.3.101" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fed2f355eb9 code=0x7ffc0000 [ 99.688834][ T26] audit: type=1326 audit(1769957718.233:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4666 comm="syz.3.101" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fed2f355eb9 code=0x7ffc0000 [ 99.724271][ T26] audit: type=1326 audit(1769957718.233:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4666 comm="syz.3.101" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7fed2f355eb9 code=0x7ffc0000 [ 99.755670][ T26] audit: type=1326 audit(1769957718.233:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4666 comm="syz.3.101" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fed2f355eb9 code=0x7ffc0000 [ 99.789899][ T26] audit: type=1326 audit(1769957718.233:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4666 comm="syz.3.101" exe="/root/syz-executor" sig=0 arch=c000003e syscall=10 compat=0 ip=0x7fed2f355eb9 code=0x7ffc0000 [ 99.880695][ T4261] usb 5-1: Using ep0 maxpacket: 32 [ 100.010557][ T4576] usbtmc 1-1:16.0: usb_control_msg returned -110 [ 100.017403][ T4261] usb 5-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 100.043113][ T4261] usb 5-1: config 155 interface 0 altsetting 0 has an invalid endpoint with address 0xE2, skipping [ 100.080063][ T4261] usb 5-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 100.115273][ T1107] usb 1-1: USB disconnect, device number 6 [ 100.290714][ T4261] usb 5-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 100.309386][ T4682] ODEBUG: Out of memory. ODEBUG disabled [ 100.315781][ T4261] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 100.334538][ T4261] usb 5-1: Product: syz [ 100.344702][ T4261] usb 5-1: Manufacturer: syz [ 100.354878][ T4261] usb 5-1: SerialNumber: syz [ 100.402532][ T4261] imon:imon_find_endpoints: no valid input (IR) endpoint found [ 100.416064][ T4261] imon 5-1:155.0: unable to initialize intf0, err -19 [ 100.443684][ T4261] imon:imon_probe: failed to initialize context! [ 100.450123][ T4261] imon 5-1:155.0: unable to register, err -19 [ 100.490456][ T1107] usb 1-1: new full-speed USB device number 7 using dummy_hcd [ 100.910739][ T1107] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 100.924408][ T1107] usb 1-1: config 0 has no interface number 0 [ 100.936934][ T1107] usb 1-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8c.1e [ 100.954598][ T1107] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 100.976950][ T1107] usb 1-1: config 0 descriptor?? [ 101.032563][ T1107] usb 1-1: selecting invalid altsetting 1 [ 101.041021][ T1107] dvb_ttusb_budget: ttusb_init_controller: error [ 101.047408][ T1107] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 101.133222][ T1107] DVB: Unable to find symbol cx22700_attach() [ 101.179537][ T1107] DVB: Unable to find symbol tda10046_attach() [ 101.186054][ T1107] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 101.254834][ T1107] usb 1-1: USB disconnect, device number 7 [ 101.544959][ T4700] device syzkaller0 entered promiscuous mode [ 102.234313][ T4719] device syzkaller0 entered promiscuous mode [ 102.560759][ T4233] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 102.575085][ T4247] usb 5-1: USB disconnect, device number 5 [ 102.845018][ T4736] netlink: 4 bytes leftover after parsing attributes in process `syz.3.121'. [ 102.854072][ T4233] usb 3-1: Using ep0 maxpacket: 32 [ 103.011696][ T4233] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 103.030666][ T7] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 103.046389][ T4233] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 103.096776][ T4233] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 103.119825][ T4233] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 103.149873][ T4233] usb 3-1: config 0 descriptor?? [ 103.280499][ T7] usb 2-1: Using ep0 maxpacket: 16 [ 103.401257][ T7] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 103.421705][ T7] usb 2-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 103.449297][ T7] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 103.487804][ T7] usb 2-1: config 0 descriptor?? [ 103.646631][ T4233] savu 0003:1E7D:2D5A.0002: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.2-1/input0 [ 103.946465][ T1335] usb 3-1: USB disconnect, device number 5 [ 104.068629][ T4770] device syzkaller0 entered promiscuous mode [ 104.140573][ T7] usbhid 2-1:0.0: can't add hid device: -71 [ 104.150639][ T7] usbhid: probe of 2-1:0.0 failed with error -71 [ 104.180683][ T7] usb 2-1: USB disconnect, device number 5 [ 104.570763][ T4790] netlink: 12 bytes leftover after parsing attributes in process `syz.2.134'. [ 104.643209][ T4790] device vlan2 entered promiscuous mode [ 104.662658][ T4790] device veth0 entered promiscuous mode [ 105.014979][ T4805] device syzkaller0 entered promiscuous mode [ 105.054470][ T4805] sch_tbf: burst 9 is lower than device syzkaller0 mtu (1514) ! [ 106.670513][ T7] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 106.789824][ T4852] netlink: 12 bytes leftover after parsing attributes in process `syz.4.148'. [ 106.930677][ T7] usb 4-1: Using ep0 maxpacket: 32 [ 107.060696][ T7] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 107.097548][ T7] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 107.137315][ T7] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 107.166756][ T4866] device syzkaller0 entered promiscuous mode [ 107.177482][ T7] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 107.203653][ T4866] sch_tbf: burst 9 is lower than device syzkaller0 mtu (1514) ! [ 107.231004][ T7] usb 4-1: config 0 descriptor?? [ 107.385253][ T4870] device team_slave_0 entered promiscuous mode [ 107.391676][ T4870] device team_slave_1 entered promiscuous mode [ 107.401425][ T4870] device vlan2 entered promiscuous mode [ 107.407114][ T4870] device team0 entered promiscuous mode [ 107.766195][ T7] savu 0003:1E7D:2D5A.0003: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.3-1/input0 [ 108.032625][ T1107] usb 4-1: USB disconnect, device number 3 [ 108.123050][ T4905] fido_id[4905]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/4-1/report_descriptor': No such file or directory [ 108.304783][ T4921] device syzkaller0 entered promiscuous mode [ 108.687062][ T4932] device syzkaller0 entered promiscuous mode [ 108.727198][ T4932] sch_tbf: burst 9 is lower than device syzkaller0 mtu (1514) ! [ 109.195431][ T4947] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 109.270773][ T1335] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 109.520550][ T1335] usb 1-1: Using ep0 maxpacket: 32 [ 109.800716][ T1335] usb 1-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 109.814346][ T1335] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 109.832506][ T1335] usb 1-1: Product: syz [ 109.847276][ T1335] usb 1-1: Manufacturer: syz [ 109.857906][ T1335] usb 1-1: SerialNumber: syz [ 109.875712][ T1335] usb 1-1: config 0 descriptor?? [ 109.939723][ T4968] device syzkaller0 entered promiscuous mode [ 110.118014][ T4977] device syzkaller0 entered promiscuous mode [ 110.142489][ T1335] RobotFuzz Open Source InterFace, OSIF 1-1:0.0: version d4.15 found at bus 001 address 008 [ 110.207687][ T4980] device bond_slave_0 entered promiscuous mode [ 110.214001][ T4980] device bond_slave_1 entered promiscuous mode [ 110.228685][ T4980] device vlan2 entered promiscuous mode [ 110.236641][ T4980] device bond0 entered promiscuous mode [ 110.289327][ T4983] device syzkaller0 entered promiscuous mode [ 110.584549][ T5006] binder: 5000:5006 unknown command 1074553619 [ 110.594610][ T5006] binder: 5000:5006 ioctl c0306201 200000000040 returned -22 [ 110.660528][ T4233] usb 2-1: new full-speed USB device number 6 using dummy_hcd [ 110.719173][ T5014] input: syz1 as /devices/virtual/input/input11 [ 110.825004][ T5017] device syzkaller0 entered promiscuous mode [ 110.860554][ T4937] i2c i2c-1: failure reading status [ 110.871906][ T4277] usb 1-1: USB disconnect, device number 8 [ 110.900612][ T4261] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 111.060773][ T4233] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 111.069453][ T4233] usb 2-1: config 0 has no interface number 0 [ 111.076608][ T4233] usb 2-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8c.1e [ 111.086291][ T4233] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.102140][ T4233] usb 2-1: config 0 descriptor?? [ 111.155477][ T4233] usb 2-1: selecting invalid altsetting 1 [ 111.161673][ T4233] dvb_ttusb_budget: ttusb_init_controller: error [ 111.168215][ T4233] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 111.219500][ T4233] DVB: Unable to find symbol cx22700_attach() [ 111.247940][ T4233] DVB: Unable to find symbol tda10046_attach() [ 111.254416][ T4233] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 111.340595][ T4261] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 111.358348][ T4261] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 111.371996][ T4247] usb 2-1: USB disconnect, device number 6 [ 111.448953][ T5030] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 111.468829][ T4261] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 111.478119][ T4261] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 111.498340][ T5030] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 111.506207][ T4261] usb 5-1: SerialNumber: syz [ 111.521626][ T5030] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 111.532372][ T5030] device bridge_slave_0 left promiscuous mode [ 111.538978][ T5030] bridge0: port 1(bridge_slave_0) entered disabled state [ 111.552278][ T5030] device bridge_slave_1 left promiscuous mode [ 111.558825][ T5030] bridge0: port 2(bridge_slave_1) entered disabled state [ 111.572151][ T5030] bond0: (slave bond_slave_0): Releasing backup interface [ 111.592635][ T5030] bond0: (slave bond_slave_1): Releasing backup interface [ 111.612725][ T5030] device team_slave_0 left promiscuous mode [ 111.637780][ T5030] team0: Port device team_slave_0 removed [ 111.652079][ T5030] device team_slave_1 left promiscuous mode [ 111.672536][ T5030] team0: Port device team_slave_1 removed [ 111.679227][ T5030] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 111.695161][ T5030] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 111.709717][ T5030] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 111.718030][ T5030] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 111.789224][ T5034] device syzkaller0 entered promiscuous mode [ 111.955549][ T5040] device syzkaller0 entered promiscuous mode [ 112.070169][ T5043] netlink: 'syz.1.196': attribute type 39 has an invalid length. [ 112.197844][ T5053] device syzkaller1 entered promiscuous mode [ 112.213537][ T4261] usb 5-1: 0:2 : does not exist [ 112.236770][ T4261] usb 5-1: usbmixer: too many channels (61) in unit 5 [ 112.272838][ T4261] usb 5-1: USB disconnect, device number 6 [ 112.309840][ T5060] input: syz1 as /devices/virtual/input/input12 [ 112.352651][ T4175] udevd[4175]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 112.586422][ T5066] device syzkaller0 entered promiscuous mode [ 112.658596][ T5073] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 112.665928][ T5073] IPv6: NLM_F_CREATE should be set when creating new route [ 112.673257][ T5073] IPv6: NLM_F_CREATE should be set when creating new route [ 113.160561][ T21] usb 5-1: new full-speed USB device number 7 using dummy_hcd [ 113.184067][ T5073] bridge0: port 2(bridge_slave_1) entered disabled state [ 113.191397][ T5073] bridge0: port 1(bridge_slave_0) entered disabled state [ 113.566322][ T21] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 113.575512][ T21] usb 5-1: config 0 has no interface number 0 [ 113.592867][ T21] usb 5-1: New USB device found, idVendor=0b48, idProduct=1005, bcdDevice=8c.1e [ 113.602906][ T21] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 113.620545][ T21] usb 5-1: config 0 descriptor?? [ 113.662361][ T21] usb 5-1: selecting invalid altsetting 1 [ 113.671022][ T21] dvb_ttusb_budget: ttusb_init_controller: error [ 113.677597][ T21] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 113.735753][ T21] DVB: Unable to find symbol cx22700_attach() [ 113.773635][ T21] DVB: Unable to find symbol tda10046_attach() [ 113.784549][ T21] dvb_ttusb_budget: no frontend driver found for device [0b48:1005] [ 113.878932][ T21] usb 5-1: USB disconnect, device number 7 [ 114.045208][ T5073] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 114.073724][ T5073] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 114.695423][ T5073] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 114.704843][ T5073] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 114.713823][ T5073] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 114.722944][ T5073] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 114.867616][ T5098] device syzkaller0 entered promiscuous mode [ 115.137477][ T5123] netlink: 'syz.3.216': attribute type 39 has an invalid length. [ 115.280417][ T5080] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 115.755739][ T5128] blk_update_request: I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 115.965866][ T5136] loop4: detected capacity change from 0 to 512 [ 115.998298][ T5140] binder: 5132:5140 unknown command 1074553619 [ 116.005156][ T5140] binder: 5132:5140 ioctl c0306201 200000000040 returned -22 [ 116.027268][ T5136] FAT-fs (loop4): Unrecognized mount option "shortnAme=mixed" or missing value [ 116.548763][ T4256] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 116.686936][ T5080] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 117.966224][ T5147] input: syz1 as /devices/virtual/input/input14 [ 118.021706][ T5146] device syzkaller0 entered promiscuous mode [ 118.030741][ T5080] usb 2-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ec.7e [ 118.039840][ T5080] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 118.081129][ T4256] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 118.274173][ T4256] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 118.357604][ T5080] usb 2-1: Product: syz [ 118.486386][ T5080] usb 2-1: Manufacturer: syz [ 118.506438][ T5080] usb 2-1: config 0 descriptor?? [ 118.536060][ T5080] usb 2-1: can't set config #0, error -71 [ 118.542210][ T4256] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 118.569502][ T4256] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 118.587987][ T5080] usb 2-1: USB disconnect, device number 7 [ 118.600577][ T4256] usb 1-1: SerialNumber: syz [ 118.688791][ T5157] device syzkaller0 entered promiscuous mode [ 119.154352][ T4256] usb 1-1: 0:2 : does not exist [ 119.168534][ T4256] usb 1-1: usbmixer: too many channels (61) in unit 5 [ 119.263292][ T4256] usb 1-1: USB disconnect, device number 9 [ 120.083826][ T4175] udevd[4175]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 120.196930][ T5197] device syzkaller0 entered promiscuous mode [ 120.254058][ T4174] usb 3-1: new full-speed USB device number 6 using dummy_hcd [ 121.396224][ T4174] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 121.571265][ T4174] usb 3-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ec.7e [ 121.620386][ T4174] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 121.647241][ T5246] loop3: detected capacity change from 0 to 1024 [ 121.668891][ T4174] usb 3-1: Product: syz [ 121.705914][ T4174] usb 3-1: Manufacturer: syz [ 121.754218][ T4174] usb 3-1: SerialNumber: syz [ 121.832062][ T4174] usb 3-1: config 0 descriptor?? [ 121.942622][ T4174] hub 3-1:0.0: bad descriptor, ignoring hub [ 121.975203][ T4174] hub: probe of 3-1:0.0 failed with error -5 [ 122.173304][ T4174] input: syz syz as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input17 [ 122.221423][ T5250] device syzkaller0 entered promiscuous mode [ 122.281299][ T4174] usb 3-1: USB disconnect, device number 6 [ 122.423322][ T5253] device syzkaller0 entered promiscuous mode [ 124.113260][ T5276] loop4: detected capacity change from 0 to 1024 [ 124.495536][ T5297] overlayfs: option "index=on" is useless in a non-upper mount, ignore [ 125.541711][ T5306] device syzkaller0 entered promiscuous mode [ 125.834203][ T4296] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 125.884246][ T4296] Bluetooth: hci3: Injecting HCI hardware error event [ 125.932531][ T4197] Bluetooth: hci3: hardware error 0x00 [ 126.287068][ T5314] device syzkaller0 entered promiscuous mode [ 126.331630][ T5318] netlink: 36 bytes leftover after parsing attributes in process `syz.4.274'. [ 126.712403][ T5332] tipc: Failed to remove unknown binding: 66,1,1/0:4078019107/4078019109 [ 126.721505][ T5332] tipc: Failed to remove unknown binding: 66,1,1/0:4078019107/4078019109 [ 128.809504][ T5358] device syzkaller0 entered promiscuous mode [ 129.130926][ T5368] device syzkaller0 entered promiscuous mode [ 129.267185][ T5369] loop1: detected capacity change from 0 to 4096 [ 129.464103][ T5369] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 129.621310][ T26] kauditd_printk_skb: 68 callbacks suppressed [ 129.621326][ T26] audit: type=1800 audit(1769957748.393:112): pid=5369 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.290" name="file1" dev="loop1" ino=15 res=0 errno=0 [ 129.708400][ T5360] loop4: detected capacity change from 0 to 40427 [ 131.263778][ T26] audit: type=1326 audit(1769957748.903:113): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5385 comm="syz.2.294" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f03da3c5eb9 code=0x0 [ 131.463137][ T5360] F2FS-fs (loop4): build fault injection attr: rate: 684, type: 0x1ffff [ 131.490634][ T5360] F2FS-fs (loop4): build fault injection attr: rate: 0, type: 0x35f7 [ 131.610907][ T5395] hfsplus: unable to find HFS+ superblock [ 132.191662][ T5360] F2FS-fs (loop4): invalid crc value [ 132.229000][ T5360] F2FS-fs (loop4): Failed to initialize F2FS segment manager (-4) [ 132.397777][ T5402] device syzkaller0 entered promiscuous mode [ 132.773012][ T5419] device syzkaller0 entered promiscuous mode [ 132.872867][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.879283][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.756516][ T5431] loop2: detected capacity change from 0 to 16 [ 136.531956][ T5431] erofs: (device loop2): check_layout_compatibility: unidentified incompatible feature 8, please upgrade kernel version [ 136.977004][ T5448] device syzkaller0 entered promiscuous mode [ 137.213083][ T5456] device syzkaller0 entered promiscuous mode [ 137.225659][ T5460] device syzkaller0 entered promiscuous mode [ 137.393829][ T5463] loop2: detected capacity change from 0 to 512 [ 137.432271][ T5463] EXT4-fs (loop2): inline encryption not supported [ 137.492112][ T5463] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 137.569827][ T5463] EXT4-fs (loop2): 1 orphan inode deleted [ 137.575749][ T5463] EXT4-fs (loop2): mounted filesystem without journal. Opts: inlinecrypt,,errors=continue. Quota mode: writeback. [ 137.590937][ T5463] ext4 filesystem being mounted at /62/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 137.824554][ T5475] loop0: detected capacity change from 0 to 32768 [ 137.902765][ T26] audit: type=1800 audit(1769957756.633:114): pid=5463 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.323" name="bus" dev="loop2" ino=16 res=0 errno=0 [ 137.978827][ T5475] XFS (loop0): Mounting V5 Filesystem [ 138.294220][ T5475] XFS (loop0): Ending clean mount [ 138.467113][ T5478] crypto_alloc_aead failed rc=-4 [ 138.778885][ T5509] device syzkaller0 entered promiscuous mode [ 139.600252][ T5514] device syzkaller0 entered promiscuous mode [ 139.876706][ T4192] XFS (loop0): Unmounting Filesystem [ 140.282808][ T5521] device syzkaller0 entered promiscuous mode [ 140.381673][ T5512] autofs4:pid:5512:autofs_fill_super: called with bogus options [ 140.520168][ T5531] loop4: detected capacity change from 0 to 1024 [ 140.618685][ T5531] EXT4-fs (loop4): Ignoring removed bh option [ 140.643227][ T5531] EXT4-fs (loop4): Ignoring removed nobh option [ 140.657268][ T5531] EXT4-fs (loop4): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 140.717771][ T5531] EXT4-fs (loop4): mounted filesystem without journal. Opts: delalloc,data_err=abort,barrier=0x0000000000000003,bsddf,bh,max_dir_size_kb=0x00000000004007b1,data_err=ignore,nouid32,nobh,user_xattr,nouid32,dioread_nolock,,errors=continue. Quota mode: none. [ 141.025886][ T5531] EXT4-fs error (device loop4): ext4_mb_mark_diskspace_used:3887: comm syz.4.340: Allocating blocks 497-513 which overlap fs metadata [ 141.061845][ T5531] EXT4-fs (loop4): pa ffff88805ec66620: logic 304, phys. 449, len 4 [ 141.070657][ T5531] EXT4-fs error (device loop4): ext4_mb_release_inode_pa:4904: group 0, free 0, pa_free 1 [ 141.338287][ T5551] device syzkaller0 entered promiscuous mode [ 141.384783][ T5553] device syzkaller0 entered promiscuous mode [ 141.397952][ T5554] tmpfs: Unknown parameter 'usrquota' [ 142.249902][ T5541] loop1: detected capacity change from 0 to 32768 [ 142.491671][ T5541] XFS (loop1): Mounting V5 Filesystem [ 142.989843][ T5576] device syzkaller0 entered promiscuous mode [ 143.091204][ T5541] XFS (loop1): Ending clean mount [ 143.111672][ T4174] XFS (loop1): Metadata CRC error detected at xfs_inobt_read_verify+0x3a/0xd0, xfs_finobt block 0x20 [ 143.170750][ T4174] XFS (loop1): Unmount and run xfs_repair [ 143.194780][ T4174] XFS (loop1): First 128 bytes of corrupted metadata buffer: [ 143.233234][ T4174] 00000000: 46 49 42 33 00 00 00 01 ff ff ff ff ff ff ff ff FIB3............ [ 143.269122][ T5586] loop0: detected capacity change from 0 to 2048 [ 143.276081][ T4174] 00000010: 00 00 00 00 00 00 00 20 00 00 00 01 00 00 00 10 ....... ........ [ 143.299061][ T5588] loop3: detected capacity change from 0 to 2048 [ 143.310430][ T4174] 00000020: c4 96 e0 5e 54 0d 4c 72 b5 91 04 d7 9d 8b 4e eb ...^T.Lr......N. [ 143.327048][ T4174] 00000030: 00 00 00 00 ca b4 20 ce 00 00 11 40 00 00 40 37 ...... ....@..@7 [ 143.341916][ T4174] 00000040: ff ff ff ff ff ff fe 00 00 07 00 00 00 00 00 00 ................ [ 143.379135][ T4174] 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 143.402989][ T4174] 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 143.412364][ T4174] 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 143.421921][ T5541] XFS (loop1): metadata I/O error in "xfs_btree_read_buf_block+0x1db/0x2d0" at daddr 0x20 len 8 error 74 [ 143.429015][ T5586] EXT4-fs (loop0): mounted filesystem without journal. Opts: nobarrier,noinit_itable,i_version,init_itable,,errors=continue. Quota mode: none. [ 143.442629][ T5588] EXT4-fs (loop3): mounted filesystem without journal. Opts: delalloc,noload,acl,mb_optimize_scan=0x0000000000000001,,errors=continue. Quota mode: none. [ 143.449439][ T5586] ext4 filesystem being mounted at /70/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 143.488819][ T5586] fs-verity: sha512 using implementation "sha512-avx2" [ 143.497219][ T5541] XFS (loop1): Failed to initialize disk quotas. [ 143.652938][ T4186] XFS (loop1): Unmounting Filesystem [ 145.022986][ T5587] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1163: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 145.164160][ T5587] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 384 with error 28 [ 145.247071][ T5587] EXT4-fs (loop3): This should not happen!! Data will be lost [ 145.247071][ T5587] [ 145.290227][ T5587] EXT4-fs (loop3): Total free blocks count 0 [ 145.406609][ T5587] EXT4-fs (loop3): Free/Dirty block details [ 145.445952][ T5587] EXT4-fs (loop3): free_blocks=2415919504 [ 145.484052][ T5587] EXT4-fs (loop3): dirty_blocks=1760 [ 145.489416][ T5587] EXT4-fs (loop3): Block reservation details [ 145.580475][ T5587] EXT4-fs (loop3): i_reserved_data_blocks=118 [ 145.697547][ T5616] device syzkaller0 entered promiscuous mode [ 145.932714][ T5621] device syzkaller0 entered promiscuous mode [ 146.064856][ T5588] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 384 with max blocks 2048 with error 28 [ 146.157248][ T5588] EXT4-fs (loop3): This should not happen!! Data will be lost [ 146.157248][ T5588] [ 147.131505][ T5639] sch_tbf: peakrate 7836759490224633571 is lower than or equals to rate 15540063224392467819 ! [ 147.182011][ T5637] device syzkaller0 entered promiscuous mode [ 147.274602][ T5642] device syzkaller0 entered promiscuous mode [ 147.336321][ T5648] loop3: detected capacity change from 0 to 512 [ 147.417371][ T5654] device syzkaller0 entered promiscuous mode [ 147.509393][ T5648] EXT4-fs (loop3): Ignoring removed nobh option [ 147.659887][ T5648] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpquota,nogrpid,quota,nobh,,errors=continue. Quota mode: writeback. [ 147.705443][ T5648] ext4 filesystem being mounted at /77/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 147.754246][ T5666] device syzkaller0 entered promiscuous mode [ 147.995898][ T5671] 0x7fffffffffffffff-0x8000000000000006 : "" [ 148.002623][ T5671] mtd: partition "" is out of reach -- disabled [ 148.035100][ T5671] ftl_cs: FTL header not found. [ 149.637667][ T5676] loop4: detected capacity change from 0 to 2048 [ 150.742372][ T5685] loop2: detected capacity change from 0 to 4096 [ 150.863174][ T5694] No such timeout policy "syz1" [ 151.323140][ T5693] device syzkaller0 entered promiscuous mode [ 151.809070][ T5685] ntfs3: loop2: Mark volume as dirty due to NTFS errors [ 151.874916][ T5685] ntfs3: loop2: Failed to load $Extend. [ 151.919080][ T5707] device syzkaller0 entered promiscuous mode [ 152.046077][ T5703] device syzkaller0 entered promiscuous mode [ 152.064214][ T5710] device syzkaller0 entered promiscuous mode [ 152.329730][ T5718] loop0: detected capacity change from 0 to 1024 [ 152.356252][ T5715] netlink: 8 bytes leftover after parsing attributes in process `syz.2.394'. [ 152.762163][ T5726] capability: warning: `syz.3.401' uses 32-bit capabilities (legacy support in use) [ 152.811419][ T5720] loop4: detected capacity change from 0 to 512 [ 152.961678][ T5720] EXT4-fs (loop4): inline encryption not supported [ 153.302301][ T5720] EXT4-fs (loop4): 1 orphan inode deleted [ 153.308254][ T5720] EXT4-fs (loop4): mounted filesystem without journal. Opts: inlinecrypt,,errors=continue. Quota mode: writeback. [ 153.322435][ T5720] ext4 filesystem being mounted at /78/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 153.906956][ T26] audit: type=1800 audit(1769957772.523:115): pid=5720 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.398" name="bus" dev="loop4" ino=16 res=0 errno=0 [ 155.038328][ T5758] netlink: 8 bytes leftover after parsing attributes in process `syz.3.409'. [ 155.051409][ T5754] device syzkaller0 entered promiscuous mode [ 155.144425][ T5756] device syzkaller0 entered promiscuous mode [ 156.140181][ T5766] device syzkaller0 entered promiscuous mode [ 156.185940][ T5772] device syzkaller0 entered promiscuous mode [ 157.310677][ T5791] netlink: 8 bytes leftover after parsing attributes in process `syz.3.421'. [ 157.357019][ T5794] device syzkaller0 entered promiscuous mode [ 157.541049][ T5800] device syzkaller0 entered promiscuous mode [ 157.596117][ T5806] device syzkaller0 entered promiscuous mode [ 157.904278][ T5814] loop2: detected capacity change from 0 to 1024 [ 158.661626][ T5822] device syzkaller0 entered promiscuous mode [ 158.869485][ T5829] device syzkaller0 entered promiscuous mode [ 159.006593][ T5833] netlink: 8 bytes leftover after parsing attributes in process `syz.0.433'. [ 159.826219][ T5840] device syzkaller0 entered promiscuous mode [ 159.933678][ T5844] device syzkaller0 entered promiscuous mode [ 160.097320][ T5850] device syzkaller0 entered promiscuous mode [ 160.634518][ T5852] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 160.829291][ T5854] overlayfs: missing 'lowerdir' [ 160.877997][ T5852] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 160.895316][ T5859] device ip_vti0 entered promiscuous mode [ 160.909435][ T5859] netlink: 8 bytes leftover after parsing attributes in process `syz.1.441'. [ 161.036729][ T5874] netlink: 8 bytes leftover after parsing attributes in process `syz.0.445'. [ 161.141940][ T5879] device syzkaller0 entered promiscuous mode [ 161.250842][ T5884] device syzkaller0 entered promiscuous mode [ 161.504739][ T5891] device syzkaller0 entered promiscuous mode [ 161.762389][ T5877] loop1: detected capacity change from 0 to 40427 [ 161.791080][ T5877] F2FS-fs (loop1): Invalid log_blocksize (268), supports only 12 [ 161.819667][ T5877] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock [ 162.273274][ T5877] F2FS-fs (loop1): Found nat_bits in checkpoint [ 163.775677][ T5877] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0 [ 163.789046][ T5909] device syzkaller0 entered promiscuous mode [ 163.791629][ T5877] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5 [ 164.093419][ T5920] device syzkaller0 entered promiscuous mode [ 164.108019][ T5922] netlink: 8 bytes leftover after parsing attributes in process `syz.0.461'. [ 164.224897][ T5925] device syzkaller0 entered promiscuous mode [ 164.243446][ T5930] device syzkaller0 entered promiscuous mode [ 164.336714][ T5933] device syzkaller0 entered promiscuous mode [ 167.156423][ T5962] netlink: 36 bytes leftover after parsing attributes in process `syz.0.473'. [ 167.745992][ T5969] device syzkaller0 entered promiscuous mode [ 167.853896][ T5973] netlink: 8 bytes leftover after parsing attributes in process `syz.4.477'. [ 167.905720][ T5976] device syzkaller0 entered promiscuous mode [ 168.008487][ T5971] device syzkaller0 entered promiscuous mode [ 168.052043][ T5978] device syzkaller0 entered promiscuous mode [ 168.169367][ T5961] loop3: detected capacity change from 0 to 40427 [ 168.228172][ T5987] device syzkaller0 entered promiscuous mode [ 168.251211][ T5961] F2FS-fs (loop3): Unrecognized mount option "age_extent_cache" or missing value [ 168.833920][ T6003] loop2: detected capacity change from 0 to 4096 [ 168.902138][ T5999] loop3: detected capacity change from 0 to 2048 [ 169.241820][ T6006] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 169.253196][ T6003] NILFS (loop2): corrupt root inode [ 169.459136][ T6010] device syzkaller0 entered promiscuous mode [ 169.930088][ T6011] loop1: detected capacity change from 0 to 512 [ 170.127918][ T6018] device syzkaller0 entered promiscuous mode [ 170.424073][ T6011] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 170.619331][ T6011] ext4 filesystem being mounted at /90/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 171.227109][ T6032] netlink: 8 bytes leftover after parsing attributes in process `syz.4.494'. [ 172.765863][ T6034] device syzkaller0 entered promiscuous mode [ 172.903131][ T6039] device syzkaller0 entered promiscuous mode [ 172.947386][ T6045] device syzkaller0 entered promiscuous mode [ 173.192083][ T5080] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 173.214382][ T5080] Bluetooth: hci1: Injecting HCI hardware error event [ 173.262001][ T4197] Bluetooth: hci1: hardware error 0x00 [ 174.179923][ T6056] loop4: detected capacity change from 0 to 1024 [ 174.581171][ T5289] hfsplus: b-tree write err: -5, ino 3 [ 174.646967][ T6063] device syzkaller0 entered promiscuous mode [ 174.695935][ T6061] device syzkaller0 entered promiscuous mode [ 174.996608][ T6079] netlink: 8 bytes leftover after parsing attributes in process `syz.3.510'. [ 175.256590][ T6084] device syzkaller0 entered promiscuous mode [ 175.313428][ T6085] device syzkaller0 entered promiscuous mode [ 175.369940][ T6069] loop0: detected capacity change from 0 to 32768 [ 175.441059][ T6069] XFS: noikeep mount option is deprecated. [ 175.494037][ T6089] device syzkaller0 entered promiscuous mode [ 175.569702][ T6069] XFS (loop0): Mounting V5 Filesystem [ 175.892405][ T6069] XFS (loop0): Torn write (CRC failure) detected at log block 0x30. Truncating head block from 0x51. [ 175.911947][ T6105] device syzkaller0 entered promiscuous mode [ 175.973798][ T6069] XFS (loop0): Starting recovery (logdev: internal) [ 176.059264][ T6069] XFS (loop0): Ending recovery (logdev: internal) [ 176.253249][ T4192] XFS (loop0): Unmounting Filesystem [ 176.351036][ T6114] sch_tbf: burst 9 is lower than device syzkaller0 mtu (1514) ! [ 176.497999][ T6118] loop3: detected capacity change from 0 to 128 [ 177.033678][ T6118] FAT-fs (loop3): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 177.160901][ T6118] FAT-fs (loop3): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 177.445992][ T4364] FAT-fs (loop3): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 177.855140][ T6126] device syzkaller0 entered promiscuous mode [ 178.277349][ T6134] device syzkaller0 entered promiscuous mode [ 178.284138][ T5080] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 178.330180][ T6139] loop4: detected capacity change from 0 to 256 [ 178.393953][ T6142] device syzkaller0 entered promiscuous mode [ 178.640396][ T5080] usb 1-1: Using ep0 maxpacket: 8 [ 179.386419][ T6156] sch_tbf: burst 9 is lower than device syzkaller0 mtu (1514) ! [ 179.450459][ T5080] usb 1-1: config index 0 descriptor too short (expected 30, got 18) [ 179.533932][ T6164] netlink: 28 bytes leftover after parsing attributes in process `syz.4.536'. [ 179.651668][ T5080] usb 1-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 180.078609][ T5080] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 180.109723][ T5080] usb 1-1: Product: syz [ 180.123951][ T5080] usb 1-1: Manufacturer: syz [ 180.261151][ T5080] usb 1-1: SerialNumber: syz [ 180.268095][ T5080] usb 1-1: config 0 descriptor?? [ 180.312529][ T5080] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 180.396720][ T5080] usb 1-1: setting power ON [ 180.410938][ T5080] dvb-usb: bulk message failed: -22 (2/0) [ 180.437941][ T5080] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 180.571824][ T6132] dvb-usb: bulk message failed: -22 (3/0) [ 180.577970][ T6132] dvb-usb: bulk message failed: -22 (4/0) [ 180.696647][ T5080] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 180.824657][ T6132] cxusb: i2c read failed [ 180.868385][ T5080] usb 1-1: media controller created [ 180.986207][ T6186] device syzkaller0 entered promiscuous mode [ 181.044390][ T5080] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 181.260342][ T6193] blk_update_request: I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 181.561701][ T5080] usb 1-1: selecting invalid altsetting 6 [ 181.621958][ T5080] usb 1-1: digital interface selection failed (-22) [ 181.637943][ T5080] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 181.711634][ T5080] usb 1-1: setting power OFF [ 181.716777][ T5080] dvb-usb: bulk message failed: -22 (2/0) [ 181.726201][ T6201] device syzkaller0 entered promiscuous mode [ 181.749884][ T5080] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 181.769164][ T5080] (NULL device *): no alternate interface [ 181.804001][ T5080] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 181.853982][ T5080] usb 1-1: USB disconnect, device number 10 [ 181.968304][ T6208] sch_tbf: burst 9 is lower than device syzkaller0 mtu (1514) ! [ 182.156222][ T6211] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 182.163402][ T6211] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 183.601993][ T6219] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 184.526918][ T6214] device syzkaller0 entered promiscuous mode [ 184.576627][ T6226] netlink: 8 bytes leftover after parsing attributes in process `syz.4.557'. [ 185.804780][ T6243] device syzkaller0 entered promiscuous mode [ 186.115967][ T6250] sch_tbf: burst 9 is lower than device syzkaller0 mtu (1514) ! [ 186.169132][ T6252] device syzkaller0 entered promiscuous mode [ 186.333754][ T6262] genirq: Flags mismatch irq 4. 00000000 (pcl812) vs. 00000000 (ttyS0) [ 186.376917][ T6265] device syzkaller0 entered promiscuous mode [ 186.440202][ T6262] loop0: detected capacity change from 0 to 1024 [ 186.470446][ T4296] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 186.523948][ T6262] autofs4:pid:6262:autofs_fill_super: called with bogus options [ 186.850810][ T4296] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 187.929398][ T6276] loop2: detected capacity change from 0 to 128 [ 188.201053][ T4296] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 188.308376][ T4296] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 188.348156][ T4296] usb 5-1: Product: syz [ 188.913997][ T4296] usb 5-1: Manufacturer: syz [ 188.918951][ T4296] usb 5-1: SerialNumber: syz [ 188.941425][ T6276] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 188.960837][ T6276] ext4 filesystem being mounted at /108/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 189.172742][ T4296] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 8 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 189.241808][ T6289] PKCS7: Unknown OID: [4] 0.38.35.41.951690.11253 [ 189.248947][ T6289] PKCS7: Only support pkcs7_signedData type [ 189.996322][ T4296] usb 5-1: USB disconnect, device number 8 [ 190.017843][ T4296] usblp0: removed [ 190.420985][ T6298] ax25_connect(): syz.0.577 uses autobind, please contact jreuter@yaina.de [ 191.202037][ T6304] loop0: detected capacity change from 0 to 2048 [ 191.217562][ T6302] sch_tbf: burst 9 is lower than device syzkaller0 mtu (1514) ! [ 191.270428][ T4277] Bluetooth: hci0: command 0x0406 tx timeout [ 191.276877][ T4277] Bluetooth: hci4: command 0x0406 tx timeout [ 191.337715][ T4277] Bluetooth: hci2: command 0x0406 tx timeout [ 191.366352][ T6306] device syzkaller0 entered promiscuous mode [ 191.651264][ T6308] device syzkaller0 entered promiscuous mode [ 191.687011][ T6311] No such timeout policy "syz1" [ 192.386626][ T6313] netlink: 'syz.4.584': attribute type 8 has an invalid length. [ 192.444189][ T6313] netlink: 64 bytes leftover after parsing attributes in process `syz.4.584'. [ 192.493207][ T6313] block nbd0: not configured, cannot reconfigure [ 193.126413][ T6339] sch_tbf: burst 9 is lower than device syzkaller0 mtu (1514) ! [ 193.321454][ T6346] device syzkaller0 entered promiscuous mode [ 193.479230][ T6349] loop0: detected capacity change from 0 to 512 [ 193.545398][ T6349] EXT4-fs (loop0): Quota format mount options ignored when QUOTA feature is enabled [ 193.563097][ T6349] EXT4-fs (loop0): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 193.715607][ T6349] EXT4-fs (loop0): mounted filesystem without journal. Opts: dioread_nolock,jqfmt=vfsv0,quota,,errors=continue. Quota mode: writeback. [ 193.761302][ T6349] ext4 filesystem being mounted at /123/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 194.626124][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.636096][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.868976][ T6364] device syzkaller0 entered promiscuous mode [ 195.185653][ T6374] netlink: 8 bytes leftover after parsing attributes in process `syz.0.601'. [ 195.604354][ T6382] loop1: detected capacity change from 0 to 1024 [ 196.100204][ T6384] sch_tbf: burst 9 is lower than device syzkaller0 mtu (1514) ! [ 197.367839][ T6392] loop1: detected capacity change from 0 to 2048 [ 197.684999][ T6400] loop0: detected capacity change from 0 to 256 [ 198.411094][ T6400] exfat: Deprecated parameter 'utf8' [ 198.416690][ T6400] exfat: Deprecated parameter 'namecase' [ 198.455813][ T6400] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0xbe675ead, utbl_chksum : 0xe619d30d) [ 198.501177][ T6392] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 198.870826][ T6392] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1163: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 198.961022][ T6392] EXT4-fs (loop1): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 612 with error 28 [ 199.929367][ T6392] EXT4-fs (loop1): This should not happen!! Data will be lost [ 199.929367][ T6392] [ 199.939998][ T6392] EXT4-fs (loop1): Total free blocks count 0 [ 199.946379][ T6392] EXT4-fs (loop1): Free/Dirty block details [ 199.952835][ T6392] EXT4-fs (loop1): free_blocks=2415919504 [ 199.958621][ T6392] EXT4-fs (loop1): dirty_blocks=624 [ 199.964406][ T6392] EXT4-fs (loop1): Block reservation details [ 199.971055][ T6392] EXT4-fs (loop1): i_reserved_data_blocks=39 [ 199.986758][ T6406] device syzkaller0 entered promiscuous mode [ 200.134341][ T6415] netlink: 8 bytes leftover after parsing attributes in process `syz.4.614'. [ 200.248355][ T5289] EXT4-fs (loop1): Delayed block allocation failed for inode 18 at logical offset 12 with max blocks 5 with error 28 [ 200.322110][ T5289] EXT4-fs (loop1): This should not happen!! Data will be lost [ 200.322110][ T5289] [ 200.491847][ T6425] loop3: detected capacity change from 0 to 512 [ 201.963403][ T6425] EXT4-fs error (device loop3): ext4_orphan_get:1405: comm syz.3.619: couldn't read orphan inode 26 (err -116) [ 201.977837][ T6425] EXT4-fs (loop3): mounted filesystem without journal. Opts: errors=continue,,errors=continue. Quota mode: writeback. [ 201.991439][ T6425] ext4 filesystem being mounted at /131/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 202.284421][ T6429] sch_tbf: burst 9 is lower than device syzkaller0 mtu (1514) ! [ 203.552341][ T6401] EXT4-fs error (device loop3): ext4_validate_block_bitmap:438: comm ext4lazyinit: bg 0: block 64: padding at end of block bitmap is not set [ 205.981859][ T6456] device syzkaller0 entered promiscuous mode [ 206.142144][ T6461] netlink: 8 bytes leftover after parsing attributes in process `syz.4.628'. [ 206.340067][ T6467] device syzkaller0 entered promiscuous mode [ 206.496503][ T6470] sch_tbf: burst 9 is lower than device syzkaller0 mtu (1514) ! [ 206.709399][ T6474] loop4: detected capacity change from 0 to 128 [ 206.741278][ T6476] device syzkaller0 entered promiscuous mode [ 206.760390][ T4277] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 206.862155][ T6446] loop2: detected capacity change from 0 to 40427 [ 206.920579][ T6474] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 206.941511][ T6474] ext4 filesystem being mounted at /131/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 206.964670][ T6446] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 207.003133][ T6446] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 207.030445][ T4277] usb 4-1: Using ep0 maxpacket: 8 [ 207.597691][ T6446] F2FS-fs (loop2): Found nat_bits in checkpoint [ 207.930882][ T4277] usb 4-1: config index 0 descriptor too short (expected 301, got 45) [ 207.952771][ T4277] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 208.021047][ T4277] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 208.067312][ T4277] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 208.138652][ T4277] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 208.157497][ T4277] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 208.169861][ T4277] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 208.630474][ T4277] usb 4-1: GET_CAPABILITIES returned 0 [ 208.636037][ T4277] usbtmc 4-1:16.0: can't read capabilities [ 210.204163][ T6504] device syzkaller0 entered promiscuous mode [ 210.403148][ T13] usb 4-1: USB disconnect, device number 4 [ 211.496167][ T6518] sch_tbf: burst 9 is lower than device syzkaller0 mtu (1514) ! [ 212.990443][ T6531] PKCS7: Unknown OID: [4] 0.38.35.41.951690.11253 [ 212.997012][ T6531] PKCS7: Only support pkcs7_signedData type [ 213.555286][ T6538] loop3: detected capacity change from 0 to 128 [ 213.636856][ T6538] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 213.671827][ T6538] ext4 filesystem being mounted at /137/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 213.776099][ T6536] loop2: detected capacity change from 0 to 4096 [ 214.101454][ T6550] 9pnet: Insufficient options for proto=fd [ 214.281605][ T6536] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 214.475737][ T26] audit: type=1800 audit(1769957833.253:116): pid=6536 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.651" name="file1" dev="loop2" ino=15 res=0 errno=0 [ 214.523233][ T6552] loop1: detected capacity change from 0 to 1024 [ 214.567719][ T6552] EXT4-fs (loop1): Ignoring removed bh option [ 214.672367][ T6552] EXT4-fs (loop1): Ignoring removed nobh option [ 214.701458][ T6552] EXT4-fs (loop1): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 214.935730][ T6552] EXT4-fs (loop1): mounted filesystem without journal. Opts: delalloc,data_err=abort,barrier=0x0000000000000003,bsddf,bh,max_dir_size_kb=0x00000000004007b1,data_err=ignore,nouid32,nobh,user_xattr,nouid32,dioread_nolock,,errors=continue. Quota mode: none. [ 215.356350][ T6564] device syzkaller0 entered promiscuous mode [ 215.419604][ T6552] EXT4-fs error (device loop1): ext4_mb_mark_diskspace_used:3887: comm syz.1.658: Allocating blocks 497-513 which overlap fs metadata [ 215.630866][ T6552] EXT4-fs (loop1): pa ffff88807407ce00: logic 304, phys. 449, len 4 [ 215.639031][ T6552] EXT4-fs error (device loop1): ext4_mb_release_inode_pa:4904: group 0, free 0, pa_free 1 [ 216.524042][ T6570] loop3: detected capacity change from 0 to 1024 [ 216.537945][ T6561] loop2: detected capacity change from 0 to 32768 [ 216.616403][ T6570] EXT4-fs (loop3): Ignoring removed nobh option [ 216.810478][ T6581] hugetlbfs: syz.0.667 (6581): Using mlock ulimits for SHM_HUGETLB is deprecated [ 217.650771][ T6570] EXT4-fs (loop3): mounted filesystem without journal. Opts: delalloc,noauto_da_alloc,barrier=0x0000000000000007,nodioread_nolock,grpjquota=,max_dir_size_kb=0x00000000004007b1,noinit_itable,nouid32,nobh,noauto_da_alloc,nouid32,dioread_lock,,errors=continue. Quota mode: none. [ 217.716165][ T6561] XFS (loop2): Mounting V5 Filesystem [ 217.813356][ T6561] XFS (loop2): Ending clean mount [ 217.829165][ T21] XFS (loop2): Metadata CRC error detected at xfs_inobt_read_verify+0x3a/0xd0, xfs_finobt block 0x20 [ 217.860182][ T6570] EXT4-fs error (device loop3): ext4_mb_mark_diskspace_used:3887: comm syz.3.663: Allocating blocks 385-513 which overlap fs metadata [ 217.885346][ T21] XFS (loop2): Unmount and run xfs_repair [ 217.903247][ T6595] sch_tbf: burst 9 is lower than device syzkaller0 mtu (1514) ! [ 217.920672][ T21] XFS (loop2): First 128 bytes of corrupted metadata buffer: [ 217.933987][ T21] 00000000: 46 49 42 33 00 00 00 01 ff ff ff ff ff ff ff ff FIB3............ [ 217.955981][ T21] 00000010: 00 00 00 00 00 00 00 20 00 00 00 01 00 00 00 10 ....... ........ [ 217.979266][ T21] 00000020: c4 96 e0 5e 54 0d 4c 72 b5 91 04 d7 9d 8b 4e eb ...^T.Lr......N. [ 217.994654][ T6570] EXT4-fs (loop3): pa ffff88807407c620: logic 16, phys. 129, len 24 [ 218.003536][ T6570] EXT4-fs error (device loop3): ext4_mb_release_inode_pa:4904: group 0, free 0, pa_free 8 [ 218.020699][ T21] 00000030: 00 00 00 00 ca b4 20 ce 00 00 11 40 00 00 40 37 ...... ....@..@7 [ 218.029734][ T21] 00000040: ff ff ff ff ff ff fe 00 00 07 00 00 00 00 00 00 ................ [ 218.039570][ T21] 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 218.052000][ T21] 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 218.065622][ T21] 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 218.076788][ T6561] XFS (loop2): metadata I/O error in "xfs_btree_read_buf_block+0x1db/0x2d0" at daddr 0x20 len 8 error 74 [ 218.096080][ T6561] XFS (loop2): Failed to initialize disk quotas. [ 218.227727][ T4190] XFS (loop2): Unmounting Filesystem [ 218.254662][ T6597] loop3: detected capacity change from 0 to 512 [ 218.299324][ T6597] EXT4-fs (loop3): inline encryption not supported [ 218.395242][ T6597] EXT4-fs (loop3): 1 orphan inode deleted [ 218.416739][ T6597] EXT4-fs (loop3): mounted filesystem without journal. Opts: inlinecrypt,,errors=continue. Quota mode: writeback. [ 218.429276][ T6597] ext4 filesystem being mounted at /139/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 218.660345][ T26] audit: type=1800 audit(1769957837.273:117): pid=6597 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.670" name="bus" dev="loop3" ino=16 res=0 errno=0 [ 221.004576][ T6615] device syzkaller0 entered promiscuous mode [ 221.094855][ T6611] loop4: detected capacity change from 0 to 4096 [ 221.342031][ T6611] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 221.360893][ T26] audit: type=1800 audit(1769957840.143:118): pid=6611 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.671" name="file1" dev="loop4" ino=15 res=0 errno=0 [ 221.416344][ T6624] loop2: detected capacity change from 0 to 2048 [ 221.440208][ T6627] loop0: detected capacity change from 0 to 1024 [ 221.484179][ T6627] EXT4-fs (loop0): Ignoring removed bh option [ 221.493616][ T6627] EXT4-fs (loop0): Ignoring removed nobh option [ 221.501129][ T6627] EXT4-fs (loop0): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 221.667315][ T6633] loop1: detected capacity change from 0 to 512 [ 222.027340][ T6636] No such timeout policy "syz1" [ 222.928381][ T6627] EXT4-fs (loop0): mounted filesystem without journal. Opts: delalloc,data_err=abort,barrier=0x0000000000000003,bsddf,bh,max_dir_size_kb=0x00000000004007b1,data_err=ignore,nouid32,nobh,user_xattr,nouid32,dioread_nolock,,errors=continue. Quota mode: none. [ 223.048118][ T6633] EXT4-fs error (device loop1): ext4_orphan_get:1405: comm syz.1.678: couldn't read orphan inode 26 (err -116) [ 223.062667][ T6633] EXT4-fs (loop1): mounted filesystem without journal. Opts: errors=continue,,errors=continue. Quota mode: writeback. [ 223.075583][ T6633] ext4 filesystem being mounted at /127/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 224.539254][ T6627] EXT4-fs error (device loop0): ext4_mb_mark_diskspace_used:3887: comm syz.0.675: Allocating blocks 497-513 which overlap fs metadata [ 224.735807][ T6627] EXT4-fs (loop0): pa ffff88805ec66ee0: logic 304, phys. 449, len 4 [ 224.744118][ T6627] EXT4-fs error (device loop0): ext4_mb_release_inode_pa:4904: group 0, free 0, pa_free 1 [ 226.283845][ T6677] device syzkaller0 entered promiscuous mode [ 226.328829][ T6672] loop4: detected capacity change from 0 to 2048 [ 226.471224][ T6672] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 226.646079][ T6698] loop3: detected capacity change from 0 to 512 [ 226.707136][ T6698] EXT4-fs error (device loop3): ext4_orphan_get:1400: inode #15: comm syz.3.698: inode has both inline data and extents flags [ 226.730782][ T6698] EXT4-fs error (device loop3): ext4_orphan_get:1405: comm syz.3.698: couldn't read orphan inode 15 (err -117) [ 226.804619][ T6672] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1163: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 226.826299][ T6672] EXT4-fs (loop4): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 766 with error 28 [ 226.840626][ T6672] EXT4-fs (loop4): This should not happen!! Data will be lost [ 226.840626][ T6672] [ 226.842733][ T6698] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 226.852950][ T6672] EXT4-fs (loop4): Total free blocks count 0 [ 226.867776][ T6672] EXT4-fs (loop4): Free/Dirty block details [ 226.873978][ T6672] EXT4-fs (loop4): free_blocks=2415919504 [ 226.879936][ T6672] EXT4-fs (loop4): dirty_blocks=768 [ 226.887693][ T6672] EXT4-fs (loop4): Block reservation details [ 226.893920][ T6672] EXT4-fs (loop4): i_reserved_data_blocks=48 [ 227.073831][ T4277] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 227.660425][ T4277] usb 3-1: Using ep0 maxpacket: 16 [ 227.713188][ T155] EXT4-fs (loop4): Delayed block allocation failed for inode 18 at logical offset 12 with max blocks 5 with error 28 [ 227.761357][ T155] EXT4-fs (loop4): This should not happen!! Data will be lost [ 227.761357][ T155] [ 227.958043][ T4277] usb 3-1: config 0 has an invalid interface number: 180 but max is 0 [ 227.966898][ T4277] usb 3-1: config 0 has no interface number 0 [ 227.973099][ T4277] usb 3-1: config 0 interface 180 has no altsetting 0 [ 228.856425][ T4277] usb 3-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=e8.1f [ 228.870971][ T4277] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 228.879040][ T4277] usb 3-1: Product: syz [ 228.986439][ T4277] usb 3-1: Manufacturer: syz [ 228.991308][ T4277] usb 3-1: SerialNumber: syz [ 229.009278][ T4277] usb 3-1: config 0 descriptor?? [ 229.110920][ T6731] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 229.149101][ T6731] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 229.169953][ T6737] loop0: detected capacity change from 0 to 2048 [ 229.177281][ T6731] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 229.215344][ T6731] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 229.237760][ T6739] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(9) [ 229.244944][ T6739] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 229.533158][ T6739] vhci_hcd vhci_hcd.0: Device attached [ 229.630749][ T4277] viperboard 3-1:0.180: version 0.92 found at bus 003 address 007 [ 229.760483][ T21] usb 35-1: new low-speed USB device number 2 using vhci_hcd [ 229.782678][ T6745] vhci_hcd vhci_hcd.0: pdev(1) rhport(1) sockfd(12) [ 229.789354][ T6745] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 230.059280][ T4277] viperboard-i2c viperboard-i2c.2.auto: failure setting i2c_bus_freq to 100 [ 230.148655][ T6745] vhci_hcd vhci_hcd.0: Device attached [ 230.283185][ T4277] viperboard-i2c: probe of viperboard-i2c.2.auto failed with error -5 [ 230.333966][ T4277] usb 3-1: USB disconnect, device number 7 [ 230.394800][ T6751] No such timeout policy "syz1" [ 230.626441][ T4296] Bluetooth: hci4: command 0x0405 tx timeout [ 230.899253][ T6747] vhci_hcd: connection closed [ 230.901215][ T6742] vhci_hcd: connection reset by peer [ 230.914828][ T4582] vhci_hcd: stop threads [ 230.920151][ T4582] vhci_hcd: release socket [ 230.944905][ T4582] vhci_hcd: disconnect device [ 230.987389][ T6765] loop3: detected capacity change from 0 to 64 [ 231.000723][ T4582] vhci_hcd: stop threads [ 231.005033][ T4582] vhci_hcd: release socket [ 231.168608][ T4582] vhci_hcd: disconnect device [ 233.637549][ T6795] loop1: detected capacity change from 0 to 4096 [ 233.956537][ T6806] VFS: Can't find a Minix filesystem V1 | V2 | V3 on device nullb0. [ 234.594573][ T4296] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 234.788796][ T26] audit: type=1800 audit(1769957853.563:119): pid=6809 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.724" name="file1" dev="loop1" ino=33 res=0 errno=0 [ 234.837503][ T6811] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(9) [ 234.844086][ T6811] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 234.852761][ T4296] usb 1-1: Using ep0 maxpacket: 16 [ 234.914054][ T6811] vhci_hcd vhci_hcd.0: Device attached [ 234.957055][ T6815] vhci_hcd vhci_hcd.0: pdev(4) rhport(1) sockfd(12) [ 234.963817][ T6815] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 234.971863][ T21] vhci_hcd: vhci_device speed not set [ 234.990602][ T4296] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 235.000863][ T4296] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 235.027320][ T6815] vhci_hcd vhci_hcd.0: Device attached [ 235.063521][ T6811] vhci_hcd vhci_hcd.0: pdev(4) rhport(2) sockfd(11) [ 235.070224][ T6811] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 235.093434][ T6811] vhci_hcd vhci_hcd.0: Device attached [ 235.107409][ T6811] vhci_hcd vhci_hcd.0: pdev(4) rhport(3) sockfd(14) [ 235.114186][ T6811] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 235.135701][ T6811] vhci_hcd vhci_hcd.0: Device attached [ 235.190684][ T4296] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 235.199814][ T4277] usb 41-1: new low-speed USB device number 2 using vhci_hcd [ 235.234412][ T4296] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 235.238373][ T6811] vhci_hcd vhci_hcd.0: pdev(4) rhport(4) sockfd(17) [ 235.249224][ T6811] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 235.265427][ T4296] usb 1-1: Product: syz [ 235.279871][ T4296] usb 1-1: Manufacturer: syz [ 235.298275][ T4296] usb 1-1: SerialNumber: syz [ 235.310560][ T6811] vhci_hcd vhci_hcd.0: Device attached [ 235.350667][ T6815] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(20) [ 235.357342][ T6815] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 235.418921][ T6811] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 235.430531][ T6815] vhci_hcd vhci_hcd.0: Device attached [ 235.525607][ T6815] vhci_hcd vhci_hcd.0: pdev(4) rhport(6) sockfd(22) [ 235.532377][ T6815] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 235.605327][ T6815] vhci_hcd vhci_hcd.0: Device attached [ 235.619033][ T6826] vhci_hcd: connection closed [ 235.619250][ T6822] vhci_hcd: connection closed [ 235.619395][ T6818] vhci_hcd: connection closed [ 235.626787][ T6820] vhci_hcd: connection closed [ 235.635804][ T6816] vhci_hcd: connection closed [ 235.640801][ T6789] vhci_hcd: stop threads [ 235.650702][ T6813] vhci_hcd: connection reset by peer [ 235.680915][ T4296] usb 1-1: 0:2 : does not exist [ 236.559389][ T6789] vhci_hcd: release socket [ 236.606616][ T4296] usb 1-1: USB disconnect, device number 11 [ 236.629501][ T6789] vhci_hcd: disconnect device [ 236.680638][ T6789] vhci_hcd: stop threads [ 236.715838][ T6830] vhci_hcd: connection closed [ 236.716261][ T6789] vhci_hcd: release socket [ 236.743486][ T6837] device syzkaller0 entered promiscuous mode [ 236.802245][ T6789] vhci_hcd: disconnect device [ 236.906008][ T6789] vhci_hcd: stop threads [ 236.915190][ T6789] vhci_hcd: release socket [ 236.924940][ T6789] vhci_hcd: disconnect device [ 236.932997][ T6789] vhci_hcd: stop threads [ 236.937688][ T6789] vhci_hcd: release socket [ 236.948528][ T6789] vhci_hcd: disconnect device [ 236.971460][ T6789] vhci_hcd: stop threads [ 236.978100][ T6789] vhci_hcd: release socket [ 237.063824][ T4175] udevd[4175]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 237.398110][ T6789] vhci_hcd: disconnect device [ 237.459678][ T6789] vhci_hcd: stop threads [ 237.760446][ T6789] vhci_hcd: release socket [ 237.765121][ T6789] vhci_hcd: disconnect device [ 237.770057][ T6789] vhci_hcd: stop threads [ 237.774737][ T6789] vhci_hcd: release socket [ 237.821495][ T6789] vhci_hcd: disconnect device [ 238.141834][ T6862] loop0: detected capacity change from 0 to 512 [ 238.340741][ T4296] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 238.522562][ T4296] hid-generic 0000:0000:0000.0004: hidraw0: HID v0.00 Device [syz1] on syz0 [ 239.050418][ T6862] EXT4-fs error (device loop0): ext4_orphan_get:1400: inode #15: comm syz.0.738: inode has both inline data and extents flags [ 239.489761][ T6871] fido_id[6871]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 239.701165][ T6862] EXT4-fs error (device loop0): ext4_orphan_get:1405: comm syz.0.738: couldn't read orphan inode 15 (err -117) [ 241.180807][ T4277] vhci_hcd: vhci_device speed not set [ 241.451762][ T6862] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 242.320503][ T4233] usb usb42-port1: Cannot enable. Maybe the USB cable is bad? [ 242.674814][ T6887] device syzkaller0 entered promiscuous mode [ 242.760449][ T6885] netlink: 8 bytes leftover after parsing attributes in process `syz.2.741'. [ 242.856851][ T6892] loop0: detected capacity change from 0 to 2048 [ 242.986733][ T4233] usb usb42-port1: Cannot enable. Maybe the USB cable is bad? [ 242.995754][ T4233] usb usb42-port1: attempt power cycle [ 243.849971][ T6892] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 244.062878][ T6906] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(9) [ 244.069520][ T6906] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 244.090511][ T4233] usb usb42-port1: Cannot enable. Maybe the USB cable is bad? [ 244.136298][ T6908] loop4: detected capacity change from 0 to 4096 [ 244.193273][ T6908] EXT4-fs (loop4): Quota format mount options ignored when QUOTA feature is enabled [ 244.263973][ T6908] EXT4-fs warning (device loop4): ext4_enable_quotas:6486: Failed to enable quota tracking (type=1, err=-13, ino=4). Please run e2fsck to fix. [ 244.305023][ T6908] EXT4-fs (loop4): mount failed [ 244.334975][ T6906] vhci_hcd vhci_hcd.0: Device attached [ 244.388975][ T26] audit: type=1800 audit(1769957863.163:120): pid=6892 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.743" name="file1" dev="loop0" ino=1346 res=0 errno=0 [ 244.521856][ T6914] vhci_hcd vhci_hcd.0: pdev(2) rhport(1) sockfd(12) [ 244.528528][ T6914] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 244.610489][ T5080] usb 37-1: new low-speed USB device number 2 using vhci_hcd [ 244.701985][ T6915] vhci_hcd vhci_hcd.0: pdev(2) rhport(2) sockfd(15) [ 244.708676][ T6915] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 244.970150][ T6914] vhci_hcd vhci_hcd.0: Device attached [ 245.070904][ T6915] vhci_hcd vhci_hcd.0: Device attached [ 245.117247][ T6906] vhci_hcd vhci_hcd.0: pdev(2) rhport(3) sockfd(11) [ 245.124339][ T6906] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 245.132418][ T6906] vhci_hcd vhci_hcd.0: Device attached [ 245.191406][ T6928] tmpfs: Unknown parameter 'usrquota' [ 245.260438][ T6909] vhci_hcd: connection reset by peer [ 245.266242][ T6916] vhci_hcd: connection closed [ 245.266456][ T6917] vhci_hcd: connection closed [ 245.274764][ T6928] loop1: detected capacity change from 0 to 8 [ 245.290784][ T6922] vhci_hcd: connection closed [ 245.300335][ T6878] vhci_hcd: stop threads [ 245.345185][ T6878] vhci_hcd: release socket [ 245.356247][ T6878] vhci_hcd: disconnect device [ 245.361799][ T4233] usb usb42-port1: Cannot enable. Maybe the USB cable is bad? [ 245.390732][ T4233] usb usb42-port1: unable to enumerate USB device [ 245.410788][ T6878] vhci_hcd: stop threads [ 245.415107][ T6878] vhci_hcd: release socket [ 245.419638][ T6878] vhci_hcd: disconnect device [ 245.430737][ T6878] vhci_hcd: stop threads [ 245.435820][ T6878] vhci_hcd: release socket [ 245.443712][ T6878] vhci_hcd: disconnect device [ 245.475557][ T6928] unable to read id index table [ 245.498028][ T6878] vhci_hcd: stop threads [ 245.770592][ T6878] vhci_hcd: release socket [ 245.809829][ T6878] vhci_hcd: disconnect device [ 246.018946][ T4256] libceph: connect (1)[c::]:6789 error -101 [ 246.825108][ T4256] libceph: mon0 (1)[c::]:6789 connect error [ 247.704765][ T4256] libceph: connect (1)[c::]:6789 error -101 [ 247.878108][ T6938] ceph: No mds server is up or the cluster is laggy [ 247.897799][ T4256] libceph: mon0 (1)[c::]:6789 connect error [ 248.757575][ T6963] device syzkaller0 entered promiscuous mode [ 248.978866][ T6970] loop3: detected capacity change from 0 to 4096 [ 249.140852][ T4256] libceph: connect (1)[c::]:6789 error -101 [ 249.288502][ T4256] libceph: mon0 (1)[c::]:6789 connect error [ 249.713666][ T6970] EXT4-fs (loop3): Quota format mount options ignored when QUOTA feature is enabled [ 249.750442][ T5080] vhci_hcd: vhci_device speed not set [ 250.309812][ T6970] EXT4-fs warning (device loop3): ext4_enable_quotas:6486: Failed to enable quota tracking (type=1, err=-13, ino=4). Please run e2fsck to fix. [ 250.372285][ T6986] loop1: detected capacity change from 0 to 512 [ 250.380619][ T6970] EXT4-fs (loop3): mount failed [ 250.989085][ T6986] EXT4-fs error (device loop1): ext4_orphan_get:1400: inode #15: comm syz.1.767: inode has both inline data and extents flags [ 251.013966][ T6986] EXT4-fs error (device loop1): ext4_orphan_get:1405: comm syz.1.767: couldn't read orphan inode 15 (err -117) [ 251.104548][ T6986] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 251.352133][ T7006] loop2: detected capacity change from 0 to 1024 [ 252.643290][ T4363] hfsplus: b-tree write err: -5, ino 3 [ 255.285589][ T7021] loop2: detected capacity change from 0 to 4096 [ 255.450391][ T7021] EXT4-fs (loop2): Quota format mount options ignored when QUOTA feature is enabled [ 255.765028][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.771536][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.459122][ T7021] EXT4-fs warning (device loop2): ext4_enable_quotas:6486: Failed to enable quota tracking (type=1, err=-13, ino=4). Please run e2fsck to fix. [ 256.499333][ T7021] EXT4-fs (loop2): mount failed [ 256.511432][ T7034] device syzkaller0 entered promiscuous mode [ 258.436118][ T7067] loop1: detected capacity change from 0 to 1024 [ 258.520202][ T7067] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (51269!=20869) [ 258.555613][ T7067] EXT4-fs error (device loop1): ext4_get_journal_inode:5185: inode #32: comm syz.1.786: iget: special inode unallocated [ 258.580357][ T7071] loop3: detected capacity change from 0 to 256 [ 258.614943][ T7067] EXT4-fs (loop1): no journal found [ 258.620212][ T7067] EXT4-fs (loop1): can't get journal size [ 258.641882][ T7071] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 258.687289][ T7067] EXT4-fs (loop1): filesystem is read-only [ 258.693938][ T7067] EXT4-fs (loop1): mounted filesystem without journal. Opts: errors=remount-ro,noload,noblock_validity,bsdgroups,norecovery,. Quota mode: none. [ 259.152601][ T7078] device syzkaller0 entered promiscuous mode [ 259.750341][ T7085] netlink: 8 bytes leftover after parsing attributes in process `syz.1.791'. [ 260.522942][ T7090] device syzkaller0 entered promiscuous mode [ 261.375579][ T7100] loop4: detected capacity change from 0 to 512 [ 261.743002][ T7100] EXT4-fs error (device loop4): ext4_orphan_get:1400: inode #15: comm syz.4.796: inode has both inline data and extents flags [ 262.212410][ T7100] EXT4-fs error (device loop4): ext4_orphan_get:1405: comm syz.4.796: couldn't read orphan inode 15 (err -117) [ 262.324908][ T7100] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 263.042043][ T7130] fuse: Bad value for 'fd' [ 266.183674][ T7137] device syzkaller0 entered promiscuous mode [ 267.543055][ T7152] device syzkaller0 entered promiscuous mode [ 268.307614][ T7187] loop4: detected capacity change from 0 to 512 [ 270.377127][ T7187] EXT4-fs error (device loop4): ext4_orphan_get:1400: inode #15: comm syz.4.816: inode has both inline data and extents flags [ 270.407267][ T7187] EXT4-fs error (device loop4): ext4_orphan_get:1405: comm syz.4.816: couldn't read orphan inode 15 (err -117) [ 270.434369][ T7213] device syzkaller0 entered promiscuous mode [ 270.464995][ T7187] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 271.415218][ T7230] device syzkaller0 entered promiscuous mode [ 274.150289][ C0] sched: RT throttling activated [ 275.052750][ T7265] netlink: 8 bytes leftover after parsing attributes in process `syz.0.837'. [ 276.239375][ T7273] loop2: detected capacity change from 0 to 4096 [ 276.474376][ T7273] EXT4-fs (loop2): Quota format mount options ignored when QUOTA feature is enabled [ 277.186562][ T5080] libceph: connect (1)[c::]:6789 error -101 [ 277.193193][ T5080] libceph: mon0 (1)[c::]:6789 connect error [ 277.296874][ T7280] ceph: No mds server is up or the cluster is laggy [ 277.876857][ T5080] libceph: connect (1)[c::]:6789 error -101 [ 277.889319][ T7273] EXT4-fs warning (device loop2): ext4_enable_quotas:6486: Failed to enable quota tracking (type=1, err=-13, ino=4). Please run e2fsck to fix. [ 277.934612][ T5080] libceph: mon0 (1)[c::]:6789 connect error [ 278.063356][ T7308] loop3: detected capacity change from 0 to 1024 [ 278.485767][ T5080] libceph: connect (1)[c::]:6789 error -101 [ 278.501510][ T7309] PKCS7: Unknown OID: [4] 0.38.35.41.951690.11253 [ 278.507985][ T7309] PKCS7: Only support pkcs7_signedData type [ 278.522670][ T5080] libceph: mon0 (1)[c::]:6789 connect error [ 278.574484][ T7273] EXT4-fs (loop2): mount failed [ 278.602933][ T5289] hfsplus: b-tree write err: -5, ino 3 [ 278.907303][ T7320] device syzkaller0 entered promiscuous mode [ 279.020512][ T21] usb 4-1: new low-speed USB device number 5 using dummy_hcd [ 279.131281][ T7328] device syzkaller0 entered promiscuous mode [ 279.349983][ T7341] netlink: 8 bytes leftover after parsing attributes in process `syz.4.853'. [ 279.390524][ T21] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 279.398002][ T21] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 279.440553][ T21] usb 4-1: config 168 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 279.560454][ T21] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 279.572573][ T21] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 279.630865][ T21] usb 4-1: config 168 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 279.897440][ T21] usb 4-1: config 168 descriptor has 1 excess byte, ignoring [ 279.905019][ T21] usb 4-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 279.916308][ T21] usb 4-1: config 168 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 282.158811][ T21] usb 4-1: string descriptor 0 read error: -71 [ 282.187745][ T21] usb 4-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 282.332515][ T21] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 282.385840][ T21] usb 4-1: can't set config #168, error -71 [ 282.395392][ T21] usb 4-1: USB disconnect, device number 5 [ 283.406545][ T7387] loop3: detected capacity change from 0 to 4096 [ 283.459716][ T7387] EXT4-fs (loop3): Quota format mount options ignored when QUOTA feature is enabled [ 283.577687][ T7387] EXT4-fs warning (device loop3): ext4_enable_quotas:6486: Failed to enable quota tracking (type=1, err=-13, ino=4). Please run e2fsck to fix. [ 283.625039][ T7387] EXT4-fs (loop3): mount failed [ 285.035507][ T7401] device syzkaller0 entered promiscuous mode [ 285.208468][ T7414] device syzkaller0 entered promiscuous mode [ 285.312579][ T7425] netlink: 8 bytes leftover after parsing attributes in process `syz.4.867'. [ 289.042140][ T7461] device syzkaller0 entered promiscuous mode [ 289.278226][ T7467] loop3: detected capacity change from 0 to 4096 [ 289.330549][ T7467] EXT4-fs (loop3): Quota format mount options ignored when QUOTA feature is enabled [ 289.413951][ T7467] EXT4-fs warning (device loop3): ext4_enable_quotas:6486: Failed to enable quota tracking (type=1, err=-13, ino=4). Please run e2fsck to fix. [ 289.435804][ T7467] EXT4-fs (loop3): mount failed [ 290.211137][ T7472] device syzkaller0 entered promiscuous mode [ 290.398691][ T7486] netlink: 8 bytes leftover after parsing attributes in process `syz.1.881'. [ 290.409533][ T7484] device syzkaller0 entered promiscuous mode [ 290.445247][ T7481] PKCS7: Unknown OID: [4] 0.38.35.41.951690.11253 [ 290.451980][ T7481] PKCS7: Only support pkcs7_signedData type [ 294.116509][ T7527] loop0: detected capacity change from 0 to 4096 [ 295.004145][ T7527] EXT4-fs (loop0): Quota format mount options ignored when QUOTA feature is enabled [ 295.074249][ T7527] EXT4-fs warning (device loop0): ext4_enable_quotas:6486: Failed to enable quota tracking (type=1, err=-13, ino=4). Please run e2fsck to fix. [ 295.107141][ T7527] EXT4-fs (loop0): mount failed [ 295.304273][ T7535] device syzkaller0 entered promiscuous mode [ 295.500041][ T7542] device syzkaller0 entered promiscuous mode [ 295.737962][ T7557] device syzkaller0 entered promiscuous mode [ 295.779878][ T7559] netlink: 8 bytes leftover after parsing attributes in process `syz.2.897'. [ 298.146566][ T7602] device syzkaller0 entered promiscuous mode [ 298.156247][ T7607] device syzkaller0 entered promiscuous mode [ 298.169387][ T7602] sch_tbf: burst 9 is lower than device syzkaller0 mtu (1514) ! [ 298.178326][ T7605] device syzkaller0 entered promiscuous mode [ 298.334226][ T7613] netlink: 8 bytes leftover after parsing attributes in process `syz.0.910'. [ 298.581483][ T7616] loop3: detected capacity change from 0 to 4096 [ 298.632580][ T7616] EXT4-fs (loop3): Quota format mount options ignored when QUOTA feature is enabled [ 298.686787][ T7616] EXT4-fs warning (device loop3): ext4_enable_quotas:6486: Failed to enable quota tracking (type=1, err=-13, ino=4). Please run e2fsck to fix. [ 298.708863][ T7616] EXT4-fs (loop3): mount failed [ 301.514517][ T7655] PKCS7: Unknown OID: [4] 0.38.35.41.951690.11253 [ 301.521199][ T7655] PKCS7: Only support pkcs7_signedData type [ 303.155968][ T7669] loop1: detected capacity change from 0 to 512 [ 303.216640][ T7669] EXT4-fs error (device loop1): ext4_orphan_get:1400: inode #15: comm syz.1.922: inode has both inline data and extents flags [ 303.308224][ T7669] EXT4-fs error (device loop1): ext4_orphan_get:1405: comm syz.1.922: couldn't read orphan inode 15 (err -117) [ 303.339438][ T7677] device syzkaller0 entered promiscuous mode [ 303.363386][ T7669] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 303.396459][ T7675] device syzkaller0 entered promiscuous mode [ 303.427777][ T7679] device syzkaller0 entered promiscuous mode [ 303.517943][ T7683] sch_tbf: burst 9 is lower than device syzkaller0 mtu (1514) ! [ 303.616444][ T13] libceph: connect (1)[c::]:6789 error -101 [ 303.623034][ T13] libceph: mon0 (1)[c::]:6789 connect error [ 304.285144][ T4256] libceph: connect (1)[c::]:6789 error -101 [ 304.316506][ T4256] libceph: mon0 (1)[c::]:6789 connect error [ 304.401627][ T7681] ceph: No mds server is up or the cluster is laggy [ 306.001591][ T7709] PKCS7: Unknown OID: [4] 0.38.35.41.951690.11253 [ 306.008238][ T7709] PKCS7: Only support pkcs7_signedData type [ 306.911520][ T13] libceph: connect (1)[c::]:6789 error -101 [ 306.918240][ T13] libceph: mon0 (1)[c::]:6789 connect error [ 306.963578][ T4174] libceph: connect (1)[c::]:6789 error -101 [ 306.970993][ T4174] libceph: mon0 (1)[c::]:6789 connect error [ 307.231480][ T4174] libceph: connect (1)[c::]:6789 error -101 [ 307.239646][ T4174] libceph: mon0 (1)[c::]:6789 connect error [ 308.110954][ T7731] loop2: detected capacity change from 0 to 4096 [ 308.160220][ T7731] EXT4-fs (loop2): Quota format mount options ignored when QUOTA feature is enabled [ 308.254178][ T7731] EXT4-fs warning (device loop2): ext4_enable_quotas:6486: Failed to enable quota tracking (type=1, err=-13, ino=4). Please run e2fsck to fix. [ 308.276165][ T7731] EXT4-fs (loop2): mount failed [ 311.055720][ T7757] device syzkaller0 entered promiscuous mode [ 311.077977][ T7757] sch_tbf: burst 9 is lower than device syzkaller0 mtu (1514) ! [ 311.099731][ T7758] device syzkaller0 entered promiscuous mode [ 311.367384][ T7765] loop2: detected capacity change from 0 to 512 [ 313.816039][ T7765] EXT4-fs error (device loop2): ext4_orphan_get:1400: inode #15: comm syz.2.942: inode has both inline data and extents flags [ 313.849773][ T7765] EXT4-fs error (device loop2): ext4_orphan_get:1405: comm syz.2.942: couldn't read orphan inode 15 (err -117) [ 313.884945][ T7765] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 313.947766][ T7788] PKCS7: Unknown OID: [4] 0.38.35.41.951690.11253 [ 313.954360][ T7788] PKCS7: Only support pkcs7_signedData type [ 316.030986][ T7820] loop1: detected capacity change from 0 to 4096 [ 316.049994][ T7820] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 316.167991][ T7820] EXT4-fs warning (device loop1): ext4_enable_quotas:6486: Failed to enable quota tracking (type=1, err=-13, ino=4). Please run e2fsck to fix. [ 316.189286][ T7820] EXT4-fs (loop1): mount failed [ 316.794859][ T7837] device syzkaller0 entered promiscuous mode [ 316.808999][ T7837] sch_tbf: burst 9 is lower than device syzkaller0 mtu (1514) ! [ 317.241849][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.252667][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 319.428178][ T7864] PKCS7: Unknown OID: [4] 0.38.35.41.951690.11253 [ 319.428266][ T7864] PKCS7: Only support pkcs7_signedData type [ 321.225373][ T7895] loop3: detected capacity change from 0 to 4096 [ 321.304146][ T7895] EXT4-fs (loop3): Quota format mount options ignored when QUOTA feature is enabled [ 321.427194][ T7895] EXT4-fs warning (device loop3): ext4_enable_quotas:6486: Failed to enable quota tracking (type=1, err=-13, ino=4). Please run e2fsck to fix. [ 321.474152][ T7895] EXT4-fs (loop3): mount failed [ 321.686966][ T7886] loop1: detected capacity change from 0 to 512 [ 322.048622][ T7886] EXT4-fs error (device loop1): ext4_orphan_get:1400: inode #15: comm syz.1.966: inode has both inline data and extents flags [ 322.062751][ T7886] EXT4-fs error (device loop1): ext4_orphan_get:1405: comm syz.1.966: couldn't read orphan inode 15 (err -117) [ 322.076873][ T7907] device syzkaller0 entered promiscuous mode [ 322.103166][ T7886] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 322.300202][ T7910] device syzkaller0 entered promiscuous mode [ 322.334196][ T7907] sch_tbf: burst 9 is lower than device syzkaller0 mtu (1514) ! [ 324.117147][ T7932] PKCS7: Unknown OID: [4] 0.38.35.41.951690.11253 [ 324.123664][ T7932] PKCS7: Only support pkcs7_signedData type [ 326.564614][ T7955] loop3: detected capacity change from 0 to 512 [ 326.722322][ T7958] loop1: detected capacity change from 0 to 4096 [ 326.731727][ T7955] EXT4-fs error (device loop3): ext4_orphan_get:1400: inode #15: comm syz.3.983: inode has both inline data and extents flags [ 326.779117][ T7958] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 326.820150][ T7955] EXT4-fs error (device loop3): ext4_orphan_get:1405: comm syz.3.983: couldn't read orphan inode 15 (err -117) [ 326.832880][ T7963] device syzkaller0 entered promiscuous mode [ 326.876263][ T7955] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 326.896463][ T7958] EXT4-fs warning (device loop1): ext4_enable_quotas:6486: Failed to enable quota tracking (type=1, err=-13, ino=4). Please run e2fsck to fix. [ 327.092592][ T7958] EXT4-fs (loop1): mount failed [ 327.666881][ T7975] device syzkaller0 entered promiscuous mode [ 327.696785][ T7980] device syzkaller0 entered promiscuous mode [ 328.016411][ T7984] sch_tbf: burst 9 is lower than device syzkaller0 mtu (1514) ! [ 328.038051][ T7990] device syzkaller0 entered promiscuous mode [ 330.320545][ T8016] PKCS7: Unknown OID: [4] 0.38.35.41.951690.11253 [ 330.327088][ T8016] PKCS7: Only support pkcs7_signedData type [ 331.998584][ T8028] loop0: detected capacity change from 0 to 4096 [ 333.024905][ T8028] EXT4-fs (loop0): Quota format mount options ignored when QUOTA feature is enabled [ 333.118623][ T8028] EXT4-fs warning (device loop0): ext4_enable_quotas:6486: Failed to enable quota tracking (type=1, err=-13, ino=4). Please run e2fsck to fix. [ 333.140725][ T8028] EXT4-fs (loop0): mount failed [ 333.603585][ T8024] device syzkaller0 entered promiscuous mode [ 333.853457][ T8036] loop3: detected capacity change from 0 to 512 [ 333.920177][ T8036] EXT4-fs error (device loop3): ext4_orphan_get:1400: inode #15: comm syz.3.1001: inode has both inline data and extents flags [ 333.976340][ T8036] EXT4-fs error (device loop3): ext4_orphan_get:1405: comm syz.3.1001: couldn't read orphan inode 15 (err -117) [ 333.989188][ T8036] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 334.745851][ T8059] device syzkaller0 entered promiscuous mode [ 334.790890][ T8047] device syzkaller0 entered promiscuous mode [ 336.492302][ T8086] PKCS7: Unknown OID: [4] 0.38.35.41.951690.11253 [ 336.498870][ T8086] PKCS7: Only support pkcs7_signedData type [ 339.448003][ T8106] loop1: detected capacity change from 0 to 4096 [ 339.486632][ T8106] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 339.595343][ T8106] EXT4-fs warning (device loop1): ext4_enable_quotas:6486: Failed to enable quota tracking (type=1, err=-13, ino=4). Please run e2fsck to fix. [ 339.615633][ T8106] EXT4-fs (loop1): mount failed [ 339.784202][ T8094] device syzkaller0 entered promiscuous mode [ 340.277916][ T8116] device syzkaller0 entered promiscuous mode [ 340.342257][ T8117] device syzkaller0 entered promiscuous mode [ 340.585468][ T8131] loop4: detected capacity change from 0 to 512 [ 340.873930][ T8131] EXT4-fs error (device loop4): ext4_orphan_get:1400: inode #15: comm syz.4.1023: inode has both inline data and extents flags [ 341.041070][ T8131] EXT4-fs error (device loop4): ext4_orphan_get:1405: comm syz.4.1023: couldn't read orphan inode 15 (err -117) [ 341.078021][ T8131] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 342.748244][ T8156] PKCS7: Unknown OID: [4] 0.38.35.41.951690.11253 [ 342.754837][ T8156] PKCS7: Only support pkcs7_signedData type [ 343.950821][ T8173] loop0: detected capacity change from 0 to 4096 [ 344.047979][ T8173] EXT4-fs (loop0): Quota format mount options ignored when QUOTA feature is enabled [ 345.009844][ T8173] EXT4-fs warning (device loop0): ext4_enable_quotas:6486: Failed to enable quota tracking (type=1, err=-13, ino=4). Please run e2fsck to fix. [ 345.033681][ T8173] EXT4-fs (loop0): mount failed [ 346.009601][ T8179] device syzkaller0 entered promiscuous mode [ 346.046266][ T8184] device syzkaller0 entered promiscuous mode [ 346.618337][ T8212] loop4: detected capacity change from 0 to 512 [ 347.883697][ T8218] PKCS7: Unknown OID: [4] 0.38.35.41.951690.11253 [ 347.890278][ T8218] PKCS7: Only support pkcs7_signedData type [ 348.211718][ T8212] EXT4-fs error (device loop4): ext4_orphan_get:1400: inode #15: comm syz.4.1041: inode has both inline data and extents flags [ 348.250145][ T8212] EXT4-fs error (device loop4): ext4_orphan_get:1405: comm syz.4.1041: couldn't read orphan inode 15 (err -117) [ 348.303556][ T8212] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 349.657985][ T8241] device syzkaller0 entered promiscuous mode [ 349.775987][ T8255] device syzkaller0 entered promiscuous mode [ 350.118513][ T8263] device syzkaller0 entered promiscuous mode [ 350.476612][ T8280] loop0: detected capacity change from 0 to 4096 [ 350.532989][ T8280] EXT4-fs (loop0): Quota format mount options ignored when QUOTA feature is enabled [ 350.601427][ T8280] EXT4-fs warning (device loop0): ext4_enable_quotas:6486: Failed to enable quota tracking (type=1, err=-13, ino=4). Please run e2fsck to fix. [ 350.627454][ T8280] EXT4-fs (loop0): mount failed [ 351.467862][ T8290] PKCS7: Unknown OID: [4] 0.38.35.41.951690.11253 [ 351.474345][ T8290] PKCS7: Only support pkcs7_signedData type [ 353.657483][ T8327] device syzkaller0 entered promiscuous mode [ 353.744395][ T8340] device syzkaller0 entered promiscuous mode [ 353.762213][ T8335] loop4: detected capacity change from 0 to 512 [ 353.957650][ T8335] EXT4-fs error (device loop4): ext4_orphan_get:1400: inode #15: comm syz.4.1069: inode has both inline data and extents flags [ 353.976099][ T8335] EXT4-fs error (device loop4): ext4_orphan_get:1405: comm syz.4.1069: couldn't read orphan inode 15 (err -117) [ 353.997573][ T8335] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 355.590410][ T8358] loop1: detected capacity change from 0 to 4096 [ 355.793271][ T8358] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 356.590175][ T8358] EXT4-fs warning (device loop1): ext4_enable_quotas:6486: Failed to enable quota tracking (type=1, err=-13, ino=4). Please run e2fsck to fix. [ 356.611418][ T8358] EXT4-fs (loop1): mount failed [ 357.279714][ T8371] loop4: detected capacity change from 0 to 40427 [ 357.365054][ T8371] F2FS-fs (loop4): Invalid log blocks per segment (4278190089) [ 357.372873][ T8371] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 357.383927][ T8371] F2FS-fs (loop4): invalid crc value [ 357.609480][ T8371] F2FS-fs (loop4): Found nat_bits in checkpoint [ 357.677861][ T8371] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 357.685325][ T8371] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 357.856125][ T8390] F2FS-fs (loop4): Corrupted max_depth of 3: 255 [ 357.896301][ T8390] F2FS-fs (loop4): f2fs_check_nid_range: out-of-range nid=1, run fsck to fix. [ 357.991694][ T8389] F2FS-fs (loop4): f2fs_check_nid_range: out-of-range nid=1, run fsck to fix. [ 358.512196][ T8394] device syzkaller0 entered promiscuous mode [ 358.552872][ T8401] device syzkaller0 entered promiscuous mode [ 358.761243][ T8406] PKCS7: Unknown OID: [4] 0.38.35.41.951690.11253 [ 358.767888][ T8406] PKCS7: Only support pkcs7_signedData type [ 359.353725][ T8416] IPv6: ADDRCONF(NETDEV_CHANGE): bpq0: link becomes ready [ 359.433719][ T8415] ================================================================== [ 359.442464][ T8415] BUG: KASAN: use-after-free in ax25_release+0x5ca/0x870 [ 359.449536][ T8415] Read of size 8 at addr ffff88802a7ac808 by task syz.0.1086/8415 [ 359.457363][ T8415] [ 359.459733][ T8415] CPU: 0 PID: 8415 Comm: syz.0.1086 Not tainted syzkaller #0 [ 359.467219][ T8415] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 359.477404][ T8415] Call Trace: [ 359.480712][ T8415] [ 359.483684][ T8415] dump_stack_lvl+0x188/0x250 [ 359.488405][ T8415] ? show_regs_print_info+0x20/0x20 [ 359.493633][ T8415] ? _printk+0xda/0x130 [ 359.497823][ T8415] ? ax25_release+0x5ca/0x870 [ 359.502543][ T8415] ? load_image+0x400/0x400 [ 359.507086][ T8415] print_address_description+0x60/0x2d0 [ 359.512669][ T8415] ? ax25_release+0x5ca/0x870 [ 359.517372][ T8415] kasan_report+0xdf/0x130 [ 359.521854][ T8415] ? ax25_release+0x5ca/0x870 [ 359.526564][ T8415] ax25_release+0x5ca/0x870 [ 359.531145][ T8415] sock_close+0xd5/0x240 [ 359.535425][ T8415] ? sock_mmap+0x90/0x90 [ 359.539698][ T8415] __fput+0x234/0x930 [ 359.543748][ T8415] task_work_run+0x125/0x1a0 [ 359.548375][ T8415] exit_to_user_mode_loop+0x10f/0x130 [ 359.553899][ T8415] exit_to_user_mode_prepare+0xee/0x180 [ 359.559519][ T8415] syscall_exit_to_user_mode+0x16/0x40 [ 359.565026][ T8415] do_syscall_64+0x58/0xa0 [ 359.569509][ T8415] ? clear_bhb_loop+0x30/0x80 [ 359.574223][ T8415] ? clear_bhb_loop+0x30/0x80 [ 359.578943][ T8415] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 359.584897][ T8415] RIP: 0033:0x7f78d6c39eb9 [ 359.589355][ T8415] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 359.609115][ T8415] RSP: 002b:00007ffdd69ddf98 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 359.617587][ T8415] RAX: 0000000000000000 RBX: 00007ffdd69de080 RCX: 00007f78d6c39eb9 [ 359.625603][ T8415] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 359.633606][ T8415] RBP: 0000000000057b89 R08: 0000000000000001 R09: 0000000000000000 [ 359.641603][ T8415] R10: 0000001b31420000 R11: 0000000000000246 R12: 00007ffdd69de0c0 [ 359.649601][ T8415] R13: 00007f78d6eb4fac R14: 0000000000057c0b R15: 00007f78d6eb4fa0 [ 359.657620][ T8415] [ 359.660669][ T8415] [ 359.663056][ T8415] Allocated by task 8416: [ 359.667401][ T8415] __kasan_kmalloc+0xb5/0xf0 [ 359.672133][ T8415] ax25_dev_device_up+0x50/0x580 [ 359.677108][ T8415] ax25_device_event+0x483/0x4f0 [ 359.682073][ T8415] raw_notifier_call_chain+0xcb/0x160 [ 359.687474][ T8415] __dev_notify_flags+0x194/0x300 [ 359.692614][ T8415] dev_change_flags+0xe3/0x1a0 [ 359.697430][ T8415] dev_ifsioc+0x130/0xd50 [ 359.701789][ T8415] dev_ioctl+0x545/0xe30 [ 359.706057][ T8415] sock_do_ioctl+0x245/0x320 [ 359.710684][ T8415] sock_ioctl+0x4d2/0x710 [ 359.715165][ T8415] __se_sys_ioctl+0xfa/0x170 [ 359.719955][ T8415] do_syscall_64+0x4c/0xa0 [ 359.724408][ T8415] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 359.730328][ T8415] [ 359.732672][ T8415] Freed by task 8416: [ 359.736755][ T8415] kasan_set_track+0x4b/0x70 [ 359.741381][ T8415] kasan_set_free_info+0x1f/0x40 [ 359.746351][ T8415] ____kasan_slab_free+0xd5/0x110 [ 359.751404][ T8415] slab_free_freelist_hook+0xea/0x170 [ 359.756808][ T8415] kfree+0xef/0x2a0 [ 359.760636][ T8415] ax25_device_event+0x4b4/0x4f0 [ 359.765595][ T8415] raw_notifier_call_chain+0xcb/0x160 [ 359.771092][ T8415] __dev_notify_flags+0x158/0x300 [ 359.776145][ T8415] dev_change_flags+0xe3/0x1a0 [ 359.780932][ T8415] dev_ifsioc+0x130/0xd50 [ 359.785288][ T8415] dev_ioctl+0x545/0xe30 [ 359.789559][ T8415] sock_do_ioctl+0x245/0x320 [ 359.794195][ T8415] sock_ioctl+0x4d2/0x710 [ 359.798553][ T8415] __se_sys_ioctl+0xfa/0x170 [ 359.803170][ T8415] do_syscall_64+0x4c/0xa0 [ 359.807608][ T8415] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 359.813660][ T8415] [ 359.816011][ T8415] Last potentially related work creation: [ 359.821930][ T8415] kasan_save_stack+0x35/0x60 [ 359.826651][ T8415] kasan_record_aux_stack+0xb8/0x100 [ 359.831958][ T8415] insert_work+0x54/0x3d0 [ 359.836327][ T8415] __queue_work+0x9c5/0xd50 [ 359.840944][ T8415] queue_work_on+0x124/0x1f0 [ 359.845662][ T8415] netdevice_event+0x803/0x900 [ 359.850496][ T8415] raw_notifier_call_chain+0xcb/0x160 [ 359.855998][ T8415] unregister_netdevice_many+0x1049/0x19f0 [ 359.861841][ T8415] unregister_netdevice_queue+0x324/0x370 [ 359.867691][ T8415] __tun_detach+0xd4a/0x1500 [ 359.872309][ T8415] tun_chr_close+0x109/0x1b0 [ 359.876927][ T8415] __fput+0x234/0x930 [ 359.880936][ T8415] task_work_run+0x125/0x1a0 [ 359.885554][ T8415] exit_to_user_mode_loop+0x10f/0x130 [ 359.891038][ T8415] exit_to_user_mode_prepare+0xee/0x180 [ 359.896637][ T8415] syscall_exit_to_user_mode+0x16/0x40 [ 359.902122][ T8415] do_syscall_64+0x58/0xa0 [ 359.906566][ T8415] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 359.912481][ T8415] [ 359.914820][ T8415] Second to last potentially related work creation: [ 359.921509][ T8415] kasan_save_stack+0x35/0x60 [ 359.926211][ T8415] kasan_record_aux_stack+0xb8/0x100 [ 359.931535][ T8415] insert_work+0x54/0x3d0 [ 359.935895][ T8415] __queue_work+0x9c5/0xd50 [ 359.940434][ T8415] queue_work_on+0x124/0x1f0 [ 359.945047][ T8415] netdevice_event+0x803/0x900 [ 359.949840][ T8415] raw_notifier_call_chain+0xcb/0x160 [ 359.955265][ T8415] call_netdevice_notifiers+0x8d/0xd0 [ 359.960670][ T8415] __bond_release_one+0xa37/0x11c0 [ 359.965808][ T8415] do_setlink+0xf17/0x3d60 [ 359.970258][ T8415] rtnl_newlink+0xf8d/0x1a50 [ 359.974881][ T8415] rtnetlink_rcv_msg+0x844/0xf30 [ 359.979845][ T8415] netlink_rcv_skb+0x1f5/0x440 [ 359.984635][ T8415] netlink_unicast+0x774/0x920 [ 359.989428][ T8415] netlink_sendmsg+0x8ba/0xbe0 [ 359.994242][ T8415] ____sys_sendmsg+0x5b7/0x8f0 [ 359.999383][ T8415] ___sys_sendmsg+0x236/0x2e0 [ 360.004090][ T8415] __se_sys_sendmsg+0x1af/0x290 [ 360.008976][ T8415] do_syscall_64+0x4c/0xa0 [ 360.013425][ T8415] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 360.019352][ T8415] [ 360.021696][ T8415] The buggy address belongs to the object at ffff88802a7ac800 [ 360.021696][ T8415] which belongs to the cache kmalloc-192 of size 192 [ 360.035874][ T8415] The buggy address is located 8 bytes inside of [ 360.035874][ T8415] 192-byte region [ffff88802a7ac800, ffff88802a7ac8c0) [ 360.049017][ T8415] The buggy address belongs to the page: [ 360.054686][ T8415] page:ffffea0000a9eb00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a7ac [ 360.065012][ T8415] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 360.072600][ T8415] raw: 00fff00000000200 0000000000000000 0000000a00000001 ffff888016c41a00 [ 360.081210][ T8415] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 360.089824][ T8415] page dumped because: kasan: bad access detected [ 360.096270][ T8415] page_owner tracks the page as allocated [ 360.102003][ T8415] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 4185, ts 77547236560, free_ts 77513393570 [ 360.118016][ T8415] get_page_from_freelist+0x1bbd/0x1ca0 [ 360.123605][ T8415] __alloc_pages+0x1ee/0x480 [ 360.128240][ T8415] new_slab+0xb6/0x4b0 [ 360.132348][ T8415] ___slab_alloc+0x80a/0xdd0 [ 360.136982][ T8415] __kmalloc_node+0x200/0x3b0 [ 360.141692][ T8415] memcg_alloc_page_obj_cgroups+0x81/0x120 [ 360.147570][ T8415] slab_post_alloc_hook+0xba/0x380 [ 360.152712][ T8415] kmem_cache_alloc+0x100/0x290 [ 360.157586][ T8415] __d_alloc+0x2a/0x6f0 [ 360.161806][ T8415] d_alloc_cursor+0x40/0xd0 [ 360.166337][ T8415] dcache_dir_open+0x37/0x70 [ 360.170951][ T8415] do_dentry_open+0x7ff/0xf80 [ 360.175663][ T8415] path_openat+0x26f5/0x2fa0 [ 360.180282][ T8415] do_filp_open+0x1e2/0x410 [ 360.184816][ T8415] do_sys_openat2+0x150/0x4b0 [ 360.189733][ T8415] __x64_sys_openat+0x135/0x160 [ 360.194714][ T8415] page last free stack trace: [ 360.199559][ T8415] free_unref_page_prepare+0x637/0x6c0 [ 360.205073][ T8415] free_unref_page+0x8f/0x2a0 [ 360.209871][ T8415] qlist_free_all+0x35/0x90 [ 360.214476][ T8415] kasan_quarantine_reduce+0x150/0x160 [ 360.219962][ T8415] __kasan_slab_alloc+0x2f/0xd0 [ 360.224839][ T8415] slab_post_alloc_hook+0x4c/0x380 [ 360.229574][ T8417] loop3: detected capacity change from 0 to 512 [ 360.230119][ T8415] kmem_cache_alloc+0x100/0x290 [ 360.241250][ T8415] __d_alloc+0x2a/0x6f0 [ 360.245440][ T8415] d_alloc_parallel+0x7b/0x1330 [ 360.250318][ T8415] __lookup_slow+0x134/0x410 [ 360.254953][ T8415] lookup_one_len+0x19d/0x2d0 [ 360.259661][ T8415] start_creating+0x184/0x310 [ 360.264375][ T8415] debugfs_create_dir+0x24/0x4b0 [ 360.269348][ T8415] ieee80211_debugfs_add_netdev+0x127/0xed0 [ 360.275271][ T8415] ieee80211_if_change_type+0x1fa/0x9c0 [ 360.280943][ T8415] ieee80211_change_iface+0x57/0x420 [ 360.286264][ T8415] [ 360.288616][ T8415] Memory state around the buggy address: [ 360.294274][ T8415] ffff88802a7ac700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 360.302369][ T8415] ffff88802a7ac780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 360.310566][ T8415] >ffff88802a7ac800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 360.318682][ T8415] ^ [ 360.323045][ T8415] ffff88802a7ac880: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 360.331173][ T8415] ffff88802a7ac900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 360.339255][ T8415] ================================================================== [ 360.347438][ T8415] Disabling lock debugging due to kernel taint [ 360.434132][ T8420] device syzkaller0 entered promiscuous mode [ 360.482264][ T8415] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 360.489513][ T8415] CPU: 1 PID: 8415 Comm: syz.0.1086 Tainted: G B syzkaller #0 [ 360.498317][ T8415] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 360.507175][ T8417] EXT4-fs error (device loop3): ext4_orphan_get:1400: inode #15: comm syz.3.1085: inode has both inline data and extents flags [ 360.508404][ T8415] Call Trace: [ 360.508414][ T8415] [ 360.508423][ T8415] dump_stack_lvl+0x188/0x250 [ 360.532757][ T8415] ? show_regs_print_info+0x20/0x20 [ 360.538096][ T8415] ? load_image+0x400/0x400 [ 360.542657][ T8415] panic+0x2e5/0x810 [ 360.546592][ T8415] ? bpf_jit_dump+0xd0/0xd0 [ 360.551147][ T8415] ? _raw_spin_unlock_irqrestore+0x10d/0x120 [ 360.557300][ T8415] ? _raw_spin_unlock+0x40/0x40 [ 360.562201][ T8415] ? print_memory_metadata+0x314/0x400 [ 360.567721][ T8415] ? ax25_release+0x5ca/0x870 [ 360.572526][ T8415] check_panic_on_warn+0x80/0xa0 [ 360.577511][ T8415] ? ax25_release+0x5ca/0x870 [ 360.582237][ T8415] end_report+0x6d/0xf0 [ 360.586437][ T8415] kasan_report+0x102/0x130 [ 360.588514][ T8417] EXT4-fs error (device loop3): ext4_orphan_get:1405: comm syz.3.1085: couldn't read orphan inode 15 (err -117) [ 360.591020][ T8415] ? ax25_release+0x5ca/0x870 [ 360.591046][ T8415] ax25_release+0x5ca/0x870 [ 360.591068][ T8415] sock_close+0xd5/0x240 [ 360.591092][ T8415] ? sock_mmap+0x90/0x90 [ 360.591112][ T8415] __fput+0x234/0x930 [ 360.624882][ T8415] task_work_run+0x125/0x1a0 [ 360.629607][ T8415] exit_to_user_mode_loop+0x10f/0x130 [ 360.635020][ T8415] exit_to_user_mode_prepare+0xee/0x180 [ 360.640609][ T8415] syscall_exit_to_user_mode+0x16/0x40 [ 360.646108][ T8415] do_syscall_64+0x58/0xa0 [ 360.649470][ T8417] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 360.650552][ T8415] ? clear_bhb_loop+0x30/0x80 [ 360.650577][ T8415] ? clear_bhb_loop+0x30/0x80 [ 360.650597][ T8415] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 360.650617][ T8415] RIP: 0033:0x7f78d6c39eb9 [ 360.650636][ T8415] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 360.650652][ T8415] RSP: 002b:00007ffdd69ddf98 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 360.709546][ T8415] RAX: 0000000000000000 RBX: 00007ffdd69de080 RCX: 00007f78d6c39eb9 [ 360.717564][ T8415] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 360.725576][ T8415] RBP: 0000000000057b89 R08: 0000000000000001 R09: 0000000000000000 [ 360.733584][ T8415] R10: 0000001b31420000 R11: 0000000000000246 R12: 00007ffdd69de0c0 [ 360.741631][ T8415] R13: 00007f78d6eb4fac R14: 0000000000057c0b R15: 00007f78d6eb4fa0 [ 360.749742][ T8415] [ 360.753172][ T8415] Kernel Offset: disabled [ 360.757524][ T8415] Rebooting in 86400 seconds..